test(lower): SQL conformance over the DQC synthetic-packet-trace corpus

[zzylol]

What & why

Adds the SQL counterpart of the awesome-prometheus-alerts corpus (#32): the 70 evaluation queries from the DQC synthetic-network-trace fidelity benchmark (metrics.py eval_metrics) — 29 packet level, 21 flow level stateless, 20 flow level stateful — as a real-world SQL conformance corpus.

Each benchmark query is run on a real trace and a synthetic trace and the two result sets are compared to score fidelity; here we only lower them (parse → L2 → L3). The corpus pins the SQL front end against regressions the same way the PromQL alert corpus does.

Tests only — no production code changes. Snapshot: crates/lower/tests/data/synthetic_packet_trace_queries.sql; suite: crates/lower/tests/synthetic_packet_trace.rs. Schema: packets(srcip, dstip, srcport, dstport, proto, time, pkt_len); flow / 5-tuple = (srcip, dstip, srcport, dstport, proto).

Headline finding

The SQL front end lowers all 70/70 queries — lowered: 70, rejected: 0, unparseable: 0. It handles every DQC construct end to end: CTEs (WITH), analytic window functions (LAG(time) OVER (PARTITION BY … ORDER BY time)), multi-argument COUNT(DISTINCT a, b, …), STDDEV_POP, HAVING, and CASE. Unlike the PromQL corpus (which is gated by the scalar-operand gap), the SQL side has no coverage gap on this benchmark.

What it pins

Corpus-wide invariant (corpus_lowering_is_total_and_fully_supported):

• Totality — every query lowers to Ok or a clean LoweringError, never panics.
• Parse/plan — 0/70 fail at the DataFusion parse/plan stage.
• Full-coverage ratchet — all 70 lower; a change that drops any query trips it deliberately.

Shape tests (verbatim corpus queries) pin the canonical L3:

• COUNT(*) → Count; COUNT(DISTINCT srcip) → Cardinality
• multi-column COUNT(DISTINCT srcip, dstip, srcport, dstport, proto) (5-tuple) → one Cardinality, grouped
• 5-tuple GROUP BY → five positional group keys + Count
• SUM(pkt_len) → Sum
• LAG(time) OVER (…) inter-arrival gap → analytic WindowFunc
• STDDEV_POP(gap) → population StdDev

Notes

• The _topnvalue / _topnkey / _distribution code variants are the same query scored with different distance metrics, so each is listed once (70 total).
• Corpus file format: ;-terminated statements; # / -- comment lines. The parser strips comments before splitting on ;, because the descriptions contain semicolons (e.g. "> 1 packet; zero duration").
• Follows the awesome_prometheus_alerts.rs structure so the two corpora read the same way.

🤖 Generated with Claude Code