Each BPL compiles, tests and ships independently, with strictly one-directional dependencies. Multiple databases orchestrated by synchronization, with PostgreSQL as the platform hub. Alongside it, MemoryLens, security and integration.
Dependencies are one-directional. Updating a module means replacing one .bpl file, without recompiling the executable.
The platform stays multi-database — Firebird for the MES, SQL Server/COBOL for the ERP — but the
cross-cutting services (identity, permissions, telemetry, documentation, AI) converge on PostgreSQL. The
shift is isolated behind interfaces (IAuthProvider,
IAuthRepository): changing the data
source means changing one implementation and one bootstrap line, without touching the modules.
AUTH_* tables (resources, actions, roles, permission matrix, user roles) and identity provider on PostgreSQL. Real FKs, permissions and identity co-located.
Application and security events consolidated in ml_app_events on PostgreSQL, with an outbox pattern from the SyncEventHub.
With pgvector, embeddings live next to the data: no second database, semantic search where the information already is.
// Identity is abstract: Firebird today, PostgreSQL tomorrow if HasAuthProvider then Result := CurrentAuthProvider.Authenticate(AUser, APwd) else Result := LegacyLogin2(AUser, APwd); // fallback // Cutover to PG = one bootstrap line: SetAuthProvider(TAuthPgProvider.Create(connPG));
Dashboard, telemetry, audit, documentation, log and synchronization are not per-module options: they are framework services. A scaffold that follows the MCP server's rules (scaffold_module) wires them in automatically — a generated module is born observable, traced and documented.
A cross-cutting system that serves three audiences with one architecture. Every module accesses it via TMLHelper: one uses clause, zero extra dependencies.
Captures errors, measures performance, documents architectural decisions. ML browser for cross-module navigation.
Contextual help with a ? button on every frame. Tips, warnings, guides. Late-binding: if ML isn't loaded, graceful fallback.
Diagnostics panel with event badges. Ticket creation with automatic context. Event viewer with detail.
Authentication and authorization done right: centralized permission model, declarative enforcement, audit on PostgreSQL. Internal OWASP ASVS L1 checklist, foundations ready for future reviews.
Resources, actions and roles in tables. A permission is the (resource, action) pair; a role is a set of permissions; a user gets one or more roles. Complementary to the existing level/entity model.
Guards configured in JSON on forms, menus and actions. Incremental "one at a time" rollout, with fail-open until enforcement is active on the module.
Whoever creates does not approve. APPROVE base already separated, dynamic check on sensitive actions with tracked override.
Security events (login, access denied, override) on PostgreSQL. Append-only hash chain: the "not tampered" property without blockchain.
This is the central point of the architecture: SyncFramework keeps heterogeneous databases aligned (SQL Server/COBOL of the ERP, Firebird of the MES, PostgreSQL of the platform) with a bidirectional hash-based engine that needs no triggers or timestamps on source tables. Every system stays where it is; the data stays coherent.
ERP / COBOL
Hash-based engine
Local MES
Platform · AI
Deletion tracking without modifying source tables. Garbage collector for automatic cleanup of stale entries.
Parallel multi-profile execution. Each profile has configurable source, target and transform.
Failed records tracked with retry. Conflicts handled with a per-profile configurable policy.
Console and service. Heartbeat on the DB for monitoring. Graceful shutdown.
PostgreSQL underneath, Ollama alongside, MCP as the bridge to the models.