polyc-query 2026.8.3

Read layer over the event log: a DataFusion engine for SQL over replayed partitions, and a per-conversation Parquet projection for participation-scoped search (docs/reference/datafusion-data-layer.md, docs/proposals/participation-scoped-agent-search.md).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

//! The catalog-scope selector for a query session.
//!
//! "Mint a session, then filter server-side" —
//! docs/reference/datafusion-data-layer.md:434-471. Catalog scoping (not row
//! rewriting) registers only the `CatalogProvider`/`SchemaProvider` covering
//! the partitions a session's participation set already authorizes
//! (docs/reference/datafusion-data-layer.md:473-497). [`QueryScope`] is that
//! selector — the value a caller passes to
//! [`crate::engine::QueryEngine::build`] to say which partitions a session's
//! catalog may register; building and holding the `SessionContext` itself is
//! [`QueryEngine`](crate::engine::QueryEngine)'s job, not this module's.

/// Which partitions a query session's catalog may register.
///
/// Sealed as of the A2 funnel retrofit: [`crate::authority::QueryAuthority::scope_for`]
/// is the only place a [`QueryScope`] value is derived, from an already-verified
/// [`crate::authority::Principal`] — never a caller-supplied value from outside
/// this crate.
#[derive(Debug, Clone)]
pub(crate) enum QueryScope {
    /// A maintainer/operator session — fleet-wide, gated on
    /// `Permissions.admin` (docs/reference/datafusion-data-layer.md:531-536).
    Fleet,
    /// An end-user or conversation-scoped session, bounded to the given
    /// `conv-{id}` partitions — sourced from `PersonaStore::participations`,
    /// never a client-supplied predicate
    /// (docs/reference/datafusion-data-layer.md:456-471).
    Conversations(Vec<String>),
}