v3.40.0

Guard 3.40.0 is a stable release cut from d038225.
30 commits • 27 merged pull requests • 3 contributors since Guard 3.39.0.

Features

• guard: Decide MCP proxy routing and package composition in the resident (#3930)
• guard: Move guard run authority transforms into the native resident (#3925)
  • detector authority and composition, and folding the detector result into the evaluation
  • per-artifact current-authority binding
  • saved-claim partitioning and trusted request overrides (exact and interactive)
• ci: Add runtime majority-share report (#3924)
  • Python scope comes from a static import-graph closure over the runtime roots listed in docs/guard/contracts/runtime-majority-scope.v1.json: process entry points, hook HTTP/CLI events, the native resident transport…
  • Rust scope is the crate graph linked into hol-guard-runtime. The count drops #[cfg(test)]/#[test] items (brace-matched), cfg predicates that only hold under test (for example all(unix, test)), *_tests.rs…
  • Comments and blank lines never count. Tests, generated code and adapters are reported as separate totals, not mixed into the share.
• guard: Compose command effects in the Rust resident (#3914)
• guard: Decide generic hook payloads in the Rust resident (#3915)
  • guard-contracts/src/hook_decision.rs defines the request and reply.
  • guard-runtime/src/hook_decision_{op,compose,finalize,directive}.rs compose the policy stack, settle local grants and post-claim results, and build the receipt, activity and directive fields.
  • native_hook_decision.py is the transport. It binds request_id and the canonical request_sha256, checks the reply shape, and fails closed when the resident does not answer.
• guard: Compose artifact hook decisions in the Rust resident (#3916)
  • policy_stack composes the action from config, the trusted CLI action, the untrusted payload hint, native floors, package, data-flow and scanner results.
  • tool_grant_apply and grant_settle apply local grants and the native floor.
  • saved_reuse and saved_block_reuse handle saved approval reuse and package block reuse.
• guard: Decide contributed MCP policy in the Rust resident (#3913)
• guard: Build request shell context in the Rust resident (#3909)
• guard: Decide MCP tool-call policy in the Rust resident (#3912)
• guard: Inspect compound git commands in the Rust resident (#3904)
  • New resident op with its contract in guard-contracts. The argument and config logic is split across new compound_git_* modules, each under 500 lines.
  • New Python transport. If the resident is unavailable or the reply does not match the request, the command is denied with a typed native_compound_git_inspection_* reason. There is no Python fallback.
  • Probe subprocesses run with the resident's restricted environment instead of the caller's.
• guard: Evaluate package supply-chain requests in the resident (#3901)
  • Lockfile parsing is complete-or-fail in Rust (lockfile_parse.rs, lockfile_validate.rs). It rejects duplicate keys, enforces size bounds and checks the shape of each format. The incomplete-lockfile gate moves with…
  • is_high_confidence_block in Rust treated any actively exploited package as a high-confidence block. Python also requires critical severity, so Rust now does the same.
  • New transport native_supply_chain_eval.py. native_package_authority.py and local_supply_chain.py lose the code it replaces, about 500 lines of Python in total.
• guard: Rust-owned catalog read model behind authenticated /v2 routes (#3859)
• guard: Classify detector false positives in the Rust resident (#3900)
  • New resident op false_positive_rules (feature false-positive-rules-v1), with its contract in guard-contracts/src/false_positive_rules.rs.
  • guard-command/src/false_positive_rules.rs already held a Rust port, but four of its regexes use lookaround, which the regex crate rejects, so the first call would have panicked. Those four now use fancy-regex. A…
  • Python treats U+001C–U+001F as whitespace in strip, split and splitlines and Rust does not. The port now has matching helpers. The parity vectors caught this.

Fixes

• release: Restore the uv.lock release-please version marker (#3929)
• ci: Set native compiler env in serial lane for decision-diff isolation (#3932)
• ci: Bind the native source compiler in the scheduling-sensitive lane (#3931)
• test: Bind native evidence reports and bound worker memory (c70865d)
• ci: Reduce release API usage and repair Windows compilation (c412d84)
• guard: Evaluate PowerShell type-literal commands instead of blocking them as malformed (#3918)
• release: Raise native wheel size budgets for 3.40.0 growth (#3920)
• release: Publish provenance for extension snapshots (7a71222)
• archive: Bound tar metadata and bind policy passes to the archive digest (#3905)
• runtime: Keep resident test file under the release approval-file limit (#3907)
• scanner: Recognize LICENSE.md and standard license filename variants (#3903)
  • Recognize root-level LICENSE, LICENCE, and COPYING filenames with Markdown, text, and reStructuredText extensions, including lowercase equivalents.
  • Use one shared, explicit filename allowlist in scanner checks and safe autofix so lint --fix never creates a conflicting stub LICENSE when a recognized license already exists.
  • Preserve bounded symlink-safe reads and fail closed for unsafe or unreadable license candidates.
• ci: Raise coverage shard count 192 to 256 (#3911)
• guard: Retain business-policy sources in the Windows vault (#3902)
• ci: Warm native resident for saved_v1; re-isolate flaky bridge daemon tests (#3898)

Performance

• ci: Widen scheduling-sensitive lane to 4 slices (#3919)

Refactoring

• guard: Remove Python helpers replaced by resident ops (#3928)

Internal

• release: 3.40.0 (#3910)

Install

Install this release:

uv tool install "hol-guard[cisco]==3.40.0"

Full changelog: v3.39.0...v3.40.0

Thanks @zerocodefast, ZCF, @kantorcodes!

Package publication and Desktop update availability are separate. Desktop updates are ready when the signed Core assets and update manifests appear below; macOS feed status shows signing and verification progress.