[M3gA-Mind]

Summary

Move tinyflows-storage to ulid 3. ulid 3 replaces Ulid::new() with Ulid::generate(), which produces the same 26-character, time-ordered ids. Key::ulid and Key::ulid_at (crates/tinyflows-storage/src/key.rs) switch to it. Key::ulid_at still keeps the caller's timestamp and takes only the random part from a fresh id.

This supersedes dependabot's #187, which only bumped the version and failed to compile (E0599 at key.rs:119 and :127).

Related issue

Supersedes #187.

API or behavior changes

None. No public type exposes ulid::Ulid; Key is a String newtype.

Validation

On a Linux build host, against main f778023:

• cargo test --workspace --locked: 2816 passed, 0 failed, 35 ignored, the same as main. tinyflows_storage 18 (+3 doctests), tinyflows_drivers 420.
• cargo +1.88.0 check --workspace --locked (MSRV): passes.
• cargo clippy with -D warnings: 0 items. cargo fmt --check: clean.
• Lockfile: ulid 3.0.0 is added next to 1.2.1. The tinystoragedrivers crates pinned here (rev 6226b948) still require ulid 1, so the second copy stays until tinyflows moves to a tinystoragedrivers release with ulid 3. cargo tree -i ulid@3.0.0 shows only tinyflows-storage and its dependents.

Tests

No new tests. The existing tinyflows-storage and tinyflows-drivers key and id tests cover the generated ids.

Summary by CodeRabbit

• Bug Fixes
  • Improved generation of time-based storage identifiers, while preserving the timestamp provided when creating an identifier at a specific time.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 16cd898e2a254eef70f9c34118dad993ba2bf220

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 3 files; not reviewed: Cargo.lock.
Pull request purpose (title): fix(storage): move t…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(storage): move to ulid 3 (Ulid::generate). This pull request moves `tinyflows-storage` from ulid 1 to ulid 3, replacing `Ulid::new()` with `Ulid::generate()` in `Key::ulid` and `Key::ulid_at` while preserving the documented id contract (26 Crockford base32 characters, lexically time-ordered, random tail) and the caller-supplied timestamp in `ulid_at`. It supersedes dependabot #187, which only bumped the version and failed to compile. The latest-push delta is unavailable, so no push-level comparison is reported.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The `ulid` dependency in `crates/tinyflows-storage/Cargo.toml` is bumped from 1 to 3, and `crates/tinyflows-storage/src/key.rs` switches `Key::ulid` and `Key::ulid_at` to `Ulid::generate()`. `Key::ulid_at` continues to build the id via `Ulid::from_parts` with the caller's timestamp and only the random tail taken from a fresh id. The lockfile adds ulid 3.0.0 alongside 1.2.1 because the pinned tinystoragedrivers crates still require ulid 1. No public type exposes `ulid::Ulid`; `Key` remains a `String` newtype, so the change is internal.

Features

• Modified — ulid dependency bump to 3 in tinyflows-storage: Moves the storage crate onto ulid 3, which requires the `Ulid::generate()` API; the older ulid 1 copy remains in the lockfile for the pinned tinystoragedrivers crates. (crates/tinyflows-storage/Cargo.toml serde_json = { workspace = true })
• Internal refactor — Key::ulid and Key::ulid_at use Ulid::generate(): Mechanical API rename with unchanged behavior: ids remain 26-character, time-ordered Crockford base32 strings, and `ulid_at` still preserves the caller's timestamp while taking only the random tail from a fresh id. (crates/tinyflows-storage/src/key.rs impl Key {)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane answered with 0 findings across both changed files.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `8de2b4f33fc5`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered with 0 findings across both changed files.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `8de2b4f33fc5`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Tests lane answered with no reportable defect, noting the change is a mechanical API rename whose behavior is unchanged.
• Lane summary: The change replaces across-the-board ULID API calls (ulid 1 → 3: `Ulid::new()` → `Ulid::generate()`), keeping the same documented contract (26 Crockford base32 chars, lexical order tracks creation time, random within a millisecond) and the same `from_parts` pair. `key.rs` has 217 lines and no tests were added or removed; the crate's existing coverage of `Key` (via drivers' ids/migrate tests) still applies, and the change is a mechanical API rename whose behaviour — timestamp prefix and random tail — is unchanged. I could not inspect `ulid` 3's `generate()` implementation since it is a vendored dependency, but nothing in the diff suggests a functional change worth pinning with a new test, and the diff shows no other behavioural alteration. No reportable defect found. _The code index is behind this pull request (indexed at `8de2b4f33fc5`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered with no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `8de2b4f33fc5`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane answered with no reportable defect, finding the diff consistent with the stated no-behavior-change intent and the kept-timestamp logic in `ulid_at` preserved.
• Lane summary: The diff bumps `ulid` to 3 in `tinyflows-storage` and switches `Key::ulid`/`Key::ulid_at` to `Ulid::generate()`, matching the stated no-behaviour-change intent; the kept-timestamp logic in `ulid_at` is preserved. No reportable defect found — I could not independently verify ulid 3's API surface (the vendored crate is not checked out), so I take the author's reported passing build and tests at face value. _The code index is behind this pull request (indexed at `8de2b4f33fc5`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.003556
• Tokens: 208585 input · 3648 output · 26624 cached · 53 embedding
• Updated: 2026-11-11T10:56:00Z

Head	State	Pass summary
16cd898e2a25	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T10:56:00Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The storage crate updates its ulid dependency requirement from version 1 to version 3. Key::ulid and Key::ulid_at now use Ulid::generate() for the random component, and ulid_at retains its supplied timestamp.

Changes: ULID key generation

Layer / File(s)	Summary
Dependency and key constructors crates/tinyflows-storage/Cargo.toml, crates/tinyflows-storage/src/key.rs	The ulid dependency requirement changes from "1" to "3". Both key constructors use Ulid::generate(); ulid_at continues to use the supplied timestamp.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Possibly related PRs

• tinyhumansai/tinyflows#180: This PR provides context for the dependency update by pinning tinystoragedrivers to a version that still requires ulid 1.

Suggested reviewers: senamakel

Merge Risk: Minimal · up to 16cd8

This is an internal dependency upgrade with no public API change. The reported checks pass and no actionable merge risk was found.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: upgrading storage to ulid 3 and using Ulid::generate().
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the ULID trail,
New random tails now join the tale.
The timestamp stays where it was set,
The key grows fresh, with no regret.
Soft paws hop on through version three.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2757fe7d-4f2f-4282-9ca9-cdaf3a726cac

Commits

Reviewing files that changed from the base of the PR and between f778023 and 16cd898.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 2

• crates/tinyflows-storage/Cargo.toml
• crates/tinyflows-storage/src/key.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0036