Release notes

HOL Guard v3.58.0

Stable

HOL Guard v3.58.0, released October 27, 2026, is a stable release with 48 additions, 104 improvements, 86 fixes and 25 other changes across 231 merged pull requests. Highlights: Report running processes on the build they started from; Add the opt-in Oids remote server contribution.

Changes since the previous release on this channel: v3.57.0v3.58.0

48 added · 104 improved · 86 fixed · 25 other

Published Original GitHub release for v3.58.0

Key facts

Version
v3.58.0
Channel
Stable
Published
Previous release
v3.57.0
Merged pull requests
231
Commits
265

Documented changes

263 typed entries

Verified contributors

Credits being verified. Attribution coverage is unknown.

Attribution coverage

attribution not yet verified; history inventory partial.

Install

Current installation guide

Scope

Guard v3.58.0 is a stable release published 2026-10-27. Upstream documents: Report running processes on the build they started from. Its comparison base is v3.57.0. Attribution for this release is being verified.

Changes

Added

48
  • runtimeReport running processes on the build they started from (#6234) Evidence for this change
    • It lists processes this user can see whose executable is one of the probed files, each named by boot, PID and start identity.
    • A process is bound to the file on disk only when the file provably has not changed since it started: the process started a whole second after the file's last modification or status change, and on Linux…
    • Otherwise the process keeps the build an earlier probe bound it to, passed back as known_instances, or gets an unidentified artifact with no version and unknown assurance, which never clears an advisory. Stored…
  • mcpAdd the opt-in Oids remote server contribution (09ba7a7) Evidence for this change
  • mcp-serversAdd the borer MCP contribution (41f6c0e) Evidence for this change
  • runtimeSign and verify command envelopes in the native runtime (#6116) Evidence for this change
  • runtimeAuthenticate adapter state in the native runtime (#6121) Evidence for this change
  • extensionsAdd the OpenComms command extension (0c210ac) Evidence for this change
  • runtimeResolve package risk actions inside the native runtime (927edc8) Evidence for this change
  • storeResolve an exact cloud review inside the native runtime (7c6137d) Evidence for this change
  • guardLet the native runtime verify a supply-chain bundle (2ab4140) Evidence for this change
  • runtimeCompose the live Codex allow artifact in the resident (#6103) Evidence for this change
  • dashboardShow finding evidence apart from install policy (#6182) Evidence for this change
  • extensionsAdd the ShieldEnv command extension (#6177) Evidence for this change
    • Add the ShieldEnv command extension for local secret scans, with an external trust binding, the compact public descriptor, and a portable fixture.
    • Includes the command source from #6162.
  • workspaceFlag editor tasks and dev container commands that run on their own (#6143) Evidence for this change
  • pluginSay how to get HOL Guard in the README install block and explain a missing native runtime (#6091) Evidence for this change
    • README install block (hol-guard plugin links --block)**
  • pluginMake plugin install and uninstall easier to read and recover from (#6094) Evidence for this change
    • Install and uninstall**
  • pluginStop risky plugin installs, pin both runtimes and run only absolute programs (#6093) Evidence for this change
    • The gate**
    • A listing whose gate is block stops before any runtime starts, with exit 4. This also applies without --apply, so a script that only plans sees the refusal.
    • A listing whose gate is confirm asks "Install anyway?" at the terminal. With --yes it stops with exit 4 unless --accept-risk is also given. --yes alone never accepts a risk.
  • pluginGate installs on HOL's scan result and pin them to the scanned commit (#6092) Evidence for this change
    • Spec versions**
    • hol.plugin-install-spec.v1 stays strict: an unknown key is refused.
    • v2 ignores fields it does not know, so HOL can add fields without breaking older Guards. Ignored fields never reach a command line.
  • guardCheck GitHub Actions workflows in workspace assessments (#6082) Evidence for this change
    • Only .yml and .yaml files directly in the root .github/workflows directory are read, matching the files GitHub runs. Nested directories, composite actions under .github/actions and workflow directories below…
    • The rules live in a new guard-command module, ci_workflow_risk, so the runtime owns them:
    • ci.workflow.untrusted-checkout (execution, high, likely): a privileged trigger (pull_request_target, workflow_run, including inside an on: list) together with a pull request head reference on a checkout ref:…
  • extensionsAdd GiviLoop command controls (4c682be) Evidence for this change
  • pluginLet plugin install read specs from a test portal (#6087) Evidence for this change
    • It accepts https anywhere, or plain http only on localhost, 127.0.0.1, ::1 or host.docker.internal.
    • The native Kit checks the value (endpoint command) and returns its normalized origin: lowercase host, default port dropped. It refuses credentials (even empty ones), a query, a fragment, a backslash, a bad port or a…
    • An overridden endpoint never follows a redirect. A 3xx answer stops and asks for the final install-spec URL.
  • guardApprove a paused package install in the terminal that ran it (#6095) Evidence for this change
    • Approve on the spot. When both are terminals and no AI harness marker is present, Guard asks right there: y allows once, a always allows this exact install, n (or Enter) keeps it blocked. The answer resolves…
    • Clear next steps when no one can answer. For non-interactive human output, the "Guard guidance" panel (which tells an agent to wait and not retry) is replaced by "Approve this install": the exact `hol-guard…
  • runtimeVerify Guard Cloud command capabilities in the runtime (#6079) Evidence for this change
  • mcp-serversAdd the Arch MCP contribution (6827a43) Evidence for this change
  • extensionsAdd the agent-gauntlet command extension (6f36e93) Evidence for this change
  • extensionsAdd the Mori command extension (a5cd796) Evidence for this change
  • guardCount why the bounded bridges hand a hook to the daemon (#6076) Evidence for this change
    • bounded_direct_answer returns Result instead of Option : disabled switch, unsupported event, unbuildable request, or the resident's own miss.
    • route_hook carries the miss into both daemon posts, including the one after a daemon restart, as the X-Guard-Direct-Miss header.
    • DIRECT_MISS_HEADER now lives next to DirectMiss, and the Grok bridge imports it instead of keeping its own copy.
  • policyDerive a cached bundle's decision identities in the resident (#6067) Evidence for this change
  • mcpAdd the keepAwake MCP server (61352fb) Evidence for this change
  • extensionsAdd Astrix command and MCP contributions (4c5fb48) Evidence for this change
  • guardCount why the Grok bridge hands a hook to the daemon (#6071) Evidence for this change
  • guardCheck agent plugin hooks and MCP servers in workspace assessments (#6027) Evidence for this change
    • A plugin's hooks are its manifest's inline hooks, the files that field names and hooks/hooks.json at the plugin root. Its MCP servers are the manifest's inline mcpServers, the files that field names and…
    • Hook commands run the shared hook_config_risk rules and servers the shared mcp_config_risk rules, so a plugin finding uses the same rule ids as the project hook and MCP checks (hook.config.remote-code…
    • The runtime advertises the scan as workspace-snapshot-plugins-v1. Each finding carries the rule id, category, severity, confidence, the rule's fixed title, reason and false-positive hint, the root-relative path of…
  • runtimeSign workflow capabilities in the native resident (#6052) Evidence for this change
  • nativeRead a packaged hook file's identity in the resident (#5873) Evidence for this change
  • guardAssemble the local CLI inventory in the resident (#6039) Evidence for this change
  • extensionsAdd drip command safety extension (b030e35) Evidence for this change
  • guardReconcile temporary MCP grants in the resident (#6025) Evidence for this change
  • pluginPrint a draft .well-known plugin card (#6033) Evidence for this change
  • plugin-kitPrint a listing owner's HOL stats with hol-guard plugin stats (#6031) Evidence for this change
  • guardWrite policy decisions in the resident (#6023) Evidence for this change
  • pluginCheck and convert plugins against the Agent Plugins spec (#6021) Evidence for this change
  • plugin-releaseAttest a CycloneDX SBOM and annotate changes since the previous release (#6024) Evidence for this change
  • guardCheck project agent hooks in background workspace assessments (#6014) Evidence for this change
    • The files checked are the ones agents load from the worktree root: .claude/settings.json and settings.local.json, .codex/hooks.json and config.toml, .cursor/hooks.json, .gemini/settings.json…
    • Hooks are read from a hooks object keyed by event. Only Devin's hooks.v1.json and the Copilot files may instead be keyed by event at the top level, so other top-level lists in a settings file (notify…
    • The rules live in guard_command::hook_config_risk, on top of the shared guard_command::launch_screen the MCP check uses, so remote code, environment exfiltration and privileged launches are named the same way as in…
  • pluginInstall and uninstall HOL listings with each runtime's CLI (#6013) Evidence for this change
    • Guard downloads the listing's install spec from https://hol.org/api/guard/plugins/install-spec (identifiers only, 64 KiB cap). --spec-file reads a local spec instead, for offline use and tests. The spec must name…
    • The native Plugin Kit checks every identifier in the spec and turns it into argument vectors for a fixed set of programs: claude, codex and npx. Anything else in the spec is printed under "Install by hand" and…
    • The default is a plan: Guard prints the commands and changes nothing. --apply runs them without a shell, asking Install for ? [y/N] for each runtime. --yes skips the prompts for CI. --runtime limits…
  • runtimeDerive and publish the policy verifier key natively (#6011) Evidence for this change
  • guardCheck configured MCP servers in workspace assessments (#5993) Evidence for this change
    • Python reuses Guard's harness adapters to find configured MCP servers and sends every one with the worktree roots (as named and with links followed). The runtime keeps only servers whose configuration file sits under a…
    • Only each server's launch command, arguments and URL go to the runtime over stdin. Environment, headers and other settings stay behind. The new mcp-config-assess --stdin runtime command reads no files and starts…
    • The rules live in guard_command::mcp_config_risk, on top of a shared guard_command::launch_screen that later hook checks reuse. A launch reaches a POSIX shell script (sh, bash, zsh, dash, ksh, fish and…
  • workspaceCheck agent skills in background workspace assessments (#5990) Evidence for this change
    • The native workspace snapshot takes a skills flag. With it, the runtime runs the shared skill_content_risk rules over the bytes it already hashed for each SKILL.md under .claude/skills, .agents/skills…
    • Each finding carries the rule id, category, severity, confidence, the rule's fixed title, reason and false-positive hint, and the skill's root-relative path. The rule's technical detail can quote skill text, so the…
    • A skill the scan could not read in full leaves the detector incomplete: one over the hook-time skill size bound, one that is not UTF-8, one the snapshot itself skipped, any snapshot limit that may have hidden a…
  • pluginLet the release summary carry one HOL Blue line (#5988) Evidence for this change
    • HOL's registration response may include offerUrl. The runner keeps it only when it is a https://hol.org/guard/plugins/promote?… link with plain query characters. Anything else is dropped, so HOL cannot inject…
    • The line's text is written by Guard, not by HOL: "HOL Blue adds full owner insights and the checkmark to this listing", followed by the link and a note on how to hide it.
    • HOL sends the link at most once per repository in 28 days, and never on a retry of an already recorded release.
  • Add HOL Guard sponsorship manifest (4aa4eb8) Evidence for this change

Improved

104

Fixed

86
  • commandRead a repository's own hooks directory as the developer's (#6233) Evidence for this change
  • guardVerify the signed network protection bundle in the native runtime (#6171) Evidence for this change
  • connectAsk for a new device code when Guard Cloud's approval answer is lost (#6226) Evidence for this change
  • plugin-kitPoint upgrade messages at hol-guard update instead of pip (#6231) Evidence for this change
    • a listing whose install spec uses a newer schema than this Guard reads (exit 5);
    • hol-guard plugin stats when HOL answers in a shape this Guard does not know;
    • hol-guard telemetry plugins when the native runtime is too old or the plugin index is too large.
  • dashboardStop waiting on a stalled intel sync and show how long it has run (#6224) Evidence for this change
  • supply-chainList every version a lockfile installs in the workspace inventory (#6223) Evidence for this change
    • DepMap::earlier exposes the versions a key held before its current one.
    • installs_every_version is now public so the inventory can apply the same lockfile list the manifest diff uses.
    • For those lockfiles, each earlier version is merged into the inventory as its own transitive row. The current version keeps its direct flag and range, and merge_inventory_item already gives a differing version its…
  • cloudDowngrade a catalog sync only when no page reached Cloud (#6205) Evidence for this change
  • supply-chainAudit every version a lockfile resolves a package to (#6220) Evidence for this change
    • DepMap remembers each distinct value a key held, and into_sorted_versions returns every one with the current value last. Collecting the result into a map still gives into_sorted, so callers that want one version…
    • The complete lockfile parser now emits one entry per resolved version for the lockfiles whose package managers install or build every copy side by side: pnpm, yarn and bun text locks, and Cargo.lock…
    • The transitive audit skipped every entry whose name matched a requested package. It now skips only the copy whose version the request names or the lockfile resolves the requested package to, using the same per-lockfile…
  • guardKeep a package finding's identity when its rule data changes (#6217) Evidence for this change
  • guardList every resolved version of a package in the workspace inventory (#6216) Evidence for this change
  • dashboardShow Guard's advice when workspace findings cannot reach the daemon (#6219) Evidence for this change
  • guardKeep workspace findings and model refusals out of enforcement records (#6213) Evidence for this change
  • dashboardKeep the last check time visible on workspace findings (#6211) Evidence for this change
    • The status note (out of date, failed reason, paused) and the check time now show together.
    • When the newest run failed, is queued or is still running, the findings on screen come from the last finished assessment. The row now reads "Showing results from the check 2h ago." using that assessment's finish time…
    • When no check has finished yet and the first run failed or is still in progress, the row says "No check has finished yet." The last scan time moves on failed runs too, so it is not used there.
  • releaseKeep published wheels on core metadata PyPI can read (#6201) Evidence for this change
  • plugin-kitKeep a Claude Code plugin installed by its declared command (#6176) Evidence for this change
  • guardDecide the low registry trust review floor in the native runtime (#6112) Evidence for this change
  • cloudDowngrade a sync whose catalog view was evicted instead of failing it (6677f9d) Evidence for this change
  • readRead a project's own documents out of its hidden directories (#6104) Evidence for this change
  • guardStop holding a pack because another compiler wrote its security root (#6145) Evidence for this change
  • workspaceKeep earlier findings listed while their detector has not rechecked (#6156) Evidence for this change
    • The finding stays listed with carried_from_run_id, the run that last observed it, and keeps that origin while the gap lasts.
    • A detector that completes again, or has nothing left to read, settles its own earlier findings: one it no longer reports is gone.
    • A finding the run found again is listed once, as observed.
  • guardReject unnamed options on fail-secure leading subcommands (4101032) Evidence for this change
  • guardLet an install take back a policy root admitted under another engine (#6114) Evidence for this change
  • shimsReport cloud coverage as a new login shell sees PATH (#6080) Evidence for this change
    • export PATH= :$PATH and fish_add_path --prepend put the shim directory first, so the manager is reported protected.
    • An append stays behind the real binary. That includes export PATH="$PATH: ", [ -d ] && export PATH="$PATH: ", and fish_add_path -ga.
    • A later export PATH=/usr/bin:/bin drops the shim directory.
  • adaptersFind user-installed CLIs when Guard runs with the desktop launch PATH (#6099) Evidence for this change
    • Homebrew, /usr/local/bin, ~/.local/bin, ~/bin
    • bun, npm-global, Volta, asdf, Cargo, pnpm
    • ~/. /bin
  • guardLet a quarantined pack still accept the operator's next prompt (#6110) Evidence for this change
  • guardDrop workspace findings whose severity, confidence or verdict is not text (#6118) Evidence for this change
    • workspace_mcp_config_findings.py, workspace_hook_config_findings.py, workspace_skill_findings.py: severity and confidence.
    • workspace_secret_findings.py: severity.
    • workspace_ci_workflow_findings.py: rule_id.
  • syncTreat an unreachable Guard Cloud during token refresh as a retryable outage (#6105) Evidence for this change
  • guardLet the runtime decide which posture governs a harness (e4344b6) Evidence for this change
  • runtimeKeep the published runtime's resident when an older install asks it to stop (#6100) Evidence for this change
    • A shutdown whose intent is not stop is refused with native_resident_in_use (not retryable) only when the publisher's latest snapshot (policy-snapshot-publisher-v3.json, MAC and key id verified with the store's…
    • Every doubt stops the resident as before: no policy store; a missing, unreadable, non-private, malformed or unauthenticated publisher snapshot; a lease directory lock busy past 100 ms; an unreadable lease record. A…
    • Explicit stops (stop_managed) send {"intent":"stop"} and are always honoured. The handoff path sends {"intent":"handoff"}. A bare {} from an older client counts as a handoff. Every released resident parses the…
  • commandRead the removal of a worktree that is already gone as a removal that takes nothing away (#6101) Evidence for this change
  • runtimeKeep resident auth workers free while requests evaluate (#6097) Evidence for this change
  • guardRead a harness's target_file as the file an approval is about (#6096) Evidence for this change
  • hooksName the guard home in the recovery command an authority block offers (#6053) Evidence for this change
  • pretoolRead a request for a subagent's output as collecting a result (#6088) Evidence for this change
  • extensionsLet two clients prepare the same catalog at once (#6089) Evidence for this change
  • guardKeep saved package approvals valid across feed refreshes and PATH changes (#6090) Evidence for this change
    • PATH drift. The package-manager executable component bound a digest of the whole PATH. Agent harnesses that prepend a per-session shim directory changed it on every launch, so reuse failed with…
    • Feed refreshes. The policy component bound bundle_version, policy_version, feed_snapshot_hash and the full reason text. The hourly Guard Cloud refresh changed those without changing the verdict, so reuse…
  • commandRead the Guard approval command's own help without a review (#6074) Evidence for this change
  • guardReconcile hook launchers that run another install's Python or an older runtime (#6083) Evidence for this change
  • mcpLet the relay decide OpenCode package calls its native prompt approves (#6084) Evidence for this change
  • commandResolve a relative symlink source the way the kernel does (#6077) Evidence for this change
  • extensionsAccept the compare response GitHub actually returns (#6085) Evidence for this change
  • hooksTell the daemon why the resident missed a hook (#6081) Evidence for this change
  • commandRead the launcher's own help, posture and delimited inspection without a review (#6072) Evidence for this change
  • hookRead the daemon's answer to a hol-guard hook call in the native runtime (#6075) Evidence for this change
    • It reshaped the answer into a bridge harness's wire format with _daemon_response_to_native.
    • It chose the exit status of every other harness with _consistent_native_response and _policy_action_from_daemon.
  • hooksRepin harness hooks to the current native runtime (#6070) Evidence for this change
    • repair_failing_managed_harness_hooks now reinstalls an active managed harness whose config_path names a runtime digest other than the running frozen build's.
    • The repair counts as failed when the config still names the old digest afterwards.
    • Source installs never write durable runtime paths and are skipped.
  • mcpLaunch Desktop MCP proxies through the native relay (#6061) Evidence for this change
  • hooksRender the Claude Code prompt notice in the native edge (#6073) Evidence for this change
    • edge.rs brands the rendered harness response for a reviewed Claude Code UserPromptSubmit when the envelope is not recording_only. The receipt does not bind the harness response, so receipts are unchanged.
    • The daemon worker returns the edge's harness response as is. The Python overlay and its secret-class mapping are removed from hook_worker_native.py.
    • The direct lane's prompt_answer no longer applies the notice again, because the edge it reads already carries it.
  • mcpDecide Composio tool calls in the native relay (#6062) Evidence for this change
  • releasePublish MCPB checksums that verify next to the download (#6069) Evidence for this change
  • releasePublish stable releases to the MCP Registry and MCPB (#6060) Evidence for this change
  • ciClassify the raw artifact fields helper in the runtime scope (#6066) Evidence for this change
  • releasePublish a main alpha when plugin-scanner is over the PyPI limit (#6057) Evidence for this change
    • Skip the plugin-scanner PyPI upload on a main alpha when that project is already at the 10 GiB limit.
    • Still publish hol-guard and create the alpha prerelease. The scanner upload stays required when the project has room.
  • catalogGive Sigstore's trust refresh CA roots in the packaged runtime (#6058) Evidence for this change
  • runtimeKeep the recovery command when a block has no repair page (#6045) Evidence for this change
  • authorityFinish an interrupted control-authority commit on the next read (#6042) Evidence for this change
  • commandDecide the protected harness configuration paths natively (#5876) Evidence for this change
  • nativeAttribute a package request to the harness that actually ran it (#5874) Evidence for this change
  • nativeRead a tool response's text in the resident (#5877) Evidence for this change
  • commandFollow a project lookup up to the workspace root (df70ec6) Evidence for this change
  • scannerAccept structured Kimi interface metadata (#6047) Evidence for this change
    • Validate only Kimi's five documented string display fields, allowing additional structured interface metadata such as tryPrompts, mcpOverrides and skillOverrides.
    • Preserve findings for non-object interfaces and invalid documented display values.
    • Fixes #6032. Regression cases: test_kimi_interface_accepts_additional_metadata and the CLI scan of kimi-plugin-good with all three reported fields. All five acceptance cases fail before the fix.
  • commandRead a package manager's quiet and workspace options as part of its verb (80d7efd) Evidence for this change
  • commandResolve a package manager past Guard's own shim before judging containment (0c89b8d) Evidence for this change
  • guardShow HOL as the publisher name (#6043) Evidence for this change
    • Name the publisher HOL in the Claude plugin, MCP bundle, Windows installer, and approval center.
    • Use that same publisher display name in the extension catalogs and fixtures.
    • Publish the drip command descriptor for the source already on main, so native verification can accept it.
  • commandRead a bounded jq filter over a piped read as a read (#6018) Evidence for this change
  • extensionsPublish the drip command descriptor (07bb24d) Evidence for this change
  • commandLet an agent read Guard's own records without an approval (#6016) Evidence for this change
  • dashboardStop asking a connected device to connect Guard Cloud when intel has not synced (#6041) Evidence for this change
    • Local only: unchanged. It still prompts to connect Guard Cloud.
    • Paired (waiting or active): "Guard Cloud is connected, but no signed advisory bundle has synced to this device yet. Use Sync on this page to fetch it."
  • supply-chainOffer a retry when Guard Cloud cannot be reached during sync (#6040) Evidence for this change
    • refused or reset connections
    • DNS lookup failures
    • timeouts
  • cliExplain native runtime installation requirements (#5940) Evidence for this change
    • Explain missing native runtimes in CLI configuration errors and the Desktop bootstrap fast path. Preserve the CLI error/exit 1 and Desktop's first error line, empty stdout and exit 2; avoid missing-runtime guidance…
    • Recommend hol-guard update before a matching-wheel fallback in the same Python environment. Document the 3.56.0 wheel matrix, Intel Mac repair prerequisites, Linux ARM64 limitation and Windows ARM64 x64-Python…
  • runtimeKeep enforcing when an abandoned prepare sits above the authority head (#6022) Evidence for this change
  • dashboardKeep the standalone Sync approval about syncing and close it when the sync succeeds (#6028) Evidence for this change
    • createSupplyChainSyncApprovalGate() without auto-retry now uses the headline "Approve supply-chain intel sync" and shows only the "Sync intel" step. The chained sync-then-audit gate keeps its audit headline and both…
    • isStandaloneSyncRecoveryGate() tells the modal which case it is in, so the dialog label and kicker match.
    • runRecoverySync closes the modal after a standalone sync succeeds.
  • runtimeAsk the classifier for the contained peel instead of peeling it twice (#6002) Evidence for this change
  • dashboardExplain extension policy save failures instead of printing daemon codes (#6019) Evidence for this change
  • extensionsStop a failed policy save from blocking every later save (#6015) Evidence for this change
  • nativeRead logged launches, rooted find -exec and looped inline programs as review (#6007) Evidence for this change
    • Logged background launch. node server.js > /tmp/x.log 2>&1 & ... carried the redirect reason, not the background reason, so the launch had no segments and its script read as a file nobody opened. A launch whose…
    • find -exec under a quoted home root. find "$HOME/Downloads/x" -type f -exec basename {} \; was refused for containing $. A $ is now accepted only when it opens a double-quoted parameter followed by /, so…
    • Inline program in a loop. for f in ...; do [ -f "$f" ] && node -e '...' "$f"; done read the node -e launch as an interpreter running an unread file. Each launch in a list or loop is now read on its own (split…
  • commandRead a package directory flag the same way for every verb (#6003) Evidence for this change
  • connectKeep polling for device approval when one request goes unanswered (#6005) Evidence for this change
    • A poll that times out, or fails with a refused or reset connection (directly or wrapped in URLError), doubles the polling interval up to 60 seconds and polls again.
    • Once the device code deadline passes, it stops with a message that says Guard Cloud did not answer and how to request a new code.
    • Other URLError causes, such as certificate failures, and managed-network policy blocks (ManagedNetworkError) still fail immediately.
  • releaseShip a Linux ARM64 native wheel on the GitHub release (#6009) Evidence for this change
    • Build: a manylinux_2_17_aarch64 wheel around the static aarch64-unknown-linux-musl runtime, compiled on the ubuntu-24.04-arm runner by the existing single-wheel workflow. The full-task Gauntlet runtime…
    • Release only: the platform joins GITHUB_ONLY_PLATFORM_TAGS, so PyPI staging leaves it out. The pure wheel's native-wheels.json lists its digest along with every other platform wheel.
    • Update path: hol-guard update on a pure-wheel Linux ARM64 install downloads that wheel from the v release and checks it against the embedded digest manifest, the same check Windows ARM64 gets. Doctor…
  • packageBlock bundle-flagged Copilot and exec-flow packages before review (#6004) Evidence for this change
    • Copilot sends its command in toolArgs. The daemon's package check only read tool_input.command, so it never evaluated the command.
  • updatePoint native Windows ARM64 Python at x64 Python (#6006) Evidence for this change
    • hol-guard update on a win-arm64 interpreter (sysconfig.get_platform()) that fails while building cryptography or rfc3161-client now stops with status blocked and reason…
    • The message gives the reinstall command for the active installer (pipx install --force --python " " hol-guard, the uv tool install equivalent, or that interpreter's pip) and the check that the…
    • Guard lists installed x64 interpreters from py -0p, skipping -arm64 and -32 tags, and asks each one for its own platform before labeling it x64. If none is found, the message points at the 64-bit python.org…
  • commandWalk a project's own skills tree without review (#5994) Evidence for this change
  • claudeStore a tool-call permission notice with its credentials masked (#6001) Evidence for this change
    • hook_authority_state_op/flows.rs: claude_record_notice masks command and raw_command_text on tool_call notices with redacted_command_tokens::redact_text before signing. The notice and pending rows are one…
    • The direct hook lane (hook_direct_review_notice.rs) and the daemon's fallback writer (_record_claude_permission_notice) both store through this op, so there is one masking point and no Python change.
    • Other artifact types are stored as sent. A tool_action_request command feeds the saved policy's exact-match context (hook_decision_native_permission_persist.rs), and masking it would change that hash.
  • commandRefuse a contained run that hands the shell a directory search path (#5996) Evidence for this change
  • storeMask credentials in queued tool-call commands (#6000) Evidence for this change
    • ApprovalRequest::decode masks credentials in a tool_call row's launch_target and raw_command_text with guard_command::redacted_command_tokens::redact_text, the redaction the generic queue builder already…
    • Both queue writers decode through this function: the resident hook writer (add_native_review_approval_request) and the general add_approval_request path that the daemon uses. One change covers both.
    • native_bash_request and tool_action_request rows are left alone, because their scope and exact-match checks re-parse the stored command.
  • guardSay when a workspace has no dependency files to check (#5989) Evidence for this change
    • normalizeAssessment exposes dependencyFilesFound, false when detectors.supply_chain is no_inputs.
    • The empty findings copy for such a workspace becomes "No dependency files were found, so there were no dependencies to check.", followed by the secret result when the secret detector ran.
    • Workspaces with dependency files keep the existing copy.
  • guardReport dependency files below audit discovery as unchecked (#5986) Evidence for this change
    • The Rust snapshot walk flags any manifest or lockfile deeper than the audit's discovery depth and marks the snapshot partial with the undiscovered_dependency_input reason. The discovery depth is now shared from…
    • The dashboard coverage panel explains the new reason in plain language.
    • Fix verification treats the new reason like the existing unsupported-lockfile reason: the snapshot is still readable, so verification does not fail on it.

Other changes

25

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: v3.57.0

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Evidence ledger0 credits

No credits are published for this release yet.