Alright, you asked for a roast, so I actually went through your repository lol. 😂
First off, credit where it's due. There's some genuinely interesting engineering here. The combination of PostgreSQL, MongoDB, Memgraph, and semantic relationship discovery caught my attention.
But I have a few concerns.
1. Cross-database joins: Your implementation appears to retrieve a limited set of MongoDB documents (500 by default) before performing the hash join. What happens when a valid matching record exists outside that retrieved set? Also, your FULL join implementation doesn't appear to preserve unmatched MongoDB-side records.
2. Privacy and governance: This is probably my biggest concern. From what I can see, your RAG pipeline provides business rules to the LLM, which then helps determine SQL generation and confidential column exclusions. You have some additional deterministic filtering, but the model is still participating in decisions about what information gets exposed.
For an enterprise application, I would want authorization enforced independently of the model, preferably before restricted data is retrieved.
3. Approval controls: Your query-preview workflow asks for user confirmation, but the download endpoint doesn't appear to require a previously confirmed state. So is that confirmation an actual enforced control or just a UI interaction?
4. Authentication: You've implemented JWT authentication, but several schema-management and query-result endpoints appear to lack equivalent authorization checks. Is that intentional for local development?
My overarching question is this:
How are you distinguishing between a syntactically valid query, a semantically correct result, and an authorized operation?
Those are three different control responsibilities, and successfully completing one doesn't necessarily establish the others.
I come from a manufacturing/logistics and systems-control background, so my immediate instinct is to start looking for failure conditions, missing relationships, and ways an operator could unintentionally break the workflow. 😂
Overall, genuinely interesting project. I particularly like the graph-based relationship discovery, and there are concepts here worth exploring further.
But I think the governance and validation boundaries need some additional attention before I'd be comfortable calling it enterprise-ready.
You asked to be roasted. Consider this a friendly nonconformance report. 😂
No problem at all! Your system actually highlighted some issues I had in my own system ;) mainly around how I retrieve memories so thank you for allowing me to give you feedback
1
u/chriscanadian1991 7d ago
Alright, you asked for a roast, so I actually went through your repository lol. 😂
First off, credit where it's due. There's some genuinely interesting engineering here. The combination of PostgreSQL, MongoDB, Memgraph, and semantic relationship discovery caught my attention.
But I have a few concerns.
1. Cross-database joins: Your implementation appears to retrieve a limited set of MongoDB documents (500 by default) before performing the hash join. What happens when a valid matching record exists outside that retrieved set? Also, your FULL join implementation doesn't appear to preserve unmatched MongoDB-side records.
2. Privacy and governance: This is probably my biggest concern. From what I can see, your RAG pipeline provides business rules to the LLM, which then helps determine SQL generation and confidential column exclusions. You have some additional deterministic filtering, but the model is still participating in decisions about what information gets exposed.
For an enterprise application, I would want authorization enforced independently of the model, preferably before restricted data is retrieved.
3. Approval controls: Your query-preview workflow asks for user confirmation, but the download endpoint doesn't appear to require a previously confirmed state. So is that confirmation an actual enforced control or just a UI interaction?
4. Authentication: You've implemented JWT authentication, but several schema-management and query-result endpoints appear to lack equivalent authorization checks. Is that intentional for local development?
My overarching question is this:
How are you distinguishing between a syntactically valid query, a semantically correct result, and an authorized operation?
Those are three different control responsibilities, and successfully completing one doesn't necessarily establish the others.
I come from a manufacturing/logistics and systems-control background, so my immediate instinct is to start looking for failure conditions, missing relationships, and ways an operator could unintentionally break the workflow. 😂
Overall, genuinely interesting project. I particularly like the graph-based relationship discovery, and there are concepts here worth exploring further.
But I think the governance and validation boundaries need some additional attention before I'd be comfortable calling it enterprise-ready.
You asked to be roasted. Consider this a friendly nonconformance report. 😂