Release notes

HOL Guard v3.59.0a15

Preview

HOL Guard v3.59.0a15, released October 30, 2026, is a preview release with 4 additions, 16 improvements, 14 fixes and 13 other changes across 46 merged pull requests. Highlights: Contain Linux test runs in the runtime's own sandbox; Link PR comments to listing advisories and scan limits.

Changes since the previous release on this channel: alpha/v3.59.0a8alpha/v3.59.0a15

4 added · 16 improved · 14 fixed · 13 other

Published Original GitHub release for alpha/v3.59.0a15

Key facts

Version
v3.59.0a15
Channel
Preview
Published
Previous release
alpha/v3.59.0a8
Merged pull requests
46

Documented changes

47 typed entries

Verified contributors

Credits being verified. Attribution coverage is in progress.

Attribution coverage

attribution in progress; history inventory partial.

Install

Current installation guide

Scope

Guard v3.59.0a15 is a preview release published 2026-10-30. Upstream documents: Guard 3.59.0a15 is an opt-in prerelease cut from c72b015. Stable installations remain on the stable channel. 46 commits • 46 merged pull requests • 1 contributor since Guard 3.59.0a14. Its comparison base is alpha/v3.59.0a8. It includes 129 verified contribution deliveries with public evidence links. Attribution for this release is being verified.

Changes

Added

4
  • containedContain Linux test runs in the runtime's own sandbox (#6549) Evidence for this change
  • scannerLink PR comments to listing advisories and scan limits (#6544) Evidence for this change
  • policyEnforce exact command rules from Guard Cloud policy documents (#6530) Evidence for this change
  • mcpRefuse undecidable relay calls instead of handing sessions to the Python proxy (#6524) Evidence for this change
    • mcp_relay_runtime_superseded and mcp_relay_store_newer: version skew, which the proxy of the same release still serves. A store at a newer schema used to share mcp_relay_store_unreadable with any store the…
    • The features the relay has not ported yet: mcp_relay_layers_unavailable, mcp_relay_saved_remote_policy, mcp_relay_saved_policy_unverifiable and mcp_relay_session_server_proxy_tools (which also marks servers…

Improved

16

Fixed

14
  • mcpRetry a relayed call while the daemon republishes its snapshot (#6565) Evidence for this change
    • When the lane defers a call for a reason the daemon can clear and the kick is rate-limited, the relay now waits 25 ms and decides the call again.
    • The retries stop when the existing 250 ms retry budget is spent.
    • A daemon that refuses or can't be reached still ends the retries immediately.
  • nativeKeep the direct-lane ACK when another runtime's resident restarts (#6553) Evidence for this change
    • Adding or removing a scope still changes the path set and triggers a republish.
    • Generation churn inside another runtime's scope no longer withdraws this runtime's ACK, and no longer outranks the acknowledging resident.
    • Before any runtime status is observed, every scope is fingerprinted as before.
  • commandRead a search root that is not there (#6550) Evidence for this change
  • cursorHand a stale bridge's hook to the runtime the resident runs (#6548) Evidence for this change
    • New hook_bridge_successor module (Unix). On DirectMiss::NoResident, the Cursor bridge discovers the live resident's runtime digest. If the bridge is itself a durable copy under the home's state directory, the live…
    • The child runs with HOL_GUARD_HOOK_HANDED_OFF=1, so a handed-off bridge never hands off again.
    • If spawning fails, nothing changes: the hook takes the existing daemon path. If the successor starts but does not answer by the client deadline (or exits on a signal, or prints non-UTF-8), the bridge kills it and fails…
  • commandRead the launcher's own diagnostics without a second approval (#6515) Evidence for this change
  • pretoolRead an encoded empty target list as naming no file (#6545) Evidence for this change
  • commandLet a DigitalOcean cluster listing name its own columns (#6538) Evidence for this change
  • windowsStop the daemon leaking a ctypes type on every state file open (#6513) Evidence for this change
  • guardKeep Oh My Pi read results for plugin manifests in a linked temp worktree (#6540) Evidence for this change
  • commandStop a credential word in a search pattern from forcing review (#6533) Evidence for this change
  • guardKeep the edit result for a tracked catalog named for secrets in Oh My Pi (#6536) Evidence for this change
  • commandRead Guard's own approval wait and artifact explanation quietly (#6519) Evidence for this change
  • policyStop telling users to update Guard when Cloud sends an older policy bundle (#6529) Evidence for this change
  • codexSay why an approved action stayed blocked when the daemon rejects it (#6520) Evidence for this change

Other changes

13
  • Guard 3.59.0a15 is an opt-in prerelease cut from c72b015. Stable installations remain on the stable channel. 46 commits • 46 merged pull requests • 1 contributor since Guard 3.59.0a14. Evidence for this change
  • daemonAnswer Claude Stop from the call that ends the turn (#6561) Evidence for this change
  • nativeShare one store connection across the publisher's 1 Hz recheck (#6555) Evidence for this change
  • commandRead a contained run's prefixes in one native call (#6518) Evidence for this change
  • gauntletRetry a run where the model misspelled a fixture path and then read the real file (#6558) Evidence for this change
  • gauntletGive the sibling Git-read case a real checkout and keep two prompts to their commands (#6551) Evidence for this change
  • gauntletPut the fixture's Bun on the session PATH its installer edits (#6546) Evidence for this change
  • gauntletRead the plugin manifest oracle from the checkout the agent starts in (#6543) Evidence for this change
  • recoveryMake the same-home overlap the recovery test reads deterministic (#6535) Evidence for this change
  • scannerPin scanner results on a synthetic evasion corpus (#6537) Evidence for this change
  • packagingRefuse build and package metadata nothing still consumes (#6523) Evidence for this change
  • Pin the Linux runners to ubuntu-24.04 (#6563) Evidence for this change
  • Run Linux CI jobs on ubuntu-24.04 instead of ubuntu-latest (#6559) Evidence for this change
    • Merged pull request #6479: perf(runtime): build and queue a paused native review in one store call (#6479)
    • Merged pull request #6530: feat(policy): enforce exact command rules from Guard Cloud policy documents (#6530)
    • Merged pull request #6504: perf(runtime): check a drained hook's receipt in the resident's drain page (#6504)
    • Merged pull request #6512: fix(workspace): end a slow package audit inside its assessment lease (#6512)
    • Merged pull request #6461: refactor(daemon): share the reservation file helpers and drop recovery forwarders (#6461)
    • Merged pull request #6448: fix(guard): contain work in checkouts with home hooks and function credential helpers (#6448)
    • Merged pull request #6529: fix(policy): stop telling users to update Guard when Cloud sends an older policy bundle (#6529)
    • Merged pull request #6564: refactor(daemon): drop the launch containment receipt nothing writes
    • Merged pull request #6449: perf(runtime): link a waiting Codex hook's wait when the resident pauses its review (#6449)
    • Merged pull request #6497: docs(action): link the scanner Action README to the HOL Plugins marketplace (#6497)
    • Merged pull request #6439: perf(runtime): queue a native review and read its row back in one store call (#6439)
    • Merged pull request #6452: perf(runtime): queue a paused Cursor review in the resident instead of the daemon (#6452)
    • Merged pull request #6457: fix(guard): allow plugin manifests in worktrees under the temp directory (#6457)
    • Merged pull request #6556: refactor(command): read a package test script in native authority
    • Merged pull request #6521: fix(release): adopt the resolved base version for a pull request alpha
    • Merged pull request #6570: refactor(runtime): drop a recorder lever the native runtime stopped reading
    • Merged pull request #6440: fix(guard): accept a repeated separator in a worktree destination (#6440)
    • Merged pull request #6533: fix(command): stop a credential word in a search pattern from forcing review (#6533)
    • Merged pull request #6535: test(recovery): make the same-home overlap the recovery test reads deterministic (#6535)
    • Merged pull request #6470: feat(runtime): answer only the ratified emergency-safe profile when the daemon fails (#6470)
    • Merged pull request #6464: fix(guard): run bun on an installed entrypoint the way node runs it (#6464)
    • Merged pull request #6560: refactor(command): read a new worktree's checkout in native authority
    • Merged pull request #6447: fix(approvals): give a bulk approve-once the one-shot grant a waiting Codex hook needs (#6447)
    • Merged pull request #6472: fix(command): walk an absolute path's parent steps before calling it workspace work (#6472)
    • Merged pull request #6515: fix(command): read the launcher's own diagnostics without a second approval (#6515)
    • Merged pull request #6513: fix(windows): stop the daemon leaking a ctypes type on every state file open (#6513)
    • Merged pull request #6548: fix(cursor): hand a stale bridge's hook to the runtime the resident runs (#6548)
    • Merged pull request #6499: chore(runtime): count each reason a Cursor probe or sink goes to the daemon (#6499)
    • Merged pull request #6455: docs(guard): stop documenting a native kill switch that no longer exists (#6455)
    • Merged pull request #6522: refactor(command): read a node tool route in native authority (#6522)
    • Merged pull request #6544: feat(scanner): link PR comments to listing advisories and scan limits (#6544)
    • Merged pull request #6549: feat(contained): contain Linux test runs in the runtime's own sandbox (#6549)
    • Merged pull request #6563: ci: pin the Linux runners to ubuntu-24.04
    • Merged pull request #6559: ci: run Linux CI jobs on ubuntu-24.04 instead of ubuntu-latest
    • Merged pull request #6454: chore(guard): retire Python nothing calls (#6454)
    • Merged pull request #6443: fix(command): read a Bun script entry as a script run, not a package action (#6443)
    • Merged pull request #6543: test(gauntlet): read the plugin manifest oracle from the checkout the agent starts in (#6543)
    • Merged pull request #6498: feat(action): link public repositories to their HOL Plugins listing in the PR comment (#6498)
    • Merged pull request #6469: fix(command): read a quoted for-loop word that holds spaces as the one field it is (#6469)
    • Merged pull request #6551: test(gauntlet): give the sibling Git-read case a real checkout and keep two prompts to their commands (#6551)
    • Merged pull request #6476: chore: remove leftover notes from the repository root
    • Merged pull request #6539: refactor(command): read a pytest invocation in native authority (#6539)
    • Merged pull request #6518: perf(command): read a contained run's prefixes in one native call (#6518)
    • Merged pull request #6566: refactor(command): read a manifest script's words in native authority
    • Merged pull request #6492: feat(guard): add codebases to background checks from the command line (#6492)
    • Merged pull request #6505: fix(command): read a project-relative Vitest or Jest entry as the project's own runner (#6505)
    • Merged pull request #6274: fix(approvals): let an approved Claude Code retry through despite its new prompt_id
    • Merged pull request #6465: feat(runtime): keep a day of resident lifecycle counts a support request can read (#6465)
    • Merged pull request #6494: fix(command): contain a test runner the agent spells from home (#6494)
    • Merged pull request #6466: fix(guard): apply approved Guard Cloud exceptions to Cloud policy blocks (#6466)
    • Direct commit 2c8c5a3b00f6: test(gauntlet): run the bun entry-point build in the deterministic gate too
    • Merged pull request #6489: fix(dashboard): list Muse in App coverage (#6489)
    • Merged pull request #6493: test(plugin-kit): keep listing link campaign parameters intact (#6493)
    • Merged pull request #6496: perf(approvals): look up a paused review's connector inside its queue call (#6496)
    • Merged pull request #6490: fix(review): give a queued Cloud Review decision enough time to apply after a daemon restart (#6490)
    • Merged pull request #6480: ci(gates): give the macOS gate shards eight minutes (#6480)
    • Merged pull request #6422: fix(command): read a project file beside a stderr redirect as the source it is (#6422)
    • Merged pull request #6486: perf(approvals): decide a paused review's hint inside its queue call (#6486)
    • Merged pull request #6558: test(gauntlet): retry a run where the model misspelled a fixture path and then read the real file
    • Merged pull request #6507: feat(gauntlet): cover Muse in installed acceptance (#6507)
    • Merged pull request #6467: fix(guard): read a resident's answer as a verdict only when it names this review (#6467)
    • Merged pull request #6442: perf(runtime): link and seed a waiting Codex hook in its review's queue write (#6442)
    • Merged pull request #6537: test(scanner): pin scanner results on a synthetic evasion corpus (#6537)
    • Merged pull request #6502: refactor(cursor): retire the Python Cursor hook client behind the native bridge (#6502)
    • Merged pull request #6471: fix(runtime): start one daemon when a burst of hooks meets a dead one (#6471)
    • Merged pull request #6444: perf(runtime): build a waiting Codex hook's live wait in the resident (#6444)
    • Merged pull request #6568: refactor(command): read a contained command's words in native authority
    • Merged pull request #6478: feat(runtime): ask the resident for the emergency-safe profile when the daemon fails (#6478)
    • Merged pull request #6517: fix(gauntlet): pin the sealed native runtime in installed replay (#6517)
    • Direct commit e27e1973aaa4: fix: resolve basedpyright type errors and active operation memory leak in recovery modules
    • Merged pull request #6456: chore(guard): move the harness capability report out of the runtime package (#6456)
    • Merged pull request #6523: test(packaging): refuse build and package metadata nothing still consumes (#6523)
    • Direct commit bd77d453cdb4: docs: clarify RSS probe timeout rationale
    • Merged pull request #6468: fix(guard): stop reviewing installs when NODE_OPTIONS only sizes the heap (#6468)
    • Merged pull request #6482: fix(extensions): load a script's commands from the file Guard saw it run (#6482)
    • Merged pull request #6485: fix(doctor): keep the account name out of the native runtime report (#6485)
    • Merged pull request #6475: fix(guard): run checks in a new linked worktree when each part passes (#6475)
    • Merged pull request #6509: fix(trust): keep the account name out of the install-surface diagnostics (#6509)
    • Merged pull request #6430: fix(guard): run builds and commits in temporary-directory worktrees (#6430)
    • Merged pull request #6561: perf(daemon): answer Claude Stop from the call that ends the turn
    • Merged pull request #6437: feat(runtime): answer a health question even when the resident is full (#6437)
    • Merged pull request #6519: fix(command): read Guard's own approval wait and artifact explanation quietly (#6519)
    • Merged pull request #6540: fix(guard): keep Oh My Pi read results for plugin manifests in a linked temp worktree (#6540)
    • Merged pull request #6545: fix(pretool): read an encoded empty target list as naming no file (#6545)
    • Merged pull request #6495: feat(ci): screen the module names a retirement cannot see (#6495)
    • Merged pull request #6532: refactor(command): decide a new command capability's operations in native authority (#6532)
    • Merged pull request #6473: feat(doctor): report the day's resident lifecycle in doctor (#6473)
    • Merged pull request #6477: fix(network): refuse content-encoded responses before any decoder runs (#6477)
    • Merged pull request #6553: fix(native): keep the direct-lane ACK when another runtime's resident restarts (#6553)
    • Merged pull request #6500: refactor(command): keep one copy of the action-class risk table (#6500)
    • Merged pull request #6550: fix(command): read a search root that is not there (#6550)
    • Merged pull request #6557: refactor(daemon): retire the client attach and heartbeat routes nothing calls
    • Merged pull request #6451: fix(command): read a staged diff's bare pathspecs as the staged read they are (#6451)
    • Merged pull request #6516: refactor(command): read the contained sink's inert prefix in native authority (#6516)
    • Merged pull request #6506: chore(deps): retire the runtime requirements only the deleted Python needed (#6506)
    • Merged pull request #6542: refactor(command): let native authority name a build's one writable directory (#6542)
    • Merged pull request #6474: test(gauntlet): run the installed vite entry through Bun as a live case (#6474)
    • Merged pull request #6514: feat(release): let an admin publish a pull request as an alpha
    • Merged pull request #6546: test(gauntlet): put the fixture's Bun on the session PATH its installer edits (#6546)
    • Merged pull request #6528: refactor(mcp): decide relay calls whose extension layers the publisher could not read (#6528)
    • Merged pull request #6483: test(runtime): pin how a killed resident, an unwritable scope and a broken socket fail (#6483)
    • Merged pull request #6484: fix(supply-chain): audit workspaces with thousands of lockfile packages (#6484)
    • Merged pull request #6508: ci(gauntlet): run installed acceptance for Muse (#6508)
    • Merged pull request #6463: feat(runtime): warm the resident at session start so the first hook does not pay for it (#6463)
    • Merged pull request #6459: chore(guard): retire Python helpers only tests still called (#6459)
    • Merged pull request #6531: refactor(mcp): stop honoring HOL_GUARD_MCP_RELAY=python (#6531)
    • Merged pull request #6446: fix(command): read a byte-bounded head or tail as an output filter (#6446)
    • Merged pull request #6460: fix(guard): report the restart pause that leaves a healthy install enforcing nothing (#6460)
    • Merged pull request #6462: fix(guard): treat tracked credential-named documents as project files (#6462)
    • Merged pull request #6534: refactor(runtime): retire the dead Python copies of three native authority tables (#6534)
    • Merged pull request #6487: feat(runtime): fetch managed content raw and decode it in a contained worker (#6487)
    • Merged pull request #6450: test(runtime): cover a dead published endpoint and a resident that never answers (#6450)
    • Merged pull request #6438: feat(runtime): fuzz the parsers that read untrusted bytes (#6438)
    • Merged pull request #6541: refactor(command): read a project's Vite output in native authority (#6541)
    • Merged pull request #3010: feat(recovery): add trusted service recovery (#3010)
    • Merged pull request #6458: fix(guard): contain cargo runs that name a worktree manifest (#6458)
    • Merged pull request #6441: fix(guard): allow a listing through the dependency link a worktree add chain just made (#6441)
    • Merged pull request #6488: feat(runtime): report what the serving resident has done and how it has failed (#6488)
    • Merged pull request #6536: fix(guard): keep the edit result for a tracked catalog named for secrets in Oh My Pi (#6536)
    • Merged pull request #6565: fix(mcp): retry a relayed call while the daemon republishes its snapshot
    • Merged pull request #6538: fix(command): let a DigitalOcean cluster listing name its own columns (#6538)
    • Merged pull request #6491: perf(approvals): answer a paused review and keep its connector context in its queue call (#6491)
    • Direct commit 4a22f7c4b5dc: test(gate): run the byte-bound runner cases only where the workspace sandbox exists
    • Merged pull request #6520: fix(codex): say why an approved action stayed blocked when the daemon rejects it (#6520)
    • Merged pull request #6503: fix(local-cli): list a script's options as commands you can allow or block (#6503)
    • Merged pull request #6552: refactor(local-cli): read a package runner's target in native authority
    • Merged pull request #6524: feat(mcp): refuse undecidable relay calls instead of handing sessions to the Python proxy (#6524)
    • Merged pull request #6555: perf(native): share one store connection across the publisher's 1 Hz recheck (#6555)
    • Merged pull request #6453: feat(ci): fail the retirement gate when a deletion strands a console script (#6453)

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.59.0a8

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger129 credits