Execute connector processing and trigger archives through released TinyBus module

.github/ci-paths-filter.yml

@@ -143,6 +143,8 @@ scripts:
   - '.github/workflows/ci-*.yml'
   - '.github/ci-paths-filter.yml'
   - 'scripts/ci/self-hosted/**'
+  - 'scripts/ci/check-module-boundaries.mjs'
+  - 'scripts/ci/module-boundaries.json'
   - 'scripts/mock-api/**'
   - 'scripts/*.mjs'
   - 'scripts/__tests__/**'

AGENTS.md

@@ -521,6 +521,8 @@ builds after changing a gate. Use `scripts/assert-shed.sh` or
 
 ## Loadable modules and bus contracts
 
+Hosts must interface with loadable components through their minimal `*-bus` contracts. Never import, re-export, link, or call their implementation libraries directly, including through wrapper crates or indirect dependencies. Execute component behavior through the compiled TinyBus module. If the required types or operations are missing, extend the contract and implementation in the owning repository and raise a PR against its canonical upstream first; then consume the released module and update OpenHuman’s gitlink and adapter. Do not introduce a host-side implementation workaround.
+
 ### Submodule ownership
 
 OpenHuman is the host and orchestrator for these components. It composes them,
@@ -601,7 +603,8 @@ Rules:
 - Never redeclare a contract type in OpenHuman.
 - Call members through contract constants, not string literals.
 - Contract crates stay synchronous and free of I/O and runtime dependencies.
-- Shared wire behavior belongs in the contract. Runtime, config, and security
+- Shared wire vocabulary belongs in the contract. Component algorithms execute
+  in the compiled module. Runtime, config, and security
   policy stay in the host.
 - Test the handwritten registry metadata against each contract's bus name and
   object path.

crates/openhuman-core/Cargo.toml

@@ -230,14 +230,7 @@ tinymemory-integrations = { path = "../../vendor/tinymemory/crates/tinymemory-in
 # of it.
 #
 tinyconnectors-bus = { path = "../../vendor/tinyconnectors/crates/tinyconnectors-bus" }
-# tinyconnectors — the connector module's implementation crate, linked as a
-# plain Rust library (never as the loaded module) for its pure, host-agnostic
-# helpers: failure classification, action-argument preparation, the daily
-# trigger archive, calendar defaults and the task-recency window.
-# `default-features = false` drops the `module` feature, so no TinyBus adapter or
-# ABI export is compiled into the host (and no second copy of `tinybus` enters
-# the graph). Live connector calls still go over the bus to the loaded module.
-tinyconnectors = { path = "../../vendor/tinyconnectors/crates/tinyconnectors", default-features = false }
+
 
 
 # tinymcp — the Model Context Protocol client, extracted out of this tree
@@ -320,7 +313,9 @@ tinychannels = { version = "0.1", features = ["relay-websocket"], optional = tru
 # never loads a module. The kernel-floor ratchet catches exactly that, and did.
 tinybus = { path = "../../vendor/tinybus/crates/tinybus", default-features = false, features = ["macros", "uds"] }
 tinysearch-bus = { path = "../../vendor/tinysearch/crates/tinysearch-bus" }
-tinycomputer-bus = { path = "../../vendor/tinycomputer/crates/tinycomputer-bus", optional = true }
+# Registry vocabulary is available even when the loader is disabled, so the
+# pre-core client can identify and report an unavailable module safely.
+tinycomputer-bus = { path = "../../vendor/tinycomputer/crates/tinycomputer-bus" }
 # Desktop accessibility middleware, linked as a plain library (not through the
 # tinycomputer module): the voice pipeline needs focus lookup, paste validation,
 # permission checks and the Globe key synchronously and in-process. Deps are
@@ -831,7 +826,7 @@ tinymemes = ["dep:tinymemes"]
 # A loaded module is trusted in-process code with this process's privileges, and
 # tinybus never unloads one. See `crates/openhuman-core/src/modules/` before adding an entry
 # to the registry.
-modules = ["tinybus/modules", "dep:tinycomputer-bus"]
+modules = ["tinybus/modules"]
 # Voice + audio_toolkit domains: STT/TTS providers, the standalone dictation
 # server, always-on listening, and podcast audio generation/email delivery.
 # Default-ON — the desktop app always ships with voice. Slim / headless builds
@@ -952,7 +947,7 @@ media = ["tinyagents-harness/media"]
 # runtime `DomainSet::flows` flag (#4796): the feature narrows the compile-time
 # surface, `DomainSet` gates it at runtime.
 # NOTE: this gate does NOT drop `tinyagents` itself — 26+ domains consume it.
-flows = ["dep:tinyflows", "dep:tinyflows-catalog", "dep:tinyflows-copilot", "tinyflows-drivers/catalog", "tinyflows-sqlite/catalog"]
+flows = ["modules", "dep:tinyflows", "dep:tinyflows-catalog", "dep:tinyflows-copilot", "tinyflows-drivers/catalog", "tinyflows-sqlite/catalog"]
 # Skills domains: `openhuman::skills` (metadata/discovery/install),
 # `openhuman::skill_runtime` (SKILL.md execution + the skill_executor agent),
 # and `openhuman::skill_registry` (remote catalogs + the skill_setup agent).

crates/openhuman-core/src/agent/harness/task_recency_context.rs

@@ -6,7 +6,7 @@
 //! concept. `CURRENT_AGENT_SANDBOX_MODE` carries the calling agent's sandbox
 //! mode; [`TASK_RECENCY_WINDOW`] carries an optional "only data newer than
 //! `now - window`" hint that the `composio_execute` handler applies to a
-//! curated set of task-fetch slugs (see `tinyconnectors::execute::apply_window_args`).
+//! curated set of task-fetch slugs (see `tinyconnectors-bus::PrepareArguments`).
 //!
 //! Why a task-local instead of a `Tool::execute` argument: the tool trait is
 //! invoked from many call sites (CLI, JSON-RPC, tests, agent loops). A