rivet externals are declared against a volume that does not exist — the federated half of the trace graph is never validated

[avrabe]

Summary

rivet.yaml declares six externals (kiln, meld, sigil, loom, gale, scry) each with a path: under /Volumes/Home/git/pulseengine/ — a volume that does not exist on at least one maintainer machine. That dead path: takes precedence over the git: fallback, so external resolution silently fails and rivet never resolves cross-repo traces-to links at all.

The tell is the counter, not the total:

config	result
as committed (dead path: present)	FAIL (50 errors, 188 warnings, **0 broken cross-refs**)
with the 6 dead path: lines stripped	FAIL (12 errors, 188 warnings, **12 broken cross-refs**)

0 broken cross-refs alongside 50 link errors is the signature: rivet was not resolving the federated graph, it was failing to load it. Remove the dead paths and it resolves — 38 of the 50 errors were config rot, and 12 are genuine dangling references that had been invisible behind them.

Evidence

• rivet sync works (git fallback): all 6 synced to .rivet/repos/.
• rivet lock fails: error: IO error: git rev-parse: No such file or directory (os error 2) — it runs git inside the declared path:.
• The targets are real. After sync, kiln:REQ_FUNC_014 is defined at .rivet/repos/kiln/safety/requirements/functional-requirements/REQ_FUNC_014.yaml:2, and gale:SWREQ-KILN-001 at .rivet/repos/gale/artifacts/phase2_kiln_integration.yaml:86. rivet still reported both as "does not exist" while the dead paths were in play.
• There is no rivet.lock in the repo, so externals are unpinned even in principle.

Two further gaps found alongside

1. jess and witness are referenced by traces-to links but are not declared as externals at all (2 and 1 references respectively). Those can never resolve, sync or no sync.
2. CI never runs rivet sync or rivet lock (no match in .github/workflows/). So the required Rivet Validation check validates only synth-local artifacts and skips every cross-repo link. Combined with the above, the federated half of the traceability graph is unvalidated in CI — a check that passes because it is not looking.

CI also pins rivet v0.23.0 while current is 0.32.0; the pin is deliberate (#229 — an unpinned rivet drifted the gate when 0.15.0 promoted a WARN to an ERROR), but nine minor versions is worth a look on its own.

Why this matters

This is the checkers were the defects class one level up, and it lands on traceability specifically — which v0.58 just started relying on, since release readiness is now a query over rivet statuses. A trace graph whose federated half is silently unresolved cannot support that.

Suggested shape

• Drop the path: entries, or make them conditional/optional so a missing local checkout falls back to git: instead of poisoning resolution.
• Commit a rivet.lock so externals are pinned.
• Declare jess and witness, or remove the links that reference them.
• Run rivet sync in the Rivet Validation job so the federated links are actually checked — and red-first: show the job failing on a deliberately dangling cross-repo ref before trusting it.
• Then triage the 12 genuine broken cross-refs the fix exposes.

Found while planning v0.59 (#1011). Not scoped into that release yet — filing so it is not lost.