Release v3.3.0

Added

• A hook guards agent-run cratis chronicle commands in Claude and Pi: read-only inspection and help run as before; replay, retry, quarantine clearing, job control, recommendations, and adding or removing users, applications and subscriptions are refused, as is any chronicle command the guard does not recognize.
• A human who has authorized a store mutation can allow it by starting the agent with CRATIS_HOOKS_ALLOW_STORE_MUTATIONS=1; the command lists live in cratis-store-mutations.json and can be extended per repository.

Security

• A refused command tells the agent not to retry or work around it, and to report the exact command, its target server or context, and what it would change, so the user decides.