Rivet v0.10.0

Theme: audit-grade story — three orthogonal features that move rivet from "trace your project" to "describe the boundary and defend the tool's role across it."

Highlights

• Variant-aware properties (#285, closes #255) — per-variant field values via fields-per-variant + fields_for_variant() resolver with zero-allocation Borrowed fallback.
• Cross-org / supplier-boundary coverage (#286, closes #253) — external-anchor artifact type, 3-state coverage (satisfied / external-boundary / uncovered), rivet supplier list + rivet supplier check.
• AI session provenance — schema half (#289, partially closes #127) — ai-session artifact type pins a Claude Code session to a commit. Companion link type produced-by.
• Tool-qualification workstream A (#289) — tool-confidence artifact type with regime field, ai-found-defect triage record, dogfood claim TQ-CONF-RIVET at TI2/TD1/TCL1, dossier at rivet docs tool-qualification.
• rivet stats --qualification — JSON baseline manifest for the dossier.
• --qualification-mode — top-level gate refusing out-of-scope subcommands.
• rivet coverage --aggregate (#270) — file-based cross-repo V&V matrix aggregation.

Release-process note

This release was published from the workflow artifacts of run 25966236046. The build-test-evidence job failed on a transitive highs-sys WASI cross-compile (pure CI infra issue, unrelated to the binaries). All cross-platform builds, compliance report, baseline snapshot, and the VSIX succeeded. Workflow will be patched to make build-test-evidence non-blocking.

See CHANGELOG.md for full notes.

Rivet v0.9.0

What's Changed

• ci(release-npm): switch to workflow_run trigger so npm publish auto-fires by @avrabe in #261
• ci: migrate 16 of 21 ci.yml jobs to smithy self-hosted runners by @avrabe in #262
• chore(ci): add concurrency control to all workflows by @avrabe in #258
• fix(deps): upgrade wasmtime 42 → 43 (RUSTSEC-2026-0114) by @avrabe in #260
• fix(externals): load each external's schemas; type-check prefixed artifacts against them (#245) by @avrabe in #267
• [temper] Configuration update by @temper-pulseengine[bot] in #216
• feat(sexpr): add linked-via operator + document the linked-* family (#190) by @avrabe in #265
• feat(coverage): rivet coverage --matrix — V&V matrix from repo-status artifacts by @avrabe in #243
• feat(bundle): rivet bundle <ID> --depth N --as {yaml,jsonl} (#206) by @avrabe in #266
• fix(stpa): correct TCL numbering to ISO 26262-8 (TCL1) — issue #254 A1 by @avrabe in #257
• chore(release): v0.9.0 — backlog drain + CI infrastructure by @avrabe in #268
• ci(release): install wasm-component-ld in build-test-evidence by @avrabe in #269
• ci(release): install lld (wasm-ld) for build-test-evidence by @avrabe in #271
• ci(release): make build-test-evidence non-blocking by @avrabe in #272

New Contributors

• @temper-pulseengine[bot] made their first contribution in #216

Full Changelog: v0.8.0...v0.9.0

Rivet v0.8.0

What's Changed

• fix(docs-check): tighten --coverage rule 3 + add --warn-only mode (#248) by @avrabe in #250
• feat(cli): cited-source --strict, --strict-cited-source-stale, schema migrate --list (#249) by @avrabe in #251
• fix(docs): stale literals + extend rivet docs check with EmbeddedVersionLiterals / EmbeddedFlagReferences / EmbeddedTodoMarkers (#247) by @avrabe in #252
• chore(release): v0.8.0 — dogfood follow-ups by @avrabe in #256

Full Changelog: v0.7.0...v0.8.0

Rivet v0.7.0

What's Changed

• feat(validate): warn when prose names an artifact id without a typed link (#207) by @avrabe in #234
• fix(ci): make Release workflow idempotent on existing tag by @avrabe in #244
• feat(docs-check): subcommand-coverage gate — walk clap tree + assert each path has an embedded doc by @avrabe in #241
• feat(schema): rivet schema migrate Phase 2 — conflict markers + --continue / --skip / --edit by @avrabe in #242
• chore(release): v0.7.0 — schema migrate Phase 2 + docs coverage gate by @avrabe in #246

Full Changelog: v0.6.0...v0.7.0

rivet 0.6.0

rivet 0.6.0 — schema migrate + cited-source

Theme: schema migration + cited-source faithfulness. Two marquee
features landing together — both surfaced during the post-0.5.0
fresh-user dogfood (#236, #237).

Highlights:

• rivet schema migrate (#238) — git-rebase-style preset/version
  migration with snapshot/abort. Phase 1 ships: diff engine,
  plan/apply/abort/status/finish state machine, full pre-migration
  snapshot for rollback, and one canned dev-to-aspice recipe.
  Conflict markers + --continue / --skip deferred to Phase 2.

• cited-source typed schema field + sha256 stamp (#239) — first-class
  affordance for artifacts citing external sources. Phase 1 ships the
  kind:file backend: rivet validate re-reads the cited file,
  recomputes sha256, emits cited-source-drift on mismatch
  (Severity::Warning, promotable via --strict-cited-sources).
  URI scheme allowlist mitigates exfiltration / SSRF surface.
  New rivet check sources [--update [--apply]] for the audit flow.
  Remote backends (url/github/oslc/reqif/polarion) deferred to
  Phase 2; LLM-judge layer deferred to Phase 3 (opt-in Info only,
  if at all).

Workspace, vscode-rivet, and npm root package versions bumped to
0.6.0. Platform packages stay on the release-npm.yml override path.

Honest status: one documented Verus assume() and one Rocq Admitted
remain (REQ-004 follow-ups; closure pending in PR #228).

rivet 0.5.1

rivet 0.5.1 — first-contact polish

Theme: post-0.5.0 dogfood-driven polish. Two clean-room fresh-user
passes plus three scenario-based ones (safety / STPA, compliance /
Polarion-import, AI integrator / MCP) surfaced two real bugs and one
big doc gap. All three are fixed.

Highlights:

• docs(quickstart): rewrite for fresh-user clarity (#230). New
  "What is rivet?" preamble, preset-branched step 2/3, complete
  copy-pasteable ASPICE overlay, sw-req → system-req →
  stakeholder-req stub-parent chain, common-gotchas appendix
  G.1–G.7. Wall-time wins: STPA 13min → 36s; Polarion → ASPICE
  7min → 3.8min.
• fix(aspice): seed validates clean after init (#233). The shipped
  aspice preset's seed failed rivet validate out of the box with
  2 errors (undeclared allocated-from, missing stakeholder-req
  parent). Now returns PASS with 0 warnings.
• feat(mcp): discoverability (#231). New rivet mcp --list-tools
  and --probe flags (no JSON-RPC required to enumerate the tool
  catalog or smoke-test the server) plus a new rivet docs mcp
  topic covering wire format, handshake, the 15-tool catalog, and
  the response-envelope gotcha.

Honest status: one documented Verus assume() and one Rocq Admitted
remain (REQ-004 follow-ups; closure pending in PR #228).

rivet 0.5.0

rivet 0.5.0

Theme: oracle-gated agent pipelines + restored formal-method backstops +
agent-first quickstart.

Highlights:

• Embedded rivet quickstart (10-step oracle-gated walkthrough)
• Three-pillar README + intro-talk template + one-pager
• Mythos slop-hunt scaffold v2.2 (rank → discover → validate → emit)
• Verus + Rocq + Kani all running as real CI gates
• EU AI Act Annex IV dashboard self-audit
• Variant scoping coherent across 8 dashboard handlers
• Mutation testing 16-shard with ~125 surviving mutants killed
• ReqIF round-trip and OSLC push (diff-then-POST-or-PUT)

Honest status: one documented Verus assume() and one Rocq Admitted remain
(both REQ-004 follow-ups; closure pending in PR #228).

Rivet v0.4.3

What's Changed

• feat(ci): rivet-delta SVG render for email/mobile + classification priority fix by @avrabe in #193
• test(sexpr): audit predicate matrix + fuzz + doc examples + linked-from source-arg fix by @avrabe in #194
• feat(clippy): SCRC Phase 1 lint escalation — restriction family at warn by @avrabe in #195
• feat(sexpr): count-compare + matches parse-time regex + accessor docs by @avrabe in #196
• feat(variant): rivet variant features/value/attr for 7 build systems by @avrabe in #197
• docs(variant): build-system emitter walkthrough + exit-code contract by @avrabe in #198
• feat(variant): rivet variant explain for debugging solve outcomes by @avrabe in #199
• chore(release): v0.4.3 by @avrabe in #200
• chore(release): bump vscode-rivet/package.json to 0.4.3 by @avrabe in #201

Full Changelog: v0.4.2...v0.4.3

Rivet v0.4.2

What's Changed

• v0.4.2: UX polish + 10 bug fixes (4 silent-accept, 2 LSP, 4 quality-of-life) by @avrabe in #189
• docs: sync v0.4.2 rivet artifacts + stamp bug fixes (pre-tag) by @avrabe in #192

Full Changelog: v0.4.1...v0.4.2

Rivet v0.4.1

What's Changed

• fix(feature-model): cross-tree constraints silently pass by @avrabe in #156
• fix(validate): salsa path silently drops adapter + external artifacts by @avrabe in #157
• docs: Polarion and ReqIF export fidelity analysis by @avrabe in #169
• fix(init): preserve manual content in AGENTS.md / CLAUDE.md via managed-section markers by @avrabe in #167
• fix(mythos): 4 one-liner silent-accept bugs (validate/coverage/yaml_hir/formats) by @avrabe in #168
• fix: audit followups — real hard gates, /graph budget, PLE self-apply, v0.4.0 artifacts by @avrabe in #155
• fix(mcp): set_fields rejects reserved keys; add top-level description by @avrabe in #158
• fix(serve): Cmd+K search URL persistence + embed discoverability design by @avrabe in #159
• test: YAML + CLI fuzzer targets + empirical evidence for 5 silent-accept bugs by @avrabe in #160
• docs: CLI gaps + severity backlog (real-world 3400-artifact project) by @avrabe in #161
• docs: s-expression artifact format — honest cost analysis, recommend Option A by @avrabe in #162
• feat(release): VSIX on GitHub Release + actually publish to Marketplace by @avrabe in #163
• docs(iso26262): artifact mapping + gap analysis by @avrabe in #164
• build(npm): add @pulseengine/rivet distribution by @avrabe in #166
• docs: reality-check audit of documentation-vs-code by @avrabe in #171
• docs: AI-evidence trend research by @avrabe in #173
• docs: AI-assisted safety + cyber engineering — HITL contract by @avrabe in #176
• docs: v0.4.1 positioning — Evidence as Code frame by @avrabe in #172
• fix(v0.4.1): 5 user-reported pain points (#3, #4, #6, #7, #8) by @avrabe in #174
• fix(reqif): 6 fidelity bugs — provenance, typed fields, tags, creation-time, enum, dangling relations by @avrabe in #175
• feat(cli): v0.4.1 CLI polish — fail-on, stats counts, coverage gate, JSON schemas by @avrabe in #177
• feat(serve): variant selector + filtering in dashboard by @avrabe in #179
• v0.4.1 embeds: mermaid fix + {{query}}/{{group}}/{{stats:type}} + rivet docs embeds + rivet query by @avrabe in #180
• feat: docs-check gate (recurring doc-vs-reality CI check) by @avrabe in #178
• chore(release): v0.4.1 by @avrabe in #181
• fix(serve): variant banner link missing hx-push-url (v0.4.1 release hotfix) by @avrabe in #182
• fix(docs-check): derive known_embeds from registry + add audit markers (v0.4.1 hotfix #2) by @avrabe in #183

Full Changelog: v0.4.0...v0.4.1