build: tinybus version range (>=0.1.3, <0.2), nested tinybus 0.1.5

[senamakel]

Part of tinyhumansai/openhuman#7610, #7543, #7523

Summary by CodeRabbit

• Chores
  • Updated compatibility with Tinybus and Tinybus Module releases in the 0.1.x range. This allows the project to work with compatible versions starting at 0.1.3, rather than requiring exactly version 0.1.4. No changes were made to Tinybus feature configuration.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T17:54:56.348795Z	292c745	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 216a1ea7-a210-4819-b72c-658c88b443f5

📥 Commits

Reviewing files that changed from the base of the PR and between 1153cf1 and 292c745.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• Cargo.toml
• vendor/tinybus

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Cargo.toml now accepts tinybus and tinybus-module versions >=0.1.3, <0.2. The vendor/tinybus submodule reference now points to a different commit.

Changes: tinybus dependency update

Layer / File(s)	Summary
Update tinybus dependency references Cargo.toml, vendor/tinybus	The version constraints for tinybus and tinybus-module changed from exact 0.1.4 pins to >=0.1.3, <0.2. The vendor/tinybus submodule pointer changed to commit eb5cf727071a6eb12f9efa3db8ec59e54039f336.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 292c7

The dependency range, lockfile, and published manifest declarations align. No actionable issue is established; the change appears ready for normal build validation.

### Architecture Summary

Architecture risk: 🔵 Low · up to 292c7

The change affects 1 system.

Changed systems: Cargo.toml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — Cargo.toml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in Cargo.toml: tinybus and tinybus-module now accept versions >=0.1.3, <0.2 instead of requiring exactly 0.1.4; tinybus retains its existing feature selection.
• observed — Modified behavior in vendor/tinybus: The vendor/tinybus submodule pointer now references commit eb5cf727071a6eb12f9efa3db8ec59e54039f336 instead of 1f2557657db97470cd4efb7e1fc2f374f36fdd22.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies both main changes: widening the tinybus version range and updating the vendored tinybus submodule to version 0.1.5.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the range with care,
Then hops to a new commit out there.
The bus keeps features as before,
Its version gate is open more.
One final nibble, carrots in store.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 292c74577e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Split the TinyBus gitlink update into its own commit

This commit advances vendor/tinybus while also changing the root manifest and lockfile, even though the repository requires TinyBus gitlink updates to be committed separately. First commit the compatible dependency-range change against the existing 0.1.4 submodule, then advance the gitlink and lockfile in a second independently reviewable commit.

AGENTS.md reference: AGENTS.md:L185-L188

Useful? React with 👍 / 👎.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: 292c74577e70
Updated: 2026-10-13T23:30:23Z

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change relaxes the pinned TinyBus dependency versions from exact (`=0.1.4`) to caret-style ranges (`>=0.1.3, <0.2`), which matches AGENTS.md's rule to "pin a caret range (`serde = "1"`), not an exact version". The workspace still patches both crates to the vendored `vendor/tinybus` checkout, so the resolved code is unchanged, and no caller in the tree asserts a specific TinyBus version. I found no reportable defect in this file. _The code index is behind this pull request (indexed at `ca2d5c10c5c4`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This is a two-line dependency-range change in the workspace manifest: `tinybus` and `tinybus-module` move from an exact pin (`=0.1.4`) to a caret-style range (`>=0.1.3, <0.2`), with `default-features = false` and the explicit feature list preserved. The repository rule requires pinning to a caret range rather than an exact version, so loosening the pins moves toward that policy; `<0.2` keeps the range within 0.1.x, and the versions are internal tinyhumansai crates rather than a supply-chain surface an attacker could steer. I found no security-relevant defect introduced by this change. _The code index is behind this pull request (indexed at `ca2d5c10c5c4`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This change widens the workspace pins for `tinybus` and `tinybus-module` from `=0.1.4` to the caret-style range `>=0.1.3, <0.2`, matching what the description says; it touches only two lines of `Cargo.toml` and introduces no code paths, so there is nothing here that fails or misbehaves for a reachable input. The description is accurate and needs no revision, so I have no findings. _The code index is behind this pull request (indexed at `ca2d5c10c5c4`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000205
• Tokens: 82839 input · 2547 output · 28032 cached · 48 embedding

Head	State	Pass summary
292c74577e70	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-13T23:30:23Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0002 · 82,839 in / 2,547 out · 28,032 cached (34%) · ladder/vectors-oai3, deepseek-v4.1-flash · 48 embedded
critique:    $0.0001 · 45,765 in / 747 out   · 17,152 cached (37%) · deepseek-v4.1-flash
security:    $0.0000 · 13,232 in / 157 out   · 2,176 cached (16%)  · deepseek-v4.1-flash
description: $0.0001 · 22,168 in / 774 out   · 8,704 cached (39%)  · deepseek-v4.1-flash