Skip to content

chore(ci): move the rivet pin 0.23.0 → 0.37.0 — gating set measured empty under both, two fewer false warnings - #1324

Merged
avrabe merged 1 commit into
mainfrom
chore/rivet-0.37
Sep 18, 2026
Merged

chore(ci): move the rivet pin 0.23.0 → 0.37.0 — gating set measured empty under both, two fewer false warnings#1324
avrabe merged 1 commit into
mainfrom
chore/rivet-0.37

Conversation

@avrabe

@avrabe avrabe commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Move the rivet tool pin 0.23.0 → 0.37.0 — measured before landing

The pin exists because an unpinned bump once reddened this gate on unchanged artifacts (rivet 0.15.0 promoted a warning to an error, #229). So this was measured rather than taken on the release notes: both versions were built side by side, and the exact gate Rivet Validation runs was replayed under each, on the same tree, with externals: stripped.

errors that gate (ours) total errors warnings artifacts
v0.23.0 (current pin) 0 40 (all cross-repo) 463 584 / 8 skipped
v0.37.0 0 40 (all cross-repo) 461 584 / 8 skipped

Why upgrade at all

  • rivet release notes — generate the release note from the trace (REQ-327).
  • release-readiness now scoped to local artifacts (REQ-338).

This loop hand-writes both today, so these are directly useful rather than version churn.

Also moved: the cache key

actions/cache is keyed on the version string. Left at 0.23.0 it would restore the old binary, the rivet --version guard would fail, and every run would rebuild — a silent slow path.

Not the same change as #1264

Dependabot's #1264 bumps the compliance action wrapper (0.35.0 → 0.37.0) in a non-required workflow and leaves rivet-version: v0.23.0 untouched. This PR moves the tool, in both the required Rivet Validation job and the compliance workflow's input. They are independent and can land in either order.

claim_check 75/75 · status_evidence 0 · oracle_wiring OK · both workflow files parse

Refs #229, #1064

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

@codecov

codecov Bot commented Sep 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@avrabe
avrabe force-pushed the chore/rivet-0.37 branch 2 times, most recently from ef35063 to 235a7ba Compare September 18, 2026 06:43
@avrabe @claude
chore(ci): move the rivet pin 0.23.0 -> 0.37.0, measured on this repo…
e59ace4 
…'s artifacts first

The pin exists because an unpinned bump once reddened the gate on unchanged
artifacts (rivet 0.15.0 promoted a WARN to an ERROR, #229). So the bump is
measured, not taken on the release notes: both versions were built side by
side and the EXACT gate this job runs was replayed under each, on the same
tree, with `externals:` stripped.

            errors that gate (OURS)   total errors   warnings   artifacts
  v0.23.0            0                  40 (xref)      463       584 / 8 skipped
  v0.37.0            0                  40 (xref)      461       584 / 8 skipped

The gating set is empty under both, and artifact loading is identical, so the
#1064 non-vacuity floor is unaffected (re-measured, not assumed). 0.37 adds NO
new warnings and drops two: it stopped calling `unit-verification` and
`sw-integration-verification` invalid `verifies` satisfiers — rivet's REQ-339,
dev verification measures may verify dev types. Two FEWER false complaints,
none gained.

What the upgrade buys, and why it is worth doing rather than deferring:
`rivet release notes` generates a release note FROM THE TRACE (REQ-327), and
release-readiness is now scoped to local artifacts (REQ-338). This loop
hand-writes both today.

Also moves the cache key, which is keyed on the version — without it CI would
restore the 0.23.0 binary and the version check would rebuild it every run.

NOT the same change as dependabot's #1264: that bumps the compliance ACTION
wrapper (0.35.0 -> 0.37.0) in a non-required workflow and leaves the tool
version alone. This moves the tool, in both the required `Rivet Validation`
job and the compliance workflow's input.

Refs #229, #1064

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
@avrabe
avrabe merged commit cf35150 into main Sep 18, 2026
69 checks passed
@avrabe
avrabe deleted the chore/rivet-0.37 branch September 18, 2026 08:50
@avrabe avrabe mentioned this pull request Sep 18, 2026
Closed
avrabe added a commit that referenced this pull request Sep 18, 2026
@avrabe @claude
plan(v0.70): add RQ-70-RIVETNOTES (#1337) — the CHANGELOG is prose ab…
ecfbd61 
…out a set rivet can diff, and the diff nobody ran reports 22 new warnings

Raised by the maintainer after the v0.69 tag: the release notes should carry a
rivet-DERIVED section. They did not, and running `rivet diff` now shows why that
mattered.

MEASURED with the CI-PINNED rivet 0.37.0, v0.68.0 -> v0.69.0:

  9 added, 0 removed, 0 modified, 575 unchanged
  0 new errors, 0 resolved errors, 22 NEW WARNINGS, 0 resolved

The nine additions are the release's nine artifacts with their titles — a
derived table of contents no human wrote. The 22 warnings are the finding, in
three classes, none surfaced by any v0.69 gate:

  (a) ALL NINE IDs cannot be commit-trailer references — "trailers need an
      uppercase-alphanumeric prefix and an all-digit suffix, e.g. REQ-001".
      No RQ-NN artifact is traceable through commits at all.
  (b) `req-type: process` is not in the schema's allowed set — 4 of v0.69's 9,
      53 occurrences repo-wide. A convention the schema never accepted.
  (c) all nine lack an incoming `verifies` link, so the right side of the V is
      open for every artifact this release shipped.

(a) IS THE SAME ROOT CAUSE AS RQ-70-WINDOWVAC (#1334), FOUND INDEPENDENTLY BY A
SECOND TOOL: status_evidence's window matches zero commits because
"RQ-69-SUBTRACT (#242): ..." does not fit its conventional-commit regex, and
rivet says the same IDs cannot be trailer references. One naming decision, two
traceability mechanisms silently disabled. Scope them together.

A VERSION NOTE THAT IS ITSELF A FINDING: the first run used the `rivet` on PATH
(~/.cargo/bin/rivet, 0.32.0) — exactly the shadow #1236 pins and #1308 reports
on the runners. The maintainer corrected it to the CI-pinned 0.37.0. The
artifact delta is identical, but the versions disagree about validate: 0.32.0
reports "0 broken cross-refs" where 0.37.0 reports "cross-refs NOT CHECKED —
externals failed to load". The older 0 was the vacuous reading; the upgrade
landed in v0.69 (#1324) and made it honest.

v0.70 is now 8 artifacts. Gates on this tree: status_evidence 0, claim_check
75/75; artifacts strict-loaded with a duplicate-key-strict loader.

Refs #1337 #1334 #1308

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
avrabe added a commit that referenced this pull request Sep 18, 2026
@avrabe @claude
plan(v0.70): scope the release — "Evidence you can re-derive" (7 arti…
b3ea4b6 
…facts, every candidate measured against source first) (#1336)

* plan(v0.70): scope the release — "Evidence you can re-derive" (7 artifacts, every candidate measured against source before it was written)

Two MUSTs, both cpetig (EXTERNAL reporter), both reproduced on main with their
own command lines; five SHOULDs, four of them found by v0.69's clean-room
review and verified at source before being written.

MUSTs — who is blocked:
  RQ-70-NPA    #1331  --native-pointer-abi cannot lower static-data f32
                      load/store. MEASURED: 6 of 22 functions skipped, 4 of 6
                      EXPORTS skipped, rc=1 via #952, NO object emitted. The
                      issue excerpt shows 2 — the same undercount shape as
                      #1318 (2 vs 7). The embedder-init workaround was verified
                      on THIS module (rc=0, 0 skipped, 28409 bytes), so the gap
                      is specific to the ABI.
  RQ-70-ALIAS  #1321  VCR-RA-003 SpillSlotAliased{184,...} is now THE blocker
                      for cpetig's export: v0.69 raised the capacity ceiling
                      (pool-grow(194) -> ok) and the validator refuses the
                      stream. Slot 184 is i32 LOCAL 31, not f32 local 45 — the
                      v0.69 diagnosis was corrected at the cut and the
                      mechanism is store->reload forwarding with DSE blocked by
                      unmodelled F32 ops.

SHOULDs — gates that report success about work they did not do:
  RQ-70-CITEGAP     #1333  artifact_citation_check globs artifacts/*.yaml NON-
                           recursively: 30 of 127 files, 0 v0.69 artifacts. It
                           has never scanned a release artifact since v0.61.
  RQ-70-WINDOWVAC   #1334  status_evidence's delivery window matched ZERO
                           commits for two releases. 8 RQ-NN deliveries do not
                           match the shape; the 6 that do are release/chore/plan
                           and not in DELIVERY_TYPES. CI only reds on SKIPPED.
  RQ-70-DONEWHEN    #1335  9/9 done-when are `manual:`, so R3 cannot fire;
                           100% since v0.66. The conformance gate counts
                           DECLARATION, not evaluation.
  RQ-70-PAGELIB     #1315  the page-size refusal is CLI-only; synth-core decodes
                           page_size_log2 and does not refuse, so a PUBLISHED-
                           library caller still gets it silently ignored — the
                           shape #1317 closed in the same release.
  RQ-70-FALCONCORPUS #1318 FALCON's headline numbers are not re-derivable from
                           the repo: the reporter's modules were never
                           committed. Two corpus definitions (207x5 and 193x5)
                           were both called "the corpus".

THE ANCHOR MOVES IN THIS PR, which is the only place it may move:
  ANCHOR_TAG v0.68.0 -> v0.69.0, ANCHOR_DELIVERY 80 -> 88, ANCHOR_PROGRAMME
  433 -> 442 — all three DERIVED by the checker itself, not remembered — plus
  the matching claims.yaml pin. status-evidence-anchor now reports lag 0.

Gates on this tree: status_evidence 0 (155 artifacts, 0 failures), claim_check
75/75, oracle_wiring 0, check_version_pins 0, artifact_citation 0, and both
anchor unit-test suites pass.

Refs #1331 #1321 #1333 #1334 #1335 #1315 #1318

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

* plan(v0.70): add RQ-70-RIVETNOTES (#1337) — the CHANGELOG is prose about a set rivet can diff, and the diff nobody ran reports 22 new warnings

Raised by the maintainer after the v0.69 tag: the release notes should carry a
rivet-DERIVED section. They did not, and running `rivet diff` now shows why that
mattered.

MEASURED with the CI-PINNED rivet 0.37.0, v0.68.0 -> v0.69.0:

  9 added, 0 removed, 0 modified, 575 unchanged
  0 new errors, 0 resolved errors, 22 NEW WARNINGS, 0 resolved

The nine additions are the release's nine artifacts with their titles — a
derived table of contents no human wrote. The 22 warnings are the finding, in
three classes, none surfaced by any v0.69 gate:

  (a) ALL NINE IDs cannot be commit-trailer references — "trailers need an
      uppercase-alphanumeric prefix and an all-digit suffix, e.g. REQ-001".
      No RQ-NN artifact is traceable through commits at all.
  (b) `req-type: process` is not in the schema's allowed set — 4 of v0.69's 9,
      53 occurrences repo-wide. A convention the schema never accepted.
  (c) all nine lack an incoming `verifies` link, so the right side of the V is
      open for every artifact this release shipped.

(a) IS THE SAME ROOT CAUSE AS RQ-70-WINDOWVAC (#1334), FOUND INDEPENDENTLY BY A
SECOND TOOL: status_evidence's window matches zero commits because
"RQ-69-SUBTRACT (#242): ..." does not fit its conventional-commit regex, and
rivet says the same IDs cannot be trailer references. One naming decision, two
traceability mechanisms silently disabled. Scope them together.

A VERSION NOTE THAT IS ITSELF A FINDING: the first run used the `rivet` on PATH
(~/.cargo/bin/rivet, 0.32.0) — exactly the shadow #1236 pins and #1308 reports
on the runners. The maintainer corrected it to the CI-pinned 0.37.0. The
artifact delta is identical, but the versions disagree about validate: 0.32.0
reports "0 broken cross-refs" where 0.37.0 reports "cross-refs NOT CHECKED —
externals failed to load". The older 0 was the vacuous reading; the upgrade
landed in v0.69 (#1324) and made it honest.

v0.70 is now 8 artifacts. Gates on this tree: status_evidence 0, claim_check
75/75; artifacts strict-loaded with a duplicate-key-strict loader.

Refs #1337 #1334 #1308

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@avrabe