<!-- ephemeral -->

# TeaQL safe SQL execution evidence (Go)

Use the trusted runtime telemetry sink to retain provider-native parameterized
SQL and structured binds. Project only bounded, application-safe fields before
returning diagnostics to a caller or Coding Agent.

```go
package assist_debug

import "github.com/teaql/teaql-golang/data_service"

type SafeSQLExecutionEvidence struct {
	Operation        data_service.DataServiceOperation
	ParameterizedSQL string
	ParameterCount   int
	ElapsedMicros    int64
	ResultCount      *int
	AffectedRows     *uint64
}

func SafeSQLEvidenceFrom(entries []data_service.ExecutionMetadata) []SafeSQLExecutionEvidence {
	result := make([]SafeSQLExecutionEvidence, 0, len(entries))
	for _, entry := range entries {
		result = append(result, SafeSQLExecutionEvidence{
			Operation: entry.Operation,
			ParameterizedSQL: entry.ParameterizedSQL,
			ParameterCount: len(entry.Parameters),
			ElapsedMicros: entry.EndedAt.Sub(entry.StartedAt).Microseconds(),
			ResultCount: entry.ResultCount,
			AffectedRows: entry.AffectedRows,
		})
	}
	return result
}
```

Create a `runtime.NewSQLExecutionEvidenceStore()`, attach it only to a trusted
server-created context with `WithRuntimeTelemetrySink`, and use `EnableAll`,
`EnableQuery`, `EnableMutation`, or `Disable` to control collection. Mode changes
clear earlier evidence. Raw `Parameters` and interpolated `DebugQuery` stay
inside the trusted boundary and are intentionally absent above.

Query and mutation logs and the stderr text sink are enabled on a new context.
The default is equivalent to
`context.WithDiagnosticSQLLogSink(runtime.NewTextDiagnosticSQLLogSink(os.Stderr))`.
Use `context.DisableSelectSqlLog()` and
`context.DisableMutationSqlLog()` as independent switches; use
`DisableSqlLog()` only to silence both. Each `ExecutionMetadata` retains
structured comment, purpose, audit reason, typed multi-level trace,
parameterized SQL, copy-paste `DebugQuery`, elapsed time, result count, and
affected rows. `WithDiagnosticSQLLogSink(nil)` removes operator output.
Rendered SQL must not enter ordinary telemetry or HTTP responses.

---

## TeaQL seven-language assist contract

Apply the verified Rust semantic ceiling while using only the exact GOLANG generated and
runtime APIs. Discover APIs through the generated application AGENTS.md and progressive
model-aware Assist. Do not inspect generated domain-library source.

- Do not create plurals by appending `s` or `es`; use the centralized generated plural.
- Human and non-human entities use different generated predicate vocabularies. Preserve
  forms such as “who are active” and “whose email is”; never infer them from English.
- Configure filters, projection, paging, and other query options before `purpose(...)`.
  Comment may appear anywhere in the chain. Purpose enters the executable stage; execution
  requires both values, but comment does not have to immediately precede purpose.
- Every execute/list/stream and every save accepts exactly one context argument:
  `UserContext`. Name that argument `context`, never `runtime`; data services and global
  policy are injected when the context is built. Reserve `runtime` for process-level
  runtime ownership, provider/pool setup, and module assembly.
- Tenant, merchant, identity, permissions, request policy, purpose policy, hard limit,
  and continuous-page cursor policy come only from trusted context, never dynamic JSON or TFP.
- If the required operation is absent after current entity/action and required field
  Assist, stop that path and report MISSING_ASSIST. Do not guess an API or search the
  generated library as a fallback.
- Create each application-owned source file once. After its first compile attempt,
  repair only the smallest block identified by the exact compiler or test diagnostic.
  Preserve unrelated code; do not rewrite the complete file as an error-recovery loop.
- Before a repair that would replace more than 25% of an existing application file,
  stop and report LARGE_REWRITE_REQUEST with the file, exact diagnostic, reason, and
  estimated scope. Initial creation and model-driven regeneration are not repairs.

Capability: `debug`.

- Capture purpose, comment, trace/correlation id, parameterized SQL summary,
  duration, row count, provider, and the runtime's native response when available.
- Preserve the immutable row audit event and the customizable App Audit Sink as
  separate paths. Redact credentials, tokens, connection strings, and customer data.
- Document only switches and hooks present in the selected runtime source.