polyc-query 2026.9.6

The Query plane's read model: a DataFusion engine over signed projection artifacts, behind a verified credential.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

//! The projected query read path: exact, signed projection artifacts
//! answered through `DataFusion` behind a verified credential.
//!
//! This crate is the Query plane's read model. A deployment composes
//! [`core_service::ProjectedCoreService`] once at startup, then runs each
//! credential-bearing request through it. Everything between those two
//! points stays private: `core_resolution` plans the statement against the
//! closed catalog, `core_execution` executes it over verified artifacts,
//! `statement_gate` admits only query-shaped ASTs, and `credential` carries
//! the two sealed impls `polyc-query-credential`'s witness needs. Nothing
//! outside this crate can assemble those parts in an order
//! [`core_service`] never checked — see that module's own doc for the seam.
//!
//! [`QueryLimits`], re-exported here because it is a plain
//! resource-ceilings struct the service composition takes by value, is the
//! one other public item — every field on it is one the projected path
//! reads. The wire
//! JSON envelope is [`polyc_query_model::QueryResultJson`]: it lives in the
//! `DataFusion`-free protocol vocabulary crate (POLY-359), so a caller
//! names it without linking this engine.

pub(crate) mod core_evidence;
pub(crate) mod core_execution;
pub(crate) mod core_production;
pub(crate) mod core_redaction;
pub(crate) mod core_resolution;
pub mod core_service;
pub(crate) mod credential;
pub(crate) mod function_surface;
pub(crate) mod limits;
pub(crate) mod metrics;
pub(crate) mod statement_gate;

pub use limits::QueryLimits;

/// Force-register this crate's own Prometheus metric families with the
/// process default registry.
///
/// `/metrics` then answers a query-catalog scrape from the first call — not
/// only after the first `DescribeCatalog` happens to touch a series. Call
/// once at process startup, alongside any other crate's own `init_metrics`;
/// `crates/query-service`'s `serve` is where the Query plane calls it.
pub fn init_metrics() {
    metrics::force();
}