Security migration roll-up

.github/workflows/ci.yml

@@ -9,6 +9,32 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 jobs:
+  host-core-msrv:
+    name: Host core and client Rust 1.85
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.85.0
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Check default host core features at the declared MSRV
+        run: cargo check --locked --manifest-path crates/tinybus/Cargo.toml --lib
+
+      - name: Check minimal host core features at the declared MSRV
+        run: cargo check --locked --manifest-path crates/tinybus/Cargo.toml --lib --no-default-features
+
+      - name: Check all host core features at the declared MSRV
+        run: cargo check --locked --manifest-path crates/tinybus/Cargo.toml --lib --all-features
+
+      - name: Exercise the public client from an isolated consumer without SDK dev fixtures
+        run: cargo test --locked --all-targets --all-features --manifest-path proof-workspaces/msrv-185-client/Cargo.toml
+
   module-ci:
     uses: tinyhumansai/.github/.github/workflows/module-ci.yml@4adc1080fb495098e7af1aade82ed7e6e3c69bb7
     with:

.github/workflows/release.yml

@@ -6,6 +6,16 @@ on:
         description: Existing version tag (vX.Y.Z) committed through a reviewed PR
         type: string
         required: true
+      release_mode:
+        description: Use the existing main-only path or the approved reviewed-epic path
+        type: choice
+        options: [main, reviewed-epic]
+        default: main
+        required: true
+      reviewed_pr:
+        description: Positive PR number whose merge commit the tag names (reviewed-epic mode only)
+        type: number
+        required: false
   push:
     tags: ['v*']
 permissions: {}
@@ -18,25 +28,65 @@ jobs:
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
       version: ${{ steps.tag.outputs.version }}
+      release_mode: ${{ steps.tag.outputs.release_mode }}
+      reviewed_pr: ${{ steps.tag.outputs.reviewed_pr }}
     steps:
       - id: tag
         shell: bash
         env:
           TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          RELEASE_MODE: ${{ github.event_name == 'push' && 'main' || inputs.release_mode }}
+          REVIEWED_PR: ${{ inputs.reviewed_pr }}
         run: |
           set -euo pipefail
           [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]] || {
             echo "tag must be v-prefixed semver" >&2
             exit 2
           }
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+          [[ "$RELEASE_MODE" == main || "$RELEASE_MODE" == reviewed-epic ]] || {
+            echo "release_mode must be main or reviewed-epic" >&2
+            exit 2
+          }
+          if [[ "$RELEASE_MODE" == reviewed-epic ]]; then
+            [[ "$REVIEWED_PR" =~ ^[1-9][0-9]*$ ]] || {
+              echo "reviewed_pr must be a positive integer in reviewed-epic mode" >&2
+              exit 2
+            }
+          else
+            [[ -z "$REVIEWED_PR" || "$REVIEWED_PR" == 0 ]] || {
+              echo "reviewed_pr is only valid in reviewed-epic mode" >&2
+              exit 2
+            }
+            REVIEWED_PR=""
+          fi
+          {
+            echo "tag=$TAG"
+            echo "version=${TAG#v}"
+            echo "release_mode=$RELEASE_MODE"
+            # Supply a JSON number when the main path has no reviewed PR input.
+            echo "reviewed_pr=${REVIEWED_PR:-0}"
+          } >> "$GITHUB_OUTPUT"
   sdk-release:
     needs: resolve
+    if: needs.resolve.outputs.release_mode == 'main'
     permissions:
       contents: write
     uses: tinyhumansai/.github/.github/workflows/sdk-release.yml@4adc1080fb495098e7af1aade82ed7e6e3c69bb7
     with:
       tag: ${{ needs.resolve.outputs.tag }}
       version: ${{ needs.resolve.outputs.version }}
       package: tinybus
+  sdk-reviewed-epic-release:
+    needs: resolve
+    if: needs.resolve.outputs.release_mode == 'reviewed-epic'
+    permissions:
+      contents: write
+      pull-requests: read
+      checks: read
+      actions: read
+    uses: tinyhumansai/.github/.github/workflows/sdk-reviewed-epic-release.yml@0cafb7aada1e706fa237948c52decd9b753b111c
+    with:
+      tag: ${{ needs.resolve.outputs.tag }}
+      version: ${{ needs.resolve.outputs.version }}
+      package: tinybus
+      reviewed-pr: ${{ fromJSON(needs.resolve.outputs.reviewed_pr) }}

.gitignore

@@ -1,4 +1,8 @@
 /target
+/examples/target
+/proof-workspaces/msrv-185-client/target/
+/crates/tinybus/.tmp*/
 /worktrees
+__pycache__/
 **/*.rs.bk
 .env

CHANGELOG.md

@@ -0,0 +1,184 @@
+# Changelog
+
+## 0.3.12
+
+### Added
+
+- Allow a bounded, host-configured set of exact confidential controller calls
+  to reach a module during initialization, without changing the wire or ABI.
+- Resolve a live module's unique bus peer from its canonical module ID without
+  loading cold modules or consulting the broker.
+
+## 0.3.11
+
+### Fixed
+
+- Give the process-lifetime module runtime its own selected controller so
+  context-bearing modules receive trusted setup capabilities.
+
+## 0.3.10
+
+### Fixed
+
+- Update the locked WebPKI verifier and root store to patched versions that
+  reject certificate paths through the distrusted emSign intermediates.
+
+## 0.3.9
+
+### Added
+
+- Add configured `setup_factory_with_context` exports that retain per-instance
+  state and receive a fresh loader-issued setup context for each initialization.
+
+## 0.3.8
+
+### Fixed
+
+- Keep the TinyBus host crate compatible with its declared Rust 1.85 MSRV by
+  using stable control-flow and remainder operations.
+
+## 0.3.7
+
+### Added
+
+- Support configured module setup callbacks that receive an SDK-issued
+  `ModuleSetupContext` on initial setup and reinitialization.
+
+## 0.3.6
+
+### Added
+
+- Give module setup callbacks an SDK-issued trusted host binding to the
+  restricted module controller selected by the host.
+
+## 0.3.5
+
+### Added
+
+- Expose `module::Availability` and its stable serialized status names without
+  enabling the optional module loader.
+
+### Fixed
+
+- Make the rejected native-worker spawn test deterministic when another
+  request callback is already in flight, while retaining the uncertain
+  instance's resources until callback settlement.
+
+## 0.3.4
+
+### Added
+
+- `ModuleServiceSlot::try_close_with` runs a borrowed host close callback under
+  the slot lock. Errors and cancellation retain the entry; acknowledged success
+  retires it without calling the stored closer a second time.
+
+## 0.3.3
+
+### Fixed
+
+- Publish a stream's completion or truncation verdict before closing its reader
+  channel, so a reader that has drained the payload observes the correct end.
+
+## 0.3.2
+
+### Added
+
+- `ModuleClient::bind` returns a private ordinary client pinned to the serving
+  peer for root calls, streamed uploads, and held object paths. It supports
+  linked modules and fixtures without making an artifact-attestation claim.
+
+### Fixed
+
+- Ordinary bindings preserve the selected proxy's deadline for owner lookup
+  and later calls unless the client supplies an explicit override.
+
+## 0.3.1
+
+### Added
+
+- `ModuleRuntime::lease` owns reservation activation on the dedicated runtime and
+  returns a cloneable `RuntimeLease` with a shared acknowledged-stop worker.
+- `RuntimeLeaseDriver` and `StopOutcome` expose a protocol-neutral lifecycle
+  contract on the slim build; only proven-settled failures are retried.
+- `RuntimeLeaseDriver::start` returns `StartOutcome` to distinguish acknowledged
+  start, a proven-settled failure, and an uncertain remote operation.
+- `ModuleClient::bind_attested` returns a client pinned to the proven unique
+  peer, including for later calls and held object paths.
+- Unacknowledged and faulted cleanup retains the exact callback registration
+  until STOP acknowledgement.
+
+### Fixed
+
+- An uncertain START keeps its reservation, object, and callback registration
+  owned until an authoritative settlement; it never triggers an overlapping STOP.
+- Closing a linked module connection wakes an idle receive without requiring
+  another inbound frame, drains queued frames, and refuses sends after close.
+
+## 0.3.0
+
+### Breaking changes
+
+- `RuntimeSetup` now receives the `ModuleHost` alongside its connection, so
+  runtime setup can install callbacks without a second process-global slot.
+- `LinkedModule` carries an optional Rust-only setup initializer generated by
+  `module_export_static!`; struct literals must provide `init_with_setup`.
+
+### Added
+
+- `ModuleHost::attach_linked_with_setup` replaces one linked export's default
+  setup with state captured for that admitted instance and waits for readiness.
+- `ModuleHost::module_for_sender` resolves broker-assigned unique peers to exact
+  admitted `ModuleId`s without a broker lookup.
+- `ModuleRuntime::serve_host_object` returns a drop guard for host object and
+  name ownership, with cleanup on the module runtime.
+
+### Fixed
+
+- Host object guards remove only their own interface registration and preserve
+  names that were already owned before the first guard.
+- Canceling or timing out linked setup revokes its pending module admission.
+- Module sender identity now requires an exact canonical manifest/descriptor
+  match rather than a sanitized display-name match.
+
+## 0.2.2
+
+### Added
+
+- `ModuleClient::call_with_stream` and `call_with_stream_detailed` upload
+  payloads through the module's validated proxy; the detailed form preserves
+  untrusted remote wire failures while keeping renderings and reports redacted.
+- `ModuleObjectClient::call_detailed` retains exact remote method failure
+  details for held objects while keeping its sanitized call wrapper.
+
+### Fixed
+
+- A streamed method follows the unique peer that accepted `Open`, so a
+  well-known-name handover cannot split its method from its payload.
+- A refused protocol frame reports as a transport failure rather than as a
+  module execution fault.
+
+## 0.2.1
+
+### Added
+
+- `ModuleClient::call_attested_detailed` retains remote method failure fields
+  for product adapters while keeping renderings and failure reports redacted.
+
+## 0.2.0
+
+### Breaking changes
+
+- Module search paths are now opt-in. Hosts that need discovery must configure
+  `SearchPathConfig` with their own environment variable and app directory;
+  TinyBus no longer assumes OpenHuman's `OPENHUMAN_MODULE_PATH` or data paths.
+- `ModuleHost::search_paths` is now an instance method and
+  `ResolverInputs` carries optional search-path configuration and a linked
+  registry. Update resolver construction to pass a `LinkedRegistry` (usually
+  `LinkedRegistry::global()`) and the host's `SearchPathConfig`, if any.
+
+### Added
+
+- `UnloadedAccess` provides registry-backed client access for builds without
+  the dynamic module loader.
+- Hosts can set a bundled release directory and resolve it using an explicitly
+  named environment variable.