feat(schema): warn when an embedded schema version drifts from a rivet.yaml pin (REQ-249)

[avrabe]

What

Adds a user-owned project.schema-pins map to rivet.yaml recording the expected version per schema. rivet validate compares each resolved schema version against its pin and warns on stderr when they drift.

This closes the silent-upgrade gap: an embedded-schema version bump (via rivet upgrade or a new binary) can change validation semantics out from under a project with no signal. A pin makes that drift loud.

Why a new map (DD-073)

.rivet-version already records scaffolded_from.schemas, but it is regenerated on rivet upgrade — so it tracks the current state, not the expected baseline, and can't serve as a pin. A user-owned map in rivet.yaml survives upgrades and is the thing the user reviews-and-bumps deliberately.

Behavior

warning: schema 'common' resolved to version 0.4.0 but rivet.yaml pins 0.3.0 (embedded) —
validation may have changed since the pin; review the schema diff then update
`project.schema-pins.common`, or vendor the schema to freeze it (REQ-249).

• Warnings go to stderr, so --format json on stdout stays machine-clean.
• No pins configured → no behavior change (empty map, zero warnings).
• Escalation to a hard error under a --strict flag is a deliberate follow-on slice.

Verification

• New unit test embedded::tests::schema_pin_drift_is_detected (pins vs provenance, sorted, only drift reported).
• cargo clippy --all-targets -- -D warnings clean.
• rivet validate → Result: PASS.

Implements: REQ-249
Refs: DD-073, FEAT-001

🤖 Generated with Claude Code

[github-actions]

📐 Rivet artifact delta

Change	Count
Added	1
Removed	0
Modified	1
Downstream impacted (depth ≤ 5)	0

Graph

graph LR
  REQ_249["REQ-249"]:::modified
  DD_073["DD-073"]:::added
  classDef added fill:#d4edda,stroke:#28a745,color:#155724
  classDef removed fill:#f8d7da,stroke:#dc3545,color:#721c24
  classDef modified fill:#fff3cd,stroke:#ffc107,color:#856404
  classDef overflow fill:#e2e3e5,stroke:#6c757d,color:#495057,stroke-dasharray: 3 3

Loading

Added

• DD-073

Modified

ID	Changes
REQ-249

📎 Full HTML dashboard attached as workflow artifact rivet-delta-pr-679 — download from the workflow run.

_{Posted by rivet-delta workflow. The graph shows only changed artifacts; open the HTML dashboard (above) for full context.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!