Documented changes
21 typed entries
Verified contributors
1 verified contributor · 5 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.43.0a7 is a preview release published 2026-10-12. Upstream documents: Guard 3.43.0a7 is an opt-in prerelease cut from [`22af1c6`](https://github.com/hashgraph-online/hol-guard/commit/22af1c6649e2329f4384e4a1a60b8e986d6856df). Stable installations remain on the stable channel. **5 commits • 5 merged pull requests • 1 contributor** since [Guard 3.43.0a6](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.43.0a6). Its comparison base is alpha/v3.43.0a6. It includes 5 verified contribution deliveries with public evidence links.
Changes
Added
14- **cli**: Resolve Copilot server identities in Rust ([#4235](https://github.com/hashgraph-online/hol-guard/pull/4235)) Evidence for: **cli**: Resolve Copilot server identities in Rust ([#4235](https://github.com/hashgraph-online/hol-guard/pull/4235))
- Resolve Copilot server configuration, launch identity, server identity, and tool metadata in one resident request using the existing Rust identity kernels. Evidence for: Resolve Copilot server configuration, launch identity, server identity, and tool metadata in one resident request using the existing Rust identity kernels.
- Add a bound native remote MCP URL normalization operation with recorded parity. Python callers keep the in-process normalizer for now, because the MCP server catalog validates contributions at import time. Hook payload… Evidence for: Add a bound native remote MCP URL normalization operation with recorded parity. Python callers keep the in-process normalizer for now, because the MCP server catalog validates contributions at import time. Hook payload…
- Retire about 330 runtime Python lines net, with zero unclassified lines. Freeze 157 original outcomes and register source retirement records. Evidence for: Retire about 330 runtime Python lines net, with zero unclassified lines. Freeze 157 original outcomes and register source retirement records.
- **guard**: Model Windows paths in the native shim admin ([#4232](https://github.com/hashgraph-online/hol-guard/pull/4232)) Evidence for: **guard**: Model Windows paths in the native shim admin ([#4232](https://github.com/hashgraph-online/hol-guard/pull/4232))
- `shims/winpath/`: pure re-implementation of CPython 3.12 `PureWindowsPath`/`ntpath` semantics, checked against a generated oracle fixture (`gen_winpath_oracle.py`, 1368 cases). Evidence for: `shims/winpath/`: pure re-implementation of CPython 3.12 `PureWindowsPath`/`ntpath` semantics, checked against a generated oracle fixture (`gen_winpath_oracle.py`, 1368 cases).
- `ShimFacts` path helpers (`norm/join/name/parent/is_abs/path_eq/is_within/fs_path`) now follow the `windows` fact; `expanduser`, `resolve`, and `shutil.which` get their Windows variants (`pyfs_nt.rs`). Windows… Evidence for: `ShimFacts` path helpers (`norm/join/name/parent/is_abs/path_eq/is_within/fs_path`) now follow the `windows` fact; `expanduser`, `resolve`, and `shutil.which` get their Windows variants (`pyfs_nt.rs`). Windows…
- `shim_op.rs` only fails closed when the requested path flavour differs from the host. Evidence for: `shim_op.rs` only fails closed when the requested path flavour differs from the host.
- **guard**: Identify unlisted local CLIs in the native resident ([#4237](https://github.com/hashgraph-online/hol-guard/pull/4237)) Evidence for: **guard**: Identify unlisted local CLIs in the native resident ([#4237](https://github.com/hashgraph-online/hol-guard/pull/4237))
- command parsing, wrapper and compound-segment handling (`cd`, `source`/`.`, shell `-c`/`-lc`, pipelines, dedup); Evidence for: command parsing, wrapper and compound-segment handling (`cd`, `source`/`.`, shell `-c`/`-lc`, pipelines, dedup);
- launch identity, catalog ownership, reserved and common-utility filtering, and the grant hash. Evidence for: launch identity, catalog ownership, reserved and common-utility filtering, and the grant hash.
- **guard**: Build the MCP tool-call artifact and approval hash in the native resident ([#4234](https://github.com/hashgraph-online/hol-guard/pull/4234)) Evidence for: **guard**: Build the MCP tool-call artifact and approval hash in the native resident ([#4234](https://github.com/hashgraph-online/hol-guard/pull/4234))
- The inline `BuildMcpToolApprovalHash` arm of the context digest op is extracted as `build_mcp_tool_approval`, so both paths share one builder. Evidence for: The inline `BuildMcpToolApprovalHash` arm of the context digest op is extracted as `build_mcp_tool_approval`, so both paths share one builder.
- Python-semantic details are kept exactly: the public catalog definition carries a null `mcp_tool_authority_hash` while the real hash goes to private metadata only for catalog tools; `inputSchema` else `input_schema`… Evidence for: Python-semantic details are kept exactly: the public catalog definition carries a null `mcp_tool_authority_hash` while the real hash goes to private metadata only for catalog tools; `inputSchema` else `input_schema`…
Improved
1- **runtime**: Move shell helper semantics into the native runtime ([#4229](https://github.com/hashgraph-online/hol-guard/pull/4229)) Evidence for: **runtime**: Move shell helper semantics into the native runtime ([#4229](https://github.com/hashgraph-online/hol-guard/pull/4229))
Other changes
6- Documented change: Guard 3.43.0a7 is an opt-in prerelease cut from [`22af1c6`](https://github.com/hashgraph-online/hol-guard/commit/22af1c6649e2329f4384e4a1a60b8e986d6856df). Stable installations remain on the stable channel. **5 commits • 5 merged pull requests • 1 contributor** since [Guard 3.43.0a6](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.43.0a6). Evidence for: Documented change: Guard 3.43.0a7 is an opt-in prerelease cut from [`22af1c6`](https://github.com/hashgraph-online/hol-guard/commit/22af1c6649e2329f4384e4a1a60b8e986d6856df). Stable installations remain on the stable channel. **5 commits • 5 merged pull requests • 1 contributor** since [Guard 3.43.0a6](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.43.0a6).
- Merged pull request #4229: refactor(runtime): move shell helper semantics into the native runtime (#4229) Evidence for: Merged pull request #4229: refactor(runtime): move shell helper semantics into the native runtime (#4229)
- Merged pull request #4237: feat(guard): identify unlisted local CLIs in the native resident (#4237) Evidence for: Merged pull request #4237: feat(guard): identify unlisted local CLIs in the native resident (#4237)
- Merged pull request #4232: feat(guard): model Windows paths in the native shim admin (#4232) Evidence for: Merged pull request #4232: feat(guard): model Windows paths in the native shim admin (#4232)
- Merged pull request #4234: feat(guard): build the MCP tool-call artifact and approval hash in the native resident (#4234) Evidence for: Merged pull request #4234: feat(guard): build the MCP tool-call artifact and approval hash in the native resident (#4234)
- Merged pull request #4235: feat(cli): resolve Copilot server identities in Rust (#4235) Evidence for: Merged pull request #4235: feat(cli): resolve Copilot server identities in Rust (#4235)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.43.0a6
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
- @zerocodefast
Implementation · 5 credits
Evidence ledger5 credits
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author