Baixar Common Agent Runtime 0.53.0 per a Windows

## v0.53.0

### Changes

• **Four holes around the peer surfaces, found while designing the receiving-side
broker and fixed together.** (1) A trusted peer could register a push-notification
webhook on the peer-authenticated A2A listener：send text, take the task id, point
`tasks/pushNotificationConfig/set` at a URL you control, and the host POSTs full
task snapshots — messages and artifacts — to it with no allowlist. A push config
is outbound authority, so it is refused on a messaging-only surface. (2) `a2a.start`
bound any address it was given while serving `NoAuth` (there is no auth parameter —
`build_router` hardcodes it) and registering the agent-basics filesystem tools, so a
reachable bind published `write_file` to anyone who could route to the port. A
non-loopback bind now requires `allow_non_loopback_bind：true`, the same explicit
opt-in `a2a.peers.add` and `a2a.send` already demand of their endpoints; a wildcard
bind is refused as the most reachable of all. (3) `agents.chat` reached an agent
with no channel guard and no policy, so it was the way around `agents.message`:
an agent denied at the `read_only` tier could chat at its target instead, and two
agents could answer each other with nothing to terminate the loop. Agent callers
now pass the same admission, sharing one dedupe window and rate budget per
recipient across both methods — a synchronous turn stays out of the in-flight
`QUEUE_CAP` count, which is a concurrency bound and not the backlog its old doc
comment claimed. The host stays exempt：it is the operator's own client, and the
dedupe window would otherwise swallow a person retyping a prompt. Admission runs
after the target is known to exist, so an unroutable id can neither burn the
dedupe window (whose refusal says "already delivered", which would have been
false) nor mint a permanent guard entry. (4) The same admission now covers the
paths that would otherwise be the way around *it*：`declagents.invoke`,
`declagents.route` and `declagents.route_split` reach the same declarative
executor, and the A2A conversational responder (`chat_collect`) reached a live
agent with no guard, no policy and no audit at all. Every refusal is written to
the peer audit journal with its outcome, which matters now that the budget is
shared — an `agents.message` refused for rate could have had its budget drained
by chat traffic, and without a record there is nothing to show where it went. Two more in the same family：`agents.chat.cancel`
removed a live turn's routing entry with no ownership check at all, while
`agents.chat.approve` in the dispatch arm beside it has always required the
originating host session — so any authenticated session could abort anyone's
turn by observing a `session_id`; and the peer-authenticated router now forces
`require_identity`, which is free because the middleware inserts an `Identity`
for every request it admits, and means a future reordering that dropped it
fails closed rather than quietly serving unattributed requests.

• **A peer trusted enough to message this host could write files on it.** The
peer-authenticated A2A listener binds this host's LAN address by default, and
its dispatcher ran on a `Runtime` that `register_agent_basics()` had stocked
with `write_file`/`edit_file` — with no `CapabilitySet`, no authz stage and no
admission gate, because every gate that answers "what may this caller do"
lives on the WebSocket surface instead. An inbound `Part::Data` carrying a
`tool` key compiles to a real `ToolCall` (`car-a2a::bridge`) and executes
*before* the `ChatResponder` is consulted, so `agent_reply_for`'s
"conversational" check never saw it. Adding a peer with `a2a.peers.add` — a
decision that reads as "let this daemon talk to me" — therefore also granted
filesystem write. That listener is now messaging-only：an action-bearing
message is refused with `-32600` before a task is created, and its runtime
registers no tools at all, so its public agent card stops advertising
filesystem skills to the LAN. Peer authentication answers *who* is calling; it
never answered *what they may do*. Note what this leaves：the listener wires no
`ChatResponder`, so it is a discovery beacon plus an `"Acknowledged."` stub —
inbound peer text has no consumer until a receiving-side broker exists. The
explicitly started `a2a.start` listener is unchanged — its tool `data` parts
are a documented feature and it is opt-in. See `docs/a2a.md`.

• **The A2A streaming paths let one caller watch another's task live.**
car#1230 scoped the JSON-RPC task methods, but two paths reach a task by id
outside that handler table and were missed. `tasks/resubscribe` is
intercepted in the HTTP layer before `dispatch` ever sees it, and returned
`200 OK` with `content-type：text/event-stream` on a task belonging to a
different peer. `GET /a2a/stream/:task_id` took no identity at all, so on the
authenticated router any caller could stream any task; on the peer-auth
router that same route was unreachable because it was spelled `{task_id}` —
axum 0.8 syntax on axum 0.7, which matches the literal path only. Both now
consult the same `readable_by` predicate the JSON-RPC methods use, and the
route spelling is corrected in the same change, since fixing it alone would
have opened the hole it was accidentally hiding.

• **One trusted peer could read, cancel, and write into another's tasks.** The
A2A task store is shared per listener and nothing recorded who created a task,
so `tasks/list` with null params returned every task on the surface with full
history — the exfiltration half of the push-notification hole reached by a
simpler route — while `tasks/get` and `tasks/cancel` took any id, and a
`message/send` naming someone else's non-terminal `taskId` appended to *their*
history. A `TaskRecord` now carries the creating caller's verified subject and
every one of those paths checks it：a task you do not own is not listed, reads
and cancels answer `TaskNotFound` rather than confirming it exists, and a
continuation is refused. Scoping bites only where there is an identity to
scope by — a surface whose auth produces none creates un-owned tasks and
behaves exactly as before — and the peer-authenticated router always has one,
because it forces `require_identity`. `TaskStore::create` takes the owner as a
parameter rather than offering a later setter, so an external implementor gets
a compile error instead of silently failing open.
• **An agent id that could not be addressed as a peer registered anyway.** The
supervisor's `validate_id` accepted a leading `.` or `-`, an embedded `..`,
and any length; `car_peers::is_valid_peer_name` rejects all three. An id in
that gap — `.watcher` — started fine and was then silently unreachable:
filtered out of the peer directory, unable to receive `agents.message`, and
refused by `agents.chat` with a message naming neither cause nor fix.
`validate_id` now defers to the peer rule, and a test pins the two together so
they cannot drift apart again. **Migration:** an already-registered agent with
such an id now fails to start. It could not be messaged before either — this
makes existing breakage visible rather than introducing it.

• The self-hosted daemon docs now state what agent binding (`session.auth { agent_id }`) is：identity and routing, not confinement. Every authorization gate that reads it has been audited per gate, and the two that only work in one configuration now say so.

• Documented：binding a connection to a supervised agent (`session.auth { agent_id }`) is an identity and routing mechanism, not a security boundary. A supervised agent runs as the launching user and can therefore read the daemon-wide auth token directly, so it can always reconnect as an ordinary unbound client; the gates keyed on the bound agent attribute an action, they do not confine one. Host-role access is the separate boundary that is enforced, via a credential held in its own file and never served over HTTP. `docs/proposals/agent-binding-trust-boundary.md` records the reasoning and what real confinement would cost.

• **Agent-owned run replay is pinned to the supervised-agent credential boundary.**
A real WebSocket regression now authenticates two supervised agents with
their distinct `CAR_AGENT_TOKEN` values and proves `runs.list` and
`runs.get_trace` return an agent's own persisted run while rejecting the
other agent's list and trace. The protocol reference now states the same
own-agent/cross-agent contract explicitly; host-management sessions retain
their wider read access.

• **Pinned that the assistant's host-shell note actually reaches the prompt.** The
environment description gained a host-platform/shell line, but nothing asserted the one
condition it depends on (`!sandboxed && substrate.is_local()`) ever fires — so the note
could have been appended into a branch that never runs while `cargo check` and every
existing assistant test stayed green. The new test goes through `build_assistant_runtime`
and checks the assembled description names the host, and on Windows says `cmd /C` with
its concrete substitutions rather than `sh -c`.

• **The flagship agent now gets better at tools, not just more remembered about
you.** `car do` already *remembered* (the `remember`/`recall` graph, durable
across sessions) and already *reacted* to recent trajectory pressure (the
proactive-memory pass). Neither made it better at anything：nothing turned
"this is what finally worked" into something a later run could reach, so a
user whose task it fumbled three sessions running watched it fumble the same
way a fourth time. The coder has had this since its repair-skill store landed;
the assistant did not, and the gap was pure wiring — it already emits the
failure receipts the store keys on. `assistant::tool_memory` closes it. A too