Core concepts

The risk contract

risk-contract.yaml is the product primitive. It is the artifact GitLab CI enforces, the thing other tools explain, and the boundary AI cannot override.

Contract-first by design

Riven does not make the merge decision through a comment. The merge decision is the contract status plus the CI exit code.

What the contract records

The contract can include:

changed definitions
impacted callers
breaking-change reasons
recommended verification jobs
suggested reviewers from CODEOWNERS overlap
architecture findings such as new cycles or layer violations
deterministic risk score and factor breakdown
explicit static-analysis limits

Why it matters

Machine-readable. CI, MCP hosts, and downstream automation can consume it directly.
Explainable. Every failed merge can point to specific changed symbols and affected callers.
Portable. The same artifact is used by the CLI, GitLab CI, and MCP tools.
Safe for AI. AI can read the contract and act within it, but it cannot weaken it.

What AI can and cannot do

AI can:

explain the contract
draft remediation prose
build a remediation proposal
generate a candidate diff inside a bounded patch request
verify a candidate patch in a temporary worktree

AI cannot:

change status: fail into status: pass
invent missing verification coverage
pretend static limits do not exist
apply a patch without passing validation and sandbox verification

Read the contract honestly

When Riven says a merge is blocked, the useful question is not "can the agent talk its way out of this?" The useful question is "what contract evidence must change for this merge to become safe?"

Next: GitLab gate.