plan(v0.38): make v0.38.0 a YAML maintenance and technical-debt release

[avrabe]

Maintainer decision after varve reported serde_yaml unmaintained (#930). The review-surface trio moves to v0.39.0 so v0.38.0 has one theme.

What #930 got right, and what I got wrong

serde_yaml 0.9 → 0.9.34+deprecated, archived, and it reads every artifact: artifacts/, safety/stpa-sec and safety/tool-qualification are all generic-yaml → GenericYamlAdapter → serde_yaml::from_str (formats/generic.rs:191).

I initially claimed artifacts loaded through rivet's own rowan CST and posted that as a correction on the issue. It was wrong and is retracted there. extract_schema_driven is reached from import_with_schema, a route the configured sources don't take. My own reproduction printed [WARN rivet_core::formats::generic] — naming the module — and I read it as confirmation because the conclusion was already formed.

Three implementations, and rivet already owns the write path

path	implementation	share
read artifacts	serde_yaml (archived)	711 (73%)
read stpa sources	yaml_cst.rs rowan CST	265 (27%)
edit / write	yaml_edit.rs — rivet's own, 2514 lines, 49 tests	all writes

(An earlier count said the rowan path was 0% — wrong; STPA files use hazards: as top-level keys and my counter only looked for artifacts:.)

That narrows the work: the one thing serde_yaml does that rivet doesn't already do is deserialize into typed structs. A serde Deserializer over an existing CST, not a parser project.

Corrected supply-chain finding

#930 recommends unmaintained = "deny". It would not surface serde_yaml — there's no unmaintained advisory, only RUSTSEC-2018-0005 (patched in 0.8.4). Testing that revealed something larger: CI runs cargo deny check bans licenses sources — the advisories check isn't run at all, so deny.toml's thirteen reasoned ignores are dead config, and cargo-audit sits outside CI Gate's needs. Locally check advisories exits 1 today on bitmaps, im, sized-chunks.

Scope

v0.38.0 — REQ-332, 334, 343, 345, 346, 347, 348
→ v0.39.0 — REQ-333, 335, 336, plus REQ-252 out of backlog (rowan publication taken next)

REQ-349 records the varve handoff. The blocker found while planning it — rivet's CST sits on a permanent maintenance fork of rowan, so a handoff hands varve the fork it declined — was resolved by the maintainer: the fork is ours, a different proposition from forking an abandoned third-party crate. The handoff doesn't wait on crates.io. What survives is the crate boundary: consolidate with no rivet-CLI types crossing it, so extraction is later a move rather than a rewrite.

gate	exit
fmt / clippy -D warnings (1.97.0)	0 / 0
cargo test --workspace	0 — 2368 passed
cargo test -p rivet-cli --test cli_commands	0 — 213 passed
validate / docs check / yamllint / diagnose_test.sh	0

Refs: FEAT-001

[github-actions]

📐 Rivet artifact delta

Change	Count
Added	4
Removed	0
Modified	0
Downstream impacted (depth ≤ 5)	0

Graph

graph LR
  REQ_346["REQ-346"]:::added
  REQ_347["REQ-347"]:::added
  REQ_348["REQ-348"]:::added
  REQ_349["REQ-349"]:::added
  classDef added fill:#d4edda,stroke:#28a745,color:#155724
  classDef removed fill:#f8d7da,stroke:#dc3545,color:#721c24
  classDef modified fill:#fff3cd,stroke:#ffc107,color:#856404
  classDef overflow fill:#e2e3e5,stroke:#6c757d,color:#495057,stroke-dasharray: 3 3

Loading

Added

• REQ-346
• REQ-347
• REQ-348
• REQ-349

📎 Full HTML dashboard attached as workflow artifact rivet-delta-pr-931 — download from the workflow run.

_{Posted by rivet-delta workflow. The graph shows only changed artifacts; open the HTML dashboard (above) for full context.}