chore(deps): bump pulseengine/rivet from 0.35.0 to 0.36.0

[dependabot]

Bumps pulseengine/rivet from 0.35.0 to 0.36.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.36.0

What's Changed

• fix(scanner): read verifies markers from shell scripts (REQ-319, #870) by @​avrabe in pulseengine/rivet#872
• build(deps): bump wasmtime 47.0.3 -> 47.0.4 (RUSTSEC-2026-0269, -0268) by @​avrabe in pulseengine/rivet#875
• fix(yaml): diagnose multi-document YAML instead of dropping it (REQ-321) by @​avrabe in pulseengine/rivet#877
• fix(schema): resolve required-backlink inverses; let validate fail (REQ-322, #876) by @​avrabe in pulseengine/rivet#878
• fix(test): resolve the rivet binary at compile time in all 28 tests (REQ-314) by @​avrabe in pulseengine/rivet#881
• feat(commits): report artifacts a commit claims but never advanced (REQ-315) by @​avrabe in pulseengine/rivet#888
• fix(check): require real test evidence, not a matching name (REQ-306, REQ-295) by @​avrabe in pulseengine/rivet#889
• fix(ci): classify stalls and failures instead of guessing (REQ-317, REQ-316) by @​avrabe in pulseengine/rivet#890
• feat(coverage): let a project declare rules it does not model (REQ-320) by @​avrabe in pulseengine/rivet#893
• chore(release): v0.36.0 — every member is a signal that lied by @​avrabe in pulseengine/rivet#894

Full Changelog: pulseengine/rivet@v0.35.0...v0.36.0

Changelog

Sourced from pulseengine/rivet's changelog.

v0.36.0 collected signals that lied about the code. This release collects signals that lied about themselves — and three of them were defects in the very checks shipped to fix the previous ones. classify_stall named a cause it could not observe, in the code REQ-317 shipped one day earlier to stop exactly that. Its replacement then did it again, twice, by two different routes. A diagnostic is not exempt from the discipline it enforces.

One addition, and it is the one that makes this note itself checkable: rivet can now state what a release contains, instead of the scope being retyped by hand.

Added

• rivet release notes <version> (REQ-327, #900) — generates the release note from the artifact store and the commit trailers, implementing Automotive SPICE PAM v4.1 information item 11-03, which SPL.2.BP6 requires accompany each release. Until now the scope was re-typed by hand into CHANGELOG prose and had drifted from the release-scope query twice, caught only by diffing the two manually. Sections: identification, functionalities provided, limitations in relation to the committed scope, result of verification measures, and the commits since a base ref whose trailers name an artifact in this release. The note ends by naming the eight 11-03 elements rivet does not compute, each with the evidence it would need — a note that silently omits a required element is worse than one declaring the gap. #N tokens are reported as refs, never as closures: under squash-merge a subject's #N is usually the pull request, and the two are indistinguishable from the text.

Fixed

• rivet stamp destroyed provenance (REQ-337, #912) — set_provenance replaced the whole block, so every sub-field the caller did not pass was dropped. Measured on this repository with the documented hook invocation across 1026 artifacts: model deleted on 270, session-id on 4, timestamp rewritten on 575. The model field is the worse loss — the documented automatic invocation erased the field the documented manual one exists to set, and for a project shipping EU AI Act artifacts, which model generated an artifact is the provenance. Now merges; timestamp is create-only, matching its own definition as the time of creation.
• Release readiness counted other projects (REQ-338, #907) — a version label shared with a linked external project made a release permanently uncuttable, because the verdict depended on another project's schedule. Externals are now excluded from the verdict and reported separately. release notes had shipped with the same scoping and was listing another project's unverified work as this release's withheld scope.
• The liveness probe reported an outage that was not happening (REQ-342, #919) — a failed runner lookup was substituted with an empty pool, which the classifier read as every runner being down. The lookup needs the administration scope, not grantable to GITHUB_TOKEN, so it failed on every probe: every self-hosted stall reported pool-offline whatever its cause. A second route remained after the first fix — a non-empty error body survives an emptiness check — so the payload must now be a runner list.
• A dependency wait was reported as a capacity stall (REQ-325) — a job queued behind its needs returned hosted-starved while the fleet sat at

... (truncated)

Commits

• 0b8ba0f chore(release): v0.36.0 — every member is a signal that lied (#894)
• 6778c54 feat(coverage): let a project declare rules it does not model (REQ-320) (#893)
• 2cb99c6 fix(ci): classify stalls and failures instead of guessing (REQ-317, REQ-316) ...
• 16bff52 fix(check): require real test evidence, not a matching name (REQ-306, REQ-295...
• aab7cd3 feat(commits): report artifacts a commit claims but never advanced (REQ-315) ...
• 3bffda8 fix(test): resolve the rivet binary at compile time in all 28 tests (REQ-314)...
• f92cc8c fix(schema): resolve required-backlink inverses; let validate fail (REQ-322, ...
• 0111085 fix(yaml): diagnose multi-document YAML instead of dropping it (REQ-321) (#877)
• 1e9804b build(deps): bump wasmtime 47.0.3 -> 47.0.4 (RUSTSEC-2026-0269, -0268) (#875)
• 6254d59 fix(scanner): read verifies markers from shell scripts (REQ-319, #870) (#872)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)