Documented changes
34 typed entries
Verified contributors
1 verified contributor · 14 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.47.0a3 is a preview release published 2026-10-16. Upstream documents: Guard 3.47.0a3 is an opt-in prerelease cut from 52dd510. Stable installations remain on the stable channel. 14 commits • 11 merged pull requests • 2 contributors since Guard 3.47.0a2. Its comparison base is alpha/v3.47.0a2. It includes 14 verified contribution deliveries with public evidence links.
Changes
Fixed
11- guard: Leave interpreter pipes with a missing option value to the ordinary review (#4806) Evidence for this change
- guard: Treat Windows drive and UNC search paths as outside the workspace (#4802) Evidence for this change
- Search review on Windows (security fix).
grepandrgskip review only for relative operands. On Windows, operands likeC:\...,C:/...and\\server\sharewere treated as relative, so a search of a missing… Evidence for this change - Leaf glob listings on Windows. Listings such as
ls C:\Users\me\run\*.lognow accept the Windows\separator. They get the same read classification as the POSIX spelling instead of always going to review. Evidence for this change - Codex plan evidence test. The test now passes resolved paths, matching the product callers. On Windows these are verbatim paths. Evidence for this change
- guard: Read Node long options in remote-code pipes and match the resident on repeated gate keys (#4803) Evidence for this change
- guard: Read interpreter options per family in remote-code pipes (#4794) Evidence for this change
- A download piped into an interpreter is blocked when the interpreter takes its program from standard input. The check now reads each interpreter family's own options. Value flags such as
python3 -W ignoreor `ruby -r… Evidence for this change bash -- -,python3 --, and syntax-check flags such asperl -cstill block, sinceperl -crunsBEGINblocks. Evidence for this change- guard: Route interpreter scripts by what their source does (#4774) Evidence for this change
- guard: Judge Oh My Pi eval shell calls and /tmp reads like direct calls (#4782) Evidence for this change
Other changes
23- Documented change: Guard 3.47.0a3 is an opt-in prerelease cut from
52dd510. Stable installations remain on the stable channel. 14 commits • 11 merged pull requests • 2 contributors since Guard 3.47.0a2. Evidence for this change - guard: Decide the final package-protect authority in one native call (#4797) Evidence for this change
- hooks: Compose artifact-hook saved reuse in the saved-decision lookup (#4805) Evidence for this change
- guard: Decide startup policy-integrity generation in the native runtime (#4792) Evidence for this change
- hooks: Reach the resident from an installed frozen Guard's hook command (#4773) Evidence for this change
- guard: Stop timing the direct-lane ACK settle and SQLite busy budget on wall clock (
52dd510) Evidence for this change - gauntlet: Cover remote-code pipes, tampered lockfiles and /tmp alias reads (#4798) Evidence for this change
- Split instrumented runtime coverage and seed dependency caches (
8af2028) Evidence for this change - Generate source-bound Rust coverage in parallel (
1d441dd) Evidence for this change - Merged pull request #4792: perf(guard): decide startup policy-integrity generation in the native runtime (#4792) Evidence for this change
- Merged pull request #4774: fix(guard): route interpreter scripts by what their source does (#4774) Evidence for this change
- Merged pull request #4782: fix(guard): judge Oh My Pi eval shell calls and /tmp reads like direct calls (#4782) Evidence for this change
- Merged pull request #4803: fix(guard): read Node long options in remote-code pipes and match the resident on repeated gate keys (#4803) Evidence for this change
- Merged pull request #4799: test(guard): stop timing the direct-lane ACK settle and SQLite busy budget on wall clock Evidence for this change
- Merged pull request #4773: perf(hooks): reach the resident from an installed frozen Guard's hook command (#4773) Evidence for this change
- Merged pull request #4794: fix(guard): read interpreter options per family in remote-code pipes (#4794) Evidence for this change
- Merged pull request #4796: ci: generate source-bound Rust coverage in parallel Evidence for this change
- Merged pull request #4800: ci: split instrumented runtime coverage and seed dependency caches Evidence for this change
- Merged pull request #4806: fix(guard): leave interpreter pipes with a missing option value to the ordinary review (#4806) Evidence for this change
- Merged pull request #4798: test(gauntlet): cover remote-code pipes, tampered lockfiles and /tmp alias reads (#4798) Evidence for this change
- Merged pull request #4805: perf(hooks): compose artifact-hook saved reuse in the saved-decision lookup (#4805) Evidence for this change
- Merged pull request #4797: perf(guard): decide the final package-protect authority in one native call (#4797) Evidence for this change
- Merged pull request #4802: fix(guard): treat Windows drive and UNC search paths as outside the workspace (#4802) Evidence for this change
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.47.0a2
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
Evidence ledger14 credits
Source for zerocodefast