feat(memory): bind the memory engine as a loadable TinyBus module by senamakel · Pull Request #5512 · tinyhumansai/openhuman

senamakel · 2026-08-12T07:53:05Z

Summary

Binds the memory engine as a loadable native module — the third after
tinydocs and tinywallet — with TINYMEMORY registered against
tinymemory v0.3.0
and all eleven per-host digests copied verbatim from its checksum.toml.
Adds DriverClass::Module, a fourth variant beside Embedded / External /
Null. It is a host fact, never self-reported, and each variant gates
policy — so an in-process peer reached over a bus needed its own, rather than
being filed under a class whose redaction rules were written for something else.
Adds ModuleMemoryProvider, the host client, and
TinyMemoryContractAdapter, which bridges it into the TinyCortex-contract slot
memory::binding::build expects.
This sheds no dependencies. Measured on both the contributor and product
profiles with dep-sim.py: 0 third-party crates, 0 native builds. Stated plainly
here because dep-shed is the usual reason to do this and it is not the reason
this time.

Problem

Two distinct ones.

The architectural one. The memory engine is not kernel work, but a Cargo
feature cannot express that — a gate keeps the code out of a build while leaving
the dependency edge in the graph, so the boundary survives review and not
compilation. A module is a boundary that survives compilation.

rusqlite is why the dep count does not move: it has five parents in this host,
so removing one of them changes nothing. That was measured before the work, not
discovered after.

The measurable one. cargo build --timings puts the engine at ~14.7s of
serial critical path — tinyagents → tinycortex → tinymemory-core all
complete before the host crate starts. Full build 176s → ~161s, ≈8.4%. That is
the payoff, and it is a compile-time property rather than a binary-size one.

Solution

src/openhuman/modules/memory.rs — the client. Construction is synchronous
and I/O-free, which is load-bearing rather than stylistic: CoreContext::memory_binding
is sync and ~4000 pre-boot tests call it with no tokio runtime, so a constructor
that dialled the bus would panic across the suite instead of in one place.
capabilities() answers statically from Capabilities::mandatory() with a bus
cross-check available via verify() — overstating is the dangerous direction,
since the kernel filters its RPC surface and agent-tool list from that set, so an
extra family registers methods that answer errors.

memory/driver/module_adapter.rs — the contract bridge, and the one file here
written to be deleted. binding::build produces
Arc<dyn tinycortex_api::MemoryProvider>; the module implements
tinymemory_api::MemoryProvider. tinymemory-api was moved out of
tinycortex-api, so the two have identical trait shapes and this is one adapter
rather than a migration.

Its one arguable decision is written down in the module docs: ExportPage,
ImportOutcome, SourceScope and OwnedRecallOpts cross by serde round trip,
which tolerates drift where exhaustive destructuring would catch it. That trade
is acceptable only because the contracts are identical by construction, a test
fails if a value stops surviving the crossing, and the file has a scheduled death.
Taint and category deliberately do not — they use the audited destructuring
conversions in tinymemory_tinycortex::convert, because mapping taint wrongly
would let externally-sourced content be treated as internal-trust content, which
is the one thing the policy guard exists to prevent.

Error mapping is variant-preserving. tinymemory_api::wire is the name table
and both ends use it, so the host and the module cannot drift into disagreeing
about what a name means. One name per variant, not per outcome class: this host is
itself a MemoryProvider to callers above it, get's contract makes a miss
Ok(None) while Invalid is a real failure, and PathEscape must never arrive
as Invalid — that would reclassify a sandbox escape as a caller mistake. An
unrecognised name decodes to Other, never Invalid, so a module newer than this
build cannot send a caller into a rewrite loop over input that was already correct.

PENDING_RELEASE is now empty but kept. It is what lets the per-host asset
check stay strict: an accidentally asset-less record must fail, and it can only be
told apart from a deliberate pre-release one by a list like that.

Submission Checklist

Tests added or updated (happy path + at least one failure / edge case) — 21
added: 14 on the client (error-name mapping per variant, Debug never
rendering Config, a disabled host reporting Down rather than erroring)
and 7 on the adapter (round-trip field preservation, the two error collapses
that would be bugs, and one pinning that taint/category bypass serde).
Diff coverage ≥ 80% — the two new files are the bulk of the diff and
both ship dedicated suites; registry.rs's addition is a const table
covered by the existing integrity tests.
Coverage matrix updated — N/A: docs/TEST-COVERAGE-MATRIX.md tracks no
module rows today (neither tinydocs nor tinywallet appears), so there is
no row shape to follow. Adding one for all three modules is worth doing
separately rather than inventing a convention in this PR.
All affected feature IDs listed under ## Related — N/A, per above.
No new external network dependencies introduced — no new crate, and no test
here touches the network. The module download path is exercised by
OPENHUMAN_MODULE_PATH against a locally built artifact.
Manual smoke checklist updated — N/A: behaviour-preserving. The default
driver is unchanged; Module is only reachable by explicit config.
Linked issue closed via Closes #NNN — N/A, no tracking issue.

Impact

Runtime/platform. Desktop and CLI. Nothing changes unless a host explicitly
binds the module driver: DriverClass::Module is opt-in and the default stays
Embedded. Eleven hosts have artifacts (ubuntu 22.04/24.04, macOS 15/26, Windows
2022/2025/11, × arch); anything else resolves no candidate and reports
Unsupported rather than downloading something unverifiable.

Security. A loaded module is trusted in-process native code with this
process's privileges, and tinybus never unloads a library — replacing an
artifact needs a restart. The ABI, manifest and digest gates decide what is
admitted, not what is safe. Two specifics worth a reviewer's attention:

The pinned digests are the host's half of a two-sided check. tinybus refetches
the release's own checksum.toml, compares, hashes the download, and extracts
only after. Pinning here is the offline-auditable half, and it makes a release
re-cut under the same tag stop matching rather than silently replacing what runs
in-process. They were copied from the release, never computed locally — the
record's doc comment says so, because a locally computed digest pins whatever
one machine produced and defeats the point.
guard/policy.rs groups Module with Embedded | Null for outbound
redaction, not with External. The module is in this address space and receives
no less than the embedded driver would, so redacting as if it were remote would
be theatre.

Performance. ~8.4% off a full build (see above). No runtime regression
expected: calls cross an in-process bus rather than a network, and Recall
already round-trips to a host embedder either way.

Closes: N/A
Follow-up PR(s)/TODOs:
- Delete module_adapter.rs once memory::binding migrates to the TinyMemory
  contract; it exists only to bridge the two.
- Add module rows to docs/TEST-COVERAGE-MATRIX.md covering all three modules.
- Pre-existing, not from this PR: 56 failures in openhuman::memory::driver
  with no EmbeddingHost installed. Verified by disabling this adapter and
  getting the identical 56, with the pass count dropping by exactly the 7 tests
  added here. Deterministic, not a race.

AI Authored PR Metadata

Linear Issue

Key: N/A
URL: N/A

Commit & Branch

Branch: tinymemory-module
Commit SHA: a16ebd20dc13f185f6c13ab07392105106c0d21b

Validation Run

pnpm --filter openhuman-app format:check — N/A, no frontend changes
pnpm typecheck — N/A, no TypeScript changes
Focused tests: openhuman::modules 65 · memory::binding 28 ·
memory::guard 54 · memory::driver::module_adapter 7 ·
core::subsystem 39 · core::all::tests 92 — all pass
Rust fmt/check: cargo fmt --check clean; clippy --lib with the product
feature set, -D warnings, clean; check-feature-forwarding.mjs OK
Tauri fmt/check: N/A, app/src-tauri unchanged

Validation Blocked

Two failures in the full --lib run, both pre-existing and environmental, and
I checked rather than assumed — each lives in a directory this branch leaves
byte-identical to origin/main, and neither has any edge to the registry, the
modules family, or vendor/tinymemory:

command: cargo test --lib openhuman::agent::git_attribution
error: hook_adds_openhuman_trailer_without_disabling_repository_hook fails
on assertion. Still fails with GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null, so it is local git state in this checkout, not the
branch.
impact: none on this change.
command: cargo test --lib (full run)
error: agent::harness::session::runtime::run_single_publishes_completed_and_error_events
overflows its stack and aborts the harness in a debug build.
impact: none on this change; also unmodified here.

Behavior Changes

Intended behavior change: a memory driver may now be served by a loadable native
module.
User-visible effect: none by default. Reachable only by explicitly selecting the
module driver.

Parity Contract

Legacy behavior preserved: the default Embedded driver and its binding path
are untouched; DriverClass::ALL grew from 3 to 4 with the existing three
unchanged.
Guard/fallback/dispatch parity checks: Module is grouped with
Embedded | Null in both redact_outbound and redact_outbound_json, pinned by
the memory::guard suite (54). from_contract_class gained a Module arm,
pinned by memory::binding (28). core::all::tests (92) confirms the live
controller surface is unchanged.

Duplicate / Superseded PR Handling

Duplicate PR(s): none
Canonical PR: this one
Resolution: N/A

Summary by CodeRabbit

New Features
- Added support for a module-backed memory driver.
- Added TinyMemory integration for storage, retrieval, recall, health checks, import, and export.
- Registered TinyMemory with platform-specific releases.
Enhancements
- Module-backed memory preserves outbound text and JSON content without sanitization.
- Added capability checks, graceful error handling, and health reporting.
- TinyMemory loads only when selected by the configured memory subsystem.
Reliability
- Added validation and fallback handling for unavailable or incompatible memory modules.

Update the pinned commit for the tinymemory vendored dependency to incorporate upstream fixes or improvements. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Updated the tinymemory vendor dependency to incorporate upstream fixes and improvements. This change ensures compatibility with the latest version of the library. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Updated the tinymemory vendor dependency to incorporate upstream improvements and fixes. This change ensures compatibility with the latest version of the library. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Updated the pinned commit for the tinymemory vendored dependency to incorporate upstream fixes or improvements. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The driver now returns a clear error when the configuration file is not found, instead of panicking. This improves robustness by allowing the caller to handle the missing configuration case appropriately. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

When a memory block is empty, the guard policy now correctly returns a default allow decision instead of failing to evaluate. This fixes a regression where empty blocks were incorrectly treated as policy violations, ensuring that the guard consistently permits operations on uninitialized memory regions. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Removed an unused import statement from the policy module to clean up the code and eliminate a compiler warning. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

When the memory list is empty, the retrieval function now returns an empty result instead of panicking or producing an error. This ensures graceful handling of edge cases where no memories have been stored yet. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

When a module is registered with a name that already exists in the registry, the system now returns an error instead of silently overwriting the previous entry. This prevents accidental data loss and makes the registration behavior predictable for callers. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The memory module is now publicly available through the module registry, enabling access to memory-related functionality within the system. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

When a memory binding is not found, the code now returns an appropriate error instead of panicking, ensuring the system remains stable and provides clear feedback to the caller. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The test for memory allocation was asserting the wrong return value, causing it to pass even when the underlying function returned an error. The assertion now checks for the correct success condition, ensuring the test properly validates the allocation behavior. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Fixed the test assertion in the memory retrieval test to properly verify the expected output, ensuring the test accurately reflects the intended behavior of the memory module. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

When a module is registered with a name that already exists in the registry, the system now returns an error instead of silently overwriting the existing entry. This prevents accidental loss of module references and makes the registration behavior predictable for callers. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Reformatted several lines in the memory module and its tests to comply with the project's line length conventions, wrapping expressions that exceeded the limit. No functional changes were made. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Update the pinned commit for the tinymemory vendored dependency to incorporate upstream changes. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The `from_contract_class` function was missing a match arm for the `Module` variant, which caused a compilation error when the contract's driver class enum was extended. The new arm maps `ContractDriverClass::Module` to `DriverClass::Module`, completing the total match and aligning the conversion with the kernel's generic vocabulary. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Introduce a process-global `MODULES_POLICY` that stores the configuration needed to load the `tinymemory` module, published once during boot via `set_modules_policy`. This avoids threading the full `Config` through `memory::binding::build`, which has no access to it, while keeping the existing `ModuleMemoryProvider::new` constructor for callers that do have a config. A new `from_boot_policy` constructor lets the binding site fall back to the published policy, and the provider now returns an error if neither a direct config nor a boot policy is available, preventing silent defaults that could ignore an operator's settings. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Replace the null fallback for the `Module` driver class with a real `ModuleMemoryProvider` constructed from boot policy. Previously the arm was unreachable because `tinymemory` lacked a `module` variant in `DriverClass`, and the function lacked access to the `[modules]` config block. Both prerequisites are now met, so the driver can be instantiated instead of silently returning a null provider. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

…smatch The module-backed memory driver is replaced with a null provider because the module's `ModuleMemoryProvider` implements a different memory provider trait than what the binding expects. The module driver implements `tinymemory_api::provider::MemoryProvider` while the binding requires `tinycortex_api::provider::MemoryProvider`, and implementing both traits was rejected due to the required type conversion layer that would need to be removed during the planned contract migration. The module driver, its tests, registry record, and configuration parsing are all complete, but the binding cannot use it until it migrates to the tinymemory contract. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The memory driver's module adapter now gracefully handles the case where the vendor module is not present, preventing a panic when attempting to access memory operations. This change adds a check for the vendor module's existence before proceeding with memory management tasks. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

…le driver Replace the null memory provider used for the Module driver class with a TinyMemoryContractAdapter wrapping a ModuleMemoryProvider instantiated from the boot policy. This completes the integration of the module-based memory provider so that the Module driver class now provides real memory functionality instead of a no-op placeholder. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The `pub mod module_adapter;` declaration was accidentally moved below the module-level doc comment, which broke the module's visibility. This change restores it to its original position before the doc comment, ensuring the module is correctly declared and accessible. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Changed the test assertion to expect the correct memory content when retrieving a memory by ID, fixing a false positive where the test passed despite returning incorrect data. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The round-trip test was using a string literal for the memory category instead of the typed constant from the API, which could cause the test to pass with mismatched types. Changed the category field to use the proper `MemoryCategory::Core` constant to ensure type consistency and make the test more robust. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The `embedded` module is now declared before `module_adapter` to reflect that the adapter depends on the embedded implementation. This change ensures the module declaration order mirrors the actual dependency direction, making the codebase easier to navigate. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The module adapter and its associated `ModuleMemoryProvider` are temporarily disabled by substituting a `NullMemoryProvider` for the `DriverClass::Module` variant. The `module_adapter` module declaration is commented out to prevent compilation of the unused code while the adapter is reworked. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The Module driver class now uses the TinyMemoryContractAdapter wrapping a ModuleMemoryProvider instead of a NullMemoryProvider, enabling the module-based memory subsystem to function with its actual backing provider rather than a no-op placeholder. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Update the pinned commit for the tinymemory vendored dependency to incorporate upstream changes. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Return an error instead of panicking when the boot module is not found during initialization, ensuring the system can report the issue clearly rather than crashing unexpectedly. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

When the boot module is not present in the system, the boot process now logs a warning and continues instead of failing with an error. This change improves robustness in environments where the boot module is optional or not yet configured. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

When the boot module is not present in the system, the boot process now logs a warning and continues instead of failing with an error. This change improves robustness in environments where the boot module is optional or not yet installed. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Updated the Cargo.lock file to reflect changes in the project's dependencies, including the addition of new crates such as bitcoin, pdf-extract, and docx-rs, as well as version bumps for existing dependencies like uuid and windows-sys. This ensures the lockfile stays in sync with the updated Cargo.toml files across the workspace. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The function `should_eager_load` was referencing `registry::ModuleRecord` which no longer exists at that path, causing a compilation error. The type has been moved to `super::types::ModuleRecord`, and this change updates the import to match the current module structure. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

tinysweeper

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.1050 · 114,623 in / 29,003 out · 81,507 cached (71%) · z-ai/glm-5.2
critique:    $0.0484 · 38,052 in  / 15,811 out · 28,875 cached (76%) · z-ai/glm-5.2
security:    $0.0266 · 34,533 in  / 5,828 out  · 21,597 cached (63%) · z-ai/glm-5.2
tests:       $0.0172 · 19,652 in  / 4,783 out  · 14,620 cached (74%) · z-ai/glm-5.2
description: $0.0129 · 22,386 in  / 2,581 out  · 16,415 cached (73%) · z-ai/glm-5.2

tinysweeper · 2026-08-12T08:47:45Z

What this change touches

14 files, +1427 -12 across 6 components. The code graph knows nothing about these files yet — normal for newly added files, and a cold index otherwise.

flowchart LR
  n0["src/openhuman/modules<br/>5 files +779 -2"]:::changed
  n1["src/openhuman/memory/driver<br/>3 files +475 -0"]:::changed
  n2["src/openhuman/memory<br/>2 files +91 -7"]:::changed
  n3["src/openhuman/memory/guard<br/>2 files +50 -2"]:::changed
  n4["src/core/subsystem<br/>1 file +25 -1"]:::changed
  n5["src/core/runtime<br/>1 file +7 -0"]:::changed
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

_{Green: changed. Grey: untouched, reached through an import or a call. Orange: has findings. Red: has a finding that blocks the merge.}

Component		Files	Lines	Findings
`src/openhuman/modules`	changed	5	+779 -2	—
`src/openhuman/memory/driver`	changed	3	+475 -0	—
`src/openhuman/memory`	changed	2	+91 -7	—
`src/openhuman/memory/guard`	changed	2	+50 -2	—
`src/core/subsystem`	changed	1	+25 -1	—
`src/core/runtime`	changed	1	+7 -0	—

Changed files

src/openhuman/modules

src/openhuman/modules/boot.rs
src/openhuman/modules/memory.rs
src/openhuman/modules/memory_tests.rs
src/openhuman/modules/mod.rs
src/openhuman/modules/registry.rs

src/openhuman/memory/driver

src/openhuman/memory/driver/mod.rs
src/openhuman/memory/driver/module_adapter.rs
src/openhuman/memory/driver/module_adapter_tests.rs

src/openhuman/memory

src/openhuman/memory/binding.rs
src/openhuman/memory/binding_tests.rs

src/openhuman/memory/guard

src/openhuman/memory/guard/policy.rs
src/openhuman/memory/guard/policy_tests.rs

src/core/subsystem

src/core/subsystem/driver.rs

src/core/runtime

src/core/runtime/context.rs

Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Fixed a test assertion in the module adapter tests where the expected value was incorrectly set, causing the test to fail when verifying memory retrieval behavior. The correction ensures the test accurately validates the intended functionality. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

…ata races The module adapter test file now includes a synchronization fix that prevents concurrent access to shared memory structures across threads. This change applies the correction documented in AR-004 to ensure thread-safe operations during module interactions. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The test assertion was inverted, causing the test to pass when the policy should have been rejected and fail when it should have been accepted. This fix ensures the test correctly validates that an invalid policy is rejected. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Reformatted the multi-field assertion in the export record test to use a multi-line expression, improving code readability without changing any behavior. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/openhuman/memory/binding.rs`:
- Around line 349-358: Update the non-modules `DriverClass::Module` branch in
the driver binding flow to use the same fallback metadata as admission failures:
bind `NULL_DRIVER_ID`, set the class to `DriverClass::Null`, and record the
appropriate `FallbackReason` while retaining `NullMemoryProvider`. Ensure boot
status and callers no longer see the configured module driver as successfully
admitted.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f018712d-5467-4fe4-99b8-0ad1dcce87df

📥 Commits

Reviewing files that changed from the base of the PR and between a16ebd2 and 3285ae7.

⛔ Files ignored due to path filters (1)

app/src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

src/core/runtime/context.rs
src/openhuman/memory/binding.rs
src/openhuman/memory/driver/module_adapter_tests.rs
src/openhuman/memory/guard/policy_tests.rs
src/openhuman/modules/boot.rs
src/openhuman/modules/memory.rs

🚧 Files skipped from review as they are similar to previous changes (1)

src/openhuman/modules/memory.rs

Updated the Cargo.lock file to reflect changes in the project's dependencies, including the addition of new crates such as bitcoin, pdf-extract, and docx-rs, as well as version bumps for existing dependencies like uuid and windows-sys. This ensures the lockfile stays in sync with the updated Cargo.toml after recent feature additions. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The `build` function now returns a tuple of the provider and the class it should be reported under, rather than only the provider. This allows the reported class to differ from the admitted class when a placeholder provider is bound, ensuring status output correctly shows a null-backed driver instead of advertising a module-backed driver with no store behind it. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add two tests that verify the module driver reports the correct driver class depending on whether the modules feature is enabled. When the feature is off, a placeholder binding must report the Null class to prevent advertising a live module-backed surface with a null store behind it. When the feature is on, a real module binding must report the Module class. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

This change updates the Cargo.lock file to match the current dependency tree after removing unused crates such as bitcoin, ethers, pdf-extract, and ppt-rs, while adding new dependencies like ureq, k256, and flate2 for the tinybus crate. Several version specifiers are also simplified by removing explicit version numbers where only one version remains. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

Updated the Cargo.lock file to reflect changes in the project's dependencies, including the addition of new crates such as bitcoin, pdf-extract, docx-rs, and ppt-rs, as well as version updates for existing dependencies like uuid and derive_more. This lockfile update ensures reproducible builds after modifying the workspace's Cargo.toml files. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

The lockfile has been updated to remove unused dependencies such as bitcoin, ethers, pdf-extract, and ppt-rs, and to add new dependencies including ureq, flate2, and zip 2.4.2. Several crate versions have also been bumped, and some dependencies have been simplified by removing explicit version suffixes. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

senamakel · 2026-08-12T10:14:29Z

CI status, with the pre-existing failures separated from anything this PR caused — main is currently red on the same lanes, so this needs stating rather than leaving for a reviewer to untangle.

`Rust Quality (fmt, clippy)` — was red, this PR fixes it

main @ 2ad464b3e fails this lane already:

error: cannot update the lock file /__w/openhuman/openhuman/app/src-tauri/Cargo.lock
       because --locked was passed to prevent this

scripts/check-linux-tls-dependencies.sh runs cargo tree --locked over both Cargo worlds, and the shell's lockfile was stale — it still listed the documents codec cohort (docx-rs, zip 0.6, zstd, bzip2, the CFF/CMap parsers) and the web3 crypto cohort (bitcoin, ethabi, const-hex, …), which left the graph when those moved to tinydocs / tinywallet modules and nobody refreshed the lockfile afterwards.

Refreshing it is unavoidable here anyway, because the vendor/tinymemory bump moves the root crate 0.1.0 → 0.3.0. The result is 1001 → 925 packages, and the drop is pruning, not a narrowed feature resolution — worth saying because a 76-crate shrink in the desktop shell's lockfile is exactly what a wrong-feature-set regeneration looks like, and I checked before trusting it:

cargo tree --locked --manifest-path app/src-tauri/Cargo.toml — fails on the old lockfile, passes on the new one
bash scripts/check-linux-tls-dependencies.sh — passes
cargo check --locked --manifest-path app/src-tauri/Cargo.toml — the shell compiles

The 18 product gates are hard-coded on the openhuman_core dependency in app/src-tauri/Cargo.toml rather than sitting behind shell features, so a featureless cargo tree there already resolves the full product graph. There is no narrower resolution for it to have fallen into.

This lane now passes.

`Rust Feature-Gate Smoke (gates off)` — pre-existing, not from this PR

Two failures, both in a module this branch leaves byte-identical to origin/main:

openhuman::config::migration_helpers::ops::tests::migrate_hermes_apply_imports_markdown_entries
openhuman::config::migration_helpers::ops::tests::migrate_openclaw_apply_imports_markdown_entries_into_target_workspace

panicked: no EmbeddingHost installed — the host must call
memory::embedding_host::set_embedding_host during startup wiring,
before any memory work begins

Three independent checks that this is not mine:

git diff origin/main..HEAD -- src/openhuman/config/ is empty.
Reproduced on this branch with cargo test --lib --no-default-features openhuman::config::migration_helpers::ops — and the same seam is missing in the 56 openhuman::memory::driver failures noted in the PR description, which I confirmed earlier by disabling this PR's adapter and getting the identical 56.
main fails this lane with the same message. Run 31532967305 @ 2ad464b3e, the base of this branch.

I have deliberately not fixed it. It is an unrelated startup-wiring gap in the disabled-feature build, it predates this branch, and folding a fix for it into a module-binding PR would put an unreviewable second change under this one. Happy to open it separately.

Worth noting why it survived this long: the feature-gate smoke lane runs cargo check for most gates and never compiles test code, so a disabled-build test break is invisible to it — the same trap CLAUDE.md documents for gated surfaces.

The rest

All other required lanes pass, including Feature Forwarding Gate, Coverage Matrix Sync, PR Submission Checklist, Orchestration IP Gate and Markdown Link Check. PR CI Gate aggregates the above, so it clears with the gates-off lane and not before.

Local verification on this commit, product feature set unless stated:

Check	Result
`cargo fmt --all -- --check`	clean
`clippy --lib` `-D warnings`	clean
`cargo check --lib --no-default-features`	clean
`check-feature-forwarding.mjs`	OK
`openhuman::modules`	68 pass
`openhuman::memory::binding`	29 pass
`openhuman::memory::guard`	56 pass
`memory::driver::module_adapter`	10 pass
`core::subsystem` / `core::all::tests`	39 / 92 pass

tinysweeper

The previously-blocking findings are resolved. Clearing the changes request.

             $0.1222 · 102,012 in / 36,629 out · 63,954 cached (63%) · z-ai/glm-5.2, deepseek/deepseek-v4-pro
critique:    $0.0541 · 26,070 in  / 17,319 out · 7,136 cached (27%)  · z-ai/glm-5.2, deepseek/deepseek-v4-pro
security:    $0.0273 · 24,790 in  / 8,591 out  · 19,051 cached (77%) · z-ai/glm-5.2
tests:       $0.0191 · 24,216 in  / 4,983 out  · 17,750 cached (73%) · z-ai/glm-5.2
description: $0.0216 · 26,936 in  / 5,736 out  · 20,017 cached (74%) · z-ai/glm-5.2

senamakel and others added 30 commits August 11, 2026 23:48

chore(deps): update tinymemory subproject commit

cef4ce7

Update the pinned commit for the tinymemory vendored dependency to incorporate upstream fixes or improvements. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

chore(deps): update tinymemory subproject commit

02d2706

Updated the pinned commit for the tinymemory vendored dependency to incorporate upstream fixes or improvements. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

fix(guard): remove unused import in policy.rs

80559a3

Removed an unused import statement from the policy module to clean up the code and eliminate a compiler warning. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

feat(modules): add memory module

9fab741

The memory module is now publicly available through the module registry, enabling access to memory-related functionality within the system. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

chore(deps): update tinymemory subproject commit

2e755f7

Update the pinned commit for the tinymemory vendored dependency to incorporate upstream changes. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

chore(deps): update tinymemory subproject commit

72eabd8

Update the pinned commit for the tinymemory vendored dependency to incorporate upstream changes. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

senamakel and others added 5 commits August 12, 2026 11:11

tinysweeper Bot suggested changes Aug 12, 2026

View reviewed changes

Comment thread src/openhuman/memory/driver/module_adapter_tests.rs

Comment thread src/openhuman/memory/driver/module_adapter.rs

Comment thread src/openhuman/memory/guard/policy.rs

tinysweeper Bot added the priority: p1 Next. Wrong behaviour a user will hit, or a security weakness behind a condition. label Aug 12, 2026

senamakel and others added 3 commits August 12, 2026 11:48

chore: files changed app/src-tauri/Cargo.lock

a2d6d53

Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>

YellowSnnowmann mentioned this pull request Aug 12, 2026

fix(approval): route WebChat approval parks via origin fallback #5514

Merged

7 tasks

senamakel and others added 2 commits August 12, 2026 11:55

coderabbitai Bot requested changes Aug 12, 2026

View reviewed changes

Comment thread src/openhuman/memory/binding.rs Outdated

senamakel and others added 3 commits August 12, 2026 12:10

coderabbitai Bot previously approved these changes Aug 12, 2026

View reviewed changes

senamakel and others added 3 commits August 12, 2026 12:44

senamakel dismissed coderabbitai[bot]’s stale review via 90ff667 August 12, 2026 09:48

coderabbitai Bot approved these changes Aug 12, 2026

View reviewed changes

tinysweeper Bot approved these changes Aug 12, 2026

View reviewed changes

tinysweeper Bot added priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect. and removed priority: p1 Next. Wrong behaviour a user will hit, or a security weakness behind a condition. labels Aug 12, 2026

senamakel merged commit 2826259 into tinyhumansai:main Aug 12, 2026
25 of 32 checks passed

github-actions Bot mentioned this pull request Aug 13, 2026

🦞 OpenClaw 生态日报 2026-08-13 96loveslife/big_model_radar#318

Open

Navigation Menu

Uh oh!

feat(memory): bind the memory engine as a loadable TinyBus module - #5512

feat(memory): bind the memory engine as a loadable TinyBus module#5512
senamakel merged 60 commits into
tinyhumansai:mainfrom
senamakel:tinymemory-module

senamakel commented Aug 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

tinysweeper Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tinysweeper Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

senamakel commented Aug 12, 2026

Uh oh!

tinysweeper Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

senamakel commented Aug 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Solution

Submission Checklist

Impact

Related

AI Authored PR Metadata

Linear Issue

Commit & Branch

Validation Run

Validation Blocked

Behavior Changes

Parity Contract

Duplicate / Superseded PR Handling

Summary by CodeRabbit

Uh oh!

tinysweeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tinysweeper Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this change touches

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

senamakel commented Aug 12, 2026

Rust Quality (fmt, clippy) — was red, this PR fixes it

Rust Feature-Gate Smoke (gates off) — pre-existing, not from this PR

The rest

Uh oh!

tinysweeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

senamakel commented Aug 12, 2026 •

edited by coderabbitai Bot

Loading

tinysweeper Bot commented Aug 12, 2026 •

edited

Loading

`Rust Quality (fmt, clippy)` — was red, this PR fixes it

`Rust Feature-Gate Smoke (gates off)` — pre-existing, not from this PR