chore(deps): bump pulseengine/rivet from 0.23.0 to 0.27.0

[dependabot]

Bumps pulseengine/rivet from 0.23.0 to 0.27.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.27.0

What's Changed

• fix(modify): quote --set-field values so a colon-space no longer corrupts the file (#687) by @​avrabe in pulseengine/rivet#691
• plan: REQ-255 — ingest ordeal certificates as re-checkable evidence (rivet#693) by @​avrabe in pulseengine/rivet#694
• plan(variant): 4-persona review — DD-076 + REQ-257..266 (variant hardening) by @​avrabe in pulseengine/rivet#701
• feat(lsp): enum-value + base-key completion (REQ-256, #546) by @​avrabe in pulseengine/rivet#700
• docs(variant): canonical feature-model attributes documentation (REQ-264, #546) by @​avrabe in pulseengine/rivet#703
• fix(variant): constraints fail loud instead of silently passing (REQ-257, DD-076) by @​avrabe in pulseengine/rivet#702
• fix(variant): validate binding artifact IDs + constraint feature names (REQ-258, REQ-259) by @​avrabe in pulseengine/rivet#705
• chore(release): v0.27.0 by @​avrabe in pulseengine/rivet#706

Full Changelog: pulseengine/rivet@v0.26.0...v0.27.0

Rivet v0.26.0

What's Changed

• ci(compliance): hard MB cap on the report tarball so #671 can't recur by @​avrabe in pulseengine/rivet#677
• plan(v0.26): triage serve-filtering (#674) + release-vs-variant (#673) by @​avrabe in pulseengine/rivet#686
• ci(mutants): cap address space at 48 GiB so a runaway mutant can't OOM the host (#590) by @​avrabe in pulseengine/rivet#685
• feat(serve): richer artifact filtering — tag + s-expression predicates (REQ-253) by @​avrabe in pulseengine/rivet#688
• feat(release): rivet release check --variant — release ∩ variant consistency + scoped cuttability (REQ-254) by @​avrabe in pulseengine/rivet#689
• chore(release): v0.26.0 by @​avrabe in pulseengine/rivet#692

Full Changelog: pulseengine/rivet@v0.25.0...v0.26.0

Rivet v0.25.0

What's Changed

• docs(decision): DD-071 — schema-aware LSP completion for REQ-246 authoring friction (#546) by @​avrabe in pulseengine/rivet#659
• fix(security): bump quick-xml 0.37→0.41 (RUSTSEC-2026-0194/0195) by @​avrabe in pulseengine/rivet#660
• ci: skip compile-heavy Rust jobs on artifact/docs-only PRs (runner load) by @​avrabe in pulseengine/rivet#664
• docs: runner pool operations runbook (#509) by @​avrabe in pulseengine/rivet#662
• docs(release): explain require: coverage semantics — coverage-rules ≠ every V-level (#612) by @​avrabe in pulseengine/rivet#663
• fix(mutate): compile-time exhaustiveness guard on render_artifact_yaml (#634) by @​avrabe in pulseengine/rivet#661
• fix(aspice): make swe1-has-verification satisfiers reachable (#652) by @​avrabe in pulseengine/rivet#657
• fix(validate): scope cross-repo UnknownPrefix to consumer-owned links (#649) by @​avrabe in pulseengine/rivet#658
• feat(lsp): schema-aware completion for type / link / fields (REQ-246 slice 1, DD-071, #546) by @​avrabe in pulseengine/rivet#669
• fix(security): bump crossbeam-epoch 0.9.18→0.9.20 (RUSTSEC-2026-0204) by @​avrabe in pulseengine/rivet#670
• feat(serve): backend-unavailable banner when the serve process is down (REQ-245, #621) by @​avrabe in pulseengine/rivet#675
• feat(results): per-result tracking links to PRs / remote issues (REQ-248, DD-072, #548) by @​avrabe in pulseengine/rivet#676
• feat(schema): warn when an embedded schema version drifts from a rivet.yaml pin (REQ-249) by @​avrabe in pulseengine/rivet#679
• docs(release): record crates.io publishing decision + blocker (REQ-250, REQ-252, DD-074) by @​avrabe in pulseengine/rivet#681
• chore(release): v0.25.0 by @​avrabe in pulseengine/rivet#683

Full Changelog: pulseengine/rivet@v0.24.0...v0.25.0

Rivet v0.24.0

What's Changed

• feat(serve): surface per-artifact lifecycle gaps in the artifacts API (REQ-244 pt1, #622) by @​avrabe in pulseengine/rivet#647

... (truncated)

Changelog

Sourced from pulseengine/rivet's changelog.

[0.27.0] - 2026-07-15

Added

• LSP enum-value + base-key completion (REQ-256, #546) — the language server completes a field's allowed values from the schema (e.g. status: → draft/proposed/…/accepted, sourced from schema.base_fields, never hardcoded) and the base artifact keys (id/type/title/status/tags/links/fields) at the artifact top level.

Fixed (variant hardening — a 4-persona review, DD-076: fail-loud over silent-pass)

• Constraints fail loud (REQ-257) — a feature-model constraint using a predicate the solver can't evaluate (e.g. (> asil-numeric 2)) previously silently passed; solve() now emits SolveError::UnevaluatableConstraint instead of a vacuous success.
• Binding + constraint linkage is validated (REQ-258, REQ-259) — rivet validate --model --binding now errors on a binding that maps a feature to a nonexistent artifact ID, and a constraint referencing a feature name not in the model now errors instead of being vacuously satisfied. Also fixes the committed-broken artifacts/variants/full-desktop.yaml (it selected features absent from the model) and widens the model's scope group so a composite CLI+dashboard variant is expressible.
• modify --set-field colon-space corruption (#687) — values are now quoted so a key: value-style field value no longer corrupts the YAML on write.

Docs

• Canonical feature-model attributes documentation (REQ-264, #546) — disambiguates the "attribute" overload (top-level attribute-schema: type declarations vs per-feature attributes: values), documents that there is no documentation field, and relabels the design/comparison docs shipped-vs-proposed.

[0.26.0] - 2026-07-11

Added

• Richer serve dashboard filtering (REQ-253, #674) — the /artifacts view now accepts a tags= filter (comma-separated; matches artifacts carrying all listed tags) and a full s-expression filter= predicate — the same language as rivet list --filter and the JSON API, e.g. (has-tag "safety"), (= status "approved"), (and (= type "requirement") (has-tag "stpa")). A filter input is added to the toolbar; the filter composes with the active variant scope and survives the type/status/sort/pagination controls. An unparseable filter narrows to nothing with an inline error rather than passing silently.
• rivet release check --variant (REQ-254, DD-075, #673) — checks a release against a variant's scope in one view: partitions release-tagged artifacts into in-scope (release ∩ variant), out-of-scope (tagged but excluded by the variant), and variant-only, then reports cuttability scoped to the intersection. Exits non-zero when not cuttable, or under --strict when any artifact is out-of-scope. The release-readiness predicate is now shared with rivet release status so the two cannot drift.

... (truncated)

Commits

• a97d168 Merge pull request #706 from pulseengine/release/v0.27.0
• a709feb chore(release): v0.27.0 — variant hardening (fail-loud) + LSP completion
• 173fedd fix(variant): validate binding artifact IDs + constraint feature names exist ...
• fc253d8 fix(variant): constraints fail loud instead of silently passing (REQ-257, DD-...
• 6a89ad4 docs(variant): canonical feature-model attributes documentation (REQ-264, DD-...
• 04810cd feat(lsp): enum-value + base-key completion (REQ-256, slice 2, #546) (#700)
• abcf1f6 plan(variant): file 4-persona review findings as DD-076 + REQ-257..266 (#701)
• 6751cc8 plan: REQ-255 — ingest ordeal certificates as re-checkable evidence (rivet#69...
• 790e4c6 fix(modify): quote --set-field values so a colon-space no longer corrupts the...
• c3f45f2 Merge pull request #692 from pulseengine/release/v0.26.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)