Prepare TinyBrowser v0.2.2 version

[senamakel]

Summary

Prepare the reviewed workspace version for v0.2.2. Update the root shared version and the four local TinyBrowser package entries in Cargo.lock; no source, dependency, or module ABI changes. This version commit can merge through protected main with its required Rust check, unlike the release workflow's rejected direct main push in run 36087226790.

Related issue

Release run 36087226790; paired with #22 for tag-only release preparation.

API or behavior changes

No product API or runtime behavior change. Package versions move from 0.2.1 to 0.2.2.

Validation

• cargo metadata --format-version 1 --no-deps --locked reports 0.2.2 for all four TinyBrowser packages
• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo build --locked --all-targets --all-features
• cargo test --locked --all-features --quiet
• git diff --check

Tests

No behavior test was added for a version-only change; the full existing suite passed.

Documentation

Adjusted the Cargo.toml comment for the reviewed version-PR release flow in #22.

Checklist

• The change is focused on one logical change
• No new allow attributes, ignored tests, or relaxed lints
• No secrets, tokens, or environment files in the diff or description

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 4 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Changes requested
Priority: critical
Reviewed head: 8c6424fe1021
Updated: 1790305072 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	4
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• critical · critique · Update Cargo.lock with the workspace version — Changing the workspace version updates every member package's resolved version, but this pull request does not include the corresponding Cargo.lock changes. The release workflow an (Cargo\.toml:22)
• critical · security · Update Cargo.lock with the workspace version — Changing the workspace package version also changes the versions of the local packages recorded in the committed `Cargo.lock`, but this pull request changes only `Cargo.toml`. Lock (Cargo\.toml:22)
• medium · security · Let the release workflow own the workspace version — The repository's release process explicitly owns changes to `[workspace.package].version`, but this pull request edits it directly. Manual version changes can conflict with the wor (Cargo\.toml:22)
• critical · description · Update Cargo.lock to reflect version bump from 0.2.1 to 0.2.2 — The workspace version is changed from `0.2.1` to `0.2.2`, but the committed `Cargo.lock` is not updated. All four TinyBrowser packages inherit the workspace version, so their entri (\(pull request description\))

Before merge

• Address Update Cargo.lock with the workspace version (Cargo\.toml).
• Address Update Cargo.lock with the workspace version (Cargo\.toml).
• Address Update Cargo.lock to reflect version bump from 0.2.1 to 0.2.2 (\(pull request description\)).

Agent review details

critique

• Conclusion: Failure
• Scope reviewed: all assigned evidence
• Lane summary: The workspace version bump is not accompanied by the required lockfile update, so locked release builds will fail until Cargo.lock is regenerated. _3 memory call(s) failed (model: cortex: v1/answer: timed out after 20s), so this review saw part of what the engine holds._
• Evidence: Cargo\.toml — Update Cargo.lock with the workspace version

security

• Conclusion: Failure
• Scope reviewed: all assigned evidence
• Lane summary: The manifest manually bumps the workspace version without the release workflow owning that change or the corresponding lockfile update. This is not safe to merge as submitted. (2 observation(s) grouped into shared inline comments) _3 memory call(s) failed (model: cortex: v1/answer: timed out after 20s), so this review saw part of what the engine holds._
• Evidence: Cargo\.toml — Update Cargo.lock with the workspace version
• Evidence: Cargo\.toml — Let the release workflow own the workspace version

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Failure
• Scope reviewed: all assigned evidence
• Lane summary: This PR updates the workspace version from 0.2.1 to 0.2.2 and adjusts a comment in Cargo.toml, but fails to update the committed Cargo.lock. Without the lockfile update, `--locked` builds will fail because the lockfile still records version 0.2.1. The change cannot merge until the lockfile is regenerated and committed to reflect the new version. No other issues found. Do not merge in its current state. (The description claims the lockfile is updated, but the diff does not include those changes.) _3 memory call(s) failed (model: cortex: v1/answer: timed out after 20s), so this review saw part of what the engine holds._
• Evidence: \(pull request description\) — Update Cargo.lock to reflect version bump from 0.2.1 to 0.2.2

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash
• Spend: $0.002609
• Tokens: 55364 input · 4661 output · 2790 cached · 50 embedding

Head	State	Pass summary
8c6424fe1021	changes requested	4 active finding(s), 0 resolved finding(s) (at 1790305072)

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

Or wait 57 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4ebe8ec8-cd22-456f-a159-48cd628d0b29

📥 Commits

Reviewing files that changed from the base of the PR and between 0e719ef and 8c6424f.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• Cargo.toml

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Requesting changes: 3 lane(s) blocking, worst finding is critical.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0026 · 55,364 in / 4,661 out · 2,790 cached (5%) · ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash · 50 embedded
critique:    $0.0011 · 32,269 in / 2,034 out · 2,790 cached (9%) · gpt-5.6-luna, deepseek/deepseek-v4-flash
security:    $0.0004 · 14,677 in / 788 out   · 0 cached (0%)     · gpt-5.6-luna
description: $0.0008 · 6,870 in  / 1,154 out · 0 cached (0%)     · deepseek/deepseek-v4-flash

This review incorrectly claims Cargo.lock is absent and that the old release workflow should own the version. PR #23 commits Cargo.lock with all four TinyBrowser package entries updated to 0.2.2; cargo metadata --locked and the required Rust CI checks pass. The protected-main release workflow in paired PR #22 must use a reviewed version PR because GH013 rejected its direct main push in release run 36087226790. The inline thread was answered and resolved, and GitHub cannot re-request tinysweeper by login. Dismissing only this demonstrated false/stale verdict.