kriya Console v0.3.4 — Today, action gates, and packs

Open the app and see what your agents did — and gate the actions that matter.

New in the app

• Today — the new default landing view: the last 24 h of agent activity as human-readable
  headlines (deployed to prod, published a package, cut a release, blocked by a gate) with
  routine actions rolled up, the approvals that need you, and the day's posture — receipt-chain
  state, coverage, spend — in one strip. The Audit log gains a severity lens (Headline ·
  Notable · Denied · per-class chips, per-hour rollups); the classic full ledger stays the
  default. One shared receipt drawer everywhere: claim, signature verdict, live chain
  re-check, full payload, raw signed-line export.
• Action gates — seven high-stakes action classes, each behind one dial (Allow / Receipt-only
  / Approve / Deny): deploys · destructive git · publishes (+dependency installs, receipted and
  aggregated) · production DB · infra · outbound sends · agent self-modification (Deny by
  default — the prompt-injection vector). Enforced pre-execution in the Claude Code hook
  lane as a tighten-only escalation over your rules; every decision is a signed
  kriya.gate.<class>.{evaluated,held,approved,denied} receipt, chain-linked to the blocked
  attempt's own action receipt.
• Policy packs — Developer / Analyst / Planner: named, versioned presets over the gates,
  applied to the device in one click — and the application itself is a signed
  kriya.policy.pack.* receipt. Duplicate-then-edit for custom packs.

Honest scope, as always

• Gates enforce only where the pre-execution hook runs (the Claude Code lane today); receipts
  from other lanes are classified and displayed — the UI says "observed lanes", never "blocked".
• "Blocked"/"Held" wording appears only on explicit runtime deny/hold receipts; a plain
  failed action reads "did not complete" — a policy deny and a runtime failure are
  indistinguishable on that receipt alone.
• Dependency installs are counted, never judged — no "unknown package" claim ships until a
  first-seen ledger exists.
• One policy file per device: a pack applies to the device; per-identity assignments are
  bookkeeping for the launcher/fleet, and the UI labels them that way.
• The payments gate card is a disabled preview — payment governance is the next release's
  headline, not this one's.

Dogfood: this DMG was cut under its own governance — the build, codesign, notarization, and
publish appear as release-class headlines in the Today feed of the bundled demo dataset.

Signed with our Apple Developer ID, notarized + stapled by Apple (spctl reports
"Notarized Developer ID"). Universal binary (Apple Silicon + Intel). Verify with the .sha256
asset. The bundled kriya-hook was artifact-checked post-notarization: a .claude/settings.json
edit under a gates policy exits 2 and signs kriya.gate.self-mod.denied on the chain.

Full details: CHANGELOG · FEATURE-PROOF

kriya Console v0.3.3 — memory, time, and behaviour

Four items from the hard-to-copy build programme, three of which add a new way to notice
something the previous releases could record but not reason about.

New in the app

• Memory view — signed, hash-only receipts for every write to a governed persistent-memory
  surface (CLAUDE.md, the Claude memory directory, .claude/settings*.json, and
  operator-registered MCP memory tools), with a provenance badge that escalates when untrusted
  ingress is present in the same run.
• Policy → temporal conditions — a rule may now require that something already happened in
  this session before it allows an action: "don't allow a governed git push unless a governed
  npm test succeeded earlier in this session."
• Monitor → Behaviour baselines — per-agent, per-dimension baselines formed from a stream's
  own signed receipts, flagging when later behaviour stops looking like the baseline.
• kriyaD fleet telemetry (control-plane licensed) — kriyad speaks OTel at the fleet boundary:
  one span per accepted signed envelope to your own collector, plus aggregate governance KPIs on
  GET /metrics and an importable Grafana dashboard.

Honest scope, as always

• Memory-write receipts observe and evidence, never block — and kriya does not claim to
  detect semantic memory poisoning.
• Temporal conditions are session-scoped and per-lane — they can only tighten an existing
  decision, never loosen one, and fail closed on an unreadable session log.
• Behaviour baselines are advisory only, carry no enforcement lever, and their false-alarm
  level rises materially on bursty traffic — the card deliberately never quotes it as a rate.
• Fleet telemetry exports only to your own configured collector — kriya never hosts or sees a
  copy — and metrics carry device id only, never a hostname or username.

Full details: CHANGELOG · FEATURE-PROOF

Verify

shasum -a 256 -c KriyaConsole-0.3.3-universal.dmg.sha256

kriya Console v0.3.2 — governed spend, Verified Replay, verifiable telemetry

The largest release since v0.1.0 — twelve items from the hard-to-copy build programme land together.

Four of them add something you can hand to another person and have them check without kriya installed: a replay bundle, an OpenTelemetry span set, a C2PA artifact manifest, and a diode bundle.

New in the app

• Spend — what each governed Claude Code session actually cost, reconstructed on-device from the local transcript, priced by a bundled offline sheet, and signed into its own hash chain. Only token counts, model id and timestamps are ever read — never message content, tool inputs/outputs, or file paths. Extraction runs entirely in Rust, so transcript bytes never reach the UI layer. A priced estimate, never an invoice; an unrecognised model is reported unpriced, never guessed.
• Dollar budget gates — budgets per session, rolling day and user, consulted before the next action runs: deny, route to a human, or warn. The decision is itself a signed receipt recording how stale the spend figure was. A trailing-state gate, deliberately not a hard cap.
• Verified Replay (in Sessions) — step through a past session re-derived from its signed receipts alone. Nothing is re-run. A failed signature or broken chain makes the whole derivation refuse rather than render a plausible partial.
• Local Models — kriya-llm-proxy receipts every completion from Ollama / llama.cpp / vLLM / LM Studio (model digest, token usage, prompt and output hashes), with policy able to gate on model identity. Governs clients you point at the proxy; a direct connection to the model port stays invisible.
• New Settings panes — Telemetry (OTel), Integrity (pipeline measurement), Artifact signing (C2PA), Air-gap (diode bundles).

New offline verifiers on the free kriya-audit CLI

--verify-replay · --verify-otel · --verify-artifact · --verify-bundle · --verify-exec

Also

• ISO/IEC 42001 + CSA AICM evidence pack with an AI-CAIQ support sheet. Every Annex A row capped at partial; eight controls named as not covered.
• Deterministic execution lane — a tool run as a WASI component under pinned Wasmtime with virtualised clocks and randomness, so a captured run can be re-executed and hash-compared bit-for-bit.
• Opt-in FIPS and post-quantum build lanes (AWS-LC-FIPS cert #5298 · ML-DSA-87). Both off by default and mutually exclusive — this download is byte-unchanged by them.

Honest scope

• The OTel bridge is file export and import. There is no live collector push and no listening socket.
• The budget gate is trailing-state, as described above — not a hard cap.
• Pipeline integrity is measurement, not attestation: no hardware root of trust, and a fully compromised host can lie about its own measurement.
• C2PA uses a self-managed anchor, so public validators correctly report an untrusted signing credential. That is expected, not a defect.
• A missing diode chunk is reported by index; erasure-code reconstruction is not built.

Full detail: CHANGELOG · docs

---

Verify this download before you run it:

shasum -a 256 -c KriyaConsole-0.3.2-universal.dmg.sha256

Signed with a Developer ID certificate, notarized by Apple, and stapled. Universal (Intel + Apple Silicon), macOS 10.15+.

Then verify what the app shows you with the free offline auditor — that's the whole point: don't trust us, check.

kriya Console v0.3.1 — connector discoverability

kriya Console v0.3.1.

Signed + notarized universal macOS DMG (Apple Silicon + Intel). Free tier needs no account and opens no network connection.

A discoverability fix for the newer agent connectors — nothing else changes. When nothing is detected, the "Govern everything" empty state now names all seven supported clients and explains the key distinction: Claude Code and Hermes are governed whole-lane the moment their CLI is on your PATH (via a hook), while Cursor, Cline, GitHub Copilot, and Gemini CLI have no hook — kriya governs their MCP lane via the gateway, so each appears only once it has a local (stdio) MCP server in its config. Detection and wiring were already correct; this adds the missing signpost.

For the v0.3.0 feature release (Sessions, policy test-before-apply, more agents, the governed CI lane), see v0.3.0.

Verify the download:

shasum -a 256 -c KriyaConsole-0.3.1-universal.dmg.sha256
xcrun stapler validate KriyaConsole-0.3.1-universal.dmg

kriya Console v0.3.0 — sessions, test-before-apply, more agents

kriya Console v0.3.0.

Signed + notarized universal macOS DMG (Apple Silicon + Intel). Free tier needs no account and opens no network connection.

New: Sessions — run correlation. Every governed run reconstructed as a tree — which session → which sub-agent → which action, in order — from the signed receipts alone. Computed from verified receipts only; where a seam has no parent pointer (Claude Code's hook payload), none is invented — sub-agents group by their real agent_id. Run ids live inside receipt params, which the fleet-envelope minimizer structurally cannot read: session correlation never leaves the device.

New: Policy "test before apply." Replay a candidate policy over this device's own re-verified receipts and see which past actions would land on a different tier — before you apply the edit. The simulation itself is a signed, chained receipt.

New: Govern All — Cursor · Cline · GitHub Copilot · Gemini CLI. One-click detection + routing of each client's stdio MCP servers through the governed gateway; idempotent and byte-for-byte reversible. Honest ceiling in the app: the MCP lane is governed — native built-in tools bypass MCP unless launched under containment, and cloud-executed agents are out of scope.

In the open kriya runtime (same release train): kriya-govern (per-call govern + sign), SDK middleware for LangGraph · OpenAI Agents SDK · CrewAI · Claude Agent SDK (TypeScript + Python), and kriya-ci — the governed CI lane (fail the build on a policy block; the signed receipts are the build artifact, re-verifiable offline).

See CHANGELOG.md.

Verify the download:

shasum -a 256 -c KriyaConsole-0.3.0-universal.dmg.sha256
xcrun stapler validate KriyaConsole-0.3.0-universal.dmg

kriya Console v0.2.6 — Audit log date filter + sort

kriya Console v0.2.6.

Signed + notarized universal macOS DMG (Apple Silicon + Intel). Free tier needs no account and opens no network connection.

New: Audit log date filter + sort. The Audit log now has a From/To date-range filter (UTC, matching the "When" column) and a Newest/Oldest sort, defaulting to newest-first — so a receipt is findable by when it happened, not only by text, status, or source. See CHANGELOG.md.

Verify the download:

shasum -a 256 -c KriyaConsole-0.2.6-universal.dmg.sha256
xcrun stapler validate KriyaConsole-0.2.6-universal.dmg

kriya Console v0.2.5 — stale-hook detection

kriya Console v0.2.5.

Signed + notarized universal macOS DMG (Apple Silicon + Intel). Free tier needs no account and opens no network connection.

New: stale-hook detection. After an in-place upgrade, Claude Code could keep calling an older kriya-hook (a leftover install, or a pre---policy wiring) that predates egress capture — so WebSearch/WebFetch egress silently never recorded and the network-egress lane stayed grey. The Coverage view now compares the wired hook against the binary this build ships and, when they differ, shows a warning with a one-click Re-run Govern All to re-point it. See CHANGELOG.md.

Verify the download:

shasum -a 256 -c KriyaConsole-0.2.5-universal.dmg.sha256
xcrun stapler validate KriyaConsole-0.2.5-universal.dmg

kriya Console v0.2.4 — the egress pack

kriya Console v0.2.4 — the egress pack.

Signed + notarized universal macOS DMG (Apple Silicon + Intel). Free tier needs no account and opens no network connection.

New in this release: egress governance — deny-by-default allowlists, per-destination byte budgets, "no receipt, no egress" (the signed receipt is a precondition of the network call), secret/PII scanning, DNS-exfil + SSRF guards, canary tokens, operation rails, connector registry, credential brokering, macOS Seatbelt containment, and fleet egress with a kill switch. See CHANGELOG.md and docs/FEATURES.md.

Verify the download:

shasum -a 256 -c KriyaConsole-0.2.4-universal.dmg.sha256
xcrun stapler validate KriyaConsole-0.2.4-universal.dmg