fix: retain native terminal ownership across cancellation by senamakel · Pull Request #57 · tinyhumansai/tinybus

senamakel · 2026-10-12T07:18:52Z

This cumulative SDK prerequisite for tinyhumansai/openhuman#7328 is still in progress. Keep it draft until the module-side native terminal factory, once request/finish hooks, startup ownership and their actual native proofs are implemented and independently verified. The Connection catch observer is only a prerequisite for that work.

The feature worktree is integrating the concurrently pushed PR fixes and upstream module execution/lifecycle changes through normal merges, preserving both histories. The earlier independently reviewed checkpoint includes immediate host stop fencing and retained provider drain before physical shutdown; its source/test/coverage receipts belong to that checkpoint and are not substituted for proof of the newly combined source.

Fresh full native, feature, MSRV, lint and coverage results will replace this temporary integration description when the merged checkpoint is published. The 90% file and 80% changed-line gates remain unchanged. TinySecurity's actual App adapter, release and OpenHuman migrations remain dependent on the completed SDK work.

…ure paths Add tests for shutdown behaviour when the host callback blocks, when a started shutdown is cancelled, when an initialized module is stopped before becoming ready, and when a stop wakes a backpressured delivery. A drop guard releases the blocked callback so a failed assertion cannot hang later tests. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Stopping a module now marks the transport as stopped under the pending queue lock, so sends, initialization, and the drainer all observe closure without being reported as a module fault. Queued messages are dropped and observers are woken once the opaque shutdown callback returns, keeping a caller timeout from being mistaken for physical completion. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Initialization failures were collapsed into a single string error, so a transport that was stopped mid-init surfaced as a generic transport error instead of a connection-closed one. The failure is now tracked as a distinct closed or failed variant, and callers only treat the closed case as a shutdown when deciding whether to mark initialization as failed. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add host and transport tests asserting that an ordinary stop never fabricates a faulted state, whether the module is blocked in its shutdown callback or waiting for initialization admission, while a genuine initializer failure during stop is still retained. Also reset the shared delivery code between tests and assert the pending queue drains on stop. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Delivery failures now carry the underlying error into fault_pending, which only clears queued calls when the module is stopped and the error is a connection close. Previously any failure while stopped discarded pending calls, and the stop path could finish before the module vtable was cleared. Comments were updated to describe admission rejection rather than shutdown. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Move the stop_task_spawned reset to after the lifecycle lock is acquired so a retry that fails to take the lock no longer clears the marker set by the original running stop. The flag is now only replaced by the new lock owner right before the task is spawned. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The redundant store of false before setting stop_task_spawned to true could erase the original running stop's host transition, so it has been removed. Tests now cover concurrent pending sends racing a completed drainer and a delivery failure overlapping stop. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Stopping or reinitializing a transport that has already been disposed now fails fast with ConnectionClosed instead of racing the lifecycle lock, and the host no longer clears its transition marker when a stop retry is refused. This keeps a disposed transport from being revived or from erasing the original stop's host transition. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add a regression test asserting that stop and reinitialize waiters blocked behind an in-flight shutdown fail with ConnectionClosed instead of re-entering the disposed transport, and that shutdown runs only once. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Extend the ordinary stop test to drive a real broker and observe ModuleStateChanged signals, so the retry against a closed transport is checked to fail with ConnectionClosed while the loaded entry still reports Ready. The test now also verifies the emitted stopped event carries the expected ready-to-stopped transition. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The assertion on the recorded transition origin now clones the value and matches it against Some(ModuleState::Ready) instead of comparing with assert_eq!, avoiding a borrow of the guarded field across the assertion. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The module host was overwriting transition_from with the previous state whenever a restart began, which discarded a transition already in progress. Using get_or_insert keeps the original value so the state machine reports the correct origin state. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

chatgpt-codex-connector · 2026-10-12T07:18:57Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

coderabbitai · 2026-10-12T07:19:08Z

Warning

Review limit reached

Run on-demand review

_{This review includes 18 billable files and costs up to $4.50.}

Or wait 4 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: d03dbddf-3c0e-4234-93ee-377d00f429b9

📥 Commits

Reviewing files that changed from the base of the PR and between 1e3ef98 and a87fabe.

📒 Files selected for processing (18)

crates/tinybus-module/src/execution_context_tests.rs
crates/tinybus-module/src/lib_lifecycle_tests.rs
crates/tinybus-module/src/lib_tests.rs
crates/tinybus/Cargo.toml
crates/tinybus/examples/module_controlled_init.rs
crates/tinybus/src/module/abi.rs
crates/tinybus/src/module/abi_tests.rs
crates/tinybus/src/module/host.rs
crates/tinybus/src/module/host_callbacks.rs
crates/tinybus/src/module/host_callbacks_tests.rs
crates/tinybus/src/module/host_tests.rs
crates/tinybus/src/module/transport.rs
crates/tinybus/src/module/transport_tests.rs
docs/modules/module/abi.md
docs/plans/native-terminal-authority.md
scripts/check-coverage.sh
scripts/test-e2e.ps1
scripts/test-e2e.sh

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 958360f9-2ccc-42b7-b8ca-c95cca9c66af

📥 Commits

Reviewing files that changed from the base of the PR and between 4709521 and 1e3ef98.

📒 Files selected for processing (4)

crates/tinybus/src/module/host.rs
crates/tinybus/src/module/host_tests.rs
crates/tinybus/src/module/transport.rs
crates/tinybus/src/module/transport_tests.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The transport now tracks stopped state separately from faults. Shutdown closes admission and clears pending messages after the shutdown callback returns. Initialization and delivery distinguish closure from failure, and host stop handling preserves an existing state transition.

Changes

Transport Shutdown

Layer / File(s)	Summary
Stopped-state checks and admission `crates/tinybus/src/module/transport.rs`, `crates/tinybus/src/module/transport_tests.rs`	The transport tracks stopped state and rejects initialization, readiness, reinitialization, sends, and calls after shutdown. Initialization closure remains distinct from initialization failure. Tests cover stop during initialization and admission.
Stop completion and delivery coordination `crates/tinybus/src/module/transport.rs`, `crates/tinybus/src/module/host.rs`, `crates/tinybus/src/module/transport_tests.rs`, `crates/tinybus/src/module/host_tests.rs`	The transport completes stopping after the shutdown callback returns, clears pending messages, and notifies waiters without faulting on ordinary closure. Delivery errors retain their failure behavior. Host state transitions are preserved while a stop task is running. Tests cover timeouts, cancellation, delivery races, concurrent sends, and host state events.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant StopCaller
  participant ModuleTransport
  participant ShutdownCallback
  StopCaller->>ModuleTransport: request stop
  ModuleTransport->>ShutdownCallback: invoke shutdown
  ShutdownCallback-->>ModuleTransport: return from callback
  ModuleTransport->>ModuleTransport: mark stopped and notify waiters
  ModuleTransport-->>StopCaller: return stop result

Suggested reviewers: m3ga-mind

Merge Risk: ⚪ Minimal · up to 1e3ef

No actionable shutdown-lifecycle issue remains identified; the change is mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 1e3ef

The change improves shutdown and retry ownership, but fresh deliveries can now enter a module while its shutdown callback is running. Existing identity and callback controls remain, and the supplied module runtime handles closure defensively; safe teardown for other module implementations remains a concern.

Retained concerns

Medium · security · inferred: For an installed module, shutdown begins before delivery admission closes. A broker writer can initiate a new deliver callback while the opaque shutdown callback is running, whereas the base rejected fresh admission through its fault gate. Safe teardown now depends on module-specific synchronization. The bundled SDK provides a closed tombstone, so this is a lifecycle-boundary concern rather than a verified memory-safety exploit.

Security review details

Security Blast Radius

inferred — The newly reachable overlap concerns message delivery to a stopping, already loaded module. A caller need not control module loading or initiate stop to influence an already queued message. Consequences depend on that module's teardown implementation; process-wide effects are possible for unsafe native implementations, but exploitability and deployment-wide exposure are not established.

Security Findings and Attack Paths

inferred — The relevant path is a caller-controlled message in the broker queue, followed by Transport::send and the module deliver callback during shutdown. This establishes expanded temporal reachability to native code, not a verified authorization bypass or use-after-free.

Trust Boundaries and Controls

observed — The broker overwrites sender identity and performs destination and confidential-recipient checks before routing. When a controller binding is configured, mutating module-control calls must originate from the selected controller. The shutdown change does not replace these controls.

Resilience and Maintainability Implications

observed — The unchanged SDK retains its RuntimeState allocation and removes the inbound sender during shutdown. Delivery observes that synchronized slot and returns TB_CLOSED when it is empty. This counters a general claim that shutdown overlap necessarily causes memory corruption.

Hardening Proposals

proposed — Separate delivery-admission closure from physical shutdown completion: reject fresh deliveries before entering the opaque callback while retaining the original stop task and host transition until completion. Explicitly define whether already executing delivery may overlap teardown.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 31.58% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 38 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: preserving terminal ownership during shutdown cancellation and retries.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit watched the shutdown wait,
While queued messages paused at the gate.
The callback returned; the transport closed,
And stopped was clear where fault was not.
The rabbit thumped, then hopped away.}

_{Comment @coderabbitai help to get the list of available commands.}

Add tests asserting that fresh signals and calls are rejected with ConnectionClosed once shutdown has actually begun, that queued readiness and backpressure retire before stop returns, and that an in-flight signal callback is drained even when stop times out and is cancelled. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add two tests for module transport admission while an actual shutdown is in progress. One verifies that an installed vtable without the init flag closes fresh admission before teardown, and the other verifies that a backpressure retry closes without faulting the transport. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Shutdown now closes admission separately from physical completion and waits for every reserved native callback to return before tearing down the module, so a stop timeout or cancelled caller can no longer free code underneath a running callback. Readiness signals arriving after admission closes are ignored, and queued confidential bodies are released outside internal locks. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

A ready gate mutex now guards the host ready callback and the shutdown path so a late ready notification can no longer race past admission closure and mark a stopping transport as ready. The lifecycle tests were updated to drive shutdown concurrently and assert that reinitialization fails fast with ConnectionClosed instead of staying pending. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add tests asserting that a reserved native entry cannot start after admission closes even when the stop caller is cancelled, and that unanswered method calls do not hold physical callback leases. Document the shutdown barrier that waits for reserved deliver callbacks before entering the opaque shutdown callback. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Document the approach for making the native terminal the source of truth, covering the design decisions and migration steps needed before implementation begins. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Extend TbHostVtable with an optional native_terminal_state callback appended after broker_routing, leaving it unset when normalizing older hosts. Tests cover the frozen prefix and routing tail so the new field cannot be read from a truncated allocation. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The host vtable reader previously copied the native terminal state callback only when the declared size covered the whole struct, so a host that supplied that field without any later tail lost it. Each optional callback is now gated on its own complete-field size check, and the terminal state bits are documented as constants with their admission and monotonicity rules. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Adds documentation for the optional ABI capability tails, covering how optional fields are gated by size, the native query contract and its admission rules, the meaning of PhysicallyStopped, and the lifetime and thread-safety obligations a host must uphold for the query callback and context. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The short-header rejection test now allocates a properly aligned buffer instead of pointing at a stack u32, so the read is not undefined behaviour and the assertion reflects the real ABI check. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add a test that aborts the task awaiting initialization while a deferred initializer is still running, verifying the transport publishes a fault immediately and still runs the late initializer's cleanup exactly once. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Module initialization and teardown now go through transport helpers that record terminal state consistently, so a module that fails to initialize or faults is reported as failed or faulted instead of stopped. The terminal flag update was also rewritten as a compare-exchange loop to avoid losing concurrent fault or stop-intent bits. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add tests that drive the native callback admission path through setup error and unwind while an ordinary stop is in flight, asserting that a genuine setup failure still faults the transport and that the C initializer never entered. The remaining changes are rustfmt reflow and a plan note documenting the Failed versus Canceled cause split. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Rework the native terminal authority plan so task 4 records the accepted module-local lifecycle protocol instead of the earlier proposal text. The document now specifies the public API, request and finish ownership, startup resource transfer, shutdown classification, and the fixed admission cap, and adds the binding panic-payload ordering and catch-time observer corrections that the writer must follow. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add an ignored integration test that verifies the physical owner retains the native controller while the shutdown callback is still borrowing it, and that the fixture owner is reclaimed once the transport is dropped. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Native test fixtures now hand their controller to the transport so the borrowed controller stays owned for as long as the physical transport exists, including uncertain jobs. This removes the deliberate std::mem::forget leaks in the tests and lets them assert the controller is still alive through a weak reference instead. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The combined `if` with a let-chain was split into two nested `if` blocks so the transition logic no longer depends on let-chain support. Behaviour is unchanged. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

…iately The two tests that check a transport is dropped after shutdown asserted reclamation synchronously, which raced with the task's own Arc drop. They now poll the weak count under a timeout so the assertion observes actual reclamation rather than a flag that may precede task exit. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The cleanup state check now records whether cleanup was incomplete before releasing the callback and asserts it only after shutdown completes, so a regression cannot panic while the native callback still borrows the controller. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Co-authored-by: Medulla <medulla@tinyhumans.ai>

On Windows the temp directories used by these host tests inherit a private DACL, which caused the content gate assertions to fail for reasons unrelated to the behaviour under test. Securing the release cache for each directory first lets the tests exercise the intended content checks. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The native callback setup failure race test now waits up to 30 seconds instead of 2 for the attached notification. Admission hashes the real artifact twice before this hook, and instrumented CI builds can spend several seconds there, so the old bound was too tight for a fixture setup wait that is independent of the lifecycle deadline and the race assertions below. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

chatgpt-codex-connector · 2026-10-12T12:09:06Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

Add a test-only hook that runs after cleanup publication so a test can observe the transport state at that point. The new test confirms that a completed shutdown has already released its native lifecycle marker. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Move the pending activity drop ahead of the state update so a completed stop cannot leave enable/disable reporting that opaque work is still running. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The test host builder now initialises the new native_terminal_state field so the execution context tests keep compiling against the updated host struct. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

chatgpt-codex-connector · 2026-10-12T12:50:27Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

tinysweeper · 2026-10-12T22:52:07Z

Tiny Sweeper review

Tiny Sweeper completed its review; deterministic results follow.

State: Incomplete
Priority: none
Reviewed head: a87fabe02576
Updated: 2026-10-13T05:30:00Z

Review snapshot

Change surface	Files	Review signal	Count
Production	6	Active findings	0
Tests	9	Noted findings	0
Documentation	2	Resolved findings	0
Configuration	1	Pending checks/questions	19

Completeness: Incomplete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

Added — Native terminal-state ABI tail: Adds an optional `native_terminal_state` callback and terminal flag constants (Live=1, StopIntent=2, Fault=4, PhysicallyStopped=8) read only when `size` covers that complete field, so each optional field normalizes independently and unknown or combined terminal flags deny admission. (crates/tinybus/src/module/abi.rs#pub const TB_TIMEOUT: i32 = -4;, crates/tinybus/src/module/abi.rs#pub struct TbHostVtable {, crates/tinybus/src/module/abi.rs#impl TbHostVtable {)
Added — Admission termination cause classification: Adds `AdmissionTermination::{Failed, Canceled}` and `commit_admission_termination` so an already-committed ordinary stop is preserved as non-fault cancellation while genuine setup errors and deadlines still fault, and fault remains sticky over stop intent. (crates/tinybus/src/module/transport.rs#impl Transport for ModuleTransport {, crates/tinybus/src/module/host_callbacks.rs#impl ModuleHost {, crates/tinybus/src/module/host_callbacks.rs#impl Drop for LoadRollback<'_> {)
Modified — Host lifecycle terminal commit and state reporting: Host load, rollback, and outer Drop now commit terminal flags before revocation and route through retained cleanup, with stop results reflected as Faulted/Failed when the transport is faulted and `transition_from` preserved via `get_or_insert(old)` so a canceled retry cannot erase the original transition. (crates/tinybus/src/module/host.rs#impl ModuleHost {, crates/tinybus/src/module/host.rs#impl ModuleControl for ModuleHostInner {, crates/tinybus/src/module/host_callbacks.rs#struct LoadRollback<'a> {)
Modified — Host callback fixture controls: `HostCallbackBinding` gains cfg(test) observer hooks (after_attach, fixture_controller, before_load_decision) that transfer the fixture config borrow before C entry and gate the load decision, supplying test barriers without production authority. (crates/tinybus/src/module/host_callbacks.rs#pub struct HostCallbackBinding {, crates/tinybus/src/module/host_callbacks.rs#impl ModuleHost {)
Modified — Documentation of optional tail and callback drain: Documents the size-gated optional tail, monotonic terminal intent, query-as-admission-linearization semantics, the post-host-destruction tombstone contract, and the pre-shutdown admission closure and callback drain barrier for deliver callbacks. (docs/modules/module/abi.md#The final host callback, `ready`, marks completion of asynchronous setup. This, docs/modules/module/abi.md#separate copy of Tokio's thread-locals, so it cannot borrow the host runtime.)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Could not review: crates/tinybus-module/src/lib_tests.rs, crates/tinybus/Cargo.toml, crates/tinybus/examples/module_controlled_init.rs, crates/tinybus/src/module/abi_tests.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_callbacks_tests.rs, crates/tinybus/src/module/host_tests.rs, crates/tinybus/src/module/transport.rs, crates/tinybus/src/module/transport_tests.rs, docs/modules/module/abi.md, docs/plans/native-terminal-authority.md, scripts/check-coverage.sh, scripts/test-e2e.ps1, scripts/test-e2e.sh, tinysweeper/description

Before merge

Complete the critique review for crates/tinybus-module/src/lib_tests.rs, crates/tinybus/src/module/abi_tests.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_callbacks_tests.rs, crates/tinybus/src/module/host_tests.rs, crates/tinybus/src/module/transport.rs, crates/tinybus/src/module/transport_tests.rs, crates/tinybus/Cargo.toml, crates/tinybus/examples/module_controlled_init.rs, docs/modules/module/abi.md, docs/plans/native-terminal-authority.md, scripts/check-coverage.sh, scripts/test-e2e.ps1, scripts/test-e2e.sh.
Complete the security review for crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_tests.rs, crates/tinybus/examples/module_controlled_init.rs.
Complete the description review for tinysweeper/description.

How this fits together

flowchart LR
  n0["owner<br/>changed"]:::changed
  n1["host<br/>changed"]:::changed
  n2["..._copied_without_reading_the_additive_tail<br/>changed"]:::changed
  n3["host<br/>changed"]:::changed
  n4["TbHostVtable<br/>changed"]:::changed
  n5["ModuleHost<br/>changed"]:::changed
  n6["ModuleHostInner<br/>changed"]:::changed
  n7["load_file_with_host_callbacks"]:::impacted
  n8["clone"]:::impacted
  n9["Err"]:::impacted
  n10["abi"]:::impacted
  n11["initialize"]:::impacted
  n12["initialize_ok"]:::impacted
  n0 -->|uses| n4
  n0 -->|uses| n10
  n1 -->|uses| n4
  n1 -->|uses| n10
  n2 -->|calls| n3
  n2 -->|tests| n3
  n2 -->|uses| n4
  n2 -->|uses| n10
  n3 -->|uses| n4
  n3 -->|uses| n10
  n5 -->|uses| n6
  n7 -->|calls| n8
  n7 -->|calls| n9
  n11 -->|calls| n9
  n12 -->|uses| n4
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Agent review details

critique

Conclusion: Success
Scope reviewed: incomplete; unanswered: crates/tinybus-module/src/lib_tests.rs, crates/tinybus/src/module/abi_tests.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_callbacks_tests.rs, crates/tinybus/src/module/host_tests.rs, crates/tinybus/src/module/transport.rs, crates/tinybus/src/module/transport_tests.rs, crates/tinybus/Cargo.toml, crates/tinybus/examples/module_controlled_init.rs, docs/modules/module/abi.md, docs/plans/native-terminal-authority.md, scripts/check-coverage.sh, scripts/test-e2e.ps1, scripts/test-e2e.sh
Positive: The critique lane recorded a clean result with no findings but explicitly left 15 files unreviewed, including the core transport, host, and ABI test files, so its clean result does not cover the bulk of the change.
Lane summary: Reviewed 3 files; 0 findings. 15 files could not be reviewed: crates/tinybus-module/src/lib_tests.rs, crates/tinybus/src/module/abi_tests.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_callbacks_tests.rs, crates/tinybus/src/module/host_tests.rs, crates/tinybus/src/module/transport.rs, crates/tinybus/src/module/transport_tests.rs, crates/tinybus/Cargo.toml, crates/tinybus/examples/module_controlled_init.rs, docs/modules/module/abi.md, docs/plans/native-terminal-authority.md, scripts/check-coverage.sh, scripts/test-e2e.ps1, scripts/test-e2e.sh.

security

Conclusion: Success
Scope reviewed: incomplete; unanswered: crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_tests.rs, crates/tinybus/examples/module_controlled_init.rs
Lane summary: Reviewed 13 files; 0 findings. 3 files could not be reviewed: crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_tests.rs, crates/tinybus/examples/module_controlled_init.rs. 2 files were not security-reviewed: docs/modules/module/abi.md (prose or tabular data), docs/plans/native-terminal-authority.md (prose or tabular data).

tests

Conclusion: Success
Scope reviewed: all assigned evidence
Lane summary: The pull request adds a substantial amount of behaviour (ABI tail normalization, retained physical init/cleanup ownership, admission closure, terminal tombstones) and brings a large volume of new tests with it, including ignored native-fixture tests wired into the e2e and coverage scripts. The original ABI tests now size host storage independently, and the assertions in the modified prefix/tail tests are falsifiable (they compare `is_some()` against the exact byte boundary). I found no assertion in the changed test files that cannot fail, and no behavioural regression against the rule list I can pin to the diff; the one thing I could not verify here is that the ignored native tests actually run in CI, but that is a wiring question the scripts do cover (`TINYBUS_TEST_CONTROLLED_INIT_MODULE` is exported in both e2e scripts and `check-coverage.sh`).

commits

Conclusion: Neutral
Scope reviewed: all assigned evidence
Positive: The commits lane reported nothing sensitive found in what the pull request commits.
Lane summary: Nothing sensitive found in what this pull request commits.

description

Conclusion: Neutral
Scope reviewed: incomplete; unanswered: tinysweeper/description
Lane summary: No reviewer produced a usable response.

Evidence and run details

Models: ladder/vectors-oai3, deepseek-v4.1-flash,
Spend: $0.008996
Tokens: 1556713 input · 90649 output · 327424 cached · 730 embedding
Continuity: summary cache chain restarted at the storage ceiling.

Head	State	Pass summary
`a87fabe02576`	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-13T04:52:34Z)
`a87fabe02576`	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-13T05:30:00Z)

tinysweeper

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinybus/src/module/abi_tests.rs, crates/tinybus/src/module/host_callbacks_tests.rs, crates/tinybus/src/module/transport.rs, crates/tinybus/src/module/transport_tests.rs, docs/plans/native-terminal-authority.md.

             $0.0176 · 2,759,618 in / 193,350 out · 387,072 cached (14%) · ladder/vectors-oai3, deepseek-v4.1-flash,  · 730 embedded
critique:    $0.0145 · 1,169,430 in / 169,179 out · 182,016 cached (16%) · deepseek-v4.1-flash,
security:    $0.0026 · 986,298 in   / 18,529 out  · 107,392 cached (11%) · deepseek-v4.1-flash
tests:       $0.0002 · 274,536 in   / 1,749 out   · 91,008 cached (33%)  · deepseek-v4.1-flash
description: $0.0001 · 245,564 in   / 872 out     · 6,656 cached (3%)    · deepseek-v4.1-flash

tinysweeper

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinybus-module/src/lib_tests.rs, crates/tinybus/Cargo.toml, crates/tinybus/examples/module_controlled_init.rs, crates/tinybus/src/module/abi_tests.rs, crates/tinybus/src/module/host.rs, crates/tinybus/src/module/host_callbacks.rs, crates/tinybus/src/module/host_callbacks_tests.rs, crates/tinybus/src/module/host_tests.rs and 8 more.

             $0.0090 · 1,556,713 in / 90,649 out · 327,424 cached (21%) · ladder/vectors-oai3, deepseek-v4.1-flash,  · 730 embedded
critique:    $0.0033 · 354,582 in   / 44,902 out · 109,696 cached (31%) · deepseek-v4.1-flash
security:    $0.0048 · 859,430 in   / 34,615 out · 129,536 cached (15%) · deepseek-v4.1-flash,
tests:       $0.0001 · 180,278 in   / 656 out    · 88,192 cached (49%)  · deepseek-v4.1-flash
description: $0.0006 · 78,396 in    / 7,450 out  · 0 cached (0%)        · deepseek-v4.1-flash

senamakel and others added 12 commits October 12, 2026 09:40

coderabbitai Bot approved these changes Oct 12, 2026

View reviewed changes

senamakel marked this pull request as draft October 12, 2026 07:50

senamakel and others added 14 commits October 12, 2026 10:52

Merge remote-tracking branch 'origin/main' into security-bus-7328

10c732f

docs: add plan for native terminal authority

6e4afbd

Document the approach for making the native terminal the source of truth, covering the design decisions and migration steps needed before implementation begins. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

chore: files changed crates/tinybus/src/module/transport.rs

2b8746a

Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

senamakel changed the title ~~fix: preserve ordinary shutdown state across retries~~ fix: retain native terminal ownership across cancellation Oct 12, 2026

senamakel and others added 6 commits October 12, 2026 13:09

senamakel self-assigned this Oct 12, 2026

senamakel and others added 3 commits October 12, 2026 15:04

merge: integrate main callback lifecycle fixes

5a5b0a5

Co-authored-by: Medulla <medulla@tinyhumans.ai>

senamakel marked this pull request as ready for review October 12, 2026 12:09

senamakel and others added 4 commits October 12, 2026 15:13

Merge remote-tracking branch 'upstream/main' into pr/57

24eb38f

senamakel marked this pull request as draft October 12, 2026 12:27

senamakel marked this pull request as ready for review October 12, 2026 12:50

senamakel merged commit 998d9a7 into main Oct 12, 2026
13 of 14 checks passed

senamakel deleted the security-bus-7328 branch October 12, 2026 12:50

senamakel mentioned this pull request Oct 12, 2026

feat(module): add bounded native terminal factories and physical cleanup ownership #61

Merged

tinysweeper Bot reviewed Oct 13, 2026

View reviewed changes

tinysweeper Bot added the priority: p2 Soon. Real but survivable — a rough edge, a gap, a thing that will bite later. label Oct 13, 2026

tinysweeper Bot reviewed Oct 13, 2026

View reviewed changes

tinysweeper Bot added priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect. and removed priority: p2 Soon. Real but survivable — a rough edge, a gap, a thing that will bite later. labels Oct 13, 2026

Navigation Menu

Repository navigation

fix: retain native terminal ownership across cancellation - #57

fix: retain native terminal ownership across cancellation#57
senamakel merged 61 commits into
mainfrom
security-bus-7328

senamakel commented Oct 12, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

Uh oh!

tinysweeper Bot commented Oct 12, 2026 •

edited

Loading

critique

security

tests

commits

description

Uh oh!

tinysweeper Bot left a comment

Uh oh!

tinysweeper Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

senamakel commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

Uh oh!

tinysweeper Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tiny Sweeper review

Review snapshot

Features

Tests

Findings

Before merge

How this fits together

critique

security

tests

commits

description

Uh oh!

tinysweeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

tinysweeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

senamakel commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

tinysweeper Bot commented Oct 12, 2026 •

edited

Loading