2 The Stack: An Overview

2.1 The journey of a question

A question enters the stack at the top and evidence comes out at the bottom:

1. An agent — or a person, or another agent framework speaking MCP or HTTP — asks a question.
2. QueryGraph searches the semantic model — OSI business terms, Croissant field semantics, ontology terms — for what the question means here, in this organization’s vocabulary.
3. The rights layer decides, per source, whether this principal may read it: RBAC and ODRL must both allow. Every decision, allow or deny, becomes a receipt.
4. SQL is planned only over allowed Sail sources; denied sources are named as off-limits, and never touched.
5. Synthesis happens — deterministically, or via any LLM — and the answer travels in a TypeDID envelope signed with Ed25519 under a did:key verification method.
6. An OpenLineage event (spec-conformant, schema-validated) records the run, and an Ed25519 attestation anchors the event hash.

Each step is somebody’s component. The semantic graph lives in Grust (and is queryable through Sail’s Cypher extension). The envelope machinery and the capability model are TypeSec. The tables come from a lakehouse whose catalog transitions LakeCat governs. And QueryGraph is the layer that makes them one system with one evidence chain.

A useful way to read that chain — the sentence the whole stack exists to make true: the answer used OSI metric X, resolved to Sail table Y, under capability C and odrl:read, emitting OpenLineage run R anchored by attestation A — and source Z was denied, with a receipt. No mainstream agent framework offers that sentence.

2.2 Versions and codenames

Stack releases are coordinated by codename, each repo keeping SemVer independently:

The 0.12 substrate wave landed together: Grust merged the Full39075 GQL profile, TypeSec shipped its agent-interoperability platform, and LakeCat moved to both while proving stock-client Iceberg REST conformance — with QueryGraph verified green against all three. QueryGraph 0.4.0 “Sentinel” ships on top of that wave: where Goshawk opened the doors (MCP, A2A, /v1, cross-language crypto), Sentinel stands guard over what comes through them.

2.3 The workspace

The repositories expect sibling checkouts:

~/src/
├── querygraph/          # meta-repo: README, FABLE-REVIEW-1, workspace map
│   ├── qg-rust/         # reference implementation (this guide lives here)
│   ├── qg-python/       # Pythonic mirror
│   ├── sail/            # fork, branch `grust`, Cypher extension
│   └── semantic/        # research: Polaris SemanticModel, OSI round-trips
├── grust/               # path dependency of qg-rust
├── lakecat/             # path dependency of qg-rust
└── typesec/             # consumed from crates.io