chore(deps): bump the vendored tinyhumans-sdk pin

[senamakel]

Summary

• vendor/tinyhumans-sdk: 1cd5dee → 83ab7b1. Gitlink only — one line, no source and no lockfile change.
• Picks up chore(api): sync spec for the backend spend-caps surface sdk#14 and feat: add Developer Options panel with tools for skills, AI configura… #15 (spend-cap routes + spec sync) and refactor(agent-integrations): one module per provider sdk#16 (the /agent-integrations/* surface split one module per provider).
• Verified this crate still compiles against the new pin.

Problem

The vendored SDK pin sat at tinyhumansai/sdk#13 (the optional Socket.IO transport) while the SDK's main moved three commits ahead. The largest of those, #16, restructures the agent-integration surface from two flat files into src/api/agent_integrations/ with one module per provider — the kind of change that looks alarming on a vendored dependency, so it is worth stating exactly what it does and does not do.

Solution

Move the gitlink and nothing else.

The restructure is a verified pure move: the SDK's 102 public types and 62 public methods are unchanged, no source line was altered, and api::agent_integration_types remains as a re-export shim precisely so vendored consumers like this one keep resolving their existing imports.

This crate's exposure is narrower still. Its only SDK imports are:

• tinyhumans_sdk::api::types
• tinyhumans_sdk::jwt / jwt::decode_jwt_exp_unix

Neither is in the moved surface. The dependency is also declared default-features = false, so the socket feature stays off.

Submission Checklist

• N/A: gitlink-only change; no behavior to test here. The SDK at 83ab7b1 carries its own suite — 145 tests passing, plus a new agent_integration_module_layout test pinning both the per-provider paths and the compat shim.
• N/A: no changed lines of this repo's source, so diff coverage does not apply.
• N/A: behaviour-only change — no feature rows added, removed, or renamed.
• N/A: no feature IDs affected.
• No new external network dependencies — the SDK's dependency set is unchanged, which is why Cargo.lock needed no update.
• N/A: no release-cut surface touched.
• N/A: no linked issue.

Impact

Desktop/CLI only, and no runtime behavior change. The pin also carries the SDK's post_multipart Content-Type fix (tinyhumansai/sdk#11, already in at 1cd5dee's ancestry) — relevant because Sentry TAURI-RUST-QBN stayed open client-side pending exactly this kind of re-pin.

No migration, no compatibility break: the SDK's public API is identical before and after.

Related

• Closes: N/A
• Follow-up PR(s)/TODOs: ComposioConnectionsResponse::Object silently yields zero connections on an unrecognized object shape sdk#17 — ComposioConnectionsResponse silently decodes an unrecognized object shape to zero connections. Not reachable from this crate today.

---

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: chore/bump-sdk-gitlink
• Commit SHA: 5c5a4d5b94555f4c04bc8f1eddae78fd5e064de9

Validation Run

• N/A: pnpm --filter openhuman-app format:check — no app/TS files changed
• N/A: pnpm typecheck — no TS files changed
• Focused tests: cargo check --locked --lib clean against the new pin (Checking openhuman v0.63.14 … Finished), and cargo check -p tinyhumans-sdk --locked clean. Cargo.lock confirmed untouched after both.
• Rust fmt/check (if changed): N/A — no Rust source changed in this repo. In the SDK at 83ab7b1: cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, cargo test (145 passed) and cargo package all green.
• Tauri fmt/check (if changed): N/A — no Tauri source changed

Validation Blocked

• command: N/A
• error: N/A
• impact: N/A

Behavior Changes

• Intended behavior change: none
• User-visible effect: none

Parity Contract

• Legacy behavior preserved: yes — the SDK's public API is byte-identical in shape across the bump, and the agent_integration_types re-export shim preserves the pre-split import path.
• Guard/fallback/dispatch parity checks: N/A — no dispatch or guard logic touched.

Duplicate / Superseded PR Handling

• Duplicate PR(s): none
• Canonical PR: this one

Summary by CodeRabbit

• Chores
  • Updated the bundled SDK to the latest available revision.
  • No user-facing features or behavior changes.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out · 14 embedded · openrouter/openai/text-embedding-3-small

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3892ebd3-bfb1-4777-a9c2-22486c909a40

📥 Commits

Reviewing files that changed from the base of the PR and between 2b220b8 and 5c5a4d5.

📒 Files selected for processing (1)

• vendor/tinyhumans-sdk

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The vendor/tinyhumans-sdk submodule pointer was updated from commit 1cd5dee6a17f298be43192022ff96a48644e76ca to 83ab7b1d32fdef85ec8d8427b92225a7575fb5cc.

Changes

SDK Submodule Update

Layer / File(s)	Summary
Update SDK submodule pointer vendor/tinyhumans-sdk	The submodule reference now points to commit 83ab7b1d32fdef85ec8d8427b92225a7575fb5cc.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 5c5a4

This PR only updates the vendored SDK pin and does not change repository source or intended runtime behavior; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: al629176

Poem

A rabbit checks the pointer bright,
An SDK hops to newer light.
One small commit, one tidy trail,
The vendor path now clears the rail.
Hop, hop—update complete!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the vendored tinyhumans-sdk dependency pin update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[senamakel]

The two red checks are pre-existing breakage on main, not caused by this bump.

Rust Core Coverage (cargo-llvm-cov) fails three tests here:

core::cli_capability::tests::bound_driver_probe_reports_the_default_module_driver
openhuman::memory::binding::tests::module_binding_advertises_every_family
openhuman::memory::ops::provider::tests::bound_driver_status_reports_id_class_contract_and_capabilities
test result: FAILED. 12116 passed; 3 failed; 106 ignored

The latest CI Lite run on main (32373660712, the merge of #5621) fails the same three tests, in the same job, with the identical 12116 passed; 3 failed; 106 ignored line. PR CI Gate is red only because it aggregates that job.

The failures are memory-module family/capability mismatches:

left:  ["core", "diff", "documents", "entities", "goals", "graph", "ingest",
        "maintenance", "portability", "recall", "sources", "tool_memory", "tree"]
right: [… "chunks", "episodic", "people", "profile", "retrieval" …]

left: Capabilities { bits: 8191 }   right: Capabilities { bits: 262143 }

The bound driver advertises 13 families where the tests expect 18. Nothing in that path is reachable from the SDK: this PR's entire diff is one gitlink line, and this crate imports only tinyhumans_sdk::api::types and tinyhumans_sdk::jwt.

Locally against the new pin, with vendor/tinymemory at main's recorded 38a34d2:

• cargo check -p tinyhumans-sdk --locked — clean
• cargo check --locked --lib — clean (Checking openhuman v0.63.14 … Finished)
• Cargo.lock unchanged after both

I have not tried to fix the family mismatch here — it is unrelated to this change and wants its own PR against the memory-module pin rather than being smuggled in behind a dependency bump. Flagging it because it is currently blocking every PR into main, not just this one.

[senamakel]

PR Babysitter status

Head: 5c5a4d5b9 (gitlink-only bump vendor/tinyhumans-sdk 1cd5dee → 83ab7b1; git diff --stat origin/main HEAD shows exactly one changed file)

Root cause confirmed: the two failing checks (Rust Core Coverage, PR CI Gate) are pre-existing breakage on main, unrelated to this PR's diff. main has failed the same 3 tests with the identical 12116 passed; 3 failed; 106 ignored line since PR #5620 merged (2026-08-20T12:41Z). #5620 correctly narrowed ModuleMemoryProvider::capabilities() to the 13 families the pinned tinymemory v1.0.1 artifact actually serves (fixing issue #5598's false-advertising bug), but missed updating three test files elsewhere that still hardcoded the old, incorrect "full 18-family contract" expectation:

• core::cli_capability::tests::bound_driver_probe_reports_the_default_module_driver
• openhuman::memory::binding::tests::module_binding_advertises_every_family
• openhuman::memory::ops::provider::tests::bound_driver_status_reports_id_class_contract_and_capabilities

Fix pushed as a separate PR: #5639 — fix(memory): align stale capability tests with the pinned-artifact fix. Test-only change (no production code touched), all three corrected tests verified passing locally:

test core::cli_capability::tests::bound_driver_probe_reports_the_default_module_driver ... ok
test openhuman::memory::binding::tests::module_binding_advertises_the_pinned_artifacts_families ... ok
test openhuman::memory::ops::provider::tests::bound_driver_status_reports_id_class_contract_and_capabilities ... ok

Next action: #5639 needs to go green and be merged to main by a human reviewer (this session does not merge PRs). Once merged, this PR (#5632) will be rebased onto the fixed main and should go green with no further changes — its own diff is untouched and unaffected.