chore(vendor): bump tinycortex — corroboration gate for bare credit-card runs - #5605
Merged
senamakel merged 1 commit intoAug 20, 2026
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughThe ChangesTinycortex vendor update
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: 🔵 Low · up to This update changes credit-card detection and timestamp handling in the vendored dependency; an incorrect pin or incomplete validation could leave memory records corrupted. The change is otherwise localized and mergeable with owner awareness that the target revision and its formatting, lint, and test checks must be confirmed. Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
coderabbitai
Bot
added
the
priority: p3
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
YellowSnnowmann
marked this pull request as ready for review
August 20, 2026 09:05
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
YellowSnnowmann
force-pushed
the
chore/bump-tinycortex-cc-corroboration
branch
from
August 20, 2026 09:08
25f752b to
1632f00
Compare
coderabbitai
Bot
removed
the
priority: p3
This was referenced Aug 20, 2026
YellowSnnowmann
force-pushed
the
chore/bump-tinycortex-cc-corroboration
branch
from
August 20, 2026 09:36
1632f00 to
a29c424
Compare
tinysweeper
Bot
added
the
priority: p3
YellowSnnowmann
force-pushed
the
chore/bump-tinycortex-cc-corroboration
branch
from
August 20, 2026 10:18
a29c424 to
590899a
Compare
…ard runs Pulls tinyhumansai/tinycortex#154: the PII scrubber no longer redacts a bare 13-19 digit run on Luhn alone (a ~10% false-positive rate on arbitrary digit runs). Bare runs now need a real network IIN at an issued length or a card keyword nearby; separated runs keep the Luhn-only gate. Root fix for tinyhumansai/opencompany#1201, where Luhn-valid 13-digit `at_millis` stamps were redacted out of stored memory envelopes, corrupting the JSON and presenting as the embedded namespace driver losing writes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
YellowSnnowmann
force-pushed
the
chore/bump-tinycortex-cc-corroboration
branch
from
August 20, 2026 10:19
590899a to
7a91af3
Compare
oxoxDev
pushed a commit
to tinyhumansai/opencompany
that referenced
this pull request
Aug 20, 2026
…valid digit runs Advances vendor/openhuman to tinyhumansai/openhuman#5605 (openhuman main v0.63.13 + the vendor/tinycortex bump to tinyhumansai/tinycortex#154). tinycortex's PII scrubber redacted any bare 13-19 digit run that passed Luhn — ~10% of arbitrary runs — which rewrote Luhn-valid 13-digit `at_millis` values inside this repo's serialized memory envelopes to `[REDACTED_PII_CREDIT_CARD]`, corrupting the JSON. The embedded namespace driver then dropped every corrupted record on read, which is what #1201 observed as the driver losing writes (~36% of conformance runs red). Bare runs now require a real network IIN at an issued length or a card keyword nearby; separated runs keep the Luhn-only gate. Also adds the [patch] entry this bump exposes the need for: since tinycortex@8401346 (tinymemory#18 §A1, already on openhuman main), tinycortex-api depends on tinymemory-api by git URL. [patch.crates-io] does not redirect git sources, so without a [patch."https://github.com/tinyhumansai/tinymemory"] section the git checkout joins the graph beside the vendored path copy and every shared contract type becomes two types — tinymemory-core stops compiling. openhuman carries exactly this entry for itself; replicated here with the path rebased onto the vendored checkout, same as the existing WS4 entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pulls tinyhumansai/tinycortex#154 (plus the four tinycortex main commits between the current pin
8401346and its base): the memory-store PII scrubber no longer redacts a bare 13-19 digit run on Luhn alone — a ~10% false-positive rate on arbitrary digit runs, which was rewriting Luhn-valid 13-digit epoch-millisecond timestamps inside serialized memory envelopes into[REDACTED_PII_CREDIT_CARD]and corrupting the JSON.Downstream symptom: tinyhumansai/opencompany#1201 — the embedded
namespacememory driver's conformance lane red on ~36% of runs, presenting as the driver losing writes (the read side silently dropped every corrupted record).Bare runs now need a real network IIN at an issued length or a card keyword within 32 bytes; separated runs (
4111 1111 1111 1111) keep the Luhn-only gate they always had. Bare card dumps like4111111111111111still redact.Chain
refs/pull/154/headuntil then)vendor/openhumanbump follows, carrying a deterministic regression testVerification
tinycortex at the pinned SHA: full lib suite 1260 + 132 passed, fmt + clippy clean. opencompany's previously-flaky
store::memoryconformance suite reproduced the corruption 100% deterministically on the old pin (pinned Luhn-valid timestamp) and passes on this one — evidence in opencompany#1201.🤖 Generated with Claude Code
Summary by CodeRabbit