[sanil-23]

Summary

Bump the workspace version from 0.2.0 to 0.2.1 to release the host-managed storage fix (#124). Changes the root workspace.package version and the internal path-dependency constraints, and regenerates Cargo.lock. No code changes.

Related issue

Releases #124 (declare-only, no migration, on host-managed storage ports).

API or behavior changes

None. Version metadata only.

Validation

• cargo metadata --locked: passes; every workspace crate (incl. tinybox-module) resolves to 0.2.1.
• fmt / clippy / build / test were run green on the 0.2.0 tree at fix(storage): declare only, and migrate nothing, on host-managed ports #124; this commit changes no code.

Tests

None needed — version metadata only.

Documentation

None needed.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

---

After merge: tag v0.2.1 at the merged commit (the Release workflow verifies the tag is on main and the module version matches, then builds and verifies all 17 archives).

🤖 Generated with Claude Code

[tinysweeper]

Tiny Sweeper review

Reviewed head: e93b746727842570eb07fdd98cac18cf6c01bb96

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 2 files; not reviewed: Cargo.lock.
Pull request purpose (title): chore: bump workspac…

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore: bump workspace version to 0.2.1. Release-metadata chore: bumps the workspace version from 0.2.0 to 0.2.1 for the host-managed storage fix (#124), updating `workspace.package.version` and every internal path-dependency constraint to match, with no code changes. Critique and security lanes answered with no findings; description lane answered with no description defect, noting the lockfile regeneration could not be confirmed from the visible diff. The latest-push delta is unavailable: no trusted base-to-head comparison exists, so nothing here should be read as a push delta.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

`Cargo.toml` moves `[workspace.package] version` from 0.2.0 to 0.2.1 and bumps the version constraint on each internal path dependency (tinybox-bus, tinybox-core, tinybox-host, tinybox-jail, tinybox-linux, tinybox-microvm, tinybox-docker, tinybox-ssh, tinybox-sync, tinybox-drivers) to 0.2.1. Workspace members inherit `version.workspace = true`, so pinned versions stay consistent. The pull request also lists `Cargo.lock` among changed files, but the lockfile contents were not visible in the reviewed diff. No dependency, feature, or lint settings changed.

Features

• Modified — Workspace package version bump to 0.2.1: Propagates 0.2.1 to all workspace members that inherit `version.workspace = true`, making the tree consistent for the v0.2.1 release described in the PR body. (Cargo.toml members = [, Cargo.toml serde_json = "1")
• Internal refactor — Internal path-dependency version constraints aligned to 0.2.1: Keeps the `{ path = ..., version = ... }` constraints on internal crates matching the bumped workspace version so workspace resolution does not point any internal requirement at 0.2.0. (Cargo.toml members = [, Cargo.toml serde_json = "1")

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane answered with no defect in the file: the version bump is mechanical and no internal dependency requirement is left pointing at 0.2.0. It did note it could not verify from the diff alone whether a file outside `Cargo.toml` (e.g. a release workflow or a crate manifest pinning by explicit path and version) still pins 0.2.0.
• Lane summary: The diff is a mechanical version bump: `[workspace.package] version` moves 0.2.0 → 0.2.1 and every internal path dependency's `version` field is bumped to match. Every workspace member inherits `version.workspace = true` and every path dependency is `{ path = ..., version = ... }` against the same workspace, so the pinned versions stay consistent; no dependency requirement is left pointing at 0.2.0 inside the workspace, and nothing outside this file (release manifest, lockfile-derived artifact name) is shown to depend on the old string. One thing I could not verify from the diff alone is whether any file outside Cargo.toml still pins `0.2.0` for an internal crate (e.g. a release workflow or `crates/tinybox-bin/Cargo.toml`, which pins `tinybox-cli` by explicit path and version rather than `.workspace = true`) — that file was not part of this change and is another reviewer's subject. No defect in this file. _The code index is behind this pull request (indexed at `b745626a7f02`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered with no findings: a version bump with no dependency, feature, or CI permission changes and no secrets in the diff.
• Lane summary: A version bump across the workspace manifest and its internal path dependencies, with no dependency, feature, or CI permission changes. Nothing here is exploitable or breaks a build, and no repository rule is violated. _The code index is behind this pull request (indexed at `b745626a7f02`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered with no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `b745626a7f02`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane answered with no description defect: the diff is a version-only bump matching the stated intent, though it could not confirm from the diff that `Cargo.lock` was regenerated as claimed.
• Lane summary: The diff is a version-only bump: `workspace.package.version` 0.2.0 → 0.2.1 plus the matching internal path-dependency constraints, which is exactly what the description claims. I could not see any crate-level `version.workspace = true` manifests or `Cargo.lock` in the diff to confirm the lockfile was regenerated as claimed, but that is a validation claim rather than a mismatch with the described change. No description defect found. _The code index is behind this pull request (indexed at `b745626a7f02`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000121
• Tokens: 67688 input · 1550 output · 5632 cached · 43 embedding
• Updated: 2026-10-23T13:58:05Z

Head	State	Pass summary
e93b74672784	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T13:58:05Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5ff2f8dc-ff45-4edc-9b27-521add47b1da

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0001

[sanil-23]

Duplicate of #126 (same 0.2.1 bump, already green). Closing in favor of that one.