holt 0.4.6

Holt 0.4.6 — resumable cleanup and bounded analysis

Install the signed, version-pinned GitHub release artifact:

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.4.6/holt.tgz

The bare holt npm registry name is not an official distribution. Do not use
npm install -g holt; use the exact GitHub release URL above.

This safety release makes path discard a durable, per-path transaction. An interruption or a
concurrent replacement no longer strands every completed quarantine: use holt recover-discard
to inventory/resume it, or the new holt_discard MCP action from an agent. It also batches discard
Git plumbing, bounds symbol and partition memory/output, refuses taskless partition allocation,
prevents a dirty directional duplicate from disappearing from the landing plan, and adds a private
holt base set <ref> authority for repositories whose real landing branch is not the conventional
default. The published lock graph also upgrades the vulnerable fast-uri and qs transitive
versions reported by the release audit and pins the action's zod input so reviewed test-only
dependencies cannot make the committed action bundle stale.

For supported structured-tool hook hosts, Holt now accepts explicit, exact contracts for named
local and MCP tools. A configured contract lets Holt assess declared file targets using its normal
path safeguards; an unknown Codex structured tool is denied by default. A deliberately configured
audit policy leaves a visible, journalled boundary instead of pretending an arbitrary tool schema
was understood.

The capture remains ordinary local Git object data under refs/holt/*; extended attributes and
ACLs are not represented by Git, host approval still governs non-read-only MCP calls, and no local
tool can promise zero risk against arbitrary external filesystem writers. The published dependency
graph pins the action's transitive zod input so adding the reviewed browser-proof dependency
cannot make the committed action bundle stale. This release does not
claim customer adoption, productivity gains, universal host enforcement, or a commercial service.

Verify this exact artifact

After downloading holt.tgz and the release assets:

gh release verify v0.4.6 --repo Raed2180416/holt
gh release verify-asset v0.4.6 holt.tgz --repo Raed2180416/holt
gh attestation verify holt.tgz --repo Raed2180416/holt
holt audit --require-signature

Each command verifies a different boundary. Do not infer provenance if the attestation query does
not succeed.

---

Holt is part of Contrare Research. Product and research queries:
research.contrare@outlook.com.