Release notes
HOL Guard v3.59.0a7
PreviewHOL Guard v3.59.0a7, released October 29, 2026, is a preview release with 5 additions, 3 improvements, 20 fixes and 11 other changes across 34 merged pull requests. Highlights: Add end-to-end Muse harness adapter; Add the Pumpkit MCP contribution.
Changes since the previous release on this channel: alpha/v3.59.0a4alpha/v3.59.0a7
5 added · 3 improved · 20 fixed · 11 other
Key facts
- Version
- v3.59.0a7
- Channel
- Preview
- Published
- Previous release
- alpha/v3.59.0a4
- Merged pull requests
- 34
Documented changes
39 typed entries
Verified contributors
6 verified contributors · 82 credits
View the complete verified rosterAttribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.59.0a7 is a preview release published 2026-10-29. Upstream documents: Guard 3.59.0a7 is an opt-in prerelease cut from b33a7f2. Stable installations remain on the stable channel. 38 commits • 34 merged pull requests • 5 contributors since Guard 3.59.0a6. Its comparison base is alpha/v3.59.0a4. It includes 82 verified contribution deliveries with public evidence links.
Changes
Added
5- museAdd end-to-end Muse harness adapter (#6403) Evidence for this change
- Add a
museharness adapter that installs Guard-managedPreToolUse,PermissionRequest,UserPromptSubmit,PostToolUse, andSessionStarthooks into the Muse user settings file (hookssection), preserving… - Detect Muse settings hooks,
mcpServers(stdio argv and HTTP), project.muse-plugin/plugin.jsonhook/MCP capabilities, and skill roots in the Rust resident (muse_detect); register Muse across contracts, capability… - Render verdicts in Muse's hook wire format: allow is empty stdout (Muse rejects a bare
permissionDecision: "allow"),PreToolUseblocks are JSON deny envelopes on exit 0, prompt blocks use{"decision":"block"}…
- Add a
- mcp-serversAdd the Pumpkit MCP contribution (
7f46b0e) Evidence for this change - mcp-serversAdd the opt-in SmithGuard hosted MCP contribution (
5b428bd) Evidence for this change - mcp-serversAdd the SwitchBord MCP contribution (
7fd2102) Evidence for this change - mcp-serversAdd p6_export_dashboard to the P6 MCP contribution (
c7cbb03) Evidence for this change
Improved
3- guardDrop unused claim arguments and render fallback from the hook path (#6415) Evidence for this change
- guardRetire the unused sensitive file read and write request clients (#6414) Evidence for this change
- guardRetire the dead grant containment route (#6409) Evidence for this change
Fixed
20- commandRun a workspace's Jest in the same read-only sandbox as Vitest (#6413) Evidence for this change
- guardEnter a new worktree created below new parent folders (#6431) Evidence for this change
- runtimeEnd a Claude turn on Stop when the resident answers it (#6427) Evidence for this change
hook_direct_lifecycle.rs: for Claude CodeStop, run the turn stop before returning the constant. A session id that is a number, array or object defers, since Python may spell it differently in the event.hook_authority_state_op/claude_lifecycle.rs:claude_turn_stop_directrunsEnv::claude_turn_stopin oneBEGIN IMMEDIATEtransaction, the same way the permission-notice direct ops do. It drops the session's…hook_authority_state_op.rs: the shared open/busy-timeout/BEGIN IMMEDIATEstep is factored intobegin_direct.
- guardSay when Guard is unreachable on the supply-chain pages (#6428) Evidence for this change
- guardPut back the execute bit Guard's own runtime lost (#6421) Evidence for this change
- guardLet a cd into a home-relative new worktree run under the Git Allow (#6424) Evidence for this change
- guardLet an extension Allow cover a cd into the worktree the command creates (#6411) Evidence for this change
- codexReplay the waiting hook's block instead of recording a retry-only one after it exits (#6420) Evidence for this change
- approvalsFold a Codex retry into its pending review instead of opening a new row (#6412) Evidence for this change
- guardStop reviewing Guard's own runtime posture read (#6404) Evidence for this change
- guardSay what is wrong with a native runtime that is not ready (#6400) Evidence for this change
- guardLet a dependency link land in a worktree folder or a temporary worktree beside checking peers (#6408) Evidence for this change
- codexLeave a paused review the bridge waits on to the daemon so an allow releases the hook (#6410) Evidence for this change
- guardAllow linking a dependency directory into a just-added worktree (#6406) Evidence for this change
- the link resolves inside the new checkout through plain, non-hidden names;
lncreates a new entry;
- commandRead jq's comma, slices and optional operator as bounded reads (#6405) Evidence for this change
- runtimeBound a resident exchange by a deadline, not by one read (#6397) Evidence for this change
- commandSay a home-folder redirect is what Guard could not match (#6399) Evidence for this change
- codexRelease a waiting Codex hook when Cloud Review allows it once (#6401) Evidence for this change
- runtimeClear the resident's authentication key from every plaintext copy (#6398) Evidence for this change
- guardStop holding prompts that name Transfer-Encoding (#6396) Evidence for this change
Other changes
11- Guard 3.59.0a7 is an opt-in prerelease cut from
b33a7f2. Stable installations remain on the stable channel. 38 commits • 34 merged pull requests • 5 contributors since Guard 3.59.0a6. Evidence for this change - runtimeCheck a queued bound-Bash review in one native call (#6432) Evidence for this change
- policyLay stored MCP choices over the composed policy natively (#6423) Evidence for this change
- runtimeWrite plain relayed MCP receipts in the resident (#6416) Evidence for this change
- guardRecord a direct hook answer's receipt in the resident (#6418) Evidence for this change
- mcpStop projecting call params for events nobody reads (#6417) Evidence for this change
- cursorAnswer Cursor's sink-routed probe in the edge (#6407) Evidence for this change
- guardReconcile the Rust runtime PRD and TODO with the landed cleanup (#6419) Evidence for this change
- runtimeProve a crashing resident cannot become one process per failure (#6402) Evidence for this change
- guardLet installed acceptance assemble its development wheel (#6429) Evidence for this change
- rustGate the workspace's dependencies on advisories, licenses and duplication (#6391) Evidence for this change
- Merged pull request #6421: fix(guard): put back the execute bit Guard's own runtime lost (#6421)
- Merged pull request #6364: refactor(guard): read a review's approval evidence from the edge answer (#6364)
- Merged pull request #6271: feat(mcp-servers): add the opt-in SmithGuard hosted MCP contribution
- Merged pull request #6377: fix(guard): wait out a bounded restart hold instead of reporting the runtime down (#6377)
- Direct commit d7b012046012: Merge main into fix/gh-at-me-shorthand
- Merged pull request #6354: refactor(guard): check a review's policy binding in one resident ask (#6354)
- Merged pull request #6427: fix(runtime): end a Claude turn on Stop when the resident answers it (#6427)
- Merged pull request #6382: test(native): prove a pinned Windows launch runs the reviewed program and build the native tests on Windows (#6382)
- Merged pull request #6365: fix(cline): withhold a tool call when Guard's decision names no action this hook can place (#6365)
- Merged pull request #6369: fix(command): read a process substitution as the file it hands the command (#6369)
- Merged pull request #6371: fix(scripts): keep why a warm-path sample was refused, not only its class (#6371)
- Merged pull request #6400: fix(guard): say what is wrong with a native runtime that is not ready (#6400)
- Merged pull request #6398: fix(runtime): clear the resident's authentication key from every plaintext copy (#6398)
- Merged pull request #6366: perf(cursor): answer Cursor's route probe and contained sink admission in the resident (#6366)
- Merged pull request #6362: fix(guard): read an unplaceable policy action as a block in the generated hook client (#6362)
- Merged pull request #6423: perf(policy): lay stored MCP choices over the composed policy natively (#6423)
- Merged pull request #6375: feat(guard): send a keyed location digest with agent inventory workspace findings (#6375)
- Merged pull request #6381: fix(command): read a repository's own credential helper as developer config (#6381)
- Merged pull request #6409: refactor(guard): retire the dead grant containment route (#6409)
- Merged pull request #6408: fix(guard): let a dependency link land in a worktree folder or a temporary worktree beside checking peers (#6408)
- Merged pull request #6420: fix(codex): replay the waiting hook's block instead of recording a retry-only one after it exits (#6420)
- Merged pull request #6399: fix(command): say a home-folder redirect is what Guard could not match (#6399)
- Merged pull request #6347: fix(command): read a heredoc that a redirect or a pipe follows on the same line (#6347)
- Merged pull request #6349: fix(command): read literal standard input fed to a filter as the data it is (#6349)
- Merged pull request #6397: fix(runtime): bound a resident exchange by a deadline, not by one read (#6397)
- Merged pull request #6417: perf(mcp): stop projecting call params for events nobody reads (#6417)
- Merged pull request #6374: fix(guard): keep workspace assessment records when an admission ends and add an off switch (#6374)
- Merged pull request #6367: fix(guard): keep an extension Allow when a Git ref read follows the allowed step (#6367)
- Merged pull request #6356: fix(ci): resolve the runtime-majority scanner's dynamic imports from the source (#6356)
- Merged pull request #6410: fix(codex): leave a paused review the bridge waits on to the daemon so an allow releases the hook (#6410)
- Merged pull request #6386: fix(runtime): compute authentication tags with the audited HMAC crate (#6386)
- Merged pull request #6378: fix(command): keep checkouts into protected locations under review when worktree or clone is allowed (#6378)
- Merged pull request #6416: perf(runtime): write plain relayed MCP receipts in the resident (#6416)
- Merged pull request #6253: feat(mcp-servers): add the Pumpkit MCP contribution
- Merged pull request #6392: fix(guard): honour a custom script extension's allow on every harness and load its commands by path (#6392)
- Merged pull request #6358: refactor(guard): move the test-only PostToolUse decode stack out of the runtime (#6358)
- Merged pull request #6380: fix(runtime): leave a record of which runtime retired which resident (#6380)
- Merged pull request #6261: fix(commands): read gh's @me user shorthand as the signed-in account, not a file (#6261)
- Merged pull request #6402: test(runtime): prove a crashing resident cannot become one process per failure (#6402)
- Merged pull request #6372: fix(approvals): keep saved Always approvals across advisory and rule updates (#6372)
- Merged pull request #6428: fix(guard): say when Guard is unreachable on the supply-chain pages (#6428)
- Merged pull request #6385: fix(codex): release a waiting Codex hook when its review is approved (#6385)
- Merged pull request #6376: fix(shims): say when an intercept probe ran out of time instead of failed (#6376)
- Merged pull request #6404: fix(guard): stop reviewing Guard's own runtime posture read (#6404)
- Merged pull request #6360: fix(guard): let an explicit git allow run on checkouts named after Guard (#6360)
- Merged pull request #6406: fix(guard): allow linking a dependency directory into a just-added worktree (#6406)
- Merged pull request #6357: fix(command): unroll a for loop over a glob with no directory in it (#6357)
- Merged pull request #6396: fix(guard): stop holding prompts that name Transfer-Encoding (#6396)
- Merged pull request #6424: fix(guard): let a cd into a home-relative new worktree run under the Git Allow (#6424)
- Merged pull request #6389: perf(guard): rewrite a sink-routed call in the edge answer (#6389)
- Merged pull request #6431: fix(guard): enter a new worktree created below new parent folders (#6431)
- Merged pull request #6387: docs(guard): reconcile the Rust runtime PRD and TODO with what shipped (#6387)
- Merged pull request #6411: fix(guard): let an extension Allow cover a cd into the worktree the command creates (#6411)
- Merged pull request #6429: ci(guard): let installed acceptance assemble its development wheel (#6429)
- Merged pull request #6388: fix(runtime): let development wheels start the native resident (#6388)
- Merged pull request #6373: fix(skills): stop reading Markdown thematic breaks as frontmatter (#6373)
- Merged pull request #6403: feat(muse): add end-to-end Muse harness adapter (#6403)
- Merged pull request #6393: perf(cursor): answer a probe the edge does not route to the sink without a second resident call (#6393)
- Merged pull request #6405: fix(command): read jq's comma, slices and optional operator as bounded reads (#6405)
- Merged pull request #6355: refactor(guard): record an edge answer's receipt in the resident (#6355)
- Merged pull request #6391: ci(rust): gate the workspace's dependencies on advisories, licenses and duplication (#6391)
- Merged pull request #6394: test(gauntlet): deny a compound that chains an allowed worktree with a blocked read (#6394)
- Merged pull request #6359: fix(hook): deny on a policy action this build cannot place in the lattice (#6359)
- Merged pull request #6370: docs(guard): record that the Grok renderer no longer falls through to allow (#6370)
- Merged pull request #6413: fix(command): run a workspace's Jest in the same read-only sandbox as Vitest (#6413)
- Merged pull request #6401: fix(guard): release a waiting Codex hook when Cloud Review allows it once (#6401)
- Merged pull request #6384: test(network): read the saved bundle check against the real clock (#6384)
- Merged pull request #6383: test(guard): expect a sibling climb to keep its review on Windows, where climb proofs do not apply (#6383)
- Merged pull request #6432: perf(runtime): check a queued bound-Bash review in one native call (#6432)
- Merged pull request #6361: feat(mcp-servers): add the SwitchBord MCP contribution
- Merged pull request #6336: fix(command): keep the trusted Git check on a -C route to no repository (#6336)
- Merged pull request #6390: feat(cli): report the native runtime from doctor and a new runtime status command (#6390)
- Merged pull request #6415: refactor(guard): drop unused claim arguments and render fallback from the hook path (#6415)
- Merged pull request #6414: refactor(guard): retire the unused sensitive file read and write request clients (#6414)
- Merged pull request #6368: perf(cursor): answer the daemon's Cursor route in one resident call and read its containment stamp (#6368)
- Merged pull request #6418: perf(guard): record a direct hook answer's receipt in the resident (#6418)
- Merged pull request #6363: fix(guard): follow a cd to a sibling checkout when proving Git reads (#6363)
- Merged pull request #6412: fix(approvals): fold a Codex retry into its pending review instead of opening a new row (#6412)
- Merged pull request #6264: feat(mcp-servers): add p6_export_dashboard to the P6 MCP contribution
- Merged pull request #6407: perf(cursor): answer Cursor's sink-routed probe in the edge (#6407)
- Merged pull request #6379: test(guard): build the sibling-climb fixture where the read screens and Git for Windows accept it (#6379)
- Merged pull request #6419: docs(guard): reconcile the Rust runtime PRD and TODO with the landed cleanup (#6419)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.59.0a4
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.