holt 0.3.1

holt 0.3.1 — safety and correctness fixes

Safety and correctness fixes across the guard, integration, and analysis paths. If you are
running 0.3.0, upgrade.

Install

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.3.1/holt.tgz

One command — no clone, no build. This signed artifact was built from the immutable v0.3.1 tag,
package-audited, checksum-verified and installed on the Ubuntu Node 24 release runner before
publication. The public benchmark and broader platform matrix remain available for independent
evaluation and future release cycles. holt.tgz is a stable name, so this URL keeps working; the
versioned holt-0.3.1.tgz is attached alongside it.

The bare holt npm registry name is not an official distribution. Do not use
npm install -g holt, even if a package later appears there; use the exact GitHub release URL.

Guard fixes

• The hooks holt integrate installs disarmed the guard. For Claude Code, integrate wires the
  blocking guard and the brief. Both used one report cache keyed only on the repository root, so
  the brief's analysis — computed without your own worktree — was served to the guard as though it
  were the guard's own. Cold cache: git clean -fd was refused, naming the symbol at risk. Run the
  brief hook first, and the
  identical command was allowed. Same for git reset --hard, git checkout -- . and
  git stash push -u.
• A space in your path turned the guard off. Eight of nine destructive forms flipped from
  refuse to allow. C:\Users\First Last\project and ~/My Drive/project are ordinary paths.
• A newline in a worktree name turned it off too — and holt risk named that worktree as
  holding work found nowhere else in the same breath.
• rm -rf <repository root> was allowed. Correct by the guard's own rule, since a clean tree
  holds no sole copy — and .git is inside that path, so it takes every commit, branch, reflog,
  stash and rescue ref with it. git worktree remove refuses the main working tree; rm does not.
• The hook could stall every tool call for as long as the host held stdin open. It now reads the
  bounded hook payload and returns without waiting for an unrelated end-of-stream signal.

Integration ownership fixes

• holt integrate deleted third-party hooks. A fixture with seven foreign PreToolUse entries
  came back with one. A corporate guardrail was claimed because its command contained --host; an
  npm package because its name contained holt; a script because the username in its path did.
• holt uninstall deleted config files in repositories holt had never been installed into —
  all sixteen project MCP targets, each printing "Only holt's own entries were touched".
• A legal JSONC trailing comma cost a team both of their MCP servers. .mcp.json is JSONC;
  holt read it with a parser that was not. The read failed, the failure was recorded as "no file",
  and integrate then created the file it had just failed to read.
• A hand-written .git/hooks/pre-commit was deleted for mentioning holt in a comment.
• holt integrate --dry-run wrote 21 files. It is now a real preview.

Ownership is now argv-shaped — the program being executed must actually be holt — and a config
holt cannot parse is left byte-for-byte alone rather than replaced.

Correctness

• A repository with one worktree reported zero risk while holding real risk. Reported from the
  field: holt risk said scanned 0/0, nothing at risk while the tree held 24 uncommitted changes
  and 9 symbols that existed nowhere else. The primary worktree is now scanned when it is the only
  one. It is still never a deletion candidate.
• Duplicate detection reported false positives without ctags — a function's "declared body" was
  its signature line alone, so any two functions sharing a name and an arity compared as identical.
• holt auto announced a lock git had already refused, and holt protect exited 0 having
  failed. Both now tell the truth, and an action that failed exits non-zero.
• holt discard printed no ref while telling you the content was "recoverable from the ref
  above". It now prints the ref, the commit and the exact restore command.
• holt refused ordinary commands whose arguments came from shell substitutions. Over-refusal is
  a defect: a refusal you cannot act on teaches you to ignore the next one.

Test and supply-chain integrity

• A source-stripping bug meant substantial product code never reached the no-telemetry and
  path-comparison gates. The no-telemetry guarantee survived the widened scan; it was
  under-verified, not false.
• The static-analysis ratchet wrote a zero and passed when the type checker could not run, and
  its config meant nothing was really being type-checked. The ratchet now fails when the checker
  fails and proves it inspected real product code.
• Both benchmark harnesses reported "correct" for runs that graded nothing. §1's headline
  result included ungraded verdicts and a summary line that divided the planted count by itself.
  The validators now refuse missing denominators and ungraded rows instead of turning unknowns into
  success.

Evidence status

The benchmark methods and validation rules are documented in
BENCHMARKS.md. This release body does
not publish a performance rate or agent-utility lift until the exact release artifact has a retained,
checksum-bearing result that the release can link directly.

Coverage guide

Host coverage is graded rather than implied. Contract-tested integrations are separated from live
host runs, and a host is not described as blocking until its real allow, deny and failure paths have
been driven. HOSTS.md records the current
level for each host from the generated manifest.

---

Holt is part of Contrare Research. Product and research queries:
research.contrare@outlook.com.