v0.50.0

Fixed

• exit code 100 in a nextest step now has a name, and one place to fix it. Two runs failed on a step whose only annotation was Process completed with exit code 100 — no failing assertion, no test named, matching no known signature. The real line sat in the job log：fatal runtime error: stack overflow, aborting, aborting one arbitrary car-server-core test with SIGABRT. The two runs died on two different tests, which is the tell：no test was at fault. handler.rs is a single async fn dispatcher over 382 string-literal method arms, and in a debug build the resulting future is megabytes wide — wider than the 2 MiB stack Rust gives the thread libtest runs each test on. The tests passed until an unrelated change grew the future a few hundred KB, then an arbitrary one of them aborted.

RUST_MIN_STACK now lives in the repo-root .cargo/config.toml's [env], which cargo applies to every process it launches, from every cwd and on every cargo version. Previously it was a step-level env: on the one CI step where the overflow was observed, while the other seven invocations that run these same tests — coverage, shared-process-test, the doctest step, two check-windows steps, build.yml's tag-time run and ci-local.sh — had no protection. coverage is the one that went over：it failed on main's 2026-08-25 nightly with the identical SIGABRT, and passes with this change. No test, assertion or gate was changed; the process is given the stack the code it exercises needs. car-server-core/tests/stack_budget.rs fails by name if the budget is ever removed, rather than letting an unrelated test abort months later. docs/solutions/nextest-exit-100-is-a-stack-overflow.md carries the full trail, including what to do when 8 MiB is not enough either.

• A slow build-windows no longer strands a release half-published. release.sh's Step-3 wait for CI to create the GitHub Release was a fixed 720 x 10 s = 120 min budget, sized off the slowest Windows build anyone had measured. Cutting v0.49.0 that job took 2 h 6 m while legitimately progressing, the budget expired on a healthy run, and everything downstream of the wait — the signed macOS upload, the preflight-macos-assets gate, the npm/PyPI publishes and the mirror, then the whole post-CI tail — silently did not happen. Re-driving CI does not repair that, because CI does not own the tail.

The wait is now adaptive：it asks the workflow run whether a job that could still create the release is running. A healthy run keeps waiting past the old two hours, and a run that reached a terminal state without creating the release now fails in minutes instead of hours. A 6 h hard ceiling and a soft budget (past which a run that reads non-healthy on five consecutive minute-apart probes is fatal — one unreadable gh response is not, or a rate-limit blip would strand the release the same way the clock did) keep it bounded. Every failure path prints the exact recovery — the already-notarized assets staged on disk are the resume point, backfill-macos-assets.sh is the expensive wrong tool for this — and scripts/test-release-ci-wait.sh runs the real loop against a canned gh on every PR.

Added

• The supervised assistant can now run a repository-scoped, durable, governed host workflow without delegating its engineering loop to another coding agent. car do --serve --governed-host --dir <repo> binds host toolchains and network access to an explicit Git repository, keeps consequential actions behind exact-scope durable approvals, applies project-defined deployment/database gates, checkpoints exact model history, fences crash-boundary dispatch from replay, and emits hash-chained receipts with local, remote, CI/CD, deployment, health, and browser proof reported as separate stages. New sync checkpoint/action JSON-RPC and Node/Python binding methods expose the durable records for audit and recovery.

• Local models now have durable CAR ownership, resource controls, and safe removal across the daemon, CLI, Node, and Python surfaces. Successful pulls write private receipt records against CAR-managed projections; existing artifacts can be explicitly adopted. models.list_unified reports car_enabled, can_remove, in_use, and management evidence. Host-gated Remove from CAR drains runtime owners and cross-process leases, writes a tombstone, and unlinks only an identity-checked managed symlink/file—shared Hugging Face blobs are never recursively deleted. Receipt-backed directory installs remain usable but report can_remove=false until CAR has portable object-bound directory traversal. New resource-policy get/set and model preflight methods expose the exact RAM ceiling and live admission verdict.

• CAR Host now opens on an outcome-first Command Deck built for everyday use. The new Ask CAR home leads with a plain-language prompt, guided setup actions, real approval and agent status, and direct paths to starter-agent creation without exposing runtime internals first. Opening an agent keeps the focused two-region workspace：requests run through the existing declarative agent surface and their complete output, errors, and receipts are saved under ~/Library/Application Support/CarHost/work/ so closing the window never hides where finished work went. A guided New Agent conversation reuses CAR's existing coder contract, checks, approval, and registry flow rather than creating a second agent system. The legacy diagnostic dashboard remains an explicit recovery surface：launch with CAR_HOST_LEGACY_DASHBOARD=1, or set the car.dashboard.useLegacy user default to true for a choice that persists across launches and still applies when the app is opened from the Dock, where an environment variable cannot reach it. The override is one-way：CAR_HOST_LEGACY_DASHBOARD=1 forces the legacy surface on whatever the preference says, but =0 does not force the Command Deck back on over a true preference — clear the user default to undo it.

• The macOS model setup now makes local-model acquisition visible and distinguishes using, verifying, and downloading. An installed model that CAR already verified can be selected for CAR Chat without downloading it again; installed but unverified models are verified first, and missing models show download progress and a durable ready, failure, or uncertain outcome in the setup surface. Recommendations now separate download size from CAR's hardware-fit estimate and the effect of unified-memory pressure, while an eligible smaller recommendation is surfaced as a data-driven "Lighter option."

• Release proof can exercise the real macOS Keychain path without touching yours. Two environment variables make an isolated Keychain selectable for a smoke run：CAR_KEYCHAIN_PATH names an explicit Keychain file, which CAR appends to every /usr/bin/security read, status, write, and delete it performs, and CAR_KEYCHAIN_PROOF_ROOT names the owner-private directory that Keychain must live inside. The proof root is required whenever the path is set — naming a Keychain with no root is an error, not a silent fall-back to your default Keychain. CAR validates the pair before every use and refuses a path that is relative, a symlink, owned by another user, group- or other-accessible, or canonically outside the proof root. The default Keychain and the search list are never modified, and with CAR_KEYCHAIN_PATH absent behavior is exactly what it was. macOS only, and a Keychain selector — not a plaintext secret backend.

Changed

• Local model allocation is now admission-controlled across native, voice, worker, and supervised-process boundaries. CAR keeps one machine-wide charge per physical allocation, retains it through cancelled native work and confirmed process-tree teardown, and never substitutes a different model for an explicitly selected local model. The public model-source schema adds managed_vllm_mlx only for CAR-owned/downloaded/supervised vLLM-MLX processes. Existing vllm_mlx JSON remains backward compatible and continues to mean an externally managed OpenAI-compatible endpoint; CAR does not reinterpret or locally admit those configurations. This is a public Rust enum addition：downstream exhaustive matches on ModelSource must add a ManagedVllmMlx arm (or a forward-compatible wildcard) when updating to this release.

• The public Rust ModelInfo struct adds local-management evidence fields. car_enabled, can_remove, in_use, and management_evidence are backward-compatible on JSON/Serde reads through defaults, but this is a Rust source compatibility break for downstream exhaustive struct literals and destructuring. Rust consumers updating to this release must add the four fields (or avoid exhaustive construction); older serialized catalog rows continue to deserialize unchanged.

• Local-model recommendations now distinguish visible alternatives from safe automatic defaults. The daemon, car setup, automatic first-run download, and concierge all load the persisted resource policy. Everyday Assistant setup prefers a tool-capable model inside its conservative recommendation target while retaining heavier and unknown-memory candidates for an explicit choice. Recommendation responses add within_recommendation_target; corrupt or unreadable policy state is reported while CAR safely falls back to Everyday. car onboard now falls back to the legacy catalog only when an older daemon returns JSON-RPC method-not-found, so current registry failures are no longer hidden.

• macOS credential access is now demand-driven. App startup and passive Home, Models, setup, health, and catalog rendering perform zero secret-store rea