[senamakel]

Native child turns previously lost spawn_subagent unconditionally, even when the host explicitly allowed bounded nesting. Add optional NestedSpawnDepth admission so a child can expose only its permitted spawn tool below the configured depth limit. Default leaf admission, denied tools, empty child sets, invalid depths and overflow remain closed.

Tests cover permitted nesting, the depth cap, denied tools and the default leaf behavior. The OpenHuman integration tests exercise a real grandchild, readable refusal at the cap, and inherited Cron security policy.

Validation:

• cargo test -p tinyagents-runtime — 177 passed.
• cargo clippy -p tinyagents-runtime --all-targets -- -D warnings — passed.
• Runtime rustdoc with warnings denied and formatting checks — passed.
• Host full embed suite — 379 passed, including 100 concurrent turns; product flow gate — 579 passed.

Refs senamakel/openhuman#220. Part of tinyhumansai/openhuman#8088. This PR targets the epic integration branch; the final epic rollup will target main.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 36f2d3012e0a5c458db356bc9331d21735030eaa

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 4 of 4 files.
Pull request purpose (title): feat(runtime): admit…

Diagnostics and supporting details

Full summary

Pull request purpose (title): feat(runtime): admit explicitly bounded nested subagent spawns. The pull request adds an opt-in bounded nested-spawn admission path to the runtime so a host can let a sub-agent turn keep a spawn tool only when the ordinary allowlist admits it and one more child fits under a validated depth ceiling, while default sub-agent turns remain leaf-only.

Review snapshot

Change surface	Files	Review signal	Count
Production	2	Active findings	0
Tests	1	Noted findings	0
Documentation	1	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

Whole pull request: it introduces `NestedSpawnDepth` with `try_new` ceiling validation and overflow-safe `allows_child`, adds `ToolAdmission::nested_spawn_depth` defaulting to `None`, and updates `plan_registration` so a sub-agent spawn tool is refused unless the ordinary allowlist check passes and the depth grant admits another child. The type is re-exported from the crate and the module README documents that the host must enforce the same ceiling when it executes the spawn. Latest-push-delta: unavailable because there is no trusted base-to-head diff comparison between the prior reviewed head and the current head; cached prompt differences are not treated as a proven push delta.

Features

• Added — NestedSpawnDepth grant with overflow-safe child check: Encapsulates depth and ceiling, validates the current depth is within the ceiling on construction, and checks whether another child fits using checked arithmetic so the `usize::MAX` case stays closed. (crates/tinyagents-runtime/src/tool_registration.rs)
• Added — Opt-in nested-spawn field on ToolAdmission: Adds `nested_spawn_depth` defaulting to `None`, keeping default sub-agent behavior leaf-only while allowing a host to explicitly grant bounded nesting for a turn. (crates/tinyagents-runtime/src/tool_registration.rs pub struct ToolAdmission {)
• Modified — Spawn-tool admission considers the host depth grant: The existing allowlist check still runs first; a sub-agent spawn tool is admitted only when the tool is allowlisted and the depth grant permits another child, otherwise it remains refused. (crates/tinyagents-runtime/src/tool_registration.rs where)
• Added — Public export of NestedSpawnDepth: Makes the new admission type available through the runtime crate API so hosts can construct a grant. (crates/tinyagents-runtime/src/lib.rs pub use prefix::PrefixSnapshot;)
• Modified — Documented leaf-default and host enforcement duty: README and module docs state that sub-agent turns are leaf turns by default, that the grant does not expand the allowlist, and that the host still enforces the depth ceiling when executing the spawn. (crates/tinyagents-runtime/README.md the mutable model history, a stable prefix, and append-only transcript state.)

Tests

• unit — Covers admission below the cap, refusal at the cap, and no expansion when the spawn tool is absent from the ordinary allowlist.: The tests lane answered and reported no findings; the assertions pin the new admission branches. (crates/tinyagents-runtime/src/tool_registration_tests.rs fn subagent_never_gets_spawn_tools_even_if_allowlisted() {, crates/tinyagents-runtime/src/tool_registration_tests.rs)
• unit — Covers invalid depth construction above the ceiling and the `usize::MAX` overflow edge case.: The tests lane answered and reported no findings; the assertions pin the construction and overflow branches. (crates/tinyagents-runtime/src/tool_registration_tests.rs)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane answered after reviewing 4 of 4 files and reported no findings, noting the grant is checked after the allowlist and only on sub-agent runs with overflow handled by `checked_add`.
• Lane summary: The new `NestedSpawnDepth` grant is checked after the ordinary allowlist and only on sub-agent runs, defaults to refusing spawn tools when `None`, and matches the harness's depth semantics (`parent + 1 <= max`), with overflow handled by `checked_add`. No concrete reachable input or repository-rule violation was found in this file. _The code index is behind this pull request (indexed at `9aaf0329345f`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered and reported no findings, noting the fail-closed default remains, the allowlist check still runs first, overflow is handled, and the ceiling is ultimately enforced by the host harness.
• Lane summary: The change keeps the fail-closed default (`nested_spawn_depth: None` still withholds spawn tools from sub-agent runs) and only widens admission when a host explicitly supplies a validated `NestedSpawnDepth`; the allowlist check still runs first, overflow is handled via `checked_add`, and the actual depth ceiling remains enforced by the harness's `checked_child_depth`. No reachable input makes `plan_registration` misbehave, and no repository rule is violated. _The code index is behind this pull request (indexed at `9aaf0329345f`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Tests lane answered and reported no findings, noting the new tests cover below-cap admission, at-cap refusal, non-allowlisted refusal, and error/overflow depths, with default behavior unchanged.
• Lane summary: The change adds a host opt-in for bounded nested spawning (`NestedSpawnDepth`) and two focused tests that pin every new branch: a grant below the ceiling admits the spawn tool, a grant at the ceiling refuses it (empty `spawn_refused` vs refused distinction is asserted separately), a grant without the tool in the ordinary allowlist does not expand it, and `try_new`/`allows_child` reject out-of-range and overflow depths. The README invariant (admitted only when allowlisted and a child fits under the ceiling) is exactly what those assertions would fail on, so the behavioural change is covered and I found no defect to report. _The code index is behind this pull request (indexed at `9aaf0329345f`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered and reported no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `9aaf0329345f`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane answered and reported no findings, stating the description matches the diff and the depth arithmetic is consistent with the added tests.
• Lane summary: The description matches the diff: it adds an optional `NestedSpawnDepth` grant, exposes it via `ToolAdmission::nested_spawn_depth`, gates spawn tools on `allows_child` while still requiring the ordinary allowlist, re-exports the type, and documents the host's remaining enforcement duty in the module README. The depth arithmetic (`depth.checked_add(1) <= max_depth`) and the `try_new` ceiling check are consistent with the tests added, and default leaf behaviour stays closed when the grant is absent. No defects found. _The code index is behind this pull request (indexed at `9aaf0329345f`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000890
• Tokens: 130089 input · 11560 output · 49792 cached · 301 embedding
• Updated: 2026-10-21T20:25:03Z

Head	State	Pass summary
ab31383505dc	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-21T20:17:52Z)
36f2d3012e0a	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-21T20:25:03Z)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a84a8909-aa7d-4950-9726-f8a40a456230

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T20:28:08.788524Z	36f2d30	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0018

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab31383505

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".