chore(modules): re-pin tinycomputer to v0.10.0

[YellowSnnowmann]

Summary

Re-pins the tinycomputer module from v0.9.1 to the published v0.10.0, which carries the travel-site fixes from tinyhumansai/tinycomputer#78 (pop-ups, calendars, place boxes, click into view) and the arboard build without image support from tinyhumansai/tinycomputer#79.

Why

The module is loaded from the published release, not built from the gitlink, so those fixes reach OpenHuman only through this pin. The submodule pin also sat two commits past the v0.9.1 tag under an exemption; v0.10.0 contains those commits, so the exemption can go.

Changes

• registry/records_computer.rs: version, release URL, and the 7 macOS and Windows archives with their digests, copied from the published v0.10.0 checksum.toml (not from a local build).
• registry_tests.rs: the pinned version and the macos-26-arm64 digest.
• vendor/tinycomputer: the v0.10.0 tag (489421c0).
• Cargo.lock and crates/openhuman-app/Cargo.lock: tinycomputer-bus and tinycomputer-accessibility 0.10.0; the image crates arboard no longer pulls in drop out. No other package changes.
• module-pin-exemptions.json: drops the tinycomputer exemption, since the pin now sits on the tag.

Submission Checklist

• N/A: Tests added or updated. The existing registry test is updated to the new version and digest; no behavior is added.
• N/A: Diff coverage ≥ 80%. The changed lines are constants, lockfiles, and a gitlink.
• N/A: Coverage matrix updated. Behavior-only change, no feature rows.
• N/A: Affected feature IDs. No matrix feature changes.
• No new external network dependencies introduced
• N/A: Manual smoke checklist. No release-cut surface changes.
• N/A: Linked issue closed. This is a step toward Integrate TinyComputer desktop and browser control into OpenHuman, then get a browser action under ~30s #7000, not its close.

Impact

• Desktop only: macOS and Windows hosts download the v0.10.0 module.
• The bus contract moves from 2.8 to 2.9 (an optional dialog_left_open field on flow requests and results). OpenHuman reads CONTRACT_VERSION from the pinned bus crate and does not build those structs, so the host and the v0.10.0 module agree.

Verification

• node scripts/ci/check-module-pins.mjs: OK. tinycomputer is no longer reported.
• Both lockfiles were updated with cargo metadata; the diff holds only the two tinycomputer crates and the dropped image crates.
• Not yet run locally: cargo test -p openhuman --lib -- modules::registry. A live browser test run is using the machine; CI covers it, and I'll post the local result here.

Related

• Related: Integrate TinyComputer desktop and browser control into OpenHuman, then get a browser action under ~30s #7000
• Follow-up PR(s)/TODOs: none

Summary by CodeRabbit

• Updates
  • Updated TinyComputer to version 0.10.0, including the available macOS and Windows downloads.
  • Removed the exemption for the previous TinyComputer version.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Reviewing pending checks
Priority: low
Reviewed head: df15a9d7afce
Updated: 1791551970 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	4

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Pending checks: Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS)

Before merge

• Wait for Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS).

How this fits together

flowchart LR
  n0["every_host_key"]:::impacted
  n1["...cord_publishes_for_every_host_or_for_none"]:::impacted
  n1 -->|calls| n0
  n1 -->|tests| n0
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 2 files; 0 findings. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 2 files; 0 findings. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This is a version-pin bump for the tinycomputer module: new version, release URL, archive names and checksums in the registry, the existing registry test updated to the new values, and the now-obsolete CI pin exemption removed. The data is entirely declarative and the accompanying test asserts the new version and a checksum, so a regression in the pin would fail that test. No findings; safe to merge. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The description accurately matches the visible diff: the registry version, release URL, asset names and digests are re-pinned to v0.10.0, the registry test is updated to the new version and macos-26-arm64 digest, and the tinycomputer pin exemption is removed. The described lockfile, vendored gitlink, and exemption changes are consistent with what is shown; digests and the vendor tag could not be independently verified here, but nothing in the description contradicts the diff. Safe to merge once CI confirms the registry test. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: This PR bumps the pinned tinycomputer module to v0.10.0 (version, release URL, archive names, sha256 hashes) and updates the pin-assertion test and exemption list in lockstep. No end-to-end harness exercises the module download/pin path, and none can under the repository's own rule that tests must not call real third-party services — verifying the hashes requires fetching the upstream release. Recorded as informational; the change itself looks sound. Waiting on end-to-end jobs: `Rust E2E (mock backend)`, `Build Playwright E2E Artifact`, `E2E (Playwright / web lane)`, `Desktop E2E (full suite, 3 OS)`.
• Unresolved questions/checks: Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS)

Evidence and run details

• Models: gpt-5.6-luna, glm-5.3-flash
• Spend: $0.000767
• Tokens: 72926 input · 3845 output · 12310 cached · 0 embedding

Head	State	Pass summary
df15a9d7afce	pending	0 active finding(s), 0 resolved finding(s) (at 1791551970)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T13:24:10.277291Z	df15a9d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ce014e78-5e5a-4e95-9ad3-c3ae1bb0a8a0

---

📥 Commits

Reviewing files that changed from the base of the PR and between 1ffe670 and df15a9d.

---

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• crates/openhuman-app/Cargo.lock is excluded by !**/*.lock

---

📒 Files selected for processing (4)

• crates/openhuman-core/src/modules/registry/records_computer.rs
• crates/openhuman-core/src/modules/registry_tests.rs
• scripts/ci/module-pin-exemptions.json
• vendor/tinycomputer

---

 ____________________________________________________________________________________________________________________________
< Developing tolerance for imperfection is the key factor in turning chronic starters into consistent finishers. - Jon Acuff >
 ----------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0008 · 72,926 in / 3,845 out · 12,310 cached (17%) · gpt-5.6-luna, glm-5.3-flash
critique:    $0.0003 · 24,225 in / 824 out   · 4,063 cached (17%)  · gpt-5.6-luna
security:    $0.0003 · 25,594 in / 954 out   · 3,575 cached (14%)  · gpt-5.6-luna
tests:       $0.0000 · 5,997 in  / 107 out   · 1,536 cached (26%)  · glm-5.3-flash
description: $0.0000 · 6,044 in  / 271 out   · 1,408 cached (23%)  · glm-5.3-flash
e2e:         $0.0001 · 6,863 in  / 675 out   · 1,728 cached (25%)  · glm-5.3-flash