Repository navigation
flows/ + cron/: put workflows behind tinyflows-bus (Catalog, Runs, CapsHost), relocate product code, shrink to host adapters (file-by-file audit) #8055
Description
Summary
crates/openhuman-core/src/flows/ (17,142 non-test lines, 17,577 test) and src/cron/ (7,408 non-test, 7,136 test) are evaluated file by file below against tinyflows v0.8.23 (vendor/tinyflows). Every non-test file has one verdict, one target and one reason.
Where things stand:
cron/is already on the bus. refactor(cron): run the scheduler in the tinyflows module over the Schedule bus contract #7962 moved the scheduler runtime into thetinyflowsmodule behindtinyflows-busSchedule contract v3. What remains is host policy: the ScheduleHost callbacks, the document port, delivery, agent and shell execution, failure classification, limits, RPC and tools. It also carries bugs and three contract gaps.flows/still links the engine in-process (tinyflows,tinyflows-catalog,tinyflows-copilot,tinyflows-drivers). Tinyflows' own plan (docs/tinyflows-bus-design.md, from the closed [tiny-modules] tinyflows: move tinyflows implementation out of openhuman-core #7544 / [tiny-modules] tinyflows: design tinyflows-bus and a host-callback caps interface (module conversion) #7562) defines slices 2–6 to put workflows behind the bus. None of them is filed, and in v0.8.23 theCatalog,RunsandCapsHostsurfaces are unserved skeletons. This epic files those slices plus everything else the audit found.
Ownership rule. tinyflows owns workflow and scheduling behaviour:
- the graph model, validation, migration and compatibility;
- the engine (run, resume, cancel);
- the node catalog and node-kind contracts, graph ops, and the generic gate stack;
- the copilot authoring tools;
- the catalog, revision, run, draft and cron stores, over the host's document port;
- run bookkeeping, dedup settling, schedule maths, claims, retry, and the scheduler runtime.
OpenHuman reaches all of it only through tinyflows-bus, served by tinyflows-module, and links no engine crate. OpenHuman owns:
- the capability implementations it serves back as host callbacks (
CapsHost,ScheduleHost): agent turns, LLM, Composio and native tools, HTTP with credentials, sandboxed code and shell, memory; - the host-vocabulary gate stages;
- Composio catalog reads and inference readiness;
- security, approvals and the autonomy tier;
- the document-port implementation;
- the
flows.*/cron.*RPC and tool registration; - the DomainEvent projection and delivery;
- operator limits, system jobs, config and product copy.
Invariants. RPC namespace strings, the 27 flow tools and the cron tool names, and DomainEvent variant names do not change. Tests move with their code. No shims are left behind. No contract type is redeclared in OpenHuman.
Verdicts
- DELETE: a shim, re-export, dead code or duplicate. Callers import the real thing.
- UPSTREAM: generic logic with no upstream equivalent. It moves to the named tinyflows crate.
- REIMPLEMENT: the host rebuilt something upstream has, or drives the engine in-process where a bus member should serve it. The host becomes a client, and the listed gaps go upstream first.
- RELOCATE: product code in the wrong host directory. It moves to
src/<domain>/. - KEEP: real wiring or a port implementation.
New modules proposed
No new crates or repositories: every upstream change extends tinyflows-bus, tinyflows-module, tinyflows-copilot or the engine. New host modules:
flows/host_gates/: host gate stages (upload paths, agent refs, connections, tool contracts) andOpenHumanBuilderGateHost. It servesAuthoringHostCheckGate/ResolveWorkflow, depends onintegrations/composio, the agent registry andtinyflows-bus, and never on the engine.flows/caps_host/: replacesflows/tinyflows/. It holds the per-requestCapsHostbinding (run identity, liveSecurityPolicy) and the llm, agent, code, http and tool-dispatch servers.flows/runs_adapter/: the StartRun / ResumeRun / CancelRun client and aPollRunprojector that publishesFlowRun*events and feeds the Langfuse export.integrations/composio/{flow_gate, flow_backend, contract/validation, builder_tools/}: the Composio flow policy, tool backend, contract checks and the five Composio-bound builder tools.inference/readiness.rs: the inference readiness probe.agent/progress_tracing/flow_export.rs: the flow Langfuse export.
Totals (24,550 non-test lines)
| Verdict | flows | cron | Total | Share |
|---|---|---|---|---|
| KEEP | 8,719 | 7,260 | 15,979 | 65% |
| RELOCATE | 3,917 | 0 | 3,917 | 16% |
| REIMPLEMENT | 3,261 | 0 | 3,261 | 13% |
| UPSTREAM | 1,062 | 0 | 1,062 | 4% |
| DELETE | 183 | 148 | 331 | 1% |
If every row lands:
flows/goes from about 17.1k to about 8.7k lines, and to about 7k once the KEEP gate, manifest and builder-host files turn into thin bus clients.cron/goes from about 7.4k to about 6.9k: about 330 lines of dead code and about 120 lines of bookkeeping retire. It stays this large because it really is host policy.
Oversized KEEP files to split: cron/scheduler.rs 505, cron/schemas.rs 492, flows/schemas.rs 538, flows/schemas_handlers.rs 568, flows/ops/builder.rs 528, flows/ops/builder_gates.rs 467, flows/tinyflows/caps/agent.rs 578.
Sub-issues (tracker)
Work order: 1. bugs + deletes → 2. relocations (one domain per PR, OpenHuman-only) → 3. upstream tinyflows work, in the design doc's slice order → 4. host adoption (each blocked on its upstream issues). Every upstream item follows the same chain: tinyflows PR, then a patch release, then the OpenHuman gitlink bump, digest re-pin (modules/registry/records_flows.rs), and deletion of the host copy.
1. Bugs found in the audit (OpenHuman-only)
- [flows-tinyflows] flows bug: resume and cancel races mislabel or tear down a live run senamakel/openhuman#45 flows bug: resume and cancel races mislabel or tear down a live run
- [flows-tinyflows] flows bug: app-event triggers are dropped while the flow is running senamakel/openhuman#46 flows bug: app-event triggers are dropped while the flow is running
- [flows-tinyflows] flows bug: run digests persist raw node output (incl. secrets) to memory senamakel/openhuman#47 flows bug: run digests persist raw node output (incl. secrets) to memory
- [flows-tinyflows] flows bug: autonomy tier is frozen at run start senamakel/openhuman#48 flows bug: autonomy tier is frozen at run start
- [flows-tinyflows] flows bug: remember_keyed deletes the old value before the new write succeeds senamakel/openhuman#49 flows bug: remember_keyed deletes the old value before the new write succeeds
- [flows-tinyflows] flows bug: flows.get_tool_contract RPC lacks the agent tool's runtime-gate warning senamakel/openhuman#50 flows bug: flows.get_tool_contract RPC lacks the agent tool's runtime-gate warning
- [flows-tinyflows] flows bug: minor correctness batch (schema text, log, delete order, config source) senamakel/openhuman#51 flows bug: minor correctness batch (schema text, log, delete order, config source)
- [flows-tinyflows] cron bug: collapsed
crontool drops the tool context senamakel/openhuman#52 cron bug: collapsedcrontool drops the tool context - [flows-tinyflows] cron bug: Run Now records ok when a required delivery failed senamakel/openhuman#53 cron bug: Run Now records ok when a required delivery failed
- [flows-tinyflows] cron bug: announce delivery always reports Delivered (delete cron/bus.rs) senamakel/openhuman#54 cron bug: announce delivery always reports Delivered (delete cron/bus.rs)
- [flows-tinyflows] cron bug: update and RPC add skip allowed_users; cron.add ignores cron.enabled senamakel/openhuman#55 cron bug: update and RPC add skip allowed_users; cron.add ignores cron.enabled
- [flows-tinyflows] cron bug: operator limits miscount, race, and skip flow/system rows senamakel/openhuman#56 cron bug: operator limits miscount, race, and skip flow/system rows
- [flows-tinyflows] cron bug: stdout println in store, unpaired run events, stale flow-subscriber config senamakel/openhuman#57 cron bug: stdout println in store, unpaired run events, stale flow-subscriber config
1. Deletes (OpenHuman-only)
- [flows-tinyflows] flows delete: shims, re-exports and dead code senamakel/openhuman#58 flows delete: shims, re-exports and dead code
- [flows-tinyflows] flows delete: state wrapper and duplicated HTTP credential helpers senamakel/openhuman#59 flows delete: state wrapper and duplicated HTTP credential helpers
- [flows-tinyflows] cron delete: completion_owner side-channel and dead code senamakel/openhuman#60 cron delete: completion_owner side-channel and dead code
2. Relocations and splits (OpenHuman-only, mechanical; RPC and tool names unchanged)
- [flows-tinyflows] flows relocate: Composio contract, connection and tier-gate logic to integrations/composio senamakel/openhuman#61 flows relocate: Composio contract, connection and tier-gate logic to integrations/composio
- [flows-tinyflows] flows relocate: Composio builder tools and tool backend to integrations/composio senamakel/openhuman#62 flows relocate: Composio builder tools and tool backend to integrations/composio
- [flows-tinyflows] flows relocate: inference readiness to inference/readiness.rs senamakel/openhuman#63 flows relocate: inference readiness to inference/readiness.rs
- [flows-tinyflows] flows relocate: Langfuse flow export and builder/discovery agent prompts to agent/ senamakel/openhuman#64 flows relocate: Langfuse flow export and builder/discovery agent prompts to agent/
- [flows-tinyflows] flows relocate: native tool backend to tools/native_ops senamakel/openhuman#65 flows relocate: native tool backend to tools/native_ops
- [flows-tinyflows] flows relocate: flow-authoring bundled skill to skills/bundled senamakel/openhuman#66 flows relocate: flow-authoring bundled skill to skills/bundled
- [flows-tinyflows] flows+cron: split oversized KEEP files senamakel/openhuman#67 flows+cron: split oversized KEEP files
3. Upstream: tinyhumansai/tinyflows (design-doc slices 2–6, plus Schedule v4)
- [flows-tinyflows] Catalog surface: serve workflow definitions, revisions and the CatalogStorage port (slice 2) senamakel/tinyflows#1 Catalog surface: serve workflow definitions, revisions and the CatalogStorage port (slice 2)
- [flows-tinyflows] Catalog surface: drafts, suggestions and run reads senamakel/tinyflows#2 Catalog surface: drafts, suggestions and run reads
- [flows-tinyflows] Authoring/Catalog: full NodeKinds contracts, ApplyGraphOps, ApprovalManifest, ImportGraph (slice 3) senamakel/tinyflows#3 Authoring/Catalog: full NodeKinds contracts, ApplyGraphOps, ApprovalManifest, ImportGraph (slice 3)
- [flows-tinyflows] Serve the CapsHost callback interface (slice 4a) senamakel/tinyflows#4 Serve the CapsHost callback interface (slice 4a)
- [flows-tinyflows] Runs surface: StartRun, PollRun, CancelRun with module-owned run rows and dedup settle (slice 4b) senamakel/tinyflows#5 Runs surface: StartRun, PollRun, CancelRun with module-owned run rows and dedup settle (slice 4b)
- [flows-tinyflows] Runs surface: dry-run in sandbox mode senamakel/tinyflows#6 Runs surface: dry-run in sandbox mode
- [flows-tinyflows] Runs surface: ResumeRun, parked-run expiry and boot sweep (slice 5) senamakel/tinyflows#7 Runs surface: ResumeRun, parked-run expiry and boot sweep (slice 5)
- [flows-tinyflows] wiring: output-field and split_out path warnings over a ToolContractLookup port senamakel/tinyflows#8 wiring: output-field and split_out path warnings over a ToolContractLookup port
- [flows-tinyflows] copilot: ProposeWorkflow and RunFlow tools, backend repair message, per-call port context senamakel/tinyflows#9 copilot: ProposeWorkflow and RunFlow tools, backend repair message, per-call port context
- [flows-tinyflows] small fixes: credential injection, trigger bindings, fallible state open, stale docs senamakel/tinyflows#10 small fixes: credential injection, trigger bindings, fallible state open, stale docs
- [flows-tinyflows] Schedule contract v4: RunJobNow, Attempt detail, ScheduleTrigger job, Deliver success senamakel/tinyflows#11 Schedule contract v4: RunJobNow, Attempt detail, ScheduleTrigger job, Deliver success
4. Host adoption (each blocked on its upstream issues; deletes the host copy)
- [flows-tinyflows] flows adopt: catalog store over the Catalog bus surface senamakel/openhuman#68 flows adopt: catalog store over the Catalog bus surface
- [flows-tinyflows] flows adopt: authoring, gates, approval manifest and node contracts over the bus senamakel/openhuman#69 flows adopt: authoring, gates, approval manifest and node contracts over the bus
- [flows-tinyflows] flows adopt: serve capabilities as the CapsHost callback object senamakel/openhuman#70 flows adopt: serve capabilities as the CapsHost callback object
- [flows-tinyflows] flows adopt: runs over StartRun/PollRun/CancelRun with an event-bus projector senamakel/openhuman#71 flows adopt: runs over StartRun/PollRun/CancelRun with an event-bus projector
- [flows-tinyflows] flows adopt: resume, parked expiry and boot sweep over ResumeRun senamakel/openhuman#72 flows adopt: resume, parked expiry and boot sweep over ResumeRun
- [flows-tinyflows] flows adopt: wiring warnings from tinyflows over a host ToolContractLookup senamakel/openhuman#73 flows adopt: wiring warnings from tinyflows over a host ToolContractLookup
- [flows-tinyflows] flows adopt: copilot ProposeWorkflow/RunFlow tools and builder fallback senamakel/openhuman#74 flows adopt: copilot ProposeWorkflow/RunFlow tools and builder fallback
- [flows-tinyflows] cron adopt: Schedule contract v4 and retire host run-now bookkeeping senamakel/openhuman#75 cron adopt: Schedule contract v4 and retire host run-now bookkeeping
- [flows-tinyflows] flows: retire direct tinyflows links from core (slice 6) senamakel/openhuman#76 flows: retire direct tinyflows links from core (slice 6)
Related, not re-filed: senamakel#97 (flow memory glue dedup, epic #8000), #7938 (agent registry relocation), #7801 (explicit dispatch context), #7973 (one storage database per user).
Notes and open decisions
codenode calling convention. The host runssourceas a function body withreturn(flows/tinyflows/caps/code.rs:212-240). Upstream'sScriptSpawnerruns a stdin/stdout script. A graph written for one convention fails on the other. Choose between a nodeconventionfield and migrating stored graphs onto upstream's runner with OpenHuman's sandbox as the spawner. The choice also decides whetherShellRun(currentlyNone) becomes available.- Approvals over a blocking bus. Recommended: implement
ApprovalProvider(ApprovalDecide/ApprovalCancel), so parking is engine-level and resumes throughResumeRun. The alternative keeps per-capability parking inside a callback that can block for hours. Approval callbacks fail closed either way. - Run timeout.
FLOW_RUN_TIMEOUT_SECS(600 s) wraps the engine call today. It can become aStartRunparameter enforced by the module, or stay host policy enforced throughCancelRun. Inference preflight stays host-side, beforeStartRun. - App events while a flow runs. For the bug fix, choose between a bounded per-flow queue and concurrent runs.
- Cron lease claims.
claim_slotadvancesnext_runat dispatch, so an interrupted occurrence is lost. The comment atprofiles/cron.rs:24-26says the opposite. The drivers' lease claims (claim_due_job/renew_claim) exist but are not inSTORE_OPERATIONS. agent_jobs_onlyvs system jobs. Enforced scopes refuseensure_system_joband never get memory jobs. RPCcron.addwithorigin: nullcreates origin-less agent jobs. Decide whether hosted profiles can reach these paths.- HTTP credential prefix. A
connection_refwithout the exacthttp_cred:prefix is ignored, so the request is sent without auth (flows/tinyflows/caps/http.rs:80-83). The code documents this as intentional, but"HTTP_CRED:stripe"or a data-derivedcomposio:ref also goes out silently. Consider failing closed on any non-empty unknown prefix. - Leaf gate.
flowsis feature-gated and other domains must not import it. The Composio and memory relocations have to move their helpers (connected_toolkits,flows_list_connections,toolkit_has_curated_catalog) too, or stay behind#[cfg(feature = "flows")]. - Dependencies on other epics. The agent-prompt relocation follows Relocate agent registry/definitions to src/agent_registry/ #7938 (
src/agent_registry/). The flow memory glue (flows/memory_tools.rs,flows/tinyflows/memory_adapter.rs) stays inflows/as decided in memory/: move generic memory mechanics into tinymemory, shrink memory/ to wiring (file-by-file audit) #8000; [memory→tinymemory] host adoption: flows memory glue onto upstream Confinement and MemoryOps senamakel/openhuman#97 deduplicates it, so this epic does not relocate it. Catalog collection names should be coordinated with Epic: uniform storage schema (tsd v1.0.0) and one database per user #7973 (one storage database per user). The copilot port context is [tiny-modules] agent: explicit dispatch context for the remaining 9 task-locals (follow-up to #7609) #7801. - Known blocker (tinyflows design doc). Modules that depend on tinybus through a nested path cannot be co-linked into
openhuman-modules-linked. This affects locallinkedmode only; CI uses the pinned release.
Evaluation
One section per directory group.
Evaluation: cron/ (7,408 non-test lines; KEEP 7,260, DELETE 148)
Paths are under crates/openhuman-core/src/cron/. The scheduler runtime, store and schedule maths already live in the tinyflows module (Schedule contract v3). Upstream says what the host keeps: JobExecutor covers "agent and shell execution, including host security and failure classification", and RunDelivery covers "product delivery to channels, conversation origins and alerts". That is why nearly everything here is KEEP.
| File | Lines | Verdict | Target | Reason |
|---|---|---|---|---|
mod.rs |
64 | KEEP | — | Wiring. It re-exports contract types and redeclares none. |
bus.rs |
101 | DELETE | channel_bridge::send_to_channel |
Duplicates channel_bridge.rs:103-125. Fire-and-forget, so delivery failures never reach the run record. Fixed and deleted in the announce-delivery bug leaf. |
bus_host.rs |
265 | KEEP | — | The ScheduleHost callback object (Execute / Failed / Deliver / ScheduleTrigger). |
channel_bridge.rs |
129 | KEEP | — | Cron's adapter onto the channel runtime. It deliberately avoids depending on the feature-gated channels (:16-17). |
client.rs |
236 | KEEP | — | The typed bus client. Six wrappers at :132-204 are test-only and get deleted. |
completion_owner.rs |
47 | DELETE | tenant on CronJobCompleted |
A global side-channel map that exists only because the event carries no owner. |
documents_port.rs |
288 | KEEP | — | The ScheduleDocuments port: a mechanical relay plus a collection allowlist. |
handlers.rs |
238 | KEEP | — | Host job-kind registry behind Execute. register_kind is used by openhuman-embed. |
host_delivery.rs |
73 | KEEP | — | Embedder delivery port (CronDelivery). |
job_builder.rs |
141 | KEEP | — | Product defaults plus the allowed_users lookup. The rules themselves are upstream calls. |
limits.rs |
124 | KEEP | — | Operator limits. check_capacity (:57-68) is reimplemented on set_max_active_jobs. |
ops.rs |
335 | KEEP | — | cron.* operations. run_and_record (:271-310) retires on RunJobNow. The shim and the #[cfg(test)] update_cron_job get deleted. |
origin.rs |
177 | KEEP | — | Origin capture, the approval exemption and turn trust. |
scheduler.rs |
505 | KEEP (split) | scheduler/{dispatcher,live_agents,manual_run}.rs |
Poll cadence, health, JobDispatcher, live agents and Run Now. LoopSlot / MANUAL_RUNS retire on contract v4. |
schemas.rs |
492 | KEEP (split) | — | cron namespace controllers. handle_add skips job_builder's checks. |
seed.rs |
205 | KEEP | — | Product job seeding. |
store.rs |
341 | KEEP | — | Synchronous store facade. Four dead functions; println! at :178. |
system_job_handlers.rs |
89 | KEEP | — | Embedder registration surface. |
system_jobs.rs |
110 | KEEP | — | System memory jobs. |
tools.rs |
37 | KEEP | — | Tool registration. |
scheduler/agent_run.rs |
344 | KEEP | — | Agent turns through the harness. |
scheduler/builtin.rs |
132 | KEEP | — | Default shell, agent and flow handlers. |
scheduler/delivery.rs |
311 | KEEP | — | Channel, desktop and alerts delivery. |
scheduler/executor.rs |
356 | KEEP | — | HostExecutor. Its per-run state map retires once Attempt carries the failure detail. |
scheduler/failure_classification.rs |
277 | KEEP | — | Host-owned under the stated boundary: user copy plus permanent-halt rules. |
scheduler/origin_context.rs |
144 | KEEP | — | Builds the prompt context from thread or channel history. |
scheduler/origin_delivery.rs |
338 | KEEP | — | Origin delivery. |
scheduler/run_delivery.rs |
149 | KEEP | — | Deliver / ScheduleTrigger callbacks. stand_in and the success recompute retire on contract v4. |
scheduler/shell_job.rs |
201 | KEEP | — | Shell through sandbox::shell_exec. Test-only parser at :61-120. |
tools/add.rs |
303 | KEEP | — | cron_add. |
tools/collapsed.rs |
196 | KEEP | — | cron. Drops the tool context. |
tools/list.rs |
126 | KEEP | — | cron_list. |
tools/remove.rs |
80 | KEEP | — | cron_remove. |
tools/run.rs |
162 | KEEP | — | cron_run. Its bookkeeping duplicates ops.rs. |
tools/runs.rs |
158 | KEEP | — | cron_runs. |
tools/update.rs |
134 | KEEP | — | cron_update. Skips the allowed_users check. |
client_testing.rs (53) is #[cfg(test)] only and is not counted.
Notes for this section
- Run Now needs
RunJobNowupstream. Today the host rebuilds deliver → record_run → record_last_run in two places and matches on output text to detect a refusal. - Contract gaps behind host workarounds:
Attempthas no detail field;ScheduleTriggercarries no job;Deliveris not told the final success. - With manual ticks,
LoopSlotis not a duplicate today, because the module takesSchedulerSlotonly inScheduler::run. CronDeliveryRequestedhas no other subscriber in core, so it goes withbus.rs.deliver_jobpassessuccess=trueon Run Now (delivery.rs:82) on purpose: a failed manual run posts canned failure text. Confirm this product behaviour.documents_port'sSERVEDcache is never invalidated. That is fine while the module runtime lives as long as the process.- The synchronous store API (
block_on_anyhow) is called from async tools and handlers. A design smell, not a correctness bug.
Evaluation: flows/ops.rs + flows/ops/ (6,629 non-test lines; KEEP 2,078, REIMPLEMENT 2,782, RELOCATE 1,431, UPSTREAM 338)
Paths are under crates/openhuman-core/src/flows/.
| File | Lines | Verdict | Target | Reason |
|---|---|---|---|---|
ops.rs |
181 | KEEP | — | Module root and run constants. Delete the graph_policy re-exports (:49-51) and the FLOW_PARKED_TTL_SECS alias (:81). |
ops/approval_manifest.rs |
160 | KEEP | Catalog.ApprovalManifest client |
Already the planned split: upstream lists candidates and assembles; the host classifies with SecurityPolicy and the Composio tier. |
ops/builder_gates.rs |
467 | KEEP (split) | flows/host_gates/; BuilderFailures |
Host stages and the BuilderGateHost impl become the AuthoringHost server. run_builder_gates / strict_gate stop linking tinyflows::gates. |
ops/builder.rs |
528 | KEEP (split) | — | The workflow_builder turn runner is host-only. backend_repair_message (:501-528) goes upstream. The extra-hidden-tools layer (:34) is dead. extract_workflow_proposal duplicates spawn_async_subagent.rs:533. |
ops/builder_toolset.rs |
142 | KEEP | — | Host tool-belt policy. Wrong log message at :133. |
ops/catalog.rs |
95 | RELOCATE | integrations/composio/ |
Composio contract lookup. Upstream leaves this to the host. |
ops/connection_ref_gate.rs |
248 | RELOCATE | integrations/composio/contract/validation.rs |
HostGateStage::Connections over Composio connected-account vocabulary. The stage adapter stays in flows. |
ops/connections.rs |
376 | RELOCATE | integrations/composio/ops/connections.rs |
Re-implements identity normalisation from enrich_connections_with_identity. |
ops/definitions.rs |
278 | REIMPLEMENT | Catalog.{List,Get,Put,Delete}Workflow |
Thin calls over the drivers' FlowCatalogDocuments plus upstream create policy. The host keeps the FlowChanged publish, trigger binding, trust purge and memory forget. |
ops/discovery.rs |
160 | KEEP | — | Flow Scout harness turn. Suggestion CRUD moves to Catalog suggestions. |
ops/drafts.rs |
113 | REIMPLEMENT | Catalog drafts | Pass-through to the drivers' drafts; promote is generic composition. |
ops/execution.rs |
507 | REIMPLEMENT | Runs.StartRun + PollRun |
Compiles and runs the engine in-process (:212, :317). |
ops/inference_readiness.rs |
489 | RELOCATE | inference/readiness.rs |
Product inference policy with no upstream equivalent. |
ops/resume.rs |
479 | REIMPLEMENT | Runs.ResumeRun |
In-process resume_with_checkpointer_journaled_observed (:310). Contains the resume race. |
ops/run.rs |
278 | REIMPLEMENT | Runs.StartRun |
Generic run preparation (compat, compile, resolve_inputs). |
ops/run_management.rs |
334 | REIMPLEMENT | Runs.CancelRun, Catalog.ListRuns, expiry, boot sweep |
Orchestrates upstream run_management and the drivers' run calls. Contains the cancel race. |
ops/run_rows.rs |
278 | REIMPLEMENT | module-owned run rows | Wraps run_summary. The host keeps the FlowRunFinished projection. |
ops/streaming.rs |
174 | KEEP | — | Web-channel progress bridge for builder and scout turns. |
ops/tool_contract_gate.rs |
223 | RELOCATE | integrations/composio/contract/validation.rs |
HostGateStage::ToolContracts over the live Composio catalog. |
ops/trail_off.rs |
47 | KEEP | — | Adapter from transcript entries to fallback::ToolResult. Delete the re-exports at :7-8. |
ops/triggers.rs |
219 | KEEP | — | Schedule-trigger binding through the cron store and boot reconcile. Event dispatch is host-only. |
ops/updates.rs |
271 | REIMPLEMENT | Catalog PutWorkflow + revisions |
Wraps the drivers' update_flow_graph / revisions. Dead disarm_automatic parameter. |
ops/validation.rs |
244 | REIMPLEMENT | Authoring.ValidateGraph + ResolveWorkflow, ImportGraph |
Rebuilds ValidateGraph in-process. |
ops/wiring_warnings.rs |
338 | UPSTREAM | tinyflows::wiring over a ToolContractLookup |
Generic binding-to-contract walk with no upstream equivalent. |
Notes for this section
flows_validateandflows_createdisagree: only create checks savedsub_workflowchildren.- The required-arg check runs twice: once as an advisory warning, once as the hard gate.
- Missing bus members (drafts, suggestions, n8n import, history/rollback, duplicate, set_enabled, prune, list-all-runs, get-run) are all in the Catalog upstream leaves.
Evaluation: flows/tinyflows/ + flows/bus* (5,063 non-test lines; KEEP 3,158, RELOCATE 1,390, UPSTREAM 350, DELETE 165)
Paths are under crates/openhuman-core/src/flows/. flows/tinyflows/ is a host module, not the crate. Its capability impls become the CapsHost callback servers.
| File | Lines | Verdict | Target | Reason |
|---|---|---|---|---|
bus.rs |
48 | KEEP | — | Subscriber module root. Drop the extract_trigger_* re-exports. |
tinyflows/mod.rs |
28 | DELETE | — | Re-exports only. |
tinyflows/langfuse_export.rs |
281 | RELOCATE | agent/progress_tracing/flow_export.rs |
OpenHuman's Langfuse transport. The generic mapping is already upstream (observe::to_exporter_observations). |
tinyflows/memory_adapter.rs |
494 | KEEP | — | Memory-v2 MemoryProvider adapter; becomes the Memory* server. Stays in flows/ per #8000, deduplicated by senamakel#97. |
tinyflows/observability.rs |
188 | KEEP | — | Projects steps to FlowRunProgress and persists rows. Becomes the PollRun projector. |
tinyflows/state.rs |
100 | DELETE | tinyflows_drivers::catalog::FlowStateDocuments |
It only wraps a type that already implements StateStore + DedupKv. |
tinyflows/caps/mod.rs |
37 | DELETE | — | Re-export shims of upstream agent_prompt / mock_schema_aware. |
tinyflows/caps/agent.rs |
578 | KEEP (split) | AgentRun / AgentEvents server |
AgentRunner over the harness. Agent routing moves out to flows/agent_route.rs. |
tinyflows/caps/code.rs |
251 | KEEP | CodeRun server |
Sandbox code runner. Its calling convention differs from upstream's (open decision 1). |
tinyflows/caps/http.rs |
262 | KEEP (part REIMPLEMENT) | HttpRequest server |
Credential-name helpers duplicate caps::host::http. The allowlist stays the host's HttpRequestTool. |
tinyflows/caps/llm.rs |
152 | KEEP | LlmComplete server |
LlmProvider over OpenHuman inference. |
tinyflows/caps/ops.rs |
723 | RELOCATE (split) | integrations/composio/flow_gate.rs |
About 430 lines of Composio flow policy. The binding root (build_capabilities, invokers) stays. |
tinyflows/caps/prompt.rs |
78 | KEEP | merge into llm.rs |
Host transcript mapping. |
tinyflows/caps/resolver.rs |
83 | KEEP | ResolveWorkflow |
Goes away once the module resolves through the catalog. |
tinyflows/caps/tier.rs |
195 | KEEP | — | Autonomy-tier and approval gate shared by every server. |
tinyflows/caps/tools/mod.rs |
131 | KEEP | ToolInvoke dispatcher |
ToolBackend registry. |
tinyflows/caps/tools/composio.rs |
273 | RELOCATE | integrations/composio/flow_backend.rs |
Composio tool backend. |
tinyflows/caps/tools/native.rs |
113 | RELOCATE | tools/native_ops/flow_backend.rs |
oh: native tool backend. |
bus/dedup_commit.rs |
350 | UPSTREAM | module settles at run end | Settle logic is upstream (dedup_settle). In-module settling uses the executed graph, which fixes :179-203. |
bus/owner.rs |
134 | KEEP | — | Storage-scope and tenant ownership. |
bus/run_digest.rs |
241 | KEEP | — | Run digest written to memory v2. Re-implements is_success_status (:71). |
bus/trigger.rs |
323 | KEEP (part REIMPLEMENT) | — | Event → run dispatch is a host overlay. extract_trigger_kind copies triggers::graph_trigger_kind. |
Notes for this section
- Served callbacks lose task-local context (
turn_origin,CoreContext::scope, the global approval gate). The run identity must ride on the callback binding, never in module-supplied JSON. - Task, State and Resolver run module-side. LLM, tools, HTTP, code/shell, memory, agent and approvals are the real host callbacks.
- The "close the approval audit" block is repeated 5 times (
http.rs:241,code.rs:191,composio.rs:252,native.rs:84,memory_adapter.rs:176). It should become one helper. - Adopt only the pure HTTP helpers from
caps::host::http, notAllowlistHttpClient: one allowlist policy should serve both the agent tool and flows.
Evaluation: the rest of flows/ (5,450 non-test lines; KEEP 3,483, RELOCATE 1,096, REIMPLEMENT 479, UPSTREAM 374, DELETE 18)
Paths are under crates/openhuman-core/src/flows/.
| File | Lines | Verdict | Target | Reason |
|---|---|---|---|---|
mod.rs |
70 | KEEP | — | Wiring. The kv_* re-export (:61) has no callers. Stale SQLite docs. |
builder_host.rs |
270 | KEEP | Catalog / Authoring / Runs client | FlowsHost implements the copilot ports. sandbox_capabilities links the engine mocks. ctx() uses the ambient context (#7801). |
builder_tools.rs |
56 | RELOCATE | integrations/composio/builder_tools/mod.rs |
Root of the Composio-bound tools. |
builder_tools_support.rs |
83 | KEEP | beside builder_host |
cfg(test) constructors. |
catalogue.rs |
147 | KEEP | ListWorkflows client |
Saved flows shown as skill entries. Hand-rolled trigger_kind read. |
draft_store.rs |
62 | REIMPLEMENT | Catalog drafts | Five one-to-one forwarders over FlowCatalogDocuments. |
memory_tools.rs |
537 | KEEP | — | Flow memory tools. Stays in flows/ per #8000, deduplicated by senamakel#97. |
node_contracts.rs |
173 | KEEP | overlay on NodeKinds |
OpenHuman notes on 11 node kinds. Still links tinyflows::catalog. |
registration.rs |
147 | KEEP | — | Registers the 27 tools. |
schemas.rs |
538 | KEEP (split) | — | 36 flows.* controllers. |
schemas_handlers.rs |
568 | KEEP (split) | schemas/handlers/* |
Pulled in with include!. |
store.rs |
417 | REIMPLEMENT | Catalog members; scope selection → CatalogStorage server |
Every function is documents()? → run(docs.X(..)). |
tools.rs |
374 | UPSTREAM | tinyflows_copilot::tools::{ProposeWorkflowTool, RunFlowTool} |
propose_workflow is ReviseWorkflowTool with revision=false. |
builder_tools/catalog_search.rs |
403 | RELOCATE | integrations/composio/builder_tools/ |
Live Composio catalog search. |
builder_tools/connection_reads.rs |
171 | RELOCATE | integrations/composio/builder_tools/ |
Composio reads (plus http_cred sources). |
builder_tools/tool_contract.rs |
311 | RELOCATE | integrations/composio/builder_tools/ |
Composio contract read and probe. |
schemas/builder_schemas.rs |
231 | KEEP | — | RPC schemas. |
schemas/definition_schemas.rs |
344 | KEEP | — | RPC schemas. |
schemas/draft_schemas.rs |
119 | KEEP | — | RPC schemas. |
schemas/run_schemas.rs |
256 | KEEP | — | RPC schemas. Broken text at :65. |
agents/mod.rs |
23 | RELOCATE | agent registry | Removed once its children move. |
agents/flow_discovery/mod.rs |
1 | RELOCATE | agent registry | — |
agents/flow_discovery/prompt.rs |
38 | RELOCATE | agent registry | Merge with workflow_builder into one archetype builder. |
agents/workflow_builder/mod.rs |
18 | DELETE | tinyflows_copilot::builder |
Re-export shim kept for a historical path. |
agents/workflow_builder/prompt.rs |
33 | RELOCATE | agent registry | — |
skills/mod.rs |
60 | RELOCATE | skills/bundled/mod.rs |
Product skills catalogue. Duplicates FLOW_AUTHORING_FILES. |
Notes for this section
flow_memory_recallrequiresflow_ideven though trusted runs ignore it. Making it optional changes the schema snapshot.- The offered-toolkit policy bounds only
search_tool_catalog, and only when a toolkit is named; contract and probe reads do not check it. catalogue.rsswitching tograph_trigger_kindchanges how an unrecognisedtrigger_kindis shown: verbatim today, "manual" after the switch.
Activity
tinysweeper commentedon Oct 16, 2026
Epic/tracking issue filing a file-by-file audit of flows/ and cron/, proposing a bus migration with ~40 sub-issues for bugs, deletes, relocations, upstream tinyflows work, and host adoption. Not a single defect; organizational/planning work with no user-visible breakage of its own, so p3. The only candidate, #8000, is a related but distinct memory-domain audit epic (explicitly cross-referenced, not duplicated), so no duplicate_of.
Labelled
priority: p3.106 remaining items
senamakel commentedon Oct 18, 2026
core-shrink audit: flows/cron items
From the reworked #7390 audit:
platform/llm_gate/{signals,throttle}.rs(the sysinfo power/CPU sampler and the capacity gate) upstream.platform/resource_admission/README.mdsays cron owns hardware sampling. Please confirm whether tinyruntime or tinyflows should own it; the issue moves accordingly.tools/native_ops.rs(226) has only flows callers (flows/ops/approval_manifest.rs,flows/tinyflows/caps/tools) and rebuilds the full tool belt on every call. It belongs in the flows caps layout. [core-shrink] delete: dead tool plumbing and the crate-wide allow(dead_code) senamakel/openhuman#335 deletes its deadlist_tools/summarize_tool; the move itself is left to this epic.scheduletool move tocron/tools.rsis [tinyagents-slim] relocate: thescheduletool tocron/senamakel/openhuman#207 (Epic: one async spawn_subagent; goals, session and tools upstream; prune tinyagents to what OpenHuman uses #8088).cron/jobs.db/flows.dbimporter instorage/import/tinyflows.rsretires with [cloud-storage] delete: retire the one-shot legacy importers once a release carrying them has shipped senamakel/openhuman#283. Dev-branchtinyflows_driversimporters: [core-shrink] upstream: drop dev-branch import_legacy_* importers from tinyflows_drivers senamakel/tinyflows#35.