Baixar Common Agent Runtime 0.50.0 per a Windows

## v0.50.0

### Fixed

• **`exit code 100` in a nextest step now has a name, and one place to fix
it.** Two runs failed on a step whose only annotation was `Process completed
with exit code 100` — no failing assertion, no test named, matching no known
signature. The real line sat in the job log：`fatal runtime error: stack
overflow, aborting`, aborting one arbitrary `car-server-core` test with
SIGABRT. The two runs died on two *different* tests, which is the tell：no
test was at fault. `handler.rs` is a single `async fn` dispatcher over 382
string-literal method arms, and in a debug build the resulting future is
megabytes wide — wider than the 2 MiB stack Rust gives the thread libtest
runs each test on. The tests passed until an unrelated change grew the future
a few hundred KB, then an arbitrary one of them aborted.

`RUST_MIN_STACK` now lives in the repo-root `.cargo/config.toml`'s `[env]`,
which cargo applies to every process it launches, from every cwd and on every
cargo version. Previously it was a step-level `env:` on the one CI step where
the overflow was observed, while the other seven invocations that run these
same tests — `coverage`, `shared-process-test`, the doctest step, two
`check-windows` steps, `build.yml`'s tag-time run and `ci-local.sh` — had no
protection. `coverage` is the one that went over：it failed on `main`'s
2026-08-25 nightly with the identical SIGABRT, and passes with this change.
No test, assertion or gate was changed; the process is given the stack the
code it exercises needs. `car-server-core/tests/stack_budget.rs` fails by
name if the budget is ever removed, rather than letting an unrelated test
abort months later.
`docs/solutions/nextest-exit-100-is-a-stack-overflow.md` carries the full
trail, including what to do when 8 MiB is not enough either.

• **A slow `build-windows` no longer strands a release half-published.**
`release.sh`'s Step-3 wait for CI to create the GitHub Release was a fixed
720 x 10 s = 120 min budget, sized off the slowest Windows build anyone had
measured. Cutting v0.49.0 that job took 2 h 6 m while legitimately
progressing, the budget expired on a healthy run, and everything downstream
of the wait — the signed macOS upload, the `preflight-macos-assets` gate, the
npm/PyPI publishes and the mirror, then the whole post-CI tail — silently did
not happen. Re-driving CI does not repair that, because CI does not own the
tail.

The wait is now adaptive：it asks the workflow run whether a job that could
still create the release is running. A healthy run keeps waiting past the old
two hours, and a run that reached a terminal state without creating the
release now fails in minutes instead of hours. A 6 h hard ceiling and a
soft budget (past which a run that reads non-healthy on five consecutive
minute-apart probes is fatal — one unreadable `gh` response is not, or a
rate-limit blip would strand the release the same way the clock did) keep it
bounded. Every failure path prints the exact recovery — the already-notarized
assets staged on disk are the resume point, `backfill-macos-assets.sh` is the
expensive wrong tool for this — and `scripts/test-release-ci-wait.sh` runs
the real loop against a canned `gh` on every PR.

### Added

• **The supervised assistant can now run a repository-scoped, durable,
governed host workflow without delegating its engineering loop to another
coding agent.** `car do --serve --governed-host --dir <repo>` binds host
toolchains and network access to an explicit Git repository, keeps
consequential actions behind exact-scope durable approvals, applies
project-defined deployment/database gates, checkpoints exact model history,
fences crash-boundary dispatch from replay, and emits hash-chained receipts
with local, remote, CI/CD, deployment, health, and browser proof reported as
separate stages. New sync checkpoint/action JSON-RPC and Node/Python binding
methods expose the durable records for audit and recovery.

• **Local models now have durable CAR ownership, resource controls, and safe
removal across the daemon, CLI, Node, and Python surfaces.** Successful pulls
write private receipt records against CAR-managed projections; existing
artifacts can be explicitly adopted. `models.list_unified` reports
`car_enabled`, `can_remove`, `in_use`, and management evidence. Host-gated
Remove from CAR drains runtime owners and cross-process leases, writes a
tombstone, and unlinks only an identity-checked managed symlink/file—shared
Hugging Face blobs are never recursively deleted. Receipt-backed directory
installs remain usable but report `can_remove=false` until CAR has portable
object-bound directory traversal. New resource-policy get/set and model
preflight methods expose the exact RAM ceiling and live admission verdict.

• **CAR Host now opens on an outcome-first Command Deck built for everyday
use.** The new Ask CAR home leads with a plain-language prompt, guided setup
actions, real approval and agent status, and direct paths to starter-agent
creation without exposing runtime internals first. Opening an agent keeps the
focused two-region workspace：requests run through the existing declarative
agent surface and their complete output, errors, and receipts are saved under
`~/Library/Application Support/CarHost/work/` so closing the window never
hides where finished work went. A guided New Agent conversation reuses CAR's
existing coder contract, checks, approval, and registry flow rather than
creating a second agent system. The legacy diagnostic dashboard remains an
explicit recovery surface：launch with `CAR_HOST_LEGACY_DASHBOARD=1`, or set
the `car.dashboard.useLegacy` user default to `true` for a choice that
persists across launches and still applies when the app is opened from the
Dock, where an environment variable cannot reach it. The override is
one-way：`CAR_HOST_LEGACY_DASHBOARD=1` forces the legacy surface on
whatever the preference says, but `=0` does **not** force the Command Deck
back on over a `true` preference — clear the user default to undo it.

• **The macOS model setup now makes local-model acquisition visible and
distinguishes using, verifying, and downloading.** An installed model that
CAR already verified can be selected for CAR Chat without downloading it
again; installed but unverified models are verified first, and missing
models show download progress and a durable ready, failure, or uncertain
outcome in the setup surface. Recommendations now separate download size
from CAR's hardware-fit estimate and the effect of unified-memory pressure,
while an eligible smaller recommendation is surfaced as a data-driven
"Lighter option."

• **Release proof can exercise the real macOS Keychain path without touching
yours.** Two environment variables make an isolated Keychain selectable for a
smoke run：`CAR_KEYCHAIN_PATH` names an explicit Keychain file, which CAR
appends to every `/usr/bin/security` read, status, write, and delete it
performs, and `CAR_KEYCHAIN_PROOF_ROOT` names the owner-private directory
that Keychain must live inside. The proof root is *required* whenever the
path is set — naming a Keychain with no root is an error, not a silent
fall-back to your default Keychain. CAR validates the pair before every use
and refuses a path that is relative, a symlink, owned by another user,
group- or other-accessible, or canonically outside the proof root. The
default Keychain and the search list are never modified, and with
`CAR_KEYCHAIN_PATH` absent behavior is exactly what it was. macOS only, and
a Keychain *selector* — not a plaintext secret backend.

### Changed

• **Local model allocation is now admission-controlled across native, voice,
worker, and supervised-process boundaries.** CAR keeps one machine-wide
charge per physical allocation, retains it through cancelled native work and
confirmed process-tree teardown, and never substitutes a different model for
an explicitly selected local model. The public model-source schema adds
`managed_vllm_mlx` only for CAR-owned/downloaded/supervised vLLM-MLX
processes. Existing `vllm_mlx` JSON remains backward compatible and continues
to mean an externally managed OpenAI-compatible endpoint; CAR does not
reinterpret or locally admit those configurations. This is a public Rust enum
addition：downstream exhaustive matches on `ModelSource` must add a
`ManagedVllmMlx` arm (or a forward-compatible wildcard) when updating to this
release.

• **The public Rust `ModelInfo` struct adds local-management evidence fields.**
`car_enabled`, `can_remove`, `in_use`, and `management_evidence` are
backward-compatible on JSON/Serde reads through defaults, but this is a Rust
source compatibility break for downstream exhaustive struct literals and
destructuring. Rust consumers updating to this release must add the four
fields (or avoid exhaustive construction); older serialized catalog rows
continue to deserialize unchanged.

• **Local-model recommendations now distinguish visible alternatives from safe
automatic defaults.** The daemon, `car setup`, automatic first-run download,
and concierge all load the persisted resource policy. Everyday Assistant
setup prefers a tool-capable model inside its conservative recommendation
target while retaining heavier and unknown-memory candidates for an explicit
choice. Recommendation responses add `within_recommendation_target`; corrupt
or unreadable policy state is reported while CAR safely falls back to
Everyday. `car onboard` now falls back to the legacy catalog only when an
older daemon returns JSON-RPC method-not-found, so current registry failures
are no longer hidden.

• **macOS credential access is now demand-driven.** App startup and passive
Home, Models, setup, health, and catalog rendering perform zero secret-store
rea