[M3gA-Mind]

Summary

Every jailed stdio MCP server was refused before it launched. tinymcp named tinybox-bus tag v0.1.36 (contract 1.21), and is_compatible needs the module's major to match. OpenHuman ships TinyBox 2.x (v0.2.5, contract 2.3; since its latest pin, v0.2.6, 2.4). So JailedSpawner::launch refused before reserving anything, with "the sandbox module is too old for jailed stdio". In OpenHuman that's every registry or mcp.json stdio server. We reproduced it in a running headless OpenHuman core, where the server's status showed status: "error", tool_count: 0 with that message.

This moves the dependency to tag v0.2.5 (contract 2.3), whose is_compatible accepts both 2.3 and 2.4 modules. A newer tag would raise the required minor past an older shipped module, and the manifest comment says so. The refusal now names both versions instead of calling a newer module "too old". A second commit drops three stale deny.toml ignores for a zip version that's no longer in the tree.

Related issue

Closes #169. Supersedes the lock-only dependabot #160, which can't move a git-tag requirement and fails --locked.

API or behavior changes

• tinybox-bus v0.1.36 → v0.2.5 (git tag on official main). Cargo.lock changes only that entry, plus one dependency line inside it (schemars, already in the lock).
• NativeJailConfig gained resources in tinybox-bus 2.x; jailed stdio sends resources: None, so the request's wire form is unchanged.
• The refusal message now reads "the sandbox module speaks contract X.Y, but jailed stdio needs A.B or a later A.x".
• deny.toml: the RUSTSEC-2026-0367/0368/0369 ignores are removed. cargo-deny reported them as advisory-not-detected.

Validation

On our Linux CI runner (toolchain 1.99.1), on this branch from main e098e53:

• cargo fmt --all -- --check: clean
• cargo clippy --locked --all-targets --all-features -- -D warnings: 0 errors (main: 0)
• cargo build --locked --all-targets --all-features: ok; RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features: clean
• cargo test --locked --all-features -p tinymcp jailed: 25 passed, 0 failed
• cargo test --locked --all-features --workspace: 1579 passed, 1 failed. The failure is directories::test::reconfiguration_waits_for_an_in_flight_tool_call_before_replacing_the_service, a timing flake that also fails on main in full-suite runs and passes alone.
• cargo deny check: only RUSTSEC-2026-0459 (libsqlite3-sys, via tinystoragedrivers; same on main, fixed separately). The three advisory-not-detected warnings main shows are gone.
• The lockfile diff is exactly the tinybox-bus entry (cargo update -p tinybox-bus), and every command above ran with --locked.
• Red control: with main's Cargo.toml and Cargo.lock (tinybox-bus v0.1.36) put back, the_tinybox_contracts_openhuman_ships_start_a_jailed_server compiles and fails: contract (2, 3): ... the sandbox module speaks contract 2.3, but jailed stdio needs 1.21 or a later 1.x. That's the refusal this PR removes, now worded with both versions.

Tests

• the_tinybox_contracts_openhuman_ships_start_a_jailed_server starts a jailed server against TinyBox contracts 2.3 and 2.4. With main's Cargo.toml and Cargo.lock (bus 0.1.36) it fails.
• a_refused_contract_names_both_versions checks the message, and that CAPABILITIES is the only bus call made.

Documentation

docs/specs/stdio-sandbox.md names the contract the jail speaks.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c6353930-ea37-4bd8-b62a-a8adbfdd57d5

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tinysweeper]

Tiny Sweeper review

Reviewed head: 564292e9407e47734e4bb4e6034486257c8b5d98

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 5 of 6 files; not reviewed: Cargo.lock.
Pull request purpose (title): Build jailed stdio o…

Diagnostics and supporting details

Full summary

Pull request purpose (title): Build jailed stdio on tinybox-bus v0.2.5 so the shipped TinyBox is accepted. Purpose (from the pull-request title): build jailed stdio on tinybox-bus v0.2.5 so the shipped TinyBox is accepted. The pull request fixes jailed stdio MCP servers being refused before launch: tinymcp pinned tinybox-bus v0.1.36 (contract 1.21), and `is_compatible` requires the module's major to match, so every TinyBox 2.x module (contract 2.3/2.4) was rejected before anything was reserved. The dependency moves to tag v0.2.5 (contract 2.3), whose `is_compatible` accepts 2.3 and 2.4; the jail request gains `resources: None` for the new `NativeJailConfig` field; the refusal error now names both the module's contract and the required one instead of calling a newer module "too old"; the stdio-sandbox spec table is updated; and three stale `deny.toml` advisory ignores are removed. Cargo.lock was not reviewed (5 of 6 files covered).

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	1	Noted findings	0
Documentation	1	Resolved findings	0
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

Jailed stdio now builds against tinybox-bus v0.2.5 (contract 2.3) instead of v0.1.36 (contract 1.21), so TinyBox 2.3 and 2.4 modules start instead of being refused. The jail request sends `resources: None` to satisfy the new `NativeJailConfig` field. Incompatible modules are still refused before any resource is reserved, but the error reports both the module's contract version and the required one rather than describing a newer module as too old. The stdio-sandbox spec row documents the contract and the refusal behavior, and `deny.toml` starts from an empty advisory ignore list. The description lane answered that the diff matches its description and characterizes the unverified claims as caveats.

Features

• Modified — tinybox-bus dependency moved to v0.2.5 (contract 2.3): Jailed stdio launches against the TinyBox releases hosts actually ship; `is_compatible` now accepts 2.3 and 2.4 modules rather than refusing every 2.x module. The manifest comment records that the tag must not be raised past the shipped module, since a newer tag would raise the required minor past an older module. (Cargo.toml tinymcp-bus = { path = "crates/tinymcp-bus" })
• Modified — Jail request sends `resources: None`: Satisfies the `resources` field added to `NativeJailConfig` in tinybox-bus 2.x while sending no limits, so no resource limits are imposed on stdio servers; the comment claims the request's wire form is unchanged. (crates/tinymcp/src/transport/stdio/jailed.rs impl JailedSpawner {)
• Modified — Incompatible-contract refusal names both versions: A rejected module now produces an error naming the module's contract and the required contract (for example "speaks contract 1.21, but jailed stdio needs 2.3 or a later 2.x") instead of calling a newer module "too old"; refusal still happens before any resource is reserved. (crates/tinymcp/src/transport/stdio/jailed.rs impl JailedSpawner {)
• Removed — Stale deny.toml advisory ignores removed: The RUSTSEC-2026-0367/0368/0369 ignores for a zip version no longer in the tree are dropped, so cargo-deny no longer reports advisory-not-detected warnings and any future advisory on those IDs would fail the check. (deny.toml all-features = true)
• Modified — stdio-sandbox spec documents the jail contract: The spec table now names tinybox-bus v0.2.5 / contract 2.3, states that 2.3 and later 2.x modules are accepted, and documents that an incompatible module is refused before anything is reserved with an error naming both versions. (docs/specs/stdio-sandbox.md A stdio MCP server is third-party code. The module starts one of three ways:)

Tests

• new test — Starts a jailed server against TinyBox contracts 2.3 and 2.4 and asserts initialization succeeds and START_STDIO is invoked for each.: The tests lane answered that this behavior is covered: it pins the contract pair the dependency bump enables and would fail under the old 0.1.x contract. (crates/tinymcp/src/transport/stdio/jailed_tests.rs async fn a_sandbox_module_too_old_for_stdio_is_refused_before_any_resource_exist)
• new test — Spawns against a module reporting contract 1.21 and asserts the exact refusal message naming both versions, and that CAPABILITIES is the only bus call made.: The tests lane answered that this behavior is covered: the exact refusal text and the no-reservation ordering are pinned. (crates/tinymcp/src/transport/stdio/jailed_tests.rs async fn a_sandbox_module_too_old_for_stdio_is_refused_before_any_resource_exist)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 5 files; 1 finding.

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The security lane answered, reviewing 4 of 4 code files with 0 findings; the spec doc was excluded as prose or tabular data.
• Lane summary: Reviewed 4 files; 0 findings. 1 file was not security-reviewed: docs/specs/stdio-sandbox.md (prose or tabular data).

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The tests lane answered that the launch-acceptance and refusal-message behaviors are covered, and identified the wire-form claim on `resources: None` as an unverified gap.
• Lane summary: The behaviour change — moving to tinybox-bus v0.2.5 and its contract 2.3 — is covered: one new test drives a full launch against contracts 2.3 and 2.4 (which the old 0.1.x contract would refuse), and another pins the refusal message naming both versions and asserts nothing is reserved before the refusal. One claim in the diff is not pinned by any test: the comment on `resources: None` says the request's wire form is unchanged, and the fake backend accepts any jail payload, so that claim is only asserted by the author, not verified here.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane answered and found no sensitive content in committed files.
• Lane summary: No sensitive content in committed files.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane answered that the diff matches its description — the pin move, `resources: None`, the two-version message with its tests, the `deny.toml` removal, and the spec update — and that unverified claims are stated as caveats rather than concealed.
• Lane summary: The description matches the change: it correctly explains the v0.1.36 → v0.2.5 pin (contract 1.21 → 2.3) that stops `is_compatible` from refusing TinyBox 2.x modules, the new `resources: None` field on `NativeJailConfig`, the two-version refusal message with its two accompanying tests, the `deny.toml` ignore removal, and the spec update. Nothing significant in the diff goes unmentioned, and the unverified claims (wire-form stability, the disclosed full-suite flake) are stated as caveats rather than concealed. Merging looks safe.

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.026595
• Tokens: 652424 input · 101023 output · 238976 cached · 331 embedding
• Updated: 2026-11-11T12:55:33Z

Head	State	Pass summary
9fc1cf301172	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T10:59:03Z)
564292e9407e	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T12:55:33Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0073