ADR-0010: Treat approved SQL as a bounded virtual source¶

• Status: Accepted — retrospective policy; aggregate extension authorized 2026-09-28.
• Recorded: 2026-09-29. This is the recording date, not an invented original approval date.
• Authority and implementation boundaries: see Evidence below and the register conventions.

Context¶

Users need SQL-derived schemas/results without granting unrestricted query execution or confusing aggregate profiling with row capture.

Decision¶

Parse one bounded local single-table SELECT; authorize physical table/columns through aliases. Query profiling uses no-row schema and aggregate wrappers and retains safe metadata, fingerprint and policy version, never SQL text/literals or query rows.

Policy 1.1 permits aliased SUM/COUNT/MIN/MAX/AVG and optional GROUP BY on authorized columns. COUNT(*) counts rows, not projection-star disclosure. Keep exclusions for joins, CTEs, subqueries, windows, arbitrary functions, writes and unsupported aggregate/grouping forms. Sensitive source references cannot be declassified through aliases/grouping. Derived expressions remain marked unsupported for automatic dependency-preserving inference.

Alternatives and consequences¶

Accepting arbitrary SQL is incompatible with the boundary. Recreating SQL aggregates in an internal formula engine is outside the accepted RC scope. Private row-result capture is a separate surface and does not enlarge default profiling/MCP budgets.

Evidence¶

Sources: SQL specification, safety guide, owner policy record. Executable anchors: SQL source policy tests, profiling tests. Scoped prior AI review evidence does not approve future changed code.

Revisit when¶

An additional SQL shape/function needs a separate policy amendment, negative tests and the required safety review.