feat(breg): add read-only external views over Adapter projections

crates/registry-adapter-core/src/checks.rs

@@ -1713,11 +1713,24 @@ fn source_route_checks(pack: &AdapterPack) -> Vec<Diagnostic> {
         .collect();
     for (index, source) in pack.source_routes.iter().enumerate() {
         let prefix = format!("/sourceRoutes/{index}");
-        let ingestion = source.evidence.is_none()
-            || source.scan.is_some()
+        let job_declared = source.scan.is_some()
             || source.next_recovery.is_some()
             || source.edits.is_some()
             || source.rescan_delay_seconds.is_some();
+        let ingestion = (source.evidence.is_none() && source.projection.is_none()) || job_declared;
+        if source.projection.as_ref().is_some_and(|projection| {
+            source.evidence.is_some()
+                || job_declared
+                || source.read_support.is_some()
+                || !projection.identifiers_valid()
+        }) {
+            findings.push(finding(
+                CheckCode::PackProjectionInvalid,
+                &format!("{prefix}/projection"),
+                "the projection contract has incompatible route roles or identifiers",
+                "Use a separate projection route with valid authority and scheme identifiers.",
+            ));
+        }
         if ingestion && source.scan.is_none() {
             findings.push(job_finding(
                 JobCode::SourceScanRequired,
@@ -2857,11 +2870,11 @@ fn evidence_only_endpoint_ids(pack: &AdapterPack) -> HashSet<String> {
         if source.evidence.is_some() {
             collect_source_endpoint_ids(&source.steps, &bodies, &mut evidence);
         }
-        let ingestion = source.evidence.is_none()
-            || source.scan.is_some()
+        let job_declared = source.scan.is_some()
             || source.next_recovery.is_some()
             || source.edits.is_some()
             || source.rescan_delay_seconds.is_some();
+        let ingestion = (source.evidence.is_none() && source.projection.is_none()) || job_declared;
         if ingestion {
             collect_source_endpoint_ids(&source.steps, &bodies, &mut ordinary);
         }

crates/registry-adapter-core/src/diagnostics.rs

@@ -53,6 +53,7 @@ pub enum CheckCode {
     PackInvalidHeaderName,
     PackMapParameterMisplaced,
     PackReadSupportInvalid,
+    PackProjectionInvalid,
     PackReservedHeaderName,
     PackScriptUncompilable,
     PackSqliteExtractInvalid,
@@ -207,6 +208,7 @@ impl CheckCode {
         Self::PackGraphQlQueryRequired,
         Self::PackInvalidHeaderName,
         Self::PackMapParameterMisplaced,
+        Self::PackProjectionInvalid,
         Self::PackReadSupportInvalid,
         Self::PackReservedHeaderName,
         Self::PackScriptUncompilable,
@@ -363,6 +365,7 @@ impl CheckCode {
             Self::PackInvalidHeaderName => "adapter.pack.invalid-header-name",
             Self::PackMapParameterMisplaced => "adapter.pack.map-parameter-misplaced",
             Self::PackReadSupportInvalid => "adapter.pack.read-support-invalid",
+            Self::PackProjectionInvalid => "adapter.pack.projection-invalid",
             Self::PackWriteSupportInvalid => "adapter.pack.write-support-invalid",
             Self::PackReservedHeaderName => "adapter.pack.reserved-header-name",
             Self::PackSqliteExtractInvalid => "adapter.pack.sqlite-extract-invalid",
@@ -583,6 +586,7 @@ impl CheckCode {
             | Self::PackInvalidHeaderName
             | Self::PackMapParameterMisplaced
             | Self::PackReadSupportInvalid
+            | Self::PackProjectionInvalid
             | Self::PackWriteSupportInvalid
             | Self::PackReservedHeaderName
             | Self::PackScriptUncompilable

crates/registry-adapter-core/src/job.rs

@@ -1278,12 +1278,16 @@ fn is_default_csv_trim(value: &bool) -> bool {
 #[must_use]
 pub fn check_job(job: &AdapterJob, pack: &AdapterPack) -> Vec<Diagnostic> {
     let mut findings = Vec::new();
-    if pack.source_routes.get(job.source.route.as_str()).is_none() {
+    if pack
+        .source_routes
+        .get(job.source.route.as_str())
+        .is_none_or(|route| route.projection.is_some())
+    {
         findings.push(job_finding(
             JobCode::RouteUnknown,
             "/source/route",
-            "the job names no source route its pinned pack declares",
-            "Name a sourceRoutes id of the pinned pack.",
+            "the job names no ingestion source route its pinned pack declares",
+            "Name an ingestion sourceRoutes id of the pinned pack.",
         ));
     }
     findings.extend(profile_consistency_checks(&job.profile));
@@ -2278,6 +2282,32 @@ mod tests {
         assert_eq!(findings[0].artifact.as_deref(), Some(ADAPTER_JOB_KIND));
     }
 
+    #[test]
+    fn check_job_cannot_acquire_from_a_projection_route() {
+        let mut value = serde_json::to_value(pack()).expect("pack serializes");
+        let source = value["sourceRoutes"][0]
+            .as_object_mut()
+            .expect("source route");
+        for member in ["scan", "edits", "nextRecovery", "rescanDelaySeconds"] {
+            source.remove(member);
+        }
+        source.insert(
+            "projection".to_owned(),
+            serde_json::json!({
+                "operation":"exact", "operationVersion":"1", "authority":"urn:example:registry",
+                "purpose":"licensing", "scope":"licensing-subjects",
+                "selectorScheme":"urn:example:id", "recordKeyScheme":"urn:example:id",
+                "retention":"retain", "absence":"protected", "localDisclosure":"host-profiles",
+                "fieldsSchema":{"path":"fields.json","digest":DIGEST},
+                "maximumBatchKeys":1, "maximumPages":1, "maximumRows":1
+            }),
+        );
+        let projection_pack = serde_json::from_value(value).expect("projection pack parses");
+        let findings = check_job(&job("kobo-submissions"), &projection_pack);
+        assert_eq!(findings[0].code, JobCode::RouteUnknown.code());
+        assert_eq!(findings[0].artifact.as_deref(), Some(ADAPTER_JOB_KIND));
+    }
+
     /// Each profile bound is a typed member: a value outside its
     /// 1-to-maximum range fails to parse, so a job that declares one never
     /// loads. The edge of each range parses; one past it does not.

crates/registry-adapter-core/src/lib.rs

@@ -45,6 +45,7 @@ mod preview_expectations;
 mod problem;
 mod profile;
 mod project;
+mod projection;
 mod result_schema;
 mod route;
 mod runtime;
@@ -66,6 +67,7 @@ pub use preview_expectations::*;
 pub use problem::*;
 pub use profile::*;
 pub use project::*;
+pub use projection::*;
 pub use result_schema::*;
 pub use route::*;
 pub use runtime::*;

crates/registry-adapter-core/src/pack.rs

@@ -446,11 +446,10 @@ pub struct EvidenceRouteContract {
     pub acquisition_posture: EvidenceAcquisitionPosture,
 }
 
-/// One source route of the governed-ingestion mode
-/// (`products/adapter/CONCEPT.md` sections 17.1 and 17.2): a route
-/// definition's steps plus the item-contract declaration. A source route
-/// is an entry point of the job mode, never a subroutine: a facade
-/// binding naming it, or a `direct:` send targeting it, refuses
+/// One source entry point for an ingestion, Evidence or projection host.
+/// The host's declaration supplies the operation contract alongside the
+/// steps. A source route is never a subroutine: a facade binding naming it,
+/// or a `direct:` send targeting it, refuses
 /// (`adapter.job.source-bound-refused`,
 /// `adapter.job.source-called-refused`). There is no `from`: the
 /// `from: file:` consumer form was rejected with the job's read step
@@ -459,7 +458,7 @@ pub struct EvidenceRouteContract {
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct SourceRouteDecl {
-    /// The source route identifier the job definition names.
+    /// The identifier the embedding host names.
     pub id: LocalId,
     /// Whether the scan ends. Mandatory; the checks refuse its absence
     /// under `adapter.job.source-scan-required`.
@@ -492,6 +491,9 @@ pub struct SourceRouteDecl {
     /// listener-free, read-only Evidence entry point.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub evidence: Option<EvidenceRouteContract>,
+    /// Separately governed acquisition for a host that may retain a projection.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub projection: Option<crate::ProjectionRouteContract>,
     /// The source-neutral read semantics this route explicitly supports. A
     /// facade host maps these native inputs and guarantees to its public
     /// protocol; it never infers them from a route id or source brand.
@@ -567,9 +569,8 @@ pub struct AdapterPack {
     /// The internal `direct:` routes shared sub-flows call.
     #[serde(default)]
     pub routes: UniqueIdList<RouteDefinition>,
-    /// The governed-ingestion source routes the job mode runs
-    /// (`products/adapter/CONCEPT.md` sections 17.1 and 17.2). Entry
-    /// points of the job mode; a facade route never reaches one.
+    /// The source routes of the ingestion, Evidence and projection hosts.
+    /// A facade route never reaches one.
     #[serde(default)]
     pub source_routes: UniqueIdList<SourceRouteDecl>,
     /// The code maps routes convert values through.
@@ -614,6 +615,9 @@ impl AdapterPack {
             )
             .collect();
         for source in &self.source_routes {
+            if let Some(projection) = &source.projection {
+                files.push(&projection.fields_schema);
+            }
             if let Some(evidence) = &source.evidence {
                 files.push(&evidence.inputs_schema);
                 files.push(&evidence.facts_schema);
@@ -861,6 +865,7 @@ mod tests {
                 edits: Some("ordered".to_string()),
                 rescan_delay_seconds: None,
                 evidence: None,
+                projection: None,
                 steps: Vec::new(),
             }])
             .expect("unique"),
@@ -948,6 +953,7 @@ mod tests {
                     edits: None,
                     rescan_delay_seconds: None,
                     evidence: None,
+                    projection: None,
                     steps: Vec::new(),
                 },
                 SourceRouteDecl {
@@ -958,6 +964,7 @@ mod tests {
                     edits: None,
                     rescan_delay_seconds: None,
                     evidence: None,
+                    projection: None,
                     steps: Vec::new(),
                 },
             ])