Documented changes
47 typed entries
Verified contributors
2 verified contributors · 20 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.44.0a8 is a preview release published 2026-10-13. Upstream documents: Guard 3.44.0a8 is an opt-in prerelease cut from [`1e8220d`](https://github.com/hashgraph-online/hol-guard/commit/1e8220d9fc221ef0a58fc0dc37ebb330b9389068). Stable installations remain on the stable channel. **17 commits • 17 merged pull requests • 2 contributors** since [Guard 3.44.0a7](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a7). Its comparison base is alpha/v3.44.0a7. It includes 20 verified contribution deliveries with public evidence links.
Changes
Added
5- **guard**: Spend an approve-once for a reviewed PreToolUse in the resident ([#4437](https://github.com/hashgraph-online/hol-guard/pull/4437)) Evidence for: **guard**: Spend an approve-once for a reviewed PreToolUse in the resident ([#4437](https://github.com/hashgraph-online/hol-guard/pull/4437))
- The resident derives the daemon's review identity (`native_review_binding`) and launch target (`_native_review_launch_target`), then runs the existing `consume_native_review_approval` store operation in-process. Evidence for: The resident derives the daemon's review identity (`native_review_binding`) and launch target (`_native_review_launch_target`), then runs the existing `consume_native_review_approval` store operation in-process.
- It holds the daemon's `storage-access.lock` shared for the spend. A missing or exclusively held gate defers. Evidence for: It holds the daemon's `storage-access.lock` shared for the spend. A missing or exclusively held gate defers.
- The accepted allow is rendered before the spend, so a spent approval always reaches the hook. Store files are kept owner-only afterwards, as the daemon does. Evidence for: The accepted allow is rendered before the spend, so a spent approval always reaches the hook. Store files are kept owner-only afterwards, as the daemon does.
- **guard**: Answer saved exact-action decisions for reviewed PreToolUse from the resident ([#4429](https://github.com/hashgraph-online/hol-guard/pull/4429)) Evidence for: **guard**: Answer saved exact-action decisions for reviewed PreToolUse from the resident ([#4429](https://github.com/hashgraph-online/hol-guard/pull/4429))
Improved
2- **mcp**: Project each tools/call in one resident round trip ([#4442](https://github.com/hashgraph-online/hol-guard/pull/4442)) Evidence for: **mcp**: Project each tools/call in one resident round trip ([#4442](https://github.com/hashgraph-online/hol-guard/pull/4442))
- **guard**: Delete store and config helpers that nothing calls ([#4428](https://github.com/hashgraph-online/hol-guard/pull/4428)) Evidence for: **guard**: Delete store and config helpers that nothing calls ([#4428](https://github.com/hashgraph-online/hol-guard/pull/4428))
Fixed
16- **guard**: Stop reviewing grep includes such as *.test.ts ([#4443](https://github.com/hashgraph-online/hol-guard/pull/4443)) Evidence for: **guard**: Stop reviewing grep includes such as *.test.ts ([#4443](https://github.com/hashgraph-online/hol-guard/pull/4443))
- `--include=.env.*` and `--include=*.env.*` (no literal source extension). Evidence for: `--include=.env.*` and `--include=*.env.*` (no literal source extension).
- The recursive tree walk, which refuses any target directory holding a Evidence for: The recursive tree walk, which refuses any target directory holding a
- **guard**: Let read-only git grep searches proceed without review ([#4439](https://github.com/hashgraph-online/hol-guard/pull/4439)) Evidence for: **guard**: Let read-only git grep searches proceed without review ([#4439](https://github.com/hashgraph-online/hol-guard/pull/4439))
- A closed grammar in `pretool/git_grep.rs` accepts the output and matching Evidence for: A closed grammar in `pretool/git_grep.rs` accepts the output and matching
- **guard**: Let frozen lockfile installs without scripts run without review ([#4444](https://github.com/hashgraph-online/hol-guard/pull/4444)) Evidence for: **guard**: Let frozen lockfile installs without scripts run without review ([#4444](https://github.com/hashgraph-online/hol-guard/pull/4444))
- **dashboard**: Calm the Extensions page hierarchy ([#4423](https://github.com/hashgraph-online/hol-guard/pull/4423)) Evidence for: **dashboard**: Calm the Extensions page hierarchy ([#4423](https://github.com/hashgraph-online/hol-guard/pull/4423))
- Connector discovery status and its retry button move from the search toolbar into the Custom extensions section. The error now shows as full wrapping text and announces via `aria-live`. The retry is a plain text button… Evidence for: Connector discovery status and its retry button move from the search toolbar into the Custom extensions section. The error now shows as full wrapping text and announces via `aria-live`. The retry is a plain text button…
- On first run, only the empty state shows **Add custom extension**. The header button returns once extensions exist or a search is active. Evidence for: On first run, only the empty state shows **Add custom extension**. The header button returns once extensions exist or a search is active.
- The empty state is a lighter dashed outline instead of a white card. Evidence for: The empty state is a lighter dashed outline instead of a white card.
- **guard**: Let frozen script-free installs, local package runners and plain printenv proceed ([#4436](https://github.com/hashgraph-online/hol-guard/pull/4436)) Evidence for: **guard**: Let frozen script-free installs, local package runners and plain printenv proceed ([#4436](https://github.com/hashgraph-online/hol-guard/pull/4436))
- **guard**: Allow plain curl reads and read-only kubectl queries ([#4421](https://github.com/hashgraph-online/hol-guard/pull/4421)) Evidence for: **guard**: Allow plain curl reads and read-only kubectl queries ([#4421](https://github.com/hashgraph-online/hol-guard/pull/4421))
- **guard**: Let git merge-base object names feed a Git read through xargs ([#4434](https://github.com/hashgraph-online/hol-guard/pull/4434)) Evidence for: **guard**: Let git merge-base object names feed a Git read through xargs ([#4434](https://github.com/hashgraph-online/hol-guard/pull/4434))
- `git merge-base REV...` with literal revisions and no options prints only Evidence for: `git merge-base REV...` with literal revisions and no options prints only
- **guard**: Let agents read and write .gitignore and rename branches without review ([#4427](https://github.com/hashgraph-online/hol-guard/pull/4427)) Evidence for: **guard**: Let agents read and write .gitignore and rename branches without review ([#4427](https://github.com/hashgraph-online/hol-guard/pull/4427))
- **updates**: Publish and select Linux Desktop alpha Core releases ([#4424](https://github.com/hashgraph-online/hol-guard/pull/4424)) Evidence for: **updates**: Publish and select Linux Desktop alpha Core releases ([#4424](https://github.com/hashgraph-online/hol-guard/pull/4424))
Other changes
24- Documented change: Guard 3.44.0a8 is an opt-in prerelease cut from [`1e8220d`](https://github.com/hashgraph-online/hol-guard/commit/1e8220d9fc221ef0a58fc0dc37ebb330b9389068). Stable installations remain on the stable channel. **17 commits • 17 merged pull requests • 2 contributors** since [Guard 3.44.0a7](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a7). Evidence for: Documented change: Guard 3.44.0a8 is an opt-in prerelease cut from [`1e8220d`](https://github.com/hashgraph-online/hol-guard/commit/1e8220d9fc221ef0a58fc0dc37ebb330b9389068). Stable installations remain on the stable channel. **17 commits • 17 merged pull requests • 2 contributors** since [Guard 3.44.0a7](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a7).
- **guard**: Write and read the Cloud advisory cache in the resident store op ([#4435](https://github.com/hashgraph-online/hol-guard/pull/4435)) Evidence for: **guard**: Write and read the Cloud advisory cache in the resident store op ([#4435](https://github.com/hashgraph-online/hol-guard/pull/4435))
- **guard**: Fetch each registry document once per package review ([#4438](https://github.com/hashgraph-online/hol-guard/pull/4438)) Evidence for: **guard**: Fetch each registry document once per package review ([#4438](https://github.com/hashgraph-online/hol-guard/pull/4438))
- Run Windows shim security gates in parallel without dropping coverage ([#4419](https://github.com/hashgraph-online/hol-guard/pull/4419)) Evidence for: Run Windows shim security gates in parallel without dropping coverage ([#4419](https://github.com/hashgraph-online/hol-guard/pull/4419))
- Merged pull request #4428: refactor(guard): delete store and config helpers that nothing calls (#4428) Evidence for: Merged pull request #4428: refactor(guard): delete store and config helpers that nothing calls (#4428)
- Merged pull request #4442: refactor(mcp): project each tools/call in one resident round trip (#4442) Evidence for: Merged pull request #4442: refactor(mcp): project each tools/call in one resident round trip (#4442)
- Merged pull request #4419: ci: run Windows shim security gates in parallel without dropping coverage (#4419) Evidence for: Merged pull request #4419: ci: run Windows shim security gates in parallel without dropping coverage (#4419)
- Merged pull request #4436: fix(guard): let frozen script-free installs, local package runners and plain printenv proceed (#4436) Evidence for: Merged pull request #4436: fix(guard): let frozen script-free installs, local package runners and plain printenv proceed (#4436)
- Merged pull request #4427: fix(guard): let agents read and write .gitignore and rename branches without review (#4427) Evidence for: Merged pull request #4427: fix(guard): let agents read and write .gitignore and rename branches without review (#4427)
- Merged pull request #4440: perf(guard): reuse registry metadata between npm install reviews (#4440) Evidence for: Merged pull request #4440: perf(guard): reuse registry metadata between npm install reviews (#4440)
- Merged pull request #4437: feat(guard): spend an approve-once for a reviewed PreToolUse in the resident (#4437) Evidence for: Merged pull request #4437: feat(guard): spend an approve-once for a reviewed PreToolUse in the resident (#4437)
- Merged pull request #4439: fix(guard): let read-only git grep searches proceed without review (#4439) Evidence for: Merged pull request #4439: fix(guard): let read-only git grep searches proceed without review (#4439)
- Merged pull request #4444: fix(guard): let frozen lockfile installs without scripts run without review (#4444) Evidence for: Merged pull request #4444: fix(guard): let frozen lockfile installs without scripts run without review (#4444)
- Merged pull request #4438: perf(guard): fetch each registry document once per package review (#4438) Evidence for: Merged pull request #4438: perf(guard): fetch each registry document once per package review (#4438)
- Merged pull request #4424: fix(updates): publish and select Linux Desktop alpha Core releases (#4424) Evidence for: Merged pull request #4424: fix(updates): publish and select Linux Desktop alpha Core releases (#4424)
- Merged pull request #4421: fix(guard): allow plain curl reads and read-only kubectl queries (#4421) Evidence for: Merged pull request #4421: fix(guard): allow plain curl reads and read-only kubectl queries (#4421)
- Merged pull request #4429: feat(guard): answer saved exact-action decisions for reviewed PreToolUse from the resident (#4429) Evidence for: Merged pull request #4429: feat(guard): answer saved exact-action decisions for reviewed PreToolUse from the resident (#4429)
- Direct commit 1e08d9df0484: fix(extensions): retain discovery status across filters and errors Evidence for: Direct commit 1e08d9df0484: fix(extensions): retain discovery status across filters and errors
- Merged pull request #4443: fix(guard): stop reviewing grep includes such as *.test.ts (#4443) Evidence for: Merged pull request #4443: fix(guard): stop reviewing grep includes such as *.test.ts (#4443)
- Merged pull request #4435: perf(guard): write and read the Cloud advisory cache in the resident store op (#4435) Evidence for: Merged pull request #4435: perf(guard): write and read the Cloud advisory cache in the resident store op (#4435)
- Direct commit 43ca66bc78da: test(guard): align branch-listing fixture with safe rename proof Evidence for: Direct commit 43ca66bc78da: test(guard): align branch-listing fixture with safe rename proof
- Merged pull request #4434: fix(guard): let git merge-base object names feed a Git read through xargs (#4434) Evidence for: Merged pull request #4434: fix(guard): let git merge-base object names feed a Git read through xargs (#4434)
- Direct commit e1a250e12bbb: test(store): verify raw cloud exception cleanup after sync Evidence for: Direct commit e1a250e12bbb: test(store): verify raw cloud exception cleanup after sync
- Merged pull request #4423: fix(dashboard): calm the Extensions page hierarchy (#4423) Evidence for: Merged pull request #4423: fix(dashboard): calm the Extensions page hierarchy (#4423)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.44.0a7
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
- @kantorcodes
Implementation · 4 credits
- @zerocodefast
Implementation · 16 credits
Evidence ledger20 credits
- @kantorcodesSource for kantorcodes
Implementation · Pull request author
- @kantorcodesSource for kantorcodes
Implementation · Verified commit author
- @kantorcodesSource for kantorcodes
Implementation · Verified commit author
- @kantorcodesSource for kantorcodes
Implementation · Verified commit author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author