build: align tinybus dependency (range, nested 0.1.5)

[senamakel]

Part of tinyhumansai/openhuman#7610, #7543, #7523

Summary by CodeRabbit

• Chores
  • Updated compatibility with newer versions of the messaging components.
  • No user-facing behavior changes are included in this update.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T17:54:39.118884Z	a516701	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5fd0a5c4-cd60-4179-9d1d-1f3c7bc137e4

📥 Commits

Reviewing files that changed from the base of the PR and between 6b238d6 and a516701.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• crates/tinydocs-module/Cargo.toml
• vendor/tinybus

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The production and test dependency requirements now accept tinybus versions from 0.1.3 up to, but not including, 0.2. The vendored tinybus submodule reference also points to a newer commit.

Changes: tinybus dependency update

Layer / File(s)	Summary
Dependency requirements and vendor reference crates/tinydocs-module/Cargo.toml, vendor/tinybus	The production and test requirements accept tinybus versions from 0.1.3 up to, but not including, 0.2. The vendor submodule points to commit eb5cf727071a6eb12f9efa3db8ec59e54039f336.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a5167

The dependency range now permits TinyBus 0.1.x releases, and the locked 0.1.5 revision preserves the module’s inspected API usage. No merge-blocking impact is identified.

### Architecture Summary

Architecture risk: 🔵 Low · up to a5167

The change affects 1 system.

Changed systems: crates

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — crates (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in crates/tinydocs-module/Cargo.toml: The production tinybus and tinybus-module requirements change from exact version 0.1.3 to the inclusive lower bound 0.1.3 and exclusive upper bound 0.2.
• observed — Modified behavior in crates/tinydocs-module/Cargo.toml: The test-only tinybus requirement changes from exact version 0.1.3 to the range >=0.1.3, <0.2.
• observed — Modified behavior in vendor/tinybus: The vendor/tinybus submodule pointer was updated to commit eb5cf727071a6eb12f9efa3db8ec59e54039f336 from 0cbc48b2f610e36bb5bdcd49fd7bb54252ccf957.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the main changes: widening the tinybus dependency range and aligning the nested vendored version to 0.1.5.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the versions in a row
From 0.1.3, but not to 0.2 below
The vendor pointer hops ahead
New commit tucked beneath its head
Then off it goes through fields of green
With tinybus updates neat and clean}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: a51670100106
Updated: 2026-10-13T23:29:57Z

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change widens the `tinybus`/`tinybus-module` pins from exact (`=0.1.3`) to a `>=0.1.3, <0.2` range in the private, `publish = false` adapter crate. Because the root `Cargo.toml` patches `tinybus`, `tinybus-module` and `tinybus-macros` to `vendor/tinybus/crates/*`, the resolution here is still driven by the vendored sources and the committed lockfile, so this is a manifest-hygiene change rather than a behaviour change; for a private crate the looser range also matches what the crate actually consumes (path-patched in-workspace sources), so I found no defect to report. _The code index is behind this pull request (indexed at `f2fe9e5ec516`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change widens two pinned dependency requirements to caret-style ranges (`>=0.1.3, <0.2`) in the private, non-published `tinydocs-module` adapter crate, matching the repository's stated dependency-pinning rule. Root `Cargo.toml` `[patch]` sections still resolve `tinybus` and `tinybus-module` to the vendored git paths, and `Cargo.lock` pins the concrete revisions, so no new network-fetched code enters the build. No security-relevant defect found. _The code index is behind this pull request (indexed at `f2fe9e5ec516`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change widens the tinybus and tinybus-module version requirements from exact pins to the caret-style range `>=0.1.3, <0.2` in crates/tinydocs-module/Cargo.toml, which matches the repository's pinning rule in spirit and only affects dependency resolution across compatible 0.1.x releases; the quoted diff and the file contents agree with the description's stated intent. I found no defect worth reporting, though I note the diff does not mention that the workspace's `[patch.crates-io]` entries redirect tinybus to vendor/tinybus, so the range's practical effect is bounded by the vendored version. _The code index is behind this pull request (indexed at `f2fe9e5ec516`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000243
• Tokens: 92764 input · 3055 output · 16128 cached · 68 embedding

Head	State	Pass summary
a51670100106	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-13T23:29:57Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0002 · 92,764 in / 3,055 out · 16,128 cached (17%) · ladder/vectors-oai3, deepseek-v4.1-flash · 68 embedded
critique:    $0.0001 · 44,541 in / 935 out   · 6,400 cached (14%)  · deepseek-v4.1-flash
security:    $0.0000 · 29,344 in / 419 out   · 3,712 cached (13%)  · deepseek-v4.1-flash
description: $0.0001 · 16,936 in / 827 out   · 6,016 cached (36%)  · deepseek-v4.1-flash