Expose trusted broker caller context without changing legacy dispatch

[senamakel]

Security modules currently cannot verify which broker connection sent a call: dispatch drops the sender before invoking an interface. Add CallContext and a compatible Interface::call_with_context extension so handlers can bind privileged calls and callbacks to a trusted peer.

Broker delivery provenance stays separate from raw sender headers. Public sends, retained transport handles, custom transports and old native host prefixes cannot mint authenticated context. Native delivery captures provenance per frame, including eager initialization and messages queued before admission. Existing handwritten and macro interfaces retain their signatures and behavior; the native vtable keeps its frozen ABI-v1 prefix with a size-checked optional extension. A connection identity does not establish a human or tenant identity.

Release the object-tree read lock before awaiting a handler so callbacks can register interfaces without deadlocking. Preserve Rust 1.85 compatibility with equivalent syntax rewrites and explicit workspace MSRV inheritance.

Validation at 5770f0c: independent specification and code-quality review passed; format, strict Clippy, default/all-feature workspace tests, slim builds, Rust 1.85, warning-denying docs, actual native fixtures and the 90% per-file coverage gate passed (94.04% aggregate lines). Native fixtures cover eager/lazy startup and reentrant callbacks. Behavioral RED→GREEN regressions cover retained-endpoint forgery, queued pre-admission provenance, registration deadlock and wrong-peer stream writes. Platform CI runs on this PR.

Prerequisite for the native TinySecurity audit and approval migration in tinyhumansai/openhuman#7328 and tinyhumansai/tinysecurity#5.

Admitted native modules also expose their unchanged artifact attestation through their fixed unique connection name. Confidential routing resolves and verifies that exact peer atomically; unrelated aliases and successor peers inherit no admission. Stopped or faulted modules reject fixed-peer calls before transport detachment. This lets security callbacks combine a pinned recipient with artifact verification. Actual hashed clock and eager/lazy callback fixtures cover the behavior.

Summary by CodeRabbit

• New Features
  • Services can access broker-authenticated caller identities when handling calls, enabling more reliable authorization.
  • Confidential calls can target an admitted module by its fixed unique identity, while preserving attestation checks.
  • Module hosts can read compatible versions of the host interface, including older supported versions.
• Bug Fixes
  • Calls to modules in unavailable states are refused, and unverified sender identities are not treated as authenticated.
• Documentation
  • Clarified caller authentication and confidential-call rules, including how module identity and attestation behave when names change.
• Chores
  • The minimum supported Rust version is now 1.85.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper completed its review; deterministic results follow.

State: Incomplete
Priority: high
Reviewed head: 41cdecba4c64
Updated: 2026-10-11T01:41:03Z

Review snapshot

Change surface	Files	Review signal	Count
Production	22	Active findings	1
Tests	9	Noted findings	1
Documentation	2	Resolved findings	4
Configuration	5	Pending checks/questions	9

Completeness: Incomplete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

Incremental change exposing trusted broker caller context without changing legacy dispatch: confidential calls may now target an admitted module's fixed unique peer; a CallContext with transport-authenticated sender flows through Interface::call_with_context; the memory transport and module ABI carry private broker provenance; CI fixture, docs, and style/rust-version updates accompany it.

Features

• Modified — Confidential calls to an admitted module's fixed unique peer: crates/tinybus/src/broker.rs#impl Broker resolves confidential calls to well-known and unique names under one router lock, and crates/tinybus/src/router.rs#impl Router tracks admitted_artifact per Peer (crates/tinybus/src/router.rs#struct Peer) so resolve_attested and attestation_of admit the exact unique connection while aliases and successors inherit nothing. (crates/tinybus/src/broker.rs#impl Broker {, crates/tinybus/src/router.rs#impl Router {, crates/tinybus/src/router.rs#struct Peer {, docs/protocol.md#A broker that sees it **must**:, docs/modules/attest/README.md#digest, and that the operator listed that digest as acceptable.)
• Added — CallContext with transport-authenticated sender: crates/tinybus/src/service/mod.rs#pub trait Interface: Send + Sync + 'static gains call_with_context and CallContext is re-exported via crates/tinybus/src/lib.rs; crates/tinybus/src/connection.rs#async fn dispatch(inner: &Inner, header: &Header, body: Value) -> Result<Value> builds brokered context only on proven broker deliveries, and ObjectTree invocation snapshots admission before releasing the tree lock. (crates/tinybus/src/service/mod.rs#pub trait Interface: Send + Sync + 'static {, crates/tinybus/src/connection.rs#async fn dispatch(inner: &Inner, header: &Header, body: Value) -> Result<Value>, crates/tinybus/src/service/tree.rs#impl ObjectTree {, crates/tinybus/src/lib.rs#pub use crate::ports::{Listener, Transport};)
• Added — Broker provenance in the memory transport and dispatch loop: crates/tinybus/src/transport/memory.rs#impl MemoryTransport { carries a private brokered flag on Delivery via send_brokered/recv_with_provenance; crates/tinybus/src/connection.rs#async fn dispatch_loop(inner: Arc<Inner>) samples provenance per frame; crates/tinybus/src/transport/mod.rs adds an intrinsic downcast so a custom transport cannot borrow broker provenance. (crates/tinybus/src/transport/memory.rs#impl MemoryTransport {, crates/tinybus/src/connection.rs#async fn dispatch_loop(inner: Arc<Inner>) {, crates/tinybus/src/transport/mod.rs#pub mod memory;)
• Added — Additive broker_routing callback in the native module ABI: crates/tinybus/src/module/abi.rs#impl TbAbiDescriptor adds an optional broker_routing tail to TbHostVtable with a read_compatible prefix copy; crates/tinybus/src/module/transport.rs#impl ModuleTransport { exposes admit_broker keyed on actual broker attachment; crates/tinybus-module/src/lib.rs#impl Transport for ModuleTransport { captures per-frame provenance into the module connection. (crates/tinybus/src/module/abi.rs#pub struct TbHostVtable {, crates/tinybus/src/module/abi.rs#impl TbAbiDescriptor {, crates/tinybus/src/module/transport.rs#impl ModuleTransport {, crates/tinybus-module/src/lib.rs#impl Transport for ModuleTransport {, crates/tinybus-module/src/lib.rs#unsafe fn write_module_vtable()

Tests

• addition — Host-transport tests verify native provenance requires actual broker admission and that the frozen host-vtable prefix stays readable by old modules; host tests add ignored cdylib-based authentication tests and terminal-state refusals for fixed unique module calls.: Behavior is asserted in the diff; execution not confirmed by trusted check evidence. (crates/tinybus/src/module/transport_tests.rs#async fn delivery_maps_a_faulted_transport_a_missing_module_and_module_refusals(, crates/tinybus/src/module/host_tests.rs#async fn a_module_loaded_from_an_allowlisted_artifact_becomes_an_attested_recipi)
• Unreviewed: tinysweeper/tests

Findings

• high · critique · Mark broker-routed memory deliveries as brokered — The new trusted context is only populated when a `Delivery` carries `brokered: true`, but the broker forwarding path is not changed in this diff to call `send_brokered`; ordinary f (crates/tinybus/src/transport/memory\.rs:75)

Lower-confidence notes

• high · critique — Keep well-known attestations off the unique connection (crates/tinybus/src/connection\.rs)

Resolved this pass

• Keep well-known attestations off the unique connection
• Keep well-known attestations off the unique connection
• Keep well-known attestations off the unique connection
• Keep well-known attestations off the unique connection

Could not review: crates/tinybus-module/src/lib.rs, crates/tinybus/src/attest.rs, crates/tinybus/src/module/abi.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/service/mod.rs, crates/tinybus/src/service/tree.rs, tinysweeper/description, tinysweeper/tests

Before merge

• Address Mark broker-routed memory deliveries as brokered (crates/tinybus/src/transport/memory\.rs).
• Complete the critique review for crates/tinybus-module/src/lib.rs, crates/tinybus/src/module/abi.rs, crates/tinybus/src/module/host.rs.
• Complete the security review for crates/tinybus/src/attest.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/service/mod.rs, crates/tinybus/src/service/tree.rs.
• Complete the tests review for tinysweeper/tests.
• Complete the description review for tinysweeper/description.

How this fits together

flowchart LR
  n0["HostCalls<br/>changed"]:::changed
  n1["ModuleTransport<br/>changed"]:::changed
  n1 -->|uses| n0
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Failure
• Scope reviewed: incomplete; unanswered: crates/tinybus-module/src/lib.rs, crates/tinybus/src/module/abi.rs, crates/tinybus/src/module/host.rs
• Lane summary: Reviewed 5 files; 2 findings. 3 files could not be reviewed: crates/tinybus-module/src/lib.rs, crates/tinybus/src/module/abi.rs, crates/tinybus/src/module/host.rs. _The code index is behind this pull request (indexed at `943e2921dce6`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer: timed out after 20s), so this review saw part of what the engine holds._
• Evidence: crates/tinybus/src/transport/memory\.rs — Mark broker-routed memory deliveries as brokered

security

• Conclusion: Success
• Scope reviewed: incomplete; unanswered: crates/tinybus/src/attest.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/service/mod.rs, crates/tinybus/src/service/tree.rs
• Lane summary: Reviewed 4 files; 0 findings. 4 files could not be reviewed: crates/tinybus/src/attest.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/service/mod.rs, crates/tinybus/src/service/tree.rs. _The code index is behind this pull request (indexed at `943e2921dce6`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer: timed out after 20s), so this review saw part of what the engine holds._

tests

• Conclusion: Neutral
• Scope reviewed: incomplete; unanswered: tinysweeper/tests
• Lane summary: No reviewer could be consulted.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Neutral
• Scope reviewed: incomplete; unanswered: tinysweeper/description
• Lane summary: No reviewer could be consulted.

Evidence and run details

• Models: ladder/vectors-oai3, openai/gpt-5.6-luna, z-ai/glm-5.3-flash, , deep
• Spend: $0.133007
• Tokens: 540663 input · 15078 output · 74015 cached · 774 embedding
• Continuity: summary cache chain restarted at the storage ceiling.

Head	State	Pass summary
fb390884fc8e	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-10T22:22:02Z)
5770f0cf8cf4	incomplete	1 active finding(s), 0 resolved finding(s) (at 2026-10-10T23:02:17Z)
31741bec6328	incomplete	0 active finding(s), 1 resolved finding(s) (at 2026-10-10T23:18:51Z)
943e2921dce6	incomplete	0 active finding(s), 2 resolved finding(s) (at 2026-10-10T23:37:12Z)
41cdecba4c64	incomplete	1 active finding(s), 4 resolved finding(s) (at 2026-10-11T01:41:03Z)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e2de42ef-3321-4c97-b5d2-0d1573bf8fcd

---

📥 Commits

Reviewing files that changed from the base of the PR and between 943e292 and 41cdecb.

---

📒 Files selected for processing (8)

• crates/tinybus-module/src/lib.rs
• crates/tinybus/src/attest.rs
• crates/tinybus/src/connection.rs
• crates/tinybus/src/module/abi.rs
• crates/tinybus/src/module/host.rs
• crates/tinybus/src/service/mod.rs
• crates/tinybus/src/service/tree.rs
• crates/tinybus/src/transport/memory.rs

---

🚧 Files skipped from review as they are similar to previous changes (5)

• crates/tinybus/src/module/host.rs
• crates/tinybus/src/service/tree.rs
• crates/tinybus/src/service/mod.rs
• crates/tinybus/src/transport/memory.rs
• crates/tinybus/src/connection.rs

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The change adds broker-authenticated sender context to interface calls and tracks broker-delivery provenance across broker and native module transports. It also adds host-vtable compatibility handling, context module fixtures, unique-peer attestation support, and Rust 1.85 workspace metadata.

Changes

Authenticated call context and delivery provenance

Layer / File(s)	Summary
Call context API and dispatch crates/tinybus/src/service/*, crates/tinybus/src/connection.rs, crates/tinybus/src/connection_tests.rs, crates/tinybus/src/lib.rs, crates/tinybus/src/message/mod.rs	Adds CallContext and Interface::call_with_context. Connection dispatch passes context to interfaces. Tests cover authenticated sender propagation, unverified sender headers, and dispatch while interfaces are registered or removed.
Broker and memory transport provenance crates/tinybus/src/transport/*, crates/tinybus/src/ports/transport.rs, crates/tinybus/src/broker.rs, crates/tinybus/src/broker_tests.rs	Memory transport deliveries now carry broker provenance. Broker attachment identifies module transports and uses broker-aware sends for memory transports.
Native module ABI and per-frame provenance crates/tinybus/src/module/*, crates/tinybus-module/src/lib.rs, crates/tinybus-module/src/lib_tests.rs	Adds compatible host-vtable reads and a broker-routing callback. Native modules capture routing status with each queued frame.
Attested destinations and module availability crates/tinybus/src/router.rs, crates/tinybus/src/broker.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/attest.rs, docs/modules/attest/README.md, docs/protocol.md	Stores admitted artifact attestations on exact peers. Confidential calls can resolve to an admitted unique peer or its attested well-known name. Module availability checks include unique destinations.
Context module fixtures and loader coverage crates/tinybus/examples/module_context*, crates/tinybus/src/module/host_tests.rs, .github/workflows/ci.yml	Adds lazy and eager context module fixtures. Integration tests and CI build and load both artifacts.
Rust version and unchanged-condition rewrites Cargo.toml, crates/tinybus*/Cargo.toml, crates/tinybus-macros/src/lib.rs, crates/tinybus/src/bin/tinybus.rs, crates/tinybus/src/module/remembered_hash.rs, crates/tinybus/src/stream/base64.rs, crates/tinybus/src/events/subscriber.rs, crates/tinybus/src/router.rs	Sets the workspace Rust version to 1.85. Several condition rewrites retain the behavior described in the summaries.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~50 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Broker
  participant MemoryTransport
  participant Connection
  participant Interface
  Client->>Broker: Send method call
  Broker->>MemoryTransport: Send with broker provenance
  MemoryTransport->>Connection: Deliver message and provenance
  Connection->>Interface: Call with authenticated context

Loading

---

Merge Risk | ⚪ Minimal · up to 41cde

Merge Risk: ⚪ Minimal · up to 41cde

No actionable merge-blocking issue is established; this change is mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 41cde

Authenticated caller identity is separated from message headers, and confidential delivery remains tied to an admitted peer. Compatibility paths do not automatically gain authenticated identity. No introduced bypass was identified in the inspected paths, but downstream authorization and deployment coverage remain incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected security scope includes callers attached to a broker session and confidential recipients on admitted native-module connections. A caller can supply message content, but peer identity alone does not authorize privileged handlers. Native execution remains within the host process's trust boundary.

Trust Boundaries and Controls

• observed — The broker overwrites attacker-supplied sender headers. Public memory sends cannot set private delivery provenance, and public receives discard it. Contextual dispatch authenticates a unique sender only when the delivery proof is present, so header replay alone is insufficient.
• observed — Fixed-peer confidential routing requires a host-vouched artifact on that exact connection. Recipient lookup and admission checking occur under one router lock. Alias handover does not transfer the peer's record, and detach removes the peer and its names.

Resilience and Maintainability Implications

• observed — Malformed native frames terminate the receive loop rather than dispatching with stale provenance. Backpressure does not enqueue a frame, shutdown removes the inbound sender, and repeated shutdown reports closure. The head also applies unavailable-module checks to fixed unique destinations during terminal-state cleanup.

Hardening Proposals

• proposed — When migrating privileged handlers, require authenticated context, bind trusted initialization to the exact peer, and invalidate that binding on disconnect or broker replacement. Treat legacy unverified context as an explicit denial state rather than falling back to sender headers.

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 52.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 155 functions across 31 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the primary change: exposing trusted broker caller context while preserving legacy dispatch behavior.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

---

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit checks each frame at night
And marks the trusted path just right
Old hosts still cross the ABI
New calls carry proof nearby
Names stay bound when aliases fly
The rabbit hops beneath the sky}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: Cargo.toml, crates/tinybus-macros/src/lib.rs, crates/tinybus-module/Cargo.toml, crates/tinybus-module/src/lib.rs, crates/tinybus-module/src/lib_tests.rs, crates/tinybus/Cargo.toml, crates/tinybus/examples/module_context.rs, crates/tinybus/examples/module_context_eager.rs and 22 more.

             $0.0098 · 203,739 in / 16,584 out · 7,112 cached (3%) · flash, gpt-5.6-luna, glm-5.3-flash
critique:    $0.0044 · 54,072 in  / 1,723 out  · 2,494 cached (5%) · gpt-5.6-luna
security:    $0.0036 · 45,353 in  / 1,267 out  · 2,250 cached (5%) · gpt-5.6-luna
tests:       $0.0003 · 34,398 in  / 3,219 out  · 64 cached (0%)    · glm-5.3-flash
description: $0.0004 · 33,831 in  / 6,029 out  · 1,856 cached (5%) · glm-5.3-flash

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0178 · 295,579 in / 9,795 out · 7,270 cached (2%) · ladder/vectors-oai3, gpt-5.6-luna, , glm-5.3-flash · 760 embedded
critique:    $0.0085 · 103,975 in / 2,854 out · 2,494 cached (2%) · gpt-5.6-luna,
security:    $0.0085 · 111,456 in / 1,624 out · 4,584 cached (4%) · gpt-5.6-luna,
description: $0.0004 · 40,306 in  / 2,578 out · 64 cached (0%)    · glm-5.3-flash

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: tinysweeper/tests.

             $0.0053 · 145,965 in / 3,134 out · 9,222 cached (6%)  · ladder/vectors-oai3, gpt-5.6-luna, glm-5.3-flash · 762 embedded
critique:    $0.0032 · 44,549 in  / 628 out   · 4,988 cached (11%) · gpt-5.6-luna
security:    $0.0015 · 19,660 in  / 570 out   · 2,250 cached (11%) · gpt-5.6-luna
description: $0.0003 · 40,738 in  / 431 out   · 1,856 cached (5%)  · glm-5.3-flash

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: tinysweeper/tests.

             $0.0141 · 265,731 in / 4,194 out · 12,448 cached (5%) · flash, ladder/vectors-oai3, gpt-5.6-luna, glm-5.3-flash · 762 embedded
critique:    $0.0067 · 89,997 in  / 982 out   · 5,156 cached (6%)  · gpt-5.6-luna
security:    $0.0067 · 89,302 in  / 1,058 out · 4,668 cached (5%)  · gpt-5.6-luna
description: $0.0003 · 41,766 in  / 357 out   · 64 cached (0%)     · glm-5.3-flash

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

          $0.1330 · 540,663 in / 15,078 out · 74,015 cached (14%) · ladder/vectors-oai3, openai/gpt-5.6-luna, z-ai/glm-5.3-flash, , deep · 774 embedded
critique: $0.0671 · 254,807 in / 7,649 out  · 21,371 cached (8%)  · openai/gpt-5.6-luna, z-ai/glm-5.3-flash, , deep
security: $0.0648 · 240,754 in / 6,214 out  · 9,346 cached (4%)   · openai/gpt-5.6-luna, deep