Read-only Querying

#Query Flow

For SQLite and PostgreSQL, the model requests one dialect-specific tool:

• data_query_sqlite
• data_query_postgresql

Each call includes source_id, sql, and optional positional parameters. The runtime then:

1. confirms the tool was projected for an active source;
2. validates arguments against the declared schema;
3. parses and normalizes exactly one SQL statement;
4. resolves tables, columns, and relationships against current catalog facts;
5. rejects unsafe syntax, functions, or source scope;
6. revalidates at the connector boundary;
7. executes once through a read-only connection or transaction; and
8. returns a bounded, schema-validated result.

#Read-only Contract

Arbitrary SQL mutation is outside Daita 1.0. Approval of a model request does not enable INSERT, UPDATE, DELETE, DDL, stored procedures, or another external write path.

PostgreSQL uses a deliberately bounded function set because server functions can perform external I/O even inside a read-only transaction. SQLite also installs a connector-level authorizer.

#Catalog Scope

A query must reference at least one current resource in the selected source. Tables and columns not present in the committed snapshot are rejected before source I/O. The result records source and resource revisions so returned evidence retains its structural provenance.

#Result Bounds

Tool output includes:

• canonical SQL and a SQL fingerprint;
• source and resource IDs and revisions;
• output columns and JSON-safe rows;
• row and byte limits;
• returned and total row counts when available;
• truncation status and reasons; and
• trust classification.

Truncation is explicit. A model should not present a truncated result as a complete population.

#Parameters

Model-proposed values should be supplied through parameters when possible rather than interpolated into SQL. Connector adapters preserve normalized, JSON-safe values and reject unsupported value shapes.

#Failure and Repair

Parser, catalog, freshness, and connector failures become bounded model-visible tool results. The direct loop may let the model correct a query on the next step, but it does not start a separate repair workflow or verifier pass.

#File Reads

CSV and JSON use data_read_file, not SQL. The call references a catalog resource ID rather than a path and follows the same source-scope, freshness, row, and byte-bound principles.