Skip to content

Integrate canonical channel contracts and native runtime for OpenHuman - #164

Draft
senamakel wants to merge 329 commits into
tinyhumansai:mainfrom
senamakel:epic/8369-security-migration
Draft

senamakel wants to merge 329 commits into
tinyhumansai:mainfrom
senamakel:epic/8369-security-migration

Conversation

@senamakel

@senamakel senamakel commented Oct 30, 2026 •

Copy link
Copy Markdown
Member

This roll-up supplies the portable channel contracts and native runtime used by OpenHuman #8512. It merges canonical main through 649321515eafd7f15701dc496eba3e2fcb4de4be, preserving its provider modules, richer media/voice contracts, event version 2, and bus contract version 33. The Rust workspace version is 0.2.0 for the API changes.

Storage declarations remain synchronous and transport-free in the bus crate. Runtime adapters convert them to the current storage API, preserve scoped callbacks and delivery receipts, and defer native storage access until the host exists. Typed text sends remain plain text; edits carry the canonical outbound intent. Boxed large members retain their JSON representation. Web output preserves explicit nulls and false/zero values, uses the canonical projector, and caps completed tool output consistently.

Prerequisite: TinyBus #116, pinned at 61dce96aac5d20d8b6fc7cfe27daef559c7d54c9, must merge first. This PR remains draft while that dependency is open and the remaining CI gates run.

Local validation for the reconciled sources (merge ec87f447761bbbe329697978a8a1d470f06c4c17):

  • Full workspace/all-feature nextest with ignored tests enabled and real TinyChannels/TinyVoice artifacts: 2,968 passed, zero skipped.
  • Workspace/all-feature/all-target check and strict clippy passed.
  • Pure bus closure passed independently for default, all, and storage features; its 123 tests passed with no default features.
  • Providers-off suite: 1,732 passed. Its TinyVoice integration was executed in the full native run above.
  • Native dependency engine boundary and negative purity controls passed.
  • Official OpenHuman source-artifact build passed. All five native artifact integration tests and the loaded TinyVoice/Dingtalk integration passed.
  • Standalone client fixture preparation and lockfiles validated. The feature matrix, coverage, documentation, and packaged E2E gates are still being checked; no final CI-green claim is made yet.

The output cap regression failed before the shared projector fix. Typed-send, scoped delivery, storage conversion, event/addressing, and serde regressions cover the merged behavior. Checkout credentials are disabled, native artifact hashes are read through standard input, and dependency admission continues rejecting storage implementation engines outside the existing iMessage SQLite exception.

Wire the new runtime test file into the client test suite so its cases are compiled and run alongside the existing tests.

Auto-committed-on: macbook
…ding

Adds a runtime test asserting that a stop returning an uncertain error is
reported as unacknowledged even when the peer's cleanup is still pending, and
that the reservation is not marked failed. The LifecyclePeer test double gains
a stop_fails flag so the failure path can be exercised.

Auto-committed-on: macbook
The lifecycle peer now serves a dedicated channel object at the runtime
path and exposes ChannelStatus through it instead of on the peer itself.
The runtime tests were extended to register that object and exercise its
status method so the new interface wiring is verified.

Auto-committed-on: macbook
The runtime lease tests covering alias handover and unacknowledged stop
outcomes have been deleted along with their module declaration, leaving
the client test suite without those lifecycle cases.

Auto-committed-on: macbook
Update the vendored tinybus submodule and its pinned revision to 0.3.2, and
raise the workspace and test-fixture versions to 0.1.37 to match. The release
test script and recording test module were adjusted for the new revision and
version strings, and the test module now advertises a FixtureReady member so
runtime tests can wait for the fixture to come up.

Auto-committed-on: macbook
Update the locked versions of the tinybus and tinychannels crates to their new releases, including the client test fixture, so the lockfiles match the bumped manifests.

Auto-committed-on: macbook
Add a ChannelRuntimeDriver that binds one attested TinyChannels peer and
implements the SDK lease contract, plus a ChannelRuntimeClient exposing the
reservation-owned runtime methods as typed calls. Errors are reported through a
closed ChannelRuntimeError that keeps the SDK classification and operation
without leaking peer-provided text.

Auto-committed-on: macbook
…rs,crates/tinychannels-client/t

Auto-committed-on: macbook
Extend the native end-to-end test to confirm that the fixture rejects
ordinary lifecycle and object calls against attested operands, covering
start, stop, and a confidential object invocation so the enforcement path
is exercised rather than merely inferred.

Auto-committed-on: macbook
….rs,crates/tinychannels-client/

Auto-committed-on: macbook
…rates/tinychannels-client/tests

Auto-committed-on: macbook
…ychannels-client/src/lib_runtim

Auto-committed-on: macbook
The fixture now derives runtime object and callback paths from a
monotonically increasing handle instead of a single hardcoded handle, so
tests can reserve multiple runtimes without collisions. Stop now unserves
the runtime object path and clears the failure flags on use so each
injected failure applies only once.

Auto-committed-on: macbook
The native end-to-end suite no longer needs the alias-handover, dispatch
policy, real-module composition, and opaque start/stop error cases, so the
corresponding fixtures and tests are dropped.

Auto-committed-on: macbook
The native end-to-end test target was split into separate runtime driver and
module runtime suites, with the shared typed-client checks left in native_e2e.
Both e2e scripts now run the new targets, and the shell script exports its
fixture environment variables so the additional cargo invocations inherit them.

Auto-committed-on: macbook
The PowerShell and shell client E2E scripts now invoke cargo build and cargo
test through scripts/ci-cancel-aware.sh so the native runtime suites cooperate
with CI cancellation. The shared support module allows dead code because the
native fixtures are used by separate integration targets, and the runtime
driver design notes were rewritten to describe the executable tests that now
exist rather than a draft awaiting Cargo access.

Auto-committed-on: macbook
Extend the native end-to-end test to drive the fixture's malformed
reservation and object response modes, asserting that both fail closed
with an incompatible contract error and are reported once. The fixture
now shares its runtime controls with the exported object and advertises
the two malformed-reply methods so the test can reach them.

Auto-committed-on: macbook
…se helper

The cached release helper now takes the release URL as an argument instead of
always deriving it from the environment prefix, so the native module fixture can
supply its own prefixed value. This keeps the shared helper usable for both the
default and native module test configurations.

Auto-committed-on: macbook
The fixture now exposes methods to pause the next reservation and to wait for and release it, letting tests hold a reservation open and exercise concurrent paths. The pinned version in the fixture and its assertions was bumped to 0.1.37 to match.

Auto-committed-on: macbook
…d-reserve

The serial lease activation now starts while A is paused inside its
confidential ReserveRuntime, and the alias is released at that point, so the
test exercises alias handoff during an in-flight reservation instead of after
all drivers are bound. The paused reservation is released once B has taken the
alias, and the activation task is awaited to keep the original assertions.

Auto-committed-on: macbook
The fixture service now implements call_with_context to capture the
confidentiality flag for audited delivery members, and exposes a
FixtureTakeDeliveryFlags method that drains the recorded entries. This
lets tests assert on the delivery context the client passes through.

Auto-committed-on: macbook
The fixture object now overrides call_with_context to push the member name and
confidentiality flag into the runtime controls whenever an audited delivery
member is invoked, and a new FixtureTakeDeliveryFlags method exposes the
collected entries so tests can assert on them.

Auto-committed-on: macbook
…tions

Extend the native end-to-end test to read the fixture's delivery flags and
verify that every typed wrapper call was observed by the broker. Each
recorded method is also checked against the expected set of confidential
methods so that misclassified deliveries fail the test.

Auto-committed-on: macbook
The readiness assertion in the runtime driver test now reports the recorded
call log alongside the error when the control call fails, making it easier to
see what the peer actually received before the failure.

Auto-committed-on: macbook
The unattested client fixture now returns a control proxy alongside the
client and call log, and the strict-binding runtime test uses it to call
FixtureReady instead of going through the module client. This keeps the
readiness check independent of the runtime API under test.

Auto-committed-on: macbook
The test access struct now holds the service connection alongside the
caller connection so it is not dropped while the fixture is in use.

Auto-committed-on: macbook
The test fixture's lockfile now records tokio as a dependency, keeping it in sync with the fixture manifest.

Auto-committed-on: macbook
Adjust the end-to-end test to import channel control, progressive, and relay types from their new module locations and to use the RuntimeLeaseDriver and tinybus::Result aliases, keeping the test compiling after the bus crate reorganized these items.

Auto-committed-on: macbook
senamakel and others added 2 commits October 30, 2026 13:00
…nd-trip

Adds a test that a legacy reaction payload without a custom emoji id decodes with a None field, and a test that outbound intents restore thread, topic, and reply metadata for provider sends. Also reformats a few long assertions for readability.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
The round-trip tests now expect snake_case field names in the serialized JSON, matching the wire format the channel types actually produce.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
senamakel and others added 20 commits October 30, 2026 20:59
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
…lose

Add an integration test that exercises the web turn projection methods end to end, verifying that they are only reachable through confidential calls, that projected events carry increasing sequence numbers and request context, and that projecting onto a closed turn fails.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Replace the end-to-end web turn test with a focused check that the declared
web projection methods are dispatched and require confidential delivery,
dropping the sequencing and retirement assertions that the smaller test no
longer exercises.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
… payload

Add a runtime web module that forwards channel events to web clients, and extend the bus web event types with flattened context and a richer optional subagent progress detail. Payload field naming moves to snake_case so the wire format matches the rest of the API.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Wrap the large payloads carried by the channel backend, inbound, interaction, remote, and runtime enums in `Box` so the variants stay small, and switch the web argument cap to `is_ok_and`. Callers and tests were updated to construct the boxed values, keeping the wire format unchanged.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Register begin_web_turn, project_web_output and end_web_turn in the module method table so the web turn interface is exposed alongside the existing methods, and update the tests to cover the new entries.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting that optional web channel event fields are left off the wire when absent while explicit false values and zero sequence and timestamp values survive serialization, and that the round trip preserves the event.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Addressed output events now skip serializing optional fields that are None, so payloads no longer carry null placeholders for absent data. Present false, zero, and explicit JSON values are still emitted, and tests cover the new shape.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting that opening a typed output succeeds for lifetimes within the canonical one-hour turn window and is rejected for zero, just-over-an-hour, and maximal values, so the module's lifetime bound stays enforced.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Reduce the maximum typed output lifetime from 30 minutes to 3700 seconds so it aligns with the canonical TinyChannels one-hour host turn lease plus a bounded grace period.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting that legacy message values derive text from typed text parts when no explicit text is given, while preserving an explicit text and the typed payload.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Outbound intents carrying only typed text parts now render a joined text fallback for both the legacy message payload and the relay send action, instead of leaving text empty. Non-text parts are left untouched so rich content still reaches providers that support it.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
…lf-test

Add a test asserting that text-only typed outbound intents convert to legacy messages with the expected content and delivery identity, and extend the storage engine tree check self-test to reject each TSD implementation crate.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Disable persisted checkout credentials in the CI job and allow the tinybus git source in deny.toml. The storage engine tree check now also blocks the tinystoragedrivers core, file, mongodb, s3, and sqlite crates, and the module artifact script hashes via stdin to avoid path handling issues. A test module is wired into the storage schema.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
…te dependency

The module artifact now enables the imessage feature so hosts linking it get the reader, and the storage-engine tree check permits rusqlite only for the module package under the existing opt-in flag. Self-tests cover the module exception and confirm it does not leak to the bus contract.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Outbound intents whose payload is a non-empty list of text-only parts now
reach the provider as plain text instead of a serialized JSON blob, matching
the existing behaviour for text payloads. The test for this path was
reformatted only.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting that converting a parts-based outbound intent to the legacy provider message preserves the parts, caption text, and idempotency key, including when the parts list is empty.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
@senamakel senamakel changed the title Security migration roll-up Integrate canonical channel contracts and native runtime for OpenHuman Oct 31, 2026
senamakel and others added 6 commits October 31, 2026 04:57
…raph checks

Rework the negative controls around the storage-driver-free bus consumer, asserting that storage clients, types, and runtime packages are rejected across versions and sources while dev-only edges are ignored. Add cases for missing or malformed graph evidence and for the required bus being unreachable, so the guard fails closed.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
The storage contract now describes the bus crate's own synchronous CollectionSpec DTOs, the 30-collection inventory, and the standalone consumer proof. The boundary script reuses the bus purity allowlist and fail-closed traversal instead of a hand-maintained forbidden list, so the gate checks the full normal/build closure for storage, runtime, and transport dependencies.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Update all tinystoragedrivers git dependencies to revision 2d23a6a and raise the busproxy pin to 2.1.2 to match the new revision.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Update the pinned tinystoragedrivers git revision from 2.1.1 to 2.1.2 and
move zstd from 0.13 to 0.14 along with its zstd-safe dependency. The lockfile
and workspace manifests were refreshed to match.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Adds assertions that the built-in collection specs declare no ttl or search
fields, plus a test that converting a declared schema to a driver spec keeps
index names, fields and uniqueness along with the ttl field and search paths.

Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant