Module executor 

CAL executor — runs parsed CAL queries against a CalStoreFacade.

The executor takes a parsed CalQuery (or a raw CAL string, which it parses internally) and executes it against a &dyn CalStoreFacade, returning a CalExecResult.

Security conditions

• S-2: Tier 1 (evolve) statements — Add, Supersede, Accumulate — execute by default (CalExecutorConfig::tier1_enabled = true). They can be disabled by setting tier1_enabled = false. Revert always returns Unsupported regardless of this flag (semantics not yet defined). All Tier 1 writes go through the same PolicyEngine::check_write() and audit trail as the HTTP/gRPC write path, so compliance invariants are preserved.
• S-5: Audit MUST NOT log parameter values, only names.

Compliance conditions

• C-1: The CalExecResult::query_hash field is always populated with a SHA-256 of the normalized CAL string (for audit trail).
• C-4: query_hash is the SHA-256 of the normalized (trimmed) query.

Structs

AccumulatedDelta

A single delta that was applied during ACCUMULATE.

CalExecResult

Result of executing a CAL query.

CalExecutor

CAL query executor.

CalExecutorConfig

Configuration for the CAL executor.

CalGrainResult

A single grain in a CAL result set (projected view).

CalMetadata

Metadata about a CAL query execution.

CalQueryPlan

Query execution plan returned by EXPLAIN.

CalVersionResult

One entry in a HISTORY OF result.

LetScope

LET binding scope for an execution context.

Enums

CalResultPayload

The result payload, discriminated by statement type.

LetValue

Resolved value of a LET binding.

Functions

grain_matches_condition

Apply a type-specific field condition to a single grain result.

grain_matches_condition_tree

Evaluate a full Condition tree against a single grain result.