Baixar Common Agent Runtime 0.52.1 per a Windows

## v0.52.1

### Added

• **Deterministic self-healing signal detection core.** The new
`car-selfheal` leaf crate folds CAR's existing eventlog alerts/events and
supervisor snapshots into typed `Detection` records for metrics alerts,
exhausted/crash-looping agents, recurring level-token log errors,
silently-idle live agents, recurring cross-run tool failures, and capability
misses. Detection identity is `sha256(locator)` rather than scan
order; evidence and provenance are credential-redacted at capture time and
bounded before entering a record. Positive known-answer and negative
zero-detection fixtures calibrate every detector. The crate has no model,
network, I/O, filing, or remediation path — a detection is evidence, never a
work order.
• **Watch-only daemon self-healing detection and trusted local handoff.**
`car-server` now runs the five deterministic detectors immediately at boot
and every 15 minutes by default (`CAR_SELFHEAL_INTERVAL_SECS` changes
frequency only), using active event-log slices, supervisor snapshots,
bounded activity/stderr tails and activity-log metadata, and observe-only
registry state. `agent_log_errors.v1` flags a running agent only when its
activity tail repeats an `ERROR`/`FATAL`/`CRITICAL` level-token or traceback
signature, or when its activity mtime is stale beyond the threshold. INFO
lines that merely contain “failed” remain noise; timestamp/UUID/number
normalization and hour/day/week/month idle buckets keep deduplication stable.
New/changed detections, tick summaries, and operator dismissals append to the owner-private
`<CAR_HOME>/selfheal/detections.jsonl` ledger. Each tick also checks a bounded
list of local paths for a `.git` config whose origin is `Parslee-ai/car` (no
subprocess, network, or broad scan). A validated checkout routes detections
to one private, trusted-tier `<CAR_HOME>/selfheal/issues/<dedup-key>.md`
handoff document per key, updated on recurrence without writing into the
checkout. Invalid/absent candidates fail closed to ledger-only, with the
source path or refusal visible through `selfheal.status` and route/path on
`selfheal.detections`. The four RPCs are mirrored through Node/Python
bindings. No off-machine filing, proposal execution, restart, or remediation
path was added.
• **Operator CLI and trust policy for self-healing signals.** The new
`car selfheal` command wraps the daemon's existing watch-only RPCs：`status`
reports cadence, counts, and the resolved route; `list` filters and renders
active detections with route and local issue path; `show` prints a trusted
local handoff document; `dismiss` appends a suppression; and `run` requests
one tick. All shipped verbs fail non-zero when the daemon is unreachable.
Feedback filing controls remain absent until Parslee-ai/car#1137 lands.
`docs/self-healing.md` documents the source-presence gate, trusted versus
consumer triage tiers, and the cutover from the external Tank judge and
goalpool route.
• **Daily Continuity can publish unattended through one exact standing CAR
approval.** A host can grant `always_allow` to the literal
`(daily-continuity-newsroom, newsroom.publish)` pair, and CAR binds that grant
to the authenticated reverse callback's canonical schema digest. Future
admission succeeds only while the same agent, session, callback, and schema
remain attached; `car approvals set-tool`, `reset-tool`, and `evaluate-tool`
expose the lifecycle with stable audit provenance.

### Fixed

• **`verify-release.sh` now checks that the docs site actually deployed, not
just what it is serving.** Its appcast assertion had two causes for one
symptom：GitHub Pages still propagating (benign — the script's own comments
document a real v0.47.0 false positive) or the Pages *build* having failed,
which strands the release. Nothing distinguished them, and because the
documented cause is the benign one, a red read as flakiness. Cutting v0.52.0
it was the second — every registry held 0.52.0 while Sparkle could still only
see 0.51.0, and the only tell was that the failure outlived any plausible CDN
window. The build status is now asserted separately via
`gh api repos/<mirror>/pages/builds`：an `errored` build fails immediately
with the offending commit and short-circuits the six appcast retries, which
could never have helped. `building`, unreadable and unrecognised states stay
advisory, so a `gh` blip cannot fail a healthy release — a checker that cries
wolf is worse than none. `scripts/test-pages-build-check.sh` pins the
classifier in CI's `lint` job (car#1199).

• **A code sample can no longer fail the docs-site build and silently strand a
release.** GitHub Pages renders the `car-releases` docs mirror with Jekyll,
which runs Liquid over every markdown page. Liquid does not respect fenced
code blocks, so a brace-heavy sample — `format!(r#"{{type="http",url="{}"}}"#,
endpoint)` in Rust, `[]map[string]any{{"name"："shell"}}` in Go — is a Liquid
*syntax error*, not a rendering quirk, and it fails the entire Pages build.
The site then keeps serving the previous commit, reporting only a generic
"Page build failed". Cutting v0.52.0 this stranded the release：GitHub, PyPI,
npm and crates.io all held 0.52.0 while `car.parslee.ai` still served the
0.51.0 `appcast.xml`, so Sparkle could not see the update — the same
end-state as v0.40.0, reached through a different door. Note what does *not*
trigger it：`{{item}}`, `{{index}}` and `{{payload}}` have been in
`websocket-protocol.md` for many releases and build fine, because well-formed
Liquid variables simply render empty. Malformedness is what throws, which is
why "we would have noticed by now" was false. `sync-car-releases-docs.sh` now
wraps every markdown page it publishes in `{% raw %}`, which disables Liquid
for that page and changes no rendered output — the mirror publishes
documentation, never templates. `scripts/test-liquid-guard.sh` covers it in
CI's `lint` job.
• **A daemon under an isolated `CAR_HOME` can no longer delete the production
home's macOS schedules.** Every CAR state root shared one global launchd
namespace：labels are `ai.parslee.car.task.<id>` with nothing recording *which*
CAR installed them. So an isolated daemon's boot reconcile enumerated the
production home's LaunchAgents, found them absent from its own task store, and
reaped them as orphans — `reaped orphaned OS schedules at boot removed=1`
deleted a live production schedule, regressing `car schedule list` from
`os/durable=true` to `daemon/false` while the task's JSON sat untouched in its
store (car#1178). `labels_to_remove`'s own doc comment claimed reconciliation
"can't touch a schedule CAR didn't create", and that was true as written —
another CAR *home*'s schedule simply was not foreign by that definition.
Installed launchd plists now record their owning root in
`EnvironmentVariables.CAR_HOME`, and a reconcile pass reaps only what it owns.
Two consequences worth knowing：a schedule installed by an isolated home now
also *executes* against that home rather than inheriting the default root at
fire time (the same isolation bug one step later), and on backends that cannot
carry an owner stamp — cron tags and `schtasks` names are just the label — an
overridden root now refuses to reap anything at all rather than guess. A
schedule installed before this stamp existed is unmarked; the default root
keeps reaping those exactly as before, and an overridden root leaves them
alone, because leaking a stale schedule is recoverable by hand and deleting a
live one is not.

### Security

• Durable human rejection still wins, and CAR rejects non-tool actions,
generic or server-owned tools, schema drift, managed-agent self-grants, and
skill-ceiling bypass attempts. All legacy and new permission mutations
require host-management authority, while corrupted policy state retains the
last valid snapshot or fails closed to the cautious posture.