analytics/dbt/ — BI-P022
The canonical SIAX transformation project. Nothing in this repository runs
it. Execution lives in N0D (n0d#38), against the contract in
src/analytics/transform/dbt-contract.ts.
Layers, and why they map onto BI-P003
| directory | tier (BI-P003) | may read | must not contain |
|---|---|---|---|
models/sources/ |
RAW |
— (declarations only) | any SQL |
models/staging/ |
NORMALIZED |
sources | joins, business logic |
models/intermediate/ |
CURATED |
staging | presentation shaping |
models/marts/ |
SERVING |
intermediate | direct source reads |
assertLayerDependenciesLegal enforces the "may read" column against the
dependency graph in manifest.json. A mart reading a source directly is
refused — that is raw data reaching a dashboard, which is precisely what
BI-P003's tier rule exists to prevent, and a convention nobody checks would not
prevent it.
What a run must produce
manifest.json and run_results.json, both registered as ST0RE artifacts.
assertValidDbtJobResult refuses a result missing either: without them the run
cannot be audited and its tests cannot be ingested by BI-P025's
DbtQualityProvider.
It also refuses:
- a result whose revision differs from the request — the run is not reproducible;
- a result whose observed dbt version differs from the pin — a runtime that is not the pinned one silently changes what the models mean;
status: successwith zero nodes executed — a dbt selector that matches nothing exits 0, which is the dbt-shaped false green.
Version posture
DBT_RUNTIME_PIN records dbt Core 1.10.13 (stable line) with
dbt-clickhouse 1.9.2. Both review flags are false. No licence or
supply-chain review has been performed in this repo, and none is claimed.
assertDbtRuntimeCertified refuses a production run until they are true, so
BI-P022's "after current license/security verification" is a gate rather than a
sentence in a document.
Credentials
A dbt run never receives a tenant's warehouse credential from this repo. N0D
resolves a credential whose write scope matches target_layer and
expected_target_schema, and the contract refuses a request whose expected
schema is not scoped to the job's tenant.