v3.26.0

Guard 3.26.0 is a stable release cut from 38df288.
14 commits • 12 merged pull requests • 6 contributors since Guard 3.25.2.

Features

• extensions: Add opt-in gog command risk rules (#3594)
• mcp: Add InsumerAPI MCP server contribution (#3597)
• mcp: Support tightening-only native server contributions (#3578)
• extensions: Give command.faf-cli a catalog icon (#3591)

Fixes

• guard: Retain process-query output within the original deadline (f8500d2)
• ci: Prevent healthy coverage shards from timing out (#3608)
  • raise only the coverage matrix job timeout from 5 to 10 minutes
  • keep all 128 shards, tests, deselections, coverage requirements, Sonar policy, and security gates unchanged
• extensions: Unblock contribution friction — bare executable matchers, enumerated staging, no per-MCP tests (#3598)
  • executable.v1 matchers: a missing subcommands array now compiles as an empty path (match every invocation of the executable), which is exactly what the rendered unclassified fallback already emits. Hand-written…
  • stage_guard_cloud_review_artifacts.py: contribution payloads are enumerated by scanning contributions/extensions/ and contributions/mcp-servers/ instead of a hardcoded list every new contribution had to edit.…
  • Extension kit: MCP kits no longer emit a generated test_guard_mcp_<name>_contribution.py module; the shared contribution checks cover metadata and native registration. Removed the existing generated test for…
• ci: Eliminate remaining Sonar reliability findings (#3600)
  • replace Markdown fence and skill-continuation regexes with deterministic physical-line parsing
  • keep transaction rollback/commit semantics while moving all post-yield cleanup under finally
  • replace trailing approval punctuation regex cleanup with bounded string operations
• guard: Recover native residents and prepare Grok prompt hooks (#3577)
• ci: Resolve Sonar reliability regressions (#3587)
  • make skill fence/token/Grok regexes linear and explicit
  • preserve variadic tuple APIs while avoiding inconsistent fixed-tuple return shapes
  • make transaction normal-exit commit work explicit in the context manager else path

Internal

• release: 3.26.0 (38df288)
• extensions: Regenerate contribution artifacts (#3607)
• extensions: Regenerate contribution artifacts (#3603)
• extensions: Regenerate contribution artifacts (#3596)

Install

Install this release:

uv tool install "hol-guard[cisco]==3.26.0"

Full changelog: v3.25.2...v3.26.0

Thanks ZCF, @kantorcodes, @zerocodefast, @douglasborthwick-crypto, @tcballard, @Wolfe-Jam!