Documented changes
42 typed entries
Verified contributors
2 verified contributors · 12 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.47.0a9 is a preview release published 2026-10-16. Upstream documents: Guard 3.47.0a9 is an opt-in prerelease cut from 81fe5c6. Stable installations remain on the stable channel. 12 commits • 11 merged pull requests • 1 contributor since Guard 3.47.0a8. Its comparison base is alpha/v3.47.0a8. It includes 12 verified contribution deliveries with public evidence links.
Changes
Added
5- release: Ship Windows ARM64 native wheels from GitHub releases (#4946) Evidence for this change
- Trust: the pure wheel on PyPI now embeds
codex_plugin_scanner/native-wheels.json, which lists the sha256 of every native wheel in the release. The release verifier rejects a pure wheel whose manifest is missing… Evidence for this change - Client: when only the pure wheel is installed,
hol-guard update,hol-guard installandhol-guard doctor --repairdownload the matching native wheel from the GitHub release, check it against the manifest, and… Evidence for this change - Release: the native runtime is cross-compiled for
aarch64-pc-windows-msvconwindows-latestand self-tested natively onwindows-11-arm. This is a release-only leg; no PR CI jobs were added. Dev (canary)… Evidence for this change - guard: Resolve package policy inside the native relay (#4937) Evidence for this change
Fixed
22- gauntlet: Count finished local apps the full-task oracle missed (#4947) Evidence for this change
- Comment stripping:
//inside quoted URLs ('http://localhost:3000') was treated as a comment, and#was treated as a comment in JavaScript, so lines likedocument.querySelector('#clear-completed')...… Evidence for this change - Gravity: games that apply gravity as an accumulating velocity (
bird.velocity += 1450 * step) failed because the word "gravity" never appeared. Evidence for this change - Todo operations: add/complete/delete written as REST routes (
request.method === 'PATCH') or as inline event handlers (tasks.filter((t) => t.id !== id),completed: checkbox.checked) failed because they were… Evidence for this change - guard: Apply the saved package approval the claim reports (#4938) Evidence for this change
- guard: Trust group write on the native runtime from file metadata only (#4941) Evidence for this change
- With NSS sources such as sssd or LDAP and enumeration turned off,
getpwall()returns only part of the account list. Evidence for this change - A second group record can have the same numeric GID and list another member, and
getgrgid()misses it. Evidence for this change - A cached ready runtime status isn't checked again when someone joins the group. Evidence for this change
- guard: Read a stash entry's diff without an approval (#4927) Evidence for this change
- guard: Answer the first Windows hook in a file-less directory spelled with a short name or other case (#4942) Evidence for this change
- It expands 8.3 short names. GitHub Windows runners set
TEMP=C:\Users\RUNNER~1\AppData\Local\Temp. Evidence for this change - It normalizes letter case, for example on the drive letter. Evidence for this change
- guard: Let Oh My Pi eval drive the isolated browser on loopback pages and pass target-less edits (#4933) Evidence for this change
- Oh My Pi
evalprograms that open a loopback dev server in the isolated browser, interact with it and display what the page reports were reviewed as unknown tools: any URL inside the code skipped every eval proof.… Evidence for this change browser.open({...})only with anhttp(s)loopbackurl(localhost,127.0.0.1,[::1], no userinfo) and presentation options;gotoonly to loopback. Evidence for this changebrowser.tab(name)handles, literal tab reads and interactions (title,observe,screenshot,click,press,fill,waitFor*,errors, ...). Evidence for this change- guard: Trust the native runtime when pip installs it under a 0002 umask (#4939) Evidence for this change
- the file belongs to the current user, Evidence for this change
- its group is that user's primary group, Evidence for this change
- the group lists no member other than that user, and Evidence for this change
- guard: Unroll a loop over a glob into the directory the pattern names (#4917) Evidence for this change
Other changes
15- Documented change: Guard 3.47.0a9 is an opt-in prerelease cut from
81fe5c6. Stable installations remain on the stable channel. 12 commits • 11 merged pull requests • 1 contributor since Guard 3.47.0a8. Evidence for this change - nightly: Give the macOS native wheel builds 35 minutes (#4944) Evidence for this change
- actions: Bump astral-sh/setup-uv from 6.8.0 to 10.3.0 (
a8ef2a1) Evidence for this change - Merged pull request #4947: fix(gauntlet): count finished local apps the full-task oracle missed (#4947) Evidence for this change
- Merged pull request #4938: fix(guard): apply the saved package approval the claim reports (#4938) Evidence for this change
- Merged pull request #4927: fix(guard): read a stash entry's diff without an approval (#4927) Evidence for this change
- Merged pull request #4933: fix(guard): let Oh My Pi eval drive the isolated browser on loopback pages and pass target-less edits (#4933) Evidence for this change
- Merged pull request #4944: ci(nightly): give the macOS native wheel builds 35 minutes (#4944) Evidence for this change
- Merged pull request #3158: deps(actions): bump astral-sh/setup-uv from 6.8.0 to 10.3.0 Evidence for this change
- Merged pull request #4939: fix(guard): trust the native runtime when pip installs it under a 0002 umask (#4939) Evidence for this change
- Merged pull request #4946: feat(release): ship Windows ARM64 native wheels from GitHub releases (#4946) Evidence for this change
- Merged pull request #4937: feat(guard): resolve package policy inside the native relay (#4937) Evidence for this change
- Merged pull request #4941: fix(guard): trust group write on the native runtime from file metadata only (#4941) Evidence for this change
- Merged pull request #4917: fix(guard): unroll a loop over a glob into the directory the pattern names (#4917) Evidence for this change
- Merged pull request #4942: fix(guard): answer the first Windows hook in a file-less directory spelled with a short name or other case (#4942) Evidence for this change
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.47.0a8
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
- @dependabot[bot]
Implementation · 1 credit
![Avatar of dependabot[bot]](https://avatars.githubusercontent.com/u/49699333?s=64&v=4){kind=small}
Evidence ledger12 credits
- @dependabot[bot]Source for dependabot[bot]
Implementation · Pull request author
Source for zerocodefast