holt 0.4.7

Holt 0.4.7: keep active sessions and source work safe

Install the signed, version-pinned GitHub release artifact:

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.4.7/holt.tgz

The bare holt npm registry name is not an official distribution. Do not use
npm install -g holt; use the exact GitHub release URL above.

A clean worktree can still be in use. Sessions can now claim ownership before editing, renew it
while working, hand it off, and release it when finished with the workspace:

holt ownership claim my-worktree --owner session-123
holt ownership heartbeat my-worktree --owner session-123
holt ownership release my-worktree --owner session-123

Gate and clean retain claimed worktrees; landing plans defer them. Context, agent briefings, MCP,
the TUI, and the graph show the same ownership evidence. Expiry requires owner release or an
explicit reviewed takeover. An interrupted internal operation releases its mutex while preserving
the session claim. This coordinates participating sessions locally; it does not detect arbitrary
running agents. See the ownership guide.

When a worktree contains only a manifest-backed ignored dependency install, Holt now reports that
as generated residue instead of allowing it to crowd out actual source work in holt status,
holt risk, or the MCP summary. It is an explanation, never a cleanup permission: an install can
contain local patches or data, so the worktree remains non-disposable. Mixed, unexplained, and
secret-bearing ignored paths remain ordinary work at risk.

The README also puts the disposable first-look example before the own-repository check, and the
website provides a direct GitHub entry point for source, releases, and feedback.

This release does not claim customer adoption, productivity gains, universal host enforcement, or
zero filesystem risk. Holt's cleanup decisions still require the relevant evidence and explicit
authority.

Verify this exact artifact

After downloading holt.tgz and the release assets:

gh release verify v0.4.7 --repo Raed2180416/holt
gh release verify-asset v0.4.7 holt.tgz --repo Raed2180416/holt
gh attestation verify holt.tgz --repo Raed2180416/holt
holt audit --require-signature

Each command verifies a different boundary. Do not infer provenance if the attestation query does
not succeed.

---

Holt is part of Contrare Research. Product and research queries:
research.contrare@outlook.com.

holt 0.4.6

Holt 0.4.6 — resumable cleanup and bounded analysis

Install the signed, version-pinned GitHub release artifact:

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.4.6/holt.tgz

The bare holt npm registry name is not an official distribution. Do not use
npm install -g holt; use the exact GitHub release URL above.

This safety release makes path discard a durable, per-path transaction. An interruption or a
concurrent replacement no longer strands every completed quarantine: use holt recover-discard
to inventory/resume it, or the new holt_discard MCP action from an agent. It also batches discard
Git plumbing, bounds symbol and partition memory/output, refuses taskless partition allocation,
prevents a dirty directional duplicate from disappearing from the landing plan, and adds a private
holt base set <ref> authority for repositories whose real landing branch is not the conventional
default. The published lock graph also upgrades the vulnerable fast-uri and qs transitive
versions reported by the release audit and pins the action's zod input so reviewed test-only
dependencies cannot make the committed action bundle stale.

For supported structured-tool hook hosts, Holt now accepts explicit, exact contracts for named
local and MCP tools. A configured contract lets Holt assess declared file targets using its normal
path safeguards; an unknown Codex structured tool is denied by default. A deliberately configured
audit policy leaves a visible, journalled boundary instead of pretending an arbitrary tool schema
was understood.

The capture remains ordinary local Git object data under refs/holt/*; extended attributes and
ACLs are not represented by Git, host approval still governs non-read-only MCP calls, and no local
tool can promise zero risk against arbitrary external filesystem writers. The published dependency
graph pins the action's transitive zod input so adding the reviewed browser-proof dependency
cannot make the committed action bundle stale. This release does not
claim customer adoption, productivity gains, universal host enforcement, or a commercial service.

Verify this exact artifact

After downloading holt.tgz and the release assets:

gh release verify v0.4.6 --repo Raed2180416/holt
gh release verify-asset v0.4.6 holt.tgz --repo Raed2180416/holt
gh attestation verify holt.tgz --repo Raed2180416/holt
holt audit --require-signature

Each command verifies a different boundary. Do not infer provenance if the attestation query does
not succeed.

---

Holt is part of Contrare Research. Product and research queries:
research.contrare@outlook.com.

holt 0.4.5

holt 0.4.5 — cross-platform installed proof

Install the signed, version-pinned GitHub release artifact:

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.4.5/holt.tgz

The bare holt npm registry name is not an official distribution. Do not use
npm install -g holt; use the exact GitHub release URL.

This patch makes the installed-artifact smoke repository line-ending invariant before its first
commit. A Windows host-global Git policy can no longer make the deliberately empty worktree look
modified. The 0.4.4 retained-proof release gate remains in force; this is a cross-platform proof
correction, not evidence of customer adoption, productivity gains, universal host enforcement, or
a commercial service.

Verify this exact artifact

After downloading holt.tgz and the release assets:

gh release verify v0.4.5 --repo Raed2180416/holt
gh release verify-asset v0.4.5 holt.tgz --repo Raed2180416/holt
gh attestation verify holt.tgz --repo Raed2180416/holt
holt audit --require-signature

Each command verifies a different boundary. Do not infer provenance if the attestation query does
not succeed.

For the full change ledger and remaining gaps, see the
post-v0.3.1 55-commit audit.

---

Holt is part of Contrare Research. Product and research queries:
research.contrare@outlook.com.

holt 0.3.1

holt 0.3.1 — safety and correctness fixes

Safety and correctness fixes across the guard, integration, and analysis paths. If you are
running 0.3.0, upgrade.

Install

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.3.1/holt.tgz

One command — no clone, no build. This signed artifact was built from the immutable v0.3.1 tag,
package-audited, checksum-verified and installed on the Ubuntu Node 24 release runner before
publication. The public benchmark and broader platform matrix remain available for independent
evaluation and future release cycles. holt.tgz is a stable name, so this URL keeps working; the
versioned holt-0.3.1.tgz is attached alongside it.

The bare holt npm registry name is not an official distribution. Do not use
npm install -g holt, even if a package later appears there; use the exact GitHub release URL.

Guard fixes

• The hooks holt integrate installs disarmed the guard. For Claude Code, integrate wires the
  blocking guard and the brief. Both used one report cache keyed only on the repository root, so
  the brief's analysis — computed without your own worktree — was served to the guard as though it
  were the guard's own. Cold cache: git clean -fd was refused, naming the symbol at risk. Run the
  brief hook first, and the
  identical command was allowed. Same for git reset --hard, git checkout -- . and
  git stash push -u.
• A space in your path turned the guard off. Eight of nine destructive forms flipped from
  refuse to allow. C:\Users\First Last\project and ~/My Drive/project are ordinary paths.
• A newline in a worktree name turned it off too — and holt risk named that worktree as
  holding work found nowhere else in the same breath.
• rm -rf <repository root> was allowed. Correct by the guard's own rule, since a clean tree
  holds no sole copy — and .git is inside that path, so it takes every commit, branch, reflog,
  stash and rescue ref with it. git worktree remove refuses the main working tree; rm does not.
• The hook could stall every tool call for as long as the host held stdin open. It now reads the
  bounded hook payload and returns without waiting for an unrelated end-of-stream signal.

Integration ownership fixes

• holt integrate deleted third-party hooks. A fixture with seven foreign PreToolUse entries
  came back with one. A corporate guardrail was claimed because its command contained --host; an
  npm package because its name contained holt; a script because the username in its path did.
• holt uninstall deleted config files in repositories holt had never been installed into —
  all sixteen project MCP targets, each printing "Only holt's own entries were touched".
• A legal JSONC trailing comma cost a team both of their MCP servers. .mcp.json is JSONC;
  holt read it with a parser that was not. The read failed, the failure was recorded as "no file",
  and integrate then created the file it had just failed to read.
• A hand-written .git/hooks/pre-commit was deleted for mentioning holt in a comment.
• holt integrate --dry-run wrote 21 files. It is now a real preview.

Ownership is now argv-shaped — the program being executed must actually be holt — and a config
holt cannot parse is left byte-for-byte alone rather than replaced.

Correctness

• A repository with one worktree reported zero risk while holding real risk. Reported from the
  field: holt risk said scanned 0/0, nothing at risk while the tree held 24 uncommitted changes
  and 9 symbols that existed nowhere else. The primary worktree is now scanned when it is the only
  one. It is still never a deletion candidate.
• Duplicate detection reported false positives without ctags — a function's "declared body" was
  its signature line alone, so any two functions sharing a name and an arity compared as identical.
• holt auto announced a lock git had already refused, and holt protect exited 0 having
  failed. Both now tell the truth, and an action that failed exits non-zero.
• holt discard printed no ref while telling you the content was "recoverable from the ref
  above". It now prints the ref, the commit and the exact restore command.
• holt refused ordinary commands whose arguments came from shell substitutions. Over-refusal is
  a defect: a refusal you cannot act on teaches you to ignore the next one.

Test and supply-chain integrity

• A source-stripping bug meant substantial product code never reached the no-telemetry and
  path-comparison gates. The no-telemetry guarantee survived the widened scan; it was
  under-verified, not false.
• The static-analysis ratchet wrote a zero and passed when the type checker could not run, and
  its config meant nothing was really being type-checked. The ratchet now fails when the checker
  fails and proves it inspected real product code.
• Both benchmark harnesses reported "correct" for runs that graded nothing. §1's headline
  result included ungraded verdicts and a summary line that divided the planted count by itself.
  The validators now refuse missing denominators and ungraded rows instead of turning unknowns into
  success.

Evidence status

The benchmark methods and validation rules are documented in
BENCHMARKS.md. This release body does
not publish a performance rate or agent-utility lift until the exact release artifact has a retained,
checksum-bearing result that the release can link directly.

Coverage guide

Host coverage is graded rather than implied. Contract-tested integrations are separated from live
host runs, and a host is not described as blocking until its real allow, deny and failure paths have
been driven. HOSTS.md records the current
level for each host from the generated manifest.

---

Holt is part of Contrare Research. Product and research queries:
research.contrare@outlook.com.

holt 0.3.0

holt 0.3.0 — measured, and fixed where the measurement hurt

Know what your agents made, and don't lose any of it. You ran a dozen agents overnight; holt
tells you what each worktree actually produced, which ones collide, which are safe to delete, and
it stops an agent deleting work that exists nowhere else.

0.2.0 could act. 0.3.0 is the first release that has been scored — against an oracle proven to
share no code with holt — and then fixed where the score was bad.

Install

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.3.0/holt.tgz

One command — no clone, no build. This release is built, installed and driven against a real
repository on Linux, macOS and Windows by CI before the file is attached, and the same smoke
test now runs on every commit rather than only at release time. holt.tgz is a stable name, so
this URL keeps working; the versioned holt-0.3.0.tgz is attached alongside it.

holt is not on the npm registry yet — npm install -g holt 404s — so this URL is the install.

Then, in any repository with worktrees:

holt integrate       # wire every agent you use — the whole setup
holt auto            # locks what would be lost; tells you what needs a decision

Measured for the first time

50 languages, 900 worktrees, 18,000 labelled claims, scored against an independent oracle that
shares no code with holt — the independence is proven, not asserted, by a static import-graph
walk, a runtime module-resolution hook, and a probe that proves the hook actually fires
(independence-check.mjs; full detail and reproduction command in BENCHMARKS.md §9):

question	precision	recall
disposable	1.00	1.00
conflict	1.00	0.96
duplicate	0.75	1.00
refuse	1.00	1.00
unique	1.00	1.00

False "safe to delete": 0 of 900, reproduced across four independent runs. duplicate's
precision and conflict's recall are the two numbers here below 1.00 on purpose — see "Known
limits" below and BENCHMARKS.md §§8–9 for exactly which cases they are and why closing
duplicate further would mean overriding holt's own correct, hand-verified answer.

Recall on disposable was 0.40 when first measured, and that is the headline fix of this
release: holt was refusing 60% of the work it exists to do. Perfect precision at 0.40 recall is not
a safe tool — it is one that answers "I cannot be sure" to most of its own question.

What's new

• holt auto — the autopilot. Does everything that cannot lose data by itself (locks what is
  at risk, releases locks no longer justified) and hands the destructive half over with the
  evidence and the exact command. It never deletes.
• holt discard <path> — the escape hatch. Captures content to a verified ref first, then
  removes it, so the guard stays on and the loss does not. A tracked file is reverted rather than
  deleted. Journalled, with the restore command printed.
• Redundancy-aware disposal — a worktree whose content a living sibling also holds is now
  correctly disposable. clean --apply re-verifies before each removal, so a redundant set drains
  to exactly one survivor; gate refuses it, because the rm -rf a script runs after gate never
  looks again.
• The guard speaks Windows — Remove-Item, rd /s /q, del /f /q, Move-Item,
  Clear-Content and Set-Content are classified exactly as their POSIX equivalents.
• Shell indirection is never a silent allow — $(echo rm), a variable-supplied verb and eval
  return ask; sh -c "…" and node -e "…" are read and given a real verdict.
• Cursor blocks deterministically, and ten hosts that claimed MCP now actually get a config —
  including OpenAI Codex CLI, which needed holt's first TOML writer.
• Static analysis — 20,749 lines shipped with no type checking; now gated by a ratchet that can
  go down and never up.
• A rewritten site with a real light mode and a picture of what you actually get.

Fixed

Seven ways holt could report work as "safe to delete" when it existed nowhere else — each
reproduced end to end with git fsck confirming the loss, each now covered by a test that was
watched failing first: vendor/, logs/ and tmp/ treated as generated; git stash unmodeled;
rescue reporting verified:true for a submodule it captured nothing from; discard following a
symlink into another file's work; and node -e "require('fs').rmSync(…)" silently allowed.

Also: a rename/rename conflict reported as "no collisions"; gitignored .env.local files
manufacturing false HIGH collisions; an O(N²) merge-tree storm; and a ctags argv injection where a
file named -L could leak the contents of files outside the batch.

Known limits

• Very large repositories are slow with symbols on — the Linux kernel takes ~16 minutes.
  --no-symbols is fast and answers a weaker question.
• A duplicate verdict is symbol-identity based: two workstreams that each declare a function with
  the same name can read as duplicates even when their bodies differ. Measured precision is
  0.75 on the benchmark corpus, and every false positive traces to the one case bench50 plants
  on purpose, once per language — the same symbol name and body declared in a second file with
  different surrounding content — which is a real, deliberately unresolvable disagreement between a
  symbol-identity answer and a content-identity oracle, not an unexamined miss (BENCHMARKS.md §8
  has the full breakdown, the fix that did land for a different false-positive class, and why
  this specific number does not move further). holt duplicates --deep adds token-level clone
  detection (jscpd) for the same question asked a different way.
• conflict recall is 0.96 (2 of 50 planted conflict pairs missed) rather than 1.00. Both
  misses are holt collisions --json --all not surfacing a pair git merge-tree says collides;
  which 2 of the 50 repositories miss has moved between scoring runs taken minutes apart during
  active work on this exact code path — reported as an open, moving defect with the specific
  repositories named (BENCHMARKS.md §9), not smoothed into a single number that looks more settled
  than it is.

holt v0.2.0 — know what your agents made, and don't lose any of it

v0.2.0 — Developer Preview

This release continues building the foundation for Holt as the control plane for parallel development and AI agent collaboration.

Holt is an AI-native workspace for understanding and managing parallel development. This release focuses on strengthening the core platform with improved reliability, better repository analysis, and a more robust foundation for future agent capabilities.

What's New

Improved repository and worktree analysis.
Better handling of concurrent operations.
Expanded automated test coverage across core workflows.
Numerous stability improvements and bug fixes throughout the project.

Improvements

Faster and more reliable project indexing.
More deterministic behavior during parallel operations.
Internal architecture refinements to support upcoming graph-based project intelligence features.
General performance and developer experience improvements.
Looking Ahead

Future releases will continue expanding Holt beyond worktree management toward a semantic project graph capable of giving both humans and AI agents a shared understanding of repositories, architecture, tasks, and active development.