rivet-dev · jjanella · Aug 24, 2026 · Aug 24, 2026 · Aug 24, 2026 · Aug 24, 2026
diff --git a/.direnv/flake-profile b/.direnv/flake-profile
@@ -0,0 +1 @@
+flake-profile-2-link
diff --git a/.direnv/flake-profile-2-link b/.direnv/flake-profile-2-link
@@ -0,0 +1 @@
+/nix/store/pknafnv7zx67x4misiglnnvbj3sgm30r-nix-shell-env
diff --git a/.gitignore b/.gitignore
@@ -37,6 +37,8 @@ frontend/build/
 .idea/
 *.swp
 *.swo
+.envrc
+flake-profile*
 
 # OS
 .DS_Store

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -32,6 +32,7 @@ members = [
   "engine/packages/metrics",
   "engine/packages/metrics-server",
   "engine/packages/namespace",
+  "engine/packages/outbound-guard",
   "engine/packages/pegboard",
   "engine/packages/pegboard-envoy",
   "engine/packages/pegboard-gateway",
@@ -56,6 +57,7 @@ members = [
   "engine/packages/universalpubsub",
   "engine/packages/util",
   "engine/packages/util-id",
+  "engine/packages/webhook",
   "engine/packages/util-serde",
   "engine/packages/workflow-worker",
   "engine/sdks/rust/api-full",
@@ -500,6 +502,9 @@ members = [
     [workspace.dependencies.namespace]
     path = "engine/packages/namespace"
 
+    [workspace.dependencies.rivet-outbound-guard]
+    path = "engine/packages/outbound-guard"
+
     [workspace.dependencies.pegboard]
     path = "engine/packages/pegboard"
 
@@ -573,6 +578,9 @@ members = [
     [workspace.dependencies.rivet-util-id]
     path = "engine/packages/util-id"
 
+    [workspace.dependencies.webhook]
+    path = "engine/packages/webhook"
+
     [workspace.dependencies.rivet-util-serde]
     path = "engine/packages/util-serde"
     version = "=2.3.7"

diff --git a/docs/content/docs/debugging.mdx b/docs/content/docs/debugging.mdx
@@ -199,7 +199,7 @@ Returns the configured provider settings per datacenter and the latest pool erro
 }
 ```
 
-`runner_pool_error` mirrors actor scheduling errors such as `serverless_http_error`, `serverless_connection_error`, and `serverless_stream_ended_early`.
+`runner_pool_error` mirrors actor scheduling errors such as `serverless_http_error`, `serverless_connection_error`, `serverless_destination_blocked`, and `serverless_stream_ended_early`.
 
 ### Check Serverless Provider Health
 

diff --git a/docs/content/docs/troubleshooting.mdx b/docs/content/docs/troubleshooting.mdx
@@ -97,6 +97,14 @@ Rivet was unable to connect to your serverless endpoint. Check that:
 - Your server is publicly reachable from the internet.
 - There are no DNS or firewall issues blocking the connection.
 
+### `serverless_destination_blocked`
+
+The configured serverless URL points at a destination Rivet is not allowed to reach. Rivet dials serverless endpoints from inside its own network, so by default it refuses any destination that is not publicly routable: private ranges, link-local and cloud metadata addresses, carrier-grade NAT, and other reserved ranges. Check that:
+
+- Your endpoint URL is publicly reachable, and is not an internal hostname or address.
+- The URL scheme is `http` or `https`, and the URL does not embed credentials.
+- If you are self-hosting and intentionally point runners at an address on your own network, set `outbound.allow_private_networks` to `true` in your engine config, or list the specific range in `outbound.allow_cidrs`.
+
 ### `serverless_stream_ended_early`
 
 The connection to your serverless endpoint was terminated before the actor finished. This usually means your serverless function hit its execution time limit. Ensure that your Rivet provider's request lifespan is configured to match the max duration of your serverless platform.

diff --git a/engine/artifacts/config-schema.json b/engine/artifacts/config-schema.json
diff --git a/engine/artifacts/errors/webhook.conflict.json b/engine/artifacts/errors/webhook.conflict.json
diff --git a/engine/artifacts/errors/webhook.delivery_failed.json b/engine/artifacts/errors/webhook.delivery_failed.json
diff --git a/engine/artifacts/errors/webhook.delivery_not_found.json b/engine/artifacts/errors/webhook.delivery_not_found.json
diff --git a/engine/artifacts/errors/webhook.delivery_not_retryable.json b/engine/artifacts/errors/webhook.delivery_not_retryable.json
diff --git a/engine/artifacts/errors/webhook.destination_blocked.json b/engine/artifacts/errors/webhook.destination_blocked.json
diff --git a/engine/artifacts/errors/webhook.event_type_not_allowed.json b/engine/artifacts/errors/webhook.event_type_not_allowed.json
diff --git a/engine/artifacts/errors/webhook.invalid.json b/engine/artifacts/errors/webhook.invalid.json
diff --git a/engine/artifacts/errors/webhook.not_found.json b/engine/artifacts/errors/webhook.not_found.json
diff --git a/engine/artifacts/errors/webhook.request_failed.json b/engine/artifacts/errors/webhook.request_failed.json
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		flake-profile-2-link
the-company-company Bot Sep 15, 2026 Copy link Copy Markdown Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. 🟠 Medium · Local nix development environment files are committed This symlink (and `.direnv/flake-profile-2-link`, which points at a machine-specific `/nix/store/...` path) is a local direnv artifact that is broken for anyone else. The same PR adds `.envrc` and `flake-profile*` to `.gitignore` precisely to keep these files out, yet they are committed anyway. `flake.nix`, `flake.lock`, and `rust-toolchain.toml` come from the "chore: setup nix development env" commits and are likewise local environment setup; `rust-toolchain.toml` additionally forces `channel = "stable"` on every rustup-based contributor's build. Drop these files from the PR and let the new `.gitignore` entries keep them out.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		/nix/store/pknafnv7zx67x4misiglnnvbj3sgm30r-nix-shell-env
-Original file line number
+Diff line change
@@ Expand Up / @@ -37,6 +37,8 @@ frontend/build/ @@
     .idea/
     *.swp
     *.swo
+    .envrc
+    flake-profile*
     # OS
     .DS_Store
@@ Expand Down @@