[senamakel]

OpenHuman now tracks TinyJuice v0.11.2 and its published platform archive checksums from the release's checksum.toml. The vendor gitlinks pin the TinyAgents 3.0 release-prep head and the merged TinyVoice/TinyJuice compatibility commits.

Dependencies merged into the epic branches:

• chore(release): prepare TinyAgents 3.0.0 tinyagents#547
• build: support TinyAgents 3.x tinyvoice#55
• build(examples): require TinyAgents 3.0 tinyjuice#116

Validation:

• cargo test --manifest-path Cargo.toml -p openhuman --lib every_asset_name_carries_the_pinned_version (passed, 1 test)
• Compared all 17 archive names and SHA-256 values with TinyJuice v0.11.2's published checksum.toml (passed)

Refs senamakel/tinyagents#68
Part of #8088

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8322b875-3825-4345-8de0-26a71813306a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: a75b77b5bf5e66c6098c1578267c609942e6d790

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 6 files; not reviewed: Cargo.lock, crates/openhuman…, and 3 additional unreviewed files.
Pull request purpose (title): chore(modules): pin…

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(modules): pin TinyJuice v0.11.2 release. The description states OpenHuman now tracks TinyJuice v0.11.2 with its published platform archive checksums from the release's checksum.toml, and that vendor gitlinks pin the TinyAgents 3.0 release-prep head plus merged TinyVoice/TinyJuice compatibility commits. The visible diff re-pins the TINYJUICE module record: version, release URL, and all 17 per-platform archive names and SHA-256 digests move from 0.10.8 to 0.11.2, with the host_key set and LoadPolicy::Lazy unchanged. The diffstat lists Cargo.lock, crates/openhuman-app/Cargo.lock and three vendor gitlinks that are not visible in the inspected diff.

Unreviewed paths

• Cargo.lock
• crates/openhuman-app/Cargo.lock
• vendor/tinyagents
• vendor/tinyjuice
• vendor/tinyvoice

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

In the TinyJuice module record (crates/openhuman-core/src/modules/registry/records_memory_juice.rs, the TINYJUICE module record), the declared version moves from 0.10.8 to 0.11.2 and the release URL moves to the matching v0.11.2 GitHub tag. Each of the 17 PlatformAsset entries (archlinux, fedora-43/44, macos-15/26, ubuntu-22.04/24.04, and windows-11/2022/2025 across arm64 and x86_64) receives an archive filename stamped 0.11.2 and a new SHA-256 digest; tar.gz remains for Unix targets and .zip for Windows. The load policy stays LoadPolicy::Lazy, the host_key set is unchanged, and no other fields, callers, or contracts change. The whole-pull-request file list also includes Cargo.lock, crates/openhuman-app/Cargo.lock, and vendor/tinyagents, vendor/tinyjuice, vendor/tinyvoice gitlinks, none of which appear in the inspected diff.

Features

• Modified — TinyJuice module version and release URL pin: Module resolution now targets the v0.11.2 release tag instead of v0.10.8; the release URL tracks the version field. (crates/openhuman-core/src/modules/registry/records_memory_juice.rs pub(crate) const TINYJUICE: ModuleRecord = ModuleRecord {)
• Modified — Per-platform archive names and SHA-256 pins (17 assets): Every platform asset's archive filename and expected digest is updated so install verification attests against v0.11.2 artifacts; the digests are the integrity control for module downloads and are checked against the pinned table before load. (crates/openhuman-core/src/modules/registry/records_memory_juice.rs pub(crate) const TINYJUICE: ModuleRecord = ModuleRecord {)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This is a mechanical version bump of the TINYJUICE module record from 0.10.8 to 0.11.2: every archive name and sha256 is updated consistently, the host_key set is unchanged, and release_url tracks version. I cannot verify the sha256 digests or that the release assets exist without network access, so I note that limitation rather than raise it as a defect; nothing in the diff itself looks wrong. _The code index does not reflect this commit, so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane reports no new input handling, subprocess or network code, dependency, or permission; the digests are checked against a pinned table before the artifact is loaded, so the version pin remains the security boundary unchanged in kind.
• Lane summary: This change only bumps the pinned tinyjuice module version from 0.10.8 to 0.11.2, updating the release URL, archive names and SHA-256 digests for all 17 platforms. It touches no input handling, no subprocess or network code, and no permissions; the digests are checked against a pinned table before the artifact is loaded, so the version pin is the security boundary and it is unchanged in kind. Nothing to report. _The code index does not reflect this commit, so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This is a dependency-pin bump in a `ModuleRecord` constant: version, release URL, archive filenames and sha256 digests all move from tinyjuice 0.10.8 to 0.11.2, with every one of the seventeen platform entries updated consistently. There is no branching, no logic, and no runtime behaviour to regress silently — the table is compiled data whose correctness is the pinned digests, which no in-repo test can verify (the artifacts live outside this repository, and the repo's rules forbid tests that hit real backend/third-party services). Demanding a unit test here would be noise, so no test-coverage finding is warranted. I checked the diff for a stale version string, a mismatched archive/digest pairing or a host_key left behind on the old release; I found none. _The code index does not reflect this commit, so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane found no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index does not reflect this commit, so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: SHA-256 values could not be verified against the external checksum.toml from review.
• Lane summary: The diff is a mechanical version and checksum bump for the TinyJuice module assets (0.10.8 → 0.11.2), consistent with the PR body's claim of pinning TinyJuice v0.11.2 and its published checksums. The body also mentions vendor gitlink updates, which this diff does not show — but the diff is presented as the complete change and only touches one file. I can verify the archive-name/version consistency the body claims (names all embed 0.11.2, matching the version field), but I cannot verify the SHA-256 values against the external release checksum.toml from here. No repository rule is violated by this edit. _The code index does not reflect this commit, so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.001317
• Tokens: 94925 input · 1914 output · 11776 cached · 1358 embedding
• Updated: 2026-10-23T00:52:13Z

Head	State	Pass summary
122f74c83d67	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T00:40:40Z)
a75b77b5bf5e	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T00:52:13Z)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T00:54:21.905529Z	a75b77b	New commits
🔒 Security Review	✅ Completed 2026-10-23T00:54:14.778271Z	a75b77b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0003

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 122f74c83d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".