docs+schema: external-anchor cited-source field + README link + MSRV fix (REQ-066/070)

README.md

@@ -56,6 +56,13 @@ This is not an audit-after-the-fact tool. The point is that the agent
 *authors* against the typed schema while the oracle is firing — so the
 evidence is born compliant instead of being reverse-engineered later.
 
+> **Before you build Rivet into a process, read [What Rivet is
+> not](docs/rivet-is-not.md).** It enumerates — in the register of an
+> ISO 26262-10 SEooC Safety Manual — the boundaries of Rivet's
+> competence and the obligations that remain the integrator's, not the
+> tool's. It is shorter than this README; reading it first saves a
+> day's debugging.
+
 ## Install
 
 ```bash

docs/srs.md

@@ -82,7 +82,7 @@ audit, deny, vet, coverage).
 
 [[REQ-009]] ties test results to GitHub releases as evidence artifacts.
 
-[[REQ-011]] pins Rust edition 2024 with MSRV 1.85.
+[[REQ-011]] pins Rust edition 2024 with MSRV 1.89.
 
 ### 3.7 V-Model Traceability Flow
 

docs/verification.md

@@ -134,7 +134,7 @@ a qualification gate:
 | `deny`         | `cargo deny`        | License violations, duplicate deps     |
 | `vet`          | `cargo vet`         | Supply chain verification              |
 | `coverage`     | `cargo llvm-cov`    | Code coverage metrics                  |
-| `msrv`         | MSRV 1.85 check     | Backward compatibility ([[REQ-011]])   |
+| `msrv`         | MSRV 1.89 check     | Backward compatibility ([[REQ-011]])   |
 
 ## 9. Requirement-to-Test Mapping
 

schemas/common.yaml

@@ -353,6 +353,18 @@ artifact-types:
         description: >
           Optional contract / PO / DIA reference for traceability into
           the legal artefact (ISO 26262-8 §5 DIA, ASPICE SUP.10).
+      - name: cited-source
+        type: mapping
+        required: false
+        description: >
+          Optional sha256-stamped reference to the upstream document this
+          anchor delegates to. The mapping carries `uri`, `kind` (file |
+          reqif | url | github | oslc | polarion), `sha256`, and
+          `last-checked`. `rivet supplier pull` fetches it into the
+          local supplier cache; `rivet validate` checks drift. Declared
+          here so the field that makes `external-anchor` functional for
+          federation is no longer an undefined-field INFO at validate
+          time (REQ-066). See `rivet docs schema-cited-sources`.
     link-fields: []
 
 # ──────────────────────────────────────────────────────────────────────────