DATA-ONT-001 — Validate model executability before publication
| Field | Value |
|---|---|
| Status | Open finding; source-verified |
| Severity | High |
| Components | sparqd/ontology, Cube, Trino, sparqd/oqullus |
| Associated issues | sparqd/ontology-backend#15 |
Concrete observed case
Backend save validation checks request shape, names, member types, primary-key
presence, relationship targets, and brace balance. sql_table need only be
non-empty. Dimension, measure, and relationship SQL is not parsed or resolved.
Proposal submission and merge do not compile the complete model or validate it
against current Trino metadata.
Oqullus populates table and column options from Superset, but expressions remain free text and API callers can bypass the form. A selected table can also be renamed or removed after the browser loaded its metadata.
Expected condition
Working-branch drafts may remain datasource-unresolved with explicit diagnostics. Proposal submission and merge must validate the exact branch revision by generating and compiling the full Cube model and checking physical table, column, relationship, and expression references against the effective Trino identity.
Why it matters
A proposal can be approved and merged successfully but fail only when a user queries it. That moves data-contract failure from a controlled publication gate to consumers and makes an approved model appear trustworthy when it is not.
Existing controls and workarounds
Browser metadata selectors reduce basic table and column typos. Structural backend validation catches malformed definitions and missing Ontology targets. Authors must currently run representative semantic queries manually before submission and again before merge.
Alternatives considered
- Recommended: allow draft saves, persist validation status, hard-gate proposal submission and merge on server-owned Cube plus datasource validation.
- Block every save until executable — stronger but hostile to incremental modeling and temporarily unavailable datasources.
- Validate only in Oqullus — rejected because API callers and metadata drift bypass the browser.
Component involvement
- Ontology backend owns validation orchestration, revision binding, diagnostics, and the publication gate.
- Cube compiles the generated complete model.
- Trino validates physical metadata under an explicitly chosen validation identity and policy.
- Oqullus displays draft validity and actionable field diagnostics.
Reproduction and verification
Resolution conditions
Close when invalid physical references or Cube compilation errors can remain a clearly invalid draft but cannot pass proposal submission or merge, metadata drift is caught by revalidation, and diagnostics identify the object/member and failing dependency.
Validation and blockers
The missing checks are source-confirmed. Product must approve draft semantics, and data/security reviewers must define whether validation uses the author, reviewer, or a constrained service identity.