Repository navigation
Security migration roll-up - #116
Merged
M3gA-Mind merged 885 commits intoNov 2, 2026
Merged
Conversation
Adds tests specifically for the static-link feature to ensure correct behavior when linking statically. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
feat(modules): expose authenticated migration host binding
This update bumps the version across the project and introduces a new feature allowing module setup callbacks to receive an SDK-issued trusted host binding for restricted module controllers. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
chore(release): bump version to 0.3.6
…le context This update introduces support for configuration and trusted host checks within the module context service. It allows the service to expose configuration details and manage context authorization based on the presence of a trusted host. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
…alization Adds a new integration test to verify that a configured cdylib module preserves its binding context even after being reinitialized by the host. This ensures that the module maintains its established security context across lifecycle events. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
…context Introduces `start_reconfigurable_module_with_context` and `start_linked_reconfigurable_module_with_context` to allow module initialization with a host-bound context. This enables more complex setup scenarios where the module needs access to specific host information during configuration. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
…module/src/static_link_tests.rs Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
…/tinybus/examples/module_contex Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
This introduces a new example for testing a configured module context and updates related test scripts and configurations to support it. This allows for more comprehensive testing of module initialization scenarios. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
This introduces a new optional module setup mechanism for static linking tests. It allows defining a setup function that can be optionally provided during module initialization. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Adds assertions to verify the correct manifest is retained when using configured context in static linking tests. This ensures that the configured context module behaves as expected during linking. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Updates the documentation for module setup callbacks to clarify the new `setup_with_context` option and its behavior during reinitialization. This clarifies how context is provided during module setup. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
…o.lock Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
…ures The coverage script's example lists and environment variable map now include the new module_context_configured example so it is built and measured alongside the other test modules. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
…ntext feat: support configured module setup contexts
This update bumps the version across the workspace to 0.3.8 and adjusts the rust version in tinybus to 1.85 to maintain compatibility with the declared MSRV. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
This updates the version numbers in the examples Cargo.lock file to reflect the latest dependency versions. This ensures that the examples are using compatible and up-to-date libraries. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
This commit refactors several areas to improve clarity and robustness. It tightens up conditional checks in `broker.rs` and `service_slot.rs`, and updates the base64 decoding length check in `base64.rs` for better idiomatic Rust. Additionally, the message dispatch logic in `connection.rs` is slightly adjusted for cleaner flow control. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Adds a dedicated CI job to test the host core and the client using Rust 1.85, ensuring compatibility with the declared MSRV. This job runs checks and tests for the client in an isolated environment. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
….TAG,proof-workspaces/msrv-185- Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add the target directory of the msrv-185-client proof workspace to the ignore rules so that generated build output from the MSRV verification run is no longer tracked. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
This change refactors several areas to improve control flow and error handling across module operations. Specifically, it tightens up conditional checks in host management and refines how remembered hashes are stored to ensure correctness when file content hasn't changed. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
This adds a new step to the CI workflow to run `cargo check` with all features enabled for the host core. This ensures that the crate compiles correctly even when all its features are active. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
This updates the gitignore file to exclude the target directory within the proof-workspaces for the msrv-185-client, preventing unnecessary tracking of build artifacts. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
This change updates the module assets for the macos-26-arm64 target. This is likely part of a build or dependency update process. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Replace the unwrap_err call with err plus expect so the test reports a clear message when the preloaded module unexpectedly succeeds instead of panicking with a generic unwrap error. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test case that requests the same single binding twice through the resolver, verifying that a repeated request is accepted only when the completed result still retains that exact binding. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting that when the runtime factory fails during blocking work, the resolver surfaces the startup error together with the terminal marker so callers can treat it as unrecoverable. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The two assertions in the resolver startup test now pass the captured error string as the failure message, so a mismatch reports the actual error instead of only the expected substring. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The resolver test now checks that the error message contains the module bus startup prefix and the runtime refusal reason separately, so the assertion no longer depends on their exact concatenation. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a regression test asserting that when a concurrent unbound admission wins the search path, the callback load fails closed with the expected error, the callback factory is never invoked, and the record ends up in the Failed state. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting that a cached ready resolution cannot substitute for its retained host callback binding, so loading with a different binding fails with the expected error. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The assertion that a concurrent unbound admission fails closed now prints the actual error message when it fails, making the cause of a regression easier to diagnose. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The resolver test now passes the captured error as the assertion message so a failure shows the actual error text instead of only the expected substring. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Adds a callback object to the resolver test fixture so the resolution path that serves a callback interface is exercised alongside the existing record setup. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Replace the err().expect() pattern with an explicit match so the test asserts on the error without tripping clippy's expect_used lint. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
feat(tinybus): bind resolver callbacks to admitted modules
Callback bindings now track their owning host through a dedicated Arc token instead of a Weak reference to the host inner state, which previously forced a recursive auto-trait proof through the loaded bindings. A test asserts that ModuleHost remains Send and Sync. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
fix(module): break recursive host callback Send cycle
Tiny Sweeper reviewFindingsNo active actionable findings. Advisory notes
Verdict: Incomplete · Priority: medium Diagnostics and supporting detailsFull summaryPull request purpose (title): Security migration roll-up. The full pull-request behavior spans bounded ZIP extraction, library digest pinning and attestation, stricter module identity validation, trusted-host context for module setup with pre-ready confidential routes, context-bearing module setup and linked setup, module transport close/reinitialization changes, module lifecycle error metadata, and opt-in search paths. No reportable defects were returned by any completed lane. The latest-push-delta is unavailable: the review state has the prior reviewed head and rendered evidence but no trusted base-to-head diff comparison. Unreviewed paths
Partial review reasons
Review snapshot
Completeness: Incomplete What changedThe latest-push-delta is unavailable: the review state has the prior reviewed head and rendered evidence, but no trusted base-to-head diff comparison; cached prompt differences are not a proven push delta. Features
TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. Before merge
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
|
Warning Review limit reached
This review includes 115 billable files and costs up to $28.75. View limit details
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
tinysweeper
Bot
added
the
priority: p3
Resolve overlapping host-callback, stream-endpoint, try_serve_at and resolver work: keep the epic's identity-bound callback retention, release-cache callback loading and per-attempt factories, and add upstream's setup-readiness ladder (settle), cached-Ready re-check, admission-race recovery and extraction hardening on top. Co-authored-by: Medulla <medulla@tinyhumans.ai>
The coverage script now recognises the module_host_stream_callback example and its TINYBUS_TEST_HOST_STREAM_CALLBACK_MODULE environment variable, so the new module is built and measured alongside the other host callback examples. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The test now starts a dedicated module runtime instead of reusing the shared one, since the fixture module's fixed bus name can already be held by other callback tests and caused contention. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The direct resolver test now builds its fixture with a runtime factory so the resolver has an executor available, matching the setup used by the other resolver tests. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
tinysweeper
Bot
added
priority: p2
Add a resolver test asserting that a module already resolved in the process-wide table but loaded into a different runtime yields an error instead of a callback binding, and that no new binding is prepared. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the upstream roll-up for the security migration in OpenHuman. OpenHuman needs this change available upstream before it can advance its gitlink.
Required by tinyhumansai/openhuman#8487.
Rolls up the TinyBus runtime, module admission, transport, and contract changes.
Validation: no tests or builds were run for this PR. The source branch SHA and its diff against main were verified before opening.