chore(deps): bump pulseengine/rivet from 0.27.0 to 0.29.0

[dependabot]

Bumps pulseengine/rivet from 0.27.0 to 0.29.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.29.0

What's Changed

• test(feature-model): fuzz the constraint solver (REQ-266) by @​avrabe in pulseengine/rivet#715
• fix(feature-model): don't mis-report a shared child as a cycle (REQ-269) by @​avrabe in pulseengine/rivet#716
• feat(serve): variant source-linkage slices a+b (REQ-265, DD-077) by @​avrabe in pulseengine/rivet#717
• feat(variant): disk-verify the source manifest, fail-loud (REQ-265c) by @​avrabe in pulseengine/rivet#719
• feat(schema): dev-native verification type so requirements reach verified (#721) by @​avrabe in pulseengine/rivet#723
• feat(export): --variant applies the per-variant field overlay (REQ-265d) by @​avrabe in pulseengine/rivet#728
• chore(release): v0.29.0 — variant source-linkage + V-model bridge by @​avrabe in pulseengine/rivet#729

Full Changelog: pulseengine/rivet@v0.28.0...v0.29.0

Rivet v0.28.0

What's Changed

• ci(toolchain): pin nightly to 2026-07-11 while upstream nightly ICEs (REQ-267) by @​avrabe in pulseengine/rivet#707
• plan(roadmap): sequence v0.28–v0.30 (variant P1 → source-linkage → CI resilience) by @​avrabe in pulseengine/rivet#708
• fix(serve): variant discovery surfaces parse errors + reads wrapped variant files (REQ-260, REQ-262) by @​avrabe in pulseengine/rivet#709
• fix(variant): surface feature-model attribute_warnings on the CLI (REQ-261) by @​avrabe in pulseengine/rivet#711
• ci(variant): gate PRs on variant + binding soundness (REQ-263) by @​avrabe in pulseengine/rivet#712
• chore(release): v0.28.0 — variant hardening P1 (silent-drops) by @​avrabe in pulseengine/rivet#713

Full Changelog: pulseengine/rivet@v0.27.0...v0.28.0

Changelog

Sourced from pulseengine/rivet's changelog.

[0.29.0] - 2026-07-21

Added

• Dev-native verification type (REQ-270, #721) — the dev schema declared the requirement-verification rule but shipped no type that could source a verifies link to a requirement, so type: requirement could never mechanically reach verified on any dev-only project. Adds a verification type with a required verifies → [requirement] link-field, so a lightweight project closes the right side of its own V without adopting ASPICE. Bumps dev@0.2.0 → 0.3.0.
• export --variant <NAME> (REQ-265d) — a variant-scoped compliance export. The variant's per-variant field overlay is baked into each artifact's top-level fields before export, across all formats (reqif, generic-yaml, gherkin, zola, and the html/single-page audit bundle) — no hand-translation of IDs into an s-expr --filter. Mirrors list --variant / query --variant.
• variant manifest disk-verifies source globs (REQ-265c) — every binding source: glob's base directory is checked against disk; a missing base warns loudly (stderr + JSON source_warnings), and --strict escalates it to a nonzero exit.

Fixed (variant hardening, continued)

• Shared child no longer mis-reported as a cycle (REQ-269) — a feature reachable through two parents (a diamond / DAG) was rejected as a cycle; validate_tree now tracks the current DFS path (recursion stack) instead of a global visited set, so a diamond loads while a genuine back-edge cycle is still rejected. Surfaced by REQ-266's coverage.
• serve variant scope no longer leaks externals (REQ-265b) — external artifacts (which have no binding to the project's feature model) are excluded from /artifacts under an active variant instead of appearing unscoped.
• External source links are honest (REQ-265a) — resolve_source_file returns no link for an out-of-project path rather than emitting a dead link the /source guard rejects.

Testing

• Constraint-solver property tests (REQ-266) — the proptest strategies now generate cross-tree constraints, fuzzing the solver's highest-risk paths (implies propagation, excludes, REQ-257's fail-loud gate) with an independent oracle that a green solve() never silently passes a violated constraint. Previously zero constraint coverage.

[0.28.0] - 2026-07-16

Fixed (variant hardening P1 — DD-076: broken config must fail loud, not present as absent)

• serve variant discovery surfaces parse errors (REQ-260) — a malformed, cyclic, or attribute-invalid feature model (or binding) used to be .ok()- swallowed into model: None, so resolve() reported "no feature model configured for this project" — actively misleading, since the model exists but is broken. The dashboard now renders a red "Feature model failed to load" banner with the parse diagnostic instead of presenting a broken config as an absent one.
• Unknown feature-attribute keys reach validate (REQ-261) —

... (truncated)

Commits

• 4621251 chore(release): v0.29.0 — variant source-linkage + V-model bridge (#729)
• 6a4753f feat(export): --variant applies the per-variant field overlay (REQ-265d) (#728)
• 8a013aa feat(schema): dev ships a native verification type so requirements can reach ...
• 3735bc2 feat(variant): disk-verify the source manifest, fail-loud on missing bases (R...
• 2df2fe4 feat(serve): variant source-linkage slices a+b — honest external links, no sc...
• 2ff1c09 fix(feature-model): don't mis-report a shared child as a cycle (REQ-269) (#716)
• ab9b24c test(feature-model): fuzz the constraint solver (REQ-266) (#715)
• 8abbb62 chore(release): v0.28.0 — variant hardening P1 (silent-drops) (#713)
• aab1c32 ci(variant): gate PRs on variant + binding soundness (REQ-263, DD-076) (#712)
• 961f3a3 fix(variant): surface feature-model attribute_warnings on the CLI (REQ-261, D...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)