Refresh all project docs: lifecycle, security, capability matrix, indexes

The docs lagged the code: Sphinx indexes stopped at v181 while v182-v223
existed, the Actions-menu redesign was undocumented outside WHATS_NEW,
and the project had no security policy, changelog, API lifecycle, or
honest platform-support statement. Adds all four, documents the menu-
driven GUI (v223 EN/Zh), syncs the three READMEs and WHATS_NEW files,
and records the Actions-menu tab contract in CLAUDE.md.

Author: JE-Chen

CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+This file records user-visible compatibility changes. Detailed development
+notes remain in `WHATS_NEW.md`.
+
+The format follows Keep a Changelog. Until 1.0, breaking changes are permitted
+only when documented here with a migration path.
+
+## Unreleased
+
+### Added
+
+- Stable, headless `je_auto_control.api` façade.
+- Portable `autocontrol.failure-bundle/v1` diagnostic archives and CLI command.
+- Public API lifecycle, capability matrix, security policy, coverage and type
+  checking configuration.
+
+### Changed
+
+- Releases are prepared from version tags and use PyPI Trusted Publishing.
+
+### Deprecated
+
+- New integrations should avoid the eager, historical top-level import surface
+  and import stable entry points from `je_auto_control.api`.

CLAUDE.md

@@ -84,6 +84,7 @@ No feature is complete unless it can be driven entirely without the GUI **and**
 - **Re-export from the package facade**: add the public functions / classes to `je_auto_control/__init__.py` and its `__all__` so `import je_auto_control as ac; ac.<feature>(...)` works out of the box.
 - **Executor command coverage**: wire an `AC_*` command into `utils/executor/action_executor.py` so the feature is usable from JSON action files, the socket server, the scheduler, and the visual script builder — all without Python glue.
 - **GUI tab or control is a thin wrapper**: the Qt widget must only translate user input into calls on the headless core. It must not contain business logic that would be unreachable headlessly.
+- **Tab commands live in the Actions menu, not in-tab buttons**: the main window is menu-driven. A tab keeps only its inputs, tables, and result/status views; its commands surface through the window-level **Actions** menu. Core tabs declare `(label_key, handler)` pairs at registration in `gui/main_widget.py`; feature tabs expose a `menu_actions()` method returning the same shape. Script Builder and Remote Desktop are the only exempt tabs (interactive panel layouts). `test/unit_test/headless/test_actions_menu_gui.py` guards this contract — a new tab without registry actions or a `menu_actions()` hook fails CI.
 - **The top-level package stays Qt-free**: `import je_auto_control` MUST NOT import `PySide6`. The GUI entry point is loaded lazily inside `start_autocontrol_gui()`. Verify with:
 
   ```python

README.md

@@ -99,9 +99,10 @@ All per-release notes have moved to **[WHATS_NEW.md](WHATS_NEW.md)**.
 - **WebRTC Packet Inspector** — process-global rolling window of `StatsSnapshot` samples (default 600 / ~10 min @ 1Hz) fed by the existing WebRTC stats pollers. Per-metric `last/min/max/avg/p95` for RTT, FPS, bitrate, packet loss, jitter
 - **USB Device Enumeration** — read-only cross-platform device listing. Tries pyusb (libusb) first; falls back to platform-specific (Windows `Get-PnpDevice`, macOS `system_profiler`, Linux `/sys/bus/usb/devices`). Phase 2 passthrough builds on this (see below)
 - **System Diagnostics** — single-command "is everything OK?" probe across platform, optional deps, executor command count, audit chain, screenshot, mouse, disk space, REST registry. CLI exits 0 if all green / 1 otherwise; REST `/diagnose`; severity-tagged GUI tab
+- **Stable API & Failure Bundles** — versioned, lazy `je_auto_control.api` façade for new integrations (`execute_action`, `generate_code`, `run_diagnostics`, failure bundles) with a documented [lifecycle policy](docs/API_LIFECYCLE.md). Portable `autocontrol.failure-bundle/v1` diagnostic ZIPs: manifest + redacted context/events/log tail, optional screenshot and diagnostics, best-effort collectors, atomic write. CLI `je_auto_control failure-bundle out.zip`; `codegen --failure-bundle` wraps generated pytest in automatic failure diagnostics
 - **USB Hotplug Events** — polling-based hotplug watcher (`UsbHotplugWatcher`) with bounded ring buffer + sequence-numbered events; `GET /usb/events?since=N` lets late subscribers catch up. GUI auto-refresh toggle on the USB tab.
 - **OpenAPI 3.1 + Swagger UI** — `GET /openapi.json` (auth-gated, generated from the live route table) + `GET /docs` (browser Swagger UI with bearer token bar). Drift test in CI catches new routes added without metadata.
-- **Configuration Bundle** — single-file JSON export/import of user config (admin hosts, address book, trusted viewers, known hosts, host service, IDs). Atomic write with `<name>.bak.<timestamp>` backups; CLI `python -m je_auto_control.utils.config_bundle export|import`; `POST /config/{export,import}`; GUI buttons on the REST API tab.
+- **Configuration Bundle** — single-file JSON export/import of user config (admin hosts, address book, trusted viewers, known hosts, host service, IDs). Atomic write with `<name>.bak.<timestamp>` backups; CLI `python -m je_auto_control.utils.config_bundle export|import`; `POST /config/{export,import}`; export/import commands on the REST API tab's Actions menu.
 - **USB Passthrough (opt-in)** — let a remote viewer use a USB device physically attached to the host, over a WebRTC `usb` DataChannel. Wire-level protocol (11 opcodes incl. `RESUME`, CREDIT-based flow control, 16 KiB payload cap with EOF fragmentation for oversize transfers). All eight original open questions resolved: reliable-ordered channel, LIST-over-channel (ACL-filtered), per-claim credits, Linux kernel-driver detach/reattach, and ACL **HMAC-SHA256 integrity** (fail-closed on tamper; pluggable key — Windows DPAPI or passphrase vault). **Backends:** `LibusbBackend` (production), `WinusbBackend` (ctypes) and `IokitBackend` (native IOKit enumeration + libusb transfers) — Windows/macOS *hardware-unverified*; `default_passthrough_backend()` picks per-OS. Viewer-side blocking client (`control/bulk/interrupt_transfer`, `list_devices`, `resume`); in-process `UsbLoopback` so one machine can share + use a device through the full stack. **Wired into WebRTC** host/viewer (`viewer.usb_client()`) plus claim **resume tokens** that survive a reconnect. Persistent ACL (default deny, mode 0600) with host-side prompt dialog, abuse **rate-limit / lockout**, and tamper-evident audit integration. Five driving surfaces: AnyDesk-style **GUI panel** (share + ACL allow/block + local/remote use), `AC_usb_*` executor commands (JSON / socket / scheduler), **REST** `/usb/...`, first-class **MCP** `ac_usb_*` tools, and the Python API. Default off — opt-in via `enable_usb_passthrough(True)` or `JE_AUTOCONTROL_USB_PASSTHROUGH=1`; default-on still pending Phase 2e external security sign-off + real-hardware verification.
 - **Observability (Prometheus + OpenTelemetry)** — stdlib-only `Counter` / `Gauge` / `Histogram` registry with a tiny built-in HTTP exporter on `/metrics`, plus an OpenTelemetry-compatible tracer that upgrades to real OTel spans when the SDK is installed. The executor and agent loop emit `autocontrol_action_calls_total{action,outcome}`, `autocontrol_action_duration_seconds`, and `autocontrol_agent_steps_total{tool,outcome}` automatically — drop the URL into a Prometheus scrape config and you have a Grafana dashboard with zero per-script wiring.
 
@@ -546,8 +547,8 @@ ac.run_from_description("open Notepad and type hello", executor=executor)
 | `AUTOCONTROL_LLM_BACKEND` | `anthropic` to force a backend |
 | `AUTOCONTROL_LLM_MODEL` | Override the default model (e.g. `claude-opus-4-7`) |
 
-GUI: **LLM Planner** tab — description box, `QThread`-backed *Plan*
-button, action-list preview, and a *Run plan* button.
+GUI: **LLM Planner** tab — description box and action-list preview;
+*Plan* (`QThread`-backed) and *Run plan* live in the window's Actions menu.
 
 ### Runtime Variables & Control Flow
 
@@ -575,7 +576,8 @@ commands, scripts can drive themselves from data without Python glue:
 
 `AC_if_var` operators: `eq`, `ne`, `lt`, `le`, `gt`, `ge`, `contains`,
 `startswith`, `endswith`. GUI: **Variables** tab — live view of
-`executor.variables` with single-set, JSON seed, and clear-all controls.
+`executor.variables`; single-set, JSON seed, and clear-all run from the
+window's Actions menu.
 
 ### Remote Desktop
 
@@ -1099,8 +1101,9 @@ for run in default_history_store.list_runs(limit=20):
     print(run.id, run.source, run.status, run.artifact_path)
 ```
 
-The GUI **Run History** tab exposes filter/refresh/clear and
-double-click-to-open on the artifact column.
+The GUI **Run History** tab shows the runs table with
+double-click-to-open on the artifact column; filter, refresh, and
+clear run from the window's Actions menu.
 
 ### Report Generation
 
@@ -1357,6 +1360,16 @@ Or from the command line:
 python -m je_auto_control
 ```
 
+The main window is menu-driven: tabs hold only their inputs, tables,
+and result views, and every tab's commands live in the window-level
+**Actions** menu, which rebuilds for the active tab. **View → Tabs**
+shows or hides any of the ~48 registered tabs, grouped by category
+(Core / Editing / Detection & Vision / Automation Engines / System);
+the default layout opens with just Record, Script Builder, and Remote
+Desktop. **View → Text Size** offers auto/preset font scaling, and the
+**Language** menu (English / 繁體中文 / 简体中文 / 日本語) retranslates
+the whole window live.
+
 ---
 
 ## Command-Line Interface
@@ -1438,6 +1451,11 @@ python -m pytest test/integrated_test/
 
 ### Project Links
 
+- [Capability and platform matrix](docs/CAPABILITY_MATRIX.md)
+- [Public API lifecycle and deprecation policy](docs/API_LIFECYCLE.md)
+- [Security policy](SECURITY.md)
+- [Compatibility changelog](CHANGELOG.md)
+
 - **Homepage**: https://github.com/Intergration-Automation-Testing/AutoControl
 - **Documentation**: https://autocontrol.readthedocs.io/en/latest/
 - **PyPI**: https://pypi.org/project/je_auto_control/

README/README_zh-CN.md

@@ -97,9 +97,10 @@
 - **WebRTC 包监测** — 由既有 WebRTC stats 轮询喂入的进程级 `StatsSnapshot` 滚动窗口（默认 600 条 / 1 Hz 约 10 分钟）。对 RTT、FPS、bitrate、丢包率、jitter 各回 `last/min/max/avg/p95`
 - **USB 设备列举** — 只读的跨平台 USB 设备列举。优先尝试 pyusb（libusb）；若无则退回平台特定命令（Windows `Get-PnpDevice`、macOS `system_profiler`、Linux `/sys/bus/usb/devices`）。第二阶段 passthrough 构建于此（见下）
 - **系统诊断** — 一键"目前正常吗？"探测：平台、可选依赖包、executor 命令数、审计链、截图、鼠标、磁盘空间、REST registry。CLI 全绿 exit 0／否则 1；REST `/diagnose`；按严重度上色的 GUI 分页
+- **稳定 API 与失败诊断包** — 给新集成用的版本化、延迟加载 `je_auto_control.api` 门面(`execute_action`、`generate_code`、`run_diagnostics`、failure bundles),附[生命周期政策](../docs/API_LIFECYCLE.md)。便携式 `autocontrol.failure-bundle/v1` 诊断 ZIP:manifest + 已脱敏的 context/events/log 尾段、可选截图与诊断、best-effort 收集器、原子写入。CLI `je_auto_control failure-bundle out.zip`;`codegen --failure-bundle` 让生成的 pytest 自动包上失败诊断
 - **USB Hotplug 事件** — 轮询式 hotplug 监测（`UsbHotplugWatcher`），含 bounded ring buffer 与带序号的事件；`GET /usb/events?since=N` 让晚加入的订阅者补上进度。USB 分页有自动刷新切换钮。
 - **OpenAPI 3.1 + Swagger UI** — `GET /openapi.json`（auth-gated，从活的路由表生成）+ `GET /docs`（浏览器版 Swagger UI 含 bearer token 栏）。CI 上有 drift 测试，新加路由忘记写 metadata 会被拦下。
-- **配置包导出／导入** — 单一 JSON 文件，导出／导入用户配置（admin hosts、address book、trusted viewers、known hosts、host service、IDs）。原子写入加 `<name>.bak.<时间戳>` 备份；CLI `python -m je_auto_control.utils.config_bundle export|import`；`POST /config/{export,import}`；REST API 分页有按钮。
+- **配置包导出／导入** — 单一 JSON 文件，导出／导入用户配置（admin hosts、address book、trusted viewers、known hosts、host service、IDs）。原子写入加 `<name>.bak.<时间戳>` 备份；CLI `python -m je_auto_control.utils.config_bundle export|import`；`POST /config/{export,import}`；REST API 分页的导出／导入命令位于窗口的 Actions 菜单。
 - **USB Passthrough（需主动启用）** — 让远端 viewer 使用实体插在 host 上的 USB 设备，走 WebRTC `usb` DataChannel。Wire-level 协议（11 个 opcode 含 `RESUME`、CREDIT 流量控制、16 KiB payload 上限，超量传输以 EOF 分片）。八个原始未决问题全部解决：可靠有序 channel、LIST 走 channel（ACL 过滤）、per-claim credit、Linux kernel driver detach/reattach、ACL **HMAC-SHA256 完整性**（篡改 fail-closed；密钥可插拔 — Windows DPAPI 或 passphrase vault）。**Backend：**`LibusbBackend`（production）、`WinusbBackend`（ctypes）、`IokitBackend`（原生 IOKit 列举 + libusb 传输）— Windows/macOS *硬件未验证*；`default_passthrough_backend()` 依 OS 自动挑。Viewer 端阻塞式 client（`control/bulk/interrupt_transfer`、`list_devices`、`resume`）；in-process `UsbLoopback` 让同机可走完整堆栈 share+use。**已接入 WebRTC** host/viewer（`viewer.usb_client()`）并含断线可续租的 **resume token**。持久化 ACL（默认 deny、mode 0600），含 host 端 prompt 对话框、滥用 **rate-limit / lockout** 与可检测篡改审计整合。五个驱动面：AnyDesk 风 **GUI 面板**（分享 + ACL 允许/封锁 + 本机/远端使用）、`AC_usb_*` executor 命令（JSON / socket / 调度器）、**REST** `/usb/...`、一级 **MCP** `ac_usb_*` 工具、以及 Python API。默认 off — 用 `enable_usb_passthrough(True)` 或 `JE_AUTOCONTROL_USB_PASSTHROUGH=1` 启用；默认启用仍待 Phase 2e 外部安全签核 + 实机硬件验证。
 
 ---
@@ -529,7 +530,7 @@ ac.run_from_description("打开记事本并输入 hello", executor=executor)
 | `AUTOCONTROL_LLM_BACKEND` | 强制指定 `anthropic` |
 | `AUTOCONTROL_LLM_MODEL` | 覆盖默认模型（如 `claude-opus-4-7`） |
 
-GUI：**LLM Planner** 分页 — 描述输入框、`QThread` 后台执行的 *Plan* 按钮、预览指令清单，以及 *Run plan* 按钮。
+GUI：**LLM Planner** 分页 — 描述输入框与指令清单预览；*Plan*（`QThread` 后台执行）与 *Run plan* 位于窗口的 Actions 菜单。
 
 ### 运行期变量与流程控制
 
@@ -1004,8 +1005,8 @@ for run in default_history_store.list_runs(limit=20):
     print(run.id, run.source, run.status, run.artifact_path)
 ```
 
-GUI **执行历史** 标签页提供筛选 / 刷新 / 清除功能，并可双击截图列打开
-附件。
+GUI **执行历史** 标签页显示运行记录表格，可双击截图列打开附件；筛选 /
+刷新 / 清除命令位于窗口的 Actions 菜单。
 
 ### 报告生成
 
@@ -1237,6 +1238,13 @@ je_auto_control.start_autocontrol_gui()
 python -m je_auto_control
 ```
 
+主窗口采用菜单驱动设计：标签页只保留输入字段、表格与结果视图，每个
+标签页的命令都集中在窗口级的 **Actions** 菜单，会随当前标签页动态重建。
+**View → Tabs** 可按分类（核心 / 编辑 / 检测与视觉 / 自动化引擎 / 系统）
+显示或隐藏约 48 个已注册标签页；默认布局只打开录制、脚本构建器与远程
+桌面三个标签页。**View → Text Size** 提供自动／预设字号，**Language**
+菜单（English / 繁體中文 / 简体中文 / 日本語）可即时切换整个窗口的语言。
+
 ---
 
 ## 命令行界面