kriya Console v0.3.3 — memory, time, and behaviour

Four items from the hard-to-copy build programme, three of which add a new way to notice
something the previous releases could record but not reason about.

New in the app

• Memory view — signed, hash-only receipts for every write to a governed persistent-memory
  surface (CLAUDE.md, the Claude memory directory, .claude/settings*.json, and
  operator-registered MCP memory tools), with a provenance badge that escalates when untrusted
  ingress is present in the same run.
• Policy → temporal conditions — a rule may now require that something already happened in
  this session before it allows an action: "don't allow a governed git push unless a governed
  npm test succeeded earlier in this session."
• Monitor → Behaviour baselines — per-agent, per-dimension baselines formed from a stream's
  own signed receipts, flagging when later behaviour stops looking like the baseline.
• kriyaD fleet telemetry (control-plane licensed) — kriyad speaks OTel at the fleet boundary:
  one span per accepted signed envelope to your own collector, plus aggregate governance KPIs on
  GET /metrics and an importable Grafana dashboard.

Honest scope, as always

• Memory-write receipts observe and evidence, never block — and kriya does not claim to
  detect semantic memory poisoning.
• Temporal conditions are session-scoped and per-lane — they can only tighten an existing
  decision, never loosen one, and fail closed on an unreadable session log.
• Behaviour baselines are advisory only, carry no enforcement lever, and their false-alarm
  level rises materially on bursty traffic — the card deliberately never quotes it as a rate.
• Fleet telemetry exports only to your own configured collector — kriya never hosts or sees a
  copy — and metrics carry device id only, never a hostname or username.

Full details: CHANGELOG · FEATURE-PROOF

Verify

shasum -a 256 -c KriyaConsole-0.3.3-universal.dmg.sha256