Release notes

HOL Guard v3.47.0a5

Preview

Published October 16, 2026Original GitHub release for alpha/v3.47.0a5

Documented changes

91 typed entries

Verified contributors

4 verified contributors · 51 credits

View the complete verified roster

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.47.0a5 is a preview release published 2026-10-16. Upstream documents: Guard 3.47.0a5 is an opt-in prerelease cut from 026d1c0. Stable installations remain on the stable channel. 50 commits • 40 merged pull requests • 4 contributors since Guard 3.47.0a4. Its comparison base is alpha/v3.47.0a4. It includes 51 verified contribution deliveries with public evidence links.

Added

dashboard: Offer the open extension slot in both surfaces and sharpen the starter shelf (#4875) Evidence for this change
guard: Resolve the managed network policy in the native egress caller (#4870) Evidence for this change
guard: Acquire and inspect external archives in the native egress caller (#4868) Evidence for this change
guard: Perform brokered supply-chain egress from the Rust caller (#4862) Evidence for this change
gauntlet: Build the qualify wheel on Linux and add --prepare-only (d269186) Evidence for this change
guard: Raise the inline approval prompt from the native MCP relay (#4845) Evidence for this change
guard: Decide opencode ask-mode MCP tool calls in the resident (#4821) Evidence for this change
gauntlet: Run full-task projects under Claude Code and Codex (#4817) Evidence for this change
Adds two local full-task projects, flappy-bird-game and todo-app-local. Each starts from an empty Git repository. A run passes only when the repository holds the app, committed tests that import the app's own code… Evidence for this change
--profile full-tasks now accepts --harness claude-code and --harness codex. Those runs use Guard's installed hooks in a disposable home and read verdicts from the Guard daemon. Any hooked tool call without a… Evidence for this change
The new harness lanes cover local tasks only. They reject Docker, GitHub tasks, --jobs and provider options, and never qualify a merge. Evidence for this change

Fixed

guard: Stop the native runtime when Guard uninstalls itself (#4856) Evidence for this change
guard: Review a backgrounded command instead of blocking it outright (#4871) Evidence for this change
guard: Edit the Codex config instead of rewriting it (#4858) Evidence for this change
guard: Record which install wrote each extension-control catalog (#4842) Evidence for this change
guard: Reuse the Windows runtime digest while writers are locked out (#4866) Evidence for this change
The handle is opened without FILE_SHARE_WRITE and stays open as long as the digest is cached. The kernel refuses any open that could change the file's data, and the lock itself cannot be taken while a writer or… Evidence for this change
The lock is used only after a write open of the same path is refused with a sharing violation, which proves the filesystem enforces it. If that check fails, every lookup re-hashes, as before. Evidence for this change
On every cache hit, the held file's file ID, size and timestamps are checked against the path. A renamed or replaced binary is hashed again. Evidence for this change
guard: Let an approved python script launch be reused while its source is unchanged (cbf23ff) Evidence for this change
guard: Stop letting an agent authorize its own secret reads (#4853) Evidence for this change
guard: Stop promising a retry when the install cannot publish policy (#4872) Evidence for this change
guard: Build the native runtime on Windows again (#4867) Evidence for this change
guard: Keep MCP servers whose command argument sits behind a schema reference on the Python proxy (#4857) Evidence for this change
guard: Run scratch scripts outside the workspace in the workspace sandbox (#4832) Evidence for this change
guard: Stop reviewing workspace-wide omp grep over tracked fixtures and nested checkouts (#4836) Evidence for this change
guard: Read a project's saved decisions when the store holds other projects' rows (#4847) Evidence for this change
guard: Read Oh My Pi eval programs that compute in memory or drive a local browser page (#4826) Evidence for this change
guard: Stop blocking package scripts and tools the sandbox can actually run (6ddf4d0) Evidence for this change
guard: Clear Windows false positives in guard-command integration reads (#4830) Evidence for this change
guard: Read inline and standard-input programs before deciding where they run (#4816) Evidence for this change
Inline source: python -c, node -e/--eval/-p/--print (including --eval=), deno eval. Evidence for this change
Standard input: a heredoc, a single local | pipe into python3 -/python3, node -/node. Evidence for this change
A program fed to an interpreter in a pod (kubectl exec ... -- node --input-type=module - < file) is read without its imports. Evidence for this change
guard: Run Windows Codex Python test scripts in the contained sandbox (#4835) Evidence for this change

Other changes

Documented change: Guard 3.47.0a5 is an opt-in prerelease cut from 026d1c0. Stable installations remain on the stable channel. 50 commits • 40 merged pull requests • 4 contributors since Guard 3.47.0a4. Evidence for this change
guard: Derive MCP saved-policy candidates in the resident (#4878) Evidence for this change
guard: Answer unmodeled shell reviews in one resident query (#4863) Evidence for this change
guard: Compose compound runtime artifacts in the resident (#4861) Evidence for this change
guard: Derive artifact risk signals in the resident in one call (#4839) Evidence for this change
Merged pull request #4840: ci: reduce macOS gate fan-out and isolate updater tests Evidence for this change
Merged pull request #4837: test(guard): stop each test's native residents at teardown (#4837) Evidence for this change
Merged pull request #4871: fix(guard): review a backgrounded command instead of blocking it outright (#4871) Evidence for this change
Merged pull request #4832: fix(guard): run scratch scripts outside the workspace in the workspace sandbox (#4832) Evidence for this change
Merged pull request #4843: ci: fetch only the history needed by planning and analysis Evidence for this change
Merged pull request #4801: ci(gauntlet): run cases on the native hook bridge instead of a forced loopback fetch (#4801) Evidence for this change
Merged pull request #4821: feat(guard): decide opencode ask-mode MCP tool calls in the resident (#4821) Evidence for this change
Merged pull request #4874: chore: use neutral placeholder names in fixtures and docs (#4874) Evidence for this change
Merged pull request #4841: perf(guard): build embedded script evidence in one native call (#4841) Evidence for this change
Merged pull request #4827: feat(gauntlet): build the qualify wheel on Linux and add --prepare-only Evidence for this change
Merged pull request #4779: fix(guard): stop blocking package scripts and tools the sandbox can actually run Evidence for this change
Merged pull request #4863: perf(guard): answer unmodeled shell reviews in one resident query (#4863) Evidence for this change
Merged pull request #4835: fix(guard): run Windows Codex Python test scripts in the contained sandbox (#4835) Evidence for this change
Merged pull request #4826: fix(guard): read Oh My Pi eval programs that compute in memory or drive a local browser page (#4826) Evidence for this change
Merged pull request #4859: ci: keep generated bytecode out of runtime archive keys Evidence for this change
Merged pull request #4830: fix(guard): clear Windows false positives in guard-command integration reads (#4830) Evidence for this change
Merged pull request #4855: perf(guard): scope the policy-bundle handoff to the harnesses its rules bind (#4855) Evidence for this change
Merged pull request #4862: feat(guard): perform brokered supply-chain egress from the Rust caller (#4862) Evidence for this change
Merged pull request #4869: ci: prune superseded runtime test archives Evidence for this change
Merged pull request #4858: fix(guard): edit the Codex config instead of rewriting it (#4858) Evidence for this change
Merged pull request #4817: feat(gauntlet): run full-task projects under Claude Code and Codex (#4817) Evidence for this change
Merged pull request #4839: perf(guard): derive artifact risk signals in the resident in one call (#4839) Evidence for this change
Merged pull request #4867: fix(guard): build the native runtime on Windows again (#4867) Evidence for this change
Merged pull request #4844: test(guard): run sleep directly in the resident identity tests (#4844) Evidence for this change
Merged pull request #4836: fix(guard): stop reviewing workspace-wide omp grep over tracked fixtures and nested checkouts (#4836) Evidence for this change
Merged pull request #4845: feat(guard): raise the inline approval prompt from the native MCP relay (#4845) Evidence for this change
Merged pull request #4842: fix(guard): record which install wrote each extension-control catalog (#4842) Evidence for this change
Merged pull request #4866: fix(guard): reuse the Windows runtime digest while writers are locked out (#4866) Evidence for this change
Merged pull request #4857: fix(guard): keep MCP servers whose command argument sits behind a schema reference on the Python proxy (#4857) Evidence for this change
Merged pull request #4848: test: wait for the child executable before identity assertions Evidence for this change
Merged pull request #4875: feat(dashboard): offer the open extension slot in both surfaces and sharpen the starter shelf (#4875) Evidence for this change
Merged pull request #4831: test(gauntlet): cover script credential exfiltration and network scripts (#4831) Evidence for this change
Merged pull request #4829: fix(guard): let an approved python script launch be reused while its source is unchanged Evidence for this change
Merged pull request #4816: fix(guard): read inline and standard-input programs before deciding where they run (#4816) Evidence for this change
Merged pull request #4860: test(runtime): run the ELF rpath inheritance test only on Unix (#4860) Evidence for this change
Merged pull request #4847: fix(guard): read a project's saved decisions when the store holds other projects' rows (#4847) Evidence for this change
Merged pull request #4854: Add Architecture Intelligence Platform MCP contribution (#4854) Evidence for this change
Merged pull request #4872: fix(guard): stop promising a retry when the install cannot publish policy (#4872) Evidence for this change
Merged pull request #4846: perf(guard): answer benign GitHub shell checks in the resident (#4846) Evidence for this change
Merged pull request #4856: fix(guard): stop the native runtime when Guard uninstalls itself (#4856) Evidence for this change
Merged pull request #4851: ci: reuse exact runtime test builds without reusing test results Evidence for this change
Merged pull request #4878: perf(guard): derive MCP saved-policy candidates in the resident (#4878) Evidence for this change
Merged pull request #4868: feat(guard): acquire and inspect external archives in the native egress caller (#4868) Evidence for this change
Merged pull request #4873: refactor(guard): delete runtime Python modules nothing imports (#4873) Evidence for this change
Merged pull request #4864: ci: tolerate bounded Sonar evidence connection resets Evidence for this change
Merged pull request #4861: perf(guard): compose compound runtime artifacts in the resident (#4861) Evidence for this change
Merged pull request #4807: test(guard): give the macOS package-script routes a real home to prove against (#4807) Evidence for this change
Merged pull request #4849: test(guard): expect the Windows owner name in the embedded-script vector (#4849) Evidence for this change
Direct commit 9df81500e9e3: fix(guard): review browser evals and refuse module attribute chains in pure compute programs Evidence for this change
Merged pull request #4853: fix(guard): stop letting an agent authorize its own secret reads (#4853) Evidence for this change
Merged pull request #4870: feat(guard): resolve the managed network policy in the native egress caller (#4870) Evidence for this change

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.47.0a4

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.