[cmbays]

Summary

User-facing check selection + suppression for the coverage-check engine (epic #168): the [checks] section of the existing --config AnalysisConfig TOML (sqlfluff-style opt-out/opt-in modes with group globs), targeted [[checks.suppress]] entries, and the inline SQL pragma -- cute-dbt: ignore(check-id, "reason") — all strictly display-layer, extending the #186 pipeline invariant.

Closes #171

Acceptance criteria — evidence

• [checks] config POD + serde tests (mode/enable/disable validation) — src/domain/check_config.rs: ChecksConfig / ChecksMode / SuppressEntry PODs (deny_unknown_fields throughout), resolve_check_policy enforces enable ⇔ opt-in (required there; enable = [] is an explicit "display nothing"), disable ⇔ opt-out. Serde + validation-matrix unit tests; AnalysisConfig gains #[serde(default)] checks (absent section = identical-to-before default).
• Group-glob resolution against the registry, fail-closed — exact ids + group.* globs only; unknown id/group/unsupported pattern is a usage error (exit 2, no report) whose remediation names the registry's known checks and groups. Validated at --config parse time (ConfigLoadError::Checks, the ARCHITECTURE §3 usage-error path). Glob expansion tested against a synthetic multi-check registry AND the production registry.
• Suppression is display-layer ONLY — #169 — check-engine walking skeleton: heuristics! registry + supersedes pipeline + grain.unique-key-unbacked #186 invariant extended — apply_check_policy runs strictly after resolve_supersedes; new invariant tests: suppressing the superseding check does not resurrect the superseded finding (marked, never removed), disabling it via config removes without resurrecting, and policy application only removes-or-marks (never adds). Engine stages remain policy-blind by construction.
• Inline pragma scanner + book grammar — scan_pragmas over the model's manifest raw_code (verbatim authored SQL; see deviation note below); full-line or trailing placement; applies model-wide. Grammar documented in book/src/check-selection.md (linked in SUMMARY; deliberately outside the generated book/src/checks/ dir, which is stale-gated).
• Suppressed findings carry their reason into the payload — Finding.suppressed: Option<Suppression { source: config|pragma, reason }> (serde-skipped when None → pre-feature: check selection + suppression — [checks] config modes, suppress entries, inline pragma #171 payloads and goldens byte-stable). Real-fixture payload tests in tests/check_engine.rs pin both arms; the feature: report findings surface — per-model coverage checklist + tiered findings + suppressed-count #170 surface renders the collapsed set from this field.
• BDD scenarios, synthetic only, feature-count gates bumped atomically — features/check_selection.feature (9 scenarios: both modes, empty opt-in, suppress entry, pragma with/without reason, both fail-closed error paths); expected=13 → 14 in ci.yml and lefthook.yml in the same commit. All fixtures are temp-file synthetic — nothing committed, tests/fixtures/MANIFEST.toml untouched.

Discovery calls

• Pragma placement granularity: file-level, model-wide, any line. Construct-adjacent placement would need tokenizer span mapping for no current consumer (the one shipped check is construct-singular per model: config.unique_key). File-level is the simplest defensible grammar, matches the sqlfluff -- noqa trailing-comment ergonomics, and is documented as such in the book.
• Reason: required for [[checks.suppress]], optional for the pragma. A config entry lives far from the code it silences, so it must carry its own justification ("we know and don't care" — say why); empty/whitespace reasons are rejected with remediation. The pragma sits beside the code it suppresses — the surrounding source + its review history are the justification surface, so the reason is optional there (and serde-skipped in the payload when absent).
• Unknown pragma id: stderr warning, not a run failure. Config fails closed (exit 2); source text warns (cute-dbt: warning: … is not a registered check; the pragma has no effect) — failing a whole run on a typo'd SQL comment would be hostile, but silence would be comment rot.
• No config-time warning for disabling a check with supersedes dependents (issue Discovery item 2): the non-resurrection behavior is the documented invariant, intentional configs shouldn't warn, and with a single-check registry there is no live edge to warn about. Revisit if a real supersedes pair ships and confuses someone.

Deviation (classified): pragma source is manifest raw_code, not a ProjectFileReader re-read

The issue sketch said "reuses the ProjectFileReader path". The manifest's raw_code is the verbatim authored model file (the #111 SQL-diff precedent), so re-reading the same bytes from disk would only add a --project-root requirement and a soft-failure mode — the pragma would silently stop working in baseline mode without a project root. Scanning raw_code keeps the scanner domain-pure and the pragma working in both scope modes unconditionally. Same data, strictly fewer failure modes.

Lane notes

• src/adapters/render.rs touch (builder-179's lane) is isolated to one commit and is purely mechanical: the three payload-assembly fns gain a check_policy param (conveniences pass CheckPolicy::default()), and the single findings call site applies apply_check_policy after model_findings. templates/report.html untouched; no example regenerated.
• Rebased onto origin/main at 8690d42 (after render PRs #179 — design integration PR-3: full model path + column-test display alignment #189/#177 — design integration PR-1: chassis CSS (tokens, 5 themes, 4 style packs, density) #187 merged) before pushing; clean rebase, no conflicts.
• src/domain/checks.rs edits are engine plumbing only (Suppression/SuppressionSource PODs + the suppressed field on Finding) — no heuristics! registry-entry churn, minimizing conflict surface with builder-172.

Gates (run directly, post-rebase)

Gate	Result
cargo fmt --check	clean
cargo clippy --all-targets --locked -- -D warnings	exit 0
cargo nextest run	972 passed, 33 skipped
cargo test --test bdd	105 scenarios / 663 steps passed
cargo test --test headless_toggle -- --ignored	32 passed
cargo test --test headless_zero_egress -- --ignored	1 passed
RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --locked	exit 0
cargo deny check	advisories/bans/licenses/sources ok
heuristics ledger	byte-identical (SPECS unchanged — no regen needed)
crap4rs (v0.4.0 semantics, threshold 25)	1387 functions, 0 above threshold, worst 23.0, PASS
goldens	all three examples regenerated locally and byte-identical; git diff -- examples/ empty

🤖 Generated with Claude Code

---

[coderabbitai]

Warning

Review limit reached

@cmbays, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 11 minutes and 20 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cb8807fd-07b6-4fed-a833-1b931cea2b28

📥 Commits

Reviewing files that changed from the base of the PR and between 33f2c5e and d106c4b.

📒 Files selected for processing (18)

• .github/workflows/ci.yml
• ARCHITECTURE.md
• book/src/SUMMARY.md
• book/src/check-selection.md
• features/check_selection.feature
• lefthook.yml
• src/adapters/config_reader.rs
• src/adapters/render.rs
• src/cli/mod.rs
• src/domain/check_config.rs
• src/domain/checks.rs
• src/domain/config.rs
• src/domain/mod.rs
• tests/check_engine.rs
• tests/headless_toggle.rs
• tests/steps/check_selection.rs
• tests/steps/mod.rs
• tests/steps/world.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch domain-171-checks-selection-suppression

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ghost]

Ready to review this PR? Stage has broken it down into 7 individual chapters for you:

	Title
1	Define check selection and suppression domain models
2	Wire check selection into AnalysisConfig
3	Implement fail-closed config loading and validation
4	Integrate policy application into the render pipeline
5	Wire policy construction into the CLI
6	Add documentation and update CI gates
7	Verify selection and suppression with tests

_{Chapters generated by Stage for commit d106c4b on Jun 10, 2026 11:27pm UTC.}

[gemini-code-assist]

Code Review

This pull request introduces check selection and suppression capabilities to cute-dbt, allowing users to tune coverage checks via a new [checks] configuration section or inline SQL pragmas. It supports dual selection modes (opt-out and opt-in) with group globs, targeted suppressions with required reasons, and inline pragmas with optional reasons. The display-layer policy is applied strictly after supersedes resolution, and invalid configurations fail closed with clear remediation text. The feedback identifies a potential parsing bug in src/domain/check_config.rs where a closing parenthesis inside a double-quoted pragma reason could prematurely truncate the parsed body, and suggests a more robust parsing approach.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

📄 Rendered report preview

All golden examples regenerated cleanly.

🟡 Golden examples

Committed to examples/ and byte-identity gated — the canonical reports contributors and consumers browse. Stable across PRs.

Report	View	Download
diff-showcase-report.html	▶ Open ↗	⬇ Download
jaffle-shop-report.html	▶ Open ↗	⬇ Download
playground-report.html	▶ Open ↗	⬇ Download

🐶 Live dogfood preview

This PR doesn't touch dbt-project/, so there's no live dogfood preview.

▶ Open ↗ opens the report in your browser in one click —
published to this repo's GitHub Pages under /pr-193/.
⬇ Download fetches the same self-contained HTML as a workflow
artifact (auth-gated; works fully offline). Either way the report
makes zero external resource requests.

The Pages preview may take ~1 min to update after this comment
posts. On PRs from forks the Open link is unavailable (read-only
token) — use Download.

Alternative: GitHub CLI

# gh CLI >= 2.63 extracts into ./report-preview-playground/.
gh run download 27312995792 -R breezy-bays-labs/cute-dbt -n report-preview-playground
open report-preview-playground/playground-report.html

---

_{Posted by report-preview.yml for d106c4bdf15febcffef8cf95886d41126bf21c1a. Affordance only — never blocks merge.}