Add optional static TinyMemory module exports

[senamakel]

Summary

Add an opt-in static-link feature to tinymemory-module so OpenHuman can link its module in-process through Rust-addressable TinyBus ABI entries. The default build retains its dynamic C exports. Both modes expand one module declaration, keeping the method manifest identical. Pin the nested TinyBus submodule to the canonical merge of tinybus#28.

Related issue

None.

API or behavior changes

Additive feature and public descriptor, manifest, and initializer exports when static-link is enabled. Default behavior is unchanged.

Validation

• cargo fmt --all -- --check
• cargo clippy --locked --manifest-path crates/tinymemory-module/Cargo.toml --all-targets -- -D warnings
• cargo clippy --locked --manifest-path crates/tinymemory-module/Cargo.toml --all-targets --features static-link -- -D warnings
• cargo build --locked --manifest-path crates/tinymemory-module/Cargo.toml
• cargo test --locked --manifest-path crates/tinymemory-module/Cargo.toml --lib
• cargo test --locked --manifest-path crates/tinymemory-module/Cargo.toml --test module_e2e (isolated dynamic loader cases)
• cargo test --locked --manifest-path crates/tinymemory-module/Cargo.toml --features static-link --test static_link
• nm confirms the default dylib still exports TinyBus descriptor, manifest, and initializer symbols

Tests

Added a static-link integration test that attaches the module through ModuleHost::attach_raw_with_config and calls DriverId over TinyBus. CI runs static-link clippy and the test; the existing dynamic loader E2E covers default behavior. The linked-host test uses narrowly documented unsafe calls because TinyBus requires callers to guarantee the ABI entry points remain valid for the host lifetime; unsafe_code remains denied in the module and is allowed only on this test function. The module coverage job combines dynamic and all-feature profiles under the unchanged 80% line floor (81.77% locally).

Documentation

Updated docs/specs/tinybus-module.md and module crate docs with the linked-mode feature and entry paths.

Checklist

• The change is focused on one logical change
• The only lint exception is the linked-host test's documented unsafe ABI calls
• No secrets, tokens, or .env contents in the diff or the description

Summary by CodeRabbit

• New Features
  • Hosts can now compile the module directly into an executable using an opt-in static-linking option. The default build continues to support dynamic loading.
• Documentation
  • Updated the module guide to explain the differences between dynamic loading and static linking, including how hosts access the module’s ABI entry points in each mode.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 1 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: 90a8c07433b0
Updated: 1790369926 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	1
Tests	2	Noted findings	0
Documentation	1	Resolved findings	61
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

Previously reported and still active

• Add the static\_link test target before invoking it

Resolved this pass

• Cover the static-link public API with an end-to-end test
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Add the static_link test target before invoking it
• Keep optional features under the coverage gate
• Replace crate-level unsafe allow with targeted per-item allows
• Include static-link in the feature coverage gate
• Cover the static-link public API with an end-to-end test
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Add the static_link test target before invoking it
• Replace crate-level unsafe allow with targeted per-item allows
• Cover the static-link public API with an end-to-end test
• Avoid allowing unsafe code in the test crate
• medium — Cover the static-link public API with an end-to-end test
• high — Call the available raw attach API
• medium — Avoid allowing unsafe code in the test crate
• critical — Add the static_link test target before invoking it
• medium — Include static-link in the feature coverage gate
• Cover the static-link public API with an end-to-end test
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Keep optional features under the coverage gate
• Replace crate-level unsafe allow with targeted per-item allows
• Add the static_link test target before invoking it
• Include static-link in the feature coverage gate
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Cover the static-link public API with an end-to-end test
• Add the static_link test target before invoking it
• medium — Cover the static-link public API with an end-to-end test
• high — Call the available raw attach API
• medium — Avoid allowing unsafe code in the test crate
• medium — Keep optional features under the coverage gate
• medium — Replace crate-level unsafe allow with targeted per-item allows
• critical — Add the static_link test target before invoking it
• medium — Include static-link in the feature coverage gate
• Cover the static-link public API with an end-to-end test
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Replace crate-level unsafe allow with targeted per-item allows
• Cover the static-link public API with an end-to-end test
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Add the static_link test target before invoking it
• Keep optional features under the coverage gate
• Replace crate-level unsafe allow with targeted per-item allows
• Include static-link in the feature coverage gate
• Cover the static-link public API with an end-to-end test
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Keep optional features under the coverage gate
• Replace crate-level unsafe allow with targeted per-item allows
• Add the static_link test target before invoking it
• Include static-link in the feature coverage gate
• Cover the static-link public API with an end-to-end test
• Call the available raw attach API
• Avoid allowing unsafe code in the test crate
• Add the static_link test target before invoking it
• Keep optional features under the coverage gate
• Replace crate-level unsafe allow with targeted per-item allows

Before merge

• Address carried finding Add the static\_link test target before invoking it.

How this fits together

flowchart LR
  n0["call"]:::impacted
  n1["assert"]:::impacted
  n2["admit_module"]:::impacted
  n3["proxy"]:::impacted
  n4["..._runs_over_the_bus_and_lands_in_the_store"]:::impacted
  n5["Result"]:::impacted
  n4 -->|calls| n0
  n4 -->|tests| n0
  n4 -->|calls| n1
  n4 -->|calls| n2
  n4 -->|calls| n3
  n4 -->|uses| n5
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 6 files; 0 findings. (1 earlier finding(s) still open) _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 5 files; 0 findings. 1 file was not security-reviewed: docs/specs/tinybus-module.md (prose or tabular data). (4 earlier finding(s) still open) _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds a static-link feature to tinymemory-module, allowing a host to link the module in-process via Rust-addressable ABI entries, with a new integration test and CI coverage. All earlier findings are resolved; no new issues introduced. (1 earlier finding(s) still open) _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds an opt-in static-link feature with Rust-addressable ABI exports, integration tests, and combined coverage in CI. All prior concerns are resolved; the change is correct and safe to merge. (1 earlier finding(s) still open) _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This pull request adds a `static-link` feature that exposes Rust-addressable TinyBus ABI entry points, along with a dedicated integration test (`static_link.rs`) that exercises them end-to-end. The CI job runs that test, and the coverage measurement is adjusted to include it. All earlier findings about covering the static-link API, calling the raw attach API, and allowing unsafe code have been addressed by this test and the corresponding lint relaxation. The change is safe to merge. 2 end-to-end jobs passed on this head. (2 earlier finding(s) still open) _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.013474
• Tokens: 510306 input · 25645 output · 32157 cached · 682 embedding

Head	State	Pass summary
5c85acacb19b	changes requested	2 active finding(s), 6 resolved finding(s) (at 1790367900)
5024c3d289a6	pending	1 active finding(s), 14 resolved finding(s) (at 1790368271)
7238e07310f3	pending	5 active finding(s), 11 resolved finding(s) (at 1790368515)
90a8c07433b0	changes requested	8 active finding(s), 23 resolved finding(s) (at 1790369199)
90a8c07433b0	ready for maintainer review	0 active finding(s), 61 resolved finding(s) (at 1790369926)

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 78576d00-85fb-4a6e-a140-fc8ede0395ca

📥 Commits

Reviewing files that changed from the base of the PR and between b7ea77f and 90a8c07.

⛔ Files ignored due to path filters (1)

• crates/tinymemory-module/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• .github/workflows/ci.yml
• crates/tinymemory-module/Cargo.toml
• crates/tinymemory-module/src/lib.rs
• crates/tinymemory-module/tests/module_e2e.rs
• crates/tinymemory-module/tests/static_link.rs
• docs/specs/tinybus-module.md
• vendor/tinybus

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The module adds an opt-in static-link feature that exposes its ABI entry points through Rust paths. Integration tests, CI checks, coverage collection, and documentation cover the linked mode while preserving the default dynamic-loading mode.

Changes

Static-Link Module Exports

Layer / File(s)	Summary
Static-link export mode crates/tinymemory-module/Cargo.toml, crates/tinymemory-module/src/lib.rs, docs/specs/tinybus-module.md, vendor/tinybus	The crate adds the static-link feature and selects module_export_static! when enabled. It re-exports the ABI entries for Rust-linked hosts. The docs distinguish static linking from default dynamic loading, and the TinyBus submodule reference changes.
Static-link integration checks crates/tinymemory-module/tests/static_link.rs, crates/tinymemory-module/tests/module_e2e.rs, crates/tinymemory-module/Cargo.toml, .github/workflows/ci.yml	The linked-mode tests check the ABI entries and call DriverId through an in-memory bus. The dynamic-loading test is excluded when static-link is enabled. CI adds Clippy and linked-mode checks, then collects coverage from default and all-feature builds.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant StaticLinkTest
  participant TinyMemoryModule
  participant ModuleHost
  participant InMemoryBroker
  participant ClientProxy
  StaticLinkTest->>TinyMemoryModule: Read ABI descriptor, manifest, and initializer
  StaticLinkTest->>ModuleHost: Attach linked module with workspace configuration
  StaticLinkTest->>InMemoryBroker: Start broker
  StaticLinkTest->>ClientProxy: Call DriverId
  ClientProxy->>InMemoryBroker: Send DriverId request
  InMemoryBroker->>TinyMemoryModule: Deliver DriverId request
  TinyMemoryModule-->>ClientProxy: Return "tinycortex"

Loading

Suggested reviewers: yellowsnnowmann

Merge Risk: ⚪ Minimal · up to 90a8c

The supplied evidence identifies no issue that must be fixed before merging. Complete the normal build and test checks before merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 90a8c

Static linking gives a host another way to attach the memory module without changing the default build or its declared service interface. The remaining risk is limited but not fully resolved: the new attachment path and its failure handling have not been verified against the host implementation.

Retained concerns

• Low · security · inferred: Static attachment shifts selection of a fully privileged in-process module to the embedding host. Whether raw attachment applies comparable ABI and manifest admission checks is unverified; this is not evidence that a check is bypassed.

Security review details

Security Blast Radius

• inferred — A linked module would execute with its embedding host’s process privileges, as dynamic modules already do. No production deployment or new externally reachable caller is established.

Security Findings and Attack Paths

• inferred — The sensitive-data panic-payload candidate remains unresolved, not verified. Available evidence does not show that request data enters a panic payload or that the embedding host redacts one; the changed TinyBus implementation could not be inspected.

Trust Boundaries and Controls

• inferred — The linked test supplies ABI entries directly to raw host attachment, whereas the dynamic test supplies an artifact path. Subsequent access in both tests goes through a TinyBus proxy; equivalence of their admission checks is not established.

Resilience and Maintainability Implications

• observed — Setup strips the remote-backend secret before installing callbacks and reduces a store-factory error to a stage-only bus error. Those controls do not establish panic-payload handling.

Hardening Proposals

• proposed — Before relying on linked attachment in a host, verify its ABI and manifest admission policy, who controls the supplied entries and configuration, and the outcome of failed or repeated initialization.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (4 skipped: 4 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding optional static-link exports for the TinyMemory module.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

_{A rabbit checks the ABI path,
Then hops where linked symbols stay.
A bus carries DriverId along,
“tinycortex” answers back,
And clover marks the passing tests.}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0083 · 331,866 in / 13,498 out · 17,071 cached (5%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 382 embedded
critique:    $0.0043 · 167,948 in / 3,542 out  · 10,346 cached (6%) · gpt-5.6-luna
security:    $0.0030 · 116,807 in / 1,765 out  · 3,653 cached (3%)  · gpt-5.6-luna
tests:       $0.0003 · 16,405 in  / 1,202 out  · 1,536 cached (9%)  · deepseek-v4-flash
description: $0.0002 · 7,254 in   / 2,595 out  · 0 cached (0%)      · deepseek-v4-flash
e2e:         $0.0004 · 20,188 in  / 2,483 out  · 1,536 cached (8%)  · deepseek-v4-flash

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0078 · 303,172 in / 20,792 out · 32,528 cached (11%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 626 embedded
critique:    $0.0037 · 143,928 in / 7,985 out  · 18,420 cached (13%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0030 · 113,288 in / 4,401 out  · 10,524 cached (9%)  · gpt-5.6-luna
tests:       $0.0003 · 15,574 in  / 1,658 out  · 1,536 cached (10%)  · deepseek-v4-flash
description: $0.0002 · 6,534 in   / 1,445 out  · 1,024 cached (16%)  · deepseek-v4-flash
e2e:         $0.0004 · 19,332 in  / 1,466 out  · 1,024 cached (5%)   · deepseek-v4-flash

[tinysweeper]

The previously-blocking findings are resolved. Clearing the changes request.

             $0.0031 · 124,166 in / 9,155 out · 6,169 cached (5%)  · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 653 embedded
critique:    $0.0009 · 35,449 in  / 918 out   · 2,073 cached (6%)  · gpt-5.6-luna
security:    $0.0010 · 35,017 in  / 1,018 out · 0 cached (0%)      · gpt-5.6-luna
tests:       $0.0003 · 17,845 in  / 868 out   · 1,536 cached (9%)  · deepseek-v4-flash
description: $0.0002 · 9,376 in   / 1,474 out · 1,536 cached (16%) · deepseek-v4-flash
e2e:         $0.0004 · 21,610 in  / 2,063 out · 1,024 cached (5%)  · deepseek-v4-flash

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0032 · 112,859 in / 20,142 out · 10,587 cached (9%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 678 embedded
critique:    $0.0014 · 51,830 in  / 2,750 out  · 6,491 cached (13%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0005 · 12,886 in  / 1,252 out  · 0 cached (0%)      · gpt-5.6-luna
tests:       $0.0004 · 16,034 in  / 2,939 out  · 1,536 cached (10%) · deepseek-v4-flash
description: $0.0003 · 7,111 in   / 5,487 out  · 1,024 cached (14%) · deepseek-v4-flash
e2e:         $0.0005 · 19,798 in  / 3,926 out  · 1,536 cached (8%)  · deepseek-v4-flash

[tinysweeper]

Requesting changes: 2 lane(s) blocking, worst finding is critical.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0065 · 246,202 in / 20,420 out · 31,048 cached (13%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 682 embedded
critique:    $0.0026 · 95,430 in  / 6,219 out  · 12,928 cached (14%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0028 · 102,069 in / 4,407 out  · 10,952 cached (11%) · gpt-5.6-luna
tests:       $0.0003 · 16,153 in  / 1,730 out  · 2,048 cached (13%)  · deepseek-v4-flash
description: $0.0002 · 7,213 in   / 3,193 out  · 2,560 cached (35%)  · deepseek-v4-flash
e2e:         $0.0004 · 19,918 in  / 1,976 out  · 2,560 cached (13%)  · deepseek-v4-flash

[senamakel]

@tinysweeper Please re-review the current head after the resolved threads. The module CI job passed, including the static_link target and two-pass 81.77% coverage. The prior review report noted its code index was behind at 5c85aca; current head is 90a8c07, where static_link.rs and the pinned TinyBus attach_raw_with_config API are present.

[tinysweeper]

The previously-blocking findings are resolved. Clearing the changes request.

             $0.0135 · 510,306 in / 25,645 out · 32,157 cached (6%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 682 embedded
critique:    $0.0074 · 270,623 in / 9,682 out  · 12,423 cached (5%) · gpt-5.6-luna
security:    $0.0047 · 182,271 in / 4,815 out  · 12,566 cached (7%) · gpt-5.6-luna
tests:       $0.0005 · 19,154 in  / 3,617 out  · 1,536 cached (8%)  · deepseek-v4-flash
description: $0.0004 · 10,214 in  / 5,308 out  · 1,024 cached (10%) · deepseek-v4-flash
e2e:         $0.0004 · 22,911 in  / 870 out    · 1,536 cached (7%)  · deepseek-v4-flash