# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 54 → 46 (-7.8)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 72 → 60 (-12.9)
- Architecture 84 → 84 (+0.1)
- Maturity 73 → 46 (-26.1)
- Readiness 48 → 50 (+2.5)
- Security 43 → 36 (-7.3)
- Performance 100 → 100 (+0.0)

## Resolved (75)

- Change coupling: __init__.py ↔ model.py (verl/models/mcore/__init__.py)
- Change coupling: __init__.py ↔ util.py (verl/models/mcore/__init__.py)
- Documentation: no project overview (examples/dppo_trainer/README.md)
- Documentation: no project overview (examples/gmpo_trainer/README.md)
- Duplicated block (11 lines × 2) (verl/models/mcore/loader.py)
- Duplicated block (11 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (11–12 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (12 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (13 lines × 2) (verl/workers/engine/fsdp/transformer_impl.py)
- Duplicated block (14 lines × 2) (verl/utils/qat/vllm_patch.py)
- Duplicated block (15 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (15–18 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (16 lines × 2) (verl/utils/megatron/tensor_parallel.py)
- Duplicated block (17 lines × 2) (verl/utils/tokenizer/continuous_token.py)
- Duplicated block (17–18 lines × 3) (verl/models/mcore/loader.py)
- Duplicated block (18–19 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (18–28 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (19 lines × 2) (scripts/legacy_model_merger.py)
- Duplicated block (20–21 lines × 2) (verl/utils/modelopt/vllm_modelopt_patch.py)
- Duplicated block (42–43 lines × 2) (verl/models/mcore/loader.py)
- …and 55 more

## New (103)

- ActorRolloutRefWorker.init_model (cyclomatic 16) (verl/workers/engine_workers.py)
- ActorRolloutRefWorker.update_weights (cognitive 17) (verl/workers/engine_workers.py)
- AgentLoopOutput.as_dict (cognitive 18) (verl/experimental/agent_loop/agent_loop.py)
- CannLinearCrossEntropy.forward (cognitive 19) (verl/utils/kernel/npu/cann_linear_ce.py)
- CannLinearCrossEntropy.forward (cyclomatic 19) (verl/utils/kernel/npu/cann_linear_ce.py)
- Duplicated block (10 lines × 2) (verl/utils/vllm/vllm_fp8_utils.py)
- Duplicated block (17 lines × 2) (verl/utils/qat/modelopt.py)
- Duplicated block (17 lines × 2) (verl/utils/tokenizer/continuous_token.py)
- Duplicated block (5 lines × 3) (verl/utils/vllm/vllm_fp4_utils.py)
- Duplicated block (8 lines × 2) (verl/utils/vllm/vllm_fp4_utils.py)
- Duplicated block (8–10 lines × 2) (verl/utils/vllm/vllm_fp4_utils.py)
- Fp8ConfigWeightQuantizer.__call__ (cognitive 23) (verl/utils/qat/compressed_tensors.py)
- High CVE: [GHSA redacted] (uv.lock)
- High vulnerability: [GHSA redacted] (uv.lock)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 83 more

## Changes since last survey

- 66 commits — 33 feature/other, 33 fixes

## By area

- .github/workflows — 12 commits
- examples/tpu — 9 commits
- verl/utils — 9 commits
- verl/trainer — 5 commits
- verl/workers — 4 commits
- docs/ascend_tutorial — 3 commits
- tests/utils — 3 commits
- tests/workers — 3 commits
- (root) — 2 commits
- docs/advance — 2 commits
- tests/checkpoint_engine — 2 commits
- tests/special_distributed — 2 commits
- verl/models — 2 commits
- docker/ascend — 1 commit
- docker/rocm — 1 commit
- docs/algo — 1 commit
- docs/examples — 1 commit
- docs/perf — 1 commit
- tests/experimental — 1 commit
- tests/special_npu — 1 commit

## Notable commits

- fix: [ci] fix: fix ascend ci (#8162)
- fix: [ci] fix: move nightly PPO CI back to Ascend A2 (#8148)
- fix: [ci] fix: set explicit model path for Ascend nightly jobs (#8157)
- fix: [ci] fix: set explicit model paths for Qwen3-30B nightly jobs (#8165)
- fix: [ckpt, hardware] fix: make checkpoint CPU offload device-agnostic (#8232)
- fix: [data] fix: Update TQ version and align config yaml (#8181)
- fix: [data] fix: correct enable_thinking_default YAML value and loss mask mismatch (#8086)
- fix: [doc] fix: change  ascend product name (#8073)
- fix: [fsdp] fix: copy offloaded shards in fsdp2_sharded_save_to_cpu (#8177)
- fix: [fsdp] fix: prevent parameter corruption during FSDP2 CPU offload (#8187)
- fix: [fsdp] fix: support save merged lora hf_model (#8180)
- fix: [hardware, doc] feat: TPU examples: public-package image, 2-chip GRPO smoke test, DP shard size from TP, SFT torchrun fixes (#8288)
- fix: [hardware, doc] fix: make examples/tpu/grpo run on main and add a v6e-4 RayCluster and Dockerfile (#8225)
- fix: [hardware, doc] fix: update TPU GRPO examples for Ray TPU_VISIBLE_CHIPS and Qwen3-4B 100-step stability (#8239)
- fix: [hardware, profile] fix: improve existing pytorch profiling to support other pytorch supported device (#8151)
- fix: [hardware, sft] fix: default TPU SFT script to torchrun and remove TPU_VISIBLE_CHIPS worker workaround (#8233)
- fix: [hardware] fix: pin tensordict and install orjson in the TPU GRPO image (#8292)
- fix: [megatron,worker] fix: offload actor parameters after disaggregated weight sync (#7631)
- fix: [megatron] fix: backward through chunked vocab-parallel entropy (#8195)
- fix: [megatron] fix: leave HybridDeviceOptimizer state untouched in optimizer offload (#8237) (#8286)
- …and 46 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)