Normalize native dependency ownership and split config UI

Make distro packages the single source of truth for GTK/X11 Python bindings instead of advertising them as wheel-managed runtime dependencies. Update the uv, CI, and packaging workflows to use system site packages, regenerate uv.lock, and keep portable and Arch metadata aligned with that contract.

Pull runtime policy, audio probing, and page builders out of config_ui.py so the settings window becomes a coordinator instead of a single large mixed-concern module. Rename the config serialization and logging helpers, and stop startup logging from exposing raw vocabulary entries or custom model paths.

Remove stale helper aliases and add regression coverage for safe startup logging, packaging metadata and module drift, portable requirements, and the extracted audio helper behavior.

Validated with uv lock, python3 -m compileall -q src tests, python3 -m unittest discover -s tests -p 'test_*.py', make build, and make package-arch.

tests/test_aman_run.py

@@ -205,6 +205,33 @@ class AmanRunTests(unittest.TestCase):
         self.assertIn("startup.readiness: startup failed: warmup boom", rendered)
         self.assertIn("next_step: run `aman self-check --config", rendered)
 
+    def test_run_command_logs_safe_config_payload(self):
+        with tempfile.TemporaryDirectory() as td:
+            path = Path(td) / "config.json"
+            path.write_text(json.dumps({"config_version": 1}) + "\n", encoding="utf-8")
+            custom_model_path = Path(td) / "custom-whisper.bin"
+            custom_model_path.write_text("model\n", encoding="utf-8")
+            args = aman_cli.parse_cli_args(["run", "--config", str(path)])
+            desktop = _FakeDesktop()
+            cfg = Config()
+            cfg.recording.input = "USB Mic"
+            cfg.models.allow_custom_models = True
+            cfg.models.whisper_model_path = str(custom_model_path)
+            cfg.vocabulary.terms = ["SensitiveTerm"]
+            with patch("aman_run.lock_single_instance", return_value=object()), patch(
+                "aman_run.get_desktop_adapter", return_value=desktop
+            ), patch("aman_run.load_runtime_config", return_value=cfg), patch(
+                "aman_run.Daemon", _FakeDaemon
+            ), self.assertLogs(level="INFO") as logs:
+                exit_code = aman_run.run_command(args)
+
+        self.assertEqual(exit_code, 0)
+        rendered = "\n".join(logs.output)
+        self.assertIn('"custom_whisper_path_configured": true', rendered)
+        self.assertIn('"recording_input": "USB Mic"', rendered)
+        self.assertNotIn(str(custom_model_path), rendered)
+        self.assertNotIn("SensitiveTerm", rendered)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_config.py

@@ -9,7 +9,7 @@ SRC = ROOT / "src"
 if str(SRC) not in sys.path:
     sys.path.insert(0, str(SRC))
 
-from config import CURRENT_CONFIG_VERSION, load, redacted_dict
+from config import CURRENT_CONFIG_VERSION, Config, config_as_dict, config_log_payload, load
 
 
 class ConfigTests(unittest.TestCase):
@@ -39,7 +39,7 @@ class ConfigTests(unittest.TestCase):
 
             self.assertTrue(missing.exists())
             written = json.loads(missing.read_text(encoding="utf-8"))
-            self.assertEqual(written, redacted_dict(cfg))
+            self.assertEqual(written, config_as_dict(cfg))
 
     def test_loads_nested_config(self):
         payload = {
@@ -311,6 +311,18 @@ class ConfigTests(unittest.TestCase):
             ):
                 load(str(path))
 
+    def test_config_log_payload_omits_vocabulary_and_custom_model_path(self):
+        cfg = Config()
+        cfg.models.allow_custom_models = True
+        cfg.models.whisper_model_path = "/tmp/custom-whisper.bin"
+        cfg.vocabulary.terms = ["SensitiveTerm"]
+
+        payload = config_log_payload(cfg)
+
+        self.assertTrue(payload["custom_whisper_path_configured"])
+        self.assertNotIn("vocabulary", payload)
+        self.assertNotIn("whisper_model_path", payload)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_config_ui_audio.py

@@ -0,0 +1,53 @@
+import sys
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+SRC = ROOT / "src"
+if str(SRC) not in sys.path:
+    sys.path.insert(0, str(SRC))
+
+from config_ui_audio import AudioSettingsService
+
+
+class AudioSettingsServiceTests(unittest.TestCase):
+    def test_microphone_test_reports_success_when_audio_is_captured(self):
+        service = AudioSettingsService()
+        with patch("config_ui_audio.start_recording", return_value=("stream", "record")), patch(
+            "config_ui_audio.stop_recording",
+            return_value=SimpleNamespace(size=4),
+        ), patch("config_ui_audio.time.sleep") as sleep_mock:
+            result = service.test_microphone("USB Mic", duration_sec=0.0)
+
+        self.assertTrue(result.ok)
+        self.assertEqual(result.message, "Microphone test successful.")
+        sleep_mock.assert_called_once_with(0.0)
+
+    def test_microphone_test_reports_empty_capture(self):
+        service = AudioSettingsService()
+        with patch("config_ui_audio.start_recording", return_value=("stream", "record")), patch(
+            "config_ui_audio.stop_recording",
+            return_value=SimpleNamespace(size=0),
+        ), patch("config_ui_audio.time.sleep"):
+            result = service.test_microphone("USB Mic", duration_sec=0.0)
+
+        self.assertFalse(result.ok)
+        self.assertEqual(result.message, "No audio captured. Try another device.")
+
+    def test_microphone_test_surfaces_recording_errors(self):
+        service = AudioSettingsService()
+        with patch(
+            "config_ui_audio.start_recording",
+            side_effect=RuntimeError("device missing"),
+        ), patch("config_ui_audio.time.sleep") as sleep_mock:
+            result = service.test_microphone("USB Mic", duration_sec=0.0)
+
+        self.assertFalse(result.ok)
+        self.assertEqual(result.message, "Microphone test failed: device missing")
+        sleep_mock.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_diagnostics.py

@@ -16,7 +16,6 @@ from diagnostics import (
     DiagnosticCheck,
     DiagnosticReport,
     run_doctor,
-    run_diagnostics,
     run_self_check,
 )
 
@@ -192,26 +191,6 @@ class DiagnosticsTests(unittest.TestCase):
         self.assertIn("networked connection", results["model.cache"].next_step)
         probe_model.assert_called_once()
 
-    def test_run_diagnostics_alias_matches_doctor(self):
-        cfg = Config()
-        with tempfile.TemporaryDirectory() as td:
-            config_path = Path(td) / "config.json"
-            config_path.write_text('{"config_version":1}\n', encoding="utf-8")
-            with patch.dict("os.environ", {"DISPLAY": ":0"}, clear=False), patch(
-                "diagnostics.load_existing", return_value=cfg
-            ), patch("diagnostics.list_input_devices", return_value=[{"index": 1, "name": "Mic"}]), patch(
-                "diagnostics.resolve_input_device", return_value=1
-            ), patch(
-                "diagnostics.get_desktop_adapter", return_value=_FakeDesktop()
-            ), patch(
-                "diagnostics._run_systemctl_user",
-                return_value=_Result(returncode=0, stdout="running\n"),
-            ):
-                report = run_diagnostics(str(config_path))
-
-        self.assertEqual(report.status, "ok")
-        self.assertEqual(len(report.checks), 7)
-
     def test_report_json_schema_includes_status_and_next_step(self):
         report = DiagnosticReport(
             checks=[

tests/test_packaging_metadata.py

@@ -0,0 +1,55 @@
+import ast
+import re
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _parse_toml_string_array(text: str, key: str) -> list[str]:
+    match = re.search(rf"(?ms)^\s*{re.escape(key)}\s*=\s*\[(.*?)^\s*\]", text)
+    if not match:
+        raise AssertionError(f"{key} array not found")
+    return ast.literal_eval("[" + match.group(1) + "]")
+
+
+class PackagingMetadataTests(unittest.TestCase):
+    def test_py_modules_matches_top_level_src_modules(self):
+        text = (ROOT / "pyproject.toml").read_text(encoding="utf-8")
+        py_modules = sorted(_parse_toml_string_array(text, "py-modules"))
+        discovered = sorted(path.stem for path in (ROOT / "src").glob("*.py"))
+        self.assertEqual(py_modules, discovered)
+
+    def test_project_dependencies_exclude_native_gui_bindings(self):
+        text = (ROOT / "pyproject.toml").read_text(encoding="utf-8")
+        dependencies = _parse_toml_string_array(text, "dependencies")
+        self.assertNotIn("PyGObject", dependencies)
+        self.assertNotIn("python-xlib", dependencies)
+
+    def test_runtime_requirements_follow_project_dependency_contract(self):
+        with tempfile.TemporaryDirectory() as td:
+            output_path = Path(td) / "requirements.txt"
+            script = (
+                f'source "{ROOT / "scripts" / "package_common.sh"}"\n'
+                f'write_runtime_requirements "{output_path}"\n'
+            )
+            subprocess.run(
+                ["bash", "-lc", script],
+                cwd=ROOT,
+                text=True,
+                capture_output=True,
+                check=True,
+            )
+
+            requirements = output_path.read_text(encoding="utf-8").splitlines()
+
+        self.assertIn("faster-whisper", requirements)
+        self.assertIn("llama-cpp-python", requirements)
+        self.assertNotIn("PyGObject", requirements)
+        self.assertNotIn("python-xlib", requirements)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_portable_bundle.py

@@ -208,15 +208,22 @@ class PortableBundleTests(unittest.TestCase):
             self.assertTrue(tarball.exists())
             self.assertTrue(checksum.exists())
             self.assertTrue(wheel_path.exists())
+            prefix = f"aman-x11-linux-{version}"
             with zipfile.ZipFile(wheel_path) as archive:
                 wheel_names = set(archive.namelist())
                 metadata_path = f"aman-{version}.dist-info/METADATA"
                 metadata = archive.read(metadata_path).decode("utf-8")
             self.assertNotIn("desktop_wayland.py", wheel_names)
             self.assertNotIn("Requires-Dist: pillow", metadata)
+            self.assertNotIn("Requires-Dist: PyGObject", metadata)
+            self.assertNotIn("Requires-Dist: python-xlib", metadata)
             with tarfile.open(tarball, "r:gz") as archive:
                 names = set(archive.getnames())
-            prefix = f"aman-x11-linux-{version}"
+                requirements_path = f"{prefix}/requirements/cp311.txt"
+                requirements_member = archive.extractfile(requirements_path)
+                if requirements_member is None:
+                    self.fail(f"missing {requirements_path} in portable archive")
+                requirements_text = requirements_member.read().decode("utf-8")
             self.assertIn(f"{prefix}/install.sh", names)
             self.assertIn(f"{prefix}/uninstall.sh", names)
             self.assertIn(f"{prefix}/portable_installer.py", names)
@@ -229,6 +236,8 @@ class PortableBundleTests(unittest.TestCase):
             self.assertIn(f"{prefix}/requirements/cp311.txt", names)
             self.assertIn(f"{prefix}/requirements/cp312.txt", names)
             self.assertIn(f"{prefix}/systemd/aman.service.in", names)
+            self.assertNotIn("pygobject", requirements_text.lower())
+            self.assertNotIn("python-xlib", requirements_text.lower())
 
     def test_fresh_install_creates_managed_paths_and_starts_service(self):
         with tempfile.TemporaryDirectory() as tmp: