Repository navigation
Conversation
Records, release-manifest tests and gitlinks move to each release tag. Digests come from the GitHub asset digests, checked against every release's checksum.toml. TinyBox's bus contract moves 2.0 -> 2.1, which only adds the resource-aware jailed exec member; TinyHosts and TinyMCP are version-only.
Composed from a regenerated lock: path-crate versions, the tinybox-bus 0.2.2 references, and tinybox-docker's new ipnet, sha2 and tempfile edges. Windows edge re-points and the getrandom re-resolution are left as on main. The app lock also catches up tinychannels-bus 0.1.43 and tinyflows 0.9.2, which main's app lock had left behind.
Tiny Sweeper reviewReviewed head: Verdict: Ready for maintainer review · Priority: none Diagnostics and supporting detailsFull summaryPull request purpose (title): chore(modules): pin TinyBox v0.2.2, TinyHosts v0.4.4, TinyMCP v0.20.3. This pull request, titled "chore(modules): pin TinyBox v0.2.2, TinyHosts v0.4.4, TinyMCP v0.20.3", bumps three loadable modules to their 2026-10-24 releases by re-pinning the registry records (version, release URL, every platform archive name and sha256 digest), updating the vendor gitlinks and both lockfiles per the description, and updating the tests that hard-code each release. The review evidence covers 5 changed files; the pull-request description additionally lists Cargo.lock, crates/openhuman-app/Cargo.lock, and the three vendor gitlinks, which do not appear in the visible diff. The latest-push delta is unavailable, so no push-delta comparison is claimed. Unreviewed paths
Review snapshot
Completeness: Complete What changedRegistry records for TinyBox, TinyHosts, and TinyMCP now point at versions 0.2.2, 0.4.4, and 0.20.3 respectively, with matching release URLs and refreshed per-platform archive names and digests across all 17 assets each. The registry, hosting, and TinyBox operations tests are updated to the new versions and digests, and the TinyBox bus contract assertion moves from (2, 0) to (2, 1). Per the description, vendor gitlinks for the three modules and both lockfiles are also moved, though those hunks are not present in the supplied diff. Features
TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Before mergeNone. How this fits togetherflowchart LR
n0["...ations_match_the_released_module_contract<br/>changed"]:::changed
n1["...tches_the_published_v021_release_manifest<br/>changed"]:::changed
n2["...ches_the_published_v0202_release_manifest<br/>changed"]:::changed
n3["...tches_the_verified_v0260_release_manifest<br/>changed"]:::changed
n4["..._local_grants_from_pinned_tinybox_release<br/>changed"]:::changed
n5["config_with"]:::impacted
n6["expect"]:::impacted
n7["assert"]:::impacted
n8["...ader_serves_the_published_tinybox_release"]:::impacted
n9["...viders_and_confidential_local_preparation"]:::impacted
n10["mock_client_with_docker_control_delay"]:::impacted
n0 -->|calls| n5
n0 -->|tests| n5
n0 -->|calls| n6
n1 -->|calls| n6
n2 -->|calls| n6
n3 -->|calls| n6
n4 -->|calls| n6
n4 -->|calls| n7
n8 -->|calls| n6
n8 -->|calls| n7
n9 -->|calls| n5
n9 -->|tests| n5
n9 -->|calls| n6
n10 -->|calls| n6
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
TinyBox 0.2.2 release crates/openhuman-core/src/modules/registry/records_extra.rs, crates/openhuman-core/src/modules/registry_tests.rs, crates/openhuman-core/src/modules/tinybox/operations_tests.rs, vendor/tinybox |
The registry record and pinned-release tests now use version 0.2.2 and contract version 2.1. The 17 platform asset names and checksums were updated, along with the vendor reference. |
TinyHosts 0.4.4 release crates/openhuman-core/src/modules/registry/records_extra.rs, crates/openhuman-core/src/hosting/hosting_tests.rs, vendor/tinyhosts |
The registry record and hosting test now use version 0.4.4. The platform asset names and checksums, pinned Ubuntu asset hash, and vendor reference were updated. |
TinyMCP 0.20.3 release crates/openhuman-core/src/modules/registry/records_mcp_connectors.rs, crates/openhuman-core/src/modules/registry_tests.rs, vendor/tinymcp |
The registry record and release tests now use version 0.20.3. The 17 platform asset names and checksums, including the Arch Linux archive names, and the vendor reference were updated. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Possibly related issues
- tinyhumansai/openhuman#8369: This PR updates registry entries and tests for new TinyBox, TinyHosts, and TinyMCP releases and their checksums, matching the issue’s module-release adoption objective.
Possibly related PRs
- tinyhumansai/openhuman#8327: It updates the same three module release pins and vendor references.
- tinyhumansai/openhuman#8320: It introduced the TinyBox registry pin and bus contract that this PR advances.
- tinyhumansai/openhuman#8399: It updated the TinyBox release test to the version that this PR advances.
Suggested reviewers: senamakel
Merge Risk: 
6530a
-
The release pins and test expectations appear aligned. No actionable merge-blocking issue is identified; complete the normal release checks before merging.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 5 files. (3 skipped: 3 … Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies the main change: pinning the TinyBox, TinyHosts, and TinyMCP modules to their updated versions. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 5 files. (3 skipped: 3 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks each checksum line,
Three fresh releases now align.
New archive names hop into place,
TinyBox’s contract keeps its pace.
The vendor pins move on in time.
Comment @coderabbitai help to get the list of available commands.
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
tinysweeper
Bot
added
the
priority: p3
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Conflicts were tinyhumansai#8409's TinyBox v0.2.2 / TinyHosts v0.4.4 / TinyMCP v0.20.3 pins against this branch's newer v0.2.3 / v0.4.5 / v0.20.4: records, hosting_tests, registry_tests and the three gitlinks keep this branch's side. vendor/tinyagents takes main's v3.1.1 (2b234b7) here; the next commits move it to v3.1.2. Both lockfiles keep this branch's side and are regenerated at the end of the series.
…d releases operations_tests still asserted TinyBox 0.2.2 (main's tinyhumansai#8409 pin) against the v0.2.3 record. The TinyWallet record comment names v0.27.0, and the linked-modules manifest comment now says module repos require tinybus 0.3 (>=0.3.6).
Summary
Moves three loadable modules to their 2026-10-24 releases. For each one this moves the registry record, the
vendor/gitlink, the tests that hard-code its release, and both lockfiles.How each module is moved
checksum.toml. All 51 match. Each release ships the same 17 archives as the one before it.registry_tests.rs, the TinyHosts artifact-set test inhosting_tests.rs, and TinyBox's ignored pinned-loader test.vendor/and the lockfiles, whether versions or digests..githubpins none of these three modules.Host contract
StartJailedExecWithResources(withNativeJailRequest). The 2.0 request shapes are unchanged. Nothing in the host breaks:Error::EgressRollbackFailedvariant affects nothing, since no host code matches on that error type exhaustively.EgressAllowlist.storage_callbackor the wire format.[patch]that redirects it to the vendored tinytools 0.6.0 now matches its version requirement.Lockfiles
Both lockfiles were regenerated with targeted
cargo update -pon a remote host, then composed so that every changed line comes from these bumps:tinybox-bus 0.2.2references;tinybox-docker's newipnet,sha2andtempfileedges.The regen also re-pointed Windows-only
windows-sys/windows-coreedges and re-resolvedtempfile'sgetrandomedge. These lines are kept as on main.The app lock also catches up
tinychannels-bus0.1.43 andtinyflows0.9.2. Main's app lock is behind on these, and the same regen on plain main produces exactly these two lines.Checks
Checked on a remote host at 6530aed, whose parent is main e8707ea:
cargo metadata --locked: passes for the root and app locks, and leaves the tree clean (no lock rewrite).cargo test -p openhuman --lib(core features):modules::registrytests pass. That includestinybox_registry_matches_the_published_v022_release_manifest,tinymcp_registry_matches_the_published_v0203_release_manifestand the release-manifest file.every_row_has_a_valid_generated_grantpasses.the_module_registry_pins_the_released_hosts_artifact_setpasses with full features.static:rust-fmt(crates/openhuman-embed/src/lib.rs:252,261) andstatic:agent-runtime-boundaryfail on main too.Summary by CodeRabbit