synadia-labs/rita

Rita is a Go library for event sourcing that leverages NATS JetStream as its underlying event store. It provides core capabilities for managing event streams, including optimistic concurrency control, state evolution through deciders, and durable side-effect processing via reactors. The system supports flexible data handling through a pluggable serialization framework and type registry, enabling transparent marshaling of various data formats.

This change introduces foundational internal packages: a \clock\ package providing a \Clock\ interface to abstract system time (defaulting to \time.Now\), an \id\ package offering two strategies for generating unique identifiers via UUID and NUID, and an \internal/pb\ package containing the generated Go code and proto definition for a test message type \A\ with helper serialization methods.

clock, id, internal · high confidence

Introduces the Rita library, providing an event store backed by NATS JetStream with support for type-registered or binary event serialization, optimistic concurrency control via sequence expectations, and state evolution through Decider and Evolver interfaces. The release includes a Manager for creating and configuring event stores, a Reactor system for durable, side-effect-driven event consumption with configurable backoff and acknowledgment policies, and a Model wrapper for thread-safe state management. It also adds comprehensive test coverage for event appending, replay, reactor binding, and concurrent model evolution.

(repo-wide) · high confidence

The new \types.Registry\ component enables automatic marshaling and unmarshaling of Go structs to and from byte slices using pluggable codecs. It maintains a mapping between type names and struct types, validates that registered types are serializable (e.g., pointer to struct), and supports optional validation via the \Validator\ interface. Users can now register custom types and use the registry to handle serialization logic transparently across the application.

types · high confidence

The codec package now provides a unified interface for serializing and deserializing data, featuring four distinct implementations: JSON, Binary, MessagePack, and Protocol Buffers. The Binary codec specifically supports native Go types implementing encoding.BinaryMarshaler/BinaryUnmarshaler as well as raw byte slices, ensuring safe copying during unmarshaling. These codecs are automatically registered in a global map upon initialization, allowing users to select their preferred serialization format by name.

codec · high confidence

Added a suite of runnable Go examples in the \examples/\ directory that demonstrate core Rita capabilities. The \quickstart\ example shows basic event appending and state reconstruction. \deciders\ illustrates the command-decision pattern with invariant validation and thread-safe model evolution. \optimistic-concurrency\ demonstrates handling sequence conflicts and retries. \projection\ shows continuous state updates using the \Watch\ API. \reactor\ and \reactor-lifecycle\ cover creating, binding, updating, and deleting durable reactors for side-effect processing. Finally, \tenancy\ demonstrates multi-tenant isolation using scoped event store handles.

examples · high confidence

The testutil package now provides three new helper components to streamline testing. A deterministic Clock allows tests to control time progression via a configurable unit and supports manual time advancement through a new Add() method. An Is assertion helper simplifies test verification with methods for checking equality, error types, absence of errors, and boolean conditions. Additionally, NATS server management is standardized with functions to start a JetStream-enabled server, with optional support for specifying a custom JetStream domain.

testutil · high confidence

The project now includes a go.mod file establishing the module as github.com/synadia-labs/rita, targeting Go 1.25.0. This introduces dependencies for NATS connectivity (nats-server v2.12.6, nats.go v1.53.1), JetStream extensions (orbit.go/jetstreamext v0.3.2), serialization (msgpack v5.4.1, protobuf v1.36.12), and utility libraries (uuid, go-cmp, testify).

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 71 → 77 (+6.3)
• Rubric changed (rubric-2026.08.19 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 93 → 97 (+3.2)
• Architecture 100 → 100 (+0.0)
• Maturity 60 → 62 (+2.2)
• Readiness 78 → 83 (+5.0)
• Security 75 → 98 (+23.2)

• Coverage not included — suite not readable by the collector
• Critical CVE: [GHSA redacted] (go.mod)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• Duplicated block (11 lines × 2) (examples/reactor-lifecycle/main.go)
• Duplicated block (12 lines × 2) (eventstore.go)
• Duplicated block (13 lines × 2) (examples/reactor-lifecycle/main.go)
• Duplicated block (14 lines × 2) (examples/projection/main.go)
• Duplicated block (14 lines × 3) (examples/deciders/main.go)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• LLM evaluation failed
• Medium CVE: GO-2025-3955 (go.mod)
• Medium CVE: GO-2026-5024 (go.mod)
• Medium vulnerability: GO-2026-5841 (go.mod)
• No exposed public API
• Off-boarding risk: anonymized user #1
• Test reliability not included
• …and 3 more

• Documentation: no installation or build instructions (README.md)
• Documentation: no usage examples (README.md)
• Duplicated block (13 lines × 2) (eventstore.go)
• Duplicated block (15 lines × 2) (examples/reactor-lifecycle/main.go)
• Duplicated block (15 lines × 2) (examples/reactor-lifecycle/main.go)
• Duplicated block (15–17 lines × 2) (examples/reactor-lifecycle/main.go)
• Duplicated block (15–17 lines × 4) (examples/deciders/main.go)
• Duplicated block (15–18 lines × 5) (examples/deciders/main.go)
• Duplicated block (18–20 lines × 2) (examples/projection/main.go)
• Duplicated block (8 lines × 2) (examples/reactor-lifecycle/main.go)
• Duplicated block (9 lines × 2) (examples/deciders/main.go)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• Medium CVE: GO-2025-3955 (go.mod)
• Medium vulnerability: GO-2026-5932 (go.mod)
• Medium: security finding (details withheld)
• Members sharing a duplicated core (4 members, 50+ identical tokens) (examples/deciders/main.go)
• …and 6 more

• 1 commits — 1 feature/other, 0 fixes

• (root) — 1 commit

• change: CHORE: dependency updates

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

synadia-labs/rita was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.