Governed text-to-SQL · the trust boundary
The referee that won't let a confident wrong number ship.
On the Spider 2.0 enterprise benchmark, frontier models collapse to ~10-17%, and the failures are the dangerous kind: a silently wrong join, a missing fiscal-period filter, a wrong revenue definition, returning a confident wrong number in a board pack. Here, the model only drafts the SQL. Deterministic code parses that candidate and checks it, clause by clause, against a versioned semantic contract, then ALLOWS, ABSTAINS with the exact violated clause, or ESCALATES to a human. synthetic data · runs in your browser
Two questions a naive assistant gets confidently wrong
Same English question. Left: the number a naive text-to-SQL baseline ships. Right: the gate refuses and names the contract clause it violated. The prevented-error delta is the whole pitch.
Run any request through the gate
Pick a question from the 25-question bank. The gate shows the candidate SQL, the deterministic contract checks, and the verdict, with the certified number for allows, the cited clause for abstains, and a steward step for escalations. Contract version ·.
English → model drafts candidate SQL → deterministic referee checks it against the semantic contract (metrics · certified joins · mandatory filters · required grain) → ALLOW / ABSTAIN / ESCALATE, logged to a replayable hash-chained ledger. The model never decides whether a query runs. · willytai.com