fix(memory): carry source scope and self-echo exclusion across the bus; re-pin tinymemory v1.2.0

AGENTS.md

@@ -893,17 +893,49 @@ the TinyMemory module to a released, SHA-256-verified artifact, so a new bus
 method is a `tinymemory` release plus a registry re-pin before it is a host
 change. Adding a `MemoryProvider` method without that produces a driver that
 answers `Unsupported` — strictly worse than the direct call, because the failure
-moves from compile time to run time. The concrete gaps (retrieval filters, chunk
-reads, an entity-kind filter, source listing, the people domain, and the
-`source_scope` task-local) are enumerated in that lint's module docs.
-
-**One trap worth naming: `tinymemory-api` and `tinycortex-api` are two crates
-with near-identical types.** The engine's
-`tinymemory_core::store::chunks::types::SourceKind` resolves to
-`tinycortex_api::chunks::SourceKind`, which is **not** the contract's
-`memory::api::chunks::SourceKind`. Swapping one import for the other looks like
-a free type carve-out and is a type error — the module does that conversion at
-its own boundary.
+moves from compile time to run time. The gap list in that lint's module docs is **stale as of 2026-08-23**: retrieval
+filters, chunk reads, the entity-kind filter, source listing and the people
+domain all landed as real capability families (`MemoryRetrieval`,
+`MemoryChunks`, `MemoryPeople`, `MemoryProfile`, `MemoryEpisodic`), and
+`ModuleMemoryProvider` implements all of them bar `as_episodic`. What blocks
+migrating onto them is **release lag, not seam width** — see the release note
+below. The `source_scope` task-local is no longer a gap either: it is host
+policy, it lives in `memory::source_scope`, and the scope crosses the bus as a
+`SourceScope` value.
+
+**Task-locals do not cross the bus, and both of the ones here are permission
+checks that fail OPEN.** The module is a separately compiled `cdylib` with its
+own statics, so a task-local set host-side reads as absent inside it — and
+absent means *unrestricted* for `source_scope` and *exclude nothing* for the
+self-echo exclusion. Never let a memory call infer either from ambient state:
+pass `memory::source_scope::as_bus_scope()` and `RecallOpts::exclude_session_id`
+explicitly. The engine's scoped/unscoped function pairs exist for this reason —
+`cover_window_scoped`, `query_source_scoped`, `drill_down_scoped`,
+`fetch_leaves_scoped`. **The unsuffixed twin reads the engine's task-local and
+must not be called from this host.**
+
+**The module release lags the vendored source.** `modules::registry` pins a
+released, SHA-256-verified artifact; the vendored submodule is routinely ahead
+of it. Check the *tag*, not the working tree, before migrating onto a family:
+`git -C vendor/tinymemory show <tag>:crates/tinymemory-module/src/lib.rs | grep '"ListChunks"'`.
+Migrating onto a method the pinned artifact does not serve yields a runtime
+`Unsupported` — strictly worse than the direct call, because the failure moves
+from compile time to run time.
+
+**The `SourceKind` trap is gone — do not re-derive it.** This note used to warn
+that `tinymemory_core::store::chunks::types::SourceKind` resolved to
+`tinycortex_api::chunks::SourceKind` and was **not** the contract's
+`SourceKind`, so swapping the import was a type error rather than a free carve-
+out. `tinycortex-api` is now a deprecated re-export of `tinymemory-bus`, and the
+two resolve to the **same item**; the engine's chunk types are re-exported from
+`crate::engine::backend::chunks`, which lands in the same place. Verified with a
+compile-time identity probe (a function taking the engine path and returning the
+contract path), then by repointing every OpenHuman call site — the compiler is
+the proof. Prefer `tinymemory_api::chunks::…` in new code.
+
+The general shape of the warning still holds for *other* pairs: two crates with
+near-identical types are a real hazard, and a "free carve-out" is only free once
+the compiler says so. Probe before assuming, in either direction.
 
 #### The `tui` gate
 

src/core/all.rs

@@ -10,7 +10,7 @@ use std::sync::OnceLock;
 
 use serde_json::{Map, Value};
 
-use crate::openhuman::memory::api::capabilities::{Capabilities, Capability};
+use tinymemory_api::capabilities::{Capabilities, Capability};
 
 use crate::core::ControllerSchema;
 
@@ -239,7 +239,7 @@ struct GroupedController {
     /// Absence, not a stub that errors — a registered-but-failing method
     /// teaches a model that the capability exists and makes it retry. Same
     /// reasoning as the `flows` compile-time gate (see CLAUDE.md) and as
-    /// `crate::openhuman::memory::api::capabilities`' module docs.
+    /// `tinymemory_api::capabilities`' module docs.
     capability: Option<Capability>,
     controller: RegisteredController,
 }

src/core/all_tests.rs

@@ -1608,7 +1608,7 @@ fn memory_controllers_form_one_contiguous_run_in_aggregator_order() {
 // present and failing, because a registered-but-failing method teaches a model
 // the capability exists and makes it retry.
 
-use crate::openhuman::memory::api::capabilities::Capability;
+use tinymemory_api::capabilities::Capability;
 
 /// A workspace path unique to one test.
 ///

src/core/cli_capability.rs

@@ -37,8 +37,8 @@
 //! static namespace/function names, never from user-supplied argument values,
 //! and no memory content can reach this path at all.
 
-use crate::openhuman::memory::api::capabilities::{Capabilities, Capability};
 use anyhow::Result;
+use tinymemory_api::capabilities::{Capabilities, Capability};
 
 use crate::core::subsystem::DriverClass;
 

src/core/cli_capability_tests.rs

@@ -94,14 +94,17 @@ fn message_never_contains_a_credential_or_endpoint() {
 #[cfg(feature = "modules")]
 #[tokio::test]
 async fn bound_driver_probe_reports_the_default_module_driver() {
-    // Was asserting `capabilities() == Capabilities::all()`. That encoded
-    // #5598 as expected: the pinned v1.0.1 tinymemory artifact serves thirteen
-    // of the contract's eighteen families (missing `chunks`, `episodic`,
-    // `people`, `profile`, `retrieval`), so claiming the full contract made
-    // those five answer `UnknownMethod` instead of reporting themselves
-    // absent. `modules::memory::ARTIFACT_CAPABILITIES` was narrowed to match
-    // what is actually served (see its module docs); this pins the same
-    // corrected boundary rather than the stale full-contract claim.
+    // Was asserting `capabilities() == Capabilities::all()`. That encoded #5598
+    // as expected: the then-pinned v1.0.1 artifact served thirteen of the
+    // contract's eighteen families, so claiming the full contract made the
+    // other five answer `UnknownMethod` instead of reporting themselves absent.
+    //
+    // The registry now pins v1.2.0, which added bus members for `chunks`,
+    // `people`, `profile` and `retrieval` — so the boundary moved from thirteen
+    // to seventeen. `episodic` is the one still withheld, and for a different
+    // reason: the artifact serves it, but `ModuleMemoryProvider` has no
+    // `as_episodic`, so advertising it would be the same over-claim in a
+    // different coat. This pins that corrected boundary, not the stale one.
     let cfg = MemorySubsystemConfig::default();
     let binding = binding_for("default", cfg.clone());
     assert_eq!(
@@ -111,9 +114,20 @@ async fn bound_driver_probe_reports_the_default_module_driver() {
     let advertised = binding.capabilities();
     assert!(advertised.contains_all(Capabilities::mandatory()));
     assert!(advertised.contains(Capability::Tree));
+    for capability in [
+        Capability::Chunks,
+        Capability::People,
+        Capability::Profile,
+        Capability::Retrieval,
+    ] {
+        assert!(
+            advertised.contains(capability),
+            "the pinned v1.2.0 artifact must advertise {capability:?}"
+        );
+    }
     assert!(
-        !advertised.contains(Capability::Retrieval),
-        "the pinned v1.0.1 artifact has no bus member for `retrieval` (#5598)"
+        !advertised.contains(Capability::Episodic),
+        "`episodic` must stay unadvertised until `ModuleMemoryProvider` implements `as_episodic`"
     );
     assert!(Capabilities::all().contains_all(advertised));
     assert_ne!(

src/core/cli_tests.rs

@@ -366,7 +366,7 @@ use crate::core::all::{
     capability_for_parts, capability_for_rpc_method, sole_capability_for_namespace,
 };
 use crate::core::cli_capability::capability_verdict;
-use crate::openhuman::memory::api::capabilities::Capabilities;
+use tinymemory_api::capabilities::Capabilities;
 
 #[test]
 fn capability_gated_namespace_reports_a_config_fact_not_a_typo() {
@@ -404,9 +404,7 @@ fn capability_gated_function_reports_a_config_fact_not_a_typo() {
 fn capability_gated_rpc_method_reports_its_family_unfiltered() {
     assert_eq!(
         capability_for_rpc_method("openhuman.memory_tree_wipe_all"),
-        Some(Some(
-            crate::openhuman::memory::api::capabilities::Capability::Tree
-        ))
+        Some(Some(tinymemory_api::capabilities::Capability::Tree))
     );
 }
 

src/core/memory_cli.rs

@@ -62,9 +62,7 @@ const SUBCOMMAND_CONTROLLER: &[(&str, &str)] = &[
 
 /// The capability `openhuman memory <sub>` needs, if any. Resolved from the
 /// controller registry, never from a local table.
-fn required_capability(
-    subcommand: &str,
-) -> Option<crate::openhuman::memory::api::capabilities::Capability> {
+fn required_capability(subcommand: &str) -> Option<tinymemory_api::capabilities::Capability> {
     let function = SUBCOMMAND_CONTROLLER
         .iter()
         .find(|(sub, _)| *sub == subcommand)
@@ -555,7 +553,7 @@ mod tests {
     use super::*;
     use crate::core::cli_capability::{capability_verdict, CAPABILITY_UNAVAILABLE_PREFIX};
     use crate::core::subsystem::DriverClass;
-    use crate::openhuman::memory::api::capabilities::{Capabilities, Capability};
+    use tinymemory_api::capabilities::{Capabilities, Capability};
 
     /// Drift guard: a renamed controller function must break here rather than
     /// silently un-gate a subcommand (`required_capability` would start

src/core/runtime/context.rs

@@ -334,11 +334,11 @@ impl CoreContext {
     /// would keep `memory_store` / `memory_recall` / `memory.list_documents`
     /// answering off the embedded store the guarded re-point has not yet
     /// covered. See [`MemoryBinding::disables_memory`](crate::openhuman::memory::binding::MemoryBinding::disables_memory).
-    pub fn memory_capabilities(&self) -> crate::openhuman::memory::api::capabilities::Capabilities {
+    pub fn memory_capabilities(&self) -> tinymemory_api::capabilities::Capabilities {
         self.memory_binding()
             .map(|binding| {
                 if binding.disables_memory() {
-                    crate::openhuman::memory::api::capabilities::Capabilities::default()
+                    tinymemory_api::capabilities::Capabilities::default()
                 } else {
                     binding.capabilities()
                 }
@@ -373,8 +373,7 @@ impl CoreContext {
     /// there is no context at all. This is the direct analogue of
     /// `core::all::group_allowed` and is the function a future capability
     /// registration filter calls.
-    pub fn current_memory_capabilities() -> crate::openhuman::memory::api::capabilities::Capabilities
-    {
+    pub fn current_memory_capabilities() -> tinymemory_api::capabilities::Capabilities {
         Self::current()
             .map(|ctx| ctx.memory_capabilities())
             .unwrap_or_else(crate::openhuman::memory::binding::unbound_default_capabilities)
@@ -1055,7 +1054,7 @@ mod tests {
         assert!(ctx.memory_binding().is_err(), "no workspace ⇒ no binding");
         assert_eq!(
             ctx.memory_capabilities(),
-            crate::openhuman::memory::api::capabilities::Capabilities::all(),
+            tinymemory_api::capabilities::Capabilities::all(),
             "a context with no binding must not deny any capability"
         );
     }
@@ -1070,14 +1069,14 @@ mod tests {
     fn current_memory_capabilities_defaults_open_without_a_context() {
         assert_eq!(
             crate::openhuman::memory::binding::unbound_default_capabilities(),
-            crate::openhuman::memory::api::capabilities::Capabilities::all()
+            tinymemory_api::capabilities::Capabilities::all()
         );
         // And when a context *is* ambient, the call resolves through it rather
         // than erroring.
         let ctx = CoreContext::for_test(crate::core::runtime::DomainSet::full(), None, None);
         assert_eq!(
             ctx.memory_capabilities(),
-            crate::openhuman::memory::api::capabilities::Capabilities::all()
+            tinymemory_api::capabilities::Capabilities::all()
         );
     }
 
@@ -1088,7 +1087,7 @@ mod tests {
         let ctx = CoreContext::for_test(crate::core::runtime::DomainSet::harness(), None, None);
         assert_eq!(
             ctx.memory_capabilities(),
-            crate::openhuman::memory::api::capabilities::Capabilities::all()
+            tinymemory_api::capabilities::Capabilities::all()
         );
     }
 }

src/core/subsystem/driver.rs

@@ -34,7 +34,7 @@ use serde::{Deserialize, Serialize};
 /// This is a **host configuration fact**, never something the driver reports.
 ///
 /// Deliberately not `#[non_exhaustive]`, for the same reason
-/// `crate::openhuman::memory::api::capabilities::Capability` is not: adding a class must break
+/// `tinymemory_api::capabilities::Capability` is not: adding a class must break
 /// every exhaustive `match` in the host, because those matches are where policy
 /// (egress, trust, credential resolution) is decided per class.
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize)]
@@ -108,7 +108,7 @@ impl std::str::FromStr for DriverClass {
 
 /// Liveness of a bound driver, in the kernel's generic vocabulary.
 ///
-/// Shaped one-for-one against `crate::openhuman::memory::api::health::MemoryHealth` — and
+/// Shaped one-for-one against `tinymemory_api::health::MemoryHealth` — and
 /// against whatever the next subsystem's contract carries — so the boundary
 /// conversion is a total three-arm `match` that cannot drift. Serializes as an
 /// internally-tagged object with a stable snake_case `status` discriminant:
@@ -191,7 +191,7 @@ impl std::fmt::Display for DriverHealth {
 /// The kernel deliberately does not know any subsystem's family vocabulary —
 /// `"tree"` and `"tool_memory"` mean something to the memory subsystem and
 /// nothing here. Each subsystem's adapter converts its own typed set (for
-/// memory: `crate::openhuman::memory::api::capabilities::Capabilities`) into this at bind
+/// memory: `tinymemory_api::capabilities::Capabilities`) into this at bind
 /// time, and the kernel only ever asks "does the bound driver advertise this
 /// string?" when deciding whether to register a controller or emit a tool.
 ///

src/core/subsystem/driver_tests.rs

@@ -97,7 +97,7 @@ fn driver_health_display_includes_the_reason() {
 /// silently making the conversion partial.
 #[test]
 fn driver_health_shape_matches_memory_health_one_for_one() {
-    use crate::openhuman::memory::api::health::MemoryHealth;
+    use tinymemory_api::health::MemoryHealth;
 
     let pairs: Vec<(MemoryHealth, DriverHealth)> = vec![
         (MemoryHealth::Ready, DriverHealth::Ready),
@@ -188,7 +188,7 @@ fn driver_capabilities_contains_all_is_subset_semantics() {
 /// memory capability is.
 #[test]
 fn every_memory_contract_capability_string_maps_into_driver_capabilities() {
-    use crate::openhuman::memory::api::capabilities::Capability;
+    use tinymemory_api::capabilities::Capability;
 
     let caps: DriverCapabilities = Capability::ALL.iter().map(|cap| cap.as_str()).collect();
 

src/core/subsystem/mod.rs

@@ -13,7 +13,7 @@
 //!
 //! Since M2b the memory adapter exists in
 //! [`crate::openhuman::memory::binding`] (it converts
-//! `crate::openhuman::memory::api::MemoryHealth` into [`DriverHealth`] and the contract's
+//! `tinymemory_api::MemoryHealth` into [`DriverHealth`] and the contract's
 //! typed capability set into [`DriverCapabilities`]), and M2c added the
 //! read-only [`status`] projection plus the `subsystems` RPC namespace and the
 //! `openhuman subsystems` CLI table.

src/core/subsystem/status.rs

@@ -8,7 +8,7 @@
 //!
 //! ## Capabilities cross the wire as opaque strings, never as a typed set
 //!
-//! A memory driver's typed set (`crate::openhuman::memory::api::capabilities::Capabilities`)
+//! A memory driver's typed set (`tinymemory_api::capabilities::Capabilities`)
 //! is a `u16` bitset whose `Deserialize` rejects the **whole** array on a
 //! single unrecognised family string. A driver speaking a newer minor contract
 //! may legitimately advertise a family this build has never heard of, and

src/openhuman/agent/harness/archivist/boundary.rs

@@ -179,7 +179,7 @@ pub fn detect_boundary(
 /// The part of a segment boundary detection reads.
 ///
 /// A narrow view rather than the whole
-/// [`ConversationSegment`](crate::openhuman::memory::api::provider::episodic::ConversationSegment)
+/// [`ConversationSegment`](tinymemory_api::provider::episodic::ConversationSegment)
 /// because the decision depends on four fields, and naming them makes it
 /// checkable that nothing else influences it.
 #[derive(Clone, Debug, Default)]

src/openhuman/agent/harness/archivist/recap.rs

@@ -156,7 +156,7 @@ impl ArchivistHook {
             .iter()
             .filter(|e| !e.content.trim().is_empty())
             .map(|e| {
-                use tinymemory_core::store::chunks::types::approx_token_count;
+                use tinymemory_api::chunks::approx_token_count;
                 let content = e.content.clone();
                 let token_count = approx_token_count(&content);
                 let ts = chrono::DateTime::from_timestamp(e.timestamp as i64, 0)

src/openhuman/agent/learning/cache.rs

@@ -7,10 +7,8 @@
 use std::sync::Arc;
 
 use crate::openhuman::agent::learning::candidate::FacetClass;
-use crate::openhuman::memory::api::provider::{
-    MemoryProfile, MemoryProvider, ProfileFacet, UserState,
-};
 use crate::openhuman::memory::guard::MemoryGuard;
+use tinymemory_api::provider::{MemoryProfile, MemoryProvider, ProfileFacet, UserState};
 
 /// Thin wrapper around the profile facet store.
 ///
@@ -205,9 +203,7 @@ pub fn class_prefix(class: FacetClass) -> &'static str {
 
 // ── Facet state enum re-export (convenience for callers of this module) ───────
 
-pub use crate::openhuman::memory::api::provider::{
-    FacetState as CacheFacetState, UserState as CacheUserState,
-};
+pub use tinymemory_api::provider::{FacetState as CacheFacetState, UserState as CacheUserState};
 
 // ── Tests ─────────────────────────────────────────────────────────────────────
 

src/openhuman/agent/learning/cache_tests.rs

@@ -2,8 +2,8 @@
 
 use super::*;
 use crate::openhuman::agent::learning::candidate::FacetClass;
-use crate::openhuman::memory::api::host::EvidenceRef;
-use crate::openhuman::memory::api::provider::{FacetState, FacetType, ProfileFacet, UserState};
+use tinymemory_api::host::EvidenceRef;
+use tinymemory_api::provider::{FacetState, FacetType, ProfileFacet, UserState};
 
 fn make_cache() -> FacetCache {
     crate::openhuman::agent::learning::test_profile::in_memory_cache()