{
  "schema": "nexuscrm.runtime-record-query-metadata-closure.d2a/v1",
  "evidence_revision": "bfa0524850286bbb67c41fef5370041be30767e6",
  "app_capability": "io.nexuscrm.sfcrm.query.v1",
  "runtime_capability": "runtime.records.query.v1",
  "projection_profile": "record-query/v1",
  "call_path": [
    {
      "path": "backend/internal/runtimeapi/query_server.go",
      "anchor": "func (s *QueryServer) QueryRecords",
      "role": "transport-to-neutral Runtime adapter"
    },
    {
      "path": "nexuscrm-analytics/query_service.go",
      "anchor": "func (qs *QueryService) QueryWithSpec",
      "role": "metadata-driven CRUD, FLS, RLS, relationship, and query orchestration"
    },
    {
      "path": "nexuscrm-persistence/query_repository.go",
      "anchor": "func (r *QueryRepository) Find",
      "role": "projected TiDB record read"
    }
  ],
  "facts": [
    {
      "id": "catalog.object-and-field-runtime-shape",
      "owner": "catalog_revision",
      "projection": "record-query/v1",
      "consumer": "object lookup, physical read source, selected fields, typed hydration, and derived access policy",
      "evidence_path": "nexuscrm-metadata/metadata_service.go",
      "evidence_anchor": "func (ms *MetadataService) GetSchema(ctx context.Context, apiName string)"
    },
    {
      "id": "catalog.relationship-topology",
      "owner": "catalog_revision",
      "projection": "record-query/v1",
      "consumer": "parent field paths, relationship selections, child subqueries, and sharing-parent traversal",
      "evidence_path": "nexuscrm-metadata/metadata_relationship_lookup.go",
      "evidence_anchor": "func (ms *MetadataService) ForeignKeyForRelationship"
    },
    {
      "id": "catalog.row-and-sharing-policy",
      "owner": "catalog_revision",
      "projection": "record-query/v1",
      "consumer": "sharing model, row-read access policy, sharing rules, and target-record dependencies",
      "evidence_path": "nexuscrm-permissions/rls_filter.go",
      "evidence_anchor": "func (ps *PermissionService) BuildRLSResult"
    },
    {
      "id": "security.effective-object-read-grant",
      "owner": "security_epoch",
      "projection": "excluded",
      "consumer": "object CRUD Read admission",
      "evidence_path": "nexuscrm-analytics/query_service.go",
      "evidence_anchor": "func (qs *QueryService) checkObjectReadAccess"
    },
    {
      "id": "security.effective-field-read-grants",
      "owner": "security_epoch",
      "projection": "excluded",
      "consumer": "FLS validation and authorized SELECT projection",
      "evidence_path": "nexuscrm-analytics/query_service.go",
      "evidence_anchor": "func (qs *QueryService) visibleFieldsForQuery"
    },
    {
      "id": "security.row-principal-membership",
      "owner": "security_epoch",
      "projection": "excluded",
      "consumer": "RLS hierarchy, group, share, and team predicates",
      "evidence_path": "nexuscrm-permissions/rls_filter.go",
      "evidence_anchor": "func (ps *PermissionService) BuildRLSResult"
    },
    {
      "id": "runtime.authorized-record-values",
      "owner": "runtime_database",
      "projection": "excluded",
      "consumer": "bounded record page and total-size result",
      "evidence_path": "nexuscrm-persistence/query_repository.go",
      "evidence_anchor": "func (r *QueryRepository) Find"
    },
    {
      "id": "request.trusted-call-and-capability",
      "owner": "trusted_call",
      "projection": "excluded",
      "consumer": "Org, installation, workload, user, query capability, and SecurityEpoch binding",
      "evidence_path": "backend/internal/runtimeapi/security_admission.go",
      "evidence_anchor": "type TrustedCall struct"
    }
  ],
  "ownership_guards": {
    "l1_owns_external_query_grammar_and_public_wire": true,
    "catalog_apprelease_owns_app_to_runtime_capability_mapping": true,
    "catalog_revision_owns_immutable_query_metadata": true,
    "security_epoch_owns_dynamic_permission_grants": true,
    "runtime_database_owns_record_values": true,
    "runtime_receives_only_a_closed_typed_plan": true
  },
  "unreachable_edges": [
    {
      "id": "runtime-metadata-repository-fallback",
      "path": "nexuscrm-metadata/metadata_service.go",
      "anchor": "if ms.UsesRequestBoundRuntimeView() {",
      "proof": "the serving MetadataService returns from the request-bound RuntimeMetadataView branch before any repository/cache fallback"
    },
    {
      "id": "runtime-process-global-metadata-refresh",
      "path": "nexuscrm-metadata/metadata_service.go",
      "anchor": "runtime metadata service: process-global refresh is disabled",
      "proof": "the serving graph cannot create or refresh a second process-global metadata authority"
    },
    {
      "id": "query-without-capability-bound-view",
      "path": "backend/internal/runtimeapi/query_server.go",
      "anchor": "view, ok := RuntimeMetadataViewFromContext(ctx)",
      "proof": "query fails closed before engine execution when ServingAdmission did not bind the exact query view"
    },
    {
      "id": "production-query-repository-metadata-source",
      "path": "backend/internal/runtimeapi/process.go",
      "anchor": "runtimeassembly.NewServingRecordsReadRuntime(",
      "proof": "production composition constructs the repository-free Runtime MetadataService and injects the request-bound resolver"
    }
  ],
  "conformance_fixture": {
    "module": "github.com/nexuscrm/app-packs-conformance/issue-tracker",
    "consumer": "IssueQueryConsumer.ListByRetryFloor",
    "role": "CI-only non-CRM consumer of the public neutral query contract",
    "production_dependency_allowed": false
  }
}