Add checked workspace-interface query roots

Implement scoped interface extents across QX, generated bindings, SDK,
Orch, Camino and browser queries. Preserve native projection, aggregation,
pagination and watch invalidation without synthetic persisted objects.
Validate exact query grants and scope freshness on execution and replay.
Add local PostgreSQL, transport, browser and code-generation coverage.

C1 implementation slice only: full-text indexes and Studio search adoption
(C2/C3) remain tracked in the implementation handoff. No publication or deployment.

src/index.ts

@@ -285,15 +285,22 @@ export const createRuntimeContext = (
   const ports = new Map<string, RuntimePort>();
   for (const dependency of request.dependencies) {
     switch (dependency.binding.case) {
-      case "queryId": {
-        const queryId = dependency.binding.value,
-          objectId = dependency.objectId || request.objectId;
+      case "queryId":
+      case "workspaceQuery": {
+        if (dependency.binding.case === "workspaceQuery" && !dependency.binding.value.scope)
+          throw new Error(`Workspace query port ${dependency.portId} has no scope`);
+        const queryId =
+          dependency.binding.case === "queryId" ? dependency.binding.value : dependency.binding.value.queryId;
+        const root =
+          dependency.binding.case === "queryId"
+            ? { case: "objectId" as const, value: dependency.objectId || request.objectId }
+            : { case: "workspaceScope" as const, value: dependency.binding.value.scope! };
         ports.set(dependency.portId, {
           queryId,
           execute: (variables, expectedDefinitionDigest) =>
-            orch.executeQuery({ queryId, objectId, variables, expectedDefinitionDigest }),
+            orch.executeQuery({ queryId, root, variables, expectedDefinitionDigest }),
           watch: (variables, signal, expectedDefinitionDigest) =>
-            orch.watchQuery({ queryId, objectId, variables, expectedDefinitionDigest }, { signal }),
+            orch.watchQuery({ queryId, root, variables, expectedDefinitionDigest }, { signal }),
         });
         break;
       }

src/queries.ts

@@ -19,10 +19,17 @@ export type QxQuerySnapshot<T> = {
 } & ({ status: "ready"; data: T } | { status: "partial"; data: QxQueryPartial<T> });
 declare const queryTypes: unique symbol;
 /** Generated shape evidence, not permission to run a query. */
-export interface QxQueryDescriptor<Variables, Result, Root extends string = string> {
+export interface QxQueryDescriptor<
+  Variables,
+  Result,
+  Root extends { kind: "object" | "workspace-interface"; interface: string } = {
+    kind: "object" | "workspace-interface";
+    interface: string;
+  },
+> {
   readonly id: string;
   readonly definitionDigest: string;
-  readonly rootInterfaceRevisionId: Root;
+  readonly root: Root;
   readonly variables: QxValueType;
   readonly output: QxValueType;
   readonly watch: boolean;

src/quixos/package_pb.ts

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/package.proto (package quixos, syntax proto3)
 /* eslint-disable */
 

src/quixos/refs_pb.ts

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/refs.proto (package quixos, syntax proto3)
 /* eslint-disable */
 
@@ -10,7 +10,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file quixos/refs.proto.
  */
 export const file_quixos_refs: GenFile = /*@__PURE__*/
-  fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zInUKDUNhcGFiaWxpdHlSZWYSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAEgASgJEhQKDG9wZXJhdGlvbl9pZBgCIAEoCRIvCgtjb25mb3JtYW5jZRgDIAEoCzIaLnF1aXhvcy5Db25mb3JtYW5jZVdpdG5lc3Mi0QEKDEZpZWxkRWRpdGluZxIbChNnZXR0ZXJfb3BlcmF0aW9uX2lkGAEgASgJEhsKE3NldHRlcl9vcGVyYXRpb25faWQYAiABKAkSFQoNZG9jdW1lbnRfdHlwZRgDIAEoCRIWCg5iaW5kaW5nX2RpZ2VzdBgEIAEoCRInCgRtb2RlGAUgASgOMhkucXVpeG9zLkZpZWxkRWRpdGluZy5Nb2RlIi8KBE1vZGUSDwoLVU5TUEVDSUZJRUQQABIMCghSRUdJU1RFUhABEggKBENSRFQQAiKWAQoSQ29uZm9ybWFuY2VXaXRuZXNzEhEKCW9iamVjdF9pZBgBIAEoCRIdChVpbnRlcmZhY2VfcmV2aXNpb25faWQYAiABKAkSFgoOY29uZm9ybWFuY2VfaWQYAyABKAkSHQoVd29ya3NwYWNlX3JldmlzaW9uX2lkGAQgASgJEhcKD3dvcmtzcGFjZV9lcG9jaBgFIAEoCSJCChBQYWNrYWdlRXhwb3J0UmVmEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSEQoJZXhwb3J0X2lkGAIgASgJItgBChJJbmplY3RlZERlcGVuZGVuY3kSDwoHcG9ydF9pZBgBIAEoCRIXCg1zdGF0ZV9zbG90X2lkGAIgASgJSAASJgoEZWRnZRgDIAEoCzIWLnF1aXhvcy5FZGdlRGVwZW5kZW5jeUgAEh8KFWludGVyZmFjZV9yZXZpc2lvbl9pZBgEIAEoCUgAEh0KE2NvbnN0cnVjdG9yX2F0b21faWQYBSABKAlIABISCghxdWVyeV9pZBgHIAEoCUgAEhEKCW9iamVjdF9pZBgGIAEoCUIJCgdiaW5kaW5nIj0KDkVkZ2VEZXBlbmRlbmN5EhQKDGVkZ2VfdHlwZV9pZBgBIAEoCRIVCg1wcm9qZWN0aW9uX2lkGAIgASgJYgZwcm90bzM");
+  fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zInUKDUNhcGFiaWxpdHlSZWYSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAEgASgJEhQKDG9wZXJhdGlvbl9pZBgCIAEoCRIvCgtjb25mb3JtYW5jZRgDIAEoCzIaLnF1aXhvcy5Db25mb3JtYW5jZVdpdG5lc3Mi0QEKDEZpZWxkRWRpdGluZxIbChNnZXR0ZXJfb3BlcmF0aW9uX2lkGAEgASgJEhsKE3NldHRlcl9vcGVyYXRpb25faWQYAiABKAkSFQoNZG9jdW1lbnRfdHlwZRgDIAEoCRIWCg5iaW5kaW5nX2RpZ2VzdBgEIAEoCRInCgRtb2RlGAUgASgOMhkucXVpeG9zLkZpZWxkRWRpdGluZy5Nb2RlIi8KBE1vZGUSDwoLVU5TUEVDSUZJRUQQABIMCghSRUdJU1RFUhABEggKBENSRFQQAiKWAQoSQ29uZm9ybWFuY2VXaXRuZXNzEhEKCW9iamVjdF9pZBgBIAEoCRIdChVpbnRlcmZhY2VfcmV2aXNpb25faWQYAiABKAkSFgoOY29uZm9ybWFuY2VfaWQYAyABKAkSHQoVd29ya3NwYWNlX3JldmlzaW9uX2lkGAQgASgJEhcKD3dvcmtzcGFjZV9lcG9jaBgFIAEoCSJCChBQYWNrYWdlRXhwb3J0UmVmEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSEQoJZXhwb3J0X2lkGAIgASgJIpUCChJJbmplY3RlZERlcGVuZGVuY3kSDwoHcG9ydF9pZBgBIAEoCRIXCg1zdGF0ZV9zbG90X2lkGAIgASgJSAASJgoEZWRnZRgDIAEoCzIWLnF1aXhvcy5FZGdlRGVwZW5kZW5jeUgAEh8KFWludGVyZmFjZV9yZXZpc2lvbl9pZBgEIAEoCUgAEh0KE2NvbnN0cnVjdG9yX2F0b21faWQYBSABKAlIABISCghxdWVyeV9pZBgHIAEoCUgAEjsKD3dvcmtzcGFjZV9xdWVyeRgIIAEoCzIgLnF1aXhvcy5Xb3Jrc3BhY2VRdWVyeURlcGVuZGVuY3lIABIRCglvYmplY3RfaWQYBiABKAlCCQoHYmluZGluZyKaAQoTV29ya3NwYWNlUXVlcnlTY29wZRIUCgx3b3Jrc3BhY2VfaWQYASABKAkSHQoVd29ya3NwYWNlX3JldmlzaW9uX2lkGAIgASgJEhcKD3dvcmtzcGFjZV9lcG9jaBgDIAEoCRIdChVpbnRlcmZhY2VfcmV2aXNpb25faWQYBCABKAkSFgoOYmluZGluZ19kaWdlc3QYBSABKAkiWAoYV29ya3NwYWNlUXVlcnlEZXBlbmRlbmN5EhAKCHF1ZXJ5X2lkGAEgASgJEioKBXNjb3BlGAIgASgLMhsucXVpeG9zLldvcmtzcGFjZVF1ZXJ5U2NvcGUiPQoORWRnZURlcGVuZGVuY3kSFAoMZWRnZV90eXBlX2lkGAEgASgJEhUKDXByb2plY3Rpb25faWQYAiABKAliBnByb3RvMw");
 
 /**
  * @generated from message quixos.CapabilityRef
@@ -207,6 +207,12 @@ export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
      */
     value: string;
     case: "queryId";
+  } | {
+    /**
+     * @generated from field: quixos.WorkspaceQueryDependency workspace_query = 8;
+     */
+    value: WorkspaceQueryDependency;
+    case: "workspaceQuery";
   } | { case: undefined; value?: undefined };
 
   /**
@@ -225,6 +231,68 @@ export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
 export const InjectedDependencySchema: GenMessage<InjectedDependency> = /*@__PURE__*/
   messageDesc(file_quixos_refs, 4);
 
+/**
+ * Scope evidence is not authority by itself. The caller must also hold the
+ * matching workspace-query grant (or the authenticated workspace user grant).
+ *
+ * @generated from message quixos.WorkspaceQueryScope
+ */
+export type WorkspaceQueryScope = Message<"quixos.WorkspaceQueryScope"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+
+  /**
+   * @generated from field: string workspace_revision_id = 2;
+   */
+  workspaceRevisionId: string;
+
+  /**
+   * @generated from field: string workspace_epoch = 3;
+   */
+  workspaceEpoch: string;
+
+  /**
+   * @generated from field: string interface_revision_id = 4;
+   */
+  interfaceRevisionId: string;
+
+  /**
+   * @generated from field: string binding_digest = 5;
+   */
+  bindingDigest: string;
+};
+
+/**
+ * Describes the message quixos.WorkspaceQueryScope.
+ * Use `create(WorkspaceQueryScopeSchema)` to create a new message.
+ */
+export const WorkspaceQueryScopeSchema: GenMessage<WorkspaceQueryScope> = /*@__PURE__*/
+  messageDesc(file_quixos_refs, 5);
+
+/**
+ * @generated from message quixos.WorkspaceQueryDependency
+ */
+export type WorkspaceQueryDependency = Message<"quixos.WorkspaceQueryDependency"> & {
+  /**
+   * @generated from field: string query_id = 1;
+   */
+  queryId: string;
+
+  /**
+   * @generated from field: quixos.WorkspaceQueryScope scope = 2;
+   */
+  scope?: WorkspaceQueryScope | undefined;
+};
+
+/**
+ * Describes the message quixos.WorkspaceQueryDependency.
+ * Use `create(WorkspaceQueryDependencySchema)` to create a new message.
+ */
+export const WorkspaceQueryDependencySchema: GenMessage<WorkspaceQueryDependency> = /*@__PURE__*/
+  messageDesc(file_quixos_refs, 6);
+
 /**
  * @generated from message quixos.EdgeDependency
  */
@@ -245,5 +313,5 @@ export type EdgeDependency = Message<"quixos.EdgeDependency"> & {
  * Use `create(EdgeDependencySchema)` to create a new message.
  */
 export const EdgeDependencySchema: GenMessage<EdgeDependency> = /*@__PURE__*/
-  messageDesc(file_quixos_refs, 5);
+  messageDesc(file_quixos_refs, 7);
 

src/quixos/runtime_pb.ts

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/runtime.proto (package quixos.runtime, syntax proto3)
 /* eslint-disable */