feat: the agent tool vocabulary

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
  - name: Security reports
- url: https://github.com/tinyhumansai/rust-template/security/policy
+ url: https://github.com/tinyhumansai/tinytools/security/policy
  about: Please do not report vulnerabilities through public issues.

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
  # This job executes repository code (cargo build/test); don't persist
  # the token in git config.
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
  with:
@@ -53,32 +52,71 @@ jobs:
  - name: Test default features
  run: cargo test
 
- # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
- # promises `cargo run -p template --example basic` works, and a compiled
- # example can still fail on its first line.
- - name: Run the bundled example
- run: cargo run -p template --example basic
-
- # `crates/template-bus` exists so a host can name the payload types
- # without compiling the module. That promise is invisible in a diff,
- # because a forbidden dependency arrives transitively through a feature
- # someone enabled one crate away — so it is asserted rather than
- # documented.
+ # This crate is the vocabulary both an agent harness and a host
+ # application link against, so its dependency list is a promise to both.
+ # That promise is invisible in a diff, because a forbidden dependency
+ # arrives transitively through a feature someone enabled one crate away —
+ # so it is asserted rather than documented.
  #
- # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+ # `tinyagents` is on the list for a structural reason, not a size one: it
+ # depends on *this* crate. An edge back would be a cycle, and the
+ # `context` module's erasure trait exists precisely to make one
+ # unnecessary. Everything else on the list is weight a tool author should
+ # not have to compile to write a tool.
+ #
+ # The FORWARD form is required. `cargo tree -i <crate> -p tinytools`
  # discards the `-p` scope, prints the whole-workspace inverse tree, and
  # exits 0 looking clean even when this crate is the one at fault.
- - name: Assert the contract crate stays transport-free
+ - name: Assert the vocabulary crate stays dependency-light
  run: |
  set -euo pipefail
- forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
- | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
+ # Compare crate NAMES only. `cargo tree` prints each package as
+ # `name vX.Y.Z (/path/to/checkout)`, and a consumer may vendor this
+ # repository *underneath* one of the forbidden crates — tinyagents
+ # does exactly that — so grepping the raw line matches the path and
+ # reports a dependency that is not there. Cut the version and path off
+ # first.
+ package_names="$(cargo tree -p tinytools --all-features -e normal,build --prefix none \
+ | awk '{print $1}' | sort -u)"
+
+ # An ALLOWLIST, not a blocklist: naming eight forbidden crates only
+ # catches those eight. Adding `surf`, `async-std`, an arbitrary
+ # `*-sys` native binding, or any other transport/runtime would pass
+ # silently under a blocklist. Every package this crate's forward tree
+ # is reviewed to actually contain is named here instead, so *any*
+ # newly introduced package — forbidden or merely unreviewed — fails
+ # the gate until this list is updated in the same commit.
+ allowed='
+ tinytools
+ anyhow
+ async-trait
+ serde
+ serde_core
+ serde_derive
+ serde_json
+ proc-macro2
+ quote
+ syn
+ unicode-ident
+ itoa
+ memchr
+ zmij
+ '
+
+ # Anything in package_names that is not a line of $allowed.
+ forbidden="$(comm -23 \
+ <(printf '%s\n' "$package_names") \
+ <(printf '%s\n' "$allowed" | sort -u))"
+
  if [ -n "$forbidden" ]; then
- echo "template-bus pulled in a dependency its manifest forbids:" >&2
+ echo "tinytools pulled in a dependency its manifest doesn't review for:" >&2
  echo "$forbidden" >&2
  echo >&2
- echo "The contract is what a host compiles against. It must stay free" >&2
- echo "of transports, async runtimes, HTTP clients and native libraries." >&2
+ echo "This crate is what a harness and a host both compile against." >&2
+ echo "It must stay free of agent harnesses, transports, async" >&2
+ echo "runtimes, HTTP clients and native libraries. If this package" >&2
+ echo "is a genuinely reviewed addition, add it to the allowlist in" >&2
+ echo "this step in the same commit that adds the dependency." >&2
  exit 1
  fi
 
@@ -100,7 +138,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - uses: dtolnay/rust-toolchain@stable
 
@@ -118,7 +155,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  # `rust-version` is inherited from `[workspace.package]`, so every member
  # reports the same value. Read it off the package the module ships as
@@ -128,7 +164,7 @@ jobs:
  run: |
  set -euo pipefail
  msrv="$(cargo metadata --format-version 1 --no-deps \
- | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+ | jq -r '.packages[] | select(.name == "tinytools") | .rust_version')"
  if [[ -z "$msrv" || "$msrv" == "null" ]]; then
  echo "workspace.package.rust-version is not set in Cargo.toml" >&2
  exit 1
@@ -151,7 +187,6 @@ jobs:
  - uses: actions/checkout@v7
  with:
  persist-credentials: false
- submodules: recursive
 
  - name: Check advisories, licenses, bans, and sources
  uses: EmbarkStudios/cargo-deny-action@v2