recon + sqlglot validator + drill_down package; guard ReAct dimension picks against candidate list

ctrl/recon.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Rebuild the per-dataset recon artefacts inside the api pod and copy them
+# back to the host so they're visible next to the source YAMLs.
+#
+# Outputs per dataset under api/datasets/<name>/:
+#   - extracted_schema.json   (auto, from Postgres introspection)
+#   - recon.json              (merged: extracted + schema_docs.yaml + metrics.yaml)
+#
+# Usage:
+#   bash ctrl/recon.sh                # all datasets
+#   bash ctrl/recon.sh financial      # one dataset
+
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+CTX="${KCTX:---context kind-nvi}"
+NS="${KNS:--n nvi}"
+
+POD=$(kubectl $CTX $NS get pod -l app=api -o jsonpath='{.items[0].metadata.name}')
+if [ -z "$POD" ]; then
+    echo "no api pod found; is \`make tilt-up\` running?" >&2
+    exit 1
+fi
+
+# Run the build inside the pod (needs live Postgres access).
+build_args=()
+if [ "${1-}" != "" ]; then
+    build_args+=(--dataset "$1")
+fi
+kubectl $CTX $NS exec "$POD" -- uv run python -m api.recon.build "${build_args[@]}"
+
+# Pull each artefact back to the host.
+for ds_path in api/datasets/*/; do
+    ds=$(basename "$ds_path")
+    case "$ds" in
+        __*|.*) continue ;;
+    esac
+    if [ "${1-}" != "" ] && [ "$1" != "$ds" ]; then
+        continue
+    fi
+    for f in extracted_schema.json recon.json; do
+        if kubectl $CTX $NS cp "$POD:/app/api/datasets/$ds/$f" "api/datasets/$ds/$f" 2>/dev/null; then
+            echo "  → api/datasets/$ds/$f"
+        fi
+    done
+done