Skip to content

feat(import): feature-gate importers so legacy cron imports without the flows engine - #135

Merged
senamakel merged 3 commits into
mainfrom
storage-7662-tinyflows-1
Oct 13, 2026
Merged

senamakel merged 3 commits into
mainfrom
storage-7662-tinyflows-1

Conversation

@senamakel

@senamakel senamakel commented Oct 13, 2026 •

Copy link
Copy Markdown
Member

Part of tinyhumansai/openhuman#7662, tinyhumansai/openhuman#7522

What

tinyflows-import gains features (engine, store, catalog, schedule; all default-on) so a host without the flows engine can build with default-features = false, features = ["schedule"] and still import legacy jobs.db cron jobs and runs (import_cron). tinyflows-drivers is taken with default features off. CI now lints and tests the schedule-only importer build. The existing cron importer tests run in that configuration.

Deferred (recorded on #7662)

  • Fold of tinyflows-drivers into the published tinyflows crate: kept split by decision, still blocked because tinystoragedrivers-core is not on crates.io and a published crate cannot carry a git dependency.
  • Removal of the OpenHuman root/app tsd [patch]: needs the tinyflows tsd source to match tinyagents', an OpenHuman-side change.
  • Host wiring: have the OpenHuman build without flows call import_cron with schedule-only features, and supply the key list to import_file_state (the legacy store hashes keys, so only the host knows them).
  • tinyjuice nested tinyagents copy to tsd v0.7.0: only if it enters the Cargo graph.

Summary by CodeRabbit

  • New Features
    • Importer functionality can now be selected by feature group, allowing cron jobs to be imported without enabling the flows engine.
    • Catalog, checkpoint, cron, state, and workflow-store imports are available when their corresponding features are enabled; all feature groups remain enabled by default.
  • Tests
    • CI now runs Clippy and tests the schedule-only configuration.

…ows-import/src/lib.rs

Auto-committed-on: dragonfly
The CI workflow now runs clippy and tests for tinyflows-import with only the
schedule feature enabled, matching the existing coverage for the drivers crate.
This ensures legacy cron jobs can still be imported without the flows engine.

Auto-committed-on: dragonfly
The sorted_by test helper is now only compiled when the catalog feature is enabled, since it is used solely by catalog-related tests and would otherwise trigger dead code warnings in other configurations.

Auto-committed-on: dragonfly
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-13T15:17:54.755412Z 307b25f PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 5200f23f-3e77-4508-a778-c1f716db43ba
📥 Commits

Reviewing files that changed from the base of the PR and between 568048b and 307b25f.

📒 Files selected for processing (4)
  • .github/workflows/ci.yml
  • crates/tinyflows-import/Cargo.toml
  • crates/tinyflows-import/src/lib.rs
  • crates/tinyflows-import/src/test_support.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The importer now supports selectable feature groups. Its schedule feature can be enabled without the flows engine. CI checks this configuration with Clippy and tests.

Changes: Importer Feature Selection

Layer / File(s) Summary
Feature definitions and gated exports
crates/tinyflows-import/Cargo.toml, crates/tinyflows-import/src/lib.rs, crates/tinyflows-import/src/test_support.rs
Feature mappings make dependencies optional and gate modules, exports, and the sorted_by helper. The schedule feature does not require engine.
Schedule-only CI checks
.github/workflows/ci.yml
CI runs Clippy and tests with default features disabled and only schedule enabled.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 307b2

The importer is configured to offer schedule-only builds without the engine, with CI checks for that configuration. The supplied evidence identifies no material merge risk.

Security architecture risk: 🔵 Low · up to 307b2

The change narrows selectable capabilities without establishing a new security weakness. Caller authorization, source ownership, and recovery during interrupted or concurrent migration remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • observed — The migration write scope is determined by the supplied CronDocuments storage handle. Tenant scoping is documented as a host responsibility; the importer does not independently bind the selected database to that tenant.

Trust Boundaries and Controls

  • observed — Schedule import retains deterministic job identity mapping and conditional absent writes. Engine, catalog, and store compilation are not the enforcement points for these controls.

Resilience and Maintainability Implications

  • inferred — Existing recovery is incremental, not transaction-wide. Semantic run deduplication precedes a separate conditional insertion, and counter advancement follows insertion. Concurrent imports can therefore duplicate a logical run, while interruption can leave an inserted run with an unadvanced counter. These limitations predate the PR; changed exposure or worsening was not established.

Hardening Proposals

  • proposed — When wiring schedule-only migration into a host, validate database provenance against the authorized target scope, serialize migration invocations, and define recovery for failure between run insertion and counter advancement. These are integration safeguards, not observed PR vulnerabilities.
Pre-merge checks · Passed 5
Passed Passed checks (5 passed)
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the primary change: feature-gating importers so legacy cron imports can run without the flows engine.
Docstring Coverage Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (2 skipped: 2 …
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

A rabbit checks the schedule gate,
With cron jobs queued and engine-free,
The features sort into their place,
While Clippy hops through happily,
And tests run clean as springtime tea.

Comment @coderabbitai help to get the list of available commands.

@senamakel
senamakel merged commit 4c9adc4 into main Oct 13, 2026
3 checks passed
@tinysweeper

tinysweeper Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Tiny Sweeper review

Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: 307b25f964dc
Updated: 2026-10-13T22:12:38Z

Review snapshot

Change surface Files Review signal Count
Production 1 Active findings 0
Tests 1 Noted findings 0
Documentation 0 Resolved findings 0
Configuration 2 Pending checks/questions 0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

How this fits together

flowchart LR
  n0["tree_digest"]:::impacted
  n1["read"]:::impacted
  n2["expected"]:::impacted
  n3["Value"]:::impacted
  n4["insert"]:::impacted
  n5["digest"]:::impacted
  n0 -->|calls| n1
  n0 -->|tests| n1
  n0 -->|calls| n4
  n0 -->|tests| n4
  n0 -->|calls| n5
  n0 -->|tests| n5
  n2 -->|calls| n1
  n2 -->|tests| n1
  n2 -->|uses| n3
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Loading
Agent review details

critique

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: Reviewed 4 files; 0 findings. _The code index is behind this pull request (indexed at `d44159cf42e1`), so retrieved context may be out of date._

security

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: Reviewed 4 files; 0 findings. _The code index is behind this pull request (indexed at `d44159cf42e1`), so retrieved context may be out of date._

tests

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: This change makes the importer's four entry points Cargo-feature-gated (engine/store/catalog/schedule), adds matching CI jobs, and adds a feature gate to a test helper. The library wins from this — timestamps come from the live crate — but the diff as published is not implementable: the bare `[features]` block is inserted inside the existing `[dependencies]` table, and writing raw `tinyflows-import` runs into two other packages. Neither is a coding-rule violation I can pin to the repository's instructions, so I have no anchorable findings; I flag them here only so they are not lost. _The code index is behind this pull request (indexed at `d44159cf42e1`), so retrieved context may be out of date._

commits

  • Conclusion: Neutral
  • Scope reviewed: all assigned evidence
  • Lane summary: Nothing sensitive found in what this pull request commits.

description

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: The change adds feature gates to `tinyflows-import` (engine/store/catalog/schedule, all default-on), makes its `tinyflows`, `tinyflows-catalog` and `tinyflows-schedule` dependencies optional, switches `tinyflows-drivers` to `default-features = false`, and adds CI jobs linting and testing the schedule-only build; the description matches the diff and the diff is internally consistent — each cfg feature corresponds to a declared feature that pulls the required dependency, and the CI steps name the same feature set the description describes. I found no defect worth reporting. _The code index is behind this pull request (indexed at `d44159cf42e1`), so retrieved context may be out of date._
Evidence and run details
  • Models: ladder/vectors-oai3, deepseek-v4.1-flash
  • Spend: $0.000495
  • Tokens: 275189 input · 6060 output · 37120 cached · 147 embedding
Head State Pass summary
307b25f964dc ready for maintainer review 0 active finding(s), 0 resolved finding(s) (at 2026-10-13T22:12:38Z)

tinysweeper 0.1.2

@tinysweeper tinysweeper Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tinysweeper found nothing blocking. Approving.

             $0.0005 · 275,189 in / 6,060 out · 37,120 cached (13%) · ladder/vectors-oai3, deepseek-v4.1-flash · 147 embedded
critique:    $0.0002 · 114,089 in / 2,089 out · 15,488 cached (14%) · deepseek-v4.1-flash
security:    $0.0001 · 74,942 in  / 921 out   · 9,856 cached (13%)  · deepseek-v4.1-flash
tests:       $0.0001 · 58,228 in  / 958 out   · 6,272 cached (11%)  · deepseek-v4.1-flash
description: $0.0001 · 24,814 in  / 859 out   · 5,504 cached (22%)  · deepseek-v4.1-flash

@tinysweeper tinysweeper Bot added the priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect. label Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant