52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
# `analytics/dbt/` — BI-P022
|
|
|
|
The canonical SIAX transformation project. **Nothing in this repository runs
|
|
it.** Execution lives in N0D (`n0d#38`), against the contract in
|
|
`src/analytics/transform/dbt-contract.ts`.
|
|
|
|
## Layers, and why they map onto BI-P003
|
|
|
|
| directory | tier (BI-P003) | may read | must not contain |
|
|
| ---------------------- | -------------- | --------------------- | --------------------- |
|
|
| `models/sources/` | `RAW` | — (declarations only) | any SQL |
|
|
| `models/staging/` | `NORMALIZED` | sources | joins, business logic |
|
|
| `models/intermediate/` | `CURATED` | staging | presentation shaping |
|
|
| `models/marts/` | `SERVING` | intermediate | direct source reads |
|
|
|
|
`assertLayerDependenciesLegal` enforces the "may read" column against the
|
|
dependency graph in `manifest.json`. A mart reading a source directly is
|
|
refused — that is raw data reaching a dashboard, which is precisely what
|
|
BI-P003's tier rule exists to prevent, and a convention nobody checks would not
|
|
prevent it.
|
|
|
|
## What a run must produce
|
|
|
|
`manifest.json` and `run_results.json`, both registered as ST0RE artifacts.
|
|
`assertValidDbtJobResult` refuses a result missing either: without them the run
|
|
cannot be audited and its tests cannot be ingested by BI-P025's
|
|
`DbtQualityProvider`.
|
|
|
|
It also refuses:
|
|
|
|
- a result whose revision differs from the request — the run is not reproducible;
|
|
- a result whose observed dbt version differs from the pin — a runtime that is
|
|
not the pinned one silently changes what the models mean;
|
|
- `status: success` with **zero nodes executed** — a dbt selector that matches
|
|
nothing exits 0, which is the dbt-shaped false green.
|
|
|
|
## Version posture
|
|
|
|
`DBT_RUNTIME_PIN` records dbt Core 1.10.13 (stable line) with
|
|
`dbt-clickhouse` 1.9.2. **Both review flags are `false`.** No licence or
|
|
supply-chain review has been performed in this repo, and none is claimed.
|
|
`assertDbtRuntimeCertified` refuses a `production` run until they are true, so
|
|
BI-P022's "after current license/security verification" is a gate rather than a
|
|
sentence in a document.
|
|
|
|
## Credentials
|
|
|
|
A dbt run never receives a tenant's warehouse credential from this repo. N0D
|
|
resolves a credential whose write scope matches `target_layer` and
|
|
`expected_target_schema`, and the contract refuses a request whose expected
|
|
schema is not scoped to the job's tenant.
|