Release notes
HOL Guard v3.56.0a3
PreviewHOL Guard v3.56.0a3, released October 23, 2026, is a preview release with 5 additions, 5 improvements, 21 fixes and 15 other changes across 43 merged pull requests. Highlights: Sync the extension catalog by default; Derive Codex hook identities in the native runtime.
Changes since the previous release on this channel: alpha/v3.56.0a2alpha/v3.56.0a3
5 added · 5 improved · 21 fixed · 15 other
Key facts
- Version
- v3.56.0a3
- Channel
- Preview
- Published
- Previous release
- alpha/v3.56.0a2
- Merged pull requests
- 43
Documented changes
46 typed entries
Verified contributors
Credits being verified. Attribution coverage is in progress.
Attribution coverage
attribution in progress; history inventory partial.
Install
Scope
Guard v3.56.0a3 is a preview release published 2026-10-23. Upstream documents: Guard 3.56.0a3 is an opt-in prerelease cut from 0a3c836. Stable installations remain on the stable channel. 45 commits • 43 merged pull requests • 3 contributors since Guard 3.56.0a2. Its comparison base is alpha/v3.56.0a2. It includes 47 verified contribution deliveries with public evidence links. Attribution for this release is being verified.
Changes
Added
5- cloudSync the extension catalog by default (#5777) Evidence for this change
ManagedControlsFeatureFlags.from_environment()treats an unsetGUARD_EXTENSION_CATALOG_SYNC_V1as on. An explicittruestays on; any other value (for examplefalse) opts out.- The daemon's existing background cloud sync then advertises the installed catalog digest in the runtime session, and uploads the catalog when Cloud's handshake asks for it. No new UI, command or user step.
- The managed-controls stages (
GUARD_POLICY_EXTENSION_TARGETS_V1,GUARD_MANAGED_EXTENSION_CONTROLS_V1,GUARD_MANAGED_CONTROLS_ATOMIC_APPLY_V1,GUARD_EXTENSION_FIRST_CONTROLS_UI) stay opt-in.
- nativeDerive Codex hook identities in the native runtime (#5761) Evidence for this change
- nativeRead an overlay's instruction role in the resident (#5762) Evidence for this change
- nativeLet the resident choose what an inventory scan opens (#5758) Evidence for this change
- inboxBlock selected refuses several pending requests at once (#5694) Evidence for this change
Improved
5- nativeRead a command rule's shape in the runtime that compiles it (#5767) Evidence for this change
- inventoryClassify scan findings in the resident (#5744) Evidence for this change
- nativeCompute an inventory snapshot's identity in the resident (#5741) Evidence for this change
- nativeCommand and path redaction in the resident (#5740) Evidence for this change
- nativeClassify an inventory item in the resident (#5743) Evidence for this change
Fixed
21- releaseBundle sigstore's embedded trust roots into the frozen Guard core (#5787) Evidence for this change
- nativeLet a backgrounded launch reach its owners' review (#5756) Evidence for this change
- nativeRead a shell's script operand by its path, not its suffix (#5776) Evidence for this change
- ciRetain runtime test builds from either partition (
978525c) Evidence for this change - nativeRead a trailing brace group as the command list inside it (#5768) Evidence for this change
- nativeReview a sourcing whose file is not there instead of blocking it (#5771) Evidence for this change
- nativeRead a pruned vendored tree as part of a find fan-out (#5772) Evidence for this change
- ciPreserve failure dispatch and assert stable scratch identity (
a12ef95) Evidence for this change - nativeBuild on Windows and pin exec as a launcher in the model differential (#5773) Evidence for this change
- nativeReview the command a scheduling prefix runs instead of blocking it (#5770) Evidence for this change
- nativeRead a curl URL written without a scheme (#5746) Evidence for this change
- nativeRefuse a rooted or drive-prefixed target in a verified read on every platform (#5766) Evidence for this change
- nativeRead a trailing subshell group as the command list inside it (#5747) Evidence for this change
- commandsRead the shell's exec as the launcher it is (#5754) Evidence for this change
- sinkPlan the program behind nice and stdbuf (#5759) Evidence for this change
- gauntletAccept Codex's contained route on Windows as contained success (#5760) Evidence for this change
- commandAsk before recursive removal and skip it when Git can restore every target (#5716) Evidence for this change
- extensionsSaving an extension's tool choices reviews its new and changed tools (#5698) Evidence for this change
- nativeRun a redirected pytest suite in the workspace sandbox (#5745) Evidence for this change
- nativeKeep the approval card on a case label and an empty prefix (#5737) Evidence for this change
- contractsHold every request bound under the transport's frame limit (#5749) Evidence for this change
Other changes
15- Guard 3.56.0a3 is an opt-in prerelease cut from
0a3c836. Stable installations remain on the stable channel. 45 commits • 43 merged pull requests • 3 contributors since Guard 3.56.0a2. Evidence for this change - ciNormalize Windows release compiler inventory (#5739) Evidence for this change
- versionsLink the Version coverage card to how coverage works (#5738) Evidence for this change
- redactionPin the command tokens Python and the runtime each persist (#5792) Evidence for this change
- packagePin the argv redaction Python and the runtime each apply (#5788) Evidence for this change
- policyPin the baseline risk actions Python and the runtime each keep (#5784) Evidence for this change
- nativeWait for the publisher's ack-mismatch error instead of racing it (#5769) Evidence for this change
- nativeKeep the narrower pytest profile for a lone 2>&1 (#5765) Evidence for this change
- contractsPin the item classification request bound (#5757) Evidence for this change
- Give the native gate shards room to finish (#5775) Evidence for this change
- Run the nightly extension builder projections in native force mode (#5764) Evidence for this change
- guardDrop private constants nothing reads, and use the two that were retyped (#5786) Evidence for this change
- runtimeDrop the restricted-pytest leftovers the native runtime owns (#5782) Evidence for this change
- runtimeDrop the policy severity tables Rust already owns (#5778) Evidence for this change
- runtimeDrop the shell static-safety helpers Rust already owns (#5774) Evidence for this change
- Merged pull request #5766: fix(native): refuse a rooted or drive-prefixed target in a verified read on every platform (#5766)
- Merged pull request #5737: fix(native): keep the approval card on a case label and an empty prefix (#5737)
- Merged pull request #5749: fix(contracts): hold every request bound under the transport's frame limit (#5749)
- Merged pull request #5778: chore(runtime): drop the policy severity tables Rust already owns (#5778)
- Merged pull request #5716: fix(command): ask before recursive removal and skip it when Git can restore every target (#5716)
- Merged pull request #5773: fix(native): build on Windows and pin exec as a launcher in the model differential (#5773)
- Merged pull request #5740: refactor(native): command and path redaction in the resident (#5740)
- Merged pull request #5772: fix(native): read a pruned vendored tree as part of a find fan-out (#5772)
- Merged pull request #5779: fix(ci): preserve failure dispatch and assert stable scratch identity
- Merged pull request #5781: fix(ci): retain runtime test builds from either partition
- Merged pull request #5761: feat(native): derive Codex hook identities in the native runtime (#5761)
- Merged pull request #5738: docs(versions): link the Version coverage card to how coverage works (#5738)
- Merged pull request #5698: fix(extensions): saving an extension's tool choices reviews its new and changed tools (#5698)
- Merged pull request #5776: fix(native): read a shell's script operand by its path, not its suffix (#5776)
- Merged pull request #5759: fix(sink): plan the program behind nice and stdbuf (#5759)
- Merged pull request #5784: test(policy): pin the baseline risk actions Python and the runtime each keep (#5784)
- Direct commit b279eda0ab62: Merge origin/main into fix/extension-save-reviews-new-tools
- Merged pull request #5739: perf(ci): normalize Windows release compiler inventory (#5739)
- Merged pull request #5786: chore(guard): drop private constants nothing reads, and use the two that were retyped (#5786)
- Merged pull request #5769: test(native): wait for the publisher's ack-mismatch error instead of racing it (#5769)
- Merged pull request #5787: fix(release): bundle sigstore's embedded trust roots into the frozen Guard core (#5787)
- Merged pull request #5762: feat(native): read an overlay's instruction role in the resident (#5762)
- Merged pull request #5746: fix(native): read a curl URL written without a scheme (#5746)
- Merged pull request #5756: fix(native): let a backgrounded launch reach its owners' review (#5756)
- Direct commit 91449a7ab71e: Merge origin/main into feat/inbox-block-selected
- Merged pull request #5744: refactor(inventory): classify scan findings in the resident (#5744)
- Merged pull request #5741: refactor(native): compute an inventory snapshot's identity in the resident (#5741)
- Merged pull request #5764: ci: run the nightly extension builder projections in native force mode (#5764)
- Merged pull request #5743: refactor(native): classify an inventory item in the resident (#5743)
- Merged pull request #5765: test(native): keep the narrower pytest profile for a lone 2>&1 (#5765)
- Merged pull request #5792: test(redaction): pin the command tokens Python and the runtime each persist (#5792)
- Merged pull request #5774: chore(runtime): drop the shell static-safety helpers Rust already owns (#5774)
- Merged pull request #5694: feat(inbox): Block selected refuses several pending requests at once (#5694)
- Merged pull request #5777: feat(cloud): sync the extension catalog by default (#5777)
- Merged pull request #5771: fix(native): review a sourcing whose file is not there instead of blocking it (#5771)
- Merged pull request #5745: fix(native): run a redirected pytest suite in the workspace sandbox (#5745)
- Merged pull request #5775: ci: give the native gate shards room to finish (#5775)
- Merged pull request #5758: feat(native): let the resident choose what an inventory scan opens (#5758)
- Merged pull request #5757: test(contracts): pin the item classification request bound (#5757)
- Merged pull request #5782: chore(runtime): drop the restricted-pytest leftovers the native runtime owns (#5782)
- Merged pull request #5760: fix(gauntlet): accept Codex's contained route on Windows as contained success (#5760)
- Merged pull request #5754: fix(commands): read the shell's exec as the launcher it is (#5754)
- Merged pull request #5747: fix(native): read a trailing subshell group as the command list inside it (#5747)
- Merged pull request #5770: fix(native): review the command a scheduling prefix runs instead of blocking it (#5770)
- Merged pull request #5767: refactor(native): read a command rule's shape in the runtime that compiles it (#5767)
- Merged pull request #5768: fix(native): read a trailing brace group as the command list inside it (#5768)
- Merged pull request #5788: test(package): pin the argv redaction Python and the runtime each apply (#5788)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.56.0a2
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.