[M3gA-Mind]

Summary

Release prep for v0.26.0 (minor), cut from main on the tinybus 0.1 line. Two commits:

1. fix(deps): tokio 1.53.1 → 1.53.3 in Cargo.lock, for RUSTSEC-2026-0386. It's the patched release in the same minor, with the same dependencies and MSRV, and it clears the supply-chain failure on main.
2. chore(release): versions 0.24.1 → 0.26.0, plus the matching workspace-crate entries in Cargo.lock.

It's a minor because v0.24.1..main has breaking changes:

• the storage contract moved to tinystoragedrivers 2.1;
• MSRV went from 1.85 to 1.88;
• public API was removed or moved: Reservation::commit and PaymentLedger::commit_reservation (chore(x402): reject bad recovery ids, exact chain labels, drop commit_reservation #118), the stored-payment types and consts, the storage_schema re-exports, and from_scoped/memory;
• x402 is stricter: it refuses cross-origin challenges, caps validBefore, settles only on a matching receipt (fix(x402): settle only on a receipt that matches the payment #116), and refuses an EVM transaction with no recipient (fix(module): refuse an EVM transaction with no recipient #117).

v0.25.0 was tagged on epic/8056-modules-wiring, not main, so main's next release skips to 0.26.0. Nothing calls the removed methods in this repo or in openhuman.

Test plan

• cargo build --locked, a lockfile-unchanged check, and full module-ci (Linux), run off-GitHub on the cuttlefish check host.

[tinysweeper]

Tiny Sweeper review

Reviewed head: d0fc648e005a9b581440d9d96c414ba76415f024

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 6 of 7 files; not reviewed: Cargo.lock.
Pull request purpose (title): chore(release): tiny…

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(release): tinywallet 0.26.0. Tiny Sweeper completed its review; deterministic results follow.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	6	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The rendered whole-pull-request diff modifies version declarations in seven manifest files, each changing version = "0.24.1" to version = "0.26.0": the root Cargo.toml (tinywallet) and the manifests of the tinywallet-bus, tinywallet-crypto, tinywallet-module, tinywallet-web3, and tinywallet-x402 crates. All other manifest fields (edition 2024, rust-version 1.88, license GPL-3.0-only) are unchanged, and no changed symbols were supplied. The PR description additionally claims Cargo.lock changes — a tokio bump to 1.53.3 and matching workspace-crate lock entries — but the description lane states no Cargo.lock changes appear in the diff and that the description therefore does not match what the diff does. The latest-push-delta evidence is unavailable, so no per-push delta can be described.

Features

• Modified — Workspace version bump to 0.26.0: The root package and the six workspace crates advance from 0.24.1 to 0.26.0, described as a minor release that skips 0.25.0 because that tag was cut on a different branch. This changes the published version identifiers for every affected crate. (Cargo.toml, crates/tinywallet-bus/Cargo.toml, crates/tinywallet-crypto/Cargo.toml, crates/tinywallet-module/Cargo.toml, crates/tinywallet-web3/Cargo.toml, crates/tinywallet-x402/Cargo.toml)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 6 files; 0 findings. _The code index is behind this pull request (indexed at `1535b7316935`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 6 files; 0 findings. _The code index is behind this pull request (indexed at `1535b7316935`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane reported no sensitive content in committed files, with no pending or unanswered checks.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `1535b7316935`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The diff bumps seven crate versions (root plus six workspace crates) from 0.24.1 to 0.26.0. The PR body also claims a second commit updating the matching workspace-crate entries in Cargo.lock and a tokio bump in Cargo.lock, but no Cargo.lock changes appear in the diff — so the release description does not match what the diff does, and `cargo build --locked` would fail against a version-mismatched lockfile if the lock entries are indeed absent. I could not verify Cargo.lock's current contents from the diff alone. _The code index is behind this pull request (indexed at `1535b7316935`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.012489
• Tokens: 337078 input · 4194 output · 52096 cached · 63 embedding
• Updated: 2026-10-23T15:03:58Z

Head	State	Pass summary
d0fc648e005a	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T15:03:58Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b02aba55-d91c-4944-a673-024407d475fc

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0125