feat: P0+P1 security, filter/sort/pagination, traceability, test markers

artifacts/decisions.yaml

@@ -678,7 +678,7 @@
     status: draft
     tags: [rendering, markdown, architecture]
     fields:
       rationale: CommonMark rendering via pulldown-cmark. Lightweight, no-alloc, already proven in the Rust ecosystem. Artifact descriptions contain markdown syntax that is currently escaped and displayed as plain text.
 
     links:
       - type: satisfies
@@ -689,7 +689,7 @@
     status: draft
     tags: [documents, embedding, architecture]
     fields:
       rationale: Embed syntax uses colon-separated modifiers (full, links, upstream, downstream, chain) that the schema interprets. The schema defines which link types go up (satisfies, implements) vs down (satisfied-by, implemented-by). Traversal depth is configurable. Same syntax works in dashboard and static HTML export.
     links:
       - type: satisfies
         target: REQ-033
@@ -705,8 +705,8 @@
       with structure matching the STPA Handbook methodology.
     tags: [adapter, stpa, architecture]
     fields:
       alternatives: Reuse the generic YAML adapter with type-prefixed keys. Rejected because it obscures the STPA methodology structure and makes manual editing harder for safety engineers who think in STPA terms.
       rationale: STPA artifacts use a domain-specific YAML structure (losses.yaml, hazards.yaml, ucas.yaml) rather than the generic format, matching the STPA Handbook structure and enabling direct import from meld.
 
     links:
       - type: satisfies
@@ -724,8 +724,8 @@
       downstream tool can consume without domain-specific knowledge.
     tags: [adapter, architecture]
     fields:
       alternatives: Per-domain YAML formats for each schema (ASPICE YAML, cybersecurity YAML). Rejected because it fragments tooling and requires adapter-per-domain rather than a single generic path.
       rationale: The generic YAML adapter uses a single canonical format with explicit type, links array, and fields map per artifact. This provides a universal interchange format that any adapter can target and any tool can consume without domain-specific knowledge.
 
     links:
       - type: satisfies
@@ -741,8 +741,8 @@
       internal salsa/rowan state.
     tags: [adapter, aadl, architecture]
     fields:
       alternatives: Embed spar-parser as a Rust library dependency. Rejected because spar uses salsa and rowan with complex internal state that would tightly couple the two tools. CLI JSON is a clean boundary.
       rationale: The AADL adapter imports architecture models via spar CLI JSON output rather than parsing AADL directly. This avoids duplicating spar's parser and leverages spar's analysis results (diagnostics, resolved references). The JSON interchange format is stable and version-negotiable between spar and rivet.
 
     links:
       - type: satisfies
@@ -760,8 +760,8 @@
       SpecObject attribute values.
     tags: [adapter, reqif, architecture]
     fields:
       alternatives: Strip XHTML and store plain text only. Rejected because it loses formatting, tables, and embedded images that are semantically significant in requirements documents.
       rationale: The ReqIF adapter preserves XHTML rich-text content during import/export rather than flattening to plain text. This is required for round-trip fidelity with tools like Polarion and DOORS that use embedded XHTML in SpecObject attribute values. Content is stored as-is in artifact fields and rendered in the dashboard.
     links:
       - type: satisfies
         target: REQ-005
@@ -845,3 +845,24 @@
         metadata from the export content so the same export can be deployed
         in multiple contexts.
       alternatives: Embed version list at export generation time. Rejected because it requires re-export when new versions are published.
+
+  - id: DD-039
+    type: design-decision
+    title: Embed assets via include_str!/include_bytes! with build.rs stub generation
+    status: approved
+    description: >
+      JavaScript (HTMX, Mermaid) and WASM (spar) assets are embedded in the
+      binary via include_str!/include_bytes!. build.rs generates stub files
+      when spar WASM is not built, ensuring compilation always succeeds.
+      The runtime detects stubs and shows a fallback message.
+    tags: [architecture, assets, wasm]
+    links:
+      - type: satisfies
+        target: REQ-022
+    fields:
+      rationale: >
+        Embedding assets eliminates CDN dependencies and enables offline
+        operation. Stub generation ensures the build never fails due to
+        missing optional WASM assets.
+      alternatives: Serve from filesystem at runtime. Rejected because it
+        requires deploying assets separately from the binary.

artifacts/features.yaml

@@ -211,6 +211,8 @@ artifacts:
     links:
       - type: satisfies
         target: REQ-014
+      - type: satisfies
+        target: REQ-009
     fields:
       phase: phase-1
 
@@ -245,6 +247,8 @@ artifacts:
     links:
       - type: satisfies
         target: REQ-015
+      - type: satisfies
+        target: REQ-003
       - type: implements
         target: DD-010
     fields:

rivet-cli/src/main.rs

@@ -293,6 +293,9 @@ enum Command {
         /// Port to listen on
         #[arg(short = 'P', long, default_value = "3000")]
         port: u16,
+        /// Address to bind to (default: 127.0.0.1, localhost only)
+        #[arg(short = 'B', long, default_value = "127.0.0.1")]
+        bind: String,
     },
 
     /// Sync external project dependencies into .rivet/repos/
@@ -648,8 +651,15 @@ fn run(cli: Cli) -> Result<bool> {
             format,
             strict,
         } => cmd_commits(&cli, since.as_deref(), range.as_deref(), format, *strict),
-        Command::Serve { port } => {
+        Command::Serve { port, bind } => {
             let port = *port;
+            let bind = bind.clone();
+            if bind == "0.0.0.0" || bind == "::" {
+                eprintln!(
+                    "warning: binding to {} exposes the dashboard to all network interfaces",
+                    bind
+                );
+            }
             let ctx = ProjectContext::load_full(&cli)?;
             let schemas_dir = resolve_schemas_dir(&cli);
             let mut doc_dirs = Vec::new();
@@ -674,6 +684,7 @@ fn run(cli: Cli) -> Result<bool> {
                 schemas_dir,
                 doc_dirs,
                 port,
+                bind,
             ))?;
             Ok(true)
         }

rivet-cli/src/serve/mod.rs

@@ -318,6 +318,7 @@ pub async fn run(
     schemas_dir: PathBuf,
     doc_dirs: Vec<PathBuf>,
     port: u16,
+    bind: String,
 ) -> Result<()> {
     let git = capture_git_info(&project_path);
     let loaded_at = std::process::Command::new("date")
@@ -405,8 +406,8 @@ pub async fn run(
             },
         ));
 
-    let addr = format!("0.0.0.0:{port}");
-    eprintln!("rivet dashboard listening on http://localhost:{port}");
+    let addr = format!("{bind}:{port}");
+    eprintln!("rivet dashboard listening on http://{bind}:{port}");
 
     let listener = tokio::net::TcpListener::bind(&addr).await?;
     axum::serve(listener, app).await?;

rivet-cli/src/serve/styles.rs

@@ -651,4 +651,28 @@ table.sortable th:hover{color:var(--text)}
 .cell-detail ul{list-style:none;padding:.5rem;margin:0}
 .cell-detail li{padding:.25rem .5rem;border-bottom:1px solid var(--border)}
 .cell-detail li:last-child{border-bottom:none}
+
+/* ── Filter bar ────────────────────────────────────────── */
+.filter-bar{margin-bottom:1rem;padding:1rem}
+.filter-bar .form-row{display:flex;gap:.75rem;align-items:center;flex-wrap:wrap}
+
+/* ── Pagination ────────────────────────────────────────── */
+.pagination{display:flex;gap:.25rem;align-items:center;justify-content:center;
+  margin-top:1rem;padding:.75rem 0;flex-wrap:wrap}
+.pagination a{display:inline-flex;align-items:center;justify-content:center;
+  min-width:2rem;height:2rem;padding:0 .5rem;border:1px solid var(--border);
+  border-radius:var(--radius-sm);font-size:.82rem;font-family:var(--font);
+  color:var(--text);background:var(--surface);text-decoration:none;
+  transition:all var(--transition);cursor:pointer}
+.pagination a:hover{background:var(--accent);color:#fff;border-color:var(--accent)}
+.pagination-current{display:inline-flex;align-items:center;justify-content:center;
+  min-width:2rem;height:2rem;padding:0 .5rem;border:1px solid var(--accent);
+  border-radius:var(--radius-sm);font-size:.82rem;font-weight:600;
+  color:#fff;background:var(--accent)}
+.pagination-disabled{display:inline-flex;align-items:center;justify-content:center;
+  min-width:2rem;height:2rem;padding:0 .5rem;border:1px solid var(--border);
+  border-radius:var(--radius-sm);font-size:.82rem;
+  color:var(--text-secondary);background:var(--surface);opacity:.5}
+.pagination-ellipsis{display:inline-flex;align-items:center;justify-content:center;
+  min-width:1.5rem;height:2rem;font-size:.82rem;color:var(--text-secondary)}
 "#;