# Changelog

## Score

- CAI 30 → 30 (+0.1)
- Rubric changed (rubric-2026.09.10 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 67 → 67 (-0.3)
- Architecture 46 → 48 (+1.2)
- Maturity 83 → 83 (+0.0)
- Readiness 42 → 36 (-5.6)
- Security 38 → 47 (+9.1)
- Event-Driven 10 → 10 (+0.0)
- Event Sourcing 100 → 100 (+0.0)
- Accessibility 68 → 67 (-0.7)
- Performance 69 (new)

## Resolved (475)

- ActorHandleRaw.#sendActionNow (cognitive 31) (rivetkit-typescript/packages/rivetkit/src/client/actor-handle.ts)
- ActorHandleRaw.#sendActionNow (cyclomatic 19) (rivetkit-typescript/packages/rivetkit/src/client/actor-handle.ts)
- Change coupling: napi-runtime.ts ↔ wasm-runtime.ts (rivetkit-typescript/packages/rivetkit/src/registry/napi-runtime.ts)
- Critical CVE: [CVE redacted] (pnpm-lock.yaml)
- Critical CVE: [CVE redacted] (pnpm-lock.yaml)
- Critical CVE: [CVE redacted] (pnpm-lock.yaml)
- Critical CVE: [CVE redacted] (pnpm-lock.yaml)
- Critical CVE: [CVE redacted] (pnpm-lock.yaml)
- Critical CVE: [CVE redacted] (pnpm-lock.yaml)
- Critical CVE: [CVE redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- DatabaseKv::revive_workflows_inner (cognitive 16) (engine/packages/gasoline/src/db/kv/debug.rs)
- Duplicated block (10 lines × 2) (engine/packages/gasoline/src/db/kv/debug.rs)
- Duplicated block (10 lines × 2) (engine/packages/universaldb/src/driver/rocksdb/transaction_task.rs)
- Duplicated block (10 lines × 2) (engine/sdks/rust/envoy-protocol/src/versioned/v7_to_v6.rs)
- Duplicated block (10 lines × 2) (engine/sdks/rust/envoy-protocol/src/versioned/v7_to_v8.rs)
- Duplicated block (12 lines × 2) (engine/sdks/rust/envoy-protocol/src/versioned/v7_to_v6.rs)
- Duplicated block (13 lines × 2) (engine/packages/universaldb/src/driver/postgres/database.rs)
- Duplicated block (13 lines × 4) (engine/packages/pegboard-gateway2/src/shared_state.rs)
- …and 455 more

## New (320)

- ActorConnRaw.#handleOnClose (cyclomatic 18) (rivetkit-typescript/packages/rivetkit/src/client/actor-conn.ts)
- ActorHandleRaw.#sendActionAttempts (cognitive 31) (rivetkit-typescript/packages/rivetkit/src/client/actor-handle.ts)
- ActorHandleRaw.#sendActionAttempts (cyclomatic 19) (rivetkit-typescript/packages/rivetkit/src/client/actor-handle.ts)
- Change coupling: actor_context.rs ↔ telemetry.ts (rivetkit-typescript/packages/rivetkit-napi/src/actor_context.rs)
- Change coupling: lib.rs ↔ napi-runtime.ts (rivetkit-rust/packages/rivetkit-core/src/lib.rs)
- Change coupling: telemetry.rs ↔ telemetry.ts (rivetkit-rust/packages/rivetkit-core/src/telemetry.rs)
- Change-coupling hub: wasm-runtime.ts → context.rs, lib.rs, napi-runtime.ts (rivetkit-typescript/packages/rivetkit/src/registry/wasm-runtime.ts)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- DatabaseKv::inspect_missing_init_state (cognitive 25) (engine/packages/gasoline/src/db/kv/repair.rs)
- DatabaseKv::inspect_missing_init_state (cyclomatic 22) (engine/packages/gasoline/src/db/kv/repair.rs)
- Duplicated block (10 lines × 2) (engine/sdks/rust/envoy-protocol/src/versioned/v6_to_v5.rs)
- Duplicated block (10 lines × 2) (rivetkit-swift/Sources/RivetKitClient/ActorConnection.swift)
- Duplicated block (10 lines × 2) (rivetkit-swift/Sources/RivetKitClient/ActorConnection.swift)
- Duplicated block (11 lines × 7) (rivetkit-swift/Sources/RivetKitSwiftUI/ActorObservable.swift)
- Duplicated block (11–12 lines × 3) (engine/packages/api-public/src/actors/create.rs)
- Duplicated block (12 lines × 2) (engine/packages/universaldb/src/driver/rocksdb/transaction_task.rs)
- Duplicated block (12 lines × 4) (engine/sdks/rust/envoy-protocol/src/versioned/v6_to_v5.rs)
- Duplicated block (13 lines × 2) (engine/packages/depot/src/compaction/companion.rs)
- …and 300 more

## Changes since last survey

- 88 commits — 60 feature/other, 28 fixes

## By area

- frontend/src — 18 commits
- rivetkit-typescript/packages — 14 commits
- engine/packages — 12 commits
- rivetkit-rust/packages — 10 commits
- (repo) — 5 commits
- examples/docs — 5 commits
- docs/actors — 4 commits
- docs/general — 4 commits
- (root) — 3 commits
- docs-internal/engine — 3 commits
- engine/sdks — 3 commits
- docs/api — 2 commits
- .github/workflows — 1 commit
- container-runner/src — 1 commit
- docs/content — 1 commit
- examples/jwt-better-auth — 1 commit
- frontend/vite.config.ts — 1 commit

## Notable commits

- fix: fix(auth-jwt): allow Guard startup during Epoxy v4 rollout
- fix: fix(container-runner): propagate fallible serve config parsing
- fix: fix(depot): import BucketId in the inline compaction workflow tests
- fix: fix(envoy): replay terminal actor events after reconnect
- fix: fix(examples): stop showing unverified JWT decoding as verification
- fix: fix(frontend): allow the sandbox portal hostname in the dev server
- fix: fix(frontend): decode region restarted time from operator boot id
- fix: fix(frontend): enforce dns-safe cluster names in byoc create form
- fix: fix(frontend): poll byoc cluster regions on a 5s interval
- fix: fix(frontend): show product picker note under the step title instead of below the grid (#5742)
- fix: fix(frontend): stop double-counting compute in paid-plan bill totals
- fix: fix(frontend): use cloud namespace for onboarding deploy command
- fix: fix(frontend): use services pool name in managed services upsert
- fix: fix(pegboard-envoy): use async scc methods so actor stop cannot deadlock the envoy command stream
- fix: fix(pegboard-gateway): forward request ray id to actors
- fix: fix(rivetkit): add trace ids to logs written inside a workflow
- fix: fix(rivetkit): disable services in driver test runtimes
- fix: fix(rivetkit): finish a step span after its result is written
- fix: fix(rivetkit): log resolved envoy version at startup (#5785)
- fix: fix(rivetkit): sync Rust env parsing with TypeScript
- …and 68 more