polyc-query 2026.8.3

Read layer over the event log: a DataFusion engine for SQL over replayed partitions, and a per-conversation Parquet projection for participation-scoped search (docs/reference/datafusion-data-layer.md, docs/proposals/participation-scoped-agent-search.md).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

//! Read-only read layer over the event log, with two mechanisms behind one
//! sealed funnel: a `DataFusion` engine for SQL over replayed partitions, and
//! a per-conversation Parquet projection for participation-scoped search.
//!
//! Per the accepted designs at `docs/reference/datafusion-data-layer.md`
//! (tracking: #1178 epic, #1179 phase 1, #1202 phase 2, the 2026-07-21
//! access-control retrofit this crate's `authority` module implements) and
//! `docs/proposals/participation-scoped-agent-search.md` (the search index).
//!
//! The crate was SQL-only when it was named, so the description says what it
//! now is rather than describing a crate this no longer matches.
//!
//! # The sealed funnel (A2)
//!
//! [`authority::QueryAuthority`] is the crate's ONE public entry point —
//! "one scope path, sealed"
//! (docs/reference/datafusion-data-layer.md, "Access control"). Every other
//! module that can build an unscoped engine or read unredacted data
//! (`engine`, `session`, `provider`, `views`, `decode`, `statement_gate`,
//! `search_index`) is `pub(crate)`: nothing outside this crate can reach
//! a `engine::QueryEngine` except through [`authority::QueryAuthority::scope_for`],
//! which only ever accepts an already-verified [`authority::Principal`] —
//! itself mintable only by [`authority::QueryAuthority`]'s own verification
//! methods, never by a public constructor. [`authority`]'s own module doc
//! states the full sealed/public split and how it is pinned.
//!
//! [`output::QueryResultJson`] (the wire JSON envelope) and [`audit::ReadAuditRecord`]
//! (the durable per-query audit record shape) round out the public surface,
//! alongside [`QueryLimits`] (re-exported here since it is a plain resource-
//! ceilings config struct [`authority::QueryAuthority::new_state_backed`] takes by value —
//! no reason for a caller assembling one to reach into the `pub(crate)`
//! `engine` module for it) — see each module's own doc.
//!
//! [`SearchIndex`] is the one exception the seal deliberately makes, and it
//! widens nothing: `search_index` itself stays `pub(crate)`, and this handle
//! exposes only what a Container must do to keep the projection maintained —
//! open it, register its observer, supervise its worker. It reads nothing back
//! out. The read side arrives as a scope-checked port behind
//! [`authority::QueryAuthority`], the same funnel every other read goes
//! through.

pub mod audit;
pub mod authority;
pub(crate) mod cache;
pub mod dashboard;
pub(crate) mod decode;
pub(crate) mod engine;
pub mod feed;
pub mod journal;
pub(crate) mod metrics;
pub mod output;
pub(crate) mod provider;
pub mod routine_catalog;
pub(crate) mod search_index;
pub(crate) mod session;
pub(crate) mod statement_gate;
pub(crate) mod views;

pub use cache::CacheConfig;
pub use engine::QueryLimits;
pub use search_index::marks::CommitMarks;
pub use search_index::{SearchIndex, SearchIndexError, TermKeyOrigin};

/// Force-register this crate's own Prometheus metric families with the
/// process default registry.
///
/// (`metrics`, QRY-3 hardening review item D) so `/metrics` answers a
/// query-sizing scrape from the first call — not only after the first query
/// happens to touch a series. Call once at process startup, alongside any
/// other crate's own `init_metrics` (`crates/control-plane/src/grpc/mod.rs`'s
/// `serve` is where the control plane calls every such crate's
/// `init_metrics` today).
pub fn init_metrics() {
    metrics::force();
}