Documented changes
73 typed entries
Verified contributors
2 verified contributors · 33 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.44.0a6 is a preview release published 2026-10-13. Upstream documents: Guard 3.44.0a6 is an opt-in prerelease cut from [`34cd91f`](https://github.com/hashgraph-online/hol-guard/commit/34cd91f07dd84e2d8ee0a2dade71366d32b04a09). Stable installations remain on the stable channel. **31 commits • 31 merged pull requests • 2 contributors** since [Guard 3.44.0a5](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a5). Its comparison base is alpha/v3.44.0a5. It includes 33 verified contribution deliveries with public evidence links.
Changes
Added
32- **guard**: Answer Claude prompts that carry Guard's notice from the resident ([#4405](https://github.com/hashgraph-online/hol-guard/pull/4405)) Evidence for: **guard**: Answer Claude prompts that carry Guard's notice from the resident ([#4405](https://github.com/hashgraph-online/hol-guard/pull/4405))
- `hook_direct_claude_prompt_text.rs` renders the daemon's copy from the native result: the system message, the briefing in `additionalContext` (only when the response has a `hookSpecificOutput` object), the secret-read… Evidence for: `hook_direct_claude_prompt_text.rs` renders the daemon's copy from the native result: the system message, the briefing in `additionalContext` (only when the response has a `hookSpecificOutput` object), the secret-read…
- A reason the daemon would stringify from a non-text value still defers, so the daemon keeps that rare shape. Evidence for: A reason the daemon would stringify from a non-text value still defers, so the daemon keeps that rare shape.
- `ensure_terminal_punctuation` is shared with the PermissionRequest text module. Evidence for: `ensure_terminal_punctuation` is shared with the PermissionRequest text module.
- **guard**: Answer Claude permission requests with a pending notice from the resident ([#4399](https://github.com/hashgraph-online/hol-guard/pull/4399)) Evidence for: **guard**: Answer Claude permission requests with a pending notice from the resident ([#4399](https://github.com/hashgraph-online/hol-guard/pull/4399))
- The daemon binds its policy-integrity key (and key id) to the direct lane, but only when the resident advertises `hook-direct-permission-notice-v1`. It reads an existing key and never creates one for the resident. Evidence for: The daemon binds its policy-integrity key (and key id) to the direct lane, but only when the resident advertises `hook-direct-permission-notice-v1`. It reads an existing key and never creates one for the resident.
- The resident first probes read-only for a notice row. Only when one exists does it take an immediate write transaction, verify the notice with the bound key, mark the pending prompt seen, and render the same response… Evidence for: The resident first probes read-only for a notice row. Only when one exists does it take an immediate write transaction, verify the notice with the bound key, mark the pending prompt seen, and render the same response…
- The key path needs a current direct-lane ACK lease (`admit_direct_binding`), the same admission a direct allow needs. Evidence for: The key path needs a current direct-lane ACK lease (`admit_direct_binding`), the same admission a direct allow needs.
- **guard**: Compose generic-hook saved decisions in one resident call ([#4397](https://github.com/hashgraph-online/hol-guard/pull/4397)) Evidence for: **guard**: Compose generic-hook saved decisions in one resident call ([#4397](https://github.com/hashgraph-online/hol-guard/pull/4397))
- runs every candidate on one store connection, always non-consuming; Evidence for: runs every candidate on one store connection, always non-consuming;
- applies the portable-workspace rule: a portable decision is restrictive only and never brings a one-shot approval; Evidence for: applies the portable-workspace rule: a portable decision is restrictive only and never brings a one-shot approval;
- takes the most restrictive decision within each group; Evidence for: takes the most restrictive decision within each group;
- **guard**: Answer Claude permission dialogs without a Guard notice from the resident ([#4395](https://github.com/hashgraph-online/hol-guard/pull/4395)) Evidence for: **guard**: Answer Claude permission dialogs without a Guard notice from the resident ([#4395](https://github.com/hashgraph-online/hol-guard/pull/4395))
- The Claude bridge asks a live resident about `PermissionRequest`. Other harnesses, other permission events and notifications still go straight to the daemon. Evidence for: The Claude bridge asks a live resident about `PermissionRequest`. Other harnesses, other permission events and notifications still go straight to the daemon.
- The lane accepts the names `runtime_hook_event_name` maps to `PermissionRequest` for Claude Code only. It applies the checks that lifecycle hooks already get: no transition probe, no payload reference, a bound lane… Evidence for: The lane accepts the names `runtime_hook_event_name` maps to `PermissionRequest` for Claude Code only. It applies the checks that lifecycle hooks already get: no transition probe, no payload reference, a bound lane…
- The session ID is stripped as `_optional_string` strips it. Without a session the daemon looks up no notice, so the lane passes the hook through too. Evidence for: The session ID is stripped as `_optional_string` strips it. Without a session the daemon looks up no notice, so the lane passes the hook through too.
- **guard**: Answer Grok hooks from the resident ([#4389](https://github.com/hashgraph-online/hol-guard/pull/4389)) Evidence for: **guard**: Answer Grok hooks from the resident ([#4389](https://github.com/hashgraph-online/hol-guard/pull/4389))
- The direct lane accepts `grok`. A lifecycle hook gets `{}`, which is what `fail_closed_response` returns for Grok. Evidence for: The direct lane accepts `grok`. A lifecycle hook gets `{}`, which is what `fail_closed_response` returns for Grok.
- `grok_direct_request` builds the request from the bridge config's guard home and the `?home=` value the client sends. It sends a request only when the daemon would keep that context: the guard home must already be its… Evidence for: `grok_direct_request` builds the request from the bridge config's guard home and the `?home=` value the client sends. It sends a request only when the daemon would keep that context: the guard home must already be its…
- The Grok bridge asks the resident within half of its daemon timeout. Once the resident answers, its response is rendered through the same `to_native` and approval-wait steps as a daemon response, and the daemon is not… Evidence for: The Grok bridge asks the resident within half of its daemon timeout. Once the resident answers, its response is rendered through the same `to_native` and approval-wait steps as a daemon response, and the daemon is not…
- **guard**: Answer ZCode hooks from the resident ([#4386](https://github.com/hashgraph-online/hol-guard/pull/4386)) Evidence for: **guard**: Answer ZCode hooks from the resident ([#4386](https://github.com/hashgraph-online/hol-guard/pull/4386))
- `zcode` joins the resident's direct harnesses and the bounded bridge's direct list. Evidence for: `zcode` joins the resident's direct harnesses and the bounded bridge's direct list.
- When the edge denies a ZCode `PreToolUse` shell call as `sandbox-required`, the resident rewrites it into the `execute-contained-test` sink. It writes the same request snapshot and runs the same platform checks as… Evidence for: When the edge denies a ZCode `PreToolUse` shell call as `sandbox-required`, the resident rewrites it into the `execute-contained-test` sink. It writes the same request snapshot and runs the same platform checks as…
- The daemon's evidence drain now accepts ZCode records, so a ZCode answer is recorded exactly as the daemon records its own. Evidence for: The daemon's evidence drain now accepts ZCode records, so a ZCode answer is recorded exactly as the daemon records its own.
- **guard**: Answer lifecycle hooks from the resident ([#4384](https://github.com/hashgraph-online/hol-guard/pull/4384)) Evidence for: **guard**: Answer lifecycle hooks from the resident ([#4384](https://github.com/hashgraph-online/hol-guard/pull/4384))
- `hook_direct_lifecycle.rs` handles an event that `direct_event` does not review: Evidence for: `hook_direct_lifecycle.rs` handles an event that `direct_event` does not review:
- It finds the event name with the daemon's `runtime_hook_event_name` rule. Evidence for: It finds the event name with the daemon's `runtime_hook_event_name` rule.
- It returns `{"decision": "allow", ...}` for hermes and openclaw, and `{"continue": true, ..., "hookSpecificOutput": {"hookEventName": }}` for everyone else, with `reason_code` `native_hook_event_unavailable`. Evidence for: It returns `{"decision": "allow", ...}` for hermes and openclaw, and `{"continue": true, ..., "hookSpecificOutput": {"hookEventName": }}` for everyone else, with `reason_code` `native_hook_event_unavailable`.
- **guard**: Answer bounded harness hooks from the resident ([#4373](https://github.com/hashgraph-online/hol-guard/pull/4373)) Evidence for: **guard**: Answer bounded harness hooks from the resident ([#4373](https://github.com/hashgraph-online/hol-guard/pull/4373))
- `codex_hook_bridge_direct.rs`: adds `bounded_direct_request` and `bounded_direct_answer`. The request carries the daemon's own Guard home. It is sent only when that path is already canonical, because the daemon reviews… Evidence for: `codex_hook_bridge_direct.rs`: adds `bounded_direct_request` and `bounded_direct_answer`. The request carries the daemon's own Guard home. It is sent only when that path is already canonical, because the daemon reviews…
- `bounded_hook_bridge.rs`: tries the direct lane before the daemon. It renders the resident's harness response with the existing `daemon_response_to_native`. If the answer cannot be rendered, the route is `Delegate {… Evidence for: `bounded_hook_bridge.rs`: tries the direct lane before the daemon. It renders the resident's harness response with the existing `daemon_response_to_native`. If the answer cannot be rendered, the route is `Delegate {…
- `hook_direct.rs`: the resident admits the seven harnesses. ZCode still defers because the daemon routes it through containment, and Grok keeps its own client. Evidence for: `hook_direct.rs`: the resident admits the seven harnesses. ZCode still defers because the daemon routes it through containment, and Grok keeps its own client.
Fixed
7- **guard**: Admit read-only for loops over literal words by unrolling them ([#4391](https://github.com/hashgraph-online/hol-guard/pull/4391)) Evidence for: **guard**: Admit read-only for loops over literal words by unrolling them ([#4391](https://github.com/hashgraph-online/hol-guard/pull/4391))
- **daemon**: Wait for republish after stale control authority or expired snapshot ([#4404](https://github.com/hashgraph-online/hol-guard/pull/4404)) Evidence for: **daemon**: Wait for republish after stale control authority or expired snapshot ([#4404](https://github.com/hashgraph-online/hol-guard/pull/4404))
- `native_command_control_authority_not_current`: another process sharing the Guard home re-committed the command-control authority marker, for example a second Guard version or a concurrent publisher. The publisher… Evidence for: `native_command_control_authority_not_current`: another process sharing the Guard home re-committed the command-control authority marker, for example a second Guard version or a concurrent publisher. The publisher…
- `native_policy_snapshot_expired`: the snapshot reached its expiry before renewal finished, which happens under host load. The publisher schedules an immediate republish when it marks the snapshot expired. Evidence for: `native_policy_snapshot_expired`: the snapshot reached its expiry before renewal finished, which happens under host load. The publisher schedules an immediate republish when it marks the snapshot expired.
- **guard**: Run contained Vite builds from a package directory with their declared output, esbuild, and config bundle ([#4383](https://github.com/hashgraph-online/hol-guard/pull/4383)) Evidence for: **guard**: Run contained Vite builds from a package directory with their declared output, esbuild, and config bundle ([#4383](https://github.com/hashgraph-online/hol-guard/pull/4383))
- **guard**: Keep quoted regex alternation from posing as a synthesized program ([#4388](https://github.com/hashgraph-online/hol-guard/pull/4388)) Evidence for: **guard**: Keep quoted regex alternation from posing as a synthesized program ([#4388](https://github.com/hashgraph-online/hol-guard/pull/4388))
- **guard**: Keep network clients out of containment and fix macOS containment regressions ([#4392](https://github.com/hashgraph-online/hol-guard/pull/4392)) Evidence for: **guard**: Keep network clients out of containment and fix macOS containment regressions ([#4392](https://github.com/hashgraph-online/hol-guard/pull/4392))
Other changes
34- Documented change: Guard 3.44.0a6 is an opt-in prerelease cut from [`34cd91f`](https://github.com/hashgraph-online/hol-guard/commit/34cd91f07dd84e2d8ee0a2dade71366d32b04a09). Stable installations remain on the stable channel. **31 commits • 31 merged pull requests • 2 contributors** since [Guard 3.44.0a5](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a5). Evidence for: Documented change: Guard 3.44.0a6 is an opt-in prerelease cut from [`34cd91f`](https://github.com/hashgraph-online/hol-guard/commit/34cd91f07dd84e2d8ee0a2dade71366d32b04a09). Stable installations remain on the stable channel. **31 commits • 31 merged pull requests • 2 contributors** since [Guard 3.44.0a5](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a5).
- Merged pull request #4377: fix(guard): let --ignore-scripts installs of a git-free tree continue on npm 11.9 and later (#4377) Evidence for: Merged pull request #4377: fix(guard): let --ignore-scripts installs of a git-free tree continue on npm 11.9 and later (#4377)
- Merged pull request #4374: fix(guard): let script-free npm installs continue from ordinary developer shells (#4374) Evidence for: Merged pull request #4374: fix(guard): let script-free npm installs continue from ordinary developer shells (#4374)
- Direct commit f0faa4f4b6cf: fix(ci): own the Rust nextest config in the hook data-plane contract Evidence for: Direct commit f0faa4f4b6cf: fix(ci): own the Rust nextest config in the hook data-plane contract
- Merged pull request #4373: feat(guard): answer bounded harness hooks from the resident (#4373) Evidence for: Merged pull request #4373: feat(guard): answer bounded harness hooks from the resident (#4373)
- Merged pull request #4402: perf(guard): compose generic-hook approval reuse in the grouped saved-decision call (#4402) Evidence for: Merged pull request #4402: perf(guard): compose generic-hook approval reuse in the grouped saved-decision call (#4402)
- Merged pull request #4379: fix(guard): accept every Oh My Pi line selector on reads Guard already allows (#4379) Evidence for: Merged pull request #4379: fix(guard): accept every Oh My Pi line selector on reads Guard already allows (#4379)
- Merged pull request #4371: fix(guard): let commits in a contained linked worktree clear AUTO_MERGE (#4371) Evidence for: Merged pull request #4371: fix(guard): let commits in a contained linked worktree clear AUTO_MERGE (#4371)
- Merged pull request #4372: fix(gauntlet): judge the Python full task's tests by what they import (#4372) Evidence for: Merged pull request #4372: fix(gauntlet): judge the Python full task's tests by what they import (#4372)
- Merged pull request #4400: perf(ci): parallelize Rust compilation and prioritize slow tests (#4400) Evidence for: Merged pull request #4400: perf(ci): parallelize Rust compilation and prioritize slow tests (#4400)
- Merged pull request #4378: fix(guard): let recursive search read feature directories named after secrets (#4378) Evidence for: Merged pull request #4378: fix(guard): let recursive search read feature directories named after secrets (#4378)
- Merged pull request #4389: feat(guard): answer Grok hooks from the resident (#4389) Evidence for: Merged pull request #4389: feat(guard): answer Grok hooks from the resident (#4389)
- Merged pull request #4394: fix(guard): point chained public repo creates to the private alternative (#4394) Evidence for: Merged pull request #4394: fix(guard): point chained public repo creates to the private alternative (#4394)
- Merged pull request #4393: fix(guard): tell agents to retry when the native policy is not ready (#4393) Evidence for: Merged pull request #4393: fix(guard): tell agents to retry when the native policy is not ready (#4393)
- Merged pull request #4395: feat(guard): answer Claude permission dialogs without a Guard notice from the resident (#4395) Evidence for: Merged pull request #4395: feat(guard): answer Claude permission dialogs without a Guard notice from the resident (#4395)
- Merged pull request #4375: fix(guard): name the home-directory bound when git worktree add leaves home (#4375) Evidence for: Merged pull request #4375: fix(guard): name the home-directory bound when git worktree add leaves home (#4375)
- Merged pull request #4376: fix(gauntlet): build Docker full tasks in the container user's own home (#4376) Evidence for: Merged pull request #4376: fix(gauntlet): build Docker full tasks in the container user's own home (#4376)
- Merged pull request #4397: feat(guard): compose generic-hook saved decisions in one resident call (#4397) Evidence for: Merged pull request #4397: feat(guard): compose generic-hook saved decisions in one resident call (#4397)
- Merged pull request #4399: feat(guard): answer Claude permission requests with a pending notice from the resident (#4399) Evidence for: Merged pull request #4399: feat(guard): answer Claude permission requests with a pending notice from the resident (#4399)
- Merged pull request #4391: fix(guard): admit read-only for loops over literal words by unrolling them (#4391) Evidence for: Merged pull request #4391: fix(guard): admit read-only for loops over literal words by unrolling them (#4391)
- Merged pull request #4382: fix(guard): keep the evidence drain from tripping the restart circuit (#4382) Evidence for: Merged pull request #4382: fix(guard): keep the evidence drain from tripping the restart circuit (#4382)
- Merged pull request #4387: fix(guard): prove worktree add with -C, global hook managers and LFS filters (#4387) Evidence for: Merged pull request #4387: fix(guard): prove worktree add with -C, global hook managers and LFS filters (#4387)
- Merged pull request #4384: feat(guard): answer lifecycle hooks from the resident (#4384) Evidence for: Merged pull request #4384: feat(guard): answer lifecycle hooks from the resident (#4384)
- Merged pull request #4381: fix(guard): stop offering --ignore-scripts as the way past a package review (#4381) Evidence for: Merged pull request #4381: fix(guard): stop offering --ignore-scripts as the way past a package review (#4381)
- Merged pull request #4388: fix(guard): keep quoted regex alternation from posing as a synthesized program (#4388) Evidence for: Merged pull request #4388: fix(guard): keep quoted regex alternation from posing as a synthesized program (#4388)
- Merged pull request #4405: feat(guard): answer Claude prompts that carry Guard's notice from the resident (#4405) Evidence for: Merged pull request #4405: feat(guard): answer Claude prompts that carry Guard's notice from the resident (#4405)
- Merged pull request #4386: feat(guard): answer ZCode hooks from the resident (#4386) Evidence for: Merged pull request #4386: feat(guard): answer ZCode hooks from the resident (#4386)
- Merged pull request #4404: fix(daemon): wait for republish after stale control authority or expired snapshot (#4404) Evidence for: Merged pull request #4404: fix(daemon): wait for republish after stale control authority or expired snapshot (#4404)
- Merged pull request #4390: fix(gauntlet): accept contained runs that use the agent's own home directory (#4390) Evidence for: Merged pull request #4390: fix(gauntlet): accept contained runs that use the agent's own home directory (#4390)
- Merged pull request #4380: fix(guard): keep lifecycle hooks from opening the native circuit breaker (#4380) Evidence for: Merged pull request #4380: fix(guard): keep lifecycle hooks from opening the native circuit breaker (#4380)
- Merged pull request #4392: fix(guard): keep network clients out of containment and fix macOS containment regressions (#4392) Evidence for: Merged pull request #4392: fix(guard): keep network clients out of containment and fix macOS containment regressions (#4392)
- Merged pull request #4366: fix(guard): allow frozen, script-free installs from registry-only lockfiles (#4366) Evidence for: Merged pull request #4366: fix(guard): allow frozen, script-free installs from registry-only lockfiles (#4366)
- Direct commit 2af61f97d337: fix(guard): reject environment-sensitive loop names and align audit status tests Evidence for: Direct commit 2af61f97d337: fix(guard): reject environment-sensitive loop names and align audit status tests
- Merged pull request #4383: fix(guard): run contained Vite builds from a package directory with their declared output, esbuild, and config bundle (#4383) Evidence for: Merged pull request #4383: fix(guard): run contained Vite builds from a package directory with their declared output, esbuild, and config bundle (#4383)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.44.0a5
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
- @kantorcodes
Implementation · 2 credits
- @zerocodefast
Implementation · 31 credits
Evidence ledger33 credits
- @kantorcodesSource for kantorcodes
Implementation · Pull request author
- @kantorcodesSource for kantorcodes
Implementation · Verified commit author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Verified commit author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author