ShieldCortex 5.6.0: Plain-English Approval Cards, Maintenance Before Dream Mode, Safe --help

ShieldCortex 5.6.0 was released on 10 October 2026. It is a minor release on 5.5.0. The supported Node range (^22.14.0 || >=24.0.0: 22.14 or later within 22.x, or 24 and newer; not 23) is unchanged. Action Guard stays off by default: every Action Guard change below applies only where you have turned the guard on.

Three changes are worth calling out, followed by the caveats that come with them. The changelog has the short list.

Approval cards in plain English

When an action is held for approval, the card sent to the owner used to show a values-free alert surface: a redacted action and a rule name. In 5.6.0, cards from the Claude Code hook through the OpenClaw approval channel, and from the OpenClaw plugin's typed approval, say three things instead:

• What the action does — a verb and its target, such as a path, host, process, package or service. Never the raw command.
• Why it was held — one phrase per guard signal.
• Who asked — the runtime, a short host name and a session reference. The raw OpenClaw session key is never shown.

The summary is bounded and redacted; it is not a guarantee that every secret is detected. A target is withheld whole, never partly masked, for example when it is empty, is over the length cap, contains unusual characters, is changed by the credential redactor or matches the generic secret shapes. A secret in any other shape is not guaranteed to be caught. When no safe summary can be built, the card says so.

The cards change text, not decisions: no allow, ask or deny outcome changes because of them. Notify webhooks and denials.jsonl stay values-free and unchanged from 5.5.0. One visible difference: the OpenClaw plugin's typed approval now reports severity warning whenever it carries a plain-English card, where before severity came from risk words in the message.

Memory maintenance before Dream Mode

shieldcortex consolidate used to run only Dream Mode, so it never touched short-term memory, even though doctor's short-term memory row told you to run it. It now runs a memory maintenance phase first and prints what it did before the Dream Mode summary.

That phase can remove memories, both short-term and long-term. It promotes worthy short-term memories, expires decayed ones, evicts short-term memories over your configured short-term limit, evicts long-term memories when that store is over its configured limit, and resolves identical long-term pairs.

Cap eviction never takes memories captured in the last hour or pinned memories. That exclusion belongs to cap eviction only. Expiry and duplicate resolution follow their own rules. The printed summary counts promotions, expiries, evictions and duplicate pairs, not every row the pass touches.

Doctor's short-term and long-term memory rows now follow your configured limits instead of hardcoded numbers, and the short-term row warns only when short-term memory is over its limit. Because of that, doctor --strict can return a different exit code for the same store than it did on 5.5.0. If anything gates on that exit code, expect it to move.

--help does nothing but help

In earlier versions, install --help went straight into the Claude Code install and wrote its files, doctor --help ran every check, and setup --help exited with an error. In 5.6.0 all three print their own usage and exit before any installer or doctor module is loaded, whatever order the help and other flags come in. Runs without a help flag are routed as before.

Action Guard changes, and their limits

Where the guard is on, some decisions change:

• Teardown commands ask first. SQL DROP, TRUNCATE or an unscoped DELETE through a database client, Terraform or OpenTofu destroy, Kubernetes namespace, volume and node deletes, Helm uninstalls and cloud group or account teardown used to be allowed and now need approval.
• Script files follow recognised nested calls. A script file that runs another file is followed into it when the guard recognises the call, so a call that was allowed only because the payload sat in a second file can now be denied. That is not a promise that every way of running a second file is recognised.
• Interpreter heredocs are unchanged from 5.5.0. A planned relief for heredoc programs that only read data was withdrawn before release. Interpreter heredocs are scanned and folded exactly as in 5.5.0, including the known false positive: a heredoc program that reads a data file containing prose about dangerous commands can still be denied on that file.
• Files at recognised sensitive paths are not read into the scan. The guard compares each nested path, as spelled, against the same set of sensitive path spellings its sensitive-path rule uses, such as SSH key locations, cloud credential files, system account files and env files. A match is never read: it is asked about on its path and is never auto-allowed. This is a spelling check, not file identity. A path that reaches the same file through an alias, a symlink, a variable, or another spelling such as .., ./ or a doubled slash is outside that coverage.
• "Look at" in written source is prose, not a scheduler call. Writing source with a phrase like "Look at the findings" no longer reads as a scheduler change. Real at and crontab calls still ask. This fix covers the in-process guard only; the outage fallbacks are unchanged.

Also in 5.6.0

The local dashboard gets phase A of its redesign: a five-item nav (Home, Needs you, Memory, Protection, Settings), a Needs you page, plain-word labels and a dark theme by default. Old page URLs redirect to the nearest kept page. The read-only approval card component is not yet mounted on a page, and dashboard tests do not yet run in CI. shieldcortex/defence also exports the approval-card builders.

Read the changelog →

Full 5.6.0 release notes on GitHub →

Built by Drakon Systems.