feat: v0.12.0 — close the graph, make claims mechanical

.github/workflows/ci.yml

@@ -56,5 +56,32 @@ jobs:
           GH_TOKEN: ${{ github.token }}
       - name: rivet validate
         run: rivet validate
+      - name: rivet check verification-evidence (anti-rot)
+        # A renamed or deleted test named in a verification artifact goes
+        # red here instead of leaving a requirement silently "verified"
+        # (REQ-VGATE-001).
+        run: rivet check verification-evidence
+      - name: claim-check
+        # Load-bearing doc claims must keep their evidence (REQ-CLAIM-001).
+        run: python3 tools/claim-check.py
       - name: coverage report (informational)
         run: rivet coverage || true
+
+  mutants:
+    name: cargo mutants (trust-critical gate)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: mutants
+      - name: Install cargo-mutants
+        run: cargo install --locked cargo-mutants
+      - name: Mutate the trust-critical modules — zero survivors required
+        # The org gate (REQ-MUTATE-001, rivet's mutants-cli pattern): the
+        # modules that hold the trust decisions must kill every mutant.
+        # The nightly workflow covers the full workspace, advisory.
+        run: |
+          cargo mutants --no-shuffle             -f crates/varve-core/src/rollback.rs             -f crates/varve-core/src/layer.rs             -f crates/varve-core/src/platform.rs             -f crates/varve-core/src/verify.rs             -f crates/varve-core/src/pin.rs             -f crates/varve-core/src/realm.rs

.github/workflows/mutants.yml

@@ -0,0 +1,42 @@
+# Nightly full-workspace mutation run — advisory tier of REQ-MUTATE-001.
+# Adapted from pulseengine/rivet's templates/cargo-mutants/mutants.yml.
+# The per-PR gate (ci.yml `mutants` job) covers the trust-critical modules
+# with zero survivors; this covers everything else and preserves evidence.
+
+name: Mutants
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  mutants:
+    name: cargo mutants (full workspace, advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: mutants-nightly
+      - name: Install cargo-mutants
+        run: cargo install --locked cargo-mutants
+      - name: Full-workspace mutation run
+        # Advisory: report and preserve evidence; the trust-critical gate
+        # lives in ci.yml and is required.
+        run: cargo mutants --no-shuffle || true
+      - name: Upload mutation evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: mutants-report-${{ github.run_id }}
+          path: mutants.out
+          retention-days: 30

CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## v0.12.0 — 2026-08-08
+
+Close the graph, make claims mechanical (REQ-VGATE-001 + REQ-MUTATE-001
++ REQ-CLAIM-001 verified) — the 2026-08-08 audit's findings, fixed.
+
+- The requirement→test graph is CLOSED: verification artifacts with
+  `verifies` links for all 21 requirements, each naming its concrete
+  tests; `rivet check verification-evidence` (76 named steps, all
+  audited against sources) gates CI so renamed/deleted tests go red
+- Mutation testing is a GATE: cargo-mutants per-PR over the six
+  trust-critical modules (rollback, layer, platform, verify, pin,
+  realm) with zero survivors required, nightly full-workspace advisory
+  (org template). The first run proved the audit right: 33 surviving
+  mutants found and killed — including the entire civil-date
+  arithmetic of the staleness check and wrong-length-but-pure-hex
+  key/digest acceptance in pin and realm parsing
+- Claim-check: claims.yaml binds seven load-bearing doc claims to
+  named tests/files/workflow steps; tools/claim-check.py gates CI
+- Rivet debt paid: eight missing design decisions (DD-010..017)
+  authored with their real rationale, schema-enum and id fixes —
+  `rivet validate` reached zero warnings for the first time
+- varve#7 fixed: pin errors no longer print their cause twice
+
 ## v0.11.0 — 2026-08-08
 
 Portable wasm entries + layer runners (REQ-RUNNER-001 verified).

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/varve", "crates/varve-core"]
 
 [workspace.package]
-version = "0.11.0"
+version = "0.12.0"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/pulseengine/varve"