refactor(daemon-service): move query authz and remote protocol

crates/tracedecay-daemon-service/Cargo.toml

@@ -50,6 +50,7 @@ tracedecay-contracts = { path = "../tracedecay-contracts", version = "0.1.0" }
 tracedecay-code-index = { path = "../tracedecay-code-index", version = "0.1.0", default-features = false }
 tracedecay-code-index-runtime = { path = "../tracedecay-code-index-runtime", version = "0.1.0", default-features = false }
 tracedecay-configuration = { path = "../tracedecay-configuration", version = "0.1.0" }
+tracedecay-daemon-identity = { path = "../tracedecay-daemon-identity", version = "0.1.0" }
 tracedecay-daemon-protocol = { path = "../tracedecay-daemon-protocol", version = "0.1.0" }
 tracedecay-dashboard-api = { path = "../tracedecay-dashboard-api", version = "0.1.0" }
 tracedecay-domain = { path = "../tracedecay-domain", version = "0.1.0" }
@@ -65,16 +66,20 @@ tracedecay-rusqlite-runtime = { path = "../tracedecay-rusqlite-runtime", version
 tracedecay-semantic = { path = "../tracedecay-semantic", version = "0.1.0" }
 tracedecay-semantic-contracts.workspace = true
 tracedecay-session-memory = { path = "../tracedecay-session-memory", version = "0.1.0" }
+tracedecay-session-temporal-store = { path = "../tracedecay-session-temporal-store", version = "0.1.0" }
 tracedecay-sessions = { path = "../tracedecay-sessions", version = "0.1.0" }
 tracedecay-source-edit = { path = "../tracedecay-source-edit", version = "0.1.0" }
 tracedecay-store = { path = "../tracedecay-store", version = "0.1.0" }
+tracedecay-store-runtime = { path = "../tracedecay-store-runtime", version = "0.1.0" }
 tracedecay-tool-catalog = { path = "../tracedecay-tool-catalog", version = "0.1.0" }
 tracedecay-application = { path = "../tracedecay-application", version = "0.1.0" }
 url = "2"
 
 [dev-dependencies]
 tempfile = "3"
+tracedecay-search-eval = { path = "../tracedecay-search-eval", version = "0.1.0" }
 tokio = { version = "1", features = ["full", "test-util"] }
 tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt"] }
+tracedecay-code-index-runtime = { path = "../tracedecay-code-index-runtime", version = "0.1.0", default-features = false, features = ["test-helpers"] }
 tracedecay-global-db = { path = "../tracedecay-global-db", version = "0.1.0", features = ["test-helpers"] }
 tracedecay-runtime-core = { path = "../tracedecay-runtime-core", version = "0.1.0", features = ["test-helpers"] }

crates/tracedecay/src/daemon/callable_code_authorization.rs → crates/tracedecay-daemon-service/src/callable_code_authorization.rs

@@ -1,19 +1,20 @@
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use tracedecay_contracts::{
-    ApplicationOperation, ApplicationProblem, ApplicationProblemKind, AuthorityReceipt,
-    CallableCodeAuthorizationAdmission, CallableCodeAuthorizationFuture,
+    ApplicationContractError, ApplicationOperation, ApplicationProblem, ApplicationProblemKind,
+    AuthorityReceipt, CallableCodeAuthorizationAdmission, CallableCodeAuthorizationFuture,
     CallableCodeAuthorizationPort, RequestAdmission, RequestContext, ResolvedScope, RetryDirective,
     SafeDiagnostic,
 };
-use tracedecay_daemon_service::callable_code_request_context;
 use tracedecay_domain::{ComponentVersion, UtcMicros};
 
+use crate::callable_code_request_context;
 use tracedecay_application::{
     CallableCodeAuthorizationSourcePort, CurrentCallableCodeAccessFuture,
     ProjectSourceAccessSnapshot,
 };
+use tracedecay_configuration::config::PinnedRuntimeConfiguration;
 use tracedecay_configuration::{
     ConfigurationControlStore, ConfigurationError, ProjectConfigurationRuntime,
 };
@@ -23,63 +24,69 @@ type CurrentCallableCodeAccess =
     dyn Fn(UtcMicros) -> CurrentCallableCodeAccessFuture<'static> + Send + Sync;
 
 #[derive(Clone)]
-pub(super) struct DaemonCallableCodeAuthorizationSource {
+pub struct DaemonCallableCodeAuthorizationSource {
     access: Arc<CurrentCallableCodeAccess>,
 }
 
 impl DaemonCallableCodeAuthorizationSource {
-    fn new(
+    pub fn new(
         access: impl Fn(UtcMicros) -> CurrentCallableCodeAccessFuture<'static> + Send + Sync + 'static,
     ) -> Self {
         Self {
             access: Arc::new(access),
         }
     }
 
-    pub(super) fn production(
+    pub fn production(
         project_root: PathBuf,
         scope: ResolvedScope,
         configuration: Arc<ProjectConfigurationRuntime>,
+        source_access_at: impl Fn(
+            &ResolvedScope,
+            &Path,
+            &PinnedRuntimeConfiguration,
+            UtcMicros,
+        )
+            -> Result<ProjectSourceAccessSnapshot, ApplicationContractError>
+        + Send
+        + Sync
+        + 'static,
     ) -> Self {
         let project_root = Arc::new(project_root);
         let scope = Arc::new(scope);
+        let source_access_at = Arc::new(source_access_at);
         Self::new(move |observed_at| {
             let project_root = Arc::clone(&project_root);
             let scope = Arc::clone(&scope);
             let configuration = Arc::clone(&configuration);
+            let source_access_at = Arc::clone(&source_access_at);
             Box::pin(async move {
                 let current = configuration
                     .configuration_store()
                     .current()
                     .await
                     .map_err(configuration_current_problem)?;
-                let configuration =
-                    tracedecay_configuration::config::PinnedRuntimeConfiguration::new(
-                        configuration.configuration_target().clone(),
-                        current.revision_id,
-                        current.snapshot,
-                    )
-                    .map_err(|_| concealed())?;
-                crate::daemon::project_open_owners::daemon_owned_project_source_access_at(
-                    &scope,
-                    &project_root,
-                    &configuration,
-                    observed_at,
+                let configuration = PinnedRuntimeConfiguration::new(
+                    configuration.configuration_target().clone(),
+                    current.revision_id,
+                    current.snapshot,
                 )
-                .map_err(|_| concealed())
+                .map_err(|_| concealed())?;
+                source_access_at(&scope, &project_root, &configuration, observed_at)
+                    .map_err(|_| concealed())
             })
         })
     }
 
     #[hotpath::skip]
-    pub(super) async fn current(
+    pub async fn current(
         &self,
         observed_at: UtcMicros,
     ) -> Result<ProjectSourceAccessSnapshot, ApplicationProblem> {
         (self.access)(observed_at).await
     }
 
-    pub(super) fn authorize(
+    pub fn authorize(
         &self,
         admitted_access: ProjectSourceAccessSnapshot,
     ) -> DaemonCallableCodeAuthorization {
@@ -107,20 +114,35 @@ impl CallableCodeAuthorizationSourcePort for DaemonCallableCodeAuthorizationSour
 }
 
 #[derive(Clone)]
-pub(crate) struct DaemonCodeGraphReadAdmission {
+pub struct DaemonCodeGraphReadAdmission {
     scope: ResolvedScope,
     authorization: DaemonCallableCodeAuthorizationSource,
 }
 
 impl DaemonCodeGraphReadAdmission {
-    pub(crate) fn production(
+    pub fn production(
         project_root: PathBuf,
         scope: ResolvedScope,
         configuration: Arc<ProjectConfigurationRuntime>,
+        source_access_at: impl Fn(
+            &ResolvedScope,
+            &Path,
+            &PinnedRuntimeConfiguration,
+            UtcMicros,
+        )
+            -> Result<ProjectSourceAccessSnapshot, ApplicationContractError>
+        + Send
+        + Sync
+        + 'static,
     ) -> Self {
         Self::new(
             scope.clone(),
-            DaemonCallableCodeAuthorizationSource::production(project_root, scope, configuration),
+            DaemonCallableCodeAuthorizationSource::production(
+                project_root,
+                scope,
+                configuration,
+                source_access_at,
+            ),
         )
     }
 
@@ -246,7 +268,7 @@ fn map_graph_admission_problem(problem: ApplicationProblem) -> CodeGraphReadErro
     }
 }
 
-pub(super) struct DaemonCallableCodeAuthorization {
+pub struct DaemonCallableCodeAuthorization {
     source: DaemonCallableCodeAuthorizationSource,
     admitted_access: ProjectSourceAccessSnapshot,
 }

crates/tracedecay-daemon-service/src/lib.rs

@@ -57,17 +57,24 @@
 pub use tracedecay_runtime_core::DAEMON_TASK_ABORT_DEADLINE as TASK_ABORT_DEADLINE;
 
 pub mod application_surface;
+pub mod callable_code_authorization;
 pub mod invocation;
 mod mcp_project_registry;
 mod mcp_workflow_index;
 pub mod project_owner_registration;
 pub mod project_runtime;
+pub mod query_authority_provider;
+pub mod query_mcp_admission;
 pub mod remote_http_transport;
+pub mod remote_protocol;
 pub mod request_cancellation;
 mod shutdown_coordination;
 
 mod multi_root;
 
+pub use callable_code_authorization::{
+    DaemonCallableCodeAuthorizationSource, DaemonCodeGraphReadAdmission,
+};
 pub use invocation::semantic_evaluation::SemanticInvocationControlV1;
 #[cfg(any(test, feature = "test-helpers"))]
 pub use invocation::{
@@ -111,6 +118,15 @@ pub use project_runtime::{
     SemanticOwnerRegistrationSignalsV1, StoreObservabilityMountErrorV1, StoreObservabilityMountV1,
     StoreObservabilityRegistryV1,
 };
+pub use query_authority_provider::{
+    DaemonQueryActivationRegistrarV1, DaemonQueryAuthorityProviderV1,
+    QueryAuthorityProviderStatusV1, QueryAuthorityUpdateErrorV1,
+};
+pub use query_mcp_admission::{
+    QUERY_MCP_READ_CAPABILITY_V1, QueryMcpAdmissionUnavailableV1, QueryMcpReadAdmissionProviderV1,
+    QueryMcpReadAdmissionV1, admit_query_mcp_read,
+};
+pub use remote_protocol::build_daemon_remote_protocol_router;
 pub use request_cancellation::{Lease, RequestCancellationRegistryV1};
 pub use shutdown_coordination::{ShutdownCoordinatorV1, ShutdownStatus};
 pub use tracedecay_daemon_protocol::{