[antoinetoussaint-byte]

Local compositions currently start a PostgreSQL server for every database service. This adds explicit sharing: an owned service with shared-local-server: true exports a local bootstrap capability; a database service with local-server: module/service consumes that declared dependency while retaining its database, migrations, runtime principals and endpoint identity. Two database services can now run on one physical Nix or Docker server.

Reuses Codefly's dependency graph, accepted Init mappings/configurations, lifecycle ordering, native/container runtimes, migrations and grant reconciliation. No machine-global pool, extra supervisor, fixed DSN or application-client changes. Default behavior is unchanged. Classification: fix in the Postgres runtime, which owns local database provisioning.

The borrower refuses absent/ambiguous dependency handoff, missing server opt-in, mismatched native addresses, a reused server-owner identity/database, incompatible server settings and PostgreSQL majors. Cluster-global role names have durable ownership claims; concurrent bootstrap is serialized with a bounded advisory lock. Runtime reader/writer principals cannot connect to peer databases. Migration owners remain trusted local superusers, as on the existing owned-cluster path; this is not isolation between untrusted migration authors. Stop/Destroy of a borrower never stops the dependency or drops data. The normal graph stops the server after consumers.

Validation:

• go build ./..., go vet ./..., go mod tidy -diff, git diff --check passed.
• Repository CI unit command passed (224s, using the documented Docker exclusions).
• Final focused go test . -race -json -run '^Test(LocalServer|CIWorkflowEnforcesSharedServerRegression)' -count=1 passed. Both real backends executed, neither skipped: Nix 3.63s, Docker 10.73s. Tests cover simultaneous independently migrated databases, published shared mappings, own-data reads, denied cross-database connections, role collision refusal, lock cancellation/retry, borrower Stop/Destroy and whole-server restart persistence.
• Built the actual agent with codefly agent build into an isolated plugin directory. Scaffolded a fresh workspace/module and three services with codefly init/codefly add; composed two borrowers using codefly run service shared/alpha shared/beta --runtime-context nix. Both used one server listener. On SIGINT the CLI stopped both borrowers, then the server; verified the postmaster exited. No existing user database was migrated or deleted.
• Added a mandatory CI Docker regression after the locally built runtime image, with -race. Workflow shape is tested. Actionlint passes with shellcheck disabled; full actionlint reports pre-existing SC2129 at line 41 in the unchanged image-resolution script.

Docs updated: docs/local-shared-server.md covers composition, trust boundaries, lifecycle/recovery, qualification and a deliberate backup/restore cutover. templates/agent/README.md.tmpl exposes local sharing to scaffolded services; AGENTS.md records the added CI regression.

Limitations: opting in does not import an old per-service cluster. Directory's existing databases remain untouched. A standalone codefly endpoint invocation unable to attach to the live flow can fall back to the borrower's proposed port; the composition's accepted mappings/runtime configuration are authoritative. Hosted manifests and external-instance bindings are unchanged; no hosted qualification or arbitrary application backup/restore was performed. The Docker test ran locally against the pinned published image; CI additionally runs it against the image built from this checkout.

Fixes #193

[antoinetoussaint-byte]

Superseded by #196 (a218ae5, merged): one shared native Postgres server per run with a database and a non-superuser owner per service, needing no composition declaration. #194 required every composition to declare a dependency on a server-owning service and hand-pick a distinct POSTGRES_USER, and its migration owners were superusers, so services were not isolated from each other. Closed in the 2026-10-27 clean-up on the owner's instruction.