## Summary
- Strengthened `cara setup` with structured verification, clearer remediation, and concrete next-step guidance.
- Shipped the first stable WASM plugin runtime, including managed plugin activation, runtime reporting, and public plugin development docs.
- Standardized the extension surface on `plugins.*` and added `cara plugins` commands for status, install, update, and managed binary inspection.
- Refreshed plugin/runtime test coverage and dependency baselines, including current `wasmtime`, `wit-parser`, and `wit-component` updates.

## Breaking Changes
- None.

## Migration Steps
- No manual migration is required for the stable path from `v0.3.x` to `v0.4.0`.
- As usual before upgrading, create a backup:
  - `cara backup --output ./carapace-backup.tar.gz`
- After upgrade, verify the install:
  - `cara verify --outcome auto`
  - `cara verify --outcome autonomy`

## Rollback Steps
- Reinstall the previous known-good binary, for example `v0.3.0`.
- Restore the backup created before upgrade:
  - `cara restore --path ./carapace-backup.tar.gz`
- Re-run:
  - `cara status --port 18789`
  - `cara verify --outcome auto --port 18789`
  - `cara verify --outcome autonomy --port 18789`

## Security
- Setup now distinguishes ready, partial, and invalid provider configuration states and gives explicit remediation instead of ambiguous success output.
- Managed plugins activate only from the canonical managed path with manifest backing, SHA-256 pinning, and signature verification policies.
- `plugins.load.paths` remains available as an explicit trusted-local development path, with current behavior documented clearly in the plugin guide.
- Dependency and workflow updates keep the release on current audited TLS and WASM toolchain baselines.

## Verification
- Verify published artifacts and Sigstore bundles:
  - `RELEASE_TAG=v0.4.0 ./scripts/smoke/verify-release-artifacts.sh`
- After upgrading, verify runtime behavior:
  - `cara verify --outcome auto`
  - `cara verify --outcome autonomy`
- If you use plugins, confirm activation state after restart:
  - `cara plugins status --port 18789`

## Known Caveats
- Plugin activation changes remain restart-based; hot reload is not part of the current public workflow.
- Anthropic subscription onboarding and guided Bedrock/Vertex onboarding are still in progress.
- Some plugin-runtime follow-ups remain tracked for maintainability and diagnostics, but they are not required to use the shipped plugin authoring and management path.
