# `analytics/dbt/` — BI-P022

The canonical SIAX transformation project. **Nothing in this repository runs
it.** Execution lives in N0D (`n0d#38`), against the contract in
`src/analytics/transform/dbt-contract.ts`.

## Layers, and why they map onto BI-P003

| directory              | tier (BI-P003) | may read              | must not contain      |
| ---------------------- | -------------- | --------------------- | --------------------- |
| `models/sources/`      | `RAW`          | — (declarations only) | any SQL               |
| `models/staging/`      | `NORMALIZED`   | sources               | joins, business logic |
| `models/intermediate/` | `CURATED`      | staging               | presentation shaping  |
| `models/marts/`        | `SERVING`      | intermediate          | direct source reads   |

`assertLayerDependenciesLegal` enforces the "may read" column against the
dependency graph in `manifest.json`. A mart reading a source directly is
refused — that is raw data reaching a dashboard, which is precisely what
BI-P003's tier rule exists to prevent, and a convention nobody checks would not
prevent it.

## What a run must produce

`manifest.json` and `run_results.json`, both registered as ST0RE artifacts.
`assertValidDbtJobResult` refuses a result missing either: without them the run
cannot be audited and its tests cannot be ingested by BI-P025's
`DbtQualityProvider`.

It also refuses:

- a result whose revision differs from the request — the run is not reproducible;
- a result whose observed dbt version differs from the pin — a runtime that is
  not the pinned one silently changes what the models mean;
- `status: success` with **zero nodes executed** — a dbt selector that matches
  nothing exits 0, which is the dbt-shaped false green.

## Version posture

`DBT_RUNTIME_PIN` records dbt Core 1.10.13 (stable line) with
`dbt-clickhouse` 1.9.2. **Both review flags are `false`.** No licence or
supply-chain review has been performed in this repo, and none is claimed.
`assertDbtRuntimeCertified` refuses a `production` run until they are true, so
BI-P022's "after current license/security verification" is a gate rather than a
sentence in a document.

## Credentials

A dbt run never receives a tenant's warehouse credential from this repo. N0D
resolves a credential whose write scope matches `target_layer` and
`expected_target_schema`, and the contract refuses a request whose expected
schema is not scoped to the job's tenant.