Skip to content

feat: vendor direct TinyHumans dependencies - #176

Open
senamakel wants to merge 2 commits into
mainfrom
git-deps-main-sync
Open

senamakel wants to merge 2 commits into
mainfrom
git-deps-main-sync

Conversation

@senamakel

@senamakel senamakel commented Sep 19, 2026

Copy link
Copy Markdown
Member

Replaces parent-level TinyHumans Git dependencies with paths into vendored submodules pinned to current upstream main.\n\nVerification:\n- TinyHivemind: cargo test --workspace --all-targets\n- TinyCortex: cargo check --workspace --all-targets, focused API/contract tests (full suite has one pre-existing source-weight assertion failure unrelated to this change).

Summary by CodeRabbit

  • Build and Dependency Updates
    • Included version-pinned inference and memory components directly with the project.
    • Updated project configuration to use the included component versions consistently.
    • Updated the included component revisions to ensure reproducible builds.
    • No user-facing functionality or public interfaces changed.

senamakel and others added 2 commits September 19, 2026 21:55
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
@tinysweeper

tinysweeper Bot commented Sep 19, 2026

Copy link
Copy Markdown

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 4 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Changes requested
Priority: high
Reviewed head: 8386fd7f10d1
Updated: 1789844675 (Unix time)

Review snapshot

Change surface Files Review signal Count
Production 1 Active findings 4
Tests 0 Noted findings 0
Documentation 0 Resolved findings 0
Configuration 2 Pending checks/questions 0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

  • high · critique · Do not merge crates from nested workspaces into this workspace — These crates are described as inheriting metadata from the TinyInference upstream workspace, but listing them as members of this root workspace makes them members of this workspace (Cargo\.toml:10)
  • medium · critique · Avoid requiring an uninitialized submodule to build — This path dependency only works when `vendor/tinymemory` has been populated. A normal `git clone` does not initialize submodules, and Cargo also does not populate nested submodules (api/Cargo\.toml:41)
  • high · description · Use Rust 2021 edition per repository convention — The workspace.package sets `edition = "2024"` and `rust-version = "1.88"`. The repository's own coding rules state "Use Rust 2021 and standard `cargo fmt` style". Edition 2024 is n (\(pull request description\))
  • medium · description · Fix workspace.package repository URL to point to the correct project — The `repository` field in `workspace.package` is set to the tinyinference repository, but this workspace belongs to the tinycortex crate. The URL should point to the tinycortex rep (\(pull request description\))

Before merge

  • Address Do not merge crates from nested workspaces into this workspace (Cargo\.toml).
  • Address Use Rust 2021 edition per repository convention (\(pull request description\)).
Agent review details

critique

  • Conclusion: Failure
  • Scope reviewed: all assigned evidence
  • Lane summary: Reviewed 3 files; 2 findings. _The code index is behind this pull request (indexed at `1ce634005c3f`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
  • Evidence: Cargo\.toml — Do not merge crates from nested workspaces into this workspace
  • Evidence: api/Cargo\.toml — Avoid requiring an uninitialized submodule to build

security

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: Reviewed 3 files; 0 findings. _The code index is behind this pull request (indexed at `1ce634005c3f`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

tests

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: This pull request replaces three git dependencies (tinyinference-embeddings, tinyinference-llm, tinymemory-api) with local path dependencies pointing to vendored submodules, and adds workspace-level metadata and lint configuration. No behavioural code is changed, so no new tests are needed. The change is straightforward and sound. _The code index is behind this pull request (indexed at `1ce634005c3f`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

commits

  • Conclusion: Neutral
  • Scope reviewed: all assigned evidence
  • Lane summary: Nothing sensitive found in what this pull request commits.

description

  • Conclusion: Failure
  • Scope reviewed: all assigned evidence
  • Lane summary: Vendors TinyHumans Git dependencies as submodule paths, but introduces a workspace.package section with edition 2024 (unstable) and rust-version 1.88 (nonexistent), plus an incorrect repository URL. These metadata errors will prevent compilation on current stable Rust and must be fixed before merging. _The code index is behind this pull request (indexed at `1ce634005c3f`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
  • Evidence: \(pull request description\) — Use Rust 2021 edition per repository convention
  • Evidence: \(pull request description\) — Fix workspace.package repository URL to point to the correct project

e2e

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: Changes the dependency resolution of `tinyinference` and `tinymemory` from Git URLs to vendored path dependencies via submodules. This is a build/config change with no external surface — no runtime behavior, API, or observable output is modified — so no end-to-end test is needed. _The code index is behind this pull request (indexed at `1ce634005c3f`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
Evidence and run details
  • Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
  • Spend: $0.015207
  • Tokens: 304927 input · 18286 output · 21186 cached · 396 embedding
Head State Pass summary
8386fd7f10d1 changes requested 4 active finding(s), 0 resolved finding(s) (at 1789844675)

tinysweeper 0.1.0

@coderabbitai

coderabbitai Bot commented Sep 19, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: aa09f19b-8e66-4a90-bb4e-db83db51a512

📥 Commits

Reviewing files that changed from the base of the PR and between 518c855 and 8386fd7.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (5)
  • .gitmodules
  • Cargo.toml
  • api/Cargo.toml
  • vendor/tinyinference
  • vendor/tinymemory

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.


📝 Walkthrough

Walkthrough

The repository adds pinned tinyinference and tinymemory submodules, includes their crates in the Rust workspace, centralizes workspace metadata and dependencies, and changes application dependencies from Git revisions to local vendored paths.

Changes

Vendored workspace integration

Layer / File(s) Summary
Workspace and submodule setup
.gitmodules, Cargo.toml, vendor/tinyinference, vendor/tinymemory
The repository registers and pins both submodules. The workspace includes their crates and adds shared package metadata, dependencies, and lint settings.
Local dependency resolution
Cargo.toml, api/Cargo.toml
tinyinference-embeddings, tinyinference-llm, and tinymemory-api now use local paths instead of Git dependencies and revision pins.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: vendoring the direct TinyHumans dependencies.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

A rabbit hops through crates so neat
Vendored paths make builds complete
Two pinned friends join the Rusty den
Shared lints guide them now and then
Local links replace the distant trail

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 19, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-19T19:04:44.033098Z 8386fd7 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8386fd7f10

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Cargo.toml
Comment on lines +10 to +13
"vendor/tinyinference/crates/tinyinference-core",
"vendor/tinyinference/crates/tinyinference-embeddings",
"vendor/tinyinference/crates/tinyinference-llm",
"vendor/tinymemory/crates/tinymemory-api",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Initialize submodules in the documented clone workflow

When a new contributor follows gitbooks/getting-started.md:147-154, the documented plain git clone leaves these newly required submodule directories uninitialized, so the first cargo check fails while loading the missing vendored manifests. Although scripts/setup.sh initializes them, this workflow never invokes that script; update it to clone with --recurse-submodules or run git submodule update --init --recursive before Cargo.

Useful? React with 👍 / 👎.

@tinysweeper tinysweeper Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes: 2 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0152 · 304,927 in / 18,286 out · 21,186 cached (7%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 396 embedded
critique:    $0.0074 · 137,361 in / 5,706 out  · 10,112 cached (7%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0067 · 123,409 in / 3,140 out  · 9,026 cached (7%)  · gpt-5.6-luna
tests:       $0.0003 · 16,101 in  / 1,866 out  · 1,024 cached (6%)  · deepseek-v4-flash
description: $0.0003 · 7,714 in   / 4,237 out  · 1,024 cached (13%) · deepseek-v4-flash
e2e:         $0.0003 · 16,867 in  / 379 out    · 0 cached (0%)      · deepseek-v4-flash

Comment thread Cargo.toml
members = [
".",
"api",
"vendor/tinyinference/crates/tinyinference-core",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

priority high critique likely

Do not merge crates from nested workspaces into this workspace

These crates are described as inheriting metadata from the TinyInference upstream workspace, but listing them as members of this root workspace makes them members of this workspace instead. Cargo does not support nested workspaces, and any workspace = true fields in their manifests will resolve against this root's metadata (edition = 2024, rust-version = 1.88, and the TinyInference repository) rather than their upstream workspace. That can make cargo metadata/cargo check fail or silently change the vendored crates' package configuration. Keep the submodule workspace separate and use path dependencies, or remove its own workspace root and explicitly verify every inherited field after making it a member.

[RULE] workspace-membership ·

Comment thread api/Cargo.toml
tinymemory-api = { git = "https://github.com/tinyhumansai/tinymemory", rev = "4549cda222de3891b95e2fa58e2565bb2c194328" }
# Vendored as a submodule so this re-export and any local TinyMemory consumer
# resolve exactly one set of contract types, without a direct Git dependency.
tinymemory-api = { path = "../vendor/tinymemory/crates/tinymemory-api" }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

priority medium critique confident

Avoid requiring an uninitialized submodule to build

This path dependency only works when vendor/tinymemory has been populated. A normal git clone does not initialize submodules, and Cargo also does not populate nested submodules when resolving a repository used as a git dependency, so cargo check fails with a missing manifest before tinycortex-api can build. The CI checkout explicitly enables submodules, but that does not protect contributors following the repository's normal clone instructions or downstream users consuming the crate from Git. Keep the dependency self-contained for ordinary checkouts, or add and enforce a documented/bootstrap mechanism that makes every supported source-consumption path initialize the submodule.

[RULE] uninitialized-submodule ·

@tinysweeper tinysweeper Bot added the priority: p1 Next. Wrong behaviour a user will hit, or a security weakness behind a condition. label Sep 19, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: p1 Next. Wrong behaviour a user will hit, or a security weakness behind a condition.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant