refactor(memory): move safety, memory tools, readers, scheduler gate and importers to tinymemory (wave 4)

[senamakel]

Summary

Vendor-extraction wave 4 moves the remaining generic memory code into tinymemory as new library crates.

crates/openhuman-core/src: 598,594 → 591,238 lines (−7,356).

Stacked on #6830 (memory guard). Merge that first. This diff includes its commits until then.

Depends on:

• refactor(safety): delegate store::safety to the shared tinymemory-safety crate tinycortex#178 (branch w4-memory-rest).
• feat: memory cluster extraction (safety, tools, gate, import, sources) - stacks on #173 tinymemory#174 (branch w4-memory-rest, stacked on feat(docker): Dockerfile, cloud server support, and parallel release pipeline #173). The gitlink is 0f5af00c.

What moved (tinymemory)

1. tinymemory-safety (new crate). One copy of pii, secrets, checksums, patterns and normalize now replaces three: the host's, tinycortex's and tinymemory-core's (through tinycortex). This was a user decision.
   • The copies disagreed on bare Luhn-valid 13–19 digit runs. The crate exposes that as Policy { bare_card }. The default LuhnOnly is the host's stricter behaviour; tinycortex opts into Policy::corroborated() (opencompany#1201). No consumer changes behaviour.
   • Tests from both copies are ported, 157 in total.
2. tinymemory-tools (new crate). It holds 14 memory agent tools: memory_tree and its per-mode tools, raw store, vector/hybrid/chunk-context search, and the tool-memory tools.
   • They sit behind a MemoryToolHost trait (guarded provider, source-scope check, query embedder, ingest_document hook). The host implements it as HostMemoryTools.
   • Names, descriptions, schemas, exposure and permissions are pinned against a JSON fixture captured before the move.
   • Several tools stay in the host because they carry host policy or the host ingest path: memory_store, memory_forget, the collapsed tool, the goals tool and ingest_document.
   • tinymemory now depends on tinytools, which was a user decision. It resolves to the single vendored copy through the root [patch].
3. Source readers → tinymemory-sources. SourceReader takes &Path instead of &Config. tinymemory-core's duplicate readers are removed, so one set remains.
4. Reconcile helpers → tinymemory-sources. This covers apply_caps_defaults_to_entries and composio_upsert_target.
5. Scheduler gate → tinymemory-gate (new crate). It holds sampling, the cached policy, the sampler task, wait_for_capacity and the permit.
   • init_global takes a SchedulerGateConfig, and the env-override names are passed in.
   • starship-battery sits behind tinymemory-gate/battery.
   • The host keeps the singleton, the semaphore, the signed-out override and test isolation.
   • It is not in tinymemory-api, whose manifest forbids an async runtime and native probes.
6. OpenClaw/Hermes memory importers → tinymemory-import (new crate).
   • It takes the workspace path plus an open_target closure. The closure runs after the backup, so a null driver is refused at the same point as before.
   • The host keeps target_memory_backend and the RPC surface.

The goals has_goal_pii/validate_goal_text stay in the host, which the goals contract documents as host policy.

Pins and CI

• tinymemory exemption: expect is v1.18.0-52-g0f5af00c. check-module-pins shows no tinymemory failure; the other modules' failures already exist on main.
• ignored-test-baseline.json: lowered, because 13 core #[ignore] tests moved.
• Lockfiles: only the new crates were added, to the root and app lockfiles.

Verification

• Vendor:
  • tinymemory default members pass fmt, clippy -D warnings and tests. tinymemory-module still builds.
  • tinycortex: 1,203 tests pass, and clippy is clean.
• OpenHuman:
  • Every test target builds with product features. The embed and tinyhumans tests and the app manifest also build.
  • Full lib suite: 9,600 passed and 2 failed. Both failures are known on base: credential_scrub::browser_confirmation_token_survives_without_exempting_page_credentials and the flaky composio connected_integrations_cache_is_keyed_per_credential.
  • The moved reader raw-coverage tests pass.
• CI scripts:
  • Feature forwarding, the gated-test allowlist and submodule monotonic pass.
  • rust:layout and the runtime-boundary check fail only on the entries already failing on base.
• Not run: json_rpc_e2e and the memory-module e2e suites, which need a built module.

Summary by CodeRabbit

• Changes
  • Memory and search tools now use consolidated shared implementations; the existing registered tool set remains available, except the former walk and smart_walk tools.
  • Memory safety uses the default strict scrubbing policy, which redacts Luhn-valid 13–19 digit number sequences.
  • Memory source readers, migration, and scheduler-gate behavior have been consolidated without other documented user-facing behavior changes.