feat(memory): install tinymemory and source driver admission from it

.github/workflows/ci-lite.yml

@@ -959,10 +959,10 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Init tinycortex submodule
+      - name: Init tinycortex and tinymemory submodules
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git submodule update --init --recursive vendor/tinycortex
+          git submodule update --init --recursive vendor/tinycortex vendor/tinymemory
 
       - name: Cache TinyCortex build artifacts
         uses: Swatinem/rust-cache@v2

.github/workflows/release-production.yml

@@ -401,7 +401,7 @@ jobs:
       # fork the core image doesn't need. The Dockerfile COPYs vendor/ because
       # [patch.crates-io] resolves Rust SDK crates from vendor/.
       - name: Init vendored Rust submodules
-        run: git submodule update --init --recursive vendor/tinyagents vendor/tinyflows vendor/tinycortex vendor/tinyjuice vendor/tinychannels vendor/tinyplace vendor/tinyhumans-sdk
+        run: git submodule update --init --recursive vendor/tinyagents vendor/tinyflows vendor/tinycortex vendor/tinyjuice vendor/tinychannels vendor/tinyplace vendor/tinyhumans-sdk vendor/tinybus vendor/tinymemory
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Log in to GHCR

.github/workflows/release-staging.yml

@@ -297,7 +297,7 @@ jobs:
       # fork the core image doesn't need. The Dockerfile COPYs vendor/ because
       # [patch.crates-io] resolves Rust SDK crates from vendor/.
       - name: Init vendored Rust submodules
-        run: git submodule update --init --recursive vendor/tinyagents vendor/tinyflows vendor/tinycortex vendor/tinyjuice vendor/tinychannels vendor/tinyplace vendor/tinyhumans-sdk
+        run: git submodule update --init --recursive vendor/tinyagents vendor/tinyflows vendor/tinycortex vendor/tinyjuice vendor/tinychannels vendor/tinyplace vendor/tinyhumans-sdk vendor/tinybus vendor/tinymemory
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Build image (no push)

.github/workflows/test-reusable.yml

@@ -229,10 +229,10 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Init tinycortex submodule
+      - name: Init tinycortex and tinymemory submodules
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git submodule update --init --recursive vendor/tinycortex
+          git submodule update --init --recursive vendor/tinycortex vendor/tinymemory
 
       - name: Cache TinyCortex build artifacts
         uses: Swatinem/rust-cache@v2

.gitmodules

@@ -23,6 +23,10 @@
 	path = vendor/tinybus
 	url = https://github.com/tinyhumansai/tinybus.git
 	branch = main
+[submodule "vendor/tinymemory"]
+	path = vendor/tinymemory
+	url = https://github.com/tinyhumansai/tinymemory.git
+	branch = main
 [submodule "vendor/tinywallet"]
 	path = vendor/tinywallet
 	url = https://github.com/tinyhumansai/tinywallet

Cargo.toml

@@ -208,6 +208,29 @@ tinycortex = { version = "0.1", features = [
 # the embedded engine. No `[patch.crates-io]` entry is needed: cargo unifies
 # this with the `path = "api"` dependency the engine crate already declares.
 tinycortex-api = { path = "vendor/tinycortex/api" }
+
+# tinymemory — the engine-neutral memory layer
+# (https://github.com/tinyhumansai/tinymemory). Owns the parts of the memory
+# subsystem that are true for *any* engine: the driver-admission rules
+# (`tinymemory::registry`) and the three mandatory capability families composed
+# over the `Memory` storage trait (`tinymemory::mandatory`). TinyCortex stays
+# the engine; this is the layer a second engine would enter through.
+#
+# Vendored as a git submodule under `vendor/` beside the other tiny* crates and
+# consumed by path: the crate is not published to crates.io, so there is no
+# `[patch.crates-io]` entry for it, and for the same reason
+# `app/src-tauri/Cargo.toml` needs no `../../` twin — an unpublished path
+# dependency resolves transitively through this manifest.
+#
+# `tinymemory-tinycortex` is the seam between TinyCortex's contract types and
+# TinyMemory's. It names `tinycortex` by version requirement, so the
+# `[patch.crates-io]` entry below unifies it onto *this* checkout's engine
+# rather than the one pinned inside the tinymemory submodule.
+#
+# After cloning: `git submodule update --init --recursive vendor/tinymemory`.
+tinymemory = { path = "vendor/tinymemory" }
+tinymemory-api = { path = "vendor/tinymemory/api" }
+tinymemory-tinycortex = { path = "vendor/tinymemory/adapters/tinycortex" }
 tinychannels = { version = "0.1", features = ["relay-websocket"] }
 # tinybus — the message bus. Owns what `src/core/event_bus/` used to: the typed
 # pub/sub surface (`EventBus`, `EventHandler`, `SubscriptionHandle`), the

docs/specs/plan-memory.md

@@ -6,6 +6,50 @@
 
 ---
 
+## Amendment 2026-08-10 — the destination is `tinymemory`, not `vendor/tinycortex`
+
+This plan was written when TinyCortex was the only engine in view, so it named
+`vendor/tinycortex` as the destination for everything that moves. That is now split in two,
+because "engine-specific" and "engine-neutral" are different destinations:
+
+| Kind of code | Destination | Why |
+| --- | --- | --- |
+| TinyCortex's own storage, retrieval, tree, queue and sync internals (§6.2) | `vendor/tinycortex` — unchanged | It is the implementation of *one* engine. |
+| The contract, capability negotiation, driver admission, the conformance corpus, the shared mandatory families, and one adapter per engine | **`vendor/tinymemory`** (new submodule) | A second engine cannot be reached through a crate named after the first. |
+
+**What landed (2026-08-10).**
+
+- `tinymemory-api` — the contract, moved out of `tinycortex-api` byte-identical. §3.1's carve-out
+  still describes how it was *created*; it now lives one repository over.
+- `tinymemory::registry` — driver admission, lifted out of `memory/binding.rs`. §4's driver table
+  is where new ids get reserved.
+- `tinymemory::mandatory` — the three mandatory families composed once over the `Memory` storage
+  trait, so a new engine inherits the four easy-to-get-wrong parts (taint routing, all-namespace
+  list, scoped-recall refusal, import provenance) instead of re-deriving them.
+- `tinymemory-tinycortex` — the seam, with exhaustively-destructuring conversions.
+- `vendor/tinycortex` is pinned as a nested submodule of `tinymemory`. Adapters name their engine
+  by **version requirement**, so a host's own `[patch.crates-io]` unifies everything onto one
+  engine copy; a path dependency would give the host two engines with two incompatible `Memory`
+  traits.
+
+**Two contracts, converted at one seam — a deliberate deviation.** `tinycortex-api` was *not*
+turned into a re-export of `tinymemory-api`. The two therefore remain distinct Rust types that
+describe the same values, and `tinymemory-tinycortex` converts between them. The cost is real and
+should be stated: a value crossing the seam is rebuilt, and the two contracts can drift. The
+mitigation is that every conversion destructures exhaustively, so a field added on either side is
+a compile error naming the field rather than a silently dropped value.
+
+The consequence for this plan: **openhuman stays on `tinycortex-api`** as its contract. §6.7's grep
+invariant is unchanged. A future phase that unifies the two contracts would re-point the host's
+~200 `tinycortex_api::` references in one mechanical pass; until then, the seam is the boundary.
+
+**Sequencing unchanged.** M8a (the `source_scope` inversion) is still the hard gate before any
+`memory_tree/retrieval` file moves, and M8b's per-module moves still go to `vendor/tinycortex`.
+This amendment changes *where the engine-neutral layer lives*, not the order in which the engine
+moves.
+
+---
+
 ## 1. Goals
 
 1. **Memory becomes an API, not an implementation.** The kernel owns a versioned memory contract;