Common Agent Runtime 0.56.1

What's new in 0.56.1

v0.56.1

Changes

• A2A tasks created by a CAR peer are owned by its full-key principal (peer:<key>), not its 4-byte fingerprint label, so two keys sharing a label cannot read, list, cancel, or continue each other's tasks. RuntimeScope.caller_id and the eventlog's caller_id carry the same principal. Tasks live in memory only, so no stored owner needs migrating (#2312).

• Peer-message and tool admission read the agent-permission policy chosen by their server state's ServerStateConfig::agent_permissions_path. The daemon default is unchanged：the operator's live <CAR_HOME>/agent-permissions.json, whatever --journal-dir is. Embedders can set with_agent_permissions_path, and car-server-core's own unit tests use their tempdir's file. Before this, three lattice::tests failed on any Mac whose real policy held or denied an agent named milo (#2308).

• Keep builder sessions alive on macOS and Linux while a silent model-invoked shell process tree is doing measurable CPU work, using the same sampler, cadence, and one-percent-of-one-core threshold as protected checks. Truly idle silent commands still become stale.

• Preserve a bounded, credential-redacted stdout/stderr tail under each coder session's evidence/shell directory when a builder shell call times out or is cancelled, while continuing to terminate its complete process tree so build locks are released.

• Your default org now applies to coding sessions, on any local engine. coder.start (and car code) binds a session to your default org (car auth default-org) when you name no org and the repository declares none. A bound session can now run Claude Code, Codex or local Foreman, not only the native engine. Those engines always run isolated when bound：the CLI loads none of your own MCP servers, plugins, settings or memory, so organization work cannot leak into personal state, and it has no web access; Gemini and mini-swe-agent cannot isolate and refuse when bound. A default that cannot be used — a distributed run (fleet workers do not carry an organization yet), a default no login holds any more, or a failed membership check (offline, revoked) — refuses the start and tells you to pass personal: true; nothing silently runs as personal.

• A Lattice review mirrored onto host approvals no longer carries the review text. …

Full release notes »