Non-coverage contract
What HOL Guard does not claim to cover
Guard coverage is harness-, version-, and event-specific. This page makes fail-open behavior and observable blind spots first-class public facts instead of allowing “supported” to imply universal protection.
Global coverage boundaries
Category non-claims
- traditional endpoint antivirus
- universal model-level prompt-injection filter
- replacement for SCA or dependency scanning
- support for every action in every harness
Channel limitations
- stable: Coverage is harness- and event-specific.
- stable: Scanning and runtime interception are separate controls.
- stable: Guard does not claim universal model-level prompt filtering.
- alpha: Alpha capabilities must be labeled alpha on public pages.
- alpha: Coverage is harness- and event-specific.
- alpha: Guard does not claim universal model-level prompt filtering.
Fail-open, crash, timeout, and blind-spot facts
These facts are derived from the same commit-pinned support contract used by the coverage table.
| Channel | Harness | Fail behavior | Known boundary | Evidence |
|---|---|---|---|---|
| stable | Codex | surface specific | Inline file edits applied directly by the model without a tool call are not visible to Guard. | source commit |
| stable | Claude Code | surface specific | Background agent sessions that run without an active terminal do not surface hook events to Guard. | source commit |
| stable | OpenCode | surface specific | Prompt content is not currently surfaced through hooks. | source commit |
| stable | OpenCode | surface specific | File read/write events bypass Guard unless OpenCode permission rules block them. | source commit |
| stable | GitHub Copilot CLI | surface specific | MCP tool calls routed through the VS Code extension are not visible to the CLI-level Guard hook. | source commit |
| stable | Cursor | surface specific | Shell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session. | source commit |
| stable | Cursor | surface specific | Prompt submission is not surfaced through native Cursor hooks. | source commit |
| stable | Cline | surface specific | Native Cline PostToolUse hooks are observation-only; full output mediation requires the Guard-managed Cline plugin transport. | source commit |
| stable | Cline | surface specific | JetBrains protection is reported as unverified until a live pre-tool deny proof is observed. | source commit |
| stable | Gemini CLI | surface specific | Prompt submission events and file read/write operations are not currently observable through the Gemini hook surface. | source commit |
| stable | Hermes | surface specific | Hermes desktop and ACP entry paths may not register shell hooks; CLI and gateway honor hooks.pre_tool_call. | source commit |
| stable | OpenClaw | surface specific | Shell commands and prompt events are not currently observable. | source commit |
| stable | OpenClaw | surface specific | Guard only intercepts MCP tool calls via the proxy layer. | source commit |
| stable | Antigravity | surface specific | Shell commands are not currently observable through the Antigravity hook surface; Guard intercepts extensions and MCP registrations via scan at launch time. | source commit |
| stable | Kimi Code | fail open | The pinned support contract marks this adapter fail-open; a hook failure must not be described as fail-closed protection. | source commit |
| stable | Kimi Code | fail open | Tool output post-processing and inline edits applied without a tool call are not visible to Guard. | source commit |
| stable | Kimi Code | fail open | Hooks run in parallel, so separate requests may be reviewed concurrently. | source commit |
| stable | Grok Build | fail open | The pinned support contract marks this adapter fail-open; a hook failure must not be described as fail-closed protection. | source commit |
| stable | Grok Build | fail open | Grok UserPromptSubmit hooks are observe-only, so prompt screening cannot block the model from seeing the prompt. | source commit |
| stable | Grok Build | fail open | Enforcement is the catch-all PreToolUse hook, including subagent and MCP tools. | source commit |
| stable | Grok Build | fail open | --always-approve and bypassPermissions weaken Grok's own prompt policy, but the Guard hook still returns a native deny when policy blocks a tool call. | source commit |
| stable | Pi | surface specific | Package install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension. | source commit |
| stable | Oh My Pi | surface specific | Package install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension. | source commit |
| stable | ZCode | fail open | The pinned support contract marks this adapter fail-open; a hook failure must not be described as fail-closed protection. | source commit |
| stable | ZCode | fail open | Inline edits applied directly by the model without a tool call are not visible to Guard. | source commit |
| stable | ZCode | fail open | Background sessions that run without an active terminal do not surface hook events. | source commit |
| alpha | Codex | surface specific | Inline file edits applied directly by the model without a tool call are not visible to Guard. | source commit |
| alpha | Claude Code | surface specific | Background agent sessions that run without an active terminal do not surface hook events to Guard. | source commit |
| alpha | OpenCode | surface specific | Prompt content is not currently surfaced through hooks. | source commit |
| alpha | OpenCode | surface specific | File read/write events bypass Guard unless OpenCode permission rules block them. | source commit |
| alpha | GitHub Copilot CLI | surface specific | MCP tool calls routed through the VS Code extension are not visible to the CLI-level Guard hook. | source commit |
| alpha | Cursor | surface specific | Shell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session. | source commit |
| alpha | Cursor | surface specific | Prompt submission is not surfaced through native Cursor hooks. | source commit |
| alpha | Cline | surface specific | Native Cline PostToolUse hooks are observation-only; full output mediation requires the Guard-managed Cline plugin transport. | source commit |
| alpha | Cline | surface specific | JetBrains protection is reported as unverified until a live pre-tool deny proof is observed. | source commit |
| alpha | Gemini CLI | surface specific | Prompt submission events and file read/write operations are not currently observable through the Gemini hook surface. | source commit |
| alpha | Hermes | surface specific | Hermes is an early-access harness; some event surface coverage depends on the Hermes version installed. | source commit |
| alpha | OpenClaw | surface specific | Shell commands and prompt events are not currently observable. | source commit |
| alpha | OpenClaw | surface specific | Guard only intercepts MCP tool calls via the proxy layer. | source commit |
| alpha | Antigravity | surface specific | Shell commands are not currently observable through the Antigravity hook surface; Guard intercepts extensions and MCP registrations via scan at launch time. | source commit |
| alpha | Kimi Code | fail open | The pinned support contract marks this adapter fail-open; a hook failure must not be described as fail-closed protection. | source commit |
| alpha | Kimi Code | fail open | Tool output post-processing and inline edits applied without a tool call are not visible to Guard. | source commit |
| alpha | Kimi Code | fail open | Hooks run in parallel, so separate requests may be reviewed concurrently. | source commit |
| alpha | Grok Build | fail open | The pinned support contract marks this adapter fail-open; a hook failure must not be described as fail-closed protection. | source commit |
| alpha | Grok Build | fail open | Grok UserPromptSubmit hooks are observe-only, so prompt screening cannot block the model from seeing the prompt. | source commit |
| alpha | Grok Build | fail open | Enforcement is the catch-all PreToolUse hook, including subagent and MCP tools. | source commit |
| alpha | Grok Build | fail open | --always-approve and bypassPermissions weaken Grok's own prompt policy, but the Guard hook still returns a native deny when policy blocks a tool call. | source commit |
| alpha | Pi | surface specific | Package install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension. | source commit |
| alpha | Oh My Pi | surface specific | Package install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension. | source commit |
| alpha | ZCode | fail open | The pinned support contract marks this adapter fail-open; a hook failure must not be described as fail-closed protection. | source commit |
| alpha | ZCode | fail open | Inline edits applied directly by the model without a tool call are not visible to Guard. | source commit |
| alpha | ZCode | fail open | Background sessions that run without an active terminal do not surface hook events. | source commit |
How to interpret a gap
A partial or unsupported surface means the public evidence does not justify describing that action as protected. It does not mean the harness is unsafe, and it does not mean another control cannot cover the gap. Coverage changes must update the commit-pinned support manifest before this page or comparison content can claim the new behavior.