feat(memory): bind the memory engine as a loadable TinyBus module

src/core/runtime/context.rs

@@ -514,6 +514,13 @@ pub async fn init_stores(
         // vectors into the wrong embedding space or make a sync run look empty
         // instead of broken.
         crate::openhuman::memory::host_impls::install_memory_host_seams(Arc::new(cfg.clone()));
+        // Publish the config a module-backed memory driver should load
+        // against, before the binding below can construct one. Boot-only and
+        // idempotent (first call wins) — see `modules::memory::set_modules_policy`
+        // for why this must be a process-global rather than threaded through
+        // `MemoryBinding::for_workspace`.
+        #[cfg(feature = "modules")]
+        crate::openhuman::modules::memory::set_modules_policy(Arc::new(cfg.clone()));
         match crate::openhuman::memory::global::init(cfg.workspace_dir.clone()) {
             Ok(_) => log::info!(
                 "[boot] memory::global initialized (workspace={})",

src/core/subsystem/driver.rs

@@ -46,16 +46,39 @@ pub enum DriverClass {
     /// An out-of-process backend reached through a transport adapter over a
     /// documented wire contract.
     External,
+    /// A loadable native module: a `cdylib` admitted through tinybus's ABI,
+    /// manifest and digest gates and reached over the in-process module bus.
+    ///
+    /// Neither of the two classes above fits, and the difference is the policy
+    /// this class gates:
+    ///
+    /// - not [`Self::Embedded`], because the code is **not compiled into this
+    ///   binary**. It is downloaded, verified against a digest pinned in
+    ///   `modules::registry`, and `dlopen`ed. Whether it is present at all is a
+    ///   runtime fact, so a capability set derived from it can be empty on a
+    ///   platform no artifact is published for.
+    /// - not [`Self::External`], because there is **no egress and no process
+    ///   boundary**. It shares this address space, these privileges and this
+    ///   crash domain, so the trust checks that make sense for a remote backend
+    ///   (endpoint allowlisting, TLS, credential scoping) are neither applicable
+    ///   nor sufficient. What protects the host is admission, not isolation.
+    ///
+    /// Treating a module as `External` would apply egress policy to something
+    /// that makes no network calls while implying an isolation the loader does
+    /// not provide; treating it as `Embedded` would claim a compile-time
+    /// guarantee that a downloaded artifact does not have.
+    Module,
     /// A stub advertising zero capabilities — what a compiled-out or
     /// unconfigured subsystem binds to.
     Null,
 }
 
 impl DriverClass {
     /// Every class, in declaration order.
-    pub const ALL: [DriverClass; 3] = [
+    pub const ALL: [DriverClass; 4] = [
         DriverClass::Embedded,
         DriverClass::External,
+        DriverClass::Module,
         DriverClass::Null,
     ];
 
@@ -69,6 +92,7 @@ impl DriverClass {
         match self {
             Self::Embedded => "embedded",
             Self::External => "external",
+            Self::Module => "module",
             Self::Null => "null",
         }
     }

src/openhuman/memory/binding.rs

@@ -254,14 +254,15 @@ pub(crate) fn reserved_class(id: &str) -> Option<DriverClass> {
 
 /// The contract's driver class in the kernel's generic vocabulary.
 ///
-/// A total three-arm match, which is why both enums were shaped one-for-one.
+/// A total match, which is why both enums were shaped one-for-one.
 /// The kernel's own enum is deliberately not replaced by the contract's: it is
 /// shared with the subsystems that come after memory, which must not inherit
 /// their vocabulary from a *memory* crate.
 fn from_contract_class(class: ContractDriverClass) -> DriverClass {
     match class {
         ContractDriverClass::Embedded => DriverClass::Embedded,
         ContractDriverClass::External => DriverClass::External,
+        ContractDriverClass::Module => DriverClass::Module,
         ContractDriverClass::Null => DriverClass::Null,
     }
 }
@@ -307,18 +308,67 @@ pub fn admit(cfg: &MemorySubsystemConfig) -> Result<(String, DriverClass), Fallb
 fn build(workspace_dir: &Path, cfg: &MemorySubsystemConfig) -> MemoryBinding {
     match admit(cfg) {
         Ok((driver_id, class)) => {
-            let provider: Arc<dyn MemoryProvider> = match class {
+            // Both the provider *and* the class it should be reported under. The
+            // two can differ: a build without the `modules` feature admits the
+            // module class but can only bind a placeholder, and reporting the
+            // admitted class there would advertise a module-backed driver with a
+            // null behind it — a live surface with no store, which is exactly
+            // what status output exists to make visible.
+            let (provider, class): (Arc<dyn MemoryProvider>, DriverClass) = match class {
                 // Construction is deliberately sync and I/O-free: this runs on
                 // `CoreContext::memory_binding`, which ~4000 pre-boot tests
                 // call with no tokio runtime. The driver resolves its client on
                 // first use — see `driver::embedded`'s module docs.
-                DriverClass::Embedded => {
-                    Arc::new(EmbeddedMemoryProvider::new(workspace_dir, cfg.hooks))
-                }
-                DriverClass::Null => Arc::new(NullMemoryProvider::new()),
+                DriverClass::Embedded => (
+                    Arc::new(EmbeddedMemoryProvider::new(workspace_dir, cfg.hooks)),
+                    DriverClass::Embedded,
+                ),
+                DriverClass::Null => (Arc::new(NullMemoryProvider::new()), DriverClass::Null),
                 // Unreachable: `admit` refuses every external driver above, so
                 // this arm cannot bind a transport that does not exist yet.
-                DriverClass::External => Arc::new(NullMemoryProvider::new()),
+                // Reported as `Null`, for the same reason as the arm below: what
+                // bound is a placeholder, and status must say so.
+                DriverClass::External => (Arc::new(NullMemoryProvider::new()), DriverClass::Null),
+                // This function builds an `Arc<dyn tinycortex_api::provider::
+                // MemoryProvider>`, while `modules::memory::ModuleMemoryProvider`
+                // implements `tinymemory_api::provider::MemoryProvider`. Those are
+                // two different traits from two different crates.
+                // `TinyMemoryContractAdapter` is the bridge: it wraps the module
+                // provider and implements the tinycortex-side trait by converting
+                // each call across the seam (see its module docs for why most
+                // conversions destructure exhaustively while a few cross by serde
+                // round trip). It is a temporary bridge — it exists to be deleted
+                // once the binding itself migrates onto the tinymemory contract,
+                // at which point `ModuleMemoryProvider` binds directly here.
+                //
+                // Gated on the `modules` feature because the concrete provider
+                // type lives behind it (unlike the adapter above, which is
+                // generic and feature-independent). A build without `modules`
+                // cannot load the module driver at all, so it falls back to the
+                // same placeholder every other inadmissible driver gets, logged
+                // loudly rather than silently — kernel.md §3.7.
+                #[cfg(feature = "modules")]
+                DriverClass::Module => (
+                    Arc::new(
+                        crate::openhuman::memory::driver::module_adapter::TinyMemoryContractAdapter::new(
+                            Arc::new(
+                                crate::openhuman::modules::memory::ModuleMemoryProvider::from_boot_policy(),
+                            ),
+                        ),
+                    ),
+                    DriverClass::Module,
+                ),
+                #[cfg(not(feature = "modules"))]
+                DriverClass::Module => {
+                    log::warn!(
+                        "[memory:binding] workspace={} configured driver='{}' resolves to the \
+                         module class, but this build was compiled without the `modules` \
+                         feature; falling back to the null placeholder",
+                        workspace_dir.display(),
+                        driver_id,
+                    );
+                    (Arc::new(NullMemoryProvider::new()), DriverClass::Null)
+                }
             };
             // The configured trust state for the driver that actually bound.
             // Absent `[subsystems.memory.drivers.<id>]` entry ⇒ the fail-closed

src/openhuman/memory/binding_tests.rs

@@ -636,3 +636,37 @@ fn the_embedded_driver_never_disables_memory() {
     let binding = for_workspace(dir.path(), &MemorySubsystemConfig::default()).expect("binds");
     assert!(!binding.disables_memory());
 }
+
+// A build that admits the module class but cannot construct a module-backed
+// provider must not *report* the module class. `bind_provider` receives the
+// class that status, `modules.status` and the boot log all read, so passing the
+// admitted class while binding a placeholder advertises a live module-backed
+// surface with a null store behind it — the one failure this codebase's drift
+// guards exist to prevent, and the shape a reviewer caught here.
+
+#[cfg(not(feature = "modules"))]
+#[test]
+fn a_module_driver_reports_the_null_class_when_the_feature_is_off() {
+    let cfg = cfg_with_class("tinymemory", "module");
+    let binding = super::build(std::path::Path::new("/tmp/openhuman-binding-test"), &cfg);
+    assert_eq!(
+        binding.class(),
+        crate::core::subsystem::DriverClass::Null,
+        "a placeholder must not be reported as module-backed"
+    );
+}
+
+#[cfg(feature = "modules")]
+#[test]
+fn a_module_driver_reports_the_module_class_when_the_feature_is_on() {
+    // The other direction, so the arm above cannot be "fixed" by making every
+    // module binding report Null. Construction stays I/O-free, so this needs no
+    // runtime and loads nothing.
+    let cfg = cfg_with_class("tinymemory", "module");
+    let binding = super::build(std::path::Path::new("/tmp/openhuman-binding-test"), &cfg);
+    assert_eq!(
+        binding.class(),
+        crate::core::subsystem::DriverClass::Module,
+        "a real module binding must report the module class"
+    );
+}

src/openhuman/memory/driver/mod.rs

@@ -10,3 +10,4 @@
 //! would be meaningless.
 
 pub mod embedded;
+pub mod module_adapter;