chore(deps): bump pulseengine/rivet from 0.30.0 to 0.32.0

[dependabot]

Bumps pulseengine/rivet from 0.30.0 to 0.32.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.32.0

What's Changed

• plan(weak-green): REQ-284/285/286 — docs truth-drift + docs-check hardening + release-status loudness by @​avrabe in pulseengine/rivet#763
• build(deps): wasmtime 45→47 (fixes RUSTSEC-2026-0222) + justify-ignore rkyv by @​avrabe in pulseengine/rivet#762
• fix(mutate): modify --add-tag drops the WHOLE FILE when a tag needs quoting (REQ-287, P0 data loss) by @​avrabe in pulseengine/rivet#765
• docs(fix): correct 8 embedded-doc snippets that contradict the binary (REQ-284) by @​avrabe in pulseengine/rivet#764
• chore(release): v0.32.0 — weak-green hardening + mutation reliability + security by @​avrabe in pulseengine/rivet#766
• chore(trace): flip REQ-284 proposed → implemented (clean-room pre-tag fix) by @​avrabe in pulseengine/rivet#767

Full Changelog: pulseengine/rivet@v0.31.0...v0.32.0

Rivet v0.31.0

What's Changed

• feat(schema): ordeal-certificate evidence artifact type (#693 Part 2, ordeal#67) by @​avrabe in pulseengine/rivet#743
• fix(verify): verification-evidence no longer false-errors on nextest -E filtersets (REQ-280, v0.30.1) by @​avrabe in pulseengine/rivet#757
• feat(validate): --strict compliance-gate mode (REQ-283, downstream Ford/linc-mesh) by @​avrabe in pulseengine/rivet#758
• chore(release): v0.31.0 — filterset fix + validate --strict + ordeal-certificate by @​avrabe in pulseengine/rivet#760

Full Changelog: pulseengine/rivet@v0.30.0...v0.31.0

Changelog

Sourced from pulseengine/rivet's changelog.

[0.32.0] - 2026-08-05

Weak-green hardening + mutation reliability + security. This release began as a deliberate audit of rivet's own "green that proves less than it appears."

Fixed

• P0 data loss: rivet modify --add-tag/--remove-tag could drop the whole file (REQ-287) — the tag flow list was re-emitted without quoting individual tags (unlike the hardened set-field/add paths). A tag carrying a YAML flow indicator — e.g. a legitimately-quoted "release: v1.0" read back from the store — was re-emitted bare, turning the flow list into a map so the WHOLE file failed to parse and every artifact in it silently vanished, while modify exited 0 reporting success. A benign, unrelated --add-tag was enough to trigger it. Each tag is now quoted via yaml_quote_inline_scalar; a regression test guards it. (Found by a mutation-path stress audit that otherwise cleared set-field/link/unlink/sql UPDATE/add as faithful.)
• Embedded docs no longer contradict the binary (REQ-284) — a docs countercheck found 8 truth-drifts that rivet docs check (token hygiene only) passed clean: the json-output doc claimed a {command, data:{…}} envelope no command emits (payload keys are top-level); three diagnostics docs used modify --field (the flag is --set-field); known-type used a non-existent modify --type; broken-link used a wrong add signature; unknown-link-type pointed at a non-existent rivet docs links topic (it is rivet schema links); and a coverage jq recipe used a stale .entries[] key (.rules[]).

Security

• wasmtime + wasmtime-wasi 45 → 47 — clears RUSTSEC-2026-0222 (stores can mix up type indices between engines) in the host wasm seam. rkyv's RUSTSEC-2026-0235 is a justified cargo-audit ignore: it is an optional feature of rust_decimal that rivet does not enable (never compiled into any binary).

[0.31.0] - 2026-08-05

Added

• rivet validate --strict — compliance-gate mode (REQ-283) — validate PASS proves link integrity and required-field presence, but by default says nothing about field values or names: a value outside a schema allowed-values enum is only a Warning, and an undeclared field name only Info, so the gate exits 0 over both (the status field's enum was uniquely an Error — an asymmetry). --strict promotes allowed-values and unknown-field diagnostics to errors so CI can enforce field-value/name correctness. Opt-in by design — a project may carry pre-existing violations, so the default stays lenient (same rationale as --strict-orphans). A persistent rivet.yaml validate.strict switch is a planned follow-on. Reported downstream.
• ordeal-certificate evidence artifact type (REQ-277, #693 Part 2, ordeal#67) — new embedded schema schemas/ordeal-certificate.yaml describing an ordeal-cert/v1 bundle (ordeal v0.17.0, cert-bundle feature): produced-by / checked-by tool blocks, attests-kind/attests-claim/attests-standards, cnf-sha256/proof-sha256 content addressing, and a structured recheck block (command, expect-exit). A typed attests-transform link-field

... (truncated)

Commits

• ec436b8 chore(trace): flip REQ-284 proposed -> implemented (docs fixes shipped in #76...
• 5c4b7a0 chore(release): v0.32.0 — weak-green hardening + mutation reliability + secur...
• d2eff3f docs(fix): correct 8 embedded-doc snippets/claims that contradict the binary ...
• df78062 fix(mutate): modify --add-tag no longer drops the whole file when a tag needs...
• 7619b0d build(deps): bump wasmtime 45->47 (fixes RUSTSEC-2026-0222); justify-ignore r...
• e1a539f plan(weak-green): file REQ-284/285/286 from the docs countercheck + release-s...
• 2129652 chore(release): v0.31.0 — nextest-filterset fix + validate --strict + ordeal-...
• 09a3eb2 feat(validate): --strict compliance-gate mode escalates field-value/name lint...
• 71c7a84 fix(verify): check verification-evidence no longer false-errors on nextest -E...
• 3d03ee3 feat(schema): ordeal-certificate evidence artifact type (#693 Part 2) (#743)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)