Methodology & Definitions

eFront Holdings Extract

The primary portfolio registry. A CSV snapshot (currently REPI eFront 04_03_26.csv) containing ~550 properties with classifications, ownership, advisors, JV partners, acquisition prices, regions, metros, and fiscal year ends.

SitusAMC Quarterly Appraisal Database

Source for forward-looking valuation mechanics. Used by the Monte Carlo volatility calibration and DCF assumptions. Provides property-level appraisals (value, rent, occupancy, cap rates, terminal & discount rates) at quarterly cadence.

Data cleaning: Dollar values stripped of formatting. Percentages converted to decimals. Rows filtered to live assets. Invalid sentinels (-, #N/A, #DIV/0!) treated as missing.

Loan Maturities Extract

A per-property loan file (REPI_Loan_Maturities/eFront_Loan_Maturities.csv) powering debt analytics. Columns: Current Leverage Balance (SBA level), Outstanding Loan Balance (total), Maturity Date, Lender Type, Loan Type, Life Cycle, Risk Profile, SBA RE Action.

MTF Excel (Most-Recent Valuation)

Property-level NAV and Life Cycle data. Loaded dynamically by pattern match in the REPI_Dashboard directory. Feeds into PRISM scenario analysis at the SBA Investment Level.

Weekly Operating Workbooks

Per-property Excel workbooks (approximately 32 files) containing weekly-cadence operating metrics: occupancy, availability, leased %, market and effective rent, rent-per-SF, vacant units. Drives the Operations dashboard's weekly view.

Income Statements

Quarterly income-statement Excel files, organized by period folder (1Q25, 4Q25, etc.). Actual vs. budget for 17+ properties; powers the Financial Performance section of the property report and the Variance Report.

Bitcoin Monthly Prices

btc_monthly.csv — monthly close prices from September 2014 onwards. Used by the Monte Carlo engine when the BTC Sleeve toggle is enabled. Yahoo refresh runs best-effort on startup; the committed CSV is the fallback.

Geographic Mapping

NCREIF four-region taxonomy (East, West, South, Midwest). A geocache.csv maps property names to pre-computed lat/lon; fallback logic uses metro center then state center then US center when a property is absent from the cache.

What It Shows

Property-level KPIs, variance reporting, Google Reviews, Monte Carlo projections, investment-story narratives, and the property report across the multifamily portfolio. Weekly workbooks + quarterly income statements feed every view.

Property Report Header

The institutional-style blue header on each property report carries: property name, location, address, year built, and the asset's Fiscal Year End — pulled from the eFront Investment Year End column for 540+ properties. Fuzzy name matching reconciles Weekly ↔ eFront title differences.

Key Metrics

What It Shows

Trailing 1Y / 3Y / 5Y / 10Y composite returns, excess returns measured in basis points, and strategy attribution versus institutional benchmarks. Data source: TTG_Data_Historical.xlsx.

How to Interpret

Composite returns reflect time-weighted performance over each trailing window. Excess returns (bps) show out/underperformance vs. the selected benchmark. Strategy attribution decomposes returns into allocation and selection effects.

Note: Returns are calculated from appraisal-based valuations, which inherently smooth short-term volatility compared to transaction-based indices. See §08 Volatility Calibration for how this is addressed in forward-looking models.

Holdings Registry

A 550-property registry from the eFront extract: geographic concentration mapping, advisor and JV partner breakdowns, loan maturity wall, and benchmark positioning against NCREIF NPI / ODCE.

Benchmarks

PRISM — Portfolio Risk & Investment Scenario Model

An interactive transaction-approval tool. The user enters the attributes of a proposed acquisition — property, advisor, JV partner, ownership %, acquisition price, equity, leverage, NAV, risk profile, life cycle, investment structure — and PRISM shows the before / after impact on every Investment Portfolio Guideline.

Data Unification

PRISM merges four sources at the property level:

Property name matching across sources uses a Jaccard token-similarity fuzzy merge so "Carlyle Crossing - Dylan" in the weekly workbook reconciles to the same entity in eFront.

IPG Compliance Matrix (11 checks)

Every proposed transaction is scored against all 11 Investment Portfolio Guidelines. Each check returns a pass / fail badge on the PRISM report.

PRISM Dimension Tables

Before / after tables are computed for nine dimensions:

Property Type · Region · Sub-Type · Risk Profile · Life Cycle · Investment Structure · Investment Advisor · JV Partner · Metro Area

Each row carries the full PRISM column set:

What It Does

A standalone dashboard giving the team three tools for building confidence in the eFront holdings extract: a random-question quiz, a rule violation scanner, and an outlier surface. Results persist in SQLite so accuracy trends can be reviewed over time.

Quiz Engine

Eleven templates draw random questions from the 550-property data. Each session is attributed to a display name; answers are graded in real time and persisted with the correct answer for audit.

Grading tolerance: exact match for strings (case-insensitive, trimmed); ±1 percentage point for ownership; ±1% or ±$100K (whichever is larger) for sums; exact for counts and years.

Rule Violations (10 rules)

Outlier Detection (8 heuristics)

What It Is

A 6-bucket document repository with drag-and-drop PDF uploads, property / advisor / JV tagging, SQLite-backed indexing, admin-gated delete, and a Florida Statutes Chapter 215 statutory reference panel.

Taxonomy (6 categories)

Upload Behaviors

• PDF only. Non-PDF uploads are rejected server-side.
• 50 MB per file cap. Enforced in both Flask and Nginx (client_max_body_size 60M on /legal/).
• Versioning: duplicate filenames get a timestamp suffix (e.g. LPA_2026-04-13_010203.pdf) — nothing ever overwrites.
• Tagging: at upload, the user optionally tags the document with Property (from 550 eFront names), Advisor (from 8 canonical names), and JV Partner (from 34 known partners).
• Audit log: every upload and delete is timestamped and attributed to the Nginx basic-auth username.
• Admin-gated delete: only repi_admin can remove files; team uploads freely.

Florida Statutes Chapter 215 — Statutory Reference

The Legal Library ships with a curated reference to eight key sections of Florida Statutes Chapter 215 (Financial Matters — General Provisions). Each category card links out to the sections that govern its contents. Links resolve to flsenate.gov/Laws/Statutes/2025/...

Scope

A 9-month implementation proposal for lifting the REPI-ONE stack onto Snowflake, unifying advisor chart-of-accounts, and standing up a sandboxed development environment for continued feature work. This is a planning document — no live Snowflake connection exists yet.

Phased Timeline

Infrastructure Requirements

• 3–4 Mac Studio M3 Pros with max RAM — development cluster.
• 1 NVIDIA DGX Spark — ML/AI coordinator for document summarization, anomaly detection, forecasting.
• Snowflake tenant with separate Dev and Prod accounts and promotion gates.
• VLAN isolation — dev fleet sandboxed; egress to Snowflake only.
• VPN-gated access — role-scoped, easily revocable per team member.

Supporting Documents

The proposal page hosts seven document categories with the same drag-and-drop + SQLite indexing pattern as the Legal Library: Migration Plan · Chart of Accounts · Hardware Specifications · Network & Security · Accounting DB Schema · Cost Estimate · Risk Register.

The Problem: Appraisal Smoothing

Real estate appraisals lag actual market movements. Observed quarter-to-quarter value changes understate true economic volatility because appraisers anchor to prior valuations. Raw portfolio statistics will therefore look less volatile than they truly are.

Geltner (1993) Unsmoothing

The Geltner unsmoothing correction — an institutional standard — backs out the appraisal lag to estimate true transaction-based volatility.

Outlier handling: Before computing raw volatilities, values are IQR-winsorized at ±3×IQR and capped at 25% to prevent single extreme appraisals from dominating the calibration.

What It Projects

Per-property forward NAV projection at monthly cadence when the BTC Sleeve is on, quarterly otherwise. The engine anchors at the most recent non-null SBA NAV and emits a full distribution of forward paths — fan chart percentiles, a terminal histogram, and ten sample paths for visual interpretation.

Four Simulation Methods

Controls

BTC Sleeve — Joint Simulation

When the BTC Sleeve toggle is on, the engine runs a joint property + Bitcoin simulation at monthly cadence. For Bootstrap and Regime-Switching methods, correlation is preserved automatically because every drawn quarter index carries both its property return and its three paired BTC monthly returns from the same historical period.

Each run produces three portfolio scenarios side-by-side: 2.5%, 5%, and 10% BTC allocation at t₀ (no rebalance). Metrics displayed per scenario: Median Terminal, VaR-95, Expected Shortfall, P(Loss), Best/Worst Case.

Data alignment: BTC monthly data starts Sep 2014. Property quarters ending before that date are dropped. Below-6-quarter alignment returns a "no data" state; the dashboard shows an empty placeholder.

Bitcoin Power Law (Santostasi)

Giovanni Santostasi's thesis: long-run BTC price follows a power function of time since the Genesis block (Jan 3, 2009). The engine fits this model by log-log OLS on the committed BTC monthly history at service startup.

The deviation AR(1) reverts toward the trend with a 24-month half-life (φ = 0.5^(1/24)). Deviations are clipped at ±3× the support/resistance offsets to prevent explosive excursions.

Typical fit: exponent B ≈ 5.84 on the current btc_monthly.csv, consistent with Santostasi's published B ≈ 5.82. The UI shows the fitted exponent next to a log-price chart with all three bands overlaid.

Outputs

Data

• Snapshot calibration. Volatility is typically calibrated from one quarterly cycle. This may under- or over-estimate long-run volatility.
• Appraisal lag. Situs valuations lag actual transaction prices by 0–6 months. The Geltner correction mitigates but does not eliminate this.
• Cross-sectional proxy for NOI volatility. Year-over-year value changes are used as a proxy for NOI volatility; raw NOI data is not in the Situs feed.
• Small samples. When fewer than 3 assets match a property type or state filter, hardcoded fallback volatilities are used (8% NOI, 70 bps cap rate).

PRISM

• Pipeline adjustments are manually maintained. The PRISM Adjustments Excel is the single source of truth; refresh cadence is quarterly.
• ODCE weights are coded. Hardcoded at PDF values; refreshed manually when NCREIF publishes new quarter weights.
• No debt waterfall modeling. Leverage is treated as a single aggregate per property; senior/mezz/preferred equity distinctions are not modeled.

Monte Carlo

• Equity-only. No debt modeling, no waterfall allocations, no LP/GP splits.
• Fixed discount rate. Constant across paths; real-world interest rates are themselves stochastic.
• No CapEx. Simplified NOI stream; major renovation or capex events are not modeled.
• Cap rate bounds. Exit cap rates hard-clamped to 3%–12%; extreme distress or bubble scenarios outside this range are not captured.
• Power Law breaks BTC ↔ RE correlation. Under Power Law method, BTC paths follow the trend model while property returns are bootstrapped independently. The historical monthly linkage is not preserved.

Data Validation

• Single data source. Rules and outliers run against the eFront extract only. Cross-source reconciliation (MTF vs. eFront vs. Situs) is deferred.
• Static quiz templates. Eleven hardcoded question patterns. No temporal or change-detection questions yet.

Legal Library

• No full-text search. Search operates on filename, description, property, and advisor — PDF content is not OCR-indexed.
• Admin-gated delete via HTTP basic auth. Audit log captures the username, but basic auth is transport-layer; HTTPS is recommended before exposing beyond the internal team.

Snowflake Proposal

• No live Snowflake connection. The tile hosts a planning document and document library. Code does not currently query Snowflake.
• Hardware and cost figures are estimates. Subject to vendor quotes and AWS marketplace pricing at procurement.

Platform

• Surface-level health check. Dashboard status is determined by HTTP HEAD probes with a 1.5-second timeout. "Live" confirms the server is responding, not that underlying data is correct or current.
• Polling lag. Status polls every 8 seconds. Brief delay between an actual outage and the status indicator changing.

Platform Codebase — At a Glance

The REPI platform is composed of seven Python / Flask applications plus a shared data directory, spread across roughly 70 Python source files and ~24,500 lines of application code. Each dashboard is a standalone service with its own Gunicorn process; Nginx reverse proxies route traffic by URL prefix.

Stack & Conventions

Shared Patterns Across Dashboards

• services/data_loader.py — loads source data once at startup into an AppData container that route handlers treat as immutable.
• services/storage.py — on dashboards with persistence (Legal, Snowflake, Data Validation): SQLite schema + versioned file storage + audit log.
• services/charts.py — Plotly figure builders returning JSON strings ready for the template.
• utils/formatters.py — fmt_money, fmt_pct, fmt_bps, fmt_date; kept in sync across all apps.
• templates/_jump_nav.html — floating dashboard-switcher widget; identical copy in each project.

Code-Level Security Review

Internal audit of the Python source across all seven projects, scanning for SQL injection, path traversal, unsafe deserialization, command injection, secret hardcoding, file-upload validation gaps, CSRF exposure, and template injection.

Summary: The codebase is well-architected for security. All SQL uses bound parameters. All file operations use sanitized filenames and send_from_directory with database-verified IDs. No eval, exec, pickle.load, or yaml.load on user input. No hardcoded production secrets. No unsafe subprocess.shell=True with user input.

Five open items were identified; one is Medium severity (CSRF token absence on state-mutating routes), the rest are Low or Informational.

Positive Findings (Mitigations Already in Place)

• SQL parameterization throughout. Every sqlite3.execute() call uses ? placeholders with bound parameters. No f-string or concatenation-based SQL anywhere in the codebase.
• Safe filename handling. Uploads pass through safe_filename() (regex-stripped to A-Za-z0-9._ -()), forced .pdf extension, and version_filename() timestamp suffix to prevent overwrites.
• PDF-only upload whitelist. MIME check on application/pdf + extension match at the server; non-PDF uploads rejected with a clear error. 50 MB size cap enforced pre-save.
• Downloads via send_from_directory. File downloads use a database-looked-up filename — the client only supplies an integer doc_id, never a path.
• Path traversal protection in legacy endpoints. REPI_Snowflake’s /docs/<path> endpoint uses os.path.normpath() + .startswith(DOCS_DIR) check to block .. traversal.
• No unsafe deserialization. Zero instances of pickle.load, yaml.load (without safe_load), eval, exec, or compile on user-controlled data.
• No command injection. Application code never calls os.system or subprocess with shell=True on user input.
• No template injection. Jinja2 autoescape is on by default. |safe filter appears only on server-generated chart JSON, never on user data.
• No secrets in source. API keys, passwords, and tokens are not hardcoded. Production secret keys are pulled from environment variables.
• Audit logging. Legal library logs every upload and delete with timestamp + actor (Nginx basic-auth username).

Open Findings (5)

Remediation Priority

1. V-01 CSRF (Medium). Integrate flask-wtf’s CSRFProtect. Add hidden tokens to state-mutating forms. ~1–2 days across all apps.
2. V-02 Secret keys (Low). Document required env vars in deployment runbook; generate via python3 -c "import secrets; print(secrets.token_hex(32))". ~30 minutes.
3. V-03 Snowflake admin gate (Low). Port Legal’s _is_admin() pattern to Snowflake. ~1 hour.
4. V-05 Snowflake audit log (Informational). Add an audit_log table + _audit() helper matching Legal. ~1 hour.
5. V-04 Debug mode guard (Informational). One-line conditional. ~5 minutes.

Dependency Risk

Every project pins major versions in requirements.txt: flask>=3.0.0, pandas>=2.0.0, numpy>=1.24, plotly>=5.18, openpyxl>=3.1, gunicorn>=21.2. As of the last audit cycle, no critical CVEs against the pinned minimum versions. Dependency hashes are not enforced in CI — recommend adding pip-compile --generate-hashes before next major deployment.

Review Cadence

This review is a point-in-time snapshot. Recommended cadence:

• Quarterly — re-run the grep-based security scan for new instances of the 13 vulnerability classes above (SQL injection, path traversal, unsafe deserialization, command injection, CSRF, open redirect, template injection, secret hardcoding, file-upload gaps, input validation gaps, logging of sensitive data, race conditions, dependency freshness).
• At every major release — run pip-audit against all seven requirements.txt files; file any CVE over Low severity.
• On significant new code — new upload, new auth boundary, or new external integration triggers an ad-hoc review.