Release notes

HOL Guard v3.60.0a74

Preview

HOL Guard v3.60.0a74, released November 12, 2026, is a preview release with 3 additions, 7 fixes and 1 other change across 9 merged pull requests. Highlights: Decide Hermes installs and stale shim refreshes in the native runtime; Seal and open Codex hook authority records in the runtime.

Changes since the previous release on this channel: alpha/v3.60.0a73alpha/v3.60.0a74

3 added · 7 fixed · 1 other

Published Original GitHub release for alpha/v3.60.0a74

Key facts

Version
v3.60.0a74
Channel
Preview
Published
Previous release
alpha/v3.60.0a73
Merged pull requests
9

Documented changes

11 typed entries

Verified contributors

2 verified contributors · 11 credits

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.60.0a74 is a preview release published 2026-11-12. Upstream documents: Guard 3.60.0a74 is an opt-in prerelease cut from 476ce7a. Stable installations remain on the stable channel. 10 commits • 9 merged pull requests • 2 contributors since Guard 3.60.0a73. Its comparison base is alpha/v3.60.0a73. It includes 11 verified contribution deliveries with public evidence links.

Changes

Added

3
  • guardDecide Hermes installs and stale shim refreshes in the native runtime (#7569) Evidence for this change
    • Hermes install plan.** A new hermes_install_plan runner-authority kind answers five questions for the Hermes adapter:
  • guardSeal and open Codex hook authority records in the runtime (#7562) Evidence for this change
    • the pending publication inverse (recovery);
    • the retained authority receipt beside a hook manifest (receipt);
    • the repair and publication-inverse review requests (repair_request, inverse_request).
  • guardDecide Cursor hook rebinds and uninstall restores in the native runtime (#7564) Evidence for this change
    • Cursor hook rebind.** rebind_stale_cursor_hooks and cursor_hook_script_bakes_ephemeral_cli now ask two new cursor_hook_config ops:

Fixed

7
  • daemonRoute Codex live decisions so approved requests run (#7572) Evidence for this change
  • guardRead globs with wildcard directories like their matches (#7547) Evidence for this change
    • The walk starts at the literal directory before the first wildcard. That root has to pass the bounded directory read, and none of its components may be hidden. The harness homes keep their own Markdown-only proof, and…
    • Wildcard components follow the existing last-component model: only * and ?, ASCII case ignored, and a hidden or non-ASCII entry the pattern would match sends the read to review (dotglob, locale-dependent ?).…
    • A matched directory name with whitespace or a glob character keeps the review, since an unquoted $f in a loop would split or expand it again. The exception is a bracketed route directory such as [id] matched by a…
  • guardKeep a recursive grep's directory exclusions beside its includes (#7571) Evidence for this change
  • runtimeRead "since the last push" as a pushed change, and plain words like "out" as task words (#7566) Evidence for this change
    • None of its words were on the list that marks a prompt as being about changes, so the note did not include the newest commit's diff. Agents then ran git log and git show HEAD themselves.
    • The plain word "out" was searched as a code name. In the sortedcontainers benchmark project it matched a local variable in SortedList._pos, and the agent opened that method first.
  • runtimeTreat a path inside a tag as a machine path (#7575) Evidence for this change
  • commandAccept pip-style == pins in the versioned package matcher (2e31f02) Evidence for this change
  • guardLet a contained search skip .git by name (#7567) Evidence for this change
    • Merged pull request #7564: feat(guard): decide Cursor hook rebinds and uninstall restores in the native runtime (#7564)
    • Merged pull request #7562: feat(guard): seal and open Codex hook authority records in the runtime (#7562)
    • Merged pull request #7567: fix(guard): let a contained search skip .git by name (#7567)
    • Merged pull request #7215: fix(command): accept pip-style == pins in the versioned package matcher
    • Merged pull request #7572: fix(daemon): route Codex live decisions so approved requests run (#7572)
    • Merged pull request #7566: fix(runtime): read "since the last push" as a pushed change, and plain words like "out" as task words (#7566)
    • Merged pull request #7575: fix(runtime): treat a path inside a tag as a machine path (#7575)
    • Merged pull request #7547: fix(guard): read globs with wildcard directories like their matches (#7547)
    • Merged pull request #7571: fix(guard): keep a recursive grep's directory exclusions beside its includes (#7571)
    • Merged pull request #7569: feat(guard): decide Hermes installs and stale shim refreshes in the native runtime (#7569)
    • Direct commit dcb105ecab7b: Merge remote-tracking branch 'origin/main' into repair/pr-7215

Other changes

1

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.60.0a73

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger11 credits