M3 Resource graph API: a per-tenant projection into ClickHouse

[Rikarin]

docs/plan/01 § Management · a CyberCloud.ResourceManager query API · M3.

"A per-tenant projection into ClickHouse fed by the resource change stream. Not KQL — SQL over a flattened table."

Two dependencies, and the first is the reason this is M3 rather than M2:

• There is no resource change stream to feed it. The write path records membership now (IResourceManager has no ListAsync — the collection endpoint and its authorization filter #10), and IResourceGroupGrain holds the inventory, but nothing emits a change event a projection could consume.
• ListObjects (M2 ReBAC: ListObjects and the Leopard index #37) — a graph query answers "which resources", which is the authorization question Check cannot answer at scale.

ClickHouse is already the logs and traces tier and is already database-per-tenant, so the projection has a home.

[Rikarin]

Both halves landed on master — 723177a+75d9a13 (projection, merged 2c1ec56's parent 115fe0c) and 47e9a8b+a268a8e (query, merged 2c1ec56). Leaving open for what is written as owed.

The stream: resource-changed rides NATS JetStream directly (NATS.Client.JetStream 3.1.0) on cc.{tenant}.res.{provider}.{type}.{id} — not Microsoft.Orleans.Streaming.NATS, re-checked on 2026-09-17: fourteen versions, every one -alpha.1, and the producer is the gateway, an Orleans client with no stream provider. One builder (ResourceChangedEvents.From) for the gateway's and the silo's emissions, so the columns cannot drift (⚠ at merge it gained #90's Path, or the watch seam would have seen nothing from the silo side).

The projection: CyberCloud.ResourceGraph — a silo-side consumer per tenant writing doc 08's flattened row into the tenant's ClickHouse (tenant_{N}.resource_graph), idempotent on (resource_id, version), with the access column filled from #37's membership index. Proven against a real NATS and a ClickHouse Testcontainer, replay idempotent. The AppHost carries a ClickHouse for it.

The query API — a KQL subset, translated, never exposed (the decision is a dated correction in docs/plan/01 and /08): Microsoft.Azure.Kusto.Language 12.4.1 parses and binds against one declared resources table; KqlTranslator walks the bound tree into one ClickHouse SELECT — where/project/extend/summarize/order by/take/distinct/count and the scalar functions the subset names, tags.<key> reading the Map — with every literal a parameter, is_deleted = 0 AND hasAny(access, {caller}) on the base, max_execution_time/max_rows_to_read/readonly=2 per query, and a refusal naming the operator and the supported list for anything else. POST /tenants/{t}/providers/CyberCloud.ResourceGraph/resources with { query, $top, $skipToken }, and cyc graph query. Golden files, the refusal list, injection attempts rendered as parameters, and the endpoint over the real gateway against the projector-fed ClickHouse. ⚠ The Kusto NuGet artefact ships a Microsoft EULA (the GitHub source is Apache-2.0); the ADR-011 reading and the exit are recorded in docs/plan/02.

⚠ Owed (docs/plan/08 § The resource-graph projection): the address is outside the generated document — #63's question a fourth time; no id spelled as the resource path (the row lacks parent names); ago/now/bin; a relation change recomputes the access column only on the next resource change; the portal's explorer.