Release notes

HOL Guard v3.60.0a16

Preview

HOL Guard v3.60.0a16, released November 6, 2026, is a preview release with 10 additions, 1 improvement, 6 fixes and 3 other changes across 18 merged pull requests. Highlights: Reset the extension-control authority in the resident; Clear the remote policy authority in the resident.

Changes since the previous release on this channel: alpha/v3.60.0a15alpha/v3.60.0a16

10 added · 1 improved · 6 fixed · 3 other

Published Original GitHub release for alpha/v3.60.0a16

Key facts

Version
v3.60.0a16
Channel
Preview
Published
Previous release
alpha/v3.60.0a15
Merged pull requests
18

Documented changes

20 typed entries

Verified contributors

Credits being verified. Attribution coverage is in progress.

Attribution coverage

attribution in progress; history inventory partial.

Install

Current installation guide

Scope

Guard v3.60.0a16 is a preview release published 2026-11-06. Upstream documents: Guard 3.60.0a16 is an opt-in prerelease cut from bad46be. Stable installations remain on the stable channel. 19 commits • 18 merged pull requests • 3 contributors since Guard 3.60.0a15. Its comparison base is alpha/v3.60.0a15. Attribution for this release is being verified.

Changes

Added

10
  • extensionsReset the extension-control authority in the resident (#7310) Evidence for this change
    • New reset op on the extension-control authority request, carrying the reason and whether the catalog manifests go with the lost key.
    • In one immediate transaction the resident archives the snapshot, every transition and every proof into extension_control_authority_recovery_archive, records the extension_control_authority_reset event with the same…
    • Python keeps the key recovery and secret storage, then bootstraps the fresh authority as before. The reset op needs the commit feature.
  • extensionsClear the remote policy authority in the resident (#7307) Evidence for this change
  • extensionsQueue recovery's change event in the resident and refuse unreserved pack commits (#7305) Evidence for this change
  • extensionsWrite earned authority anchors in the resident (#7303) Evidence for this change
    • anchored: a prepared row exists at that revision, seals that snapshot, and carries no authority of its own. The vault still pins the committed head below it and the row authenticates as that head's prepare.
    • committed: the committed snapshot head is that revision and digest, and the vault already names it.
    • Anything else, including prepared, is refused as tampered with the vault untouched.
  • extensionsResume a commit retry's own prepared row in the resident (#7301) Evidence for this change
    • commit_pending / mark_committed / finish: the proof is inserted as consumed, or a reserved proof is stamped once (coalesce), in the transaction that commits the row.
    • abandon: the reserved proof is released with the row.
    • current: when the retry's view already shows the row committed, the proof is stamped and the change event queued; no anchor is written.
  • extensionsMigrate a catalog that activates a command pack in the resident (#7300) Evidence for this change
    • migrate takes the pack_reserve the commit path already sends. It reserves the staged activation in the transaction that writes the prepared row and returns pack_bound once the row is anchored. A reservation the…
    • resume with a migration_record records the migration event in the transaction that commits the row. It queues no change event, which matches every other migration.
    • Python runs the same resume loop a commit uses, so the lifecycle floor moves before the resident installs the activation. The Python insert, reserve, finish, snapshot update and event write for this path are gone.
  • extensionsReserve staged pack activations in the resident (#7299) Evidence for this change
  • extensionsInstall pack-bound control commits in the resident (#7298) Evidence for this change
  • storeWrite local extension grants and continuity natively (#7309) Evidence for this change
    • New native methods are apply_custom_extension_continuity and upsert_local_cli_grant. They live in guard_store_continuity_write.rs.
    • Every refusal keeps its Python message, so callers and the HTTP API return the same errors as before.
    • The capability refusals (invalid_capabilities, capabilities_require_cli_surface, capabilities_require_allowed_grant) are raised as LocalCliCapabilityError again on the Python side.
  • extension-controlBootstrap, commit, resume, migrate and manifest writes in the resident (#7295) Evidence for this change
    • bootstrap takes the bootstrap plan and inserts the revision-zero snapshot in one immediate transaction, then seals the committed anchor into the credential vault and reads it back.
    • commit_prepare takes the commit plan, reserves the proof and writes the prepared transition in the same transaction, so no other writer can claim the revision in between. resume with the reserved proof finishes the…
    • migrate commits a catalog rebinding: the prepared row, the anchored anchor, the snapshot move, the migration event (and the regression row for a downgrade), then the committed anchor. The migration event is built…

Improved

1

Fixed

6

Other changes

3

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.60.0a15

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Evidence ledger0 credits

No credits are published for this release yet.