docs(distributed-query): async queries are scoped to the submitting principal

[lukekim]

Summary

spiceai/spiceai#12841 scoped the async queries API to the principal that submitted each query. Listing, polling, fetching results, and cancelling now reach only the caller's own queries; another principal's query reports 404 Not Found (not 403) so query IDs cannot be probed, and ownership is resolved before result expiry so a non-owner cannot distinguish an expired job from a missing one. The scope is the request's cache namespace — public when unauthenticated, the principal's opaque id when authenticated, and an internal system scope for background runtime tasks — so it follows exactly the boundary already documented under Per-Principal Cache Isolation.

The Distributed Query page documented GET /v1/queries as "List all queries" and said nothing about ownership on the HTTP, Arrow Flight, or CLI surfaces.

Changes

• New Query Ownership section under Async Queries API covering the three owner scopes, the 404-not-403 behavior, the expiry-before-ownership ordering, and that jobs written by a pre-ownership runtime read as public.
• GET /v1/queries endpoint row: "List all queries" → "List the caller's queries".
• List Queries and Cancel Query sections note the ownership restriction.
• HTTP Error Responses: 404 row now includes a query submitted by a different principal.
• Arrow Flight API and CLI Subcommands note that the same scoping applies.

Verified against origin/trunk, not just the merged diff: current_job_owner() (crates/runtime/src/jobs/mod.rs), PUBLIC_JOB_OWNER = "public" (crates/runtime/src/jobs/state.rs), JobExecutor::require_owner/owned_job/list_jobs (crates/runtime/src/jobs/executor.rs), QueryCancelRegistry::cancel_owned/list_for (crates/runtime-datafusion/src/query_cancel_registry.rs), and the Flight call sites in crates/runtime/src/flight/actions.rs and async_actions.rs.

Source PRs

• fix(runtime): scope query jobs and active queries to the principal that submitted them spiceai#12841 — fix(runtime): scope query jobs and active queries to the principal that submitted them

Versioned-docs propagation

Addition — vNext only. The commit is in no release tag (git tag --contains 8fc9cec is empty; latest is v2.1.4), so versioned_docs/version-2.1.x/ correctly describes the pre-scoping behavior.

Test plan

• cd website && npm run build passes (Docusaurus throws on broken links / undefined tags)
• Versioned-docs propagation checked — addition, vNext only
• Files updated: 1

[github-actions]

✅ Pull with Spice Passed

Passing checks:

• ✅ Title meets minimum length requirement (10 characters)
• ✅ Has at least one of the required labels: area/blog, area/docs, area/cookbook, dependencies
• ✅ No banned labels detected
• ✅ Has at least one assignee: lukekim

[github-actions]

🚀 deployed to https://10f273a5.spiceai-org-website.pages.dev