memhouse 0.7.0 → 0.8.0

package/README.md

@@ -36,6 +36,13 @@ makes it worse — [EACCES on install](#eacces-on-install) tells them apart.
 memhouse deploy --local      # a loopback-bound ClickHouse, then install and ship
 ```
 
+The house it stands up is **yours by name**: its superuser defaults to your OS
+username (`polat`, not `memhouse_root` — override with `--user`), and the house
+database defaults to the same name, so your memory lives at `polat.messages` and
+`WHERE user_id = 'polat'` reads like it should. The name
+and password are fixed when the data volume is first initialised, like any ClickHouse
+container, and reused on every redeploy after that.
+
 Otherwise point at one you already run, or hand the SQL to whoever administers it:
 
 ```bash
@@ -157,19 +164,30 @@ immediate.
 
 ## How your memory is stored
 
-**One house, one set of rooms per member.** You own `sessions_<you>`,
-`messages_<you>`, `tool_calls_<you>` in the `mem` database, and hold grants on
-those and nothing else. Isolation is a grant that is simply *absent*, so it fails
-closed — no row policy that has to be right on every table and every read path.
+**A house is a database; its rooms are three shared tables.** `sessions`, `messages`
+and `tool_calls` live in whatever database you point at — your own name by default
+(`polat.messages`), a team's (`team_a.messages`), even `default`. Everyone in the
+house writes into the same tables with their own credential, and every row says where
+it came from: `user_id`, stamped by the server (`MATERIALIZED currentUser()`, with
+async inserts pinned off so the stamp cannot be skipped), and `host`, the machine's
+install fingerprint.
+
+`WHERE user_id = 'alice'` is one person. `WHERE host = '…'` is one machine. No filter
+is the whole house — which is exactly what a team dashboard wants.
 
-All of *your* machines ship into *your* rooms; the `host` column tells them apart.
-Another member's machines never do. A team-wide read is a `Merge` room
-(`all_sessions`) plus a `GRANT`, which narrows to whatever the caller can already
-see. Sharing a whole room needs no operator.
+Sharing is not a feature bolted on top; it IS the house. A team makes a database,
+grants each person `ALL` on it, and their shippers all write into the same rooms:
+
+```sql
+CREATE DATABASE team_a;
+CREATE USER alice IDENTIFIED BY '…';
+GRANT ALL ON team_a.* TO alice;    -- repeat per housemate
+```
 
-The member name comes from the server — `SELECT currentUser()` — not from your
-config. A client that could name its own member could write into someone else's
-rooms.
+`ALL` on your own house reaches nothing outside it — the database is the boundary,
+which is also why joining a ClickHouse someone else runs (a kernel's, a team's) needs
+no negotiation beyond a database and a credential. Housemates are collaborators;
+groups that should not see each other get separate houses.
 
 ### Imported history is protected
 

package/bin/memhouse.js

@@ -23,7 +23,7 @@ const SHIP_JS = path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js');
 const SERVER_JS = path.join(REPO_ROOT, 'memhouse', 'server', 'server.js');
 const DELIVERY = path.join(REPO_ROOT, 'memhouse', 'delivery');
 const PKG = require(path.join(REPO_ROOT, 'package.json'));
-const { roomNames, ROOM_TYPES, mergeRooms, MEMBER_PRIVS, MEMBER_PROFILE, MEMBER_PROFILE_SETTINGS, installCommand } = require(path.join(REPO_ROOT, 'memhouse', 'per-member', 'rooms'));
+const { roomNames, ROOM_TYPES, MEMBER_PIN, installCommand } = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
 const envfile = require(path.join(REPO_ROOT, 'memhouse', 'envfile'));
 
 const HOME_DIR = process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse');
@@ -65,7 +65,10 @@ function resolveConfig() {
     url: pick('url', 'MEMHOUSE_URL', 'http://localhost:8123'),
     user: pick('user', 'MEMHOUSE_USER', 'memhouse_root'),
     password: pick('password', 'MEMHOUSE_PASSWORD', ''),
-    db: pick('db', 'MEMHOUSE_DB', 'mem'),
+    // The house defaults to the USER'S OWN NAME (`polat` ships into `polat.messages`),
+    // because a house is a database and the natural first house is your own. Any name
+    // works — user 'alice' with house 'default' is a supported pairing.
+    db: pick('db', 'MEMHOUSE_DB', pick('user', 'MEMHOUSE_USER', 'memhouse_root')),
     port: pick('port', 'MEMHOUSE_PORT', '4640'),
     // Did anything actually SAY which house this is, or are the values above just the
     // defaults? The defaults are not neutral — localhost:8123 as memhouse_root is a real
@@ -600,38 +603,20 @@ function generatePassword() {
  * same templates provision.js applies, so the two cannot drift into different houses.
  */
 function memberSql(db, member, password) {
-  const here = path.join(REPO_ROOT, 'memhouse', 'per-member');
-  // The templates are written unqualified because provision.js applies them with the
-  // house already selected. A human pastes this somewhere unknown — clickhouse-client,
-  // the play UI, curl — so every name is qualified here and there is no `USE`.
-  //
-  // `currentDatabase()` in the Merge engine is the trap, and it is silent:
-  // it is evaluated at CREATE time, not at read time, so a block run without the house
-  // selected builds Merge rooms pointing at `default` that return zero rows forever. The
-  // literal name goes in instead.
+  // The template is written unqualified because the shipper applies it with the house
+  // already selected. A human pastes this somewhere unknown — clickhouse-client, the
+  // play UI, curl — so every name is qualified here and there is no `USE`.
   const qualify = (sql) => sql
-    .replace(/CREATE TABLE IF NOT EXISTS (\w+)/g, `CREATE TABLE IF NOT EXISTS ${db}.$1`)
-    .replace(/ AS (\w+)\nENGINE = Merge/g, ` AS ${db}.$1\nENGINE = Merge`)
-    .replace(/Merge\(currentDatabase\(\)/g, `Merge('${db}'`);
-  const rooms = qualify(fs.readFileSync(path.join(here, 'schema-member.sql.tpl'), 'utf-8')
-    .replaceAll('{{MEMBER}}', member));
-  const merge = qualify(fs.readFileSync(path.join(here, 'schema-merge.sql.tpl'), 'utf-8')
-    .replaceAll('{{TEMPLATE_MEMBER}}', member));
-  // The SAME grant set provision.js issues. These two paths build the same house, and when
-  // only one of them was narrowed, `install --print-sql` — the path INSTALL.md calls the
-  // common case — still emitted GRANT ALL, which includes CREATE TABLE on the member's own
-  // room name. A member provisioned that way could drop their room, recreate it as
-  // Merge('<db>','^messages_'), and double every other member's rows in the team room:
-  // exactly the attack the narrowing was for, fully reachable, one release later.
-  const grants = ROOM_TYPES.flatMap((t) => [
-    `GRANT ${MEMBER_PRIVS} ON ${db}.${t}_${member} TO ${member};`,
-    `GRANT SELECT ON ${db}.${t}_${member} TO ${member} WITH GRANT OPTION;`,
-  ]).join('\n');
-  const mergeGrants = Object.values(mergeRooms())
-    .map((n) => `GRANT SELECT ON ${db}.${n} TO ${member};`).join('\n');
+    .replace(/CREATE TABLE IF NOT EXISTS (\w+)/g, `CREATE TABLE IF NOT EXISTS ${db}.$1`);
+  const rooms = qualify(fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl'), 'utf-8'));
   return `-- memhouse: everything '${member}' needs in house '${db}'. Run as a user with
 -- ACCESS MANAGEMENT (a stock 'default' with access_management=1 will do).
 --
+-- A house is a database; its rooms are three shared tables. Everyone granted on the
+-- database writes into the same tables, and every row carries who (user_id, stamped by
+-- the server) and where from (host, the install's fingerprint). Adding a housemate later
+-- is the same two statements: CREATE USER, GRANT ALL ON the house.
+--
 -- Every name is qualified and there is no USE, so this runs anywhere: clickhouse-client,
 -- the play UI, curl, a GUI. Order matters only in that the database comes first.
 --
@@ -655,26 +640,16 @@ CREATE USER IF NOT EXISTS ${member} IDENTIFIED BY '${password.replace(/'/g, "\\'
 
 ${rooms.trim()}
 
--- Exactly what the shipper uses, and nothing that defines an object: no CREATE TABLE, no
--- DROP, no TRUNCATE. A member who owned the room NAME rather than its data could replace
--- it with a Merge over every member's rooms and double their rows in the team room.
--- Only SELECT is re-grantable, so a share can only ever be read-only.
-${grants}
-
--- Team-wide reads. A Merge room reduces to the rooms the CALLER holds grants for, so
--- this narrows rather than denies, and picks up members added later with no DDL.
-${merge.trim()}
-
-${mergeGrants}
-
--- Resource ceilings. Confidentiality isolation is a grant that is absent; this is the
--- availability half, and it did not exist until 0.4.7 — a member could raise
--- max_memory_usage, zero max_execution_time and take a shared server down for everyone.
--- CONST, not MAX: a plain default is advisory, and MAX is not enough either because 0 means
--- UNLIMITED in ClickHouse and 0 satisfies any MAX. Measured — with a MAX ceiling in force,
--- SETTINGS max_memory_usage = 0 was accepted and the ceiling was gone.
-CREATE SETTINGS PROFILE OR REPLACE ${MEMBER_PROFILE} SETTINGS ${MEMBER_PROFILE_SETTINGS};
-ALTER USER ${member} SETTINGS PROFILE '${MEMBER_PROFILE}';
+-- The whole database. ALL on your own house reaches nothing outside it — the database is
+-- the boundary — and it is what lets the shipper create and evolve its own tables.
+GRANT ALL ON ${db}.* TO ${member};
+
+-- Pin async_insert on the user (ADD SETTING merges; a bare SETTINGS clause would replace
+-- the user's whole list). The pin keeps the user_id stamp honest: a MATERIALIZED
+-- currentUser() is computed during the INSERT, and an async flush stores it as the empty
+-- string. CONST refuses the override; a client that never mentions the setting is held
+-- at 0 and its insert lands stamped.
+ALTER USER ${member} ADD SETTING ${MEMBER_PIN};
 `;
 }
 
@@ -702,22 +677,19 @@ async function adminBootstrap(cfg, admin) {
     catch { console.log(bad(`house '${cfg.db}' does not exist and '${admin.user}' cannot create it: ${e.message}`)); return null; }
   }
 
-  // 2. the user. An EXISTING user is refused: adopting one silently hands the second
-  // human the first's identity and rooms, and user_id MATERIALIZED currentUser() would
-  // stamp them identically, so nothing downstream would ever notice.
-  // A member who passes --admin-user gets ACCESS_DENIED here, because no member holds
-  // SELECT ON system.users. That is the isolation working — but the raw 497 names neither
-  // side, while INSTALL.md promises install "refuses, names both sides, and creates
-  // nothing". Say who you are not, and what the owner has to run instead.
+  // 2. the user. A shared house makes an existing user unremarkable — rows are told apart
+  // by the server-stamped user_id, so "the handle is taken" hands nobody anything. What
+  // still matters is proof: connecting AS the member below is what validates whichever
+  // password is in play, existing user or fresh one.
   let exists;
   try {
     exists = (await chRows(adminCfg, `SELECT name FROM system.users WHERE name = '${admin.member}'`, { database: '' })).length > 0;
   } catch (e) {
     if (/Not enough privileges|ACCESS_DENIED|system\.users/i.test(e.message || '')) {
       console.log(bad(`'${admin.user}' is not an admin of this house — it cannot read system.users, so it cannot provision a member`));
-      console.log('  Adding a member is the house owner\'s job. Ask them for:');
-      console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member ${admin.member} --merge`);
-      console.log('  If you already HAVE a member credential on this house, you do not need admin:');
+      console.log('  Joining a house is two statements for whoever owns it:');
+      console.log(`     CREATE USER ${admin.member} IDENTIFIED BY '…';  GRANT ALL ON ${cfg.db}.* TO ${admin.member};`);
+      console.log('  If you already HAVE a credential on this house, you do not need admin:');
       console.log(`     memhouse install --url ${adminCfg.url} --user ${admin.member} --password …`);
       return null;
     }
@@ -725,19 +697,14 @@ async function adminBootstrap(cfg, admin) {
   }
   let password = flags['member-password'] || null;
   if (exists) {
-    if (flags['adopt-user'] !== true) {
-      console.log(bad(`ClickHouse user '${admin.member}' already exists in this house.`));
-      console.log('  Creating rooms for them would hand you their identity — user_id is stamped from');
-      console.log('  currentUser(), so their rows and yours would be indistinguishable.');
-      console.log('  If this is you on a new machine, prove it:');
-      console.log(`     memhouse install --adopt-user --member ${admin.member} --member-password '…' …`);
-      console.log(`  If it is someone else, pick another handle:  --member <name>`);
+    if (!password) {
+      console.log(bad(`ClickHouse user '${admin.member}' already exists — pass --member-password to install as them.`));
+      console.log(`  Or pick another handle:  --member <name>`);
       return null;
     }
-    if (!password) { console.log(bad('--adopt-user requires --member-password — the password is the proof')); return null; }
     try { await ch({ ...cfg, user: admin.member, password }, 'SELECT 1', { database: '' }); }
-    catch { console.log(bad(`--adopt-user: '${admin.member}' did not authenticate with that password`)); return null; }
-    console.log(ok(`adopted existing user '${admin.member}' (password verified)`));
+    catch { console.log(bad(`'${admin.member}' did not authenticate with that password`)); return null; }
+    console.log(ok(`using the existing ClickHouse user '${admin.member}' (password verified)`));
   } else {
     if (!password) {
       password = generatePassword();
@@ -753,24 +720,18 @@ async function adminBootstrap(cfg, admin) {
     createdUser = admin.member;
   }
 
-  // 3. rooms, 4. grants, 5. Merge rooms + their grant — provision.js owns all of it, so
-  // there is one implementation of the grant set rather than two that drift.
-  const provision = path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js');
-  const rc = spawnSync(process.execPath, [provision, '--member', admin.member, '--merge'], {
-    stdio: 'inherit',
-    env: { ...process.env, MEM_URL: cfg.url, MEM_USER: admin.user, MEM_PASSWORD: admin.password, MEM_DB: cfg.db },
-  });
-  if (rc.status !== 0) {
-    // "nothing was written" was a lie whenever the CREATE USER above had already run —
-    // and it runs before this. Observed: provision.js died on a missing dependency, this
-    // printed the all-clear, and the next install refused with the identity-takeover
-    // message because the user it said it had not created was there. Say what exists, and
-    // name the two ways forward.
-    console.log(bad('provisioning failed'));
+  // 3. the grant and the pin. GRANT ALL on the house is the whole tenancy model: it
+  // reaches nothing outside the database, and it is what lets the member's own shipper
+  // create and evolve the rooms (--ensure-schema below).
+  try {
+    await q(`GRANT ALL ON ${cfg.db}.* TO ${admin.member}`, { database: '' });
+    await q(`ALTER USER ${admin.member} ADD SETTING ${MEMBER_PIN}`, { database: '' });
+    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', async_insert pinned`));
+  } catch (e) {
+    console.log(bad(`could not grant the house to '${admin.member}': ${e.message}`));
     if (createdUser) {
-      console.log(`  ClickHouse user '${createdUser}' WAS created before this failed; its rooms were not.`);
-      console.log('  Nothing was written to disk. To continue once the cause is fixed:');
-      console.log(`     memhouse install --adopt-user --member ${createdUser} --member-password '<the password above>' …`);
+      console.log(`  ClickHouse user '${createdUser}' WAS created before this failed.`);
+      console.log(`  Continue once fixed:  memhouse install --member ${createdUser} --member-password '<the password above>' …`);
       console.log(`  Or undo it as the admin:  DROP USER ${createdUser}`);
     } else {
       console.log('  nothing was written');
@@ -779,11 +740,15 @@ async function adminBootstrap(cfg, admin) {
   }
 
   // The step that makes this trustworthy: stop being admin, and prove the credential we
-  // are about to persist actually reaches the rooms.
+  // are about to persist can build and reach the rooms itself.
   const memberCfg = { ...cfg, user: admin.member, password };
+  if (run(SHIP_JS, ['--ensure-schema'], memberCfg) !== 0) {
+    console.log(bad(`'${admin.member}' could not create the rooms in '${cfg.db}' — nothing written to disk`));
+    return null;
+  }
   try {
-    const seen = await chRows(memberCfg, `SELECT count() AS n FROM system.tables WHERE database = '${cfg.db}' AND name IN ('sessions_${admin.member}','messages_${admin.member}','tool_calls_${admin.member}')`, { database: '' });
-    if (Number(seen[0]?.n) !== 3) { console.log(bad(`'${admin.member}' cannot see all three of their rooms — nothing written`)); return null; }
+    const seen = await chRows(memberCfg, `SELECT count() AS n FROM system.tables WHERE database = '${cfg.db}' AND name IN ('sessions','messages','tool_calls')`, { database: '' });
+    if (Number(seen[0]?.n) !== 3) { console.log(bad(`'${admin.member}' cannot see the three rooms — nothing written`)); return null; }
   } catch (e) { console.log(bad(`'${admin.member}' could not connect after provisioning: ${e.message}`)); return null; }
   console.log(ok(`verified as '${admin.member}' — admin credential discarded, not stored`));
   return memberCfg;
@@ -841,6 +806,16 @@ async function cmdInstall({ interactive }) {
   let cfg = resolveConfig();
   const adminUser = flags['admin-user'];
 
+  // The house name is spliced unquoted into CREATE DATABASE and GRANT ALL ON <db>.* —
+  // validate it HERE, on every install mode, not only where deploy happens to choose it.
+  // Found by the acceptance run, driven end to end: `install --db system` sailed through,
+  // granted a member CHECK/SHOW/SELECT/INSERT/ALTER/DROP/TRUNCATE/… ON system.* and
+  // created sessions/messages/tool_calls INSIDE the server's system database, exit 0.
+  // On a shared or kernel ClickHouse that is a granted-everything-on-system user minted
+  // by a memhouse one-liner.
+  try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(cfg.db, 'house'); }
+  catch (e) { console.log(bad(e.message)); return 1; }
+
   // Option 1 — print the SQL and stop. For the common case: you have admin on this
   // ClickHouse and would rather run four statements yourself than hand a credential to an
   // installer. Nothing is written and nothing is contacted.
@@ -879,7 +854,7 @@ async function cmdInstall({ interactive }) {
   if (keyProblem) {
     console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
     console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
-    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}, then: memhouse ship --full`);
+    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl')}, then: memhouse ship --full`);
     console.log('  no config was written — nothing here reads as installed.');
     return 1;
   }
@@ -893,8 +868,8 @@ async function cmdInstall({ interactive }) {
     }
     if (flags['no-ship'] !== true && run(SHIP_JS, [], cfg) !== 0) return 1;
     console.log(ok('installed — next: memhouse start   (dashboard + shipper loop)'));
-    console.log('  admin is needed again only for: a second member, or an ADD COLUMN rollout.');
-    console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member <name> --merge`);
+    console.log('  adding a housemate later is two statements for the admin:');
+    console.log(`     CREATE USER <name> IDENTIFIED BY '…';  GRANT ALL ON ${cfg.db}.* TO <name>;`);
     return 0;
   }
 
@@ -903,7 +878,7 @@ async function cmdInstall({ interactive }) {
   // authenticating as memhouse_root instead: the three flags did nothing, --yes satisfied
   // haveAll so no prompt asked who you were, and resolveConfig's default was used AS A
   // CREDENTIAL. Refuse rather than do something else silently.
-  const adminOnly = ['adopt-user', 'member', 'member-password'].filter((k) => flags[k] !== undefined);
+  const adminOnly = ['member', 'member-password'].filter((k) => flags[k] !== undefined);
   if (!adminUser && adminOnly.length) {
     console.log(bad(`--${adminOnly.join(', --')} ${adminOnly.length > 1 ? 'are' : 'is'} only read with --admin-user`));
     console.log('  Those flags provision a member, which needs house admin. Without them this');
@@ -1016,7 +991,7 @@ async function cmdInstall({ interactive }) {
   if (keyProblem) {
     console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
     console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
-    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}, then: memhouse ship --full`);
+    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl')}, then: memhouse ship --full`);
     console.log('  no config was written — nothing here reads as installed.');
     return 1;
   }
@@ -1306,7 +1281,7 @@ async function cmdDoctor() {
       add(t === objects.length, t === objects.length
         ? `schema: 3/3 rooms in '${cfg.db}' (${objects.join(', ')})`
         : `schema: ${t}/${objects.length} rooms in '${cfg.db}' — missing ${absent.join(', ')}`,
-        `run: memhouse install, or as the owner: node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member ${rooms.member}`);
+        `run: memhouse install — with ALL on the house, ship --ensure-schema builds them`);
     } catch (e) { add(false, 'schema check', `${e.message} — run: memhouse install`); }
     // Columns, not just rooms. A room with a column missing accepts every insert and
     // discards that field — measured, 85 rows shipped with the value thrown away while
@@ -1314,7 +1289,7 @@ async function cmdDoctor() {
     // counted rooms.
     try {
       const { templateColumns } = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js'));
-      const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl'), 'utf-8');
+      const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl'), 'utf-8');
       const want = templateColumns(tpl);
       // Names AND types AND the MATERIALIZED kind. Comparing names alone left every other
       // kind of drift invisible, with measured consequences: a `UInt64` column narrowed to
@@ -1379,7 +1354,7 @@ async function cmdDoctor() {
         add(false, `sorting keys: only ${checked}/${ROOM_TYPES.length} rooms are MergeTree — the rest have no sorting key at all`,
           'a room was replaced by a Merge/View/Log engine; rebuild it from the schema template as the house owner');
       } else add(wrongKeys.length === 0, `sorting keys${wrongKeys.length ? `: wrong on ${wrongKeys.join(', ')}` : ` carry origin correctly (${checked}/${ROOM_TYPES.length} rooms)`}`,
-        `rebuild those rooms from the schema template, then: memhouse ship --full\n     template: ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}`);
+        `rebuild those rooms from the schema template, then: memhouse ship --full\n     template: ${path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl')}`);
     } catch (e) { add(false, 'sorting keys', e.message); }
     try {
       // countIf, not any(). `any()` returns an arbitrary row's value, so on a house with
@@ -1917,8 +1892,8 @@ async function cmdReset() {
   } catch { /* pre-origin house: nothing to protect, ensureSchema will add the column */ }
 
   if (flags.yes !== true) {
-    // Name the rooms. Under the per-member layout this only ever empties the caller's own,
-    // and "ALL rows in 'mem'" would misdescribe that in the alarming direction.
+    // Name the rooms, and the scope honestly: the tables are shared, but reset only ever
+    // deletes rows whose user_id is the CALLER's — a housemate's rows are untouched.
     const scope = allOrigins
       ? `EVERY row, including ${imported} imported one(s) that re-shipping CANNOT restore,`
       : 'the rows the shipper wrote';
@@ -2257,10 +2232,43 @@ async function cmdUninstall() {
           : process.env.MEMHOUSE_PASSWORD ? 'MEMHOUSE_PASSWORD' : null;
       if (initialised && rotateAsk) {
         console.log(bad(`${rotateAsk} cannot change the credential of an existing house — the image only applies it when it initialises the data directory.`));
-        console.log('  to rotate:   ALTER USER memhouse_root IDENTIFIED BY \'…\' inside the house, then: memhouse setup --password …');
+        console.log(`  to rotate:   ALTER USER ${priorCfg.user || 'memhouse_root'} IDENTIFIED BY '…' inside the house, then: memhouse setup --password …`);
         console.log('  to start over (DESTROYS the memory):  memhouse deploy --down');
         process.exitCode = 2; break;
       }
+      // Who owns this house. A local deploy is the pilot's own machine and their own
+      // memory, so the house user is THEM — suggested from the OS username (`polat`, not
+      // `memhouse_root`) — created by the container itself at first init with full
+      // rights. No admin/member split, no provisioning dance: a URI and a credential is
+      // the whole install. The name is fixed at volume init exactly like the password,
+      // so an existing house keeps the user it was born with.
+      const osName = (os.userInfo().username || '').replace(/[^A-Za-z0-9_]/g, '_').replace(/^[0-9_]+/, '');
+      let houseUser;
+      if (initialised) {
+        // The env FILE, not resolveConfig(): flags outrank the file there, so comparing
+        // `--user other` against priorCfg.user compares the flag against itself and the
+        // refusal below can never fire — while the volume stays initialised with the
+        // original name and every later connection fails auth.
+        const storedUser = readEnvFile().MEMHOUSE_USER;
+        // No stored user means the env file is gone or emptied — the stored PASSWORD is
+        // gone with it, so the `initialised && !reusable` refusal below already owns this
+        // case. Refusing `--user` here on a guessed 'memhouse_root' would tell the pilot
+        // their house "was initialised with memhouse_root" on no evidence at all.
+        if (storedUser && flags.user && flags.user !== true && flags.user !== storedUser) {
+          console.log(bad(`--user cannot rename the user of an existing house — the image creates it only when it initialises the data directory.`));
+          console.log(`  this house was initialised with '${storedUser}'. To start over (DESTROYS the memory):  memhouse deploy --down`);
+          process.exitCode = 2; break;
+        }
+        houseUser = storedUser || 'memhouse_root';
+      } else if (flags.user && flags.user !== true) {
+        houseUser = String(flags.user);
+      } else if (flags.yes !== true && process.stdin.isTTY) {
+        houseUser = (await ask(`House user (this becomes your member name)`, osName || 'memhouse_root')).trim() || osName || 'memhouse_root';
+      } else {
+        houseUser = osName || 'memhouse_root';
+      }
+      try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(houseUser, 'house user'); }
+      catch (e) { console.log(bad(`'${houseUser}' cannot be the house user — ${e.message}`)); process.exitCode = 2; break; }
       // An initialised volume with no credential to reuse — env file deleted, emptied, or
       // never written — is the same lockout by another route: a generated password would
       // be ignored by the server and then written over the config as if it worked.
@@ -2287,7 +2295,17 @@ async function cmdUninstall() {
       const tag = flags.tag || process.env.MEMHOUSE_CH_TAG || dep.managedTag() || dep.DEFAULT_TAG;
       // The database is part of the destination, not a detail of it — see the service
       // check below, which must compare it.
-      const targetDb = flags.db || process.env.MEMHOUSE_DB || priorCfg.db || 'mem';
+      // STATED sources only, then the house user. priorCfg.db is unusable here: resolveConfig
+      // computes a DEFAULT for it (the user's name, itself defaulted), so going through it
+      // handed a fresh deploy `memhouse_root` as the house name while the superuser was
+      // 'polat' — the memory would live in a database named after a role account nobody
+      // chose.
+      const targetDb = flags.db || process.env.MEMHOUSE_DB || readEnvFile().MEMHOUSE_DB || houseUser;
+      // Same check install runs, but EARLY — deploy initialises the container volume and
+      // writes the env file before its install step, so a refusal that waits for install
+      // arrives after the damage.
+      try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(targetDb, 'house'); }
+      catch (e) { console.log(bad(e.message)); process.exitCode = 2; break; }
       {
         // A service-managed shipper keeps the environment it was installed with, so ANY
         // switch that repoints the config leaves it shipping somewhere else — not only an
@@ -2341,7 +2359,7 @@ async function cmdUninstall() {
       }
       const pw = reusable || crypto.randomBytes(16).toString('hex');
       if (reusable) console.log(ok('reusing the existing house credential (its data volume is already initialised)'));
-      const r = dep.up({ password: pw, port, tag });
+      const r = dep.up({ password: pw, port, tag, user: houseUser });
       if (!r.ok) { console.log(bad(r.msg)); process.exitCode = 1; break; }
       console.log(ok(`ClickHouse starting via ${r.engine} on ${r.url} (loopback only)`));
 
@@ -2353,7 +2371,10 @@ async function cmdUninstall() {
       // house that eventually came up is unreachable forever. The image applies the
       // password only at first init, so there is no way back from that.
       if (!reusable) {
-        writeEnvFile({ ...priorCfg, url: r.url, user: 'memhouse_root', password: pw });
+        // db INCLUDED: this file is read back by the install below, and writing
+        // priorCfg's computed default here made that install refuse over a mismatch
+        // with a file this same command had just written.
+        writeEnvFile({ ...priorCfg, url: r.url, user: houseUser, password: pw, db: targetDb });
         console.log(ok(`credential saved to ${ENV_FILE} before waiting — the volume is initialised with it`));
       }
 
@@ -2403,10 +2424,10 @@ async function cmdUninstall() {
       // anticipates it) and it is NOT the narrow set INSTALL.md's grant-set argument
       // describes. A user who later adds a second member should know which house they
       // have.
-      console.log(warn(`this house is yours alone: '${'memhouse_root'}' is its superuser, and that is the credential being saved`));
-      console.log('  Adding a second person later? Give them their own member instead:');
-      console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member <name> --merge`);
-      flags.url = r.url; flags.user = 'memhouse_root'; flags.password = pw;
+      console.log(warn(`this house is yours alone: '${houseUser}' is its superuser, and that is the credential being saved`));
+      console.log('  Adding a housemate later is two statements:');
+      console.log(`     CREATE USER <name> IDENTIFIED BY '…';  GRANT ALL ON ${targetDb}.* TO <name>;`);
+      flags.url = r.url; flags.user = houseUser; flags.password = pw;
       flags.db = targetDb;
       flags.yes = true;
       process.exitCode = await cmdInstall({ interactive: false });

package/memhouse/DESIGN.md

@@ -5,10 +5,12 @@ on your machines — across **all 17 editors** agentlytics supports — parsed l
 shipped to a typed ClickHouse store, shareable with a team, installable on the
 ultimagent kernel as an **agency**, and visible through the agentlytics dashboard.
 
-**One house, a set of rooms per member** — `sessions_<m>`, `messages_<m>`,
-`tool_calls_<m>`. All of one member's machines ship into that member's rooms, told
-apart by the `host` column; no member writes into another's. The shared-table layout
-this once had was removed in 0.4.0; see `per-member/`.
+**A house is a database; its rooms are three shared tables** — `sessions`, `messages`,
+`tool_calls`. Everyone in the house writes into the same tables with their own
+credential; the server-stamped `user_id` says who, the install fingerprint `host` says
+which machine. Sharing IS the house; the boundary between groups is the database. (The
+layout has moved twice: shared-tables-with-row-policies fell in 0.4.0, per-member
+suffixed rooms fell in 0.8.0 — see `house/HOUSE.md` for why.)
 
 **Agency, precisely.** In constellation terms (`../TERMINOLOGY.md`) memhouse is a
 **house** — the `mem` database — **plus a resident**: the shipper. That pairing
@@ -24,23 +26,21 @@ on   = "loop"      # a daemon — not an insert trigger, not a schedule
 ```
 
 The session rollup is a **routine** — house machinery, not a second resident. Since
-0.4.0 it is not even an object: it is SQL text (`per-member/rooms.js`), substituted with
-the caller's own room names and computed during your query, for your query, writing
-nothing. memhouse has **no materialized views at all** — in fact no stored views at all
+0.4.0 it is not even an object: it is SQL text (`house/house.js`), computed during your
+query, for your query, writing nothing. memhouse has **no materialized views at all** — in fact no stored views at all
 — so the shipper is not merely a resident, it is the only candidate in the tree. Strip
 it and every remaining moving part is a routine over rows nobody is writing any more.
 
 Note that `user_id MATERIALIZED currentUser()` is a materialized *column*: it computes
-during your own insert and is part of the table's definition. It is not what isolates
-members — the room they hold no grant on does that — but it records who wrote each row,
-which keeps provenance across a share and keeps the `Merge` rooms meaningful. An identity
-property, not what makes this an agency.
+during your own insert and is part of the table's definition. It is what tells housemates'
+rows apart in the shared tables — provenance, stamped by the server, with async_insert
+pinned so it cannot be skipped. An identity property, not what makes this an agency.
 
 **Positioning:** an alternative agency **competing with memory-house**. It borrows
 memory-house's proven ideas (server-stamped identity, idempotent shipping,
 skills/plugin delivery) and agentlytics' proven assets (adapters, UI, cost engine) —
-but **not** its shared-table-plus-row-policy layout, which 0.4.0 removed in favour of
-one set of rooms per member. If it wins, it can become memory-house v4; until then the
+but **not** its row-policy machinery: memhouse's tables are shared by people who chose
+one house, and the boundary between houses is the database itself. If it wins, it can become memory-house v4; until then the
 two run side by side as separate agencies, each in its own house. Naming: the product is
 **memhouse**; the agency is **`memhouse`** and its house is the **`mem`** database
 (identifiers can't carry a dash; the owner kept the longer name, `memhouse_root`).
@@ -60,20 +60,19 @@ them free and further along; **bet 3 is the one nobody else attempts.**
    write axis this bet is precisely *moving work from routine to resident*:
    memory-house parses when you query, memhouse parses before anyone asks and
    writes the result down.
-2. **Typed common schema** (`per-member/schema-member.sql.tpl`, applied once per
-   member; `schema-merge.sql.tpl` for the team rooms). Physical typed columns (what
-   memory-house derives in views) + `tool_calls_<m>` (memory-house has no tool table)
-   + one `extra JSON` escape hatch per room so unnormalized adapter fields are never
-   lost. `ReplacingMergeTree(ingested_at)`; `messages_<m>` keyed
-   `(session_id, user_id, seq)` so a re-ship of a grown/changed session replaces stale
-   rows (latest-wins). FTS text indexes built in (CH ≥ 26.2).
-3. **Kernel-installable agency.** Same install path proven for agentlytics-agency:
-   `install-agency{memhouse}` → house + `memhouse_root` + credential; members via
-   `register-member` + owner `GRANT` on that member's own rooms. Own-only visibility
-   needs no policy: a member is granted their rooms and nobody else's. The shipper is
-   the resident that lands with it. Identity is `user_id MATERIALIZED currentUser()`
-   (requires `async_insert=0`). Sharing is a further GRANT, issued by the member
-   themselves (grant-option) or the owner.
+2. **Typed common schema** (`house/schema.sql.tpl` — three shared tables per house).
+   Physical typed columns (what memory-house derives in views) + `tool_calls`
+   (memory-house has no tool table) + one `extra JSON` escape hatch per room so
+   unnormalized adapter fields are never lost. `ReplacingMergeTree(ingested_at)`;
+   `messages` keyed `(session_id, user_id, origin, seq)` so a re-ship of a
+   grown/changed session replaces stale rows (latest-wins) and two housemates' rows
+   never collapse into one. FTS text indexes built in (CH ≥ 26.2).
+3. **Kernel-installable agency.** Joining any ClickHouse — a kernel's included — is a
+   database plus a credential: `CREATE USER`, `GRANT ALL ON <house>.* `, done. The
+   shipper is the resident that lands with it and creates its own rooms. Identity is
+   `user_id MATERIALIZED currentUser()` with `async_insert = 0 CONST` pinned on the
+   user; machines are told apart by the `host` fingerprint. The boundary between
+   agencies on one server is the database — a house's ALL reaches nothing outside it.
 4. **Borrowed UI, zero fork.** The React SPA consumes REST JSON, not tables. The
    memhouse server implements the **same `/api/*` contract** as agentlytics'
    `server.js` (same routes, same response shapes) over the memhouse schema, and
@@ -83,9 +82,9 @@ them free and further along; **bet 3 is the one nobody else attempts.**
 
 | Path | What | Notes |
 |---|---|---|
-| `per-member/rooms.js` | room-name resolution + the session rollup | one naming rule for both transports |
-| `per-member/schema-member.sql.tpl` | one member's three rooms (typed) | the owner via `provision.js`, or the member on a house they own |
-| `per-member/schema-merge.sql.tpl` | the three team Merge rooms | owner-managed; reduce to the caller's grants |
+| `house/house.js` | room names + the session rollup + the user pin | one rule for both transports |
+| `house/schema.sql.tpl` | the house's three shared tables (typed) | applied by each member's own shipper |
+| `house/HOUSE.md` | the model, and what it replaced | |
 | `shipper/ship.js` | parse-on-client shipper CLI — the resident (`worker`) | reuses `../../editors`; incremental; idempotent |
 | `server/server.js` | REST API + dashboard | same API contract as agentlytics; serves `../../public` |
 | `delivery/` | delivery kit | installer, skills, plugin, AGENT-INSTALL.md, prompt |

package/memhouse/delivery/PROMPT.md

@@ -26,22 +26,20 @@ FIRST. Only say you don't know after a search comes back empty.
 (full-text over messages), `/memhouse:sessions` (list/filter sessions),
 `/memhouse:sql` (free-form read-only SQL). Without skills, query directly.
 
-**Table names first.** Every member owns their rooms, so every table below takes your
-username as a suffix — `messages_<you>`, `sessions_<you>`, `tool_calls_<you>`. There
-are no unsuffixed rooms; the plain names fail with `UNKNOWN_TABLE` rather than
-returning nothing. Get the suffix from `SELECT currentUser()`. **There is no
-`sessions_v` object** — the rollup is a saved query over those same rooms, and
+**Table names.** The house's rooms are three plain, shared tables — `messages`,
+`sessions`, `tool_calls` — in the connection's database. Everyone in the house writes
+into the same tables; `user_id` (server-stamped) says whose row it is and `host` says
+which machine. Query the whole house by default; add `WHERE user_id = '<name>'` for one
+person. **There is no `sessions_v` object** — the rollup is a saved query, and
 `memhouse sessions-query` prints it ready to drop into a `FROM (...) AS c`.
-`all_messages` / `all_sessions` / `all_tool_calls` read across every member you hold a
-grant for.
 
 - Find sessions about a topic (FTS, lowercase your terms):
-  `SELECT DISTINCT session_id, any(project), min(ts) FROM messages_<you>
+  `SELECT DISTINCT session_id, any(project), min(ts) FROM messages
    WHERE hasToken(text_word, 'clickhouse') GROUP BY session_id
    ORDER BY 3 DESC LIMIT 10 SETTINGS final=1, join_use_nulls=1 FORMAT PrettyCompact`
 - Recent sessions: `SELECT session_id, source, project, started, first_prompt
    FROM $(memhouse sessions-query) AS c ORDER BY started DESC LIMIT 20 SETTINGS final=1, join_use_nulls=1`
-- Replay one session: `SELECT role, text FROM messages_<you>
+- Replay one session: `SELECT role, text FROM messages
    WHERE session_id = '<id>' ORDER BY seq SETTINGS final=1, join_use_nulls=1`
 
 **Rules.**