Skip to content

chore(deps): bump pulseengine/rivet from 0.34.0 to 0.35.0 - #1107

Merged
avrabe merged 1 commit into
mainfrom
dependabot/github_actions/pulseengine/rivet-0.35.0
Sep 7, 2026
Merged

chore(deps): bump pulseengine/rivet from 0.34.0 to 0.35.0#1107
avrabe merged 1 commit into
mainfrom
dependabot/github_actions/pulseengine/rivet-0.35.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps pulseengine/rivet from 0.34.0 to 0.35.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.35.0

What's Changed

Full Changelog: pulseengine/rivet@v0.34.0...v0.35.0

Changelog

Sourced from pulseengine/rivet's changelog.

[0.35.0] - 2026-08-27

The friction round. Every issue a human reported this cycle is fixed here — #832, #833, #835, #848, #852, #853, #854, #856 — alongside the three customer-requested dashboard changes.

Added

  • rivet sync --locked (REQ-311, #853) — check out the exact commits recorded in rivet.lock instead of each external's ref: head. rivet lock wrote pins that sync never read, so a consumer's committed lock pinned for provenance while its federated CI validated against whatever the sibling repos' heads happened to be: a force-push, artifact rename or bad commit silently changed what CI saw, and a run could not be reproduced later. Mirroring cargo, --locked never updates the lock and fails rather than floating when it cannot honour it — a missing lockfile or an unpinned external are both hard errors. Each resolved commit is printed so a CI log records what was actually validated.
  • rivet context --stdout / --brief (REQ-297, #811) — read project state without mutating the working tree.
  • Declared-blocked acceptance criteria (REQ-313, #856) — an acceptance-criteria entry may be a mapping (text / status / blocked-by) as well as a bare string, so a criterion an author knows is not yet dischargeable has somewhere to live other than shouty caps inside the string. A criterion blocked-by the release its own artifact is scoped to is a deadlock and is now an error: the release cannot be cut until the artifact verifies, and the artifact cannot verify until that release ships.

Fixed

  • Declared incompleteness scored as an oversight (REQ-309, #848) — a safety goal carrying GSN's undeveloped: true counted identically to a goal someone forgot. The schema's own rule description already promised the exemption ("unless marked undeveloped") while undeveloped appeared in no Rust file. A traceability rule may now name an exempting boolean field via exempt-when-field; an exempt source leaves the denominator and is reported as its own named count. A forgotten goal moves the figure 100% → 50%, where it is loud, instead of hiding among declared gaps.
  • validate --explain reported from one of [] (REQ-310, #852) for a rule that is satisfiable — which reads as "no type may source this link" and sent the reporter toward filing a schema gap that did not exist. The source set is now derived from the types that declare the ability to source the link, and a rule nothing can satisfy says so explicitly.
  • A dead externals path reported 0 broken cross-refs (REQ-312, #854). When external loading fails, cross-ref resolution never runs — and a zero read as "the cross-repo graph is clean" when it meant "the graph was never checked". On the reporting project that hid 12 genuine dangling refs behind 38 phantom errors. The summary now says cross-refs NOT CHECKED.
  • Overlapping sources collided every id with itself (REQ-302, #746) — 184 phantom errors masked 6 real ones. Sources are deduped at load; diagnostic order is now total, so report diffing between baselines works.
  • check verification-evidence was blind to nested workspaces (REQ-236,

... (truncated)

Commits
  • 4ff980e chore(release): v0.35.0 — the friction round (#868)
  • 9d9a697 plan(v0.36): triage the untracked issue board; give v0.36.0 a theme (#869)
  • fe18f29 plan(v0.35): cut what shipped, split the remainder (#866)
  • 679d612 fix(serve): truncation signal on /api/v1/artifacts (REQ-303, #832) (#864)
  • fa387cc fix(proofs): Kani CoverageEntry init missing exempt/exempt_ids (REQ-309, #848...
  • 2ddb0b3 ci: make the Test and Proptest jobs do what their names say (REQ-304, REQ-305...
  • 83c7d91 feat(sync): --locked checks out the commits recorded in rivet.lock (REQ-311, ...
  • 99f3b8b fix(explain): derive the allowed-source set instead of printing [] (REQ-310, ...
  • e08b3d0 feat(validate,export): declared-blocked acceptance criteria (REQ-313, #856) (...
  • e569bf2 fix(validate): report cross-refs as NOT CHECKED when externals fail to load (...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Dependency updates label Aug 31, 2026
@temper-pulseengine
temper-pulseengine Bot enabled auto-merge (squash) August 31, 2026 21:45
@github-actions
github-actions Bot disabled auto-merge August 31, 2026 21:45
@github-actions github-actions Bot added the major-bump-hold Breaking-class dep bump (major / 0.x-minor / 0.0.x) held from auto-merge — #866/#965 label Aug 31, 2026
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.34.0 -> 0.35.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

@avrabe avrabe mentioned this pull request Sep 3, 2026
Open
@codecov

codecov Bot commented Sep 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@avrabe

avrabe commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

[maintainer loop] Held-state audit — recording measured status so this hold is not silent.

pulseengine/rivet action 0.34.0 -> 0.35.0 · classifier: ``

All 9 required contexts are GREEN on this PR. The only red is
Rivet Federated Graph (advisory), which was failing repo-wide from
2026-09-03 04:00–21:25 because GitHub rate-limits anonymous clones from
datacenter IPs — nothing to do with this bump. Diagnosed and fixed in #1143/#1144.

So this is held by policy, not by evidence of breakage. The policy
(SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965) treats a 0.x minor as a de-facto
major, because for a 0.x crate it is one — earned from ordeal 0.9 -> 0.12,
which auto-merged as "minor" and hung Test/Z3 for 4–6 hours per run for
days.

Why you are being told this rather than left to rot. A held PR currently has
no defined exit: it cannot auto-merge, and nothing prompts a human. Four of
these accumulated since 2026-08-31 — one (#1111, wasmparser) was genuinely
source-breaking and is closed with that evidence; the rest were reporting a CI
outage, not an incompatibility. A hold that is correct and silent is how they
became invisible, and I described their state wrongly in the org review as a
result. Raised for temper in #1132.

Staying held pending a deliberate decision, not forgotten. If you want it taken,
say so on this PR.

@avrabe

avrabe commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

Why now (RQ-64-DEPS, #965): this PR's base is 32 commits behind main, so its CI verdict is uninterpretable — the single failure it currently shows could be the bump or any of those 32 commits. Attribution needs a baseline. Rebasing is the prerequisite for judging the bump at all, not an endorsement of merging it.

This remains held under SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965: under semver a 0.x-minor bump is BREAKING, and that rule exists because ordeal 0.9 → 0.12 auto-merged as "minor" and hung Test and Z3 for hours across several days (#849).

RQ-64-DEPS is scoped to give that hold an exit condition — it currently says hold and never says how a held bump gets evaluated and released, which is why four have accumulated since 2026-08-31.

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@avrabe

avrabe commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

Why recreate and not rebase (RQ-64-DEPS, #965): this branch carries a
Merge branch 'main' into … commit authored by a human. Dependabot refuses to
rebase any branch with foreign commits — it said so on this PR at 06:05:
"Looks like this PR has been edited by someone other than Dependabot. That
means Dependabot can't rebase it." That is not a transient decline; it is a
one-way door. rebase will never work here again.

Measured, not assumed:
merge-base with main b552fb4c (2026-09-03, pre-v0.63)
true tip-behind 32 commits
only red check Rivet Federated Graph (advisory) — green on main HEAD

The single red is advisory and sits on a tree four days stale, so it cannot
be attributed to the bump: the same job passes on main at 8862ee2f. A
verdict from a stale base is not evidence about the dependency.

recreate discards the branch and rebuilds it on current main, which both
makes the CI verdict interpretable and restores dependabot's ability to manage
this PR. The merge commit being overwritten carried no content of its own.

@avrabe

avrabe commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@avrabe

avrabe commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Measured, for the record (RQ-64-DEPS, #965): the earlier @dependabot recreate
on this PR was wrapped in backticks and dependabot did not act on it. The same
command posted as plain text on #1106 was picked up within minutes and the branch
was recreated on current main. So the command must be unformatted — a code-span
@dependabot … is not parsed as a command.

Recorded here rather than only fixed, because the failure looked exactly like
"dependabot is slow" for half an hour, and that is a misdiagnosis worth not
repeating.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/pulseengine/rivet-0.35.0 branch from db05bfb to c5bf076 Compare September 7, 2026 10:40
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.34.0 -> 0.35.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

avrabe added a commit that referenced this pull request Sep 7, 2026
@avrabe @claude
fix(ci): RQ-64-DEPS (#965) — the MINORHOLD exit exists but says nothi…
4fa6926 
…ng about the tree the suite ran on

The artifact's original premise ("the hold has no exit") was too strong. The
workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never
a block: merge a held bump BY HAND once the FULL suite is green ... the
discriminator is CI, not a maintainer's read of the diff." That criterion is
correct. The premise is corrected in the artifact rather than edited away, the
third premise correction this release and the same discipline RQ-64-FLOORPROSE
got.

What the exit omitted is everything about the TREE THE SUITE RAN ON, which is
what made it unusable in practice:

1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one
   red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured
   on trees whose merge-base was four days and one release stale. Neither that
   red nor a green would have attributed anything to the bump.

2. The refresh mechanism can be permanently gone. Those three each carry a human
   `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to
   rebase a branch with foreign commits — it said so on all three at 06:05Z.
   Merging main into a dependabot branch to freshen it is the move that destroys
   the ability to freshen it. Now written down, because it is not obvious and it
   is not reversible.

3. A bump nobody evaluates needs a disposition. These accumulated for a week
   because nothing required an answer. "Still open" is not a disposition.

None of this loosens the hold — 0.x-minor is breaking under semver and the
ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which
is what keeps a hold a delay rather than an accumulator.

Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched —
the added text deliberately avoids them), workflow parses, rivet validate at
main's 40-error baseline with 0 broken cross-refs.

Refs #965

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
avrabe added a commit that referenced this pull request Sep 7, 2026
@avrabe @claude
fix(ci): RQ-64-DEPS (#965) — record the plain-text requirement for de…
f40b8d8 
…pendabot commands, measured by probe

`@dependabot recreate` inside BACKTICKS is silently ignored. Measured
2026-09-07: three held PRs sat unchanged for over half an hour after a
backticked command; the identical command posted UNFORMATTED on #1106 was acted
on within minutes, and #1107/#1110 followed once reposted plain.

Worth writing down for two reasons. The failure is indistinguishable from "the
bot is slow", which is how it was misdiagnosed here. And the only reason it
became a measurement rather than a guess is that the plain form was probed on
ONE PR before being repeated on all of them — the difference between a
controlled test and three identical shots in the dark.

Refs #965

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
@avrabe avrabe mentioned this pull request Sep 7, 2026
Merged
avrabe added a commit that referenced this pull request Sep 7, 2026
@avrabe @claude
fix(ci): RQ-64-DEPS (#965) — the MINORHOLD exit exists but says nothi…
dfa4350 
…ng about the tree the suite ran on

The artifact's original premise ("the hold has no exit") was too strong. The
workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never
a block: merge a held bump BY HAND once the FULL suite is green ... the
discriminator is CI, not a maintainer's read of the diff." That criterion is
correct. The premise is corrected in the artifact rather than edited away, the
third premise correction this release and the same discipline RQ-64-FLOORPROSE
got.

What the exit omitted is everything about the TREE THE SUITE RAN ON, which is
what made it unusable in practice:

1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one
   red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured
   on trees whose merge-base was four days and one release stale. Neither that
   red nor a green would have attributed anything to the bump.

2. The refresh mechanism can be permanently gone. Those three each carry a human
   `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to
   rebase a branch with foreign commits — it said so on all three at 06:05Z.
   Merging main into a dependabot branch to freshen it is the move that destroys
   the ability to freshen it. Now written down, because it is not obvious and it
   is not reversible.

3. A bump nobody evaluates needs a disposition. These accumulated for a week
   because nothing required an answer. "Still open" is not a disposition.

None of this loosens the hold — 0.x-minor is breaking under semver and the
ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which
is what keeps a hold a delay rather than an accumulator.

Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched —
the added text deliberately avoids them), workflow parses, rivet validate at
main's 40-error baseline with 0 broken cross-refs.

Refs #965

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
avrabe added a commit that referenced this pull request Sep 7, 2026
@avrabe @claude
fix(ci): RQ-64-DEPS (#965) — record the plain-text requirement for de…
ab46600 
…pendabot commands, measured by probe

`@dependabot recreate` inside BACKTICKS is silently ignored. Measured
2026-09-07: three held PRs sat unchanged for over half an hour after a
backticked command; the identical command posted UNFORMATTED on #1106 was acted
on within minutes, and #1107/#1110 followed once reposted plain.

Worth writing down for two reasons. The failure is indistinguishable from "the
bot is slow", which is how it was misdiagnosed here. And the only reason it
became a measurement rather than a guess is that the plain form was probed on
ONE PR before being repeated on all of them — the difference between a
controlled test and three identical shots in the dark.

Refs #965

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
avrabe added a commit that referenced this pull request Sep 7, 2026
@avrabe @claude
fix(ci): RQ-64-DEPS — the MINORHOLD exit said nothing about the tree …
18309f5 
…the suite ran on (#1186)

* fix(ci): RQ-64-DEPS (#965) — the MINORHOLD exit exists but says nothing about the tree the suite ran on

The artifact's original premise ("the hold has no exit") was too strong. The
workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never
a block: merge a held bump BY HAND once the FULL suite is green ... the
discriminator is CI, not a maintainer's read of the diff." That criterion is
correct. The premise is corrected in the artifact rather than edited away, the
third premise correction this release and the same discipline RQ-64-FLOORPROSE
got.

What the exit omitted is everything about the TREE THE SUITE RAN ON, which is
what made it unusable in practice:

1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one
   red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured
   on trees whose merge-base was four days and one release stale. Neither that
   red nor a green would have attributed anything to the bump.

2. The refresh mechanism can be permanently gone. Those three each carry a human
   `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to
   rebase a branch with foreign commits — it said so on all three at 06:05Z.
   Merging main into a dependabot branch to freshen it is the move that destroys
   the ability to freshen it. Now written down, because it is not obvious and it
   is not reversible.

3. A bump nobody evaluates needs a disposition. These accumulated for a week
   because nothing required an answer. "Still open" is not a disposition.

None of this loosens the hold — 0.x-minor is breaking under semver and the
ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which
is what keeps a hold a delay rather than an accumulator.

Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched —
the added text deliberately avoids them), workflow parses, rivet validate at
main's 40-error baseline with 0 broken cross-refs.

Refs #965

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

* chore(rivet): correct the v0.64 plan's VG-009 claim — a grep for `1.6` matched `41.6 %`

The plan comment asserted that VG-009 and VCR-REACH-002 both still state
aarch64 accepts 1.6 %. Only the second is true.

VG-009's only "1.6" is the tail of "41.6 %", a line-coverage figure for
synth-backend-riscv/src/backend.rs, framed "measured at v0.54.0" — correctly
dated history, and untouched since #918. Flagging it would have been a false
red on a properly dated citation.

Measured and reported by the RQ-64-SCOPEGAP lane, which was briefed with
explicit permission to return a negative result and used it. The claim was
mine: it came from a grep for `1.6`, which returns OCCURRENCES and cannot
return FRAMING. Same failure that produced v0.62's devirtualization claim,
and the correction is left visible beside the original rather than edited
away — the scoping error is the same shape the artifact is about.

The real population the artifact should have named is larger and of a
different kind: eight artifacts restating the repo's own proof counts as
undated present-tense fact ("188 Qed / 52 Admitted", six months stale
against a number CLAUDE.md itself count-eq-pins).

`chore` deliberately, not `fix`: naming RQ-64-SCOPEGAP in a delivery-shaped
subject would oblige R4 to find that artifact's status flip in THIS PR, and
it belongs to #1182.

Verified: rivet validate at main's 40-error baseline, 0 broken cross-refs;
status_evidence_check exit 0.

Refs #1085

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

* fix(ci): RQ-64-DEPS (#965) — record the plain-text requirement for dependabot commands, measured by probe

`@dependabot recreate` inside BACKTICKS is silently ignored. Measured
2026-09-07: three held PRs sat unchanged for over half an hour after a
backticked command; the identical command posted UNFORMATTED on #1106 was acted
on within minutes, and #1107/#1110 followed once reposted plain.

Worth writing down for two reasons. The failure is indistinguishable from "the
bot is slow", which is how it was misdiagnosed here. And the only reason it
became a measurement rather than a guess is that the plain form was probed on
ONE PR before being repeated on all of them — the difference between a
controlled test and three identical shots in the dark.

Refs #965

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

* chore(release): RQ-64-DEPS (#965) — record PR #1186 in landed:, status stays proposed (half the done-when)

R4 is satisfied by fields.landed rather than a status flip, deliberately: the
exit condition landed but the four held PRs have no disposition yet, and
claiming `implemented` on half a criterion is the shape this release keeps
finding in other people's gates.

Refs #965

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@avrabe

avrabe commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/pulseengine/rivet-0.35.0 branch from c5bf076 to 1c72986 Compare September 7, 2026 13:38
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.34.0 -> 0.35.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

@avrabe avrabe mentioned this pull request Sep 7, 2026
Closed
@avrabe

avrabe commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
chore(deps): bump pulseengine/rivet from 0.34.0 to 0.35.0
ec63713 
Bumps [pulseengine/rivet](https://github.com/pulseengine/rivet) from 0.34.0 to 0.35.0.
- [Release notes](https://github.com/pulseengine/rivet/releases)
- [Changelog](https://github.com/pulseengine/rivet/blob/main/CHANGELOG.md)
- [Commits](pulseengine/rivet@v0.34.0...v0.35.0)

---
updated-dependencies:
- dependency-name: pulseengine/rivet
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/pulseengine/rivet-0.35.0 branch from 1c72986 to ec63713 Compare September 7, 2026 14:01
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.34.0 -> 0.35.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

@avrabe
avrabe merged commit 1b07bfc into main Sep 7, 2026
61 checks passed
@avrabe
avrabe deleted the dependabot/github_actions/pulseengine/rivet-0.35.0 branch September 7, 2026 14:32
@avrabe

avrabe commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Landed under the MINORHOLD exit condition (#1186 / RQ-64-DEPS #965). Reason,
grounded in what the bump touches:

  • Base freshness: rebased by dependabot to behind=0 before the verdict was
    read.

  • Scope — the narrowest of the four. This changes exactly one line, in
    .github/workflows/compliance.yml:
    uses: pulseengine/rivet/.github/actions/compliance@v0.34.0 → @v0.35.0.

    Two things it does not change, both worth stating because they are easy to
    assume: the rivet binary is pinned separately inside that action's with:
    block (rivet-version: v0.23.0) and is untouched; and the required Rivet Validation context lives in ci.yml with its own binary pin, so it is not
    downstream of this bump at all. This moves a compliance-report action wrapper
    in a non-required workflow.

  • Discriminator: 9/9 required contexts green by name, no non-advisory red.

  • PR-head vs merged: 0 lines.

Distinguishing the action version from the tool version is the whole content of
this evaluation — without it, "a rivet bump" reads as though it could change the
verdict of the job that validates synth's own artifacts. It cannot.

This was referenced Sep 7, 2026
Merged
Merged
avrabe added a commit that referenced this pull request Sep 7, 2026
@avrabe @claude
chore(rivet): close RQ-64-DEPS and record WHY RQ-64-ARCHMODEL is defe…
b99ae91 
…rred — a scope decision, surfaced rather than silent (#1192)

Two artifact updates, no code.

RQ-64-DEPS -> implemented. Both done-when clauses are discharged: the MINORHOLD
exit condition landed in #1186, and all four held bumps now have a disposition
recorded on the PR itself — #1106 and #1110 and #1107 merged for three different
reasons, #1108 closed as genuinely breaking. Four bumps, four outcomes, each on
its own evidence. The z3 decline is the FIRST time the enforced hold has stopped
a breaking 0.x-minor before it landed; the rule was written after ordeal
0.9->0.12 hung CI for days (#849) and had never been falsified until now.

RQ-64-ARCHMODEL stays `proposed` with its reason attached, following the v0.63
precedent (3540292). spar#445 is still OPEN with no activity since 2026-09-03,
re-verified at cut time rather than carried forward. It is an EXTERNAL blocker,
categorically different from a deferral for scope: nothing here went stale and
nothing got harder — it cannot proceed because the tool it depends on silently
ACCEPTS input it should refuse.

Fourth consecutive release recording feature-loop steps 1-2 as N/A, tracked by
#1136. Noted in the artifact: the conformance gate does not accept that prose as
evidence — it derives NA-FILED only from a release-SCOPED artifact existing, so
the obligation is discharged by filing, not by asserting "synth is a Rust
compiler, not AADL-architected". That assertion is true and has never been
examined, which is the point of #1136.

Verified: rivet at main's 40-error cross-repo baseline with 0 broken cross-refs,
status_evidence exit 0, claim_check 62/62.

Refs #965, #1136


Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates major-bump-hold Breaking-class dep bump (major / 0.x-minor / 0.0.x) held from auto-merge — #866/#965

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@avrabe