Implement query execution, scoped RPC enrichment, live collections, and scaffold integration

proto/camino/api.proto

@@ -5,6 +5,8 @@ package camino;
 import "camino/schema.proto";
 
 service CaminoService {
+  rpc ExecuteQuery(QueryRequest) returns (QueryResponse);
+  rpc QueryChanges(QueryChangesRequest) returns (QueryChangesResponse);
   rpc InstallPersistencePlan(InstallPersistencePlanRequest) returns (InstallPersistencePlanResponse);
   rpc GetPersistencePlan(GetPersistencePlanRequest) returns (GetPersistencePlanResponse);
   rpc CreateObject(CreateObjectRequest) returns (CreateObjectResponse);
@@ -214,3 +216,84 @@ message CaminoOp {
   string created_at = 6;
   string client_mutation_id = 7;
 }
+
+message QueryRequest {
+  string query_id = 1;
+  string object_id = 2;
+  map<string, Value> variables = 3;
+  // Typed callers require this exact checked definition. Administrative/raw
+  // callers may omit it to explicitly select the currently installed definition.
+  string expected_definition_digest = 4;
+}
+message QueryPathPart {
+  oneof part {
+    string field = 1;
+    uint32 index = 2;
+  }
+}
+message QueryPendingField {
+  repeated QueryPathPart path = 1;
+  string object_id = 2;
+  string interface_revision_id = 3;
+  string member_id = 4;
+  string operation_id = 5;
+  string value_type_json = 6;
+  // Internal residual facts are separate from the authored result projection.
+  optional uint32 residual_window = 7;
+  uint32 residual_row = 8;
+  string residual_field = 9;
+}
+message QueryStats {
+  uint32 sql_count = 1;
+  double sql_ms = 2;
+  uint32 rpc_count = 3;
+  double rpc_ms = 4;
+  uint32 result_bytes = 5;
+  double preparation_ms = 6;
+  double total_ms = 7;
+}
+message QueryResponse {
+  Value value = 1;
+  string data_version = 2;
+  string binding_digest = 3;
+  repeated QueryPendingField pending = 4;
+  QueryStats stats = 5;
+  // Redeemable only through the host's private control socket, not an RPC grant.
+  string preparation_token = 6;
+  repeated QueryFieldFailure errors = 7;
+  repeated QueryResidualWindow residual_windows = 8;
+  // Native reads share one database snapshot; package enrichment does not.
+  string consistency = 9;  // native-snapshot | mixed
+}
+
+message QueryResidualRow {
+  string entry_id = 1;
+  map<string, Value> fields = 2;
+}
+message QueryResidualOrder {
+  string field = 1;
+  bool descending = 2;
+}
+message QueryResidualWindow {
+  repeated QueryPathPart path = 1;
+  repeated QueryResidualRow rows = 2;
+  string predicate_json = 3;
+  repeated QueryResidualOrder order = 4;
+  uint32 limit = 5;
+  bool bounded_all = 6;
+  repeated QuerySelection selection = 7;
+  map<string, string> field_types = 8;
+}
+
+message QueryFieldFailure {
+  repeated QueryPathPart path = 1;
+  string error = 2;
+}
+message QueryChangesRequest {
+  string query_id = 1;
+  string object_id = 2;
+  string data_version = 3;
+}
+message QueryChangesResponse {
+  bool changed = 1;
+}

proto/camino/schema.proto

@@ -117,6 +117,7 @@ message QueryReadBinding {
   string field_name = 11;
   string value_type_json = 12;
   Cardinality cardinality = 13;
+  string key_type = 14;
 }
 message QueryBudgets {
   uint32 rows = 1;

proto/quixos/orch.proto

@@ -3,11 +3,14 @@ syntax = "proto3";
 package quixos.orch;
 
 import "camino/api.proto";
+import "camino/schema.proto";
 import "quixos/package.proto";
 import "quixos/refs.proto";
 import "quixos/runtime.proto";
 
 service OrchestratorRuntime {
+  rpc ExecuteQuery(camino.QueryRequest) returns (camino.QueryResponse);
+  rpc WatchQuery(camino.QueryRequest) returns (stream QueryEvent);
   rpc TryConform(TryConformRequest) returns (TryConformResponse);
   rpc InvokeCapability(InvokeCapabilityRequest) returns (InvokeCapabilityResponse);
   rpc EditCapabilityField(EditCapabilityFieldRequest) returns (InvokeCapabilityResponse);
@@ -23,6 +26,16 @@ service OrchestratorRuntime {
   rpc CloseActivation(CloseActivationRequest) returns (CloseActivationResponse);
 }
 
+message QueryEvent {
+  string run_id = 1;
+  uint64 sequence = 2;
+  string kind = 3;
+  camino.QueryResponse snapshot = 4;
+  repeated camino.QueryPathPart path = 5;
+  camino.Value value = 6;
+  string error = 7;
+}
+
 // Exact closed interface lookup; no policy selection or competing conformances.
 message TryConformRequest {
   string object_id = 1;
@@ -110,6 +123,7 @@ message WatchCapabilityEvent {
 message GetWorkspaceRequest {
   // Revision polling must not download the entire interface graph.
   bool include_interface_contracts = 1;
+  bool include_query_contracts = 2;
 }
 message GetWorkspaceResponse {
   string workspace_id = 1;
@@ -123,6 +137,18 @@ message GetWorkspaceResponse {
   // Exact closed interface contracts used by checked presentation consumers.
   string interfaces_json = 7;
   repeated ClassCapability class_capabilities = 8;
+  repeated QueryDescription queries = 9;
+  uint32 active_query_executions = 10;
+}
+message QueryDescription {
+  string id = 1;
+  string name = 2;
+  string package_revision_id = 3;
+  string document = 4;
+  string schema = 5;
+  repeated string source_files = 6;
+  string effects_json = 7;
+  camino.InstalledQuery plan = 8;
 }
 message ClassCapability {
   string conformance_id = 1;

proto/quixos/refs.proto

@@ -29,6 +29,7 @@ message InjectedDependency {
     EdgeDependency edge = 3;
     string interface_revision_id = 4;
     string constructor_atom_id = 5;
+    string query_id = 7;
   }
   // Defaults to the invocation receiver. A checked dependency traversal can
   // select a related object explicitly before the package runtime starts.