3.7.0-rc: schema editor with templates, drag-and-drop reordering & preview, organization entities with role-based management, redesigned policy configurator, bulk DID registration performance & new onboarding

Highlights

• New Schema Editor with form preview toggle, drag-and-drop field reordering, and clear sub-schema nesting #6422
• Schema Templates: reusable schema sets with field-level restrictions, update propagation, and detach support #6504
• New Design for Policy Configurator – block editor controls panel rebuilt to current design system #3532
• Organization entity: first-class organizations with Hedera account, DID, named roles, org-level permissions, member management, and policy assignment – with org-scoped document visibility in sourcing/validation blocks #5802 – community contribution: Xeptagon
• First Steps onboarding drawer for new users, opening by default on first login #6239
• Conditional logic on sub-schema fields #4907
• customLogicBlock bulk DID registration: parallel processing with bounded concurrency – eliminates multi-hour registration times for large device batches #6346 – community contribution: Climission
• Sustainability Atlas v0.1 beta: analytics and exploration layer over Guardian on-chain data – Business Abstraction Layer (128 methodologies, 38 registries harmonized), Methodology Explorer, Credit Lifecycle widget, on-chain provenance graph, real-time event stream integration PR #6413 – community contribution: Xeptagon

Other Enhancements

Schema / Excel

• Cross-schema source validation in documentValidatorBlock #6312
• New field types: Country, Continent, State/Province with cascading dependencies #6381
• Dynamic Calculation Inputs for Multiple Locations #6506
• Inline sub-schemas and consolidated enum tab in Excel schema templates #5584
• Guidance tab in generated Excel schema templates #5587
• Contextual Excel upload validation error messages #5582

Policy authoring

• MathBlock path autocomplete #6326
• Policy comparison value columns now use full available width #3716
• In-app User Guide links on general pages and complex forms #4072
• Dry-Run Mock Data is now opt-in: a "Move to Dry-Run" dialog replaces the forced enable prompt, with a per-policy "don't ask again" option PR #6518
• Request form drafts can now be exported to a local JSON file and restored – portable alternative to server and autosave drafts PR #6353 – _community contribution: Climission_
- Policy Manifest spec – machine-readable metadata contract for the methodology library #6031

Navigation / UI

• Dark mode – theme variables, PrimeNG preset, and user-selectable toggle PR #6212
• Login page modernized: branded gradient banner, Hedera watermark, card-based form PR #6355
• Navigation redesign: design tokens, PrimeIcons, vertical/horizontal layout toggle #6401
• Hedera navigation group: Tokens, Contracts, and Relayer Accounts grouped under "Hedera" #6485
• Feature Flag toggle for future UI features #6254
• Profile page redesigned: identity and settings consolidated into a card layout with copy-to-clipboard for DID and Hedera IDs PR #6234

Platform

• Angular 18 → 21 / PrimeNG 17 → 21 migration #6132
• Node.js 20 → 24 LTS migration #5537
• Yarn Classic → Yarn Berry v4 migration #6184

Developer

• Auto-updating Gitbook API documentation via GitHub Actions #5619
• Scalar API reference replaces Swagger UI at /api-docs: branded, sidebar grouped by tag; /api-docs-json and /api-docs-yaml spec endpoints unchanged #6514
• Policy grid actions API: four endpoints under /policies/:policyId/grids – access role-scoped at the policy engine level #5797 – community contribution: Xeptagon
• Tool import permissions extensible to non-SR users #6282
• Policy schema lazy-loading: on-demand schema loading reduces memory and startup time PR #6489 – community contribution: Climission
• Schema reference in form block data: eliminates tens-of-MB payloads on large schemas PR #6402 – community contribution: Climission
• Improved IPFS policy import error message #6423 – community contribution: Climission
• Dynamic Read API endpoint for policy data: external consumers can query Guardian policy data via dynamic MongoDB filter fields #5796 – community contribution: Xeptagon

Fixed Bugs

• Dry-run with mock data: schema mock recording now runs in-process with batch DB insertion – 5-minute start times on large schema sets now resolve in seconds #6535 / PRs #6536 + #6533
• customLogicBlock JavaScript runtime exceptions now surface to UI #6419 – community contribution: Climission
• customLogicBlock execution errors no longer silently swallowed #6271 – community contribution: Climission
• GridFS write errors no longer silent PR #6487 – community contribution: Climission
• Dry-run IPFS 404 request loop eliminated PR #6411 – community contribution: Climission
• Dry-run virtual user scoped per session PR #6328 – community contribution: Climission
• GridFS connection added to queue-service startup PR #6370 – community contribution: Climission
• Step block unavailable flash fixed PR #6447 – community contribution: Climission
• Policy import no longer silently rebinds sub-schemas by title match #6298
• Page now refreshes after document submission without manual reload #6383
• Default branding applies on load; branding fetch deduplicated; no error toasts on fetch failure #6323
• Schema test data cleared/updated when field type changes #6315
• Navigation menu no longer jumps when opening sub-menus #3117
• Navigation items no longer collapse unexpectedly when clicking another item #6404
• Old UI updated: Tokens > Retirement #5538, Manage Contracts #5506, Policy Comparison (Schemas) #3553
• Stored XSS in branding company name fixed (CVE-2026-22674): company name was rendered via innerHTML; replaced with safe text assignment PR #6190 – community contribution: Climission
• Large policy publish payloads offloaded to GridFS – prevents crash at MongoDB's 16 MB BSON document limit on queue-service PR #6275 – community contribution: Climission
• Unhandled promise rejections no longer crash services – process-level error handlers prevent a stray rejection from terminating guardian-service or api-gateway PR #6314 / PR #6321 – community contribution: Climission
• Migrations serialized across replicas with a Mongo lock – concurrent boot migrations on multi-replica deployments no longer race PR #6340 – community contribution: Climission
• Policy messages fast-fail when policy not loaded – previously waited out the full timeout (up to 5 min) before reporting unavailable PR #6341 – community contribution: Climission
• Pathological VC canonicalization on large GeoJSON geometries fixed – large MultiPolygon fields were taking tens of seconds and causing multi-GB memory spikes; geometry now signed as a @json literal PR #6251 – community contribution: Climission
• Stale SPA after redeploy fixed – index.html now served with no-cache headers so browsers always load the latest build PR #6361 – community contribution: Climission

Config Changes

PR	Change	Action required?
#6186	Volume mount paths corrected to per-service directories	Yes if using custom bind-mounts or host-mounted config directories
#6246	Cache image: Redict → Valkey 8.1	Yes for image allowlists / air-gapped environments
#6347	New CUSTOM_LOGIC_CONCURRENCY env var (default: 10)	No
#6414	8 new LISTENER_* / REST_API_* env vars (commented-out defaults)	No
#6490	Quickstart-build: logger + notification services built from source	No

Breaking Changes

None in this release.

Known Issues & Notes

Policies using sub-schema conditions (#4907) require Guardian ≥ 3.7 on all instances that load them – they are not compatible with earlier versions.

Please report issues via GitHub or send suggestions and feedback to guardian-feedback@hashgraph.com.

View Changes

Compare full changes: 3.6.0...3.7.0-rc