Stack for rivet-dev/rivet

• #5475 fix(rivetkit-core): stop scrubbing actor/not_found error mes … 👈
• main

Get stack: forklift get 5475
Push local edits: forklift submit
Merge when ready: forklift merge 5475

_{change nmzoutkq}

Review

Small, well-scoped fix. framework_error_status in registry/http.rs already mapped ("actor", "not_found") → 404 and ("actor", "method_not_allowed") → 405, but public_error_status_code in error.rs (which gates client_error_message/client_error_metadata via is_client_error_public) was missing both pairs. The HTTP status line was correct, but the response body message/metadata was getting scrubbed to the generic internal-error message; this fix aligns the two.

Checked the field data that becomes newly public for both codes:

• ActorRuntime::NotFound { resource, id } — route path or actor id, both already known to the caller (its the URI they requested / the actor they are addressing). Not sensitive.
• MethodNotAllowed { method, path } — echoes the callers own request method/path. Not sensitive.

No load-bearing lifecycle logic is touched, and the change is consistent with the layering rule in rivetkit-core/CLAUDE.md ("public HTTP status promotion for bridged runtime errors belongs in error.rs::public_error_status_code").

One more sibling gap in the same class of bug

framework_error_status also maps ("actor", "invalid_request") => StatusCode::BAD_REQUEST (registry/http.rs:1118), and this code is actually thrown (InvalidHibernatableConnectionId in actor/connection.rs:55-65, plus several invalid_request errors in registry/inspector.rs). But ("actor", "invalid_request") is still absent from public_error_status_code in this diff, so that errors message/metadata still gets scrubbed to the generic internal-error placeholder even though the wire status is correctly 400. Same root cause as the two cases this PR fixes; worth folding in here or as an immediate fast-follow so the drift does not get fixed one code at a time.

Test coverage still missing

No regression test accompanies this fix. tests/modules/action_dispatch_error.rs already has a directly analogous case (preserves_public_error_message_for_client_boundary, using actor/action_not_found) that this could mirror for actor/not_found and actor/method_not_allowed (and actor/invalid_request if that is folded in). Since the root cause here was exactly "the status-code map and the public-message map silently drifted apart," a small test locking public_error_status_code("actor", "not_found") == Some(404) and public_error_status_code("actor", "method_not_allowed") == Some(405) (or better, asserting client_message() returns the real message for these codes) would catch future drift between the two maps.

Minor (non-blocking) follow-up

registry/http.rs::framework_error_status and error.rs::public_error_status_code are two separate hand-maintained match statements over the same (group, code) space, which is exactly how this bug happened (and how the invalid_request gap above happened too). Not asking for a rewrite in this small fix, but consider having framework_error_status call into public_error_status_code for the codes they share (falling back to its own status only where public_error_status_code returns None, e.g. the internal-error default), so the two cannot drift apart again.

Nothing else to flag. The change is minimal and has no other security implications.

🚅 Deployed to the rivet-pr-5475 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
frontend-cloud	😴 Sleeping (View Logs)	Web	Jul 26, 2026 at 12:28 pm
website	😴 Sleeping (View Logs)	Web	Jul 25, 2026 at 9:17 am
frontend-inspector	😴 Sleeping (View Logs)	Web	Jul 25, 2026 at 5:05 am
kitchen-sink	😴 Sleeping (View Logs)	Web	Jul 25, 2026 at 4:44 am
ladle	✅ Success (View Logs)	Web	Jul 23, 2026 at 8:49 pm
mcp-hub	✅ Success (View Logs)	Web	Jul 23, 2026 at 8:48 pm