refactor(core): run tiny domains as TinyBus modules

.gitmodules

@@ -27,9 +27,3 @@
 	path = vendor/tinymemory
 	url = https://github.com/tinyhumansai/tinymemory.git
 	branch = main
-[submodule "vendor/tinywallet"]
-	path = vendor/tinywallet
-	url = https://github.com/tinyhumansai/tinywallet
-[submodule "vendor/tinydocs"]
-	path = vendor/tinydocs
-	url = https://github.com/tinyhumansai/tinydocs

Cargo.toml

@@ -454,7 +454,6 @@ unicode-width = { version = "0.2", optional = true }
 # After cloning: `git submodule update --init vendor/tinydocs`.
 #
 # Optional: exclusive to the default-ON `documents` feature.
-tinydocs = { path = "vendor/tinydocs", default-features = false, optional = true }
 
 # TinyWallet — host-agnostic multi-chain wallet primitives. Owns the address
 # formats themselves: parsing, validation, and the conversions between their
@@ -475,11 +474,14 @@ tinydocs = { path = "vendor/tinydocs", default-features = false, optional = true
 # What stays is address validation, key derivation, the `Transport` seam, the
 # wire contract, EIP-712 hashing and ERC-20 calldata — none of which needs a
 # chain library.
-tinywallet = { path = "vendor/tinywallet", default-features = false, features = ["btc", "evm", "solana", "tron", "keccak", "key", "net", "wire", "eip712", "abi", "x402"], optional = true }
 # secp256k1 signing over the digests the wallet module hands back. Pure Rust,
 # and already in the graph beneath `coins-bip32` (which derives the key being
 # used), so naming it directly costs nothing and is what lets `bitcoin` go.
 k256 = { version = "0.13", default-features = false, features = ["std", "ecdsa"], optional = true }
+bech32 = { version = "0.11", optional = true }
+ripemd = { version = "0.1", optional = true }
+coins-bip32 = { version = "0.8", optional = true }
+sha3 = { version = "0.10", optional = true }
 
 [target.'cfg(windows)'.dependencies]
 # Windows: tokio-tungstenite uses native-tls (schannel) so wss://
@@ -676,7 +678,7 @@ inference = ["dep:cpal"]
 # reference instead of extracted text
 # (`agent::multimodal::extract_pdf_text`). Slim / headless builds opt out via
 # `--no-default-features --features "<explicit list without documents>"`.
-documents = ["dep:tinydocs", "modules"]
+documents = ["modules"]
 # The dynamic module host (`openhuman::modules`): the loader that admits a
 # compiled `cdylib` through tinybus's ABI descriptor, manifest, dependency and
 # SHA-256 gates, plus the `modules` RPC namespace and the registry of modules
@@ -739,9 +741,13 @@ voice = [
 # pulls them in regardless.
 web3 = [
     "dep:k256",
+    "dep:bech32",
+    "dep:ripemd",
+    "dep:coins-bip32",
+    "dep:sha3",
     "dep:curve25519-dalek",
     "dep:coins-bip39",
-    "dep:tinywallet",
+    "modules",
 ]
 
 # Managed Node.js runtime: `runtime::node` (download / verify / extract / install

src/core/all.rs

@@ -10,7 +10,7 @@ use std::sync::OnceLock;
 
 use serde_json::{Map, Value};
 
-use tinycortex_api::capabilities::{Capabilities, Capability};
+use crate::openhuman::memory::api::capabilities::{Capabilities, Capability};
 
 use crate::core::ControllerSchema;
 
@@ -242,7 +242,7 @@ struct GroupedController {
     /// Absence, not a stub that errors — a registered-but-failing method
     /// teaches a model that the capability exists and makes it retry. Same
     /// reasoning as the `flows` compile-time gate (see CLAUDE.md) and as
-    /// `tinycortex_api::capabilities`' module docs.
+    /// `crate::openhuman::memory::api::capabilities`' module docs.
     capability: Option<Capability>,
     controller: RegisteredController,
 }

src/core/all_tests.rs

@@ -1658,7 +1658,7 @@ fn memory_controllers_form_one_contiguous_run_in_aggregator_order() {
 // present and failing, because a registered-but-failing method teaches a model
 // the capability exists and makes it retry.
 
-use tinycortex_api::capabilities::Capability;
+use crate::openhuman::memory::api::capabilities::Capability;
 
 /// A workspace path unique to one test.
 ///

src/core/cli_capability.rs

@@ -37,8 +37,8 @@
 //! static namespace/function names, never from user-supplied argument values,
 //! and no memory content can reach this path at all.
 
+use crate::openhuman::memory::api::capabilities::{Capabilities, Capability};
 use anyhow::Result;
-use tinycortex_api::capabilities::{Capabilities, Capability};
 
 use crate::core::subsystem::DriverClass;
 

src/core/cli_tests.rs

@@ -330,7 +330,7 @@ use crate::core::all::{
     capability_for_parts, capability_for_rpc_method, sole_capability_for_namespace,
 };
 use crate::core::cli_capability::capability_verdict;
-use tinycortex_api::capabilities::Capabilities;
+use crate::openhuman::memory::api::capabilities::Capabilities;
 
 #[test]
 fn capability_gated_namespace_reports_a_config_fact_not_a_typo() {
@@ -368,7 +368,9 @@ fn capability_gated_function_reports_a_config_fact_not_a_typo() {
 fn capability_gated_rpc_method_reports_its_family_unfiltered() {
     assert_eq!(
         capability_for_rpc_method("openhuman.memory_tree_wipe_all"),
-        Some(Some(tinycortex_api::capabilities::Capability::Tree))
+        Some(Some(
+            crate::openhuman::memory::api::capabilities::Capability::Tree
+        ))
     );
 }
 

src/core/memory_cli.rs

@@ -62,7 +62,9 @@ const SUBCOMMAND_CONTROLLER: &[(&str, &str)] = &[
 
 /// The capability `openhuman memory <sub>` needs, if any. Resolved from the
 /// controller registry, never from a local table.
-fn required_capability(subcommand: &str) -> Option<tinycortex_api::capabilities::Capability> {
+fn required_capability(
+    subcommand: &str,
+) -> Option<crate::openhuman::memory::api::capabilities::Capability> {
     let function = SUBCOMMAND_CONTROLLER
         .iter()
         .find(|(sub, _)| *sub == subcommand)
@@ -546,7 +548,7 @@ mod tests {
     use super::*;
     use crate::core::cli_capability::{capability_verdict, CAPABILITY_UNAVAILABLE_PREFIX};
     use crate::core::subsystem::DriverClass;
-    use tinycortex_api::capabilities::{Capabilities, Capability};
+    use crate::openhuman::memory::api::capabilities::{Capabilities, Capability};
 
     /// Drift guard: a renamed controller function must break here rather than
     /// silently un-gate a subcommand (`required_capability` would start

src/core/runtime/context.rs

@@ -278,11 +278,11 @@ impl CoreContext {
     /// would keep `memory_store` / `memory_recall` / `memory.list_documents`
     /// answering off the embedded store the guarded re-point has not yet
     /// covered. See [`MemoryBinding::disables_memory`](crate::openhuman::memory::binding::MemoryBinding::disables_memory).
-    pub fn memory_capabilities(&self) -> tinycortex_api::capabilities::Capabilities {
+    pub fn memory_capabilities(&self) -> crate::openhuman::memory::api::capabilities::Capabilities {
         self.memory_binding()
             .map(|binding| {
                 if binding.disables_memory() {
-                    tinycortex_api::capabilities::Capabilities::default()
+                    crate::openhuman::memory::api::capabilities::Capabilities::default()
                 } else {
                     binding.capabilities()
                 }
@@ -317,7 +317,8 @@ impl CoreContext {
     /// there is no context at all. This is the direct analogue of
     /// `core::all::group_allowed` and is the function a future capability
     /// registration filter calls.
-    pub fn current_memory_capabilities() -> tinycortex_api::capabilities::Capabilities {
+    pub fn current_memory_capabilities() -> crate::openhuman::memory::api::capabilities::Capabilities
+    {
         Self::current()
             .map(|ctx| ctx.memory_capabilities())
             .unwrap_or_else(crate::openhuman::memory::binding::unbound_default_capabilities)
@@ -1045,7 +1046,7 @@ mod tests {
         assert!(ctx.memory_binding().is_err(), "no workspace ⇒ no binding");
         assert_eq!(
             ctx.memory_capabilities(),
-            tinycortex_api::capabilities::Capabilities::all(),
+            crate::openhuman::memory::api::capabilities::Capabilities::all(),
             "a context with no binding must not deny any capability"
         );
     }
@@ -1060,14 +1061,14 @@ mod tests {
     fn current_memory_capabilities_defaults_open_without_a_context() {
         assert_eq!(
             crate::openhuman::memory::binding::unbound_default_capabilities(),
-            tinycortex_api::capabilities::Capabilities::all()
+            crate::openhuman::memory::api::capabilities::Capabilities::all()
         );
         // And when a context *is* ambient, the call resolves through it rather
         // than erroring.
         let ctx = CoreContext::for_test(crate::core::runtime::DomainSet::full(), None, None);
         assert_eq!(
             ctx.memory_capabilities(),
-            tinycortex_api::capabilities::Capabilities::all()
+            crate::openhuman::memory::api::capabilities::Capabilities::all()
         );
     }
 
@@ -1078,7 +1079,7 @@ mod tests {
         let ctx = CoreContext::for_test(crate::core::runtime::DomainSet::harness(), None, None);
         assert_eq!(
             ctx.memory_capabilities(),
-            tinycortex_api::capabilities::Capabilities::all()
+            crate::openhuman::memory::api::capabilities::Capabilities::all()
         );
     }
 }

src/core/subsystem/driver.rs

@@ -34,7 +34,7 @@ use serde::{Deserialize, Serialize};
 /// This is a **host configuration fact**, never something the driver reports.
 ///
 /// Deliberately not `#[non_exhaustive]`, for the same reason
-/// `tinycortex_api::capabilities::Capability` is not: adding a class must break
+/// `crate::openhuman::memory::api::capabilities::Capability` is not: adding a class must break
 /// every exhaustive `match` in the host, because those matches are where policy
 /// (egress, trust, credential resolution) is decided per class.
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize)]
@@ -46,27 +46,7 @@ pub enum DriverClass {
     /// An out-of-process backend reached through a transport adapter over a
     /// documented wire contract.
     External,
-    /// A loadable native module: a `cdylib` admitted through tinybus's ABI,
-    /// manifest and digest gates and reached over the in-process module bus.
-    ///
-    /// Neither of the two classes above fits, and the difference is the policy
-    /// this class gates:
-    ///
-    /// - not [`Self::Embedded`], because the code is **not compiled into this
-    ///   binary**. It is downloaded, verified against a digest pinned in
-    ///   `modules::registry`, and `dlopen`ed. Whether it is present at all is a
-    ///   runtime fact, so a capability set derived from it can be empty on a
-    ///   platform no artifact is published for.
-    /// - not [`Self::External`], because there is **no egress and no process
-    ///   boundary**. It shares this address space, these privileges and this
-    ///   crash domain, so the trust checks that make sense for a remote backend
-    ///   (endpoint allowlisting, TLS, credential scoping) are neither applicable
-    ///   nor sufficient. What protects the host is admission, not isolation.
-    ///
-    /// Treating a module as `External` would apply egress policy to something
-    /// that makes no network calls while implying an isolation the loader does
-    /// not provide; treating it as `Embedded` would claim a compile-time
-    /// guarantee that a downloaded artifact does not have.
+    /// A verified native TinyBus module loaded into this process.
     Module,
     /// A stub advertising zero capabilities — what a compiled-out or
     /// unconfigured subsystem binds to.
@@ -128,7 +108,7 @@ impl std::str::FromStr for DriverClass {
 
 /// Liveness of a bound driver, in the kernel's generic vocabulary.
 ///
-/// Shaped one-for-one against `tinycortex_api::health::MemoryHealth` — and
+/// Shaped one-for-one against `crate::openhuman::memory::api::health::MemoryHealth` — and
 /// against whatever the next subsystem's contract carries — so the boundary
 /// conversion is a total three-arm `match` that cannot drift. Serializes as an
 /// internally-tagged object with a stable snake_case `status` discriminant:
@@ -211,7 +191,7 @@ impl std::fmt::Display for DriverHealth {
 /// The kernel deliberately does not know any subsystem's family vocabulary —
 /// `"tree"` and `"tool_memory"` mean something to the memory subsystem and
 /// nothing here. Each subsystem's adapter converts its own typed set (for
-/// memory: `tinycortex_api::capabilities::Capabilities`) into this at bind
+/// memory: `crate::openhuman::memory::api::capabilities::Capabilities`) into this at bind
 /// time, and the kernel only ever asks "does the bound driver advertise this
 /// string?" when deciding whether to register a controller or emit a tool.
 ///

src/core/subsystem/driver_tests.rs

@@ -97,7 +97,7 @@ fn driver_health_display_includes_the_reason() {
 /// silently making the conversion partial.
 #[test]
 fn driver_health_shape_matches_memory_health_one_for_one() {
-    use tinycortex_api::health::MemoryHealth;
+    use crate::openhuman::memory::api::health::MemoryHealth;
 
     let pairs: Vec<(MemoryHealth, DriverHealth)> = vec![
         (MemoryHealth::Ready, DriverHealth::Ready),
@@ -188,7 +188,7 @@ fn driver_capabilities_contains_all_is_subset_semantics() {
 /// memory capability is.
 #[test]
 fn every_memory_contract_capability_string_maps_into_driver_capabilities() {
-    use tinycortex_api::capabilities::Capability;
+    use crate::openhuman::memory::api::capabilities::Capability;
 
     let caps: DriverCapabilities = Capability::ALL.iter().map(|cap| cap.as_str()).collect();
 

src/core/subsystem/mod.rs

@@ -13,7 +13,7 @@
 //!
 //! Since M2b the memory adapter exists in
 //! [`crate::openhuman::memory::binding`] (it converts
-//! `tinycortex_api::MemoryHealth` into [`DriverHealth`] and the contract's
+//! `crate::openhuman::memory::api::MemoryHealth` into [`DriverHealth`] and the contract's
 //! typed capability set into [`DriverCapabilities`]), and M2c added the
 //! read-only [`status`] projection plus the `subsystems` RPC namespace and the
 //! `openhuman subsystems` CLI table.

src/core/subsystem/status.rs

@@ -8,7 +8,7 @@
 //!
 //! ## Capabilities cross the wire as opaque strings, never as a typed set
 //!
-//! A memory driver's typed set (`tinycortex_api::capabilities::Capabilities`)
+//! A memory driver's typed set (`crate::openhuman::memory::api::capabilities::Capabilities`)
 //! is a `u16` bitset whose `Deserialize` rejects the **whole** array on a
 //! single unrecognised family string. A driver speaking a newer minor contract
 //! may legitimately advertise a family this build has never heard of, and

src/openhuman/config/schema/load_tests.rs

@@ -813,7 +813,7 @@ fn env_overlay_memory_sync_interval_parses_and_honours_zero() {
 #[test]
 fn env_overlay_subsystems_memory_driver_and_hooks_apply() {
     let mut cfg = Config::default();
-    assert_eq!(cfg.subsystems.memory.driver, "tinycortex");
+    assert_eq!(cfg.subsystems.memory.driver, "tinymemory");
     assert!(cfg.subsystems.memory.hooks.auto_recall);
     assert!(cfg.subsystems.memory.hooks.auto_capture);
     assert_eq!(cfg.subsystems.memory.hooks.max_context_tokens, 2000);