Guard 3.0.146 is a stable release cut from 5660794.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.145.

Features

• extensions: Publish command operations and catalog default floors (#2868)
  • Public extension directory entries now include matcher-derived operations: the commands each rule covers, severity, detector mode, catalog default floor, documented safe variants, and the governing permission ID.
  • Catalog default floors are the shipped baseline (allow, warn, review, require-reapproval, sandbox-required, block). They are not workspace activation, enablement, or a safety rating.
  • Directory consumers should accept the new operations field. Coverage counts and native identity are unchanged.

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.146"

Full changelog: v3.0.145...v3.0.146

Thanks @kantorcodes!

Guard 3.0.145 is a stable release cut from a8538e4.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.144.

Documentation

• Add k0s and k0rdent Guard demo (#2867)

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.145"

Full changelog: v3.0.144...v3.0.145

Thanks @kantorcodes!

Guard 3.0.144 is a stable release cut from 829b607.
2 commits • 1 contributor since Guard 3.0.143.

Fixes

• release: Retry registry version lookups (829b607)

Internal

• Fix frozen Windows daemon launch and native runtime cleanup (09a2445)

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.144"

Full changelog: v3.0.143...v3.0.144

Thanks Michael Kantor!

Guard 3.0.143 is a stable release cut from c28b245.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.142.

Fixes

• guard: Bind catalog identity to matcher semantics (#2857)
  • Include complete matcher configuration and rule-family semantics in the built-in catalog identity.
  • Preserve authenticated legacy catalog manifests while failing closed on same-identity manifest conflicts and migrating changed catalogs.
  • Include the remote execution contribution in the wheel so source and installed catalog identities remain aligned.

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.143"

Full changelog: v3.0.142...v3.0.143

Thanks @kantorcodes!

Guard 3.0.142 is a stable release cut from f440ae1.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.141.

Fixes

• scanner: Allow patch-only DeepSeek Harness bundles (#2864)
  • Honor dsh.bundle.mode set to "patch" so patch-only DeepSeek Harness bundles are not required to export Cordis apply(ctx).
  • Keep DSH_RUNTIME_APPLY_MISSING when a package declares main or exports.

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.142"

Full changelog: v3.0.141...v3.0.142

Thanks @kantorcodes!

Guard 3.0.141 is a stable release cut from 4084f34.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.140.

Fixes

• cloud: Restore bundled TLS trust and connection error layout (#2861)
  • Load bundled public CA roots for ordinary HTTPS requests while preserving platform roots and explicit CA overrides. Authenticated requests still reject redirects and all requests retain certificate and hostname…
  • Keep Cloud connection failures within the action layout, explain certificate failures plainly, and offer a clear retry action.
  • Include rebuilt dashboard assets and regression coverage for empty default trust stores and responsive error states.

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.141"

Full changelog: v3.0.140...v3.0.141

Thanks @kantorcodes!

Guard 3.0.140 is a stable release cut from 3efdcb2.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.139.

Features

• extensions: Notify accepted publishers after merge (#2863)
  • add a merge-only Extension Claim Notice workflow with manual PR backfill
  • derive claim eligibility only from reviewed numeric maintainerGithubIds on canonical main
  • notify all accepted IDs for a new native contribution and only newly accepted IDs for later listing changes

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.140"

Full changelog: v3.0.139...v3.0.140

Thanks @kantorcodes!

Guard 3.0.139 is a stable release cut from 37df244.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.138.

Fixes

• dashboard: Submit repair MFA from the authenticator field (#2860)
  • Make the repair-extensions approval dialog a real form so Enter on the authenticator field submits the confirm action.
  • Label the authenticator field, keep Cancel as a non-submit control, and trap keyboard focus in the dialog.

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.139"

Full changelog: v3.0.138...v3.0.139

Thanks @kantorcodes!

Guard 3.0.138 is a stable release cut from 61c5135.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.137.

Fixes

• evidence: Retain native decisions and correlate harness execution (#2859)
  • Record final native pre-tool decisions in the asynchronous activity journal without rerunning policy evaluation.
  • Correlate Grok and ZCode execution events using native request identifiers.
  • Distinguish unavailable rule evidence from a recorded no-match result, and prevent pre-tool events from claiming execution.

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.138"

Full changelog: v3.0.137...v3.0.138

Thanks @kantorcodes!

Guard 3.0.137 is a stable release cut from 5be95f1.
1 commit • 1 merged pull request • 1 contributor since Guard 3.0.136.

Fixes

• guard: Refresh catalog fingerprints without fail-safe (#2858)
  • Keep local protection when a trusted catalog update changes contract fingerprints without changing the catalog digest
  • Rebind or retire local controls against the new trusted fingerprints, then replace the stored catalog manifest
  • Keep fail-closed behavior when a stored catalog manifest cannot be verified

Install

Install this release:

uv tool install "hol-guard[cisco]==3.0.137"

Full changelog: v3.0.136...v3.0.137

Thanks @kantorcodes!