release: v3.3.0 — bump workspace + inter-crate pins, CHANGELOG, README

[avrabe]

Release prep for v3.3.0 — "agent-consumable scry". rivet release status v3.3.0 = cuttable, 7 accepted / 0 proposed.

The bump moves 19 sites as one commit

cargo publish resolves each leaf from the crates.io index, so a stale version = "3.2.7" pin would publish a 3.3.0 core depending on the previous release.

count	site
1	workspace version
13	pinned inter-crate deps (analyze-core ×10, viz, segment, mcp)
1	Bazel CARGO_PKG_VERSION pin — #152, the one that shipped scry 0.0.0 when missed
1	README shipped-claim
3	claims.yaml (2 texts + 2 patterns, minus overlap)

The claim-check gate did its job again, unprompted

My bump script failed partway through claims.yaml on a regex-escaping bug, leaving Cargo.toml and README moved but claims.yaml stale — and claim-check immediately went 7/7 → 5/7. That is exactly the drift it exists for, caught within one command of being introduced. Back to 7/7 after.

The historical "what v3.2.7 did" note in claims.yaml is deliberately not bumped (it refers to that release's shipped-0.0.0 bug); a guard in the script asserts it survives.

Two stale things the bump exposed, fixed rather than shipped

• README said "the full v0.1 → v3.2 arc is done" while announcing v3.3.0 — the same tense-of-a-claim drift repaired in Repair a claim that was true when written and false for months after #198.
• crates/scry-mcdc/Cargo.lock still pinned scry-sai-core 3.2.7, and the MC/DC gate builds scry_mcdc.wasm from it.

What the CHANGELOG says this release does NOT give you

Both are things a consumer would otherwise assume:

• Obligation identity is not stable across builds. FEAT-073 measured 43–45% of function identities churning per build (Obligation identity churns 43-45% per build: func_ident inherits the Rust symbol disambiguator #123). The anchors and the feed schema ship; the guarantee behind them does not. Treat an obligation_id as stable within a build only. FEAT-064 and REQ-020 moved to v3.4.0 for exactly this reason (Release rescoping decision: 5 of the 6 remaining v3.3/v3.4 blockers are not work #195).
• The MCP verify tool is structurally absent. FEAT-065 was refuted pre-ship with six wrong-verdict paths (FEAT-065 rework: matching needs content corroboration — 6 wrong-verdict paths found pre-ship #122); exposing it would put a wrong verdict directly into an agent's tool loop.

Falsification statement

Four criteria in the CHANGELOG, with the weakest flagged as such: the before/after comparison is not corpus-wide, and #126's reporter has offered theirs.

Note for the release runner

scry-sai-mcp is a first-time publish — v3.2.7's tree contained no crates/scry-mcp. Already wired into scripts/publish.rs in leaf-after-core position.

And per FEAT-066's release-machinery note: cargo package is not a valid pre-release check mid-cycle. It fails for a correct tree, because crates.io's scry-sai-core predates the Query and VerifyReport APIs. A red there means nothing; the publish path handles ordering.

Verified locally

cargo test 160 + 12 pass · fmt clean · rivet validate PASS · claim-check 7/7 · release-ordering PASS · required-checks PASS

Refs: FEAT-066

🤖 Generated with Claude Code

https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc