Documented changes
66 typed entries
Verified contributors
1 verified contributor · 31 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.47.0a6 is a preview release published 2026-10-16. Upstream documents: Guard 3.47.0a6 is an opt-in prerelease cut from d839431. Stable installations remain on the stable channel. 31 commits • 28 merged pull requests • 2 contributors since Guard 3.47.0a5. Its comparison base is alpha/v3.47.0a5. It includes 31 verified contribution deliveries with public evidence links.
Changes
Added
10- windows: Run direct Vite builds in an AppContainer (
b021d78) Evidence for this change - guard: Compose machine-managed policy into the native Guard config (#4893) Evidence for this change
- guard: Build the native MCP relay on Windows (#4903) Evidence for this change
- Proxy hand-off. Unix still
execs the Python proxy. Windows spawns it suspended, assigns it to a kill-on-close JobObject (the existingChildTreehelper), resumes it, waits, and returns its exit code. Evidence for this change - Background ensure. Unix keeps the detached
/bin/shprocess group. Windows starts the command detached in a new process group, breaking away from the caller's job when the job permits and falling back otherwise.… Evidence for this change - Exit code. Unix maps a terminating signal to
128 + signal. Windows uses the process exit code (1 if none). Evidence for this change - guard: Carry a package evaluation over the relay's resident lane (#4896) Evidence for this change
- guard: Load machine-managed policy from the native machine source (#4892) Evidence for this change
- guard: Parse the machine-managed policy in the native runtime (#4885) Evidence for this change
- guard: Drive package authority evaluation rounds from the native caller (#4882) Evidence for this change
Improved
1- guard: Remove unreferenced runtime helpers (#4897) Evidence for this change
Fixed
14- guard: Accept unified-diff old rows inside Oh My Pi PUT bodies (#4907) Evidence for this change
- runtime: Keep resident phase diagnostics off the request path (#4902) Evidence for this change
- guard: Read the file a command sources before calling it unknown (#4888) Evidence for this change
- guard: Run multi-line CLI smoke tests that export a fresh temporary path inside the workspace sandbox (#4901) Evidence for this change
- gauntlet: Count a finished print session with a running dev server as ended (#4898) Evidence for this change
- gauntlet: Observe the hook bridge through the child spawn method (#4899) Evidence for this change
- dashboard: Quote slot capacity for the product the price belongs to (#4889) Evidence for this change
- guard: Run inline Node servers and smoke tests on loopback ports in the workspace sandbox (#4881) Evidence for this change
- guard: List a project's virtualenv without asking for approval (#4865) Evidence for this change
- guard: Run commands that cd into a fresh mktemp directory in the workspace sandbox (#4887) Evidence for this change
- guard: Clear common read-only commands agents run while building a project (#4879) Evidence for this change
- guard: Trust Codex hooks at install and launch them on Windows (#4850) Evidence for this change
- guard: Name Windows child programs with native separators (#4884) Evidence for this change
- guard: Give install and doctor time to reach a cold native runtime (#4852) Evidence for this change
Other changes
41- Documented change: Guard 3.47.0a6 is an opt-in prerelease cut from
d839431. Stable installations remain on the stable channel. 31 commits • 28 merged pull requests • 2 contributors since Guard 3.47.0a5. Evidence for this change - guard: Look up, remove and discard pending hook permissions in one resident call (#4894) Evidence for this change
- ci: Keep CodeQL overlay active and reuse native compiler caches (
59f1ee4) Evidence for this change - guard: Verify downloaded package archives in the resident (#4886) Evidence for this change
- guard: Read the non-consuming remembered-decision lookup in one resident call (#4883) Evidence for this change
- guard: Expand generic-hook remembered candidates in the saved-decision lookup (#4877) Evidence for this change
- Give cursor discovery a budget a loaded runner can meet (#4891) Evidence for this change
- guard: Give secure-fs source fixtures the host drive spelling (
5790d9b) Evidence for this change - gauntlet: Add an installed-acceptance lane for the shipped build (#4819) Evidence for this change
- guard: Give hook-core source fixtures the host drive spelling on Windows (#4880) Evidence for this change
- Merged pull request #4890: test(guard): give secure-fs source fixtures the host drive spelling Evidence for this change
- Merged pull request #4882: feat(guard): drive package authority evaluation rounds from the native caller (#4882) Evidence for this change
- Merged pull request #4884: fix(guard): name Windows child programs with native separators (#4884) Evidence for this change
- Merged pull request #4850: fix(guard): trust Codex hooks at install and launch them on Windows (#4850) Evidence for this change
- Merged pull request #4899: fix(gauntlet): observe the hook bridge through the child spawn method (#4899) Evidence for this change
- Merged pull request #4865: fix(guard): list a project's virtualenv without asking for approval (#4865) Evidence for this change
- Merged pull request #4886: perf(guard): verify downloaded package archives in the resident (#4886) Evidence for this change
- Merged pull request #4898: fix(gauntlet): count a finished print session with a running dev server as ended (#4898) Evidence for this change
- Merged pull request #4877: perf(guard): expand generic-hook remembered candidates in the saved-decision lookup (#4877) Evidence for this change
- Merged pull request #4881: fix(guard): run inline Node servers and smoke tests on loopback ports in the workspace sandbox (#4881) Evidence for this change
- Merged pull request #4852: fix(guard): give install and doctor time to reach a cold native runtime (#4852) Evidence for this change
- Merged pull request #4893: feat(guard): compose machine-managed policy into the native Guard config (#4893) Evidence for this change
- Merged pull request #4907: fix(guard): accept unified-diff old rows inside Oh My Pi PUT bodies (#4907) Evidence for this change
- Merged pull request #4834: feat(windows): run direct Vite builds in an AppContainer Evidence for this change
- Merged pull request #4902: fix(runtime): keep resident phase diagnostics off the request path (#4902) Evidence for this change
- Merged pull request #4888: fix(guard): read the file a command sources before calling it unknown (#4888) Evidence for this change
- Merged pull request #4896: feat(guard): carry a package evaluation over the relay's resident lane (#4896) Evidence for this change
- Merged pull request #4892: feat(guard): load machine-managed policy from the native machine source (#4892) Evidence for this change
- Merged pull request #4903: feat(guard): build the native MCP relay on Windows (#4903) Evidence for this change
- Merged pull request #4897: refactor(guard): remove unreferenced runtime helpers (#4897) Evidence for this change
- Merged pull request #4895: perf(ci): keep CodeQL overlay active and reuse native compiler caches Evidence for this change
- Merged pull request #4889: fix(dashboard): quote slot capacity for the product the price belongs to (#4889) Evidence for this change
- Merged pull request #4885: feat(guard): parse the machine-managed policy in the native runtime (#4885) Evidence for this change
- Merged pull request #4879: fix(guard): clear common read-only commands agents run while building a project (#4879) Evidence for this change
- Merged pull request #4819: test(gauntlet): add an installed-acceptance lane for the shipped build (#4819) Evidence for this change
- Merged pull request #4891: test: give cursor discovery a budget a loaded runner can meet (#4891) Evidence for this change
- Merged pull request #4883: perf(guard): read the non-consuming remembered-decision lookup in one resident call (#4883) Evidence for this change
- Merged pull request #4887: fix(guard): run commands that cd into a fresh mktemp directory in the workspace sandbox (#4887) Evidence for this change
- Merged pull request #4880: test(guard): give hook-core source fixtures the host drive spelling on Windows (#4880) Evidence for this change
- Merged pull request #4894: perf(guard): look up, remove and discard pending hook permissions in one resident call (#4894) Evidence for this change
- Merged pull request #4901: fix(guard): run multi-line CLI smoke tests that export a fresh temporary path inside the workspace sandbox (#4901) Evidence for this change
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.47.0a5
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
Evidence ledger31 credits
Source for zerocodefast