tinyhumansai · senamakel · Aug 9, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
diff --git a/.env.example b/.env.example
@@ -456,6 +456,21 @@ OPENHUMAN_ANALYTICS_ENABLED=true
 # (periodic auto-sync disabled). Unset → 24h default.
 # OPENHUMAN_MEMORY_SYNC_INTERVAL_SECS=86400
 
+# ---------------------------------------------------------------------------
+# Subsystem driver binding ([subsystems.memory] — kernel.md §3.6)
+# ---------------------------------------------------------------------------
+# Which driver answers for the memory subsystem, and the memory-hook budgets.
+# NOTHING READS THESE YET — the config surface exists so bindings can be
+# authored ahead of the registry landing. Defaults reproduce today's behaviour.
+# Per-driver option tables ([subsystems.memory.drivers.<id>], incl. the
+# fail-closed `trust_state`) are config-file only; there is no env form.
+# OPENHUMAN_MEMORY_DRIVER=tinycortex
+# OPENHUMAN_MEMORY_HOOKS_AUTO_RECALL=true
+# OPENHUMAN_MEMORY_HOOKS_AUTO_CAPTURE=true
+# OPENHUMAN_MEMORY_HOOKS_MAX_CONTEXT_TOKENS=2000
+# OPENHUMAN_MEMORY_HOOKS_RECALL_MAX_CHARS=1000
+# OPENHUMAN_MEMORY_HOOKS_CAPTURE_MAX_CHARS=500
+
 # ---------------------------------------------------------------------------
 # Logging
 # ---------------------------------------------------------------------------

diff --git a/.github/workflows/ci-lite.yml b/.github/workflows/ci-lite.yml
@@ -485,7 +485,7 @@ jobs:
         #
         # This asserts the calibration still holds. If it fails, every
         # projection built on the simulator is suspect until it is fixed.
-        run: python3 scripts/dep-sim.py --cut-nothing --expect-names 285
+        run: python3 scripts/dep-sim.py --cut-nothing --expect-names 286
 
       - name: Guard — new feature-gated test modules must be acknowledged
         # Self-maintaining coverage: the set of source files that #[cfg]-gate a test on

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -136,7 +136,23 @@ tinyagents = { version = "2.1", features = ["sqlite"] }
 # aligned to the host pins (=0.40 / 0.21) so one bundled SQLite + one libgit2
 # link. The submodule intentionally tracks reviewed upstream main commits;
 # keep this semver requirement compatible with the vendored crate version.
-tinycortex = { version = "0.1", features = ["git-diff", "persona", "sync"] }
+tinycortex = { version = "0.1", features = [
+    "git-diff",
+    "obsidian",
+    "persona",
+    "sync",
+    "wiki-git",
+] }
+# The memory *contract* — value types, the thirteen capability families, the
+# `MemoryProvider` driver trait, and the null reference driver. A direct path
+# dependency rather than a re-export, because `tinycortex::memory` aliases back
+# only `{error, traits, types}`; `capabilities`, `provider`, `null`, `health`,
+# `recall`, and `version` are reachable only through the api crate itself.
+# Deliberately dependency-light (no rusqlite/git2/reqwest/regex/async runtime)
+# so a third-party driver can compile against the contract without pulling in
+# the embedded engine. No `[patch.crates-io]` entry is needed: cargo unifies
+# this with the `path = "api"` dependency the engine crate already declares.
+tinycortex-api = { path = "vendor/tinycortex/api" }
 tinychannels = { version = "0.1", features = ["relay-websocket"] }
 # tinybus — the message bus. Owns what `src/core/event_bus/` used to: the typed
 # pub/sub surface (`EventBus`, `EventHandler`, `SubscriptionHandle`), the

diff --git a/app/src-tauri/Cargo.lock b/app/src-tauri/Cargo.lock
diff --git a/docs/specs/kernel.md b/docs/specs/kernel.md
@@ -124,6 +124,17 @@ The one exception is the **CLI**, which keeps its subcommand arm and reports a *
 ("memory driver `supermemory` does not support tree summarisation") — same reasoning as the
 retained `mcp` and `tui` CLI arms.
 
+Implemented for memory at the CLI boundary. `core::cli_capability` resolves the bound driver
+directly — no CLI subcommand except `run`/`serve` builds a `CoreContext`, so the ambient
+`capability_allowed` gate would always default open — and `core::all::capability_for_parts` /
+`sole_capability_for_namespace` supply the **unfiltered** lookup that tells "no such command"
+apart from "gated", which every filtered lookup has already collapsed into one absence. Both CLI
+paths are covered: the generic `openhuman <namespace> <function>` dispatcher and the hand-written
+`openhuman memory <sub>` adapter. `core::dispatch` is deliberately untouched — it is the shared
+`/rpc` path, where the absence rule above still holds. A genuinely unknown command still reports
+unknown namespace / function / subcommand; collapsing the two would make real typos harder to
+diagnose.
+
 ### 3.4 Policy is kernel-side and non-bypassable
 
 Every subsystem call from product code goes through a kernel-owned **guard decorator**, never to

diff --git a/docs/specs/memory-guard-allowlist.md b/docs/specs/memory-guard-allowlist.md
@@ -0,0 +1,158 @@
+# Memory-guard allowlist
+
+Every place in the tree that still reaches memory **without** going through
+`MemoryGuard`, and why. Produced by M4b; consumed by M4c.
+
+Pinned by the ratchet in `src/openhuman/memory/bypass_allowlist_tests.rs`
+(M4c), which fails **both ways** — when a new unguarded call site appears
+(`no_new_memory_driver_bypasses`), and when an allowlisted one is cleaned up
+without being struck from the list (`bypass_allowlist_has_no_stale_entries`).
+Two further tests stop the lint rotting into a rubber stamp: the scanner must
+find a known bypass, and every needle must still match something.
+
+M4b shipped a provisional, file-keyed version of this guard inside
+`memory/ops/guard_tests.rs`. M4c deleted it — two allowlists over one tree must
+both be struck on every cleanup, and the one nobody remembers is exactly the
+dead-string rot the ratchet exists to prevent.
+
+## Scope
+
+The lint scans `src/` for twelve patterns, keyed on `(file, pattern)` so the
+failure message names the needle that tripped:
+
+| Pattern | What it hands out |
+| --- | --- |
+| `active_memory_client(` | `MemoryClientRef` |
+| `global::client_if_ready(` / `global::client(` | `MemoryClientRef` |
+| `.memory_handle(` | raw `Arc<dyn Memory>` |
+| `.profile_conn(` | raw `Arc<Mutex<rusqlite::Connection>>` |
+| `.get_document(` | `pub(crate)` read-one escape hatch |
+| `EmbeddedMemoryProvider::new(` / `NullMemoryProvider::new(` | a driver, built outside `binding::for_workspace` |
+| `MemoryClient::from_workspace_dir(` | a second engine on the same store |
+| `binding::for_workspace(` / `.memory_binding(` | a raw `MemoryBinding` |
+| `.unguarded_provider(` | the raw `Arc<dyn MemoryProvider>` off a `MemoryBinding` |
+
+**By-path test files (`*_tests.rs`, `tests.rs`, `test_support/`) are out of
+scope.** Driver tests construct drivers — that is what a driver test *is* —
+so allowlisting them would add ~25 entries that can never shrink and would
+churn on every new test. Inline `#[cfg(test)] mod tests` blocks are *not*
+stripped, because brace-tracking Rust with a line scanner is fragile and
+getting it wrong silently hides production sites; the three files affected are
+allowlisted with a reason saying so. Comment lines are skipped, so doc-comment
+references are not mistaken for calls.
+
+`global::init(workspace)` is deliberately **not** scanned. It binds the
+workspace; it does not read or write memory, and every call site is a
+login / active-user-switch / boot / CLI-entry lifecycle event
+(`security/credentials/ops.rs`, `desktop/app_state/ops.rs`,
+`core/runtime/context.rs`, `core/memory_cli.rs`, `core/subconscious_cli.rs`,
+`bin/slack_backfill.rs`, `bin/gmail_backfill_3d.rs`,
+`memory/ops/documents.rs`'s `memory_init`, `memory/tinycortex/sync.rs`).
+
+## What M4b re-pointed
+
+Four RPC handlers, all in `src/openhuman/memory/ops/`, each of whose contract
+twin is a literal one-line delegation to the same host method on the same
+store:
+
+| Handler | Contract method | Driver body |
+| --- | --- | --- |
+| `documents::doc_put` | `MemoryDocuments::put_document` | `client.put_doc(input)` |
+| `kv_graph::kv_set` | `MemoryGraph::kv_put` | `client.kv_set(ns, key, &value)` |
+| `tool_memory::tool_rule_list` | `MemoryToolMemory::tool_rules` | `tool_memory_store(memory).list_rules(tool)` |
+| `tool_memory::tool_rule_delete` | `MemoryToolMemory::delete_tool_rule` | `tool_memory_store(memory).delete_rule(tool, id)` |
+
+**Three deltas ride along, and they are the point of the milestone, not
+accidents:**
+
+1. **Tier enforcement.** A write now goes through `ToolOperation::Act`, so a
+   `readonly` autonomy tier refuses it and the hourly action budget is charged
+   one unit. Reads take `ToolOperation::Read`, which `SecurityPolicy` answers
+   `Ok` for unconditionally today.
+2. **Error strings gain a method prefix.** The driver wraps host failures
+   through `host_error(context, error)`, so `"<orig>"` becomes
+   `"put_document: <orig>"`. Additive context, never a swallowed cause.
+3. **Taint may be raised.** `doc_put` still passes `MemoryTaint::Internal`; the
+   guard's `stamp_taint` promotes it to `ExternalSync` when the turn runs under
+   a source scope. It can never launder the other direction.
+
+Redaction is a byte-identical pass-through for an embedded driver, and the
+ambient source scope is applied only on `MemoryTree::query_source`, so neither
+changes anything here.
+
+## The allowlist
+
+### A. Legitimate residents — the driver, the seam, the bind site
+
+| Path | Reason |
+| --- | --- |
+| `memory/driver/embedded/mod.rs` | This **is** the driver. Guarding it would be a cycle. |
+| `memory/driver/embedded/tool_memory_tests.rs` | Driver tests. |
+| `memory/tinycortex/sync.rs` | The engine seam. |
+| `memory/global.rs` | The process-global slot itself. |
+| `memory/ops/helpers.rs` | Defines `active_memory_client`. |
+| `memory/ops/guard.rs`, `guard_tests.rs` | The guarded resolver; matches only in prose and in its own fallback. |
+| `memory/ops/provider.rs` (`.unguarded_provider(`) | Health probe on the bound driver; a liveness probe is not product code. |
+| `core/cli_capability.rs` (`binding::for_workspace(`) | The CLI's capability gate (`kernel.md` §3.3's one exception to "degradation is absence"). Reads the driver id and advertised capability set only — the same two values `memory.provider_status` already returns over RPC — and never reaches memory content. No CLI subcommand except `run`/`serve` builds a `CoreContext`, so `CoreContext::memory()` resolves to nothing and there is no guard to route through. `core/memory_cli.rs` calls `bound_memory_driver_for` rather than binding itself. |
+| `core/subsystems_cli.rs` | The `openhuman subsystems` slot table. Delegates to `memory_subsystem_status` (which itself resolves the binding in `memory/ops/provider.rs`, already allowlisted above), so `subsystems_cli.rs` never touches `binding::for_workspace(` directly — the CLI's command arms go through `bound_memory_driver_for`. |
+
+### B. Unguardable raw SQLite — `profile_conn()`, out of scope for M4
+
+No decorator can wrap an `Arc<Mutex<rusqlite::Connection>>`. These reach the
+profile / facet tables beneath all seven policy steps. **This is why "the guard
+is the only path" is not yet a true invariant.**
+
+| Path | Sites |
+| --- | --- |
+| `memory/sync/composio/providers/profile.rs` | 5 |
+| `agent/learning/schemas.rs` | 3 |
+| `agent/learning/tools.rs` | 1 |
+| `agent/learning/startup.rs` | 2 |
+| `memory/store/client_tests.rs` | 2 (test) |
+
+The brief named only the first two files. The other two were found by grep and
+are recorded here so M4c starts from the real set.
+
+### C. Needs a concrete engine type the contract does not expose
+
+| Path | Reason |
+| --- | --- |
+| `agent/experience/ops.rs` | `AgentExperienceStore::new` takes `Arc<dyn Memory>`; the non-`"memory"` subdir branch also builds `UnifiedMemory::new_with_memory_dir` directly — a per-profile store the binding has no concept of. |
+| `agent/harness/session/builder/factory.rs` | `.memory_handle()` → `Arc<dyn Memory>`. |
+| `flows/tinyflows/memory_adapter.rs` | Returns `Arc<dyn Memory>` to satisfy a tinyflows engine trait. The contract has no `Arc<dyn Memory>` door. |
+| `flows/bus.rs` | `resolve_memory() -> Option<Arc<dyn Memory>>`, and carries a `#[cfg(test)] memory_override` seam a guard would bypass. |
+| `memory/tool_memory/tools/list.rs`, `tools/put.rs` | Agent tools building `ToolMemoryStore` from `memory_handle()`. Re-pointable in principle via `as_tool_memory()` — **deferred to M5**, which filters the tool surface by capability and would collide with a re-point made now. |
+| `memory/ops/tool_memory.rs` (`open_store`) | Still needed by the four handlers left on the client. Shrank; did not disappear. |
+
+### D. No contract method exists, or the wire shape would change
+
+| Path | Reason |
+| --- | --- |
+| `memory/ops/documents.rs` — `namespace_list`, `doc_ingest`, `doc_list`, `doc_delete`, `clear_namespace`, `context_query`, `context_recall`, `memory_*` | Each answers with a `serde_json::Value` / `String` shape with no typed contract twin; `clear_namespace` has no contract method at all; `memory_query_namespace` depends on `query_limit_for_request(client: &MemoryClient, …)`. |
+| `memory/ops/kv_graph.rs` — `kv_get`, `kv_delete`, `kv_list_namespace`, `graph_upsert`, `graph_query` | `kv_get` is an O(slice) scan in the driver and returns `MemoryKvRecord`, not `Value`; `kv_delete` has **no** contract method; `graph_query`'s camelCase→typed conversion is documented as new and lossy. |
+| `memory/ops/tool_memory.rs` — `tool_rule_put`, `tool_rule_get`, `tool_rules_json`, `tool_rules_for_prompt` | `put_tool_rule` returns unit while the RPC returns the stored rule with a refreshed `updated_at`; the other three have no contract equivalent. |
+| `memory/ops/sync.rs` | `client.ingestion_state().snapshot()` — queue telemetry, absent from the contract. |
+| `memory/ops/learn.rs` | `list_namespaces() -> Vec<String>` vs the contract's `Vec<NamespaceSummary>`, then heavy engine work. |
+| `flows/ops.rs` | `clear_namespace` (no contract method) plus a `memory_client_override` test seam. |
+| `integrations/composio/schemas.rs` | Passes `&MemoryClientRef` into `user_scopes::save`. |
+| `memory/sync/composio/providers/user_scopes.rs`, `types.rs` | Same `&MemoryClientRef` parameter shape. |
+
+### E. Tests
+
+`flows/ops_tests.rs`, `flows/tinyflows/memory_node_e2e_tests.rs`,
+`integrations/composio/ops_tests.rs`, `core/runtime/context.rs` (its `#[cfg(test)]`
+module).
+
+## Honest scorecard
+
+Four of the twenty-eight `active_memory_client()` call sites now route through
+the guard. Eleven non-test `profile_conn()` sites and twelve non-test
+`memory_handle()` sites still hand out raw handles. The defensible claim for M4
+is therefore:
+
+> Every memory RPC handler whose contract twin is a literal delegation now
+> routes through the guard, and every remaining bypass is enumerated here with
+> a reason and pinned by a drift guard.
+
+"Impossible to skip by construction" is **not** true until `memory_handle()`
+and `profile_conn()` are gone.
diff --git a/scripts/kernel-floor.limits b/scripts/kernel-floor.limits
@@ -13,6 +13,23 @@
 # Simulate with: scripts/dep-sim.py --cut <crates>
 #
 # History
+#   307/284/5  2026-08-09  merge upstream/main + PR #5446 memory-subsystem work.
+#                      Measured, not derived: `scripts/kernel-floor.sh flows`
+#                      reports 307/284/5 on this merge. +3 names over the
+#                      304/281/5 below, and the split matters:
+#                        * +2 INHERITED — `tinybus` + `tinybus-macros`, vendored
+#                          by upstream #5459. The event bus is always-on kernel
+#                          surface, so they are in the `flows` profile there too;
+#                          upstream landed them without moving this number.
+#                        * +1 OURS — `tinycortex-api`, the memory contract crate
+#                          (`MemoryProvider`, `Capabilities`, `NullMemoryProvider`)
+#                          that `MemorySubsystemConfig` -> `MemoryBinding` now
+#                          depends on directly. It was already in the graph
+#                          transitively via `tinycortex`, so no *new* third-party
+#                          code enters the kernel profile — only a new direct edge.
+#                      The -6 packages / -1 native from the tokio-tungstenite
+#                      unification below is preserved, not spent: native builds
+#                      stay at 5 and aws-lc-sys stays absent.
 #   304/281/5  2026-08-08  local whisper.cpp STT deleted (`whisper-rs` +
 #                      `whisper-rs-sys` out of BOTH Cargo worlds, and the
 #                      `[patch.crates-io] whisper-rs-sys` fork entries with
@@ -130,4 +147,4 @@
 #                      Native: aws-lc-sys libgit2-sys libsqlite3-sys libz-sys
 #                      lzma-sys ring. Target after gating is 222 names / 2 native
 #                      (libsqlite3-sys, ring) — see docs/plans MIGRATION-PLAN G6.
-flows:304:281:5
+flows:307:284:5
diff --git a/src/bin/library_profile/mock.rs b/src/bin/library_profile/mock.rs
@@ -67,6 +67,7 @@ fn model_response(response: ChatResponse) -> ModelResponse {
         raw: None,
         resolved_model: None,
         continue_turn: None,
+        served_from_cache: false,
     }
 }