chore(release): v0.6.0 — schema migrate + cited-source

[avrabe]

Summary

Bumps workspace, vscode-rivet, and npm root packages to 0.6.0. Platform packages stay on the release-npm.yml override path.

Bundles two already-merged marquee feature PRs as a release:

• feat(schema): rivet schema migrate Phase 1 — diff engine + plan/apply/abort + dev-to-aspice recipe #238 — feat(schema): rivet schema migrate Phase 1 (closes feat(schema): rivet schema migrate — git-rebase-style preset/version migration with abort/continue/skip #236 Phase 1)
• feat(validate): cited-source typed field + sha256 stamp Phase 1 — kind: file backend #239 — feat(validate): cited-source typed field + sha256 stamp Phase 1 (closes feat(validate): typed cited-source field + sha256 stamp — deterministic faithfulness check #237 Phase 1)

What ships

rivet schema migrate <target-preset> (#238)

Git-rebase-style preset/version migration. Phase 1 ships:

• Diff engine (~1k SLOC) classifying changes as mechanical / decidable-with-policy / conflict
• rivet schema migrate <target> with --apply, --abort, --status, --finish
• .rivet/migrations/<ts>-<src>-to-<tgt>/ storage with plan.yaml, manifest.yaml, state, snapshot/
• Canned recipe schemas/migrations/dev-to-aspice.yaml
• 8 unit tests + 5 integration tests (apply / abort byte-symmetry / roundtrip)
• rivet docs schema-migrate topic

Deferred to Phase 2: conflict markers in YAML, --continue / --skip / --edit, dashboard surface.

cited-source typed field + sha256 stamp (#239)

First-class schema affordance for artifacts citing external sources.

• Field shape: { uri, kind: file|url|github|oslc|reqif|polarion, sha256, last-checked }
• URI scheme allowlist enforced at validation time (exfiltration / SSRF mitigation)
• kind: file backend: re-reads cited file, recomputes sha256, emits cited-source-drift diagnostic on mismatch
• --strict-cited-sources flag promotes drift warnings to errors
• New rivet check sources [--update [--apply]] subcommand
• dev preset's requirement opts in first; other presets adopt incrementally

Deferred to Phase 2: remote backends (url, github, oslc, reqif, polarion).
Deferred to Phase 3: optional LLM-judge layer (opt-in Severity::Info only, never gates CI).

Test plan

• CI green
• rivet schema migrate aspice (plan + apply on a fresh dev project) returns PASS
• rivet validate on a cited-source: { kind: file, ... } fixture catches drift after the underlying file changes
• rivet check sources --update --apply restores PASS state
• After merge: tag v0.6.0 and create the GitHub Release

🤖 Generated with Claude Code

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Rivet Criterion Benchmarks'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.

Benchmark suite	Current: e567eab	Previous: 8d8554c	Ratio
store_insert/10000	16924476 ns/iter (± 1804529)	12638622 ns/iter (± 1399758)	1.34
link_graph_build/10000	44870141 ns/iter (± 3929563)	28431689 ns/iter (± 1353121)	1.58
validate/10000	16731610 ns/iter (± 1683191)	12073090 ns/iter (± 497967)	1.39
diff/10000	10525419 ns/iter (± 1038462)	8066975 ns/iter (± 334991)	1.30

This comment was automatically generated by workflow using github-action-benchmark.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!