[senamakel]

Summary

Bumps the workspace to 0.2.6 so a release can carry #148: retained agent37 boxes (idle sleep, adoption by owner key, expiry of long-sleeping boxes, waiting for waking instances) and box contract 2.4 with Capability::Retention.

Related issue

None.

API or behavior changes

Version numbers only: the workspace version and the sibling crate pins in [workspace.dependencies].

Validation

• cargo check -p tinybox-agent37 -p tinybox-module --locked: passes

After this merges, a v0.2.6 tag at the merged commit publishes the release.

Co-authored-by: Medulla medulla@tinyhumans.ai

Summary by CodeRabbit

• Chores
  • Updated the workspace package version to 0.2.6.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 212c87b623dc7c102c5e2910d7b368a74dfc8038

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 2 files; not reviewed: Cargo.lock.
Pull request purpose (title): chore(release): tiny…

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(release): tinybox 0.2.6. Release chore bumping the tinybox workspace from 0.2.5 to 0.2.6 so a release can carry #148 (retained agent37 boxes and box contract 2.4 with `Capability::Retention`). The change is a pure version bump: the workspace version and every internal path-dependency pin move in lockstep, with no dependency additions, feature changes, or CI permission changes. The latest-push delta is unavailable, so no push-level comparison is reported.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

`Cargo.toml` moves `[workspace.package]` version from 0.2.5 to 0.2.6 and updates the internal path-dependency pins in `[workspace.dependencies]` (tinybox-agent37, tinybox-bus, tinybox-core, tinybox-host, tinybox-jail, tinybox-linux, tinybox-microvm, tinybox-docker, tinybox-openshell, tinybox-ssh, tinybox-sync, tinybox-drivers) to 0.2.6. `Cargo.lock` is also touched per the diffstat. The tinystoragedrivers git pins at rev 6226b9484c8bd01c58741718cd89ba90a13a36bb are unchanged.

Features

• Modified — Workspace version bump to 0.2.6: Sets the release version for all workspace crates so a v0.2.6 tag at the merged commit publishes the release carrying Retained agent37 boxes: sleep when idle, adopt by owner key, expire; wait for waking instances #148. (Cargo.toml members = [, Cargo.toml base64 = "0.22")
• Modified — Internal path-dependency pins moved to 0.2.6: Keeps sibling crate requirements aligned with the new workspace version; no dependency additions or feature changes. (Cargo.toml tinystoragedrivers-busproxy = { version = "2.1.2", git = "https://github.com/tin)

Tests

• skipped — No behavioural change: nothing outside documentation, configuration and tests.: The PR description states `cargo check -p tinybox-agent37 -p tinybox-module --locked` passes, but this is author-reported and not verified by trusted check evidence. (Cargo.toml members = [)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The version edits are consistent with each other across `[workspace.package]` and every internal path dependency.
• Lane summary: This is a mechanical workspace version bump from 0.2.5 to 0.2.6 across `[workspace.package]` and every internal `path` dependency. The edits are consistent with each other. The one thing I cannot verify from the diff alone is whether any crate pins an internal dependency with an exact `=0.2.5` requirement or whether Cargo.lock is updated, but nothing in the changed lines suggests a mismatch. No findings. _The code index is behind this pull request (indexed at `317251e71ae4`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: No dependency additions, feature changes, or CI permission changes; the change is a pure version bump.
• Lane summary: A pure version bump: the workspace version and every internal path dependency move from 0.2.5 to 0.2.6 in lockstep, with no dependency additions, feature changes, or CI permission changes. The change looks sound. _The code index is behind this pull request (indexed at `317251e71ae4`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: No sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `317251e71ae4`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The diff matches the title and body exactly; the body's claim that only version numbers change is accurate, and remaining 0.2.5 strings in Cargo.lock are lockfile entries for other crates not touched by this change.
• Lane summary: The diff is a pure version bump: the workspace version and the internal path-dependency pins move from 0.2.5 to 0.2.6, which matches the title and body exactly. The body's claim that only version numbers change is accurate; the remaining 0.2.5 strings in Cargo.lock are lockfile entries for other crates and are not touched by this change. _The code index is behind this pull request (indexed at `317251e71ae4`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.001330
• Tokens: 76134 input · 1502 output · 8704 cached · 79 embedding
• Updated: 2026-11-11T08:19:08Z

Head	State	Pass summary
212c87b623dc	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T08:19:08Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Cargo.toml updates the workspace package version and listed internal path-dependency versions from 0.2.5 to 0.2.6.

Changes: Release version update

Layer / File(s)	Summary
Workspace and dependency version sync Cargo.toml	The workspace package and listed internal path dependencies change to version 0.2.6.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Possibly related issues

• Make tinybox sandbox-only: capability honesty, resource limits, network policy, events, bus contract (Linux/macOS/Windows) #27: This PR updates the workspace version, which is part of the release hygiene described in the issue. The available changes do not show release-tag or bus-contract updates.

Possibly related PRs

• tinyhumansai/tinybox#139: This PR also updates the workspace and internal dependency versions as part of a release.
• tinyhumansai/tinybox#146: This PR is an earlier workspace and internal dependency version update.

Suggested reviewers: tinysweeper

Merge Risk: Minimal · up to 212c8

This is a version bump for the 0.2.6 release. It does not change runtime behavior, and no merge-blocking risk was found.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the release version bump to tinybox 0.2.6, which matches the main change.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the version line,
Then hops through pins that now align.
From zero-two-five to six they go,
The Cargo fields reflect the flow.
One tidy bump, then carrots grow.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c805cea3-7120-410e-849a-5f2ca0c1342a

Commits

Reviewing files that changed from the base of the PR and between 690bb56 and 212c87b.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T08:19:55.668083Z	212c87b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0013