feat(schema): ordeal-certificate artifact type (REQ-255, #693 Part 2)

[avrabe]

Closes #693 (Part 2 — the ordeal-certificate ingestion type).
Unblocked by pulseengine/ordeal#107 (ordeal v0.17.0 cert-bundle feature — ordeal-cert/v1 envelope with both content hashes verified inside Certificate::from_cert_v1 before the checker runs).

Summary

• New embedded schema schemas/ordeal-certificate.yaml declares the ordeal-certificate artifact type, the attests-transform link (source-types pinned to [ordeal-certificate]), and two validation rules that bake in the honest boundaries the upstream envelope enforces.
• Registered in rivet-core/src/embedded.rs (const + SCHEMA_NAMES + embedded_schema match arm) so downstream projects can add ordeal-certificate to their rivet.yaml schemas: list.
• rivet docs artifact-types/ordeal-certificate topic (inline in rivet-cli/src/docs.rs, mirroring the SUPPLY_CHAIN_DOC pattern) with the schema YAML + prose covering serialization contract, SAT boundary, v1 reader boundary, and a worked example.
• artifacts/requirements.yaml: REQ-255 flipped proposed → implemented, release: v0.31.0, description updated to note Part 1 (the --certify hook wiring rivet's variant solver into ordeal) stays out of scope for this PR and will be filed as a separate REQ.
• 13 integration tests in rivet-core/tests/ordeal_certificate_schema.rs.

Acceptance criteria (verbatim from the issue body) → how satisfied

• New embedded schema declares ordeal-certificate artifact type carrying produced-by (tool + version), checked-by (verifier + version), attests (claim + standards), cnf-sha256 + cnf-ref, proof-sha256 + proof-ref (LRAT for UNSAT / self-checked model for SAT), and a structured recheck block (command, expect-exit).
  → schemas/ordeal-certificate.yaml. Fields are FLAT (not nested mappings) so the s-expression validation-rule evaluator can read them — the envelope stays 1:1 with ordeal-cert/v1, just projected: produced-by-tool, produced-by-version, checked-by-verifier, checked-by-version, attests-claim (enum), attests-standards (list), cnf-sha256, cnf-ref, proof-sha256, proof-ref, recheck-command, recheck-expect-exit. Test: ordeal_certificate_declares_envelope_fields.

• Typed attests-transform link-field with allowed-target rule so rivet validate's link-target-type check catches misuse.
  → Link type declared with source-types: [ordeal-certificate]. Target-types stays permissive today because none of the cross-toolchain transform artifact types (variant, loom-rule, synth-codegen, sigil-overflow, spar-layout, gale-bitvector) exist as first-class rivet artifact types yet — see the note in the schema; adding them there flips the check on automatically. Tests: attests_transform_link_source_pinned_to_ordeal_certificate, attests_transform_is_required_on_ordeal_certificate.

• rivet validate treats a re-checked certificate as a verification link, not a claimed status; a verifies link to an ordeal-certificate whose recheck.command was run and exited 0 (recorded via verification-result or an equivalent field) counts toward coverage; a certificate whose recheck was never run does not.
  → V-ordeal-cert-needs-recheck (warning) — an ordeal-certificate MUST carry recheck-exit-code == "0" (the schema pins recheck-expect-exit to "0" via allowed-values). A certificate without a recheck stamp surfaces as unverified evidence. The recheck result lives in recheck-exit-code + recheck-ran-at + recheck-checked-by — the flat form of the AC's verification-result block. Tests: needs_recheck_rule_fires_when_recheck_exit_code_missing, needs_recheck_rule_fires_when_exit_code_differs, needs_recheck_rule_silent_on_rechecked_certificate.

• Honest SAT boundary baked into the schema: for attests.claim: variant-consistent (SAT), the proof-* fields hold the self-checked model — ordeal ships no independently re-checkable SAT witness yet (UNSAT is the certificate-carrying verdict).
  → Documented in the schema header (── SAT-witness honesty boundary ──) and in the docs topic. attests-claim allowed-values include variant-consistent / variant-inconsistent / verified-transform so the two are distinguishable in the graph. No schema-side rule mistakes a SAT model for LRAT.

• v1 reader boundary as an expected-error fixture: ordeal-cert/v1 is inline-payload-only — a bundle using cnf_ref / proof_ref indirection must surface as a legible Unsupported-class validation error.
  → V-ordeal-cert-v1-inline-only (error) fires when either cnf-ref or proof-ref is present. Mirrors Certificate::from_cert_v1's BundleError::Unsupported at the rivet ingest layer. Tests: v1_inline_only_rule_fires_when_cnf_ref_present, v1_inline_only_rule_silent_when_only_inline_hashes.

• Golden-file test: an ordeal-certificate artifact serializes / parses round-trip byte-identical; a link-target-type fixture demonstrates the attests-transform allowed-targets enforcement; a coverage-rule fixture demonstrates the "re-checked → counts" vs. "never re-checked → does not count" split.
  → ordeal_certificate_artifact_yaml_roundtrips structurally round-trips the example artifact through the real parse_generic_yaml loader (byte-identical would pin the serde_yaml emitter, which drifts across versions — structural equality is what actually protects the schema). The attests-transform source-side pin + required-link tests cover the link-target-type direction rivet can enforce today. The needs_recheck and v1_inline_only tests cover the coverage-split fixture.

• rivet docs topic explains the shape, the SAT boundary, and the recheck invocation contract, with ordeal-cert/v1 as shipped linked.
  → rivet docs artifact-types/ordeal-certificate — inline topic (following this project's docs convention where topics live in rivet-cli/src/docs.rs, not a filesystem .md). Links ordeal PR Supply chain integration: Sigil attestations + SBOM/AIBOM + Rivet traceability bridge #107, ordeal#67, rivet#693, and REQ-255.

• Commit trailers: Implements: REQ-NNN + Refs: ordeal#67, #693.
  → Implements: REQ-255 (the existing rivet-side REQ for exactly this feature — no new REQ needed since REQ-255 was filed for both parts of Certified feature-model / variant consistency via ordeal's SAT core (EU AI Act evidence) #693 and only Part 2 lands here). Refs: ordeal#67, ordeal#107, #693.

• Explicitly out of scope (Part 1, filed separately): the --certify flag on rivet release check --variant / rivet variant solve, CI wiring, rules_ordeal gate, UNSAT-core surfacing as a variant validate diagnostic.
  → Confirmed out of scope. REQ-255 description now notes Part 1 will be filed as a separate REQ when picked up.

Test plan

• cargo test -p rivet-core --test ordeal_certificate_schema — 13/13 pass
• cargo test -p rivet-cli --test docs_coverage — 8/8 pass (new docs topic doesn't break subcommand-coverage)
• cargo run -p rivet-cli -- docs artifact-types/ordeal-certificate — topic renders (schema YAML + prose)
• rivet validate — PASS (589 pre-existing warnings, unchanged; REQ-255 now shows as an implemented requirement in the same missing-downstream shape as its neighbors)
• cargo fmt --all --check clean
• cargo clippy -p rivet-core -p rivet-cli --tests -- -D warnings clean

Follow-ups (deliberately not in this PR)

• Part 1 (the --certify hook shelling rivet's variant solver into ordeal's SAT front-end) — separate REQ once picked up.
• Adding the cross-toolchain transform artifact types (variant, loom-rule, synth-codegen, sigil-overflow, spar-layout, gale-bitvector) as first-class rivet types so the attests-transform link's target-types check can enforce.
• Optional ordeal = { version = "0.17", features = ["cert-bundle"] } dependency behind a cert-bundle cargo feature if rivet ever wants to invoke UnsatBundle::recheck() in-process instead of shelling recheck-command.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📐 Rivet artifact delta

Change	Count
Added	0
Removed	0
Modified	1
Downstream impacted (depth ≤ 5)	0

Graph

graph LR
  REQ_255["REQ-255"]:::modified
  classDef added fill:#d4edda,stroke:#28a745,color:#155724
  classDef removed fill:#f8d7da,stroke:#dc3545,color:#721c24
  classDef modified fill:#fff3cd,stroke:#ffc107,color:#856404
  classDef overflow fill:#e2e3e5,stroke:#6c757d,color:#495057,stroke-dasharray: 3 3

Loading

Modified

ID	Changes
REQ-255

📎 Full HTML dashboard attached as workflow artifact rivet-delta-pr-744 — download from the workflow run.

_{Posted by rivet-delta workflow. The graph shows only changed artifacts; open the HTML dashboard (above) for full context.}

[avrabe]

CI status on 065dda7: Kani Proofs failed with exit code 143 (SIGTERM) — the self-hosted runner terminated the job at 05:48:01Z while rivet-core v0.30.0 was still compiling (##[error]The runner has received a shutdown signal). This is the shared-runner infrastructure symptom tracked in #509 / #567, not a defect in this PR's diff.

Every other check on this SHA is green (or intentionally skipped):

• Docs Check ✅ (the 0.17.0 allowlist entry from 065dda7 cleared the prior failure)
• Test ✅, Format ✅, Clippy ✅, YAML Lint ✅
• Miri (safety surface) ✅, Verus Proofs ✅, Rocq Proofs ✅
• Semver Checks ✅, Traceability ✅, Playwright E2E ✅
• Code Coverage ✅ (codecov: all modified lines covered), Mutation Testing (rivet-cli) ✅
• Cargo Deny ✅, Supply Chain (cargo-vet) ✅, Security Audit (RustSec) ✅, MSRV (1.89) ✅, Schema version bump ✅, Zola export smoke ✅

The bot integration can't re-run failed jobs from here (403 Resource not accessible by integration) — a maintainer re-run of Kani, or the next infra recovery on the affected self-hosted runner, should clear the check. Happy to push again if the outcome changes on re-run.

---

Generated by Claude Code