One application, four layers.

NOVERA is one ASP.NET Core 8 application built on Razor Pages and deployed as a single assembly, and it is kept simple underneath. Roughly 320 C# and Razor files hold about 182,000 lines of application code, supported by 82 services and some 22,000 lines of stylesheet.

Two choices shape everything else.

• The project carries exactly one package reference, and no new package may be added.
• There is no object-relational mapper, no front-end framework and no build step anywhere in the solution.

Data access. All SQL is hand-written, in verbatim interpolated strings with typed, bound parameters throughout. The one package reference is there for the SQL client library it brings; the project uses no mapper.

• Benefit: every statement the system issues can be read, explained and tuned. That matters a great deal against a twenty-year-old ledger whose conventions are unusual.
• Cost: correctness rests on discipline instead of a framework, which is why the gate suite described under Engineering exists.

Front end. Plain HTML and CSS with about a dozen small vanilla JavaScript modules and no bundler.

• A token stylesheet defines the palette, spacing and radii; the application stylesheet builds on it; a third file holds the breakpoints and never re-colours anything.
• Twenty-one shared Razor partials act as reusable controls (the pager, flip card, drill panel, document viewer, field editor, entity chip, rich text editor and others), so a rule is fixed in one place and inherited everywhere.
• The look is a dark navy and gold identity with self-hosted typography, laid out mobile-first across five named screen bands, with one navigation surface visible at a time and forty-eight pixel touch targets.

Languages and background work. The interface speaks five languages, with 3,196 keys that move together as one bundle; names held in the database are translated through a cached translator instead of being re-keyed. Four background services run inside the application: reminders, notifications, email triage and the invoice scout.

Security follows the same conservative line:

• cookie-based authentication, with the entity carried as claims;
• passwords hashed with PBKDF2-SHA256 at 210,000 iterations;
• rate-limited sign-in, and sessions that expire after two hours;
• every secret in a system environment variable, never in a web-served file;
• untrusted HTML sanitised wherever it renders;
• all SQL diagnostics written against live catalogs read-only by rule.