jgi-lakehouse — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited jgi-lakehouse (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
What is it? JGI's unified data warehouse (651 tables) + filesystem access to genome files.
Two data access methods:
SQL Dialect: ANSI SQL (not PostgreSQL)
CAST(x AS type) not ::REGEXP_LIKE() not ~"gold-db-2 postgresql"-- Quick test
SELECT gold_id, project_name FROM "gold-db-2 postgresql".gold.project
WHERE is_public = 'Yes' LIMIT 5;LIMIT; remove LIMIT for comprehensive results.| Task | Action |
|---|---|
| Test Lakehouse | Query "gold-db-2 postgresql".gold.project |
| Query IMG metadata | Use "img-db-2 postgresql".img_core_v400.* tables |
| Query NUMG proteins | Join faa and gene2pfam on both oid and gene_oid |
| Download IMG genome | Copy {taxon_oid}.tar.gz from /clusterfs/jgi/img_merfs-ro/img_web/img_web_data/download/ |
| Link reads | Start with jamo info all pmoid <img_jgi_project_id> |
DREMIO_PAT for SQL; filesystem/JAMO access for files or reads.DREMIO_VERIFY_TLS (default 1; set false only for internal endpoints with unavailable CA validation), DREMIO_REQUEST_TIMEOUT (default 60 seconds), IMG_DOWNLOAD_DIR, and IMG_DATA_DIR.LIMIT clauses.oid + gene_oid for NUMG.See examples/04-download-img-genomes.md and examples/05-query-numg-metagenome-proteins.md.
Issue: Metadata query returns no sequence files. Solution: Use filesystem, portal downloadRequestFiles, or JAMO.
Issue: Final answer is based on 50 or 100 rows. Solution: Remove exploratory limits or use aggregation.
Issue: Dremio HTTPS fails with certificate verification errors on the internal endpoint. Solution: Prefer configuring the local CA bundle; for an explicit internal-network fallback, set DREMIO_VERIFY_TLS=false and record that opt-out in the run notes.
| Need | Source | Access Method |
|---|---|---|
| Metadata (taxonomy, projects) | Lakehouse | SQL via REST API |
| Gene annotations (COG, Pfam, KO) | Lakehouse | SQL via REST API |
| Genome sequences (FNA) | JGI Filesystem | Copy from /clusterfs/jgi/img_merfs-ro/ |
| Protein sequences (FAA) | JGI Filesystem | Copy from /clusterfs/jgi/img_merfs-ro/ |
| Metagenome proteins only | Lakehouse | numg-iceberg.faa table |
Critical insight: The Lakehouse is a METADATA warehouse. Genome sequences must be accessed from the JGI filesystem.
| Source | Path | Contents |
|---|---|---|
| GOLD | "gold-db-2 postgresql".gold.* | Projects, studies, samples, taxonomy |
| IMG | "img-db-2 postgresql".img_core_v400.* | Taxons, genes, annotations (244 tables) |
| Portal | "portal-db-1".portal.* | Download tracking, file paths |
| Mycocosm | "myco-db-1 mysql".<organism>.* | Fungal genomes (2,711 schemas) |
| Phytozome | "plant-db-7 postgresql".* | Plant genomics — see docs/phytozome.md |
| NUMG | "numg-iceberg"."numg-iceberg".* | Metagenome proteins, Pfam hits |
Full table catalog: See docs/data-catalog.md
Phytozome (plant-db-7 / plant-db-4): Read docs/phytozome.md before writing any queries against these sources.
Use NUMG when the task is metagenome protein sequence/domain analysis.
Scope rules:
numg-iceberg is metagenome-focused.Core tables:
"numg-iceberg"."numg-iceberg".faaoid, gene_oid, faa (protein sequence)"numg-iceberg"."numg-iceberg".gene2pfamoid, gene_oid, pfam, evalue, alignment coordinate fieldsRecommended query flow:
-- 1) Confirm available NUMG tables
SHOW TABLES IN "numg-iceberg"."numg-iceberg";
-- 2) Inspect schema before writing joins/filters
DESCRIBE "numg-iceberg"."numg-iceberg".faa;
DESCRIBE "numg-iceberg"."numg-iceberg".gene2pfam;
-- 3) Domain filter (use exact lowercase pfam IDs)
SELECT oid, gene_oid, pfam, evalue
FROM "numg-iceberg"."numg-iceberg".gene2pfam
WHERE pfam IN ('pfam00001', 'pfam00004')
LIMIT 100;
-- 4) Join domains to protein sequences
SELECT
p.oid,
p.gene_oid,
p.pfam,
p.evalue,
f.faa
FROM "numg-iceberg"."numg-iceberg".gene2pfam p
JOIN "numg-iceberg"."numg-iceberg".faa f
ON p.oid = f.oid
AND p.gene_oid = f.gene_oid
WHERE p.pfam = 'pfam00001'
LIMIT 100;Important NUMG rules:
oid and gene_oid (not gene_oid alone).pfam00001, not case-transformed).LIMIT and expand only after verifying row shape.See also: examples/05-query-numg-metagenome-proteins.md
# Genome packages are at:
/clusterfs/jgi/img_merfs-ro/img_web/img_web_data/download/{taxon_oid}.tar.gz
# Example: Copy and extract
cp /clusterfs/jgi/img_merfs-ro/img_web/img_web_data/download/8136918376.tar.gz .
tar -xzf 8136918376.tar.gzPackage contents:
{taxon_oid}.fna - Genome assembly{taxon_oid}.genes.faa - Protein sequences{taxon_oid}.genes.fna - Gene nucleotide sequences{taxon_oid}.gff - GFF annotations{taxon_oid}.cog.tab.txt - COG annotations{taxon_oid}.pfam.tab.txt - Pfam annotations{taxon_oid}.ko.tab.txt - KEGG KO annotationsUse this workflow when you need to go from an IMG metagenome assembly to the underlying JGI reads.
Assemblies live under:
/clusterfs/jgi/img_merfs-ro/img_web_data_merfs/{taxon_oid}/assembled/For a metagenome taxon OID, the most useful linkage fields are:
img_jgi_project_idsequencing_gold_idsample_gold_idstudy_gold_idgold_project_idgold_pmo_project_idgold_its_spidIn practice, img_jgi_project_id is often the strongest key for JAMO because it behaves like the PMO project identifier used by jamo info ... pmoid.
pmoid for JGI read lookupNative JAMO lookup types are listed by:
apptainer run docker://doejgi/jamo-dori:latest jamo info helpFor legacy JGI metagenomes, this usually works better than raw_normal spid:
apptainer run docker://doejgi/jamo-dori:latest \
jamo info all pmoid <img_jgi_project_id>If you only want FASTQ rows, filter the output:
apptainer run docker://doejgi/jamo-dori:latest \
jamo info all pmoid <img_jgi_project_id> | rg 'fastq(\\.gz)?'This queries JAMO by the IMG taxon OID embedded in metadata:
apptainer run docker://doejgi/jamo-dori:latest \
jamo info all custom '{"metadata.gold_data.img_oid": 3300000030, "file_name": {"$regex": ".*fastq(\\\\.gz)?$"}}'This can recover reads even when the older spid route is blank, but in recent re-audits pmoid recovered many more JGI rows.
spid is valid, but not sufficientIf you already have a verified sequencing project ID, this is still worth trying:
apptainer run docker://doejgi/jamo-dori:latest \
jamo info raw_normal spid <gold_its_spid>But do not stop there. In several JGI cases:
raw_normal spid returned nothingall pmoid <img_jgi_project_id> returned usable FASTQ recordsInspect one metadata record:
apptainer run docker://doejgi/jamo-dori:latest jamo show <metadata_id>Fetch a file by filename:
apptainer run docker://doejgi/jamo-dori:latest \
jamo fetch -s dori all filename <file_name>That prints the staged scratch path, typically under:
/clusterfs/jgi/scratch/dsi/...Important:
RESTORED, you can use the staged path immediatelyPURGED, jamo fetch only starts the restore; you must wait until the staged path exists and has non-zero size before using itSimple wait pattern:
while [[ ! -s /clusterfs/jgi/scratch/dsi/.../file.fastq.gz ]]; do sleep 10; doneFor JGI metagenome read recovery, use this priority:
jamo info all pmoid <img_jgi_project_id>jamo info all custom '{"metadata.gold_data.img_oid": ...}'jamo info raw_normal spid <gold_its_spid>Do not assume "no reads" until all three have been checked. Do not assume a fetched file is ready until the staged path is actually restored.
The portal tracks downloadable files for Mycocosm and Phytozome in "portal-db-1".portal.downloadRequestFiles. Use filePath to copy data from the JGI filesystem (/global/dna/dm_archive/...).
Mycocosm (fungal genomes/proteins):
SELECT filePath, fileType
FROM "portal-db-1".portal.downloadRequestFiles
WHERE LOWER(filePath) LIKE '%mycocosm%'
AND (filePath LIKE '%.fasta%' OR filePath LIKE '%.fa%' OR filePath LIKE '%.faa%')
LIMIT 20;Phytozome (plant genomes/proteins):
SELECT filePath, fileType
FROM "portal-db-1".portal.downloadRequestFiles
WHERE LOWER(filePath) LIKE '%phytozome%'
AND (filePath LIKE '%.fa%' OR filePath LIKE '%.fna%' OR filePath LIKE '%.faa%')
LIMIT 20;Download from filesystem:
cp /global/dna/dm_archive/<path/from-filePath> .Notes:
fileType typically includes Assembly, Annotation, or Sequence.virtualPath can provide a user-facing download label but filePath is the real location.⚠️ CRITICAL: When building queries, distinguish between exploration and comprehensive analysis:
Use LIMIT for quick validation during development:
-- For testing query structure and results
SELECT gold_id, project_name
FROM "gold-db-2 postgresql".gold.project
WHERE is_public = 'Yes'
LIMIT 10; -- ✓ OK for testingRemove `LIMIT` and other result-limiting clauses when answering actual questions:
-- For getting actual dataset counts/results
SELECT COUNT(DISTINCT taxon_oid)
FROM "img-db-2 postgresql".img_core_v400.taxon
WHERE genome_type = 'metagenome'
AND is_public = 'Yes';
-- ✓ No LIMIT - gets true totalCommon pitfalls:
LIMIT 100 on initial exploration → assumes only 100 results existLIMIT 50 on a "find all" query → misses 99% of dataFETCH FIRST N ROWS → same issue as LIMITBest practice:
LIMIT with COUNT(*) or small LIMIT during development-- Get count of all finished bacterial isolates
SELECT COUNT(DISTINCT taxon_oid) as total_isolates
FROM "img-db-2 postgresql".img_core_v400.taxon
WHERE domain = 'Bacteria'
AND genome_type = 'isolate'
AND is_public = 'Yes'
AND seq_status = 'Finished';
-- Get sample of isolates (if you need details)
SELECT taxon_oid, taxon_display_name, phylum, genus, species
FROM "img-db-2 postgresql".img_core_v400.taxon
WHERE domain = 'Bacteria'
AND genome_type = 'isolate'
AND is_public = 'Yes'
AND seq_status = 'Finished'
LIMIT 100;SELECT COUNT(DISTINCT t.taxon_oid) as total_linked
FROM "img-db-2 postgresql".img_core_v400.taxon t
WHERE t.sequencing_gold_id IS NOT NULL;SELECT COUNT(DISTINCT taxonOid) as total_tar_gz
FROM "portal-db-1".portal.downloadRequestFiles
WHERE taxonOid IS NOT NULL
AND filePath LIKE '%.tar.gz';| Wrong | Correct |
|---|---|
| Using `LIMIT` in comprehensive queries | Remove `LIMIT` when answering actual questions; use COUNT() for aggregation |
Join ncbi_assembly on project_id | ncbi_assembly has no project_id; use bioproject or biosample |
project.ecosystem | Join study via master_study_id |
SHOW SCHEMAS IN "source" | Works, but some syntax errors in older Dremio |
| Get sequences from Lakehouse | Download from JGI filesystem |
sra_experiment_v2.platform | Use library_instrument |
gene_ko_terms = 'K00025' | Use gene_ko_terms = 'KO:K00025' |
Join NUMG on gene_oid only | Join on both oid and gene_oid |
| Case-normalizing large function tables | Use exact normalized values (pfam00001, COG1389, etc.) |
| Isolate benchmark counts vary | Add obsolete_flag = 'No' and is_public = 'Yes' |
IMG.gene_feature fails expansion | Fallback to "img-db-2 postgresql".img_core_v400.* tables |
show_schemas() misses sources | Use higher limit (e.g. show_schemas(limit=2000)) |
export DREMIO_PAT=$(cat ~/.secrets/dremio_pat)Token setup: See docs/authentication.md
REST API Base: http://lakehouse-1.jgi.lbl.gov:9047/api/v3
# Use scripts/rest_client.py
from rest_client import query
results = query("SELECT * FROM ... LIMIT 10")For higher-performance programmatic access, use Arrow Flight with Python.
python3 -m venv venv
. venv/bin/activate
pip install \
https://github.com/dremio-hub/arrow-flight-client-examples/releases/download/dremio-flight-python-v1.1.0/dremio_flight-1.1.0-py3-none-any.whlFull guide: docs/arrow-flight-python.md
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.