release: v0.11.0 — offline verification, real and lightweight

[avrabe]

Cuts v0.11.0. rivet release status v0.11.0 → cuttable, all 3 requirements accepted.

Ships

• REQ-23 / airgapped: AirGappedVerifier::verify_crypto is a stub — offline keyless verification does not work end-to-end #219 — real offline keyless verification (delegates to tested primitives, anchored to the provisioned TrustBundle; the missing Rekor body-binding was caught on review — wsc verify --keyless accepts tampered WASM (signed-payload byte flip not detected) #135 UCA-2 — and added). Merkle inclusion + SCT explicitly not-verified offline.
• REQ-24 / dsse: pure-offline DSSE verify drags in the full 179-crate wsc dependency tree #218 — wsc-dsse, a no_std DSSE crate (builds for thumbv7em-none-eabi); wsc re-exports it, public API unchanged.
• REQ-25 / MC/DC coverage for verification functions via witness (WASM harness) #128 — verify-core's coverable MC/DC decision → full coverage; witness baseline 5→3; residual documented (witness gate: ^src/ scoping counts inlined std read_exact decisions #241).

Release mechanics

Version 0.10.0 → 0.11.0 across Cargo.toml, MODULE.bazel, BUILD.bazel VERSION, all internal pins (incl the new wsc-dsse), Cargo.lock. scripts/publish.rs publishes wsc-dsse before wsc.

Note for crates.io: wsc-dsse is a new name not yet on the registry — like wsc-verify-core at v0.10.0, it needs a one-time token bootstrap (Trusted Publishing can't create a nonexistent crate). I'll bootstrap it before the tag so the armed OIDC publish skips it (fail-safe) and publishes the rest.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!