Delete the memory engine from OpenHuman's test build and move its tests upstream

[YellowSnnowmann]

Summary

Delete tinycortex and tinymemory-core from OpenHuman entirely — the [dev-dependencies] entries, the
memory-engine-seams feature, memory/host_impls.rs, and the rss-bench bins.

The product build is already engine-free. #5560 finished that on 2026-08-31, verified rather than assumed:

$ PF=$(bash scripts/ci/product-features.sh)
$ cargo tree -e normal --no-default-features --features "$PF" -i tinycortex
warning: nothing to print.
$ cargo tree -e normal --no-default-features --features "$PF" -i tinymemory-core
warning: nothing to print.

So this is not a binary-size or dependency shed. What still compiles 133k lines of engine is the test suite.
This is a test-surface shed.

Shape: two PRs and a submodule bump. One upstream (tinyhumansai/tinymemory#147), then one here. No
tinymemory release and no modules/registry.rs re-pin — see "Why no release is needed".

Problem / Context

Three doors still let the engine in, all of them test or bench

Door	Declared as	Serves
[dev-dependencies]	tinycortex, tinymemory-core (test-support), tinymemory-tinycortex	lib #[cfg(test)] + tests/*.rs
memory-engine-seams	default-ON, product-OFF → dep:tinymemory-core	29 tests/*.rs calling install_memory_host_seams
rss-bench	optional deps for the two library_profile bins	in-process RSS / cold-phase measurement

No file in src/openhuman/ names tinycortex:: in production code. grep -rln "tinycortex::" src/openhuman/
returns 48 files, but 36 mention it only in doc comments and all 12 code-referencing files are *_tests.rs
or test_support.

Most of these tests are duplicates

tests/raw_coverage/memory_raw_coverage_e2e.rs imports
tinycortex::memory::ingest::canonicalize::{chat,document,email},
tinymemory_core::store::chunks::store::upsert_chunks, tree::summarise::fallback_summary and
sources::status::source_status. Every one of those modules already ships its own *_tests.rs sibling
upstream.

Test home	#[test] fns
vendor/tinycortex/src	1,575
crates/tinymemory-core/src	740
crates/tinymemory-{sources,sync,api,tinycortex,module,}	~480
openhuman (engine-linked)	315

The one rule that decides every test's fate

A test that names the engine is one of two things, and the difference is not visible from the file it sits in:

Does the assertion depend on what the driver returns, or on what OpenHuman does to what the driver
returns?

First → delete. It is an engine test in the wrong repo, and upstream owns it.
Second → repoint onto the fake driver. It is an OpenHuman test that only needed a driver to answer.

Both live in the same file. read_rpc_tests_part_01_tests.rs names zero engine types and holds both:

Test	Asserts	Fate
list_chunks_filters_by_source_id	the engine filters correctly	delete — store/chunks/store_tests.rs owns it
list_chunks_filters_by_entity_id_and_time_window	the engine filters correctly	delete
list_chunks_normalizes_invalid_tags_negative_tokens_and_empty_content	OpenHuman's normalization	repoint
list_sources_formats_email_threads_with_trimmed_user_hint	OpenHuman's formatting	repoint

The trace makes it decidable: list_chunks_rpc → list_chunks_page → chunk_query_from_filter →
provider().as_chunks(). OpenHuman owns limit/offset defaulting, the filter→query translation, the
"filter matches nothing, skip the query" short-circuit and the response shaping. The driver owns the filtering.

Repointing an engine-semantics test is worse than deleting it — it then asserts the fake driver's
filtering, which is code written to make the test pass. When in doubt, delete: the burden of proof is on
keeping a test, not on removing one.

Why no release is needed

The release-plus-re-pin gate exists for the module cdylib's wire surface. Nothing here touches it. What the
host needs from upstream is one source crate: tinymemory-conformance is publish = false and is taken by
path exactly like tinymemory-api, so a chore(vendor) submodule bump is the whole mechanism. It costs
zero new packages — its dependencies are tinymemory-api, async-trait, serde_json and anyhow, all
already in the product graph.

Expect a compile-time win, not a dependency win

Of tinycortex's ~170 transitive packages, all but five are already in the product graph for other reasons.
Deleting the engine removes exactly tinycortex, tinycortex-api, tinymemory-core, tinymemory-sync,
tinymemory-tinycortex and nothing beneath them — the same ≈ −1 package result the TinyMemory port, the
tinymcp extraction and the channels gate all landed at.

What it buys: 133k LOC off the test critical path (the module manifest measures those two crates at
14.7 s of the host build) and 25.7k LOC of memory test code that stops being OpenHuman's to maintain.

Scope

PR 1 — upstream (tinyhumansai/tinymemory#147)

A fake driver in crates/tinymemory-conformance — which this repository has already written, twice, and
which moves there rather than being authored:

File here	LOC	What it is
memory/guard/test_support_part_01.rs + _part_02.rs	1,493	RecordingProvider — all 27 families, records calls, answers empty
memory/guard/in_memory.rs	374	InMemoryProvider — mandatory three, with real storage

Both name zero engine types across 1,922 lines, and their crate:: references are almost entirely crate::openhuman::memory::api::* — a documented pub use of
tinymemory-api, so a mechanical rewrite. Exactly 3 references name a type that is genuinely this repo's
(DriverClass). Upstream's tinymemory-conformance::InMemoryProvider is the same idea implemented a third
time; PR 1 consolidates them. (in_memory.rs is deliberately not #[cfg(test)]; RecordingProvider is,
which today confines it to lib tests — moving it upstream lifts that.)

Plus only the engine assertions that provably have no upstream twin. Default posture is delete, not move: a test moves upstream only when the diff shows the
module it covers has no equivalent there. tree::summarise's fallback_summary is the one confirmed case.

Then a chore(vendor) submodule bump here.

PR 2 — this repo, three commits

Commit 1 — repoint, engine still linked. Rewrite memory/test_support/mod.rs to construct the conformance
driver instead of TinycortexProvider; the 59 install_tinycortex_for_test call sites across 18 files need no
edit. What does need editing: the four engine-backed test_support modules under memory/ops/,
memory/tree/retrieval/, memory/tree/tree_runtime/ and memory/tool_memory/, which reach
tinymemory_core::store and tree_runtime::engine directly to seed rows; and the
install_memory_host_seams() calls in the 29 tests/*.rs targets, which have nothing to install once there is
no in-process engine.

The engine is still a dev-dependency at this commit, and that is the point: both drivers are constructible
in the same build, so the suite can be run against each and compared. That comparison is the only real defence
against the fake driver quietly diverging, and it is impossible after commit 3. There is precedent for its
shape upstream — module_e2e.rs::the_module_matches_the_in_process_engine_for_the_same_input does the same
across the bus boundary.

Commit 2 — delete. Every test whose assertion depends on what the driver returns.
tests/coding_sessions_feature.rs and tests/raw_coverage/memory_tree_embed_round25_raw_coverage_e2e.rs name
no OpenHuman type at all and go whole; the rest are per-test decisions inside the mixed files, by the rule
above.

Commit 3 — cut the manifest. Atomic, because the dev-dependency drop cannot compile while a consumer
survives. Drop the three [dev-dependencies]; delete memory-engine-seams, memory/host_impls.rs and its
INTENTIONALLY_NOT_FORWARDED entry; delete rss-bench, rss-bench-dhat, src/bin/rss_bench.rs and
src/bin/library_profile/; delete memory/direct_engine_refs_tests.rs, whose ratchet has nothing left to
count.

Also in this commit: delete the 1,922 lines of fakes that moved upstream in PR 1 —
memory/guard/test_support_part_01.rs, _part_02.rs and memory/guard/in_memory.rs — and take
tinymemory-conformance as a dev-dependency in their place. It costs zero new packages: its dependencies are
tinymemory-api, async-trait, serde_json and anyhow, all already in the product graph. The guard tests
that drive those fakes stay here and import them from the crate.

A fourth commit, separately: remove the [patch.crates-io] entries. tinycortex and tinycortex-api are
unpublished and the crates.io tinycortex is a stale 0.1.1 without the engine features, so any surviving crate
naming either by version requirement fails resolution — no matching package named tinycortex-api found —
before anything compiles. Confirm resolution after commit 3, then drop the patches.

Not in scope

• The host layer stays. src/openhuman/memory/ is 67k LOC and its README states the split. guard/,
  binding.rs + driver/, schemas/ + read_rpc/ + ops/, tools/ + query/ + agent/ and
  source_scope.rs all stay, and keep the tests that assert their behaviour — on the fake driver.
• tinymemory-api, tinymemory-bus, tinymemory-sources stay. In the product graph; the contract, not
  the engine.
• The MemorySourceSync bus leg. The module's sync methods are asserted routed by
  every_declared_method_is_actually_routed and never driven. That is a real gap, but it is coverage that
  has never existed anywhere rather than coverage being migrated, so it is its own issue and not on this path.
• The facade collapse in Move the remaining memory engine internals and collapse the facade directories #5385. Its Metric 1 closes as a side effect of PR 2 commit 1.

library_profile

src/bin/library_profile/ is the only in-process engine RSS/cold-phase profile that exists. Commit 3 deletes
it. If it is worth keeping, it moves to tinymemory in PR 1, where a bin may depend on the engine freely —
otherwise it goes. One decision, not a blocker.

Acceptance criteria

• Engine gone from every graph — cargo tree -e normal,dev --features "$(bash scripts/ci/product-features.sh)" -i <crate> prints "nothing to print" for tinycortex, tinycortex-api, tinymemory-core, tinymemory-sync and tinymemory-tinycortex.
• Contract crates survive — the same command prints a tree for tinymemory-api, tinymemory-bus and tinymemory-sources.
• No test asserts engine behaviour any more — every surviving memory test asserts what OpenHuman does to what the driver returns, not what the driver returns.
• Driver equivalence proven — commit 1 shows the memory suite passing against the conformance driver and the in-process engine in the same build, with any divergence explained rather than papered over.
• Manifest cut — no tinycortex / tinymemory-core / tinymemory-tinycortex in [dependencies] or [dev-dependencies]; memory-engine-seams, rss-bench and rss-bench-dhat deleted along with memory/host_impls.rs, src/bin/rss_bench.rs, src/bin/library_profile/ and memory/direct_engine_refs_tests.rs; check-feature-forwarding.mjs passes with the allowlist entry removed.
• RPC surface unchanged — every memory*, memory_tree*, memory_sync*, memory_sources*, memory_goals* and people* method behaves identically and /schema is byte-identical.
• Coverage moved, not lost — the assertions deleted here either exist upstream already or landed there in PR 1.
• Disabled build green — GGML_NATIVE=OFF cargo test --lib --no-default-features --features flows memory:: passes; the CI smoke lane runs cargo check only and never compiles test code, so a disabled-build test break is invisible to it.
• Diff coverage ≥ 80% on both PRs.

Related

• Carry the memory engine's tests so OpenHuman can stop linking the engine tinymemory#147 — PR 1. Carries the measured family list, the required-versus-defaulted method
  split, and the capability-gated-dispatch constraint on assert_provider.
• Route memory tool and query paths through the module seam so tinymemory-core leaves the build #5560 — took the engine out of the product build; this finishes the job for the test build.
• Move the remaining memory engine internals and collapse the facade directories #5385 — the remaining facade collapse. Its Metric 1 (grep -rln "tinycortex::" src/openhuman/) reads 48
  today against a baseline of 111, but 36 are comment-only and all 12 code refs are tests, so it closes as a
  side effect rather than driving anything.
• Pluggable memory backends behind one driver contract #5372 — the parent consolidation epic.
• Drop the top-level vendor/tinycortex submodule in favour of tinymemory's nested copy #6062 — dropped the top-level vendor/tinycortex submodule in favour of tinymemory's nested copy, which is
  what makes the [patch.crates-io] entries point at the engine the prebuilt module was built from.
• src/openhuman/memory/README.md — the host/engine split this work must not violate.

[tinysweeper]

Delete the memory engine from OpenHuman's test build and move its tests upstream

Labelled priority: p2.

[YellowSnnowmann]

Triage measured: the repoint is nearly free, 33 tests need a decision

The spike that measured the driver's method list also answers the delete-versus-repoint question, because
binding a driver that answers empty separates the two buckets by construction:

• A test that passes against an empty-answering driver asserts what OpenHuman does with no data — its
  validation, its defaulting, its error paths, its response shaping. Nothing about it needs an engine.
• A test that fails asserts something about data the driver returned, so it needs either the fake's
  storage or the engine's semantics.

Running cargo test --lib memory:: with install_tinycortex_for_test bound to a recording fake:

997 passed; 33 failed; 37 ignored

96.8% of the memory suite repoints with no work at all. That is the single biggest unknown in this issue,
and it is now measured rather than estimated. The ~92 delete / ~223 repoint split this issue carried was
guesswork; the real decision surface is 33 tests.

The 33, grouped by what they would need

Engine query semantics — delete. The fake would have to filter, rank, aggregate or extract to make these
pass, and a fake that does that is being tested instead of OpenHuman. Upstream owns every one of these
behaviours (store/chunks/store_tests.rs, the entity and tree suites).

list_chunks_filters_by_source_id                      search_returns_matching_chunks
list_chunks_filters_by_entity_id_and_time_window      chunk_score_returns_breakdown_after_ingest
list_chunks_filters_by_source_kind_and_applies_limit_offset
list_chunks_query_substring_works                     chunks_for_entity_returns_leaf_chunk_ids_only
list_chunks_returns_seeded_chunk                      entity_index_for_returns_extracted_entities
delete_chunk_removes_chunk_and_dependent_rows         top_entities_returns_most_frequent
delete_chunk_still_reports_its_side_row_counts        contacts_graph_selects_person_chunks_and_groups_edges_by_chunk
list_sources_aggregates                               tree_graph_includes_leaf_chunks_linked_to_their_summary

Engine ingest pipeline — delete. Canonicalise → chunk → score → persist is the engine's, end to end.

ingest_chat_accepts_rfc3339_timestamps                execute_success_path_roundtrips_document_chunk
ingest_email_accepts_rfc3339_timestamps               execute_duplicate_source_id_reports_zero_new_chunks
ingest_document_is_idempotent_for_duplicate_source_id an_empty_chat_message_does_not_fail_the_batch_around_it
ingest_document_reports_the_chunks_it_wrote

Host behaviour that merely needs rows to exist — repoint, and the fake can already serve some. These
assert OpenHuman's formatting, ordering, scope handling and idempotence; they failed only because there was
nothing to format or order. The document and KV tiers now store in the conformance driver
(tinyhumansai/tinymemory#148), so the document-shaped ones should pass once it is bound. The chunk-shaped ones
need a judgement call: seed through whatever write path the fake does offer, or accept that the assertion is
really about engine output and let it go.

list_chunks_normalizes_invalid_tags_negative_tokens_and_empty_content
list_chunks_ignores_empty_filter_lists_and_blank_query
list_sources_formats_email_threads_with_trimmed_user_hint
tree_graph_keeps_summaries_first_then_chunks
top_entities_reports_empty_for_an_unknown_kind
delete_missing_chunk_is_idempotent
delete_source_is_idempotent_for_an_unknown_source_id
delete_source_never_logs_the_raw_source_id
clear_composio_sync_state_removes_only_target_namespace
wipe_all_clears_ingest_gate
cover_window_rpc_honors_profile_source_scope

Why the grouping is a proposal and not a verdict

The first two groups are decidable from the rule and I would delete them without further argument. The third
needs the driver actually bound to settle — several will simply pass once tinyhumansai/tinymemory#148 lands
and the submodule is bumped, and the remainder become a short list rather than a research task.

So the order inside PR 2's commit 1 is: bump the submodule, bind the driver, re-run, and let the residual
failures name themselves. That is a much smaller job than the file-by-file triage this issue currently
describes.

Caveat on scope

These counts are the memory:: filter only — 1,030 of the crate's 11,398 lib tests. The fixture also has call
sites under integrations::composio, flows::, channels:: and agent::experience; those runs showed
10 + 1 + 1 + 2 further failures against the recording fake, which are not itemised above. Expect roughly
47 tests total to need a decision, not 33.

[YellowSnnowmann]

Validated against the real driver: every failure is a delete, the repoint is free

tinyhumansai/tinymemory#148 is merged, so I bumped the submodule locally, bound
tinymemory_conformance::RecordingProvider in memory/test_support/mod.rs in place of TinycortexProvider,
and ran the suite. This is PR 2 commit 1 done for real rather than predicted.

It compiles and runs on the first try

cargo test --lib memory::        997 passed; 33 failed; 37 ignored
integrations::composio, flows::, channels::, agent::experience   14 further failures

47 failures, 100% of them engine behaviour. Everything else — the overwhelming majority — repoints with no
edit at all. The fixture swap is the entire change; the 59 install_tinycortex_for_test call sites need
nothing.

One prediction of mine was wrong, and the correction improves the plan

My earlier triage comment said several failures "should pass once the document and KV tiers store". They did
not. The failure set is byte-identical with and without that storage:

empty-answering fake : 997 passed; 33 failed
storing driver       : 997 passed; 33 failed
diff                 : empty

None of the 33 reaches the documents family at all. So the third group in that comment — the one I labelled
"host behaviour that merely needs rows to exist" — is not a separate bucket. Those tests need engine-produced
rows to format, order or count, and a fake that produced them would be an engine. They join the delete list.

Revised: there are two groups, not three, and both are delete.

The 14 outside memory::

Same character — connector cleanup cascades, sync ingest, and experience-store round trips, all asserting what
the engine did:

composio_delete_connection_clear_memory_cascades_source_tree_and_content_file
composio_delete_connection_clear_memory_cascades_live_sealed_tree_and_file
composio_delete_connection_clear_memory_deletes_slack_source
composio_delete_connection_clear_memory_keeps_other_gmail_connections
composio_sync_gmail_via_mock_ingests_records_and_updates_outcome
notion_cleanup_targets_include_synced_page_sources
notion_cleanup_targets_surface_corrupt_sync_state
enrich_handles_multiple_connections_same_toolkit
enrich_populates_email_from_cached_profile
enrich_populates_handle_for_github
disconnect_channel_clear_memory_deletes_matching_chat_sources
flows_delete_clears_flow_memory_namespace
driver_memory_round_trips_through_the_bound_driver
experience_store_round_trips_over_the_bound_driver

The last two are worth a second look before deleting — "round trips through the bound driver" reads like a
test of the binding rather than of the engine, and if so it belongs in the repoint bucket with a fake that
stores. Everything above them is cleanly engine work.

What this does to commit 1

It shrinks to almost nothing: bump the submodule, add tinymemory-conformance as a dev-dependency, rewrite
memory/test_support/mod.rs, and strip the install_memory_host_seams() calls. No test rewriting. The
raw_coverage integration targets are a separate population and still need their own pass, since
memory/test_support is pub(crate) and those targets never reached it.

Verified clean-up: the local bump, the dev-dependency, Cargo.lock and the fixture were all reverted, and the
working tree matches its pre-validation state exactly.