[sanil-23]

Summary

On a host-managed port (storage reached over the bus), TinyBox's box store and jail index now only re-declare the module's current collections. They run no in-module v1 migration.

DocumentBoxStore::open and DocumentIndexStore::open call migrations::prepare, which also ensures the v1 source collections tinybox_boxes and tinybox_jail_index. OpenHuman's storage host owns the schema. It answers an EnsureCollection only when it repeats a spec the grant declares, and the grant is generated from tinybox_bus::storage::collections(). So it refuses the v1 names with schema-is-host-only. The module then cannot open a box store, and every command resource fails.

The legacy data is the host's to carry forward. Its storage_import_tinybox importer writes the v1 shapes and runs the owner's steps. So the module has nothing to migrate on those ports.

This is the same fix tinyhumansai/tinymcp#147 made for TinyMCP.

Observed on OpenHuman main d165fdde8a (TinyBox 0.2.0 pinned from the release): the module loads (served=Release, no contract errors), but every shell call fails with "TinyBox could not create a command resource", and the module log shows schema-is-host-only from the v1 ensure_collection.

Related issue

None filed. Found while smoke-testing OpenHuman main after the 0.2.0 re-pin (tinyhumansai/openhuman#8320).

API or behavior changes

• New public DocumentBoxStore::open_host_managed(storage) and DocumentIndexStore::open_host_managed(storage, registry). They ensure only the current declarations and migrate nothing. Additive, not breaking.
• open is unchanged. It still declares and migrates, for directly bound storage such as the CLI.
• The bus module's ModuleStorage now opens its box store (and its test-only jail registry) with open_host_managed. A bus-backed module no longer writes migration receipts or touches v1 collections on the host's port.

Validation

All four commands were run in a rust:1 container (Rust 1.99):

• cargo fmt --all -- --check: passed
• cargo clippy --all-targets --all-features -- -D warnings: passed
• cargo build --all-targets --all-features: passed
• cargo test --all-features: passed (--no-fail-fast). In an earlier run, tinybox-ssh's host::observed_tests::generated_supervisor_does_not_wait_for_a_lonely_group_anchor failed once. It passed on the rerun and passes alone on unmodified main. This change does not touch tinybox-ssh, which does not depend on tinybox-drivers, so the failure looks like timing under load.

Tests

• faulty_tests.rs: a Faulty::granting(inner, granted) double that refuses ensure_collection for any name outside the grant, like the host.
• migrations_tests.rs:
  • a_host_owned_schema_refuses_what_open_declares_but_not_a_host_managed_open: under a host grant, open fails (it reproduces the bug), and open_host_managed succeeds for both stores.
  • a_host_managed_open_migrates_nothing: with a seeded v1 box, a host-managed open writes no receipt and no v2 record, and leaves the v1 row for the host.
• storage_tests.rs (module): a_bus_backed_store_leaves_the_schema_and_migrations_to_the_host checks that a bus-backed box_store() writes no migration receipts on the host's port.

Documentation

• Rustdoc covers both new constructors and migrations::declare.
• The tinybus_module::storage module docs explain why its ports are host-managed.
• No user-facing docs change.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fff5bc8f-120c-4650-9c88-a828e1a94c45

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: 8f07b30efe941231c65084314e4770101e076ee6

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 7 of 7 files.
Pull request purpose (title): fix(storage): declar…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(storage): declare only, and migrate nothing, on host-managed ports. Tiny Sweeper completed its review; deterministic results follow.

Review snapshot

Change surface	Files	Review signal	Count
Production	4	Active findings	0
Tests	3	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

`migrations::declare` is extracted from `prepare` to ensure only the current declarations; `prepare` now calls `declare` before ensuring the v1 source collections and scanning legacy rows. New public `DocumentBoxStore::open_host_managed` and `DocumentIndexStore::open_host_managed` call `declare` and then a shared `on_prepared` helper, leaving `open` unchanged. `ModuleStorage` in `crates/tinybox-module/src/tinybus_module/storage.rs` opens its box store and its test-only jail registry with `open_host_managed`, so a bus-backed module writes no migration receipts and touches no v1 collections on the host's port. Tests add `Faulty::granting`, which refuses `ensure_collection` for names outside the grant, and cover the host-grant refusal, the no-migration guarantee, and the bus-backed module behavior.

Features

• Added — migrations::declare helper: Ensures TinyBox's current declarations and nothing else, letting host-managed ports confirm host/module agreement without touching v1 source collections; `prepare` now delegates to it before its v1 ensure and legacy scan. (crates/tinybox-drivers/src/migrations.rs)
• Added — DocumentBoxStore::open_host_managed: Opens a box store on host-managed ports by declaring only, so a host grant that refuses the v1 names no longer blocks the module's box store; additive and does not change `open`. (crates/tinybox-drivers/src/box_store.rs impl DocumentBoxStore {)
• Added — DocumentIndexStore::open_host_managed: Opens the jail index store on host-managed ports by declaring only, mirroring the box store behavior and returning an error when the host refuses a declaration, the bridge cannot start, or the registry cannot be a document id. (crates/tinybox-drivers/src/index_store.rs impl DocumentIndexStore {)
• Modified — ModuleStorage uses host-managed opens: The bus module's box store and test-only jail registry now open with `open_host_managed`, so a bus-backed module no longer writes migration receipts or touches v1 collections on the host's port. (crates/tinybox-module/src/tinybus_module/storage.rs impl ModuleStorage {)

Tests

• unit/integration — A bus-backed `box_store()` writes no migration receipts on the host's port.: No claim of execution or pass is made here. (crates/tinybox-module/src/tinybus_module/storage_tests.rs async fn a_recording_view_finds_only_its_own_record() -> TestResult {)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane reviewed 7 of 7 files and reported 0 findings. It noted the code index is behind this pull request (indexed at `0c3886f6fcab`), so retrieved context may be out of date.
• Lane summary: Reviewed 7 files; 0 findings. _The code index is behind this pull request (indexed at `0c3886f6fcab`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane reviewed 7 of 7 files and reported 0 findings. It noted the code index is behind this pull request (indexed at `0c3886f6fcab`), so retrieved context may be out of date.
• Lane summary: Reviewed 7 files; 0 findings. _The code index is behind this pull request (indexed at `0c3886f6fcab`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: It found no reportable defect. It noted the code index is behind this pull request (indexed at `0c3886f6fcab`).
• Lane summary: The change adds host-managed opens that declare only the current collections and skip the v1 migration, wires the module to them, and backs the new paths with tests in both the drivers and the module. The new behaviour is covered: `a_host_owned_schema_refuses_what_open_declares_but_not_a_host_managed_open` pins that `open_host_managed` stops requiring the v1 collections while `open` does not, `a_host_managed_open_migrates_nothing` pins that no receipt is written and the v1 row is left alone, and `a_bus_backed_store_leaves_the_schema_and_migrations_to_the_host` pins it end-to-end through the bus. I found no reportable defect. _The code index is behind this pull request (indexed at `0c3886f6fcab`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane reported no sensitive content in committed files. It noted the code index is behind this pull request (indexed at `0c3886f6fcab`).
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `0c3886f6fcab`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane reported the description matches the diff: two new `open_host_managed` constructors backed by a new `migrations::declare`, the bus module switched to them, and the listed tests and diagnostics are present. It found no accurate defect. It noted the code index is behind this pull request (indexed at `0c3886f6fcab`).
• Lane summary: The description matches the diff: two new `open_host_managed` constructors backed by a new `migrations::declare`, the bus module switched to them, and the tests/diagnostics it lists are present. I found no accurate defect to report against the description or code. _The code index is behind this pull request (indexed at `0c3886f6fcab`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000200
• Tokens: 340523 input · 5109 output · 2048 cached · 417 embedding
• Updated: 2026-10-23T13:49:16Z

Head	State	Pass summary
93f776a7b59e	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T11:27:20Z)
93f776a7b59e	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T11:32:24Z)
8f07b30efe94	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T13:49:16Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0007