Release notes

HOL Guard v3.44.0a11

Preview

Published October 13, 2026Original GitHub release for alpha/v3.44.0a11

Documented changes

59 typed entries

Verified contributors

4 verified contributors · 24 credits

View the complete verified roster

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.44.0a11 is a preview release published 2026-10-13. Upstream documents: Guard 3.44.0a11 is an opt-in prerelease cut from cfcd6a8. Stable installations remain on the stable channel. 22 commits • 22 merged pull requests • 3 contributors since Guard 3.44.0a10. Its comparison base is alpha/v3.44.0a10. It includes 24 verified contribution deliveries with public evidence links.

Added

mcp: Relay MCP stdio traffic natively behind a fail-closed decision seam (#4528) Evidence for this change
Launch: parses the proxy flags (--flag value and --flag=value; unknown or missing flags are errors). It builds the scrubbed launch environment, adds HOL_GUARD_ORIGIN_HARNESS, builds the runtime launch… Evidence for this change
Transport (mcp_relay_core), matching RuntimeMcpGuardProxy.serve: Evidence for this change
request/response correlation with per-id buffering in both directions; Evidence for this change
runtime: Launch the native hook bridges on Windows (#4510) Evidence for this change
runtime: Prove bridge and resident identity on Windows (#4502) Evidence for this change
mcp: Require review for FTP directory deletion (#4514) Evidence for this change

Improved

runtime: Compose developer inspection proofs in the native resident (#4527) Evidence for this change

Fixed

guard: Give warm content-sensitivity queries room on a loaded machine (#4531) Evidence for this change
guard: Allow git worktree add for an existing branch (#4524) Evidence for this change
guard: Admit bare builtins and object filters in jq file reads (#4518) Evidence for this change
guard: Report a Cloudflare block of Guard Cloud as a network failure, not an expired sign-in (#4521) Evidence for this change
guard: Treat git search patterns as search text, not paths (#4520) Evidence for this change
the per-segment path-argument screen; Evidence for this change
the segment and whole-command sensitive-text floors; Evidence for this change
the generic sensitive-target signal; Evidence for this change
guard: Let read-only brew and pg_ctl status queries run without review (#4506) Evidence for this change
guard: Allow gh api reads that merge stderr into stdout (#4523) Evidence for this change
guard: Point package reviews at the frozen lockfile install (#4525) Evidence for this change
guard: Prove git ls-tree and plain cat-file object reads (#4496) Evidence for this change
guard: Allow jq key listings and literal filters in file reads (#4516) Evidence for this change
The filter grammar admitted only field projections and argument-free builtins. An iterated builtin (keys[]) and a builtin with a literal argument (has("x")) both failed the proof. Evidence for this change
The per-segment path screen checked every argument, filter text included. A filter ending in .key therefore looked like a private key file. Evidence for this change
guard: Give du of a missing sibling path the ls absent-path proof (#4511) Evidence for this change
guard: Run read-only bun eval scripts in the read-only runner (#4460) Evidence for this change
guard: Accept a trailing command terminator and version checks after cd (#4513) Evidence for this change
Trailing terminator.** ls;, grep -rn x src | head; and ls src; ls tests; failed to parse and were blocked. The shell runs them exactly as it runs the same command without the final ;. The segment splitter now… Evidence for this change
guard: Prove grep and ls globs across sibling repositories (#4512) Evidence for this change
grep -rn "node\|test" /service-api/.github/workflows/*.yml | head -4 Evidence for this change
grep -rn node ../service-api/.github/workflows/*.yml Evidence for this change
ls /service-api/.github/workflows/*.yml Evidence for this change

Other changes

Documented change: Guard 3.44.0a11 is an opt-in prerelease cut from cfcd6a8. Stable installations remain on the stable channel. 22 commits • 22 merged pull requests • 3 contributors since Guard 3.44.0a10. Evidence for this change
gauntlet: Render Windows fixture paths with forward slashes (#4515) Evidence for this change
guard: Exclude extension-control authority enroll, commit and recovery from runtime scope (#4503) Evidence for this change
scope: Count the MCP policy-request workflow as control plane (#4504) Evidence for this change
Merged pull request #4524: fix(guard): allow git worktree add for an existing branch (#4524) Evidence for this change
Merged pull request #4496: fix(guard): prove git ls-tree and plain cat-file object reads (#4496) Evidence for this change
Merged pull request #4518: fix(guard): admit bare builtins and object filters in jq file reads (#4518) Evidence for this change
Direct commit bd0fee06d660: fix(guard): retain projection-only jq stdin proof while allowing bounded file filters Evidence for this change
Merged pull request #4502: feat(runtime): prove bridge and resident identity on Windows (#4502) Evidence for this change
Merged pull request #4521: fix(guard): report a Cloudflare block of Guard Cloud as a network failure, not an expired sign-in (#4521) Evidence for this change
Merged pull request #4520: fix(guard): treat git search patterns as search text, not paths (#4520) Evidence for this change
Merged pull request #4513: fix(guard): accept a trailing command terminator and version checks after cd (#4513) Evidence for this change
Merged pull request #4528: feat(mcp): relay MCP stdio traffic natively behind a fail-closed decision seam (#4528) Evidence for this change
Merged pull request #4510: feat(runtime): launch the native hook bridges on Windows (#4510) Evidence for this change
Merged pull request #4523: fix(guard): allow gh api reads that merge stderr into stdout (#4523) Evidence for this change
Direct commit 9cd9117f37da: fix(guard): keep cloud evaluation under the reviewed module line limit Evidence for this change
Merged pull request #4511: fix(guard): give du of a missing sibling path the ls absent-path proof (#4511) Evidence for this change
Merged pull request #4506: fix(guard): let read-only brew and pg_ctl status queries run without review (#4506) Evidence for this change
Merged pull request #4515: test(gauntlet): render Windows fixture paths with forward slashes (#4515) Evidence for this change
Merged pull request #4503: chore(guard): exclude extension-control authority enroll, commit and recovery from runtime scope (#4503) Evidence for this change
Merged pull request #4525: fix(guard): point package reviews at the frozen lockfile install (#4525) Evidence for this change
Merged pull request #4460: fix(guard): run read-only bun eval scripts in the read-only runner (#4460) Evidence for this change
Merged pull request #4531: fix(guard): give warm content-sensitivity queries room on a loaded machine (#4531) Evidence for this change
Merged pull request #4516: fix(guard): allow jq key listings and literal filters in file reads (#4516) Evidence for this change
Merged pull request #4512: fix(guard): prove grep and ls globs across sibling repositories (#4512) Evidence for this change
Merged pull request #4514: feat(mcp): require review for FTP directory deletion (#4514) Evidence for this change
Merged pull request #4527: refactor(runtime): compose developer inspection proofs in the native resident (#4527) Evidence for this change
Merged pull request #4504: chore(scope): count the MCP policy-request workflow as control plane (#4504) Evidence for this change

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.44.0a10

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.