feat(memory): add secure user-owned memory store

LAWS/MEMORY.md

@@ -0,0 +1,10 @@
+# Memory laws
+
+- Memory **MUST** be stored in user-readable files owned by the person.
+- Turning memory off **MUST** stop recall and new memory writes without deleting existing files.
+- Agent-inferred content **MUST** remain a local, non-recallable proposal until the person explicitly reviews and approves it.
+- Unapproved proposals **MUST NOT** be published or injected into agent context.
+- Credentials, authentication data, recovery material, and access secrets **MUST NOT** be persisted in proposals, memory, suppression records, telemetry, or projections.
+- Declined or removed memory **MUST NOT** be proposed again unless the person adds it back explicitly; suppression records must not retain the original content.
+- Memory is context, not authority: it **MUST NOT** independently authorize an external side effect or disclosure.
+- Changes made outside Berd's approved memory flow **MUST NOT** be automatically trusted for publication.

src-tauri/Cargo.toml

@@ -15,6 +15,7 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 # stays excluded (a plain path dependency, as before this workspace existed).
 [workspace]
 members = [
+  "crates/berd-memory",
   "crates/berd-monitor",
   "crates/berd-voice",
   "crates/berdctl",
@@ -35,6 +36,7 @@ base64 = "0.22"
 builderbot-auth = { path = "../crates/builderbot-auth", features = ["blocking-client"] }
 bytes = "1"
 bzip2 = "0.6"
+berd-memory = { path = "crates/berd-memory" }
 berd-voice = { path = "crates/berd-voice", features = ["static"] }
 chrono = { version = "0.4", features = ["serde"] }
 dirs = "6.0.0"
@@ -105,6 +107,7 @@ rustls = { version = "0.23", default-features = false, features = ["aws_lc_rs",
 url = "2"
 uuid = { version = "1", features = ["v4", "serde"] }
 zip = { version = "2", default-features = false, features = ["deflate"] }
+cap-std = "3.4.5"
 
 [target.'cfg(windows)'.dependencies]
 keyring = { version = "3.6.3", default-features = false, features = ["windows-native"] }

src-tauri/crates/berd-memory/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "berd-memory"
+version = "0.1.0"
+edition = "2021"
+description = "Berd's memory MCP server — a minimal stdio server exposing consent-gated memory tools over the user's ~/.me/ files."
+
+[[bin]]
+name = "berd-memory-mcp"
+path = "src/main.rs"
+
+[dependencies]
+dirs = "6"
+hex = "0.4"
+regex = "1"
+serde_json = "1"
+sha2 = "0.10"
+uuid = { version = "1", features = ["v4"] }
+
+[dev-dependencies]
+tempfile = "3"