Tessera RP
PX-09
The Numbers
What is actually in the box.
Counted from the running system rather than written into the copy — the metric total comes from the catalog, the test total from the suite. A number in marketing prose rots the first time either changes.
Semantic layer
Metrics | 229 governed, across 14 domains |
Dimensions | 101 |
Query path | QuerySpec → validate → scope → compile. Nothing else emits SQL |
Ratio metrics | SUM(numerator) / SUM(denominator) at result grain, never AVG(ratio) |
Parameters | Every filter value bound; no string concatenation anywhere |
Period-over-period | A `__prev` suffix resolved by the compiler, so a caller never hands it SQL |
Catalog | Deep-frozen at module load — a request handler cannot mutate a metric |
Warehouse
Engine | Postgres. Engine-neutral SQL behind a WarehouseAdapter |
Model | Star schema — 6 conformed dimensions, 9 fact tables |
Landed cost | 7 components per order line; landed cost and contribution margin are GENERATED columns |
Raw tier | raw.record, JSONB, append-only, replayable, content-hashed |
Migrations | 25, idempotent, run as a separate owner role |
Data quality | Freshness, not-null, unique, referential, row-count and accepted-values tests |
Analytics
Forecasting | Holt-Winters, for demand and cash |
Anomalies | STL decomposition + robust z-score. No model involved |
Elasticity | Log-log regression |
Replenishment | Reorder point with service-level safety stock; stockout probability |
Cohorts | Retention and contribution-margin LTV; CAC, LTV:CAC, payback |
Working capital | Cash conversion cycle as DSO + DIO − DPO |
Security & tenancy
Isolation | Postgres RLS, ENABLE + FORCE, on every tenant-scoped table |
App role | NOSUPERUSER, NOBYPASSRLS, no DDL rights |
Scoping | Row-level data scope appended by the compiler after the caller's filters |
Roles | Owner 40 · admin 30 · analyst 20 · viewer 10 |
Sessions | Opaque random token; only its SHA-256 hash is stored |
SSO | Schema-ready via sso_subject; password auth today |
Audit | Append-only row for every mutation and every denied access |
Secrets | Deep key-based redaction before anything reaches a log |
Runtime & verification
Deployment | erp.par2labs.com · self-host · Docker · Kubernetes |
Image | 339 MB, runs non-root |
Scaling | Horizontal behind a shared Redis for cache and rate limits |
Degradation | Redis unreachable falls back to in-process buckets rather than failing |
Observability | /api/health, /api/ready, Prometheus at /api/metrics, request-id on every line |
Query bounds | Statement timeout and LIMIT max+1 — truncation is flagged, never silent |
Tests | 5,882 across 145 files |
Gates | Format, lint, typecheck, tests, coverage, dependency audit and a production build, on every push |
The coverage gate is deliberately left failing at 84% statements rather than lowered to match what the suite happens to achieve. A gate tuned to reality is not a gate.