chore(deps): bump pulseengine/rivet from 0.32.0 to 0.34.0

[dependabot]

Bumps pulseengine/rivet from 0.32.0 to 0.34.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.34.0

What's Changed

• ci: add a CI Gate aggregation job so branch protection can actually bind (#796) by @​avrabe in pulseengine/rivet#825
• chore(cli): drop REQ/#/doc-path refs from --help; tighten top-level list (#812) by @​avrabe in pulseengine/rivet#814
• plan(v0.34): REQ-292 — dev verification needs steps/test-name/test-location (#748) by @​avrabe in pulseengine/rivet#785
• plan(v0.34): read the UI requirements, measure REQ-276, triage 3 more issues by @​avrabe in pulseengine/rivet#823
• ci(mutants): add diff-scoped rivet-core PR gate (advisory) (#816) by @​avrabe in pulseengine/rivet#828
• ci: cap every job's timeout-minutes (#822) by @​avrabe in pulseengine/rivet#824
• ci: attest the release binary on an ephemeral runner to earn SLSA L3 (#782) by @​avrabe in pulseengine/rivet#826
• fix(check-verification-evidence): scan the crate named by --manifest-path (#807 Defect 1) by @​avrabe in pulseengine/rivet#830
• fix(validate): dedupe overlapping sources + deterministic diagnostic order (#746) by @​avrabe in pulseengine/rivet#759
• fix(test): use CARGO_BIN_EXE_rivet in mcp_integration so release evidence builds (#293) by @​avrabe in pulseengine/rivet#834
• feat(cli): rivet context --stdout / --brief (#811) by @​avrabe in pulseengine/rivet#813
• fix(validate,coverage): close the silent-empty-load window (#808) by @​avrabe in pulseengine/rivet#818
• plan(v0.34): correct four stale statuses against shipped code; file 4 triage artifacts by @​avrabe in pulseengine/rivet#836
• chore(release): v0.34.0 — evidence you can check by @​avrabe in pulseengine/rivet#837

Full Changelog: pulseengine/rivet@v0.33.1...v0.34.0

Rivet v0.33.1

What's Changed

• ci(mutants): don't fail the cli gate when the diff has no cli mutants by @​avrabe in pulseengine/rivet#817
• fix(mutate): --set-field must replace a sub-key's full extent (#806) by @​avrabe in pulseengine/rivet#810
• plan(v0.34): triage untriaged issues into scope; correct v0.33.0 readiness by @​avrabe in pulseengine/rivet#819
• chore(release): v0.33.1 — P0 data-loss fix in the artifact write path by @​avrabe in pulseengine/rivet#820

Full Changelog: pulseengine/rivet@v0.33.0...v0.33.1

Rivet v0.33.0

What's Changed

• plan(v0.33): gate potency — make every required check able to fail by @​avrabe in pulseengine/rivet#772
• docs(design): harvest 2 durable notes from the stale sphinx-needs branch by @​avrabe in pulseengine/rivet#777
• ci(fmt): check every workspace in the Format gate, not just the root (#769) by @​avrabe in pulseengine/rivet#774
• ci(traceability): wire rivet check verification-evidence + kill weak-green empty scan (#770) by @​avrabe in pulseengine/rivet#776
• ci(mutants): make the mutation gate able to fail — path, selector, diff scope (REQ-288) by @​avrabe in pulseengine/rivet#773
• fix(yaml-hir): preserve plain-scalar field values that contain commas (#747) by @​avrabe in pulseengine/rivet#749
• fix(ci): mutation gate must not fail on an empty diff or a shallow base (REQ-288 follow-up) by @​avrabe in pulseengine/rivet#784
• fix(serve): externals precede locals in /artifacts pagination (#778) by @​avrabe in pulseengine/rivet#779
• ci(changes): fail closed + derive embedded-asset build inputs (#771) by @​avrabe in pulseengine/rivet#781
• fix(serve): don't silently swallow a failed external load (#778 follow-up) by @​avrabe in pulseengine/rivet#783
• chore(release): v0.33.0 — gate potency by @​avrabe in pulseengine/rivet#793
• fix(ci): un-vacuum the mutants-core gate; dedupe the v0.33.0 changelog section by @​avrabe in pulseengine/rivet#795
• docs(changelog): date v0.33.0 to its actual tag date by @​avrabe in pulseengine/rivet#815

Full Changelog: pulseengine/rivet@v0.32.0...v0.33.0

Changelog

Sourced from pulseengine/rivet's changelog.

[0.34.0] - 2026-08-20

Evidence you can check. Five places where a gate ran, reported green, and checked less than its name claimed — plus the silent-empty-load window where validate printed PASS over zero artifacts read.

Added

• rivet context --stdout / --brief (REQ-297, #811) — rivet context previously took no arguments and unconditionally wrote .rivet/agent-context.md, so a SessionStart hook that only wanted to read project state mutated the working tree. .rivet/ is gitignored in this repo but not in consumers, making the side effect invisible here and visible everywhere else, with an accidental commit one git add -A away. --stdout prints the document and writes nothing; --brief drops the schema/link/rule reference (stable material better fetched via rivet docs) and keeps the state a hook actually wants — project, artifact counts, coverage gaps, verdict. Note that the default path still writes the file — that is deliberate and asserted by a test, but it does mean the reported side effect persists unless you pass --stdout, so hooks should use the new flag rather than relying on any change to the default.

Changed

• --help no longer carries internal bookkeeping (REQ-298, #812) — help text is the surface a new user meets first, and rivet's carried REQ ids, GitHub issue numbers and in-repo doc paths that mean nothing outside this repository, with the trace entry reaching 405 characters on one line. Provenance belongs in the artifacts, which is exactly what rivet makes queryable (rivet get REQ-167); duplicating it into help just made the help the second-best copy. Every top-level entry is now a single sentence: rivet -h has zero REQ ids, zero issue references, and no line over 100 columns (longest is 97, trace down from 405). Longer prose moved into per-command --help long help. (The issue also asked to tighten the top-level list so the common path is legible; that was implemented as one-sentence-per-entry and the list is still 52 flat commands — the residual is tracked as REQ-307.)

Fixed

• check verification-evidence was blind to nested workspaces (REQ-236, #807) — a step of the shape cargo test --manifest-path <nested>/Cargo.toml <filter> reported "no test matching found" even though the test existed. --manifest-path was parsed only so its value would not be mistaken for the positional filter, and was then discarded. The flag already names precisely the directory that should be scanned; it is now threaded back through, widening the scan for that step only. One reporting project went from 14 false failures and exit 1 to green. (This is Defect 1 of two in #807; the check is still name-existence rather than command-reachability, so an empty stub can still satisfy it — tracked as REQ-306.)
• Overlapping sources made every id collide with itself (REQ-302, #746) — when two configured sources[] paths overlapped, every artifact loaded twice

... (truncated)

Commits

• 2503b4c chore(release): v0.34.0 — evidence you can check (#837)
• fce7e6c plan(v0.34): close the V on shipped scope; defer the UI trio to v0.35.0 (#836)
• b3bc0d3 fix(validate,coverage): close the silent-empty-load window (#808) (#818)
• 3e77bea feat(cli): rivet context --stdout / --brief (#811) (#813)
• 2418f89 fix(test): use CARGO_BIN_EXE_rivet in mcp_integration so release evidence bui...
• 562a3eb fix(validate): dedupe overlapping sources + deterministic diagnostic order (#...
• ebd253a fix(check-verification-evidence): scan the crate named by --manifest-path (#8...
• f510645 ci: attest the release binary on an ephemeral runner (#782); cap ci-gate (#82...
• 5695008 ci: cap every job's timeout-minutes (#822) (#824)
• 6b3be3c ci(mutants): add diff-scoped rivet-core PR gate (advisory) (#816) (#828)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)