feat(memory): bind the memory engine as a loadable TinyBus module

src/core/subsystem/driver.rs

@@ -46,16 +46,39 @@ pub enum DriverClass {
     /// An out-of-process backend reached through a transport adapter over a
     /// documented wire contract.
     External,
+    /// A loadable native module: a `cdylib` admitted through tinybus's ABI,
+    /// manifest and digest gates and reached over the in-process module bus.
+    ///
+    /// Neither of the two classes above fits, and the difference is the policy
+    /// this class gates:
+    ///
+    /// - not [`Self::Embedded`], because the code is **not compiled into this
+    ///   binary**. It is downloaded, verified against a digest pinned in
+    ///   `modules::registry`, and `dlopen`ed. Whether it is present at all is a
+    ///   runtime fact, so a capability set derived from it can be empty on a
+    ///   platform no artifact is published for.
+    /// - not [`Self::External`], because there is **no egress and no process
+    ///   boundary**. It shares this address space, these privileges and this
+    ///   crash domain, so the trust checks that make sense for a remote backend
+    ///   (endpoint allowlisting, TLS, credential scoping) are neither applicable
+    ///   nor sufficient. What protects the host is admission, not isolation.
+    ///
+    /// Treating a module as `External` would apply egress policy to something
+    /// that makes no network calls while implying an isolation the loader does
+    /// not provide; treating it as `Embedded` would claim a compile-time
+    /// guarantee that a downloaded artifact does not have.
+    Module,
     /// A stub advertising zero capabilities — what a compiled-out or
     /// unconfigured subsystem binds to.
     Null,
 }
 
 impl DriverClass {
     /// Every class, in declaration order.
-    pub const ALL: [DriverClass; 3] = [
+    pub const ALL: [DriverClass; 4] = [
         DriverClass::Embedded,
         DriverClass::External,
+        DriverClass::Module,
         DriverClass::Null,
     ];
 
@@ -69,6 +92,7 @@ impl DriverClass {
         match self {
             Self::Embedded => "embedded",
             Self::External => "external",
+            Self::Module => "module",
             Self::Null => "null",
         }
     }

src/openhuman/memory/binding.rs

@@ -254,14 +254,15 @@ pub(crate) fn reserved_class(id: &str) -> Option<DriverClass> {
 
 /// The contract's driver class in the kernel's generic vocabulary.
 ///
-/// A total three-arm match, which is why both enums were shaped one-for-one.
+/// A total match, which is why both enums were shaped one-for-one.
 /// The kernel's own enum is deliberately not replaced by the contract's: it is
 /// shared with the subsystems that come after memory, which must not inherit
 /// their vocabulary from a *memory* crate.
 fn from_contract_class(class: ContractDriverClass) -> DriverClass {
     match class {
         ContractDriverClass::Embedded => DriverClass::Embedded,
         ContractDriverClass::External => DriverClass::External,
+        ContractDriverClass::Module => DriverClass::Module,
         ContractDriverClass::Null => DriverClass::Null,
     }
 }
@@ -319,6 +320,35 @@ fn build(workspace_dir: &Path, cfg: &MemorySubsystemConfig) -> MemoryBinding {
                 // Unreachable: `admit` refuses every external driver above, so
                 // this arm cannot bind a transport that does not exist yet.
                 DriverClass::External => Arc::new(NullMemoryProvider::new()),
+                // Selectable in config now (`class = "module"` parses), but it
+                // cannot bind yet, and the reason is a contract mismatch rather
+                // than missing plumbing.
+                //
+                // This function builds an `Arc<dyn tinycortex_api::provider::
+                // MemoryProvider>`, while `modules::memory::ModuleMemoryProvider`
+                // implements `tinymemory_api::provider::MemoryProvider`. Those are
+                // two different traits from two different crates. OpenHuman's
+                // migration onto the tinymemory contract is partial — most of the
+                // tree still names `tinycortex_api` — so the module driver cannot
+                // be handed to this slot until the memory binding itself moves
+                // over.
+                //
+                // Implementing the tinycortex trait *as well* was considered and
+                // rejected: the module's wire types are the tinymemory ones, so a
+                // second impl would need a full type conversion layer at exactly
+                // the seam the one-method-per-method design exists to avoid, and
+                // it would have to be deleted again when the binding migrates.
+                //
+                // Everything else is ready: the provider, its 14 tests, the
+                // registry record, and the class itself. What remains is the
+                // binding's own contract migration, which is a separate change.
+                DriverClass::Module => Arc::new(
+                    crate::openhuman::memory::driver::module_adapter::TinyMemoryContractAdapter::new(
+                        Arc::new(
+                            crate::openhuman::modules::memory::ModuleMemoryProvider::from_boot_policy(),
+                        ),
+                    ),
+                ),
             };
             // The configured trust state for the driver that actually bound.
             // Absent `[subsystems.memory.drivers.<id>]` entry ⇒ the fail-closed

src/openhuman/memory/driver/mod.rs

@@ -10,3 +10,4 @@
 //! would be meaningless.
 
 pub mod embedded;
+pub mod module_adapter;