[senamakel]

Restricted module initialization

Publication dependency

TinyBus PR49 is now canonically merged at 3834e3a792bbda20795dc33b21f882eb69dda82d. A fresh canonical fetch and ancestor check proved that the exact pinned dependency eb1c7448b9cdea72dd4e9d4281f8f0739f0308df is upstream available. The workspace uses TinyBus 0.1.3. This PR is ready for review; all individual commits are preserved. No module release or downstream host consumption is claimed.

After review, a documentation-only follow-up adds comments to the restricted methods and verifier. Strict rustdoc, formatting, diff checks, and all eight hosted Rust/docs/MSRV/supply-chain jobs pass at c76b224a06829627266db6ff4ce7332c73dd38dc. The preceding implementation review found no actionable issues; the latest CodeRabbit job reports success with review rate limiting.

Runtime behavior

Contract minor 1.15 adds RuntimeMode, reporting the actual instance mode and contract version. A safe per-instance setup factory seals the first admitted mode. Reinitialization within that mode remains compatible; attempts to change it fail before setup can replace the service or open state.

Classic mode retains its existing route, provider, preferences and archive behavior. The explicit routed_read_only mode rejects stored routes and state directories during configuration parsing. Its separate interface has no client slot, preference store or archive. It supports:

• Confidential RoutedRead for the five existing stateless toolkit, connection and trigger reads.
• RuntimeMode and framework introspection.
• Empty ListCapabilities, reflecting unavailable provider/stateful operations.
• ListAgentReadyToolkits from the static compiled catalog.

Every other member is denied before payload decoding. Ordinary delivery of RoutedRead remains refused, even on this separate interface. The immutable per-call route owns its local client for the whole operation and never uses Configure or shared credential/cache markers. Stateful operations and provider policy remain unavailable pending admitted owned state; no supplied model policy or default preferences substitute for that authority.

Regression evidence

Actual compiled module mode-sealing tests failed with the legacy callback, including after selecting corrected SDK49. Three regressions were then confirmed against ready instances: restricted-to-classic transition, independent classic/restricted modes with compatible same-mode reinitialization, and refusal before state opening. An initial fixture that raced module readiness was corrected before recording the final RED. The per-instance factory seal makes all three GREEN.

Other tests cover readonly directory nonmutation, all denied members, confidentiality-required delivery, truthful capabilities, initialization validation, contract version/serde compatibility and classic behavior. The dynamic verifier loads classic and restricted modes in separate processes, because the cdylib owns a process-global tracing subscriber. A restricted dynamic run with a read-only working directory exited0 and left the directory empty.

Fresh verification

All commands completed successfully in the standalone owning worktree, without changing OpenHuman's shared dependencies:

• Strict workspace Clippy, all targets/features, warnings denied.
• Full workspace build and test with all features: module 305 unit tests, bus 67, sync 62, six integration tests, four doctests.
• Default workspace: module 302 unit tests, bus 67, sync 62, six integration tests, four doctests.
• Restricted focused suite: seven tests, including three compiled mode regressions.
• Rust 1.88 full workspace/all targets/all features build.
• Rustdoc warnings denied, stub example, dynamic module verifier, no-default check, fmt and diff checks.
• Contract dependency tree contains no transport, runtime or native storage dependency.
• Owning per-file coverage gate: 42 measured source files, minimum 91.3793%; module adapter 95.01%, restricted interface 96.97%.

Logs are under target/debug-logs/restricted-*. Final behavior RED is restricted-mode-all-red-final.log; corresponding GREEN is restricted-mode-sealing-green.log. This tracked summary preserves the result if build output is cleaned.

Summary by CodeRabbit

• New Features
  • Added a routed read-only mode for confidential routed reads, with runtime mode and contract version reporting.
  • In this mode, ready toolkits remain available while native-provider capabilities are empty and other connector methods are unavailable.
  • Added verification for classic and routed read-only modes.
• Compatibility
  • Updated the contract version to 1.15; hosts must support this version to use routed read-only mode.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1b53b711-8eaa-4e19-852c-9cc922dcbf77

---

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 22b5352 and 92d8acd.

---

---

---

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

---

---

---

📒 Files selected for processing (19)

• Cargo.toml
• README.md
• crates/tinyconnectors-bus/src/composio/mod.rs
• crates/tinyconnectors-bus/src/composio/routed/mod_tests.rs
• crates/tinyconnectors-bus/src/composio/runtime/mod.rs
• crates/tinyconnectors-bus/src/composio/runtime/mod_tests.rs
• crates/tinyconnectors-bus/src/composio/runtime/types.rs
• crates/tinyconnectors-bus/src/lib.rs
• crates/tinyconnectors-bus/src/names/mod.rs
• crates/tinyconnectors-bus/src/names/mod_tests.rs
• crates/tinyconnectors-bus/src/version/mod.rs
• crates/tinyconnectors-bus/src/version/mod_tests.rs
• crates/tinyconnectors/examples/verify_module.rs
• crates/tinyconnectors/src/tinybus_module/mod.rs
• crates/tinyconnectors/src/tinybus_module/mod_tests.rs
• crates/tinyconnectors/src/tinybus_module/restricted.rs
• crates/tinyconnectors/src/tinybus_module/restricted_tests.rs
• docs/audits/restricted-initialization-7433.md
• vendor/tinybus

---

---

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

---

---

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

Walkthrough

The change adds a routed-read-only TinyBus runtime mode with a limited method surface, runtime-mode reporting, and per-instance mode sealing. It advances the bus contract to version 1.15 and adds tests and verification for the restricted behavior.

Changes

Routed read-only runtime mode

Layer / File(s)	Summary
Runtime mode contract and version Cargo.toml, vendor/tinybus, crates/tinyconnectors-bus/src/composio/runtime/*, crates/tinyconnectors-bus/src/composio/mod.rs, crates/tinyconnectors-bus/src/lib.rs, crates/tinyconnectors-bus/src/names/*, crates/tinyconnectors-bus/src/version/*, crates/tinyconnectors-bus/src/composio/routed/mod_tests.rs	The bus contract advances from 1.14 to 1.15. It adds serializable runtime-mode types and the RuntimeMode method name, and updates compatibility expectations. TinyBus dependencies and the vendored TinyBus reference are updated.
Configuration and mode selection crates/tinyconnectors/src/tinybus_module/mod.rs, crates/tinyconnectors/src/tinybus_module/mod_tests.rs	Module configuration defaults to Classic and rejects routed_read_only settings with a route or state_dir. Setup selects the restricted service for that mode and records the first mode per factory instance. Reinitialization with a different mode returns an error.
Restricted service and verification crates/tinyconnectors/src/tinybus_module/restricted.rs, crates/tinyconnectors/src/tinybus_module/restricted_tests.rs, crates/tinyconnectors/examples/verify_module.rs, README.md, docs/audits/restricted-initialization-7433.md	The restricted service exposes confidential routed reads, runtime-mode reporting, empty native capabilities, and ready toolkits from the default registry. Tests and the verifier check the restricted method surface, confidentiality enforcement, routed reads, and mode sealing. The README and audit document describe the mode and its verification.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant TinyBusHost
  participant TinyBusCaller
  participant RestrictedService
  participant TestServer
  TinyBusHost->>RestrictedService: Initialize with routed_read_only configuration
  TinyBusCaller->>RestrictedService: Request RuntimeMode
  RestrictedService-->>TinyBusCaller: Return RoutedReadOnly and contract version
  TinyBusCaller->>RestrictedService: Send confidential RoutedRead
  RestrictedService->>TestServer: Forward routed connections read
  TestServer-->>TinyBusCaller: Return read reply

Loading

---

---

---

---

Merge Risk: ⚪ Minimal · up to 92d8a

The reported failed-initialization case cannot lock out a retry on the same instance, because that instance cannot be reinitialized. No actionable issue remains before normal merge checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 92d8a

The new mode reduces authority by excluding shared configuration, execution, preferences, and archives. No introduced security bypass was established. Some framework lifecycle and caller-authorization guarantees remain unverified, and publication is explicitly gated on the upstream dependency.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A caller reaching restricted RoutedRead can initiate backend reads using its supplied endpoint, credentials, and operation parameters. The implementation does not grant access to a shared stored credential or local durable state. Effective account and tenant exposure still depends on upstream caller admission and backend credential authorization.

Trust Boundaries and Controls

• observed — Both classic and restricted RoutedRead require confidential delivery by declaration and reach the same handler. Test and verifier source assert CONFIDENTIALITY_REQUIRED for ordinary delivery and UNKNOWN_METHOD for unsupported canonical members. Framework enforcement ordering and noncanonical aliases could not be independently inspected.
• observed — The repository example supplies initialization configuration through ModuleHost. RestrictedService itself contains no caller-identity authorization check; confidentiality is a delivery control, not evidence of tenant authorization. The production configuration supplier and broker admission policy remain outside the verified scope.

Resilience and Maintainability Implications

• inferred — Within a retained factory, concurrent or repeated callbacks cannot change the admitted mode, including after setup fails. This bounds authority escalation through reinitialization. Complete interruption, teardown, and factory-recreation behavior remains dependent on framework lifecycle semantics not available in the checkout.

---

---

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 77.42% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 31 functions across 15 files. (4 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: per-instance sealing of restricted routed-read initialization.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 77.42% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 31 functions across 15 files. (4 skipped: 4 unsupported.)

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit checks the mode at dawn,
Then reads a route with care.
The bus reports its contract version,
While other calls meet “not there.”
The toolkits wait in their compiled list,
And no stored state is laid.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T18:34:38.877522Z	92d8acd	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper completed its review; deterministic results follow.

State: Incomplete
Priority: none
Reviewed head: c76b224a0682
Updated: 2026-10-12T04:22:45Z

Review snapshot

Change surface	Files	Review signal	Count
Production	9	Active findings	0
Tests	6	Noted findings	1
Documentation	2	Resolved findings	0
Configuration	1	Pending checks/questions	1

Completeness: Incomplete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

The change introduces contract minor 1.15 and a RuntimeMode member that returns the instance's actual mode and the crate's contract version, with Compatibilty semantics now treating (1, 14) as incompatible and (1, 15) as compatible. Initialization accepts an optional runtime_mode field; when routed_read_only is selected, a supplied route or state_dir causes a parse-time rejection, and setup is routed to a separate restricted interface that registers no client slot, preference store, or archive, serves confidential RoutedRead, RuntimeMode, ListCapabilities and ListAgentReadyToolkits, and denies every other contract member as typed unknown-method before argument decoding. A per-instance setup factory records the first admitted mode and rejects any later reinitialization requesting a different mode before setup can replace the service or open state, so classic instances stay classic and restricted instances stay restricted. Dependencies on tinybus and tinybus-module move to 0.1.3, the README documents the handshake and restricted surface, a new audit document records the publication dependency and regression evidence, and the dynamic verifier now loads a restricted instance in a fresh process to check deny-by-default dispatch, the mode handshake, and mandatory confidential delivery.

Features

• Added — RuntimeMode handshake and contract 1.15: Adds a new contract member that reports the actual immutable instance mode and the implementation's contract version, and advances the wire contract minor so hosts can require a compatible 1.15 artifact before relying on the restricted path; (1, 14) is now treated as incompatible while (1, 15) is compatible. (crates/tinyconnectors-bus/src/names/mod.rs#pub mod methods {, crates/tinyconnectors-bus/src/names/mod.rs#pub const METHODS: &[&str] = &[, crates/tinyconnectors-bus/src/composio/runtime/types.rs, crates/tinyconnectors-bus/src/lib.rs#pub use composio::{, crates/tinyconnectors-bus/src/version/mod_tests.rs#use super::{CONTRACT_VERSION, binds, is_compatible};)
• Modified — Configuration parsing rejects route or state_dir in restricted mode: Selecting routed_read_only together with a non-null route or any state_dir fails deserialization instead of silently ignoring admission fields; unknown or malformed runtime_mode values are also rejected rather than defaulted. (crates/tinyconnectors/src/tinybus_module/mod.rs#impl<'de> Deserialize<'de> for ModuleConfig {, crates/tinyconnectors/src/tinybus_module/mod_tests.rs)
• Modified — Dependency bump to tinybus and tinybus-module 0.1.3: The workspace pins the module ABI and SDK versions that provide the setup-factory and restricted-mode behavior required by this change. (Cargo.toml)
• Modified — Dynamic module verifier covers the restricted surface in a fresh process: The verifier now loads a restricted instance in a separate process, waits for the interface to be claimed, checks the reported mode and contract version, requires unknown-method refusal for every non-admitted member with malformed payloads, and requires confidentiality-required refusal for ordinary delivery of RoutedRead. (crates/tinyconnectors/examples/verify_module.rs#async fn main() -> Result<(), Box<dyn std::error::Error>> {, crates/tinyconnectors/examples/verify_module.rs#async fn verify_served_surface()
• Added — Documentation of the immutable routed-read-only mode and audit record: The README documents how to select the mode, what it serves, that admission rejects a stored route or state directory, that the host must require routed_read_only plus a compatible contract, and that omitting runtime_mode retains classic behavior; the audit document records the draft publication dependency on an upstream TinyBus change and the claimed regression evidence. (README.md#profile caches, or trigger archives. Execution, filtered tools, provider profile, docs/audits/restricted-initialization-7433.md)

Tests

• unit — The RuntimeMode handshake serializes contract_version as a major/minor pair, round-trips through serde for both Classic and RoutedReadOnly, defaults to Classic, and rejects an unknown spelling of the restricted mode.: Directly pins the new handshake types and serde shape, including default and rejection behavior. (crates/tinyconnectors-bus/src/composio/runtime/mod_tests.rs)
• unit — The shipped contract version is pinned to (1, 15), and compatibility now rejects (1, 14) while accepting (1, 15).: Pins the version bump and the compatibility flip so the minor bump cannot drift silently. (crates/tinyconnectors-bus/src/version/mod_tests.rs#use super::{CONTRACT_VERSION, binds, is_compatible};, crates/tinyconnectors-bus/src/composio/routed/mod_tests.rs#fn five_read_requests_and_replies_pin_their_tags_and_trigger_fields() {)
• unit — The declared method table includes the new RuntimeMode member alongside the previously declared members.: Keeps the names table and the exported member list in agreement. (crates/tinyconnectors-bus/src/names/mod_tests.rs#fn the_method_table_holds_the_declared_members() {, crates/tinyconnectors-bus/src/names/mod.rs#pub const METHODS: &[&str] = &[)
• unit — Restricted initialization rejects a stored route with credentials, a misspelled runtime_mode, and a boolean runtime_mode, and classic mode reports Classic with the current contract version.: Covers admission validation and the classic handshake. One stated invariant is only half-pinned: every restricted admission test that includes state_dir also includes a route, so the value.get("state_dir") half of the rejection condition could regress without failing a test. (crates/tinyconnectors/src/tinybus_module/mod_tests.rs)
• integration — A restricted instance reports RoutedReadOnly and the current contract version, returns unknown-method for every non-admitted member with payloads containing credentials and directory paths, leaks no credential text in the error, leaves a read-only directory empty, requires confidential delivery for RoutedRead, returns empty capabilities, and returns a non-empty static toolkit catalog.: Pins deny-by-default admission, confidentiality-required delivery, and the static-only surface; the read-only directory makes state creation observable. (crates/tinyconnectors/src/tinybus_module/restricted_tests.rs)
• end-to-end — The verifier loads classic behavior, then re-executes itself with a restricted configuration to check the mode handshake and deny-by-default dispatch in a fresh process, since the cdylib owns a process-global tracing subscriber.: Extends the shipped dynamic verification path to the new mode without claiming an execution result. (crates/tinyconnectors/examples/verify_module.rs#async fn main() -> Result<(), Box<dyn std::error::Error>> {, crates/tinyconnectors/examples/verify_module.rs#async fn verify_served_surface()

Findings

No active actionable findings.

Lower-confidence notes

• medium · tests — Pin the state_dir rejection for restricted config (crates/tinyconnectors/src/tinybus\_module/mod\.rs)

Could not review: crates/tinyconnectors/examples/verify_module.rs

Before merge

• Complete the security review for crates/tinyconnectors/examples/verify_module.rs.

How this fits together

flowchart LR
  n0["methods<br/>changed"]:::changed
  n1["verify_restricted_surface"]:::impacted
  n2["...separate_users_and_preserve_daily_history"]:::impacted
  n3["..._performs_confidential_read_without_state"]:::impacted
  n4["serve_via_setup"]:::impacted
  n5["INTERFACE"]:::impacted
  n1 -->|uses| n0
  n1 -->|uses| n5
  n2 -->|uses| n0
  n2 -->|calls| n4
  n2 -->|tests| n4
  n3 -->|uses| n5
  n4 -->|uses| n5
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Reviewed 18 files with no findings recorded.
• Lane summary: Reviewed 18 files; 1 finding.

security

• Conclusion: Success
• Scope reviewed: incomplete; unanswered: crates/tinyconnectors/examples/verify_module.rs
• Lane summary: Reviewed 15 files; 0 findings. 1 file could not be reviewed: crates/tinyconnectors/examples/verify_module.rs. 2 files were not security-reviewed: README.md (prose or tabular data), docs/audits/restricted-initialization-7433.md (prose or tabular data).

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The behavioural changes are pinned by tests in this diff: deny-by-default across every contract member, confidentiality-required delivery, empty capabilities, the serde and contract-version pins, the flipped compatibility assertion, and the static-link sealing regressions.
• Lane summary: The change adds a `RuntimeMode` handshake (contract 1.15), a `routed_read_only` initialization mode with its own deny-by-default interface, and a per-instance setup factory that seals the first admitted mode; the diff does carry real tests, including a `restricted_tests.rs` suite exercising the restricted interface over a memory bus and three static-link regression tests for mode sealing. The one gap I can actually pin is in the dynamic-path addition: `verify_module.rs`'s restricted pass asserts that the four admitted members are *skipped* rather than that they answer, so the dynamic artifact's ListCapabilities/ListAgentReadyToolkits wiring is never checked.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Positive: Nothing sensitive was found in what this pull request commits.
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change adds an immutable `routed_read_only` module mode: a new `RuntimeMode` contract member, a contract bump to 1.15, a per-instance setup factory that seals the first admitted mode, and a restricted service that serves only confidential RoutedRead, RuntimeMode, static capabilities and the static toolkit catalog. The description matches the diff closely and names the concrete behaviour, tests and dependencies; I found no defect that would fail or misbehave on a reachable input.

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash,
• Spend: $0.008774
• Tokens: 1931943 input · 95256 output · 548224 cached · 748 embedding

Head	State	Pass summary
c76b224a0682	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-12T03:56:40Z)
c76b224a0682	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-12T04:22:45Z)

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinyconnectors/src/tinybus_module/mod.rs, tinysweeper/description.

             $0.0079 · 1,775,872 in / 79,113 out · 248,384 cached (14%) · ladder/vectors-oai3, deepseek-v4.1-flash, , glm-5.3-flash · 748 embedded
critique:    $0.0039 · 1,133,112 in / 25,296 out · 156,416 cached (14%) · deepseek-v4.1-flash
security:    $0.0028 · 586,400 in   / 33,651 out · 91,904 cached (16%)  · deepseek-v4.1-flash,
tests:       $0.0005 · 24,688 in    / 10,944 out · 64 cached (0%)       · glm-5.3-flash
description: $0.0003 · 16,912 in    / 4,065 out  · 0 cached (0%)        · deepseek-v4.1-flash

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinyconnectors/examples/verify_module.rs.

             $0.0088 · 1,931,943 in / 95,256 out · 548,224 cached (28%) · ladder/vectors-oai3, deepseek-v4.1-flash,  · 748 embedded
critique:    $0.0029 · 947,856 in   / 30,047 out · 265,728 cached (28%) · deepseek-v4.1-flash,
security:    $0.0054 · 805,462 in   / 59,804 out · 235,392 cached (29%) · deepseek-v4.1-flash
tests:       $0.0002 · 84,207 in    / 1,987 out  · 27,904 cached (33%)  · deepseek-v4.1-flash
description: $0.0001 · 60,929 in    / 805 out    · 19,200 cached (32%)  · deepseek-v4.1-flash