Documented changes
41 typed entries
Verified contributors
1 verified contributor · 11 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.43.0a4 is a preview release published 2026-10-11. Upstream documents: Guard 3.43.0a4 is an opt-in prerelease cut from [`da723a4`](https://github.com/hashgraph-online/hol-guard/commit/da723a48b221c135cbce3bade1bab3ddb4959044). Stable installations remain on the stable channel. **11 commits • 11 merged pull requests • 1 contributor** since [Guard 3.43.0a3](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.43.0a3). Its comparison base is alpha/v3.43.0a3. It includes 11 verified contribution deliveries with public evidence links.
Changes
Added
4- **runtime**: Run the default runtime detectors in the native resident ([#4145](https://github.com/hashgraph-online/hol-guard/pull/4145)) Evidence for: **runtime**: Run the default runtime detectors in the native resident ([#4145](https://github.com/hashgraph-online/hol-guard/pull/4145))
- `guard-command` gets Rust ports of safe decode, persistence rules and skill content risk. Each comes with parity vectors recorded from the Python implementation it replaces. Evidence for: `guard-command` gets Rust ports of safe decode, persistence rules and skill content risk. Each comes with parity vectors recorded from the Python implementation it replaces.
- `guard-contracts` adds the `guard-runtime-detector-run-request.v1` and `result.v1` contracts. The `hol-guard-runtime` op is pure, binds its result to the canonical request digest, and returns typed errors for schema… Evidence for: `guard-contracts` adds the `guard-runtime-detector-run-request.v1` and `result.v1` contracts. The `hol-guard-runtime` op is pure, binds its result to the canonical request digest, and returns typed errors for schema…
- `native_runtime_detectors.py` is a thin client. It checks the response bounds and the request binding, then renders each detector's entry. Any failure raises `NativeRuntimeDetectorError`, so callers fail closed. There… Evidence for: `native_runtime_detectors.py` is a thin client. It checks the response bounds and the request binding, then renders each detector's entry. Any failure raises `NativeRuntimeDetectorError`, so callers fail closed. There…
Improved
1- Retire Python critical command floors ([#4164](https://github.com/hashgraph-online/hol-guard/pull/4164)) Evidence for: Retire Python critical command floors ([#4164](https://github.com/hashgraph-online/hol-guard/pull/4164))
Fixed
22- **guard**: Allow linked worktrees to read refs in their common git dir ([#4163](https://github.com/hashgraph-online/hol-guard/pull/4163)) Evidence for: **guard**: Allow linked worktrees to read refs in their common git dir ([#4163](https://github.com/hashgraph-online/hol-guard/pull/4163))
- the worktree's `.git` file names an admin entry under ` /worktrees`; Evidence for: the worktree's `.git` file names an admin entry under ` /worktrees`;
- that entry's `gitdir` backlink resolves to this checkout's `.git`; Evidence for: that entry's `gitdir` backlink resolves to this checkout's `.git`;
- the common directory is itself named `.git`. Evidence for: the common directory is itself named `.git`.
- **guard**: Keep a slow-starting daemon alive when its start budget runs out ([#4168](https://github.com/hashgraph-online/hol-guard/pull/4168)) Evidence for: **guard**: Keep a slow-starting daemon alive when its start budget runs out ([#4168](https://github.com/hashgraph-online/hol-guard/pull/4168))
- Pre-spawn cleanup (retiring old daemons, clearing state, recording the pending launch) took 7–16s on Windows. The daemon then needed another 15–20s to come up. Evidence for: Pre-spawn cleanup (retiring old daemons, clearing state, recording the pending launch) took 7–16s on Windows. The daemon then needed another 15–20s to come up.
- The readiness wait spent the rest of the 30s recovery budget. Evidence for: The readiness wait spent the rest of the 30s recovery budget.
- `collect_spawned_daemon_signals` queries the spawned process tree under the same lifecycle deadline, so those queries raised `TimeoutError`. Evidence for: `collect_spawned_daemon_signals` queries the spawned process tree under the same lifecycle deadline, so those queries raised `TimeoutError`.
- **gauntlet**: Stop the Guard tap from serializing parallel reviews ([#4149](https://github.com/hashgraph-online/hol-guard/pull/4149)) Evidence for: **gauntlet**: Stop the Guard tap from serializing parallel reviews ([#4149](https://github.com/hashgraph-online/hol-guard/pull/4149))
- **guard**: Run Claude Code test commands in the contained runner on macOS ([#4157](https://github.com/hashgraph-online/hol-guard/pull/4157)) Evidence for: **guard**: Run Claude Code test commands in the contained runner on macOS ([#4157](https://github.com/hashgraph-online/hol-guard/pull/4157))
- Native pretool returns the sandbox-required receipt for `claude-code` on macOS, alongside `omp` and `zcode`. Evidence for: Native pretool returns the sandbox-required receipt for `claude-code` on macOS, alongside `omp` and `zcode`.
- The containment receipt renders a `hookSpecificOutput` deny for `claude-code`, so a failed rewrite still blocks the original command. Evidence for: The containment receipt renders a `hookSpecificOutput` deny for `claude-code`, so a failed rewrite still blocks the original command.
- The hook worker rewrites the call to `hol-guard guard execute-contained-test --harness claude-code ...`. The sink re-checks native authority against the request digest before running anything. Evidence for: The hook worker rewrites the call to `hol-guard guard execute-contained-test --harness claude-code ...`. The sink re-checks native authority against the request digest before running anything.
- **guard**: Let Oh My Pi search its own artifact reports ([#4165](https://github.com/hashgraph-online/hol-guard/pull/4165)) Evidence for: **guard**: Let Oh My Pi search its own artifact reports ([#4165](https://github.com/hashgraph-online/hol-guard/pull/4165))
- a search over `~/.agent` itself; Evidence for: a search over `~/.agent` itself;
- a skills tree that holds a script; Evidence for: a skills tree that holds a script;
- an artifacts tree containing `data.json`, a `.cache/` directory, or a symlink. Evidence for: an artifacts tree containing `data.json`, a `.cache/` directory, or a symlink.
- **codex**: Name the real cause when the hook bridge cannot reach the daemon ([#4155](https://github.com/hashgraph-online/hol-guard/pull/4155)) Evidence for: **codex**: Name the real cause when the hook bridge cannot reach the daemon ([#4155](https://github.com/hashgraph-online/hol-guard/pull/4155))
- The bridge now picks its denial text from the recorded reason codes. If every recorded attempt failed because the daemon never answered, the denial says the daemon was not ready before the hook deadline, no approval… Evidence for: The bridge now picks its denial text from the recorded reason codes. If every recorded attempt failed because the daemon never answered, the denial says the daemon was not ready before the hook deadline, no approval…
- A missing state file and the stopped-daemon tombstone now get their own reason codes, `daemon_state_missing` and `daemon_state_stopped`. They used to be reported as `daemon_state_or_response_invalid` and… Evidence for: A missing state file and the stopped-daemon tombstone now get their own reason codes, `daemon_state_missing` and `daemon_state_stopped`. They used to be reported as `daemon_state_or_response_invalid` and…
- The dead-daemon, native-runtime-dead and overload messages are unchanged and keep their precedence. Evidence for: The dead-daemon, native-runtime-dead and overload messages are unchanged and keep their precedence.
- **guard**: Review writes that place a shared library below home ([#4154](https://github.com/hashgraph-online/hol-guard/pull/4154)) Evidence for: **guard**: Review writes that place a shared library below home ([#4154](https://github.com/hashgraph-online/hol-guard/pull/4154))
Other changes
14- Documented change: Guard 3.43.0a4 is an opt-in prerelease cut from [`da723a4`](https://github.com/hashgraph-online/hol-guard/commit/da723a48b221c135cbce3bade1bab3ddb4959044). Stable installations remain on the stable channel. **11 commits • 11 merged pull requests • 1 contributor** since [Guard 3.43.0a3](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.43.0a3). Evidence for: Documented change: Guard 3.43.0a4 is an opt-in prerelease cut from [`da723a4`](https://github.com/hashgraph-online/hol-guard/commit/da723a48b221c135cbce3bade1bab3ddb4959044). Stable installations remain on the stable channel. **11 commits • 11 merged pull requests • 1 contributor** since [Guard 3.43.0a3](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.43.0a3).
- **guard**: Reuse the verified runtime status when a review needs approval ([#4169](https://github.com/hashgraph-online/hol-guard/pull/4169)) Evidence for: **guard**: Reuse the verified runtime status when a review needs approval ([#4169](https://github.com/hashgraph-online/hol-guard/pull/4169))
- **guard**: Add measurement-only matched warm-path latency workflow ([#4140](https://github.com/hashgraph-online/hol-guard/pull/4140)) Evidence for: **guard**: Add measurement-only matched warm-path latency workflow ([#4140](https://github.com/hashgraph-online/hol-guard/pull/4140))
- Merged pull request #4155: fix(codex): name the real cause when the hook bridge cannot reach the daemon (#4155) Evidence for: Merged pull request #4155: fix(codex): name the real cause when the hook bridge cannot reach the daemon (#4155)
- Merged pull request #4169: perf(guard): reuse the verified runtime status when a review needs approval (#4169) Evidence for: Merged pull request #4169: perf(guard): reuse the verified runtime status when a review needs approval (#4169)
- Merged pull request #4154: fix(guard): review writes that place a shared library below home (#4154) Evidence for: Merged pull request #4154: fix(guard): review writes that place a shared library below home (#4154)
- Merged pull request #4165: fix(guard): let Oh My Pi search its own artifact reports (#4165) Evidence for: Merged pull request #4165: fix(guard): let Oh My Pi search its own artifact reports (#4165)
- Merged pull request #4140: ci(guard): add measurement-only matched warm-path latency workflow (#4140) Evidence for: Merged pull request #4140: ci(guard): add measurement-only matched warm-path latency workflow (#4140)
- Merged pull request #4168: fix(guard): keep a slow-starting daemon alive when its start budget runs out (#4168) Evidence for: Merged pull request #4168: fix(guard): keep a slow-starting daemon alive when its start budget runs out (#4168)
- Merged pull request #4163: fix(guard): allow linked worktrees to read refs in their common git dir (#4163) Evidence for: Merged pull request #4163: fix(guard): allow linked worktrees to read refs in their common git dir (#4163)
- Merged pull request #4149: fix(gauntlet): stop the Guard tap from serializing parallel reviews (#4149) Evidence for: Merged pull request #4149: fix(gauntlet): stop the Guard tap from serializing parallel reviews (#4149)
- Merged pull request #4145: feat(runtime): run the default runtime detectors in the native resident (#4145) Evidence for: Merged pull request #4145: feat(runtime): run the default runtime detectors in the native resident (#4145)
- Merged pull request #4164: refactor: retire Python critical command floors (#4164) Evidence for: Merged pull request #4164: refactor: retire Python critical command floors (#4164)
- Merged pull request #4157: fix(guard): run Claude Code test commands in the contained runner on macOS (#4157) Evidence for: Merged pull request #4157: fix(guard): run Claude Code test commands in the contained runner on macOS (#4157)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.43.0a3
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
- @zerocodefast
Implementation · 11 credits
Evidence ledger11 credits
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author