chore: release tinybox 0.1.33

[senamakel]

Version bump after tinybox#82 (tinystoragedrivers v0.11.0). Part of tinyhumansai/openhuman#7522, #7754.

[tinysweeper]

Tiny Sweeper review

This pull request is a routine release bump of the workspace version from 0.1.32 to 0.1.33, made solely by editing the `[workspace.package]` version field in Cargo.toml. All review lanes (critique, security, tests, commits) found no defects in the change itself. One defect was raised by the description lane: because the diff touches only Cargo.toml and not Cargo.lock, the committed lockfile still records the member crates at 0.1.32, leaving it stale and breaking any `--locked` build (including the release workflow) until cargo rewrites it. The critique lane noted it could not verify lockfile regeneration from the diff, consistent with this finding. The code index is behind this pull request (indexed at 8e92b4e), so retrieved context may be out of date.

State: Changes requested
Priority: high
Reviewed head: 4373e1616f90
Updated: 2026-10-14T11:00:13Z

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	1
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

Cargo.toml's `[workspace.package]` version is bumped from "0.1.32" to "0.1.33"; no other files are changed in the diff. No behavioral changes are claimed by any lane, and the tests lane confirms nothing outside documentation, configuration, and tests is affected. The outstanding concern is the absent Cargo.lock update to match the new workspace version.

Features

• Modified — Workspace version bump to 0.1.33: Updates the workspace package version to 0.1.33 for release purposes. Because Cargo.lock is not updated in the diff, the committed lockfile still pins member crates at 0.1.32, which breaks `--locked` builds (including the release workflow) until the lockfile is regenerated. (Cargo.toml)

Tests

• no_test_change — The tests lane reports no behavioral change: nothing outside documentation, configuration, and tests is modified.: No new tests are needed or provided; the change is a configuration-only version bump with no behavioral impact, per the tests lane. (Cargo.toml)

Findings

• high · description · Update Cargo.lock for the 0.1.33 version bump — The workspace version is bumped to 0.1.33, and every member crate inherits it (the workspace `[workspace.package]` version drives `version.workspace = true` across the crates), but (\(pull request description\))

Before merge

• Address Update Cargo.lock for the 0.1.33 version bump (\(pull request description\)).

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The critique lane found no repository-rule violations in the caret-style version field for the workspace itself and no findings in the manifest change.
• Lane summary: This is a routine workspace version bump from 0.1.32 to 0.1.33 in `Cargo.toml`. The only changed line is the `[workspace.package]` version; nothing in the diff calls into anything I have not seen, and no repository rule from the supplied list is violated by a caret-style version field for the workspace itself. One thing I cannot verify from the diff alone is whether every `Cargo.lock`-pinned member version and the release workflow expectations were regenerated to match, since `Cargo.lock` is not shown — but a version bump commit that pairs with a lockfile update is the norm here and the README's release process says to update the lockfile in a reviewed PR, so this is not a defect claimable from the evidence in front of me. No findings. _The code index is behind this pull request (indexed at `8e92b4e3c8f1`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The security lane found no security or correctness problems with the version bump; the change calls into nothing requiring further lookup.
• Lane summary: A routine version bump to 0.1.33 in the workspace manifest. The change calls into nothing I need to look up, and I found no security or correctness problems with it. _The code index is behind this pull request (indexed at `8e92b4e3c8f1`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Positive: The commits lane found nothing sensitive in what this pull request commits.
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Failure
• Scope reviewed: all assigned evidence
• Lane summary: This is a release bump of the workspace version from 0.1.32 to 0.1.33, and the description accurately says exactly that. One defect: the diff touches only Cargo.toml, so the committed Cargo.lock still records the member crates at 0.1.32 and is now stale, which breaks any `--locked` build (including the release workflow) until cargo rewrites it. _The code index is behind this pull request (indexed at `8e92b4e3c8f1`), so retrieved context may be out of date._
• Evidence: \(pull request description\) — Update Cargo.lock for the 0.1.33 version bump

Evidence and run details

• Models: ladder/vectors-oai3, glm-5.3-flash
• Spend: $0.000347
• Tokens: 42187 input · 3893 output · 11456 cached · 21 embedding

Head	State	Pass summary
4373e1616f90	changes requested	1 active finding(s), 0 resolved finding(s) (at 2026-10-14T11:00:13Z)

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

Or wait 53 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e2bd9425-ba23-402b-b839-01e2e5700fdf

📥 Commits

Reviewing files that changed from the base of the PR and between c8cadce and 4373e16.

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing: 1

• Cargo.toml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T11:00:38.014874Z	4373e16	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4373e1616f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update local dependency constraints for the release

When releasing the workspace as 0.1.33, the local tinybox-* dependency requirements must be updated as well; this change leaves them at 0.1.25 and tinybox-drivers at 0.1.32, so the manifests no longer describe a consistent release cohort and can resolve older workspace crates when path overrides are unavailable. Update those constraints alongside this workspace version bump.

AGENTS.md reference: AGENTS.md:L273-L276

Useful? React with 👍 / 👎.

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0003 · 42,187 in / 3,893 out · 11,456 cached (27%) · ladder/vectors-oai3, glm-5.3-flash · 21 embedded
critique:    $0.0001 · 12,763 in / 174 out   · 2,624 cached (21%)  · glm-5.3-flash
security:    $0.0001 · 12,519 in / 47 out    · 2,368 cached (19%)  · glm-5.3-flash
description: $0.0002 · 15,438 in / 3,075 out · 6,336 cached (41%)  · glm-5.3-flash