Remove Trino: Superset reads fuel-db directly as fuel_ro (PD-14)

trino/ deleted; the role trino_ro becomes fuel_ro, its password read from a
secret file at connect time; dashboards' SQL and column list for PostgreSQL;
the Compose project is renamed petrolyst, with volumes pinned to their old
names. AGENTS.md points to the architecture context. Not deployed: the next
deploy needs README's one-time steps first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/lib.sh

@@ -45,8 +45,7 @@ REQUIRED_FILES=(
   secrets/fuel-monitoring/superset_secret_key
   secrets/fuel-monitoring/superset_db_password
   secrets/fuel-monitoring/fuel_db_password
-  secrets/fuel-monitoring/fuel_db_trino_password
-  env/fuel-monitoring.env
+  secrets/fuel-monitoring/fuel_db_ro_password
 )
 
 log() { printf '%s %s\n' "$(date -u +%H:%M:%S)" "$*" >&2; }
@@ -83,7 +82,6 @@ hash_inputs() {
 
 compute_artifacts() {
   printf 'SUPERSET_IMAGE_TAG=%s\n' "$(hash_inputs "$1" "${SUPERSET_INPUTS[@]}")"
-  printf 'TRINO_CONFIG_HASH=%s\n' "$(hash_inputs "$1" stacks/fuel-monitoring/trino/etc)"
   # Only the static config: dynamic/ is watched and applies without a restart.
   printf 'TRAEFIK_CONFIG_HASH=%s\n' "$(hash_inputs "$1" traefik/static)"
 }
@@ -92,16 +90,21 @@ compute_artifacts() {
 load_artifacts() {
   local file=$1/ARTIFACTS line key value
   [ -s "$file" ] || die "$file is missing"
-  unset SUPERSET_IMAGE_TAG TRINO_CONFIG_HASH TRAEFIK_CONFIG_HASH
+  unset SUPERSET_IMAGE_TAG TRAEFIK_CONFIG_HASH
   while IFS= read -r line; do
     key=${line%%=*}
     value=${line#*=}
-    [[ $key =~ ^(SUPERSET_IMAGE_TAG|TRINO_CONFIG_HASH|TRAEFIK_CONFIG_HASH)$ && $value =~ ^[0-9a-f]{16}$ ]] ||
+    # A release from before 29 Oct 2026 still runs Trino, which logs in as
+    # `trino_ro`, since renamed `fuel_ro`: it cannot start (README "Rollback
+    # across the Trino removal").
+    [ "$key" != TRINO_CONFIG_HASH ] ||
+      die "$file is from before Trino was removed; see README \"Rollback across the Trino removal\""
+    [[ $key =~ ^(SUPERSET_IMAGE_TAG|TRAEFIK_CONFIG_HASH)$ && $value =~ ^[0-9a-f]{16}$ ]] ||
       die "unexpected line in $file: $line"
     printf -v "$key" '%s' "$value"
     export "${key?}"
   done <"$file"
-  [ -n "${SUPERSET_IMAGE_TAG:-}" ] && [ -n "${TRINO_CONFIG_HASH:-}" ] && [ -n "${TRAEFIK_CONFIG_HASH:-}" ] ||
+  [ -n "${SUPERSET_IMAGE_TAG:-}" ] && [ -n "${TRAEFIK_CONFIG_HASH:-}" ] ||
     die "$file is incomplete"
 }
 
@@ -137,6 +140,10 @@ preflight() {
   [ -z "$bad" ] || die "petrolyst-insights/ holds customization only; found: $bad"
   compose "$release" traefik config -q
   while IFS= read -r dir; do compose "$release" "$dir" config -q; done < <(stack_dirs "$release")
+  # The stack was the Compose project "fuel-monitoring" until 29 Oct 2026; "petrolyst" uses the
+  # same data volumes, so both must never run at once (README "One-time steps after 29 Oct 2026").
+  [ -z "$("${DOCKER[@]}" ps -aq --filter label=com.docker.compose.project=fuel-monitoring)" ] ||
+    die "containers of the old project fuel-monitoring exist; remove them first (README \"One-time steps after 29 Oct 2026\")"
 }
 
 # promote <release> <sha>: make the release the live tree. --chmod applies to
@@ -255,10 +262,23 @@ smoke_tests() {
   [ "$code" = 302 ] && [[ $location == "$KEYCLOAK_REALM_URL/"* || $location == *"/oauth2/start"* ]] ||
     die "https://$TRAEFIK_HOST/ should redirect to Keycloak, got $code $location"
 
-  fm exec -T trino trino --execute 'SELECT count(*) FROM fuel.information_schema.schemata' >/dev/null ||
-    die "Trino cannot read the fuel catalog"
-  fm exec -T superset curl -fsS --max-time 10 http://trino:8080/v1/info >/dev/null ||
-    die "Superset cannot reach Trino"
+  # Superset's own connection "Fuel" (fuel_ro, password from /run/secrets) reads fuel-db and
+  # cannot write to it.
+  fm exec -T superset /app/.venv/bin/python - <<'PY' || die "Superset cannot read fuel-db as fuel_ro, or fuel_ro can write"
+import sys
+
+from superset.app import create_app
+
+with create_app().app_context():
+    from superset import db
+    from superset.models.core import Database
+
+    fuel = db.session.query(Database).filter_by(database_name="Fuel").one()
+    with fuel.get_sqla_engine() as engine, engine.connect() as conn:
+        user, read_only = conn.exec_driver_sql(
+            "SELECT current_user, current_setting('transaction_read_only')").one()
+    sys.exit(0 if (user, read_only) == ("fuel_ro", "on") else 1)
+PY
   log "smoke tests passed"
 }