[M3gA-Mind]

Summary

• Moves vendor/tinystoragedrivers from 29471a1 to 19be641, the merge commit of fix(deps): move zstd to 0.14.3 for RUSTSEC-2026-0391/0398/0403 tinystoragedrivers#88, which bumps its workspace zstd to 0.14.3. (This PR first pinned the feat(channels): add channel schema, RPC controllers, and definition-driven UI #88 head e513fc1; the merge commit has the identical tree, b0e273c.)
• Both lockfiles (root Cargo.lock and crates/openhuman-app/Cargo.lock) drop zstd 0.13.3 and zstd-safe 7.3.0. The remaining zstd/zstd-safe references become bare names, and no package is added.
• The regen also changed one dependency edge in each lock: tempfile 3.27.0 now points at getrandom 0.3.4 instead of 0.4.3. Both getrandom versions were already in the lock, and no package was added or removed.

Problem

• fix(deps): bump zstd to 0.14 for RUSTSEC-2026-0391/0398/0403 #8423 moved openhuman-core to zstd 0.14, but tinystoragedrivers-document (always) and tinystoragedrivers-connect (under sqlite) still required zstd ^0.13. So zstd 0.13.3 / zstd-safe 7.3.0 still shipped, along with RUSTSEC-2026-0391, RUSTSEC-2026-0398 and RUSTSEC-2026-0403.
• The duplicate zstd/zstd-safe pair also pushed the kernel-floor flows profile to 343, over its 341 limit.

Solution

• Fix it upstream (tinystoragedrivers#88: zstd 0.14.3; the four call sites have identical signatures, so no code changes) and advance the vendored gitlink. The root [patch."https://github.com/tinyhumansai/tinystoragedrivers"] points every tsd consumer (tinyagents, tinyflows, tinyinference) at the vendored copy, so this one gitlink clears zstd 0.13 from the whole graph.
• The locks were regenerated with cargo update -p zstd@0.13.3 and not hand-edited.

Submission Checklist

If a section does not apply to this change, mark the item as N/A with a one-line reason. Do not delete items.

• N/A: Tests added or updated. This is a dependency bump with no behaviour change, and zstd frames stay interoperable.
• N/A: Diff coverage ≥ 80%. No source lines changed (gitlink + lockfiles only).
• N/A: Coverage matrix updated. Behaviour-only change.
• N/A: Affected feature IDs listed under ## Related. No feature rows are affected.
• No new external network dependencies introduced
• N/A: Manual smoke checklist updated. No release-cut surface is touched.
• N/A: Linked issue closed via a closing keyword. There is no tracking issue.

Impact

• Runtime: all platforms. The compression format is unchanged.
• Security: no zstd 0.13.3 / zstd-safe 7.3.0 left in either lockfile.
• Verified on a remote runner at the pre-commit regen (the committed locks are byte-identical to it: root 5a95a7b954, app 118ffa00f3):
  • cargo check --locked: root -p openhuman-cli --features $CLI_FEATURES --all-targets, root --workspace, and app. All exit 0.
  • cargo tree --locked -i zstd / -i zstd-safe: only zstd 0.14.3 / zstd-safe 8.2.0, in both root and app.
  • scripts/check-kernel-floor.sh: profile=flows packages=341/341 names=312/312 native=3/3, down from 343.
  • check-module-boundaries: 0 violations.
  • No duplicate tinystoragedrivers-* packages.

Related

• Closes: N/A
• Upstream: fix(deps): move zstd to 0.14.3 for RUSTSEC-2026-0391/0398/0403 tinystoragedrivers#88 (merged as 19be641).
• Follow-up PR(s)/TODOs: tinyagents, tinyflows and tinyinference each pin tinystoragedrivers 29471a1 by rev. Their standalone lockfiles still resolve zstd 0.13.3, which affects their own cargo-deny and releases, not what openhuman ships (the patch above covers that). Bump their tsd rev in their next releases.

---

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: fix/tsd-zstd-0.14
• Commit SHA: 7c88875

Validation Run

• N/A: pnpm --filter openhuman-app format:check. No frontend change.
• N/A: pnpm typecheck. No frontend change.
• Focused tests: cargo check --locked (root + app) and kernel-floor, see Impact
• Rust fmt/check (if changed): cargo check --locked passes. No Rust source changed.
• N/A: Tauri fmt/check. No Tauri source changed.

Validation Blocked

• N/A

Behavior Changes

• Intended behavior change: none
• User-visible effect: none

Parity Contract

• Legacy behavior preserved: yes, same zstd frame format
• Guard/fallback/dispatch parity checks: N/A

Duplicate / Superseded PR Handling

• Duplicate PR(s): none (fix(deps): bump zstd to 0.14 for RUSTSEC-2026-0391/0398/0403 #8423 covered openhuman-core only)
• Canonical PR: this one
• Resolution (closed/superseded/updated): N/A

Summary by CodeRabbit

• Chores
  • Updated a bundled storage component. No specific changes to user-facing features or behavior are described, so this update does not indicate a change to the app’s visible functionality.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T13:42:42.914555Z	41f1a9d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 7c88875c2f6bbdd1ece510f27d46771c026e1c76

Verdict: Ready for maintainer review · Priority: none
Coverage: File coverage is unavailable.
Pull request purpose (title): chore(vendor): move…

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(vendor): move tinystoragedrivers to zstd 0.14.3 and drop zstd 0.13 from both lockfiles. Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

security

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `027722b144d6`), so retrieved context may be out of date._

description

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

Evidence and run details

• Models: ladder/vectors-oai3
• Spend: $0.000004
• Tokens: 0 input · 0 output · 0 cached · 33 embedding
• Updated: 2026-10-27T14:05:37Z

Head	State	Pass summary
41f1a9d196ca	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-27T13:40:35Z)
7c88875c2f6b	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-27T14:05:37Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 44f96288-a2f4-4dd6-bcec-916e7c6fd290

Commits

Reviewing files that changed from the base of the PR and between 41f1a9d and 7c88875.

Files selected for processing: 1

• vendor/tinystoragedrivers

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

Walkthrough

The PR updates the vendor/tinystoragedrivers submodule reference from commit 29471a164619bcec03e5858a7d7ee0c65f52bf22 to 19be64111fbecb4b11f3752432a0356029a83328.

Changes: Vendored revision

Layer / File(s)	Summary
Update the submodule reference vendor/tinystoragedrivers	The submodule pointer changes to commit 19be64111fbecb4b11f3752432a0356029a83328.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related issues

• Epic: split openhuman-core into parallel-compiling crates (clean build 157 s -> target under 70 s) #8175: The PR performs the listed gitlink bump, but the available summary does not show the requested mono-item measurement.

Possibly related PRs

• tinyhumansai/openhuman#8325: Both PRs update the vendor/tinystoragedrivers revision.
• tinyhumansai/openhuman#8390: Both PRs advance the same submodule and relate to its zstd dependency line.
• tinyhumansai/openhuman#8423: Both PRs update zstd to 0.14.3; this PR also advances the vendor revision.

Suggested reviewers: tinysweeper

Merge Risk: Minimal · up to 7c888

No actionable merge risk remains after verifying the vendored revision and lockfile dependency transition.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately identifies the vendor update to zstd 0.14.3 and the removal of zstd 0.13 from the lockfiles.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the pointer’s place
One commit shifts with quiet grace
The vendor link now points ahead
No extra changes need be read
I nibble clover, pleased instead}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0000

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41f1a9d196

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".