feat(release): v0.18.0 — TR-030 rivet ingestion demonstrated; cosign-signed checksums (#116)

[avrabe]

What

Closes the v0.18.0 scope (rivet release status v0.18.0: 6/6 verified, cuttable) and rolls the version.

TR-030 — rivet ingestion of ordeal-cert/v1, demonstrated against a released rivet

rivet v0.31.0/v0.32.0 ship the ordeal-certificate artifact type (rivet#693 Part 2 / rivet PR #743). The new examples/rivet_ingestion.rs (VER-029):

1. live solve (prove_equiv mul-by-2 vs shl-1) → checker-validated UNSAT certificate;
2. to_cert_v1 → bundle; from_cert_v1 re-ingestion (hashes verified before parse) + recheck() — PASS;
3. structurally tampered proof and problem payloads both rejected at ingestion (HashMismatch) before any recheck;
4. emits a fixture with the bundle's own recorded sha256s: rivet 0.32.0 validate exits 0 (PASS, 0 warnings); stripping verification-result: pass flips it to exit 1 naming V-ordeal-cert-recheck-gates-verifies.

Recorded as VE-022/VV-044; TR-030 and FEAT-015 promoted via rivet verify.

#116 — keyless cosign signing of release checksums (TR-033, varve)

release.yml now signs SHA256SUMS.txt via Sigstore keyless OIDC (org Track A, mirrors synth), publishing .cosign.bundle/.sig/.pem. The create-release job already had id-token: write. Verified per TR-033's criteria against the first signed release (v0.18.0); varve re-add is then a one-liner on their side.

CI gate gap closed

No CI job ever enabled cert-bundle — the cert_bundle test module and required-features examples were never compiled in CI. The oracle job now carries cert-bundle.

Release roll

0.17.0 → 0.18.0 (workspace + ordeal-lrat pin) + changelog dated 2026-08-08.

Verification (local, all exit 0)

• cargo fmt --check, clippy --all-targets (default and cert-bundle) — clean
• cargo test --all — 186 passed; --features cert-bundle cert_bundle — 5 passed
• example run 4/4 PASS + rivet --project … validate PASS (0 warnings) on the emitted fixture
• rivet validate --skip-external-validation PASS; rivet release status v0.18.0 cuttable

🤖 Generated with Claude Code

https://claude.ai/code/session_01EBJ6kdJ16E3hnsBbq9Lwf1