polyc-query 2026.9.6

//! The two production-sealed impls a moved-out credential witness needs.
//!
//! Epic 1565, chunk 10C-1 moved the credential verification and scoping
//! mechanism — [`polyc_query_credential::credential::CredentialAuthority`],
//! [`polyc_query_credential::credential::CredentialWitness`], and every
//! verified [`polyc_query_credential::principal::Principal`] type — to the
//! `DataFusion`-free `polyc-query-credential` crate, so `polyc-control-plane`
//! can depend on the credential mechanism without also linking this crate's
//! `DataFusion` and projection machinery (the embedded engine itself is
//! deleted since POLY-196). These two `impl` blocks are the one exception: they stay
//! here, next to [`crate::core_execution::CoreScopeRevalidator`] and
//! [`crate::core_execution::sealed::CredentialProven`], because both traits
//! are sealed to this crate (the orphan rule lets a foreign type implement a
//! LOCAL trait, so `polyc-query` implementing them for a foreign
//! `CredentialWitness` keeps the seal exactly as tight as it was when
//! `CredentialWitness` lived here too: only `polyc-query` may write this
//! `impl`).

#[async_trait::async_trait]
impl crate::core_execution::CoreScopeRevalidator
    for polyc_query_credential::credential::CredentialWitness
{
    async fn current_scope(
        &self,
        operation: &crate::core_resolution::CoreOperationContext,
    ) -> Result<
        polyc_query_credential::session::QueryScope,
        crate::core_resolution::CoreResolutionError,
    > {
        operation.check()?;
        Self::current_scope(self)
            .await
            .map_err(|_| crate::core_resolution::CoreResolutionError::InvalidAttribution)
    }
}

// A credential witness re-proves the credential itself, so it may carry the
// production seal. Nothing else in this crate may.
impl crate::core_execution::sealed::CredentialProven
    for polyc_query_credential::credential::CredentialWitness
{
}