Module compartment 

Per-plugin/tool database compartments.

A compartment is a postgres ROLE + same-named SCHEMA scoped to one (kind, owner, name, version). Inside its own schema the role has full DDL/DML freedom (it owns it); through the shared objectiveai_read group (provisioned by super::init) it has READONLY access to the base objectiveai schema’s tables; and it has no privileges on any other compartment’s schema. Postgres caveat, accepted by design: other compartments’ object NAMES remain visible through pg_catalog — their data does not.

ensure is idempotent and runs on every tools run / plugins run spawn, returning the role-specific connection URL the child receives as OBJECTIVEAI_POSTGRES_URL.

The role’s password is DERIVED — xxh3_128(admin_password ":" role_name) — rather than randomized per spawn: N children of the same compartment can spawn concurrently, and a rotate-on-spawn scheme would invalidate URLs already handed to in-flight siblings. Nothing is stored; if the admin password changes, the next provision’s ALTER ROLE re-derives in stride.

Enums

Kind

Which spawn surface owns the compartment. Folded into the compartment name so a plugin and a tool with the same coordinates never share a namespace.

Functions

ensure

Ensure the compartment role + schema exist with the expected grants, and return the child’s connection URL.