learn-agent-launch-with-phoebe / Builder session 6 of 10
Learn Agent Launch with Phoebe · Builder track · Session 6 of 10

Gate the text-to-query bot: the answer is runnable, so run it

The second of three gating sessions, and the easy one - because this archetype hands you machine-checkable truth. Run the predicted query, run the gold query, compare the rows. That single move removes the judge from most of the eval. What it does not remove is a ceiling, a dominant failure class, and a set of criteria that accuracy alone will never see.

🟠 Builder track AI engineers · ML engineers · technical PMs 45 min
0-3 · Welcome 3-20 · Execution accuracy, the ceiling, the taxonomy 20-40 · Build-along: the Analyst Bot's harness and gate 40-45 · Q&A
Part 0

The archetype where the machine can settle the argument

Session b5 gated a bot with no ground truth, where correctness stayed an opinion until a human or a calibrated judge supplied one. Beacon's Analyst Bot is the opposite animal: every answer it produces is a query, and a query can be executed. That is the cheapest, sharpest grading rung on the ladder from b1, and this archetype lives on it.

Live - presented in session Self-study - read after class Official sources covered
★ What you walk out with today Execution accuracy as the field metric and why exact-set-match was deprecated, an honest read on the published ceiling from three converging pieces of evidence, the four-bucket failure taxonomy that matters more than the aggregate, abstention scored as a behaviour rather than assumed away, and a gate board on the Analyst Bot that you take to all green.
The running case: Beacon Analyst Bot Internal text-to-query bot over the warehouse. Analysts ask in English, it writes SQL, runs it, and returns rows. Read-only, so tier T2 and a bar of 85%. Nobody outside the company sees its output, which is exactly why it is under-governed: the blast radius is a wrong number in a Monday planning meeting, and that number leaves no trace.
Part 1 · the metric

Execution accuracy, and the ceiling nobody puts on the slide 7 min live

Two correct SQL queries almost never look alike. They join in a different order, alias differently, use a different date predicate, and return exactly the same rows. Any metric that compares the text rejects one of them, which is why the field moved to comparing what the queries do.

Exact-set-match - deprecated Compares predicted SQL text against gold SQL text. Two correct queries that differ in JOIN order or column order both score zero. Rightly retired. Execution accuracy (EX) - the field metric Run both queries. Compare the returned result multisets. Any SQL that produces the right rows passes, however it happens to be written. BIRD leaderboard SOTA against human Top test-set execution accuracy is about 81.95%. Human performance on the same benchmark is 92.96%. The gap to human is the honest ceiling. Spider 2.0 enterprise reality o1-preview solves 17.0% of real warehouse workflows, against 91.2% on the older Spider 1.0. Academic schemas do not predict enterprise schemas. Annotation audit the gold is wrong Audited gold-annotation error rates: 52.8% in BIRD Mini-Dev, 62.8% in Spider 2.0-Snow. Re-scoring 16 agents moved results -7% to +31% and ranks by 9. What the three of them mean together Above roughly 80% you are partly fitting annotation noise, not measuring capability. Self-reported Spider2-Snow entries above 96% and a 62.8% annotation-error audit of that same split are both true. Teach the tension.
🔍 Click to zoom - one metric, three pieces of evidence, and a ceiling that is lower than the leaderboard
★ Two queries exact-set-match scores as a miss, and EX scores as a pass -- gold SELECT c.region, SUM(o.amount) AS revenue FROM orders o JOIN customers c ON c.id = o.customer_id WHERE o.placed_at >= DATE '2026-07-01' AND o.placed_at < DATE '2026-08-01' GROUP BY c.region; -- predicted: other join order, other aliases, identical result multiset SELECT c.region, SUM(o.amount) AS revenue FROM customers c JOIN orders o ON o.customer_id = c.id WHERE o.placed_at >= DATE '2026-07-01' AND o.placed_at < DATE '2026-08-01' GROUP BY c.region;
LiveWhy the ceiling matters to your launch, not just to a leaderboard4 min▶

Three numbers, three different warnings, and they only make sense together.

  • BIRD: SOTA around 81.95%, human 92.96%. Humans do not reach 100% on this task either. When somebody asks your bot for 95% accuracy on natural-language queries, the honest answer is that measured human performance on the field's main benchmark is 92.96%.
  • Spider 2.0: o1-preview at 17.0%. The same class of model scores 91.2% on the older Spider 1.0. Nothing about the model collapsed - the schemas got real. Enterprise warehouses have hundreds of tables, dialect quirks, and multi-step workflows, and academic benchmark scores do not transfer to them.
  • The annotation audit: 52.8% and 62.8% gold-error rates. Re-evaluating 16 agents on corrected data shifted scores by -7% to +31% and moved rankings by up to nine positions. That is not a rounding correction; it is the leaderboard being partly a measurement of the labels.

The practical consequence for your own set is uncomfortable and worth saying out loud: above roughly 80% on any hand-annotated text-to-SQL set, some of what you are measuring is your annotators. That is not a reason to stop measuring. It is a reason to audit your own gold queries before you audit your model, and to stop treating the last few points as engineering progress.

Self-studyReading a vendor accuracy claim, using Snowflake's as the worked example3 min read▶

Snowflake published a 90%+ accuracy figure for Cortex Analyst. It is a useful number to read carefully, because every clause in it is doing work. The claim is measured on an internal 150-question benchmark, it is not independently verified, and it required three things at once: a curated semantic model over the tables, agentic retries rather than a single attempt, and lenient multi-gold scoring that accepts several correct queries per question. On the same internal set, single-shot GPT-4o scored 51%.

None of that makes the number dishonest. It makes it a number about a system on a specific set, and the 51% tells you how much of the system is doing the lifting. The transferable lesson is the shape of the question you ask any vendor, including yourself: whose questions, whose gold, how many attempts, how lenient the scoring, and who checked it. Session a3 turns those five into a grilling script.

Part 2 · the taxonomy

The aggregate hides which way it failed 6 min live

Two bots reporting 78% execution accuracy can be completely different products. One fails loudly, in a way the analyst notices within a second. The other fails silently, in a way that reaches a planning meeting. Report the taxonomy, not the headline.

Run the predicted query. Four things can happen, and one aggregate number hides which. 1 · Syntax error - the query does not run Loud, cheap, harmless. Caught by a dry-run before the user ever sees it. The best failure you can have, and the one teams report most proudly. 2 · Empty result - runs, returns nothing Also visible. The analyst sees zero rows and asks again. Annoying, not dangerous - nobody builds a board slide out of an empty table. 3 · Wrong but non-empty - the dangerous one Runs clean, returns plausible rows, and the number is wrong. Silent. It reaches a slide, a decision, a board pack. Only execution against gold finds it. 4 · Correct - but at what cost Right rows via a 4.2TB full-table scan. Correct and unaffordable. BIRD's R-VES weights execution accuracy by runtime ratio against the gold query. Where the wrong-but-non-empty ones come from Schema linking dominates the error taxonomy: 37% of BIRD errors are schema-linking failures and a further 36% are JOIN errors. In large multi-database settings that rises above 60%, up to 68.3%. The bot picked the wrong table or the wrong column. That is a context problem, not a model problem, and context is a lever you own. Report the taxonomy, not just the aggregate. Two bots at 78% EX are not the same bot if one fails loud and the other fails silently. The second one is the one that reaches a board pack.
🔍 Click to zoom - four outcomes, one of them silent, and the error class that produces it
The classifier, in nine lines of pseudo-code run(predicted) raises -> SYNTAX loud, dry-run catches it rows == [] and gold_rows != [] -> EMPTY visible, user retries sorted(rows) != sorted(gold) -> WRONG silent, this is the one sorted(rows) == sorted(gold) -> PASS then record runtime / gold_runtime # EX = PASS / total # and report SYNTAX, EMPTY, WRONG as three separate rates, always
Real world

The 3.1x revenue bug. Beacon's Analyst Bot joined orders to customers on the wrong key and reported 3.1 times the real revenue for a region. The query was syntactically perfect, ran in 400ms, returned a tidy grouped table, and nobody questioned it until the finance close two weeks later. That single incident is bucket 3 in the taxonomy and a schema-linking failure in the error class - the two most common findings in the published error analyses meeting in one production bug. The fix was not a bigger model. It was column descriptions and a curated set of joinable keys handed to the bot as context.

Self-studyWhy schema linking is the lever, and what "context" concretely means3 min read▶

Schema linking is the step where a natural-language phrase gets bound to an actual table and column. "Revenue" could be orders.amount, orders.gross, invoice_lines.net or a view somebody built in 2023. The bot cannot guess, and published error analyses keep landing in the same place: schema linking accounts for roughly 37% of BIRD errors with a further 36% attributable to JOIN mistakes, and in large multi-database settings the schema-linking share rises above 60%, measured up to 68.3%.

In practice, "give it schema context" means four unglamorous artifacts: column descriptions written by somebody who knows the business, an explicit list of joinable key pairs, a shortlist of the canonical tables for each common question type, and a set of worked examples of correct queries. None of that is modelling work. All of it is data-product work, which is precisely why it tends to be nobody's job and stays undone while the team argues about models.

Part 3 · beyond accuracy

Three criteria execution accuracy will never see 5 min live

A perfect EX score still leaves three launch questions unanswered: what the bot does when the question has no answer, what happens when a question has several right answers, and what stops it doing something destructive. Only one of those is a metric. The other two are a scoring choice and a rail.

Abstention TrustSQL scores it as a behaviour Real users ask questions the warehouse cannot answer: infeasible, or so under-specified that "best customer" has three defensible meanings. A bot with no abstention answers all of them confidently. TrustSQL's Reliability Score grades this directly, and under high penalty a model without abstention can score NEGATIVE - worse than answering nothing at all. Several right answers multi-gold, lenient column P and R One question can have several correct queries, and a single gold answer marks the others wrong. Snowflake's answer is to keep multiple gold queries per question and score column-level precision and recall leniently, so a valid alternative shape is not penalised for being different. Lenient scoring raises the number - say so when you report it. Rails, not metrics Cortex Analyst is read-only by design Snowflake Cortex Analyst is restricted to read-only operations: SELECT, SHOW, DESCRIBE, EXPLAIN. The engineered-DROP question cannot fail, because the DROP cannot execute. Add a least-privilege database role and a row limit and the whole class is gone. A rail removes a failure instead of measuring it, which is why it beats any metric you could add. Snowflake's 90%+ figure is INTERNAL and not independently verified: 150 questions, a semantic model, agentic retries and lenient multi-gold scoring. Single-shot GPT-4o scored 51% on that same set.
🔍 Click to zoom - one metric, one scoring choice, one rail, and the vendor claim read honestly
CriterionHow you score itWhat it catches that EX cannot
Execution accuracyRun predicted and gold, compare result multisetsThe core correctness question, deterministically
Failure taxonomySplit every miss into syntax, empty, wrong-non-emptyWhether your misses are loud or silent
AbstentionReliability Score with a penalty for confident wrong answers on infeasible questionsA bot that never says "that cannot be answered from this warehouse"
Multiple gold queriesSeveral accepted golds per question, lenient column-level precision and recallValid alternative queries being marked wrong by a single-gold set
EfficiencyR-VES: execution accuracy weighted by runtime ratio against goldA correct answer that scans 4.2TB and costs more than the analyst's afternoon
RailsNot scored - enforced. Read-only role, allowed verbs, row limitNothing. It removes the failure class rather than measuring it
The set that hides the abstention problem Every question in a normal text-to-SQL golden set has an answer, because that is how you build a golden set: you write a question, then you write the gold query. A question with no gold query does not get written. That single mechanical fact means the default set is structurally incapable of detecting a bot that never abstains - and real analysts ask infeasible and under-specified questions all day. You have to add those cases deliberately, and mark the expected behaviour as an abstention rather than a row set.
Demo 1 of 2

Build the Analyst Bot's execution harness ★ 12 min · everyone builds

Take the golden-set skeleton from b1 and give it the one thing this archetype allows: a runner. Twenty minutes of harness work replaces every judge call you were about to make.

For each case, freeze three things: the natural-language question, the gold SQL, and the gold result multiset stored as sorted rows. The stored rows are the ground truth. The gold SQL is only how you produced them, and it is allowed to be rewritten later without invalidating the case.

Write the runner: execute the predicted query against a frozen snapshot of the warehouse, execute or load the gold, and compare sorted multisets. Classify every miss into syntax · empty · wrong-non-empty and report the three rates alongside execution accuracy. If your report has one number on it, you built half a harness.

Set the category shares from a real query log, not from imagination. Beacon's Analyst Bot uses six: single-table filter and aggregate 25%, multi-table join needing schema linking 25%, under-specified question 15%, silently-wrong-filter 10%, correct-via-full-table-scan 10%, and an adversarial slice of questions engineered to emit a DROP at 15%.

Add the cases the golden-set method structurally omits: questions the warehouse cannot answer, and questions where "best" or "top" is undefined. Their expected behaviour is an abstention with a named reason, and they are scored right or wrong like any other case. This is the slice that decides whether your bot is honest.

Record runtime / gold_runtime next to every pass, and put the rails in the database rather than the prompt. A read-only role and a row limit are enforcement; "please do not drop tables" is a wish.

★ The rail that makes the adversarial slice unfailable -- enforcement lives in the grant, not in the system prompt CREATE ROLE bot_reader; GRANT USAGE ON SCHEMA analytics TO ROLE bot_reader; GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO ROLE bot_reader; -- no INSERT, UPDATE, DELETE, DROP or CREATE anywhere in this grant -- plus a hard row cap and a statement timeout on the bot's session
Audit your own gold before you audit your model Given audited gold-annotation error rates of 52.8% and 62.8% on two published benchmark splits, assume your own hand-written golds are wrong more often than you would like. Have a second person re-derive the gold result for twenty random cases. Every disagreement you find is a point of measured accuracy you were about to attribute to the model.
Demo 2 of 2

Take the Analyst Bot to all green ★ 10 min · everyone builds

The same board b9 uses, mounted on this archetype at tier T2. Two levers are dimmed as "not a gate for this bot" - work out why before you hover them.

Press Ship anyway at the default settings and read the incident list. Every line in it is one of the four taxonomy buckets wearing production clothes, and the 3.1x revenue bug is right there in the middle.

Switch on Retrieval / schema context alone and watch the multi-table join category recover. That single lever is the answer to the largest published error class in this archetype, and it costs you column descriptions rather than a model upgrade.

Hover the two dimmed levers. Cite-or-abstain grounding is dimmed because there is no passage to cite: correctness here is settled by executing the query, not by tracing prose back to a source. Human approval on irreversible actions is dimmed because a read-only query is reversible by definition - and it stops being dimmed the moment somebody lets this bot write.

Now switch on Action rails and Output verification together, then take the board to all six gates green. Note which lever fixed the full-table-scan category and which one fixed the silently-wrong filter. They are different levers and they defend different buckets of the taxonomy.

Read the honesty rail under the board The per-category pass rates are a teaching model of a bot with realistic failure modes - schema-linking failures dominate, because that is what the published error analyses show - and they are not a measurement of any real product. The statistics are not a model: the confidence figure is the lower bound of a real 95% Wilson interval, computed live in your browser from the successes and n shown. Change n and check it against the table in Leader session 4.
Homework

Try it yourself - this week ◐ 50-60 min total

Source material

Official sources covered

Every figure on this page traces to a primary source - published benchmarks, peer-reviewed papers and vendor documentation catalogued in this course's source map, dated 2026-08-13. This page covers:

✓Execution accuracy as the field metric; exact-set-match deprecated for rejecting valid alternative SQLPart 1 · named in b1, measured here
✓BIRD: SOTA test execution accuracy ~81.95% against human performance of 92.96%Part 1 · the ceiling, stated as a ceiling
✓Spider 2.0: o1-preview 17.0% on enterprise workflows vs 91.2% on Spider 1.0Part 1 · why benchmark scores do not transfer
✓Gold-annotation audit: 52.8% BIRD Mini-Dev, 62.8% Spider 2.0-Snow; 16 agents re-scored -7% to +31%, ranks moved by 9Part 1 + Demo 1 · taught against the 96%+ self-reported entries, not instead of them
✓Schema linking as the dominant error class: 37% of BIRD errors plus 36% JOIN errors; above 60-68.3% in large multi-database settingsPart 2 · the lever is context, not model size
✓TrustSQL Reliability Score: abstention as a scored behaviour, negative scores under high penaltyPart 3 · the slice a normal golden set cannot contain
✓Snowflake Cortex Analyst read-only restriction (SELECT/SHOW/DESCRIBE/EXPLAIN), and the internal, not independently verified, 90%+ claimPart 3 · rails by construction · single-shot GPT-4o at 51% on the same set
◐BIRD R-VES: execution accuracy weighted by runtime ratio against the gold queryNamed here as the efficiency gate · cost discipline in b3, cost gate in b9
◐Wilson interval arithmetic behind the confidence figure in Demo 2Used here, derived in a4
Check yourself

Three questions before you go 🎯 ◐ 90 seconds

1 · Why did the field deprecate exact-set-match in favour of execution accuracy?

Exact-set-match punishes valid alternative SQL, which makes it a measurement of writing style as much as correctness. Execution accuracy asks the only question that matters to the analyst - did the right rows come back - and it settles it deterministically, with no judge, no opinion and no dialect argument. Option C is a real irritation but it is not why the metric was retired.

2 · Your bot misses 22% of cases. Which failure bucket should worry you most?

Syntax errors are caught by a dry-run and empty results are caught by the analyst within a second. Neither reaches a slide. A silently wrong result set does - Beacon's bot joined on the wrong key, over-reported regional revenue by 3.1x, and nobody noticed until the finance close. That bucket is also where schema-linking failures land, which is roughly 37% of BIRD errors plus a further 36% of JOIN errors, and it is the reason you split the taxonomy instead of reporting one aggregate.

3 · A vendor cites 90%+ text-to-SQL accuracy. What is the honest way to read it?

The number is not dishonest and option C throws away real information. It is a claim about a whole system on one specific internal set, and the 51% single-shot figure tells you how much of the result comes from the semantic model, the retries and the scoring leniency rather than the model. It is also not comparable to BIRD, where SOTA sits around 81.95% against human performance of 92.96% - and where an audit found 52.8% gold-annotation errors in one split, which is the reason to be sceptical of everybody's high numbers, vendors included.

Builder session 6 cheat sheet · pin this

Execution accuracy, not text matchRun predicted and gold, compare result multisets. Exact-set-match was deprecated because it rejects valid alternative SQL.
The ceiling is not 100%BIRD SOTA ~81.95% against measured human performance of 92.96%. Anyone promising 95% is promising past human.
Enterprise is a different benchmarko1-preview: 91.2% on Spider 1.0, 17.0% on Spider 2.0 warehouse workflows. Academic scores do not transfer.
Above ~80% you fit annotation noiseAudited gold errors of 52.8% and 62.8%; re-scoring 16 agents moved results -7% to +31% and ranks by 9. Audit your own gold.
Split the taxonomySyntax, empty, wrong-but-non-empty, correct-but-expensive. The silent one is the dangerous one.
Schema linking is the lever37% of BIRD errors plus 36% JOIN errors, above 60-68.3% multi-database. Fixed with column descriptions, not a bigger model.
Score the abstentionGolden sets structurally omit unanswerable questions. Add them. TrustSQL's Reliability Score can go negative without abstention.
Rails beat metricsRead-only role, allowed verbs, row limit. Cortex Analyst is read-only by construction, so the DROP case cannot fail.