RillScope

Make query authority part of the plan.

A policy-aware query compiler and bounded execution-engine experiment.

Start · Architecture · Contracts · Evidence · Limits

Experimental Rust engine · MIT · No model API required

---

A client should be able to ask a useful question without deciding which tenant data it may read. RillScope explores that boundary inside a small relational compiler: the host fixes authority, the query supplies intent, and the plan must preserve both semantics and scope.

Status: The original Rust JSON/SQL compiler, binder, policy verifier, optimizer and batch executor are implemented. Current recorded Windows checks passed 48 Rust tests and 2,000 malformed inputs; the reference suite passed 814 tests and does not establish Rust correctness. Standard Linux CI 50 passed all four jobs. Canonical native run 18 completed the full 410-case grid, deciding-NULL sort supplement, Linux cancellation campaign and fresh bootstrap/verify/demo recipe. Its original 47,425 observations and source/native/receipt custody passed a separate complete replay. Measured reference targets apply only to the documented dedicated four-vCPU/8-GiB guest; provider hardware may be shared, and the required main-chat review shares implementation history. Earlier failures remain preserved. The manual visual/keyboard demo record, libFuzzer and final release remain incomplete. This is an experimental development build. Read implementation status for evidence limits.

The maintainer authorized finishing the available engineering delivery while skipping the unavailable current browser inspection. The explicit AC-008 exception records that decision. The visual criterion stays unverified, and the unchanged strict release audit continues to reject it. This authorization does not establish full acceptance or production readiness.

The experiment

Bind the question	Preserve the boundary	Inspect the evidence
A closed query language with explicit types, nullable values and duplicate-preserving rows.	Host-derived policy scans, all-position column checks and bounded execution.	Independent oracle comparisons, targeted negative controls and source-identified command receipts.

The Rust engine owns binding, rewrites and operators. SQLite is a separate test oracle over physically authorized tables. No production use or performance advantage is claimed.

Run the Rust engine

make bootstrap build
target/debug/rillscope run --catalog examples/catalog.json --context examples/context.json --query examples/query.json
target/debug/rillscope explain --catalog examples/catalog.json --context examples/context.json --query examples/query.json
make integration property fuzz
make demo

The actual Rust example returns three orders and total 40. Use examples/forbidden.json for a typed denial. SQL input uses --format sql; stdin uses --query -; --optimize off disables rewrites. Catalog/context paths and synthetic test hooks are trusted host controls. An untrusted client receives only the restricted query interface.

make demo executes the Rust CLI through the fixed-scope adapter and independently materializes each tenant's authorized relation in SQLite. Open its generated offline report, or inspect the recorded Rust report, actual screenshot, and visual/keyboard inspection. It shows alpha [[3,40]], E_FORBIDDEN, and beta [[1,999]]. No model keys or cloud service are required. The adapter's client request contains only query format/source and output choice; its constructor's binary/catalog/context paths are trusted host configuration.

Run the reference

You need Python 3.11+, its standard-library SQLite module, Git and Make. No account, API key, paid service or Python package install is required.

make verify-reference
make mutation-reference
make demo-reference

The demo prints a local report.html path under ignored .local-runs/. Open it to inspect three actual Python-reference executions: an authorized aggregate, a forbidden-column rejection and work-budget exhaustion. The HTML is escaped, script-free and offline; it is not a mock image of a completed Rust application.

Run one query directly:

python3 -m tools.reference.cli \
  --catalog examples/catalog.json \
  --context examples/context.json \
  --query examples/query.json

The synthetic alpha-tenant query returns 3 orders and a total of 40. The beta-tenant amount is excluded. Change only the query to examples/forbidden.json to observe an E_FORBIDDEN error. Context and catalog paths are trusted operator inputs, not client-controlled parameters.

The recorded reference report and desktop capture show the Python-reference example.

From query to result

The implemented Rust pipeline is:

flowchart LR
    Q[Restricted SQL / JSON] --> B[Bind names, types and authority]
    C[Trusted catalog + context] --> B
    B --> P[Mandatory PolicyScans]
    P --> O[Bounded safe rewrites]
    O --> V[Independent physical-plan verifier]
    V --> E[Original column-batch executor]
    E --> R[Complete bounded result or typed error]

Loading

Area	Inspect
Compiler entry point and opaque verified execution	src/lib.rs, src/verify.rs, src/execute.rs
Owned nullable columns and original operators	src/types.rs, src/operators/
Actual Rust CLI / SQLite and malformed-input checks	tests/acceptance_locked/, tests/property/, tests/security/
Executable semantic reference	tools/reference/engine.py
SQL-like NULL, duplicate, tenant, binding and SQLite comparisons	tests/test_reference.py
Deliberately broken tenant/NULL/join controls	scripts/mutation_reference.py
Command capture and output hash verification	scripts/evidence.py
Closed query and trusted catalog/context formats	API contract

Build and check the Rust product

The intended toolchain is pinned to Rust 1.99.0. In an environment with rustup and permitted official toolchain access:

make bootstrap
make build fmt lint check test

These commands must actually succeed before making a Rust verification claim. make format applies rustfmt; make fmt checks it. The production binary exposes run, explain and --version; the original seed is retained only with its historical tests.

Evidence that stays honest

The reference suite includes a 1,000-seed SQLite comparison test across filter/project, grouped aggregates, joins, scalar aggregates and ordering. Three targeted mutations exercise selected tenant, NULL and duplicate-handling defects. These counts describe test design and recorded reference execution, not coverage of all SQL, Rust validation, security certification or production users.

Verification report separates executed checks from outstanding requirements. Claims-to-evidence records scoped Rust successes alongside failed, blocked and unmeasured criteria. Benchmark methodology and results distinguish historical reference smoke/pilots from the complete scoped native Linux measurements.

make verify executes the 18 ordered product gates, including the guarded reference-host benchmark. make clean-verify owns the fresh committed clone and runs bootstrap, verify and demo there; native run18 completed that recipe. make release-verify runs the fresh procedure and then requires current passing published evidence for every locked criterion. The manual demo inspection remains missing. A green reference check or standard CI run does not establish full-product approval.

Boundaries worth reading

A trusted host can already read the catalog. This design limits what a restricted query can return; it does not hide information from that host, provide timing/inference privacy, isolate malicious operating-system processes or solve model prompt injection. Logical work/memory accounting must not be confused with hard OS resource isolation.

The prototype deliberately excludes arbitrary SQL functions, native code generation, distributed execution, external auth services, plan caching and spill. Threat model and limitations define the boundary precisely.

Documentation

Build and understand	Assess and reproduce
Product scope	Locked acceptance criteria
Architecture and decisions	Test matrix
API and data formats	Evaluation strategy
Operations	Verification report
Dependencies	Claims and evidence
Contributing	Security policy

Original source is MIT licensed. See third-party notices for runtime/dependency and synthetic-data provenance.

---

A result is useful only when its authority and its evidence are clear.