chore(deps): drop dependencies no crate references

[senamakel]

Summary

Found by the cross-repo dependency audit in tinyhumansai/openhuman#6353 (pnpm dep:audit, tinyanalyzer-driven) and verified by grep against this tree at main. Manifest and lockfile only; no source changes.

• tinymemory-core: drop tinymemory-sync, tinycortex-api, futures, url and dev-dependency wiremock — nothing in the crate references any of them (the tinycortex-api manifest comment described a use that no longer exists; the Composio connect tests it mentions for wiremock are not in this crate).
• tinymemory-testing-ui: drop tinymemory and anyhow — the binary only uses tinymemory-api and the concrete engine crates; the word tinymemory appears only in log strings.
• tinymemory: drop log — no log:: call in the crate.

wiremock and tinycortex-api leave the build graph entirely (7 + 3 crates); the rest are manifest clean-ups because sibling crates still pull the same dependency.

Related issue

None.

API or behavior changes

None.

Validation

Commands actually run, with their outcome:

• cargo fmt --all -- --check — clean
• cargo clippy --all-targets --all-features -- -D warnings — fails on clippy::unwrap_used in crates/tinymemory-documents/src/convert/test.rs (lines 104–223), a file this PR does not touch; same result on main
• cargo check --workspace --all-targets --all-features — clean; cargo check -p tinymemory-testing-ui on its own also clean (it no longer relies on feature unification through tinymemory)
• cargo test --workspace --all-features — no failing suites

Tests

None added: dependency removal is verified by the build, not by a test.

Documentation

Not needed; no public surface changed. Two stale manifest comments were removed with the lines they described.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

Summary by CodeRabbit

• Chores
  • Streamlined internal package dependencies across core, testing, and memory components.
  • Removed unused development and diagnostic dependencies.
  • Preserved the remaining storage, API, engine, and filesystem-related capabilities.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: f12d7e3d94af
Updated: 1789835418 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This change removes dependencies that are no longer referenced by `tinymemory-core`; the cleanup looks safe to merge. _The code index for this repository is cold, so this review saw the diff alone._ _1 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The dependency cleanup removes unused direct and development dependencies from `tinymemory-core` without changing runtime permissions, network behavior, or authentication. The change looks safe to merge. _The code index for this repository is cold, so this review saw the diff alone._ _1 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This pull request removes dependencies from three crates that are no longer referenced in their source code, as verified by a successful build and test suite. No source changes accompany the manifest updates. The change is safe to merge. _The code index for this repository is cold, so this review saw the diff alone._ _1 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: flash, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.002383
• Tokens: 44066 input · 4817 output · 4840 cached · 0 embedding

Head	State	Pass summary
f12d7e3d94af	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 1789835418)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a994bb9d-5778-4c02-af2a-baa7387221e6

📥 Commits

Reviewing files that changed from the base of the PR and between 74f2a52 and f12d7e3.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• crates/tinymemory-core/Cargo.toml
• crates/tinymemory-testing-ui/Cargo.toml
• crates/tinymemory/Cargo.toml

💤 Files with no reviewable changes (2)

• crates/tinymemory/Cargo.toml
• crates/tinymemory-testing-ui/Cargo.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request removes unused dependencies from three Cargo manifests. It also removes comments that described the deleted dependencies or their associated tests and diagnostics.

Changes

Dependency pruning

Layer / File(s)	Summary
Cargo manifest cleanup crates/tinymemory-core/Cargo.toml, crates/tinymemory-testing-ui/Cargo.toml, crates/tinymemory/Cargo.toml	Removed unused dependencies from the three manifests. Related explanatory comments were also removed or shortened.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the main change: removing unused dependencies from crate manifests. It is concise and related to the pull request scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

_{A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T16:26:33.937484Z	f12d7e3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0024 · 44,066 in / 4,817 out · 4,840 cached (11%) · flash, gpt-5.6-luna, deepseek-v4-flash
critique:    $0.0011 · 15,377 in / 805 out   · 2,030 cached (13%) · gpt-5.6-luna
security:    $0.0009 · 14,803 in / 478 out   · 1,786 cached (12%) · gpt-5.6-luna
description: $0.0002 · 7,569 in  / 1,027 out · 1,024 cached (14%) · deepseek-v4-flash

[senamakel]

CI status check: pre-existing "Supply chain" failure, unrelated to this PR

The only failing check is Supply chain (cargo-deny check advisories), failing on:

error[vulnerability]: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
  RUSTSEC-2026-0285, rustls v0.23.43 (pulled in transitively via reqwest/hyper-rustls/tinycortex/tinyinference)
  Solution: Upgrade to >=0.23.45

warning[yanked]: detected yanked crate chacha20 v0.10.1 (via rand v0.10.2 -> tinycortex)

Verified this is pre-existing and unrelated to this PR's changes (which only remove unused deps from Cargo.toml/Cargo.lock, touching no rustls/chacha20/reqwest versions):

• Checked out origin/main (HEAD 74f2a52) in a clean worktree, ran cargo deny check advisories with the same deny.toml — it fails identically with the same RUSTSEC-2026-0285 advisory and the same chacha20 yanked warning.
• The advisory (RUSTSEC-2026-0285) affects rustls transitively through reqwest/hyper-rustls, which this PR does not touch or version-bump.

This is an external advisory-database change surfacing on both main and this branch, not something introduced by this PR. Fixing it (bumping rustls to >=0.23.45) is out of scope for a dependency-audit/removal PR and should be tracked separately.

Also re-verified cargo +1.98.0 clippy --all-targets --all-features -- -D warnings locally on this branch — it passes cleanly (no unwrap_used or other lint failures), so no clippy fix is needed here.

All other checks (Rust build/clippy/fmt, MSRV, module workspace, feature powerset, full test suites) are green.