Release notes

HOL Guard v3.57.0

Stable

HOL Guard v3.57.0, released October 25, 2026, is a stable release with 26 additions, 8 improvements, 33 fixes and 8 other changes across 73 merged pull requests. Highlights: Report launched runtimes that match an advisory as workspace findings; Hold background assessments while the host is busy.

Changes since the previous release on this channel: v3.56.0v3.57.0

26 added · 8 improved · 33 fixed · 8 other

Published Original GitHub release for v3.57.0

Key facts

Version
v3.57.0
Channel
Stable
Published
Previous release
v3.56.0
Merged pull requests
73
Commits
76

Documented changes

75 typed entries

Verified contributors

Credits being verified. Attribution coverage is unknown.

Attribution coverage

attribution not yet verified; history inventory partial.

Install

Current installation guide

Scope

Guard v3.57.0 is a stable release published 2026-10-25. Upstream documents: Report launched runtimes that match an advisory as workspace findings. Attribution for this release is being verified.

Changes

Added

26
  • guardReport launched runtimes that match an advisory as workspace findings (#5980) Evidence for this change
    • Findings. One finding per advisory and matched executable path (byte-identical runtimes at two paths are two findings), for the affected, restart_required and fix_unverified verdicts. Settled or unknown…
    • Coverage. The run is never reported clean for runtimes it could not check. Missing advisories add runtime_advisories_unavailable, an unknown verdict, an unreadable harness configuration, a launch past the probe's…
    • Reassessment. The worker probes each worktree's runtimes at most once every 10 minutes, and at most two worktrees per poll, so a restart does not hash every worktree's executables at once. The runtime identity…
  • workspaceHold background assessments while the host is busy (#5978) Evidence for this change
  • plugin-kitLeave marketplace copies out of the plugin with [plugin_kit] exclude_paths (#5979) Evidence for this change
  • dashboardShow plugin update prompts in the local Guard dashboard (#5969) Evidence for this change
    • The dashboard cannot reach hol.org (CSP), so two new daemon routes do the work: GET /v1/plugins/updates runs the same native comparison as the CLI, and POST /v1/plugins/updates/dismiss records a dismissal for one…
    • Both routes need the dashboard session token. The Rust route policy lists them in TOKEN_REQUIRED_PATHS and allows them only with the right method (GET for the read, POST for the dismissal).
    • The check runs only when the reader presses "Check for plugin updates". Guard downloads the public release index and compares versions on the device; nothing about the installed plugins is sent.
  • runtimeReview Node.js launches of builds with known high or critical advisories (#5957) Evidence for this change
  • plugin-releaseAdd the trusted reusable Plugin Release workflow (#5970) Evidence for this change
    • The workflow starts with permissions: {}. The one job asks for contents: read, id-token: write, attestations: write, artifact-metadata: write and security-events: write (the last only matters with…
    • Every composite input is forwarded, and the composite's outputs (score, check result, runtime count, attestation URL, registration status and releases page URL) are exposed to the caller.
    • The doc now describes the workflow as shipped and shows a minimal caller.
  • plugin-releasePin the Guard wheel and smoke-test the composite (#5965) Evidence for this change
  • Match runtime advisories from the signed supply-chain bundle (#5953) Evidence for this change
    • Verification and coverage stay native. Python passes the stored bundle response, the recorded sync keyring and the recorded bundle entitlement through unparsed. Rust checks the entitlement with the same rule…
    • Only an anchored bundle can clear a runtime. A bundle that verifies only against the key it advertises can still report affected, but its not_affected matches are downgraded to unknown…
    • Unknown stays unknown. Platform-scoped rules match only a confirmed OS/arch; an unconfirmed platform, including a macOS universal binary, reports platform_unknown. Bundled-component rules report…
  • guardReport observed MCP launch runtimes in fleet posture (#5950) Evidence for this change
    • Coverage is observed_only, so the section never claims a complete scope and never reports a runtime as safe.
    • A minimal report leaves the section out; older receivers that do not know it are unaffected because it is optional in the v1 schema.
    • Observing launches hashes executables, so the section is cached for an hour.
  • guardAssess workspaces registered with install --workspace (#5947) Evidence for this change
    • Each poll admits the workspace of every active install once. A root that is already admitted is skipped before any snapshot.
    • Automatic admission never resumes a paused worktree, even when the same worktree is reached through a newly registered path. Manual admission still resumes, as before.
    • A root that cannot be admitted (for example, the snapshot is refused) is remembered for the life of the worker, so it is not walked on every poll. A missing root is retried once it exists.
  • dashboardReview and apply dependency fixes from the Workspaces tab (#5935) Evidence for this change
    • A Fix column joins the findings table. An npm finding with a published fix version gets Prepare fix. Other findings show "Manual update" and no button, so the tab never offers an edit the daemon cannot make.
    • Prepare fix opens a review below the table, without a modal. It shows each package.json Guard would change, the section and the range before and after, and the diff. Each manifest gets its own **Apply to **…
    • After apply, the notice names the lockfile to update with the package manager. The row shows Waiting for re-check until a complete assessment settles the proposal as Fixed or Still found ("Update the…
  • guardScan workspace snapshots for secrets in background assessments (#5930) Evidence for this change
    • The native workspace snapshot scans the same bounded file set it already hashes, with the existing guard-scanner repository secret rules. It follows no symlinks and never leaves the workspace root.
    • Credential stores, key and certificate files, non-text files and oversize files are skipped. They are counted under coverage.secrets.skipped and are not reported as findings.
    • Matched text is dropped at the native boundary. The native scan emits the final finding: a worktree-scoped id, the rule id, the root-relative path, every line where it appears (up to 16) with an occurrences count…
  • runtimeReport the runtimes configured servers would launch, without running them (#5929) Evidence for this change
    • A new native runtime-identity-probe command (feature runtime-identity-probe-v1) describes each candidate path without executing it. It resolves symlinks and hashes the file with a bounded read. Missing files…
    • The runtime family and version are inferred from the file name and the install layout only: nvm, Homebrew Cellar, fnm, asdf, volta and pyenv. Because nothing is executed or signature-checked, assurance is at most…
    • Launch resolution is native too: the probe takes launch specs (the configured command, the server's own PATH, the launch directory, and the environment values a search path may reference) under a new…
  • guardPrepare, apply and verify reviewed dependency fixes for workspace findings (#5926) Evidence for this change
  • pluginsShow update prompts for installed plugins with a newer checked release (#5928) Evidence for this change
    • Guard downloads the public listing index and the public release index. Before the native check it narrows the listing index to plugins found on this machine, using the same repositories filter as install counts.
    • The native runtime (guard-plugin-telemetry, new updates command behind the plugin-updates-v1 resident feature) compares installed versions with recorded releases locally. Nothing about installed plugins is sent.
    • A prompt is marked urgent when the newer release fixes a high or critical scanner finding, or when the installed release had one.
  • guardSend workspace assessment summaries with receipt sync (#5919) Evidence for this change
  • telemetryAdd opt-in weekly plugin install counts (#5909) Evidence for this change
  • runtimeAssess runtime identities against vendor advisory ranges (#5916) Evidence for this change
  • dashboardShow background workspace assessments in the supply-chain hub (#5921) Evidence for this change
    • Each tracked worktree shows one status: fresh, stale, queued, running, partial, failed, paused or pending.
    • A partial check lists its coverage gaps, and detectors that are not part of the check yet are named, so a partial result never reads as all clear.
    • Dependency findings show the package, installed version, fixed version, decision, severity and advisory IDs.
  • guardAssess the active worktree in the background (#5901) Evidence for this change
  • plugin-releaseAttest each plugin release with the scanner and the Plugin Kit (#5913) Evidence for this change
  • plugin-kitCheck and package one plugin source for every agent runtime (#5889) Evidence for this change
    • check reports what a marketplace reviewer or runtime loader would reject (name not kebab-case, missing description or license, skills without frontmatter, MCP servers with neither command nor url, a literal value…
    • package writes a ready-to-load copy for claude-code, codex, gemini-cli, cursor, vscode, opencode, mcp-registry and agent-skills, plus hol.provenance.json (source digest and per-file SHA-256, no…
    • links prints the install commands that already work for the repository and the steps left to list it everywhere.
  • commandAdmit the daemon summaries that resolve no compose project (#5860) Evidence for this change
  • diagnosticsRecord active-set and candidate counts for scale runs (#5894) Evidence for this change
    • guard-command keeps counters in native_command_program_work_stats.rs. They record the active extension count of the last compiled controls, plus, per thread, the candidates the last declarative pass considered and…
    • With HOL_GUARD_NATIVE_DIAGNOSTIC set, the resident writes those counts after each request as native_resident_note lines in its existing phase log. As with existing notes, a line is written only when its value…
    • With the variable unset nothing is written. Receipts, decision IDs and the wire format are unchanged.
  • Add a false-positive issue form (#5962) Evidence for this change
  • Add ApexCompress command safety extension (#2994) Evidence for this change

Improved

8

Fixed

33
  • guardLet slow workspace assessments finish instead of retrying forever (#5985) Evidence for this change
    • The runner now renews the lease after each stage: after the first snapshot, after the audit and after the runtime check. A slow workspace keeps its run and records its result.
    • If renewal fails because the run was canceled, expired or taken over, the runner stops before the next stage.
    • An expired lease is retried once. The retry is recognised because the expiry creates it in the same transaction, so a later run (for example after a paused worktree resumes) keeps its own retry. If the retry also…
  • guardKeep workspaces with unsupported lockfiles out of complete coverage (#5984) Evidence for this change
    • The snapshot digest does not change, because the lockfile is already one of the snapshot's entries. The assessment context version moves to v2 instead, so every admitted worktree is reassessed once after the upgrade.…
    • Fix verification still works in a repository that mixes ecosystems. This reason does not leave any file unread, so a pubspec.lock beside package.json cannot hide an npm finding. It is the one snapshot_* reason…
    • The secret scan is unaffected. This reason does not leave any file unread.
  • pluginWait up to 60 seconds for the HOL plugin indexes (#5982) Evidence for this change
  • workspaceReport unchecked dependencies when no advisory data is cached (#5977) Evidence for this change
  • commandHonour a Git extension Allow over a review the command order alone raises (#5967) Evidence for this change
  • plugin-releaseSend a User-Agent so release registration reaches HOL (#5973) Evidence for this change
    • Plugin release and Guarded Repository registration now send User-Agent: hol-guard-attestation-registration.
    • When registration fails, the runner now prints the HTTP status code next to the error class. It still prints no body and no token.
  • dashboardLabel the audit priority badge as high priority, not critical (#5964) Evidence for this change
  • supply-chainSay where an auditable project folder must live (#5961) Evidence for this change
  • dashboardCount blocked package installs from receipts, not inactive apps (#5959) Evidence for this change
  • commandRead git submodule status as the printing command it is (#5955) Evidence for this change
  • commandLet a parent step return to the root a proven descent left (#5956) Evidence for this change
  • commandKeep a recursive search or listing of a missing path quiet (#5954) Evidence for this change
  • commandRead a process substitution as the path it opens (#5952) Evidence for this change
  • commandKeep a help request silent when it names a subcommand's own verb (#5958) Evidence for this change
  • commandKeep a checkout's own signing and pager settings out of the way (#5917) Evidence for this change
  • commandProve the branch git worktree add names after its destination (#5949) Evidence for this change
  • commandRead a bare refresh as the reach it has, and let a fetch lead a chain (#5933) Evidence for this change
  • commandRead a branch switch as the checkout it is (#5932) Evidence for this change
  • catalogNote a publication built for another engine once, not as two errors every refresh (#5941) Evidence for this change
  • commandRead a backgrounded launch followed by more jobs as a review, not a block (#5938) Evidence for this change
  • dashboardClose Supply Chain dialogs on Escape and report real intel freshness (#5943) Evidence for this change
  • commandKeep a proven fast-forward silent when a read follows it (#5936) Evidence for this change
  • scannerReport oversized packaged Mac executables as uninspected (8725d33) Evidence for this change
  • commandKeep a reader's proof when it follows a verified directory change (#5914) Evidence for this change
  • guardKeep packages Cloud could not answer out of background findings (#5927) Evidence for this change
    • A package whose only reasons are Cloud lookup failures is left out of the findings. A block decision is always kept.
    • Supply-chain coverage for that run is reported as incomplete, with supply_chain_incomplete in the reasons, so the result reads as partial and never as clean.
  • daemonKeep the verdict's reason when a hook render misses its deadline (#5918) Evidence for this change
  • supply-chainFind the package managers a launcher PATH hides and explain a failed audit sync (#5906) Evidence for this change
  • commandRead the command list a redirected control-flow construct runs (#5912) Evidence for this change
  • guardVerify supply-chain bundles whose text is not ASCII (#5905) Evidence for this change
  • releaseList every change in large release notes (#5904) Evidence for this change
  • mcpbPack the release bundle without the MCPB CLI (#5903) Evidence for this change
    • publish-mcpb.yml and mcpb-validation.yml pack distributions/mcpb with scripts/ci/pack_mcpb.py. The release still uploads hol-guard- .mcpb and its checksum.
    • The script checks the manifest, reads [project].version and [project].dependencies, refuses symlinks and paths that leave the bundle, and writes the zip through an exclusive temporary file.
    • .github/tools/mcpb-cli is removed, including the Forge backport, the Trivy skip for that lockfile, and the node-forge ignore entry that belonged to that tool.
  • commandRead a closed double-bracket test as the test it asks (#5855) Evidence for this change
  • commandRead a grouped command that stands in a pipeline (#5862) Evidence for this change

Other changes

8

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: v3.56.0

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Evidence ledger0 credits

No credits are published for this release yet.