chore(release): v0.2.0

[p4suta-release-plz]

🤖 New release

• windows-spawn: 0.1.0 -> 0.2.0 (✓ API compatible changes)

Changelog

0.2.0 - 2026-10-19

Added

• [breaking] design the 0.2 API and prove the spawn decisions (#33)
• render the command line for launch brokers (#17)

Other

• target hosted assurance at native safety boundaries (#49)
• (deps) lock file maintenance (#47)
• record the reason for the Rust 1.84 MSRV (#46)
• [breaking] require Rust 1.84 and let lint exceptions expire (#43)
• cut the nightly deep verification to about an hour (#41)
• (deps) lock file maintenance (#31)
• stress, fuzz, and run the spawn where bounded tests stop (#39)
• make spawn state and handle types explicit (#36)
• add the required aggregate job (#29)
• release only from a signed tag and an approved deployment (#27)
• (deps) move dependency updates from Dependabot to Renovate (#25)
• enforce the repository laws mechanically (#24)
• inject Win32 failures to cover every error path (#23)
• run mutation testing on rust-mutants (#22)
• drain ConPTY output continuously and ban time in code (#21)
• prove lifecycle properties by events, not time (#20)
• make all prose terse and one sentence per line (#18)

The 0.2 API follows std::process and places each choice on the type that owns it, as ADR 0015 records; docs/migration-0.2.md maps every 0.1 item.

Added

• Command::own_process_tree, which makes Child::kill, dropping the Child, and output collection end the child's whole process tree.
• Child::wait_tree, which waits until every process of an owned tree has exited.
• Command::console with ConsoleMode, Command::priority with PriorityClass, and one Command setter for each creation flag.
• SpawnError, which keeps whether input was rejected, which Windows operation failed in which phase, and which releases failed; windows_spawn::Result.
• BorrowedPseudoConsole with borrow_raw, for a raw HPCON.
• From<ChildStdin>, From<ChildStdout>, From<ChildStderr>, From<io::Stdout>, and From<io::Stderr> for Stdio; Write for &ChildStdin; AsRawHandle for the handle types.
• ValidationError::CommandLineTooLong and ValidationError::PseudoConsoleWithConsoleMode, which reject a spawn before CreateProcessW runs.
• Formal verification in layers, as ADR 0014 records.
  Kani proves the decision cores, and Lean and Verus prove that the C runtime parsers read back every encoded command line.
  Models in TLA+, Quint, Alloy, and Prolog check output draining, the child lifecycle, the handle transfer, and the program search.
  cargo xtask proofs runs them, and Windows tests replay the models' vectors and traces through the crate.
• Seeded random command lines and environments that Windows tests pass through the crate into children, and cargo xtask verifier, which runs the Windows tests under appverif.exe.

Changed

• Fallible calls return SpawnError instead of io::Error; it converts into io::Error, keeping the code Windows reported.
• Every spawn creates its process suspended and resumes it only after releasing the attribute list and the transferred duplicates.
  A release that fails terminates the process before it runs.
• Child::kill returns Ok once the process has exited, as std::process::Child::kill does.
• The mitigation, console, and creation-flag choices moved from SpawnOptions to Command; SpawnOptions lends only Jobs, an alternate parent, and a pseudoconsole.
• AsPseudoConsole is a safe trait returning a BorrowedPseudoConsole, and SpawnOptions::pseudo_console replaces SpawnOptions::pseudoconsole.
• MitigationPolicy::dep, dep_atl_thunk, and sehop take Dep, AtlThunkEmulation, and Sehop; FontDisable and font_disable are NonSystemFonts and non_system_fonts.
• SuspendedChild::primary_thread_handle is main_thread_handle.
• Job::assign takes any process handle.
• Debug prints a Command as std does.
• SuspendedChild::id is const, like Child::id, and returns the identifier recorded at creation, so it cannot panic.
• The MSRV is Rust 1.84, as ADR 0018 records.
• Command::own_process_tree, console, priority, mitigation, and the creation-flag setters are const fn.

Removed

• DropPolicy, replaced by Command::own_process_tree.
• CreationFlags and SpawnOptions::creation_flags, replaced by the Command setters.

Fixed

• Command::to_command_line accepts a PATH set from a handle when a later operation replaces or removes it, as a spawn does.
• An attribute-list size beyond one allocation returns an error instead of panicking.

---

This PR was generated with release-plz.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1cfa6494-e83e-497a-ae92-d6115fa81e04

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}