User personal mirrors — isolated per-user memory

[servathadi]

Each user within a workspace should have their own isolated memory space (personal mirror). Only they can read/write it unless explicitly shared.

Schema:

CREATE TABLE mirror_users (
  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  workspace_id uuid REFERENCES mirror_workspaces(id),
  external_id text NOT NULL,   -- from auth system (email, user_id)
  name text,
  token_hash text,             -- hashed personal access token
  created_at timestamptz DEFAULT now(),
  UNIQUE(workspace_id, external_id)
);

Personal mirror token → resolves to workspace_id + owner_type='user' + owner_id=user.id. Search/store automatically scoped to that user's engrams only. No cross-user reads unless owner_type='project'/'squad' shared collections.