plan(v0.37): file REQ-327 — rivet cannot state what a release contains

artifacts/requirements.yaml

@@ -8491,3 +8491,14 @@ artifacts:
       created-by: ai-assisted
       model: claude-opus-5
       timestamp: 2026-09-06T00:00:00Z
+  - id: REQ-327
+    type: requirement
+    title: "rivet cannot state what a release contains, so its notes are hand-written and its supply-chain evidence goes unrecorded"
+    status: proposed
+    description: "Maintainer request, designed and grounded 2026-09-06. A release is currently described by hand: scope is re-typed from the release-scope query into CHANGELOG prose, and the notes have drifted from that query twice, caught only by diffing them mechanically. Meanwhile the release produces evidence that nothing records. AUTHORITATIVE GROUNDING: Automotive SPICE PAM v4.1 (VDA QMC), process SPL.2 Product Release, whose purpose is to control the release of a product to the intended customer. BP5 requires release approval before delivery; BP6 requires that each release is accompanied by a release note. Information item 11-03 Release note is the specification this feature should implement rather than anything invented here. It IDENTIFIES the set of functionalities provided, limitations in relation to the committed scope, known non-conformities, application parameters, configurations and variants, unique name and version of the release, added or removed functionalities, changed or improved functionalities, and documentation of resolved non-conformities. It INCLUDES intended area and environment of usage, impact to other components linked to the release, upstream or downstream compatibility, copyright and license information, result of verification and validation measures, approval for delivery by responsible roles, and dependencies to other linked products. Two of the four sections chosen with the maintainer BEFORE reading the PAM turn out to be mandated rather than optional: limitations in relation to the committed scope is the notes-versus-query diff already run by hand, and known non-conformities is the residuals section. The standard treats declared gaps as first-class release-note content, which is why a mock-up over real v0.36.0 data had an ABSENCE as its highest-signal line — external references, 0 of 10 declared. Three elements were missed and rivet already produces evidence for each: copyright and license information from the Cargo Deny licenses gate, configurations and variants from the existing variant subsystem, and approval by responsible roles from the existing review-signoff oracle which enforces reviewer identity distinct from author identity per GP 2.1.7 and GP 2.2.4. SECOND FINDING: rivet already ships supply-chain.yaml with a complete release model its own releases do not use — release-artifact (artifact-name, version, digest, signing-status of signed/unsigned/verified, artifact-type, contains sbom-component), build-attestation, and vulnerability (cve-id, severity, cvss-score, vuln-status, remediation). Every field maps to something v0.36.0 produced and discarded: a CycloneDX SBOM, a cosign bundle with pem and sig, per-asset SHA256 digests verified by hand, and fifteen cargo-audit ignore entries which are declared-unresolved vulnerabilities each carrying a written rationale. DECISION, maintainer, 2026-09-06: rivet EMITS release-artifact and vulnerability artifacts per release rather than only reporting over them, so its own supply-chain evidence becomes part of the trace and supply-chain.yaml is dogfooded by its author. More work, and considerably more honest. Linkage reuses the existing cited-source base field (uri, kind of file/url/github/oslc/reqif/polarion, sha256, last-checked) rather than a new directive; oslc and polarion cover Jira and DOORS. Links are NEVER inferred — an artifact without a cited-source renders as an explicit gap, because regexing issue numbers out of prose would both miss a Jira ticket and invent links from stray text. Output reuses the templates override pattern (embedded default, copy-to-project, diff for drift). BLOCKER to fix first: rivet list --format json exposes only id, links, status, title, type and the release field, so the mock-up had to parse raw YAML for cited-source and provenance and scrape coverage --tests text for evidence lines. NOT MODELLED anywhere yet, also produced by SPL.2: 11-04 product release package, 13-06 delivery evidence, 13-13 product release approval, and 18-06 product release criteria — the last being the conditions to be satisfied prior to authorizing delivery, which is what the release readiness query already computes informally. rivet is the first consumer."
+    release: v0.37.0
+    tags: [release, traceability, supply-chain, aspice]
+    provenance:
+      created-by: ai-assisted
+      model: claude-opus-5
+      timestamp: 2026-09-06T00:00:00Z