From 92823f78ff7b4bee2be64687870debd7275beed1 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Thu, 27 Aug 2026 19:21:02 +0200 Subject: [PATCH 1/2] =?UTF-8?q?chore(release):=20v0.35.0=20=E2=80=94=20the?= =?UTF-8?q?=20friction=20round?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scope is the 12 artifacts carrying `release: v0.35.0` — three verified (REQ-274/275/276, the customer dashboard trio) and nine implemented (REQ-299, 303, 304, 305, 309, 310, 311, 312, 313). Every issue a human reported this cycle is fixed: #832, #833, #835, #848, #852, #853, #854, #856. Cut with nine artifacts at `implemented` rather than `verified`, on the maintainer's decision. Each carries a named undischarged clause recorded in the artifact — the --fail-under policy on REQ-309, the git: fallback and lock error message on REQ-312, release-status categories on REQ-313. Holding the release until every clause is discharged would recreate at release scope exactly the deadlock REQ-313 exists to detect: a criterion dischargeable only by a release shipping. The residuals are stated in the release notes rather than rounded up. The remaining scope moved with a logged decision in #866: five artifacts to the next minor (REQ-295, 306, 307, 314, 315) and nine to backlog, including two — REQ-300 and REQ-308 — that need a design decision before they can be scheduled at all. Two things this release fixes that were reporting correctly and being ignored. The Kani job had been failing on a genuine error[E0063] since REQ-309 added fields to CoverageEntry and missed the #[cfg(kani)] harness, which is invisible to cargo build, cargo test and clippy --all-targets — the whole local self-verify set. And the Test job's evidence step could produce no JUnit XML and still go green. Both are the same shape as the defects this release is about. docs check caught two of my own errors here: a stale binary reporting the pre-bump workspace version, and a forward reference to the next minor in the changelog. Both fixed before pushing. Confirmed with cargo fmt --check, clippy --all-targets -D warnings on 1.97.0, cargo test --workspace (exit 0, 65 ok), rivet validate and rivet docs check — all exit 0. Refs: REQ-274, REQ-275, REQ-276, REQ-303, REQ-309, REQ-311, REQ-313 --- CHANGELOG.md | 92 +++++++++++++++++++++++++++++++++++++++ Cargo.lock | 6 +-- Cargo.toml | 2 +- vscode-rivet/package.json | 2 +- 4 files changed, 97 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 49ad476d..6b81dc08 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,98 @@ ## [Unreleased] +## [0.35.0] - 2026-08-27 + +The friction round. Every issue a human reported this cycle is fixed here — +#832, #833, #835, #848, #852, #853, #854, #856 — alongside the three +customer-requested dashboard changes. + +### Added +- **`rivet sync --locked`** (REQ-311, #853) — check out the exact commits + recorded in `rivet.lock` instead of each external's `ref:` head. `rivet lock` + wrote pins that `sync` never read, so a consumer's committed lock pinned for + provenance while its federated CI validated against whatever the sibling + repos' heads happened to be: a force-push, artifact rename or bad commit + silently changed what CI saw, and a run could not be reproduced later. + Mirroring cargo, `--locked` never updates the lock and **fails rather than + floating** when it cannot honour it — a missing lockfile or an unpinned + external are both hard errors. Each resolved commit is printed so a CI log + records what was actually validated. +- **`rivet context --stdout` / `--brief`** (REQ-297, #811) — read project state + without mutating the working tree. +- **Declared-blocked acceptance criteria** (REQ-313, #856) — an + `acceptance-criteria` entry may be a mapping (`text` / `status` / + `blocked-by`) as well as a bare string, so a criterion an author knows is not + yet dischargeable has somewhere to live other than shouty caps inside the + string. A criterion `blocked-by` the release its own artifact is scoped to is + a **deadlock** and is now an error: the release cannot be cut until the + artifact verifies, and the artifact cannot verify until that release ships. + +### Fixed +- **Declared incompleteness scored as an oversight** (REQ-309, #848) — a safety + goal carrying GSN's `undeveloped: true` counted identically to a goal someone + forgot. The schema's own rule description already promised the exemption + (*"unless marked undeveloped"*) while `undeveloped` appeared in no Rust file. + A traceability rule may now name an exempting boolean field via + `exempt-when-field`; an exempt source leaves the denominator and is reported + as its own named count. A forgotten goal moves the figure 100% → 50%, where + it is loud, instead of hiding among declared gaps. +- **`validate --explain` reported `from one of []`** (REQ-310, #852) for a rule + that is satisfiable — which reads as "no type may source this link" and sent + the reporter toward filing a schema gap that did not exist. The source set is + now derived from the types that declare the ability to source the link, and a + rule nothing can satisfy says so explicitly. +- **A dead `externals` path reported `0 broken cross-refs`** (REQ-312, #854). + When external loading fails, cross-ref resolution never runs — and a zero read + as "the cross-repo graph is clean" when it meant "the graph was never + checked". On the reporting project that hid 12 genuine dangling refs behind 38 + phantom errors. The summary now says `cross-refs NOT CHECKED`. +- **Overlapping `sources` collided every id with itself** (REQ-302, #746) — 184 + phantom errors masked 6 real ones. Sources are deduped at load; diagnostic + order is now total, so report diffing between baselines works. +- **`check verification-evidence` was blind to nested workspaces** (REQ-236, + #807) — `--manifest-path` was parsed and then discarded. 14 false failures to + green. +- **`/api/v1/artifacts` truncated silently** (REQ-303, #832) — the cap dropped + 17 of 1017 artifacts with nothing marking the payload partial. + +### Changed +- **`--help` no longer carries internal bookkeeping** (REQ-298, #812) — REQ ids, + issue numbers and doc paths are gone; longest line 97 columns, down from 405. +- **Dashboard and export raised to WCAG AA** (REQ-276) — accent `#3a86ff` → + `#2059b8`. Six unit tests compute relative luminance over the palette, parsing + the hex values out of the live CSS so the audit cannot drift from what ships. +- **The test-result trace renders as a fold/expand tree** (REQ-274) — a 40-hop + ASPICE chain was a flat table; deep branches now collapse with counts. Native + `
`, so it works in `rivet serve` and the static export alike. +- **Tag filtering is a real facet** (REQ-275) — a server-rendered checkbox list + over the whole project with Select All / Unselect All and a filter box, + driving the `tags` param. A `tag-match` parameter makes the combinator + explicit (`all of` by default, so existing URLs are unchanged). + +### Internal +- **CI gates that could not fail** (REQ-304 #833, REQ-305 #835) — the Test job's + evidence step could produce no JUnit XML and still go green (a swallowed + install, a fallback that dropped both XML and retries, and an upload that + ignored a missing file). The Proptest job ran without nextest retries, so a + documented port race reddened it repeatedly. Both fixed; doctests moved to a + gating job, where they had never been. +- **Kani proofs did not compile** (REQ-309 follow-up, #865) — REQ-309 added two + fields to `CoverageEntry` and missed the `#[cfg(kani)]` harness, which is + invisible to `cargo build`, `cargo test` and `clippy --all-targets`. The Kani + job was reporting a genuine `error[E0063]` that was repeatedly dismissed as + infrastructure flake. +- **Per-PR mutation coverage for rivet-core** (REQ-299) — previously rivet-cli + only. + +### Known residuals +The nine `implemented` artifacts in this release each carry a named +undischarged clause, recorded in the artifact rather than rounded up to +`verified`: the `--fail-under` policy on REQ-309, the `git:` fallback and +`rivet lock` error message on REQ-312, and release-status categories on +REQ-313. Deferred to the next minor: REQ-295, 306, 307, 314, 315. + + ## [0.34.0] - 2026-08-20 Evidence you can check. Five places where a gate ran, reported green, and diff --git a/Cargo.lock b/Cargo.lock index ee1acc4b..681ace26 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1102,7 +1102,7 @@ dependencies = [ [[package]] name = "etch" -version = "0.34.0" +version = "0.35.0" dependencies = [ "petgraph 0.7.1", ] @@ -3123,7 +3123,7 @@ dependencies = [ [[package]] name = "rivet-cli" -version = "0.34.0" +version = "0.35.0" dependencies = [ "anyhow", "axum", @@ -3151,7 +3151,7 @@ dependencies = [ [[package]] name = "rivet-core" -version = "0.34.0" +version = "0.35.0" dependencies = [ "anyhow", "criterion", diff --git a/Cargo.toml b/Cargo.toml index 82aba162..7ee1bf64 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -15,7 +15,7 @@ members = [ exclude = ["compose-witness"] [workspace.package] -version = "0.34.0" +version = "0.35.0" authors = ["PulseEngine "] edition = "2024" license = "Apache-2.0" diff --git a/vscode-rivet/package.json b/vscode-rivet/package.json index e11da57e..a3fe07ee 100644 --- a/vscode-rivet/package.json +++ b/vscode-rivet/package.json @@ -3,7 +3,7 @@ "displayName": "Rivet SDLC", "description": "SDLC artifact traceability with live validation, hover info, and embedded dashboard", "publisher": "pulseengine", - "version": "0.34.0", + "version": "0.35.0", "license": "MIT", "repository": { "type": "git", From 9a776e5b42f939a3fca33737d2490c3cc277121b Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Fri, 28 Aug 2026 00:46:36 +0200 Subject: [PATCH 2/2] chore(release): reconcile the deferred list with the settled v0.36.0 plan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release notes were written before #869 landed, so the "deferred to the next minor" line named REQ-307 (since moved to backlog as CLI usability, not part of the v0.36.0 theme) and omitted REQ-316 and REQ-317, which #869 created from untracked issues #862 and #839/#849/#860/#867. Caught by diffing the changelog line against the actual `release: v0.36.0` query rather than re-reading the prose. Release notes that describe scope should be checked against the scope, not against memory of it — the same check that found REQ-298 missing from the v0.34.0 notes. Confirmed with rivet docs check (exit 0), rivet validate (exit 0), cargo fmt --check, clippy --all-targets -D warnings on 1.97.0 and cargo test --workspace (exit 0, 65 ok). Refs: REQ-307, REQ-316, REQ-317 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6b81dc08..4e8ad5f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -94,7 +94,7 @@ The nine `implemented` artifacts in this release each carry a named undischarged clause, recorded in the artifact rather than rounded up to `verified`: the `--fail-under` policy on REQ-309, the `git:` fallback and `rivet lock` error message on REQ-312, and release-status categories on -REQ-313. Deferred to the next minor: REQ-295, 306, 307, 314, 315. +REQ-313. Deferred to the next minor: REQ-295, 306, 314, 315, 316, 317. ## [0.34.0] - 2026-08-20