STRATA (open core)

The semantic layer that refuses to make things up.

STRATA compiles governed semantic questions into SQL and returns a cryptographic receipt. Same question → same receipt identity — byte-identical SQL and identical sql_sha256 on any machine, any PYTHONHASHSEED. When it cannot prove the answer, it refuses.

pip install -e .
make demo

5-line demo

git clone <repo-url> && cd specter
pip install -e ".[dev]"
make demo
strata compile '{"metrics":["total_revenue"],"dimensions":["region"]}'

The property (falsifiable)

For all valid (schema, query): same input → byte-identical SQL → identical receipt hash, on any machine, any seed.

Prove it yourself:

make prove    # 250 generated schemas × 8 PYTHONHASHSEED values
make test     # regression determinism + refusal battery

Tamper demo

make tamper

Alter one byte of the receipt SQL and watch sql_sha256 break. Tamper with the receipt. We'll wait.

Refusal example

Unknown metrics raise at compile time — no silent guess:

from specter import SpecterCompiler

compiler = SpecterCompiler("schemas/retail_star.yaml")
compiler.compile({"metrics": ["made_up_metric"], "dimensions": ["region"]})
# ValueError: Unknown metric: made_up_metric

What runs where (honest labels)

Component	Open repo	Notes
AXIOM-SCAN	✅	Schema discovery
SPECTER compiler + compile_with_receipt	✅	Snowflake-pushdown-ready SQL
ORION BRIDGE (/query)	✅	Demo executes on DuckDB
Determinism + refusal + sql_sha256	✅	Property-tested
LUNA tamper-evident hash-chain	❌	Enterprise (strata-v1)
Snowflake-native RBAC	❌	Enterprise (strata-v1)
Live warehouse at scale	❌	Enterprise (strata-v1)

SPECTER emits Snowflake-pushdown-ready SQL and runs the open demo on real DuckDB with a public CSV dataset. SQLite remains a labeled fallback only.

Enterprise upgrade: governed multi-vertical platform with signed REFUSE ledger, native row-access + masking, and live Snowflake execution — see strata-v1 (private).

CLI

strata compile '{"metrics":["total_revenue"],"dimensions":["region","category"]}'
strata demo

ORION BRIDGE

make bridge
# GET  http://localhost:8088/status
# POST http://localhost:8088/query  {"metrics":["total_revenue"],"dimensions":["region"]}

License

Apache-2.0. See LICENSE.