Documented changes
40 typed entries
Verified contributors
Credits being verified. Attribution coverage is in progress.
Attribution coverage
attribution in progress; history inventory partial.
Install
Scope
Guard v3.44.0a2 is a preview release published 2026-10-13. Upstream documents: Guard 3.44.0a2 is an opt-in prerelease cut from [`82d643d`](https://github.com/hashgraph-online/hol-guard/commit/82d643de37be6dcb762ad90941ffb1ad0cb39921). Stable installations remain on the stable channel. **13 commits • 13 merged pull requests • 1 contributor** since [Guard 3.44.0a1](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a1). Its comparison base is alpha/v3.44.0a1. It includes 13 verified contribution deliveries with public evidence links. Attribution for this release is being ver
Changes
Added
22- **guard**: Bind policy snapshots to a freshness proof for direct resident hooks ([#4324](https://github.com/hashgraph-online/hol-guard/pull/4324)) Evidence for: **guard**: Bind policy snapshots to a freshness proof for direct resident hooks ([#4324](https://github.com/hashgraph-online/hol-guard/pull/4324))
- **Push binding.** When the resident advertises `policy-snapshot-direct-lane-v1`, the publisher adds `direct_lane` to `policy_snapshot_push`. It lists the settled workspaces and the stat identity (`mtime_ns`, `size`… Evidence for: **Push binding.** When the resident advertises `policy-snapshot-direct-lane-v1`, the publisher adds `direct_lane` to `policy_snapshot_push`. It lists the settled workspaces and the stat identity (`mtime_ns`, `size`…
- **ACK lease file.** The publisher's `_acked` barrier is now a property that mirrors itself into `native-runtime/direct-lane/ack.json` (0600, in a 0700 directory) with a 15 second lease renewed by the publisher loop.… Evidence for: **ACK lease file.** The publisher's `_acked` barrier is now a property that mirrors itself into `native-runtime/direct-lane/ack.json` (0600, in a 0700 directory) with a 15 second lease renewed by the publisher loop.…
- **Admission.** `admit_direct_lane(workspace)` returns the current snapshot only when the binding matches it, the ACK file names the same generation and digest with an unexpired lease no more than 120 seconds ahead, the… Evidence for: **Admission.** `admit_direct_lane(workspace)` returns the current snapshot only when the binding matches it, the ACK file names the same generation and digest with an unexpired lease no more than 120 seconds ahead, the…
- **guard**: Run workspace-contained commands under bubblewrap on Linux ([#4304](https://github.com/hashgraph-online/hol-guard/pull/4304)) Evidence for: **guard**: Run workspace-contained commands under bubblewrap on Linux ([#4304](https://github.com/hashgraph-online/hol-guard/pull/4304))
- **Isolation.** The command runs in fresh user, mount, PID, network, IPC and UTS namespaces with all capabilities dropped. System roots and a short list of `/etc` files are mounted read-only. Evidence for: **Isolation.** The command runs in fresh user, mount, PID, network, IPC and UTS namespaces with all capabilities dropped. System roots and a short list of `/etc` files are mounted read-only.
- **Writes go to an overlay.** The workspace is the overlay's lower layer, and every write lands in a private upper directory under `/tmp`. Evidence for: **Writes go to an overlay.** The workspace is the overlay's lower layer, and every write lands in a private upper directory under `/tmp`.
- **Credentials are hidden.** Credential files and directories already in the workspace are masked for the run with read-only empty mounts. Evidence for: **Credentials are hidden.** Credential files and directories already in the workspace are masked for the run with read-only empty mounts.
- **guard**: Run unproven local commands in a workspace sandbox instead of asking ([#4299](https://github.com/hashgraph-online/hol-guard/pull/4299)) Evidence for: **guard**: Run unproven local commands in a workspace sandbox instead of asking ([#4299](https://github.com/hashgraph-online/hol-guard/pull/4299))
- The workspace is writable, except Git execution configuration (`.git/config`, hooks, `info`, `modules`, `worktrees`, `objects/info`, at any depth, case-insensitive) and protected agent, editor and CI paths. Evidence for: The workspace is writable, except Git execution configuration (`.git/config`, hooks, `info`, `modules`, `worktrees`, `objects/info`, at any depth, case-insensitive) and protected agent, editor and CI paths.
- No network, no home directory access except vetted toolchain roots, credential reads and writes denied, and a filtered environment with a sandbox-only PATH. Evidence for: No network, no home directory access except vetted toolchain roots, credential reads and writes denied, and a filtered environment with a sandbox-only PATH.
- A fresh `git init` runs once outside the sandbox with an empty template and no host configuration, and the sandbox executes the remainder. Evidence for: A fresh `git init` runs once outside the sandbox with an empty template and no host configuration, and the sandbox executes the remainder.
- **guard**: Answer Grok hooks from the native bounded bridge ([#4319](https://github.com/hashgraph-online/hol-guard/pull/4319)) Evidence for: **guard**: Answer Grok hooks from the native bounded bridge ([#4319](https://github.com/hashgraph-online/hol-guard/pull/4319))
- **guard**: Review Cline plugin tool calls through the bounded hook bridge ([#4318](https://github.com/hashgraph-online/hol-guard/pull/4318)) Evidence for: **guard**: Review Cline plugin tool calls through the bounded hook bridge ([#4318](https://github.com/hashgraph-online/hol-guard/pull/4318))
- **guard**: Answer OpenCode shell reviews from the native bounded bridge ([#4317](https://github.com/hashgraph-online/hol-guard/pull/4317)) Evidence for: **guard**: Answer OpenCode shell reviews from the native bounded bridge ([#4317](https://github.com/hashgraph-online/hol-guard/pull/4317))
- **guard**: Answer Cline hooks from the native bounded bridge ([#4316](https://github.com/hashgraph-online/hol-guard/pull/4316)) Evidence for: **guard**: Answer Cline hooks from the native bounded bridge ([#4316](https://github.com/hashgraph-online/hol-guard/pull/4316))
- **guard**: Answer Hermes hooks from the native bounded bridge ([#4315](https://github.com/hashgraph-online/hol-guard/pull/4315)) Evidence for: **guard**: Answer Hermes hooks from the native bounded bridge ([#4315](https://github.com/hashgraph-online/hol-guard/pull/4315))
- **Render.** A new `bounded_hook_bridge_hermes.rs` mirrors `hermes_bridge_response`: Evidence for: **Render.** A new `bounded_hook_bridge_hermes.rs` mirrors `hermes_bridge_response`:
- Hermes gets one flat `{"decision","reason"}` object. Evidence for: Hermes gets one flat `{"decision","reason"}` object.
- Exit code is 2 for `review`, `require-reapproval`, `sandbox-required` and `block`. Evidence for: Exit code is 2 for `review`, `require-reapproval`, `sandbox-required` and `block`.
- **guard**: Answer bounded CLI hooks from the native runtime ([#4313](https://github.com/hashgraph-online/hol-guard/pull/4313)) Evidence for: **guard**: Answer bounded CLI hooks from the native runtime ([#4313](https://github.com/hashgraph-online/hol-guard/pull/4313))
- **Install:** on POSIX, the hook command becomes `[runtime, "bounded-hook-bridge", python, "-I", "-c", bootstrap, config]`. Hermes, Windows, frozen launchers and `HOL_GUARD_BOUNDED_HOOK_BRIDGE=python` keep the Python… Evidence for: **Install:** on POSIX, the hook command becomes `[runtime, "bounded-hook-bridge", python, "-I", "-c", bootstrap, config]`. Hermes, Windows, frozen launchers and `HOL_GUARD_BOUNDED_HOOK_BRIDGE=python` keep the Python…
Fixed
3- **guard**: Let the macOS workspace sandbox run Xcode, Homebrew and python.org tools, pipelines and file deletes ([#4325](https://github.com/hashgraph-online/hol-guard/pull/4325)) Evidence for: **guard**: Let the macOS workspace sandbox run Xcode, Homebrew and python.org tools, pipelines and file deletes ([#4325](https://github.com/hashgraph-online/hol-guard/pull/4325))
- **ci**: Give the native command evaluator job room for the larger replay gate ([#4323](https://github.com/hashgraph-online/hol-guard/pull/4323)) Evidence for: **ci**: Give the native command evaluator job room for the larger replay gate ([#4323](https://github.com/hashgraph-online/hol-guard/pull/4323))
- **guard**: Let routine agent sessions run without false stops ([#4311](https://github.com/hashgraph-online/hol-guard/pull/4311)) Evidence for: **guard**: Let routine agent sessions run without false stops ([#4311](https://github.com/hashgraph-online/hol-guard/pull/4311))
Other changes
15- Documented change: Guard 3.44.0a2 is an opt-in prerelease cut from [`82d643d`](https://github.com/hashgraph-online/hol-guard/commit/82d643de37be6dcb762ad90941ffb1ad0cb39921). Stable installations remain on the stable channel. **13 commits • 13 merged pull requests • 1 contributor** since [Guard 3.44.0a1](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a1). Evidence for: Documented change: Guard 3.44.0a2 is an opt-in prerelease cut from [`82d643d`](https://github.com/hashgraph-online/hol-guard/commit/82d643de37be6dcb762ad90941ffb1ad0cb39921). Stable installations remain on the stable channel. **13 commits • 13 merged pull requests • 1 contributor** since [Guard 3.44.0a1](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a1).
- **gauntlet**: Build a macOS arm64 native wheel for full-task runs ([#4314](https://github.com/hashgraph-online/hol-guard/pull/4314)) Evidence for: **gauntlet**: Build a macOS arm64 native wheel for full-task runs ([#4314](https://github.com/hashgraph-online/hol-guard/pull/4314))
- Merged pull request #4317: feat(guard): answer OpenCode shell reviews from the native bounded bridge (#4317) Evidence for: Merged pull request #4317: feat(guard): answer OpenCode shell reviews from the native bounded bridge (#4317)
- Merged pull request #4323: fix(ci): give the native command evaluator job room for the larger replay gate (#4323) Evidence for: Merged pull request #4323: fix(ci): give the native command evaluator job room for the larger replay gate (#4323)
- Merged pull request #4311: fix(guard): let routine agent sessions run without false stops (#4311) Evidence for: Merged pull request #4311: fix(guard): let routine agent sessions run without false stops (#4311)
- Merged pull request #4299: feat(guard): run unproven local commands in a workspace sandbox instead of asking (#4299) Evidence for: Merged pull request #4299: feat(guard): run unproven local commands in a workspace sandbox instead of asking (#4299)
- Merged pull request #4324: feat(guard): bind policy snapshots to a freshness proof for direct resident hooks (#4324) Evidence for: Merged pull request #4324: feat(guard): bind policy snapshots to a freshness proof for direct resident hooks (#4324)
- Merged pull request #4325: fix(guard): let the macOS workspace sandbox run Xcode, Homebrew and python.org tools, pipelines and file deletes (#4325) Evidence for: Merged pull request #4325: fix(guard): let the macOS workspace sandbox run Xcode, Homebrew and python.org tools, pipelines and file deletes (#4325)
- Merged pull request #4313: feat(guard): answer bounded CLI hooks from the native runtime (#4313) Evidence for: Merged pull request #4313: feat(guard): answer bounded CLI hooks from the native runtime (#4313)
- Merged pull request #4315: feat(guard): answer Hermes hooks from the native bounded bridge (#4315) Evidence for: Merged pull request #4315: feat(guard): answer Hermes hooks from the native bounded bridge (#4315)
- Merged pull request #4318: feat(guard): review Cline plugin tool calls through the bounded hook bridge (#4318) Evidence for: Merged pull request #4318: feat(guard): review Cline plugin tool calls through the bounded hook bridge (#4318)
- Merged pull request #4319: feat(guard): answer Grok hooks from the native bounded bridge (#4319) Evidence for: Merged pull request #4319: feat(guard): answer Grok hooks from the native bounded bridge (#4319)
- Merged pull request #4304: feat(guard): run workspace-contained commands under bubblewrap on Linux (#4304) Evidence for: Merged pull request #4304: feat(guard): run workspace-contained commands under bubblewrap on Linux (#4304)
- Merged pull request #4314: ci(gauntlet): build a macOS arm64 native wheel for full-task runs (#4314) Evidence for: Merged pull request #4314: ci(gauntlet): build a macOS arm64 native wheel for full-task runs (#4314)
- Merged pull request #4316: feat(guard): answer Cline hooks from the native bounded bridge (#4316) Evidence for: Merged pull request #4316: feat(guard): answer Cline hooks from the native bounded bridge (#4316)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.44.0a1
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
- @zerocodefast
Implementation · 13 credits
Evidence ledger13 credits
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author