[avrabe]

Follows #500 (the pin inventory in #501).

Change

• release-readiness.yml: RIVET_VERSION v0.22.0 → v0.40.0, the version the PR traceability gate uses.
• compliance.yml: stays on v0.22.0, with a comment explaining why.

Measured before changing

rivet release status (the tagging gate), 0.22.0 vs 0.40.0, run from the repository root:

• Shipped releases: identical verdict and exit code for every release from v0.49.0 to v0.63.0. v0.63.0 is cuttable under both with the same 10 artifacts. 0.40 is not stricter on any shipped release.
• Empty scope: a release with no scoped artifacts passes under 0.22 (exit 0) and fails under 0.40 (exit 1). A version bump with nothing scoped no longer passes vacuously.

Compliance report, why it stays on 0.22.0:

• Unchanged parts: the v0.40.0 action runs the same commands, and its new inputs are optional. Both versions export 563 artifacts at 86.4% coverage.
• What changed upstream: its Validate step now fails the job when rivet validate fails (rivet#953).
• Why that fails on meld: under 0.40, meld's rivet validate exits 1 with 43 cited-source must be a mapping with uri/kind keys errors. meld writes cited-source as a list, and 10 artifacts cite two sources, which a single mapping cannot hold. Filed as cited-source rejects a list of citations: an artifact that cites two sources cannot validate under 0.40 rivet#1106.
• The PR ratchet (validate --new-since) does not see these 43 errors, because they predate any change under review.

Both workflow files parse, and actionlint passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}