MBS Food Cost: Ops System for Multi-Outlet F&B

The problem

This multi-outlet F&B business ran its food-cost calculation on Google Sheets and Apps Script that had proven to work, but the spreadsheet systematically overstated the food cost. When the business logic was audited and rebuilt, the verified regression invariant showed true food cost at roughly 45.3%, far below the ~66% the business believed it was running. We record this as an engineering finding from the rebuild, not as a promised outcome for any other business.

The old system worked but could not grow: no typed data model, no server-side authorisation, no failure-tolerant jobs.

What we built

A full rebuild onto a real stack at feature parity, where the hard-won business logic carried over verbatim and only the platform changed:

• Operational records for purchases, receiving, recipes, sales, and operating expenses per outlet, with money as DECIMAL and append-only ledgers; corrections are reversing entries, not edits.
• Document OCR: transfer receipts and bank statements (a BCA statement PDF, for example) are read by a language model into structured JSON through a constrained response schema.
• A Mastra multi-agent assistant with a tool registry that bridges into RBAC, so an agent can only reach the data its user is entitled to see.
• WhatsApp notifications via Fonnte and email via Resend for operational flows.
• GCP infrastructure in asia-southeast1: Cloud Run for services, Cloud Tasks for queues, Scheduler and Pub/Sub for scheduled jobs.

Engineering decisions

The regression invariant is held by tests. The verified food-cost figure is an assertion in the test suite; any change that shifts the calculation fails the build, because that number is why the system is trusted.

COGS is counted exactly once. A cost enters through a purchase row or through a receive (po_ref), never both. Every mutation carries a dedup key (UNIQUE in the database), so double-submits, retries, re-uploads, and job redelivery never double-count.

Authorisation and audit are not UI layers. requireScope(...) runs in the Server Action and API handler; cross-tenant is answered with 404, out-of-scope with 403, and every mutation writes an audit row with the actor, the action, and a before/after diff.

Status

A production system used as the business’s internal operations tool, built over five months in 408 commits (April–August 2026) through a spec-driven pipeline. CI runs typecheck, lint, and tests on every push; merging to main builds a Docker image and deploys to Cloud Run.