GraphModule treats a valid foreign-key path as insufficient authority for a text-to-SQL join

A newly public MIT-licensed repository, TEXTtoSQL GraphModule, takes a stricter approach to text-to-SQL planning: a database path can be physically connected and still be rejected as semantically unauthorized. The repository was created on September 29 and had no stars or forks when checked; it also launched without a root README or a published benchmark, so this is an architecture worth inspecting rather than evidence of production readiness. Source

The model does not write the final SQL

The implementation’s orchestrator divides a request into 13 measured stages. An LLM-backed question analyzer produces structured intent, which is normalized into a canonical semantic query. From there, separate components resolve graph paths, data grain and columns, build a query plan, compile SQL deterministically, validate it, apply guardrails, execute it and assemble an answer. Each stage records latency and the stage at which a failed request stopped. Source

That split matters because it narrows the model’s authority. The model participates in interpreting the question, while the compiler—not the model—owns the final SQL text. The current compatibility adapter also exposes a meaningful limit: the planning pipeline supports at most one semantic aggregation. Source

A join path needs two kinds of permission

GraphModule stores ontology information in Neo4j and execution data in PostgreSQL. Its graph planner first resolves business concepts to tables and searches for physical paths. But physical connectivity alone does not authorize a multi-hop route: every adjacent table pair in an inferred bridge must also have a semantic relationship in the ontology. Candidate paths are ranked only after that semantic check. Source

This is a useful distinction for analytics agents. Foreign keys say that rows can be joined; they do not prove that the resulting relationship has the intended business meaning. Encoding that second test as an explicit planning gate makes a semantic layer part of authorization, not merely extra prompt context.

The execution boundary fails closed

The PostgreSQL executor accepts only queries that passed both validation and guardrails. It uses bound parameters, starts a read-only transaction, applies a transaction-local statement timeout, and retrieves one row beyond its configured cap so the response can report truncation. Defaults are five seconds and 500 returned rows. Source

The caveats are substantial. Setup requires PostgreSQL and Neo4j credentials, the dependency list is unpinned and duplicated, and the repository provides no root README explaining installation or ontology loading. Most importantly, there is no published accuracy, latency or adversarial-safety evaluation. Source

For now, GraphModule belongs in the directory as an early research implementation. Its notable contribution is not a score; it is the decision to make semantic join authority inspectable and enforceable between intent parsing and SQL execution.