Release notes

HOL Guard v3.47.0a2

Preview

Published October 15, 2026Original GitHub release for alpha/v3.47.0a2

Documented changes

67 typed entries

Verified contributors

5 verified contributors · 67 credits

View the complete verified roster

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.47.0a2 is a preview release published 2026-10-15. Its comparison base is alpha/v3.46.0a1. It includes 67 verified contribution deliveries with public evidence links.

Changes

Other changes67

Other changes

Merged pull request #4758: fix(guard): stop holding branch work and config reads in long-lived signed clones (#4758) Evidence for this change
Merged pull request #4738: fix(hooks): wait for the restarted daemon before retrying a Claude hook (#4738) Evidence for this change
Merged pull request #4768: fix(guard): let Always allow stick for node scripts whose imported code is unchanged (#4768) Evidence for this change
Merged pull request #4724: perf(runtime): block custom-rule launches the resident cannot verify in the native hook (#4724) Evidence for this change
Merged pull request #4784: fix(guard): map read-only PowerShell cmdlets to the POSIX reads Guard already proves (#4784) Evidence for this change
Merged pull request #4771: fix(guard): stop an idle daemon from rebuilding its policy snapshot in a loop (#4771) Evidence for this change
Merged pull request #4775: fix(guard): unwrap POSIX system wrappers on Windows and repair the nightly native proofs (#4775) Evidence for this change
Merged pull request #4755: fix(mcp): launch proxied MCP servers on Windows through the native runtime (#4755) Evidence for this change
Merged pull request #4760: refactor(hooks): derive the native edge floor in the resident composition (#4760) Evidence for this change
Direct commit 2306cbf391c4: Merge branch 'main' into add-rls-saboteur Evidence for this change
Merged pull request #4741: fix(dashboard): rank whole-word search matches first and stop matching inside words (#4741) Evidence for this change
Merged pull request #4785: perf(guard): stop re-binding guard home's DACL after every store connection on Windows (#4785) Evidence for this change
Merged pull request #4740: ci: emit shard plans with verified native artifacts Evidence for this change
Merged pull request #4737: perf(guard): page, count and summarize approval requests in the native runtime (#4737) Evidence for this change
Merged pull request #4727: perf(runtime): answer the first hook in a new file-less directory on the current policy snapshot (#4727) Evidence for this change
Direct commit 06d749d7bd82: fix(listing): faf-cli tagline reflects Guard default policy Evidence for this change
Merged pull request #4636: feat(extensions): add command.rls-saboteur command source (#4636) Evidence for this change
Merged pull request #4736: ci: warm native caches independently of main analysis Evidence for this change
Merged pull request #4761: fix(guard): fail closed when the resident cannot parse a wrapped install's package intent (#4761) Evidence for this change
Merged pull request #4728: perf(runtime): keep hooks on the direct lane while a new policy ACK lands (#4728) Evidence for this change
Merged pull request #4772: fix(guard): close seven deferred review findings in hooks and command review (#4772) Evidence for this change
Merged pull request #4739: feat(runtime): route frozen Desktop hooks through the native bridges (#4739) Evidence for this change
Merged pull request #4791: ci: split Rust runtime tests into complete nextest partitions Evidence for this change
Merged pull request #4786: fix(guard): classify Windows name aliases of secret paths like the plain path (#4786) Evidence for this change
Merged pull request #3372: feat(mcp): add Plim MCP server contribution (#3372) Evidence for this change
Merged pull request #4726: perf(guard): record approval creation events in the native queue write (#4726) Evidence for this change
Merged pull request #4767: perf(guard): resolve dashboard and workspace-review decisions in the native runtime (#4767) Evidence for this change
Merged pull request #4731: perf(guard): read approval requests through the native runtime (#4731) Evidence for this change
Merged pull request #4788: fix(windows): run Oh My Pi and Pi Python test scripts in the AppContainer (#4788) Evidence for this change
Merged pull request #4765: fix(guard): route build and test work only to sandboxes that can run it (#4765) Evidence for this change
Merged pull request #4787: perf(guard): list each directory before opening ignore files in the rg hidden-file walk (#4787) Evidence for this change
Merged pull request #4750: perf(hooks): review Pi and Oh My Pi file reads in the resident runtime (#4750) Evidence for this change
Merged pull request #4743: perf(guard): resolve approval scope sweeps in the native runtime (#4743) Evidence for this change
Merged pull request #4751: fix(guard): keep relative workspace cd builds on the sandbox the sink can run (#4751) Evidence for this change
Merged pull request #4752: fix(policy): point the editor modeline at the published schema URL (#4752) Evidence for this change
Merged pull request #4766: fix(guard): tell agents never to approve their own requests and nudge users to protect approvals (#4766) Evidence for this change
Merged pull request #4754: ci: reuse verified bubblewrap builds across Linux gates Evidence for this change
Merged pull request #4780: fix(guard): check Claude Code's PowerShell tool calls (#4780) Evidence for this change
Direct commit 3fb7a2e316e5: maintainer: merge main; normalize non-contribution paths to main Evidence for this change
Merged pull request #4776: fix(guard): check vite output directories before sandboxing and keep doctor's approval gate check passive (#4776) Evidence for this change
Merged pull request #4729: docs(policy): describe Policy Studio and import as GuardPolicy authors (#4729) Evidence for this change
Merged pull request #4757: ci: reduce Rust coverage debug overhead and test queue time Evidence for this change
Merged pull request #4756: ci: reuse shipped runtime builds across scheduling changes Evidence for this change
Merged pull request #4759: perf(guard): queue blocked approvals in the native runtime (#4759) Evidence for this change
Merged pull request #4744: perf(guard): resolve single and duplicate approval requests in the native runtime (#4744) Evidence for this change
Merged pull request #4777: ci: reuse verified native evaluators before test fan-out Evidence for this change
Merged pull request #4790: ci: prevent ignored comments from cancelling PR reconciliation Evidence for this change
Merged pull request #4764: fix(guard): honor the configured approval cooldown instead of asking for the password on every approval (#4764) Evidence for this change
Merged pull request #4769: ci: reduce Rust coverage build and profile-merging time Evidence for this change
Merged pull request #3657: feat(extensions): command.faf-cli v1.1.0 — card init, npx --help, one severity re-rate (#3657) Evidence for this change
Merged pull request #4745: feat(pi): answer Pi and Oh My Pi hooks through the native runtime (#4745) Evidence for this change
Merged pull request #4789: fix(guard): report unknown gate posture for state the resident refuses (#4789) Evidence for this change
Merged pull request #4747: fix(guard): run relative cd builds and resolved workspace paths without false blocks, and repair nightly native tests (#4747) Evidence for this change
Merged pull request #4748: perf(hooks): answer Grok prompts from the resident without a readiness round trip (#4748) Evidence for this change
Merged pull request #4735: fix(guard): let routine agent work through and fix the macOS and Windows nightly failures (#4735) Evidence for this change
Merged pull request #4770: fix(gauntlet): show the Luna adapter's stderr when it fails to start (#4770) Evidence for this change
Merged pull request #4734: ci(release): cancel superseded main release-prepare warm runs (#4734) Evidence for this change
Merged pull request #4749: perf(guard): read approval metadata through the native runtime (#4749) Evidence for this change
Direct commit 33c903fe9765: Merge main into add-mcp-plim Evidence for this change
Merged pull request #4730: perf(runtime): run npm -C and pnpm -C package scripts on the native contained sink (#4730) Evidence for this change
Merged pull request #3047: feat(extensions): add DataMan command safety extension and fixtures (#3047) Evidence for this change
Merged pull request #4742: fix(guard): leave Copilot, Devin and ZCode approval prompts to the harness (#4742) Evidence for this change
Merged pull request #4781: fix(guard): let Codex apply_patch write to a private temp directory like other harnesses (#4781) Evidence for this change
Merged pull request #4746: perf(hooks): start a stopped daemon from the native Claude SessionStart hook (#4746) Evidence for this change
Merged pull request #4693: chore(release): 3.46.0 (#4693) Evidence for this change
Merged pull request #4762: feat(dashboard): extension state pills, featured-first catalog and Discover spotlight (#4762) Evidence for this change
Merged pull request #4753: perf(hooks): answer Windows hooks on the resident direct lane (#4753) Evidence for this change

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.46.0a1

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.