SQL Editor — Classic mode
The SQL Editor at /admin/sql lets an authorized workspace user browse data
objects, write SQL, run queries, inspect or export results, and retain useful
work. This is the canonical assessment page for the Classic path.
It describes what was observed, what source code indicates, and what remains
unknown. The tested Classic path was observed working in Keycloak realm
gj76anadpsc, workspace w-t5e2kcxjd; that observation is limited to the
account, workspace, and journeys recorded below.
For technical routing and system boundaries, see SQL Editor architecture — Classic mode. For the detailed runtime record, see SQL Editor live evidence — Classic mode.
Current status
| Field | Current value |
|---|---|
Runtime in gj76anadpsc | Observed working — Classic mode, one admin account, workspace w-t5e2kcxjd (visible name alicloud01) |
| Deployment identity | Keycloak realm gj76anadpsc; workspace w-t5e2kcxjd; Kubernetes context dev-north-alicloud |
| Availability | Available, verified from reviewed source and deployed page evidence on 31 August 2026 |
| Assessment coverage | Partial — the admin Classic path includes a 10,000-row probe and deployed-topology inspection, but other roles, modes, upper scale boundaries, controlled failures, and workload saturation remain open |
| Source reviewed | UI and BFF on 31 August 2026; platform stacks refreshed on 3 September 2026 |
| Runtime observed | Page journeys on 31 August 2026; deployed query topology on 3 September 2026 |
| Assessment tracking | Issues #39 and #47 |
Candidate roles visible in route source include platform administrator, tenant
administrator, data engineer, machine-learning engineer, data analyst, and data
steward. Only one visible admin account was tested. Route visibility does not
prove data authorization for those roles.
Availability and evidence boundaries
Availability is established from reviewed source and deployed runtime evidence. Untested conditions are listed separately; they do not change whether the feature exists in the reviewed deployment.
| Capability or journey | Availability, verified 31 August 2026 | Actors and environment | Evidence, limits, and exclusions |
|---|---|---|---|
| Classic execution | Available — source and deployed runtime verified | One visible admin; realm gj76anadpsc; workspace w-t5e2kcxjd; dev-north-alicloud | Success, invalid SQL, zero rows, retry, two-tab overlap, exact repeat, and a 10,000-row generated result were observed. Other roles, timeout, recovery, and larger scale were not tested. |
| Classic outside the observed scope | Not assessed | Other roles, workspaces, realms, clouds, regions, and tenancy conditions | Candidate roles and workspace routing exist in source; runtime wiring and access decisions were not tested. |
| Accelerated or Nitro | Present in source; runtime not assessed | No runtime actor or environment was tested | UI, BFF, and deployment routes exist, but source signals conflict about environment exposure. Execution, authorization, history, failure, recovery, and scale were not tested. |
| History, saved queries, and Query preview | Available — source and deployed runtime verified | One admin in the observed realm/workspace | Inline history, one Save/create/delete cycle, preview, and a non-executing Open in SQL Lab handoff were observed. Update, failure, ownership, retention, and recovery were not tested. |
| Share | UI only; no shareable query resource is defined | Any actor shown the current dialog | Saved queries have backend IDs, but the editor has no canonical query URL or route that loads a query by ID. Share does not bind to a saved-query ID, and permission selections are not persisted. |
| Schedule | Unavailable | One admin in the observed realm/workspace | The control was disabled in source and runtime. |
| Scale and performance | Fixed query and metadata capacity observed; workload boundaries not assessed | Classic, one Chromium session and deployed configuration in the observed realm/workspace | The query cluster had one fixed coordinator and worker. Hive Metastore had two fixed replicas, but its PostgreSQL backend had one small fixed replica. No managed query-compute or end-to-end metadata scaling policy was evidenced. A 10,000-row table worked and a 10,000-category chart was unstable; sustained concurrency, metadata-heavy planning, failover, and larger browser/export boundaries were not tested. |
Classic execution currently depends on an authenticated caller, active account and workspace, workspace BFF, Superset, a routable Trino cluster, Ranger, metastore and object storage, and enough browser memory and storage for the result.
The assessment used read-only SQL against approved data. It did not test DDL or DML, Nitro, dashboard publication, upstream cancellation, partial results, destructive testing, stress testing, or recovery objectives. Sharing changes are not implemented and scheduling is disabled.
Main journeys
| Journey | Evidence collected | What remains |
|---|---|---|
| Open SQL Editor with workspace context | Page opened in alicloud01 with Classic, delta.default, one tab, and limit 1,000. | Other roles, missing context, and cross-workspace isolation |
| Select catalog and schema, then author SQL | The page showed delta and default, but these are observed deployment values; current source derives delta from a Superset database connection rather than the real Trino catalog layer. Valid formatting was observed. | Populate Catalog dynamically from Superset's Trino catalog API, retain databaseId only for internal routing, select an authorized default or stable first item rather than hard-coding delta, and verify the remaining authoring interactions |
| Use autocomplete | Source supplies generic keywords and globally flattened metadata already loaded in the warehouse tree. | Live behavior, Trino syntax coverage, table/alias-scoped columns, CTEs, and pre-run diagnostics |
| Run and recover from SQL errors | Success, syntax failure, zero rows, correction, and retry were observed. | Empty editor, invalid catalog, unauthorized data, and other engine errors |
| Repeat an exact query | Identical SQL containing current_timestamp and uuid() produced two execute requests, distinct execution records, and distinct results. | Cache telemetry, data-table warming, invalidation, and freshness boundaries |
| Run across tabs | Two bounded read-only Classic queries overlapped: the quick tab entered Executing while the long tab still showed its running spinner; both completed with independent results. The deployed query cluster had one fixed worker and no evidenced admission policy. | Sustained or higher-width concurrency, queuing, fairness, limits, autoscaling, cost controls, and failure isolation |
| Cancel, time out, or interrupt work | Source aborts the browser request and clears local state when Stop is used. | Safe live cancellation, upstream Trino cancellation, timeout, engine outage, partial output, and recovery |
| Inspect and export results | Search, sort, a cell viewer, 10,000 returned rows, 50-row paging, and search for row 10,000 were observed. | Cell copy, CSV/TSV/Excel, 100,000 rows, long values, browser memory, and export limits |
| Build visualizations | A three-row Bar chart and PNG/PDF exports worked. With the 10,000-row result, 10,000 unique categories first rendered blank; reducing to 100 categories rendered, and switching back produced an unreadably compressed chart. | Other chart types, malformed/mixed/untrusted data, chart-local recovery, and an approved point/cardinality budget |
| Use history, Save, preview, and rename | Inline history, Save/create/delete, non-blank rename/restore, preview, and Open in SQL Lab were observed. Preview loaded a tab without executing SQL. | History copy/freshness, saved-query update/failure, blank rename validation, ownership, and retention |
| Share or schedule | Share opened and Schedule was disabled. Source confirms Share has no canonical query target, deep-link route, or access mutation. Schedule is unconditionally disabled and has no click handler. | Define query identity, URL resolution, and authorization before implementing Share; implement or remove Schedule |
| Restore prior work | Distinct SQL and results survived tab switching, reload, and in-app navigation. An explicitly selected tab survived reload. | Newly created tabs can lose active selection on reload; workspace isolation, retention, browser quota, and accurate restored-result status remain open |
Candidate findings and workarounds
These entries are candidate observations, not accepted risk-register findings. The IDs provide assessment traceability. Components names the repository or runtime involved; it is not a person or team assignment. Evidence confidence describes only how strongly the evidence supports the condition.
Observed means the behavior was captured in the deployed workspace; Source-verified means the reviewed client behavior is unconditional; Source risk means the implementation creates a credible risk but no runtime failure or disclosure was demonstrated. Each ID links to exact reproduction or verification steps.
| Candidate finding | Components | Evidence status | Evidence confidence | Current action |
|---|---|---|---|---|
PROD-SQL-002 — Autocomplete is not semantic | sparqd/oqullus; sparqd/bff-api for engine validation | Source-verified; table-scoped live evidence pending | High | Use the warehouse tree and Trino execution for validation; decide whether semantic assistance is required. |
UX-SQL-005 — Failed runs retain prior output | sparqd/oqullus | Observed + source-verified | High | After a failed Run, Visualization can silently chart the previous successful result because it is rendered before the failure panel. Treat the chart and retained output as stale, return to Raw Result, correct SQL, and rerun. |
REL-SQL-001 — One Run sent three failed requests | sparqd/oqullus; BFF, Superset, and Trino are downstream | Observed + source-matched | High | This is client retry, not polling: the shared wrapper retries HTTP 500 twice after 500 ms and 1,000 ms. A live Trino cast failure produced three distinct query IDs, proving repeated engine execution. |
ARCH-SQL-002 — Results use custom IndexedDB persistence | sparqd/oqullus | Observed + source-verified | High | Rerun when freshness matters; define retention, expiry, isolation, and whether Superset retrieval should replace the browser copy. |
UX-SQL-002 — Inline history is stale until remount | sparqd/oqullus | Observed once | High | Reopen SQL Editor or use Queries before treating history as complete. |
UX-SQL-003 — Save conflates browser drafts with persisted query state | sparqd/oqullus; Superset saved-query API is the dependency | Observed + source-verified; reload duplicate risk not live-tested | High | Editing autosaves only to the browser; Run records execution but does not save the query; Save immediately creates or updates the backend resource. Separate tab, saved-query, and execution identity; add Save As, dirty state, atomic ID persistence, and truthful failure handling. |
PROD-SQL-001 — Restored results display Ready | sparqd/oqullus | Observed | High | Rerun when freshness matters; define restored-result semantics. |
UX-SQL-006 — New tabs may not restore as active | sparqd/oqullus | Observed + source-verified | High | Explicitly click a new tab before reload; persist active selection on add/close. |
UX-SQL-004 — Some icon controls lack accessible names | sparqd/oqullus | Observed | High | Add and test accessible names for each affected control. |
REL-SQL-002 — Visualization failure can replace the editor | sparqd/oqullus | Source risk; crash not injected | High | Add chart-local containment; prefer Raw Result for uncertain data. |
GOV-SQL-001 — High-cardinality visualization is unstable and uncapped | sparqd/oqullus | Observed + source-verified | High | Aggregate to low-cardinality groups, use Raw Result, and establish chart budgets. |
PROD-SQL-003 — Sharing lacks a canonical query identity and deep link | sparqd/oqullus; sparqd/bff-api if a share/access API is required | Dialog observed; source-verified | High | Saved-query IDs exist, but Share is not bound to one and no URL can load a query by ID. Define the shareable resource, resolver route, and authorization model before presenting Share. |
PROD-SQL-005 — Schedule is surfaced but permanently disabled | sparqd/oqullus; scheduling service only if implemented | Observed + source-verified | High | The button is always rendered with disabled={true} and no click handler. Implement it or remove it from the SQL Editor. |
SEC-SQL-001 — Tooltip encoding is not established | sparqd/oqullus | Source risk; exploitability unverified | Medium | Avoid charting untrusted text until an inert encoding contract is security-reviewed. |
ARCH-SQL-001 — Browser state lacks workspace identity | sparqd/oqullus | Source risk; disclosure not demonstrated | Medium | Do not rely on restored state after workspace changes; define partitioning and cleanup. |
REL-SQL-003 — Stop has no explicit upstream-cancel request | sparqd/oqullus, sparqd/bff-api, Superset, Trino | Client source-verified; engine outcome unverified | High | Correlate Superset/gateway/Trino telemetry until upstream cancellation is proven. |
PROD-SQL-004 — Nitro exposure and support conflict | sparqd/oqullus, sparqd/platform-stacks | Source conflict; runtime support unverified | High | Use Classic until the deployed component matrix is published. |
PERF-SQL-001 — Fixed Trino query capacity lacks managed scaling and workload admission | sparqd/platform-stacks; Trino; Trino Gateway; Kubernetes; Prometheus; sparqd/oqullus | Deployed topology + source-verified; saturation test pending | High | Add workload admission and explicit queue states first, then scale query workers from workload signals within guarded limits. Gateway autoscaling does not add query capacity. |
ARCH-SQL-003 — Trino cluster deployment is not a managed product lifecycle | sparqd/platform-stacks; sparqd/oqullus; sparqd/bff-api; Trino Gateway; Trino; Ranger | Source-verified architecture gap; lifecycle acceptance pending | High | Keep raw sizing internal. If isolation is required, expose logical compute lifecycle and routing while catalogs and Ranger policies remain a shared data-access plane. |
PERF-SQL-002 — Hive Metastore capacity and availability are not managed end-to-end | sparqd/platform-stacks; Hive Metastore; KubeBlocks PostgreSQL; Kubernetes; Prometheus; Trino and Spark consumers | Deployed topology + source-verified; load, failover, and recovery tests pending | High | The installer already exposes HMS Size. Expand it into an administrator-facing metadata capacity profile covering HMS, database, pooling, storage, and HA; use managed autoscaling only when safe. |
Assessment maturity
The platform scale is 0–4: 0 means no evident capability, 1 ad hoc, 2 partly documented or automated, 3 routinely verified, and 4 measured and improving. No overall average is calculated.
| Lens | Maturity | Why |
|---|---|---|
| Product and feature completeness | 1 | Core behavior exists, but other modes and several critical journeys remain unassessed. |
| UX and accessibility | 1 | Core journeys are usable, but stale state, active-tab restoration, accessible names, confirmation, and visualization recovery are unresolved. |
| Application and integration architecture | 2 | UI, BFF, Superset, gateway, Trino, Ranger, storage, and saved-work paths are source-mapped; internal-hop runtime tracing remains open. |
| Infrastructure and cloud controls | 1 | KCL and the deployed topology were inspected: query capacity is fixed, Hive Metastore replicas are fixed, and its PostgreSQL backend is a single small replica. Saturation, admission, query-worker and metadata scaling, database failover/recovery, network controls, and exact deployed provenance remain unverified. |
| Security and privacy | 1 | Identity and Ranger paths exist in source; role denial, cross-workspace isolation, sharing, tooltip encoding, audit, and fail-closed behavior are not demonstrated. |
| Data architecture and governance | 1 | Metastore, object storage, result persistence, and policy dependencies are mapped; retention, deletion, lineage, masking, and data-quality controls remain unverified. |
| Reliability and operations | 1 | Basic UI state and possible telemetry exist; cancellation, timeout, dependency failure, SLOs, alerts, runbooks, and recovery exercises are absent. |
| Engineering quality and delivery | 1 | Immutable source references exist, but SQL Editor-focused tests, deployed revision linkage, promotion gates, rollback evidence, and owner sign-off are absent. |
| Cost, performance, ownership, and lifecycle governance | 1 | A 10,000-row probe worked, but query and metadata capacity are fixed and no admission or managed query-compute lifecycle was evidenced. HMS/PostgreSQL connection and storage budgets, larger tested limits, benchmarks, attribution, ownership, upgrade cadence, and lifecycle decisions are unknown. |
Evidence method
Assessment follows a source-first order:
- Read Oqullus and BFF source to establish unconditional client and proxy behavior.
- Read Superset source and platform-stacks KCL for dependency and deployment intent.
- Inspect deployed non-secret configuration only when environment values can change the answer.
- Run a targeted live check only for integration, authorization, failure propagation, or scale behavior that source cannot prove.
A supported code path does not require duplicate live testing. It is recorded as Source-verified unless the support claim specifically depends on successful runtime wiring. Missing runtime evidence remains explicit rather than being inferred from source.
Remaining evidence
Safe checks still to run
- Warehouse search, refresh, expand, copy, and insert
- Close-tab active fallback, blank rename validation, shortcuts, and selected-statement execution
- Small result limits, pagination, cell copy, and CSV/TSV/Excel downloads
- History copy and saved-query update
- Other chart types, empty/text-only results, and deployed autocomplete behavior
Controlled environment or owner participation required
- Restricted-role, unauthorized-object, Ranger, redaction, and audit evidence
- Cross-workspace persistence and tenant-isolation checks
- BFF, Superset, Trino, metastore, storage, timeout, and partial-output failures
- Upstream cancellation and recovery
- Nitro mode and mode-specific performance
- 100,000-row, browser-memory, visualization, and download boundaries
- Controlled query-concurrency ramp, saturation, queuing, fairness, and recovery
- Query-worker scale-out and safe scale-in under active and queued work
- Logical compute create, route, resize, stop, restart, failure, and deletion lifecycle
- Metadata-heavy planning concurrency, HMS replica scaling, database connection saturation, PostgreSQL failover, backup restore, and storage exhaustion
- Malformed or untrusted chart data, tooltip security, and fault injection
Review blockers
- Product, UI, BFF, Dashboard Access Management, data-platform, security, data, and operations owners have not been named or recorded as reviewers.
- The deployed Superset, BFF, and Trino versions are recorded, but the deployed UI and KCL revision are not tied to the reviewed commits.
- Browser evidence artifacts remain in temporary assessor storage.
- No environment-specific SLOs, dashboards, alerts, incidents, runbooks, recovery exercises, performance budgets, or cost controls were supplied.
Classic was observed working in realm gj76anadpsc, workspace w-t5e2kcxjd,
for the tested scope. Assessment
coverage remains Partial, owner confirmation is Pending, and issue #47
must remain open until the blockers are resolved or explicitly accepted.
Evidence used
| Evidence | Reference | Boundary |
|---|---|---|
| Cogrion UI source | Oqullus commit 363355f968fed665a8c7b6cb23045049ec6bbfe9 | Client behavior and source gaps only |
| Workspace API source | BFF API commit ef1ea8de0679ef58e8def9483eba07c214dd1e0c | Proxy and authentication routes only |
| Deployment source | Platform stacks KCL commit a71390d124638bc7a91926e7cdd2de7b6684a8ee | Declared architecture, not deployed values |
| Deployed observation | Live evidence | One admin, one workspace, Classic, literal read-only SQL |
Missing evidence is recorded as not yet confirmed. Source presence alone does
not establish environment-dependent behavior outside realm gj76anadpsc and
workspace w-t5e2kcxjd.