chore: release 0.3.0

[wjduenow]

Cuts v0.3.0 to PyPI. Brings the accumulated dev line (34 commits since v0.2.0) into main.

Headline features

• Snowflake warehouse adapter (epic feat: Snowflake warehouse adapter (v0.2) — epic + research #118 — feat: SnowflakeAdapter skeleton — factory dispatch + Dialect + _snowflake_client.py shim #119–test+docs: fakesnow harness + FakeSnowflakeClient + gated live e2e (TPCH_SF1) + ops docs #124, feat: Snowflake estimate_query_bytes — EXPLAIN-based estimation (Phase 2 of #123) #130) — the second concrete WarehouseAdapter, graduating the ABC + factory seam through a real vendor.
• Custom business-rule tests (custom_sql) — the 5th dbt test type (feat: custom business-rule test generation (meta.business_rules + LLM-inferred singular SQL tests) #116), drafted from meta.signalforge.business_rules / LLM inference, pruned + graded like the built-ins.

Notable fixes

• Snowflake projection-subquery sample shape (Snowflake sample-mode prune: HASH(*) invalid in WHERE/ORDER BY — needs projection-subquery sample shape #139), vendor-neutral get_row_count seam (Snowflake oneshot sample prune: engine routes row-count through BigQuery-only _get_client — needs vendor-neutral get_table_metadata seam #140), drafter/grader prose-preamble JSON tolerance (Business-rules custom_sql drafting reproducibly fails: LLM emits prose preamble before JSON (no assistant prefill) #144).

Release mechanics

• Version 0.3.0.dev0 → 0.3.0; CHANGELOG [Unreleased] promoted to [0.3.0] — 2026-05-27 (with the missing feat: custom business-rule test generation (meta.business_rules + LLM-inferred singular SQL tests) #116 entry added).
• Pre-flight passed in an isolated dev-based worktree: ruff / ruff format / pyright clean, 2416 passed (97% cov); uv build + uvx twine check PASSED on wheel + sdist (signalforge_dbt-0.3.0).
• Release branch is based on dev (not main) because dev is 34 ahead — this PR is the dev→main promotion for the 0.3.0 line.

After merge: tag v0.3.0 on main HEAD → non-prerelease GitHub Release → publish-pypi. Then next-dev bump (0.4.0.dev0) + backmerge to dev.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added prune-existing CLI subcommand for read-only evaluation of externally-authored dbt tests without LLM calls.
  • Introduced custom SQL business-rule tests via meta.signalforge.business_rules metadata.
  • Added Snowflake warehouse adapter support with deterministic sampling and materialization.
  • Generated standalone .sql test files for kept custom-rule tests.

• Improvements

  • Enhanced ingest layer to read and validate external dbt schemas.
  • Improved LLM response parsing to handle prose preambles before JSON.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds Snowflake adapter/dialect, custom_sql business-rule tests and proposed .sql outputs, a new ingest layer, and a read-only prune-existing CLI; refactors compiler for dialects, updates CI to Python 3.13, bumps versions/docs/tests accordingly.

Changes

v0.3.0 Feature Set

Layer / File(s)	Summary
Snowflake adapter and dialect integration src/signalforge/warehouse/..., src/signalforge/prune/compiler.py, docs/warehouse-adapter-ops.md	Implements SnowflakeAdapter, SNOWFLAKE_DIALECT, EXPLAIN-based estimate, deterministic sampling/materialization, row-count seam, and dialect-driven compiler SQL.
custom_sql tests end-to-end src/signalforge/draft/*, src/signalforge/prune/*, src/signalforge/diff/*, docs/*ops.md	Adds CandidateTestCustomSQL, bounded Jinja resolution, dialect-aware sampling, proposed_test_files emission and writers, renderer sections, and sidecar schema v3.
Ingest and prune-existing CLI src/signalforge/ingest/*, src/signalforge/cli/prune_existing.py, docs/ingest-ops.md, docs/cli-ops.md	Ships ingest reader for external schema/tests, new prune-existing command (ingest→prune→diff, no LLM), skipped reporting, and config/exit-code wiring.
Path safety, CI, and versioning .github/workflows/ci.yml, src/signalforge/_common/path_safety.py, src/signalforge/__init__.py	Expands matrix to 3.13 with Codecov gating, hardens symlink-cycle detection across Python versions, and bumps package to 0.3.0.
Docs and tests updates README.md, rules/plans/docs, tests/**	Extensive docs for Snowflake, ingest, CLI, diff v3; adds unit/e2e/snapshot tests for new behaviors, markers, and proposed .sql flows.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant CLI
  participant Manifest
  participant Ingest
  participant Warehouse
  participant Diff
  User->>CLI: signalforge prune-existing <model> --schema path
  CLI->>Manifest: load manifest
  CLI->>Ingest: read_schema + read_test_files
  Ingest-->>CLI: candidate, skipped
  CLI->>Warehouse: prune_tests(candidate)
  Warehouse-->>CLI: PruneResult
  CLI->>Diff: render_diff(existing_schema, PruneResult)
  Diff-->>CLI: DiffReport (yaml + proposed_test_files)
  CLI-->>User: stdout diff, optional sidecar

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120+ minutes

Possibly related issues

• feat: Snowflake warehouse adapter (v0.2) — epic + research #118 — Implements the Snowflake adapter/dialect and related compiler/adapter seams introduced in this PR.

Possibly related PRs

• wjduenow/SignalForge#132 — Also implements Snowflake EXPLAIN-based estimate_query_bytes with EstimateUnavailableError paths.
• wjduenow/SignalForge#142 — Shares the projection-subquery sample SQL shaping and render_sample_select wiring for Snowflake.
• wjduenow/SignalForge#126 — Overlaps on DbtProfileTarget Snowflake validation and IncompleteProfileError wiring.

Poem

A rabbit with a warehouse map,
Dials Snowflake paths in one small tap. ❄️
It prunes old tests, drafts fresh SQL,
Proposes files where keepers dwell.
With hashes neat and diffs that sing,
It ships v0.3—spring, hop, spring! 🐇✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch release/0.3.0

[codecov-commenter]

Codecov Report

❌ Patch coverage is 99.52015% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/signalforge/warehouse/adapters/snowflake.py	98.06%	5 Missing ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 15

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

docs/diff-ops.md (1)

80-80: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix DiffReport.audit_schema_version in the public API description

Line 80 still documents DiffReport.audit_schema_version: Literal[2], but the sidecar contract is now 3. This should be updated to avoid downstream parser/version-gating mistakes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/diff-ops.md` at line 80, Update the public API docs to reflect the
bumped audit schema version: change the documented type for
DiffReport.audit_schema_version from Literal[2] to Literal[3], and ensure the
surrounding description (the note about external sidecar consumers gating on >=
value) mentions the new contract value 3 so downstream parsers/version-gating
use the correct audit_schema_version; update any adjacent examples or mentions
of "bumped 1 → 2 in issue `#50`" if necessary to reference the correct bump
history for clarity.

docs/audits.md (1)

22-22: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update diff sidecar schema version in the artefact table

Line 22 still says audit_schema_version: 2 for .signalforge/diff.json, but Line 214 documents the bump to Literal[3] = 3. Please align this row to 3 to avoid consumers gating on the wrong version.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/audits.md` at line 22, Update the table entry for
`.signalforge/diff.json` so its top-level schema indicates
`audit_schema_version: 3` (currently `2`); locate the row referencing
`.signalforge/diff.json` and change the documented `audit_schema_version` value
from 2 to 3 to match the type bump (Literal[3] = 3) described later in the file
and referenced by `tests/diff/test_drift_detector.py`.

src/signalforge/cli/generate.py (1)

313-320: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update the --estimate help text for Snowflake support.

This string still says the estimate path uses “BigQuery dryRun only”, but the estimator now also reports Snowflake-backed estimates. The current help text will mislead users trying the new adapter.

Suggested fix

     write_group.add_argument(
         "--estimate",
         action="store_true",
         help=(
             "Print pre-flight cost estimate (uses count_tokens + "
-            "BigQuery dryRun only; no billable Anthropic or warehouse "
+            "warehouse estimate primitives such as BigQuery dryRun or "
+            "Snowflake EXPLAIN; no billable Anthropic or warehouse "
             "calls); mutually exclusive with --write / --dry-run."
         ),
     )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/signalforge/cli/generate.py` around lines 313 - 320, Update the help text
for the "--estimate" argument in the write_group.add_argument call so it no
longer states "BigQuery dryRun only" and instead references both BigQuery and
Snowflake (or "warehouse dry-run for BigQuery and Snowflake") as supported
backends; edit the help string assigned to the "--estimate" argument in
generate.py (the write_group.add_argument block for "--estimate") to mention
Snowflake-backed estimates and keep the rest of the wording about count_tokens,
dry-run semantics, and mutual exclusivity with --write/--dry-run unchanged.

🧹 Nitpick comments (1)

src/signalforge/diff/_renderers.py (1)

964-989: ⚡ Quick win

Escape clean_path before Markdown heading emission

_render_test_files_section assumes proposed.path is always slug-safe, but this renderer can receive externally sourced DiffReport data. Emitting raw clean_path inside ### `...` can break heading rendering or allow markdown injection for malformed paths.

Suggested hardening

         for proposed in report.proposed_test_files:
             clean_path = strip_ansi_escapes(proposed.path)
             clean_sql = "\n".join(
                 strip_ansi_escapes(sql_line) for sql_line in proposed.sql.splitlines()
             )
             fence = "`" * max(3, _longest_backtick_run(clean_sql) + 1)
+            escaped_path = escape_markdown_scalar(clean_path, in_table_cell=False)
             lines.append("")
-            lines.append(f"### `{clean_path}`")
+            lines.append(f"### {escaped_path}")
             lines.append("")
             lines.append(f"{fence}sql")
             lines.append(clean_sql)
             lines.append(fence)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/signalforge/diff/_renderers.py` around lines 964 - 989, The code emits
untrusted clean_path directly inside the Markdown inline-code heading in
_render_test_files_section; to harden it, sanitize the path after ANSI stripping
by converting it to a slug-safe filename (e.g. call the existing
anchor_to_filename or a slugify helper) and use that sanitized value in the
f"### `...`" line instead of clean_path; ensure you still call
strip_ansi_escapes(proposed.path) first, then pass that result through
anchor_to_filename (or equivalent) and use the returned safe string when
appending the heading.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/rules/warehouse-adapters.md:
- Line 228: Replace the malformed heading token "`#124` is the epic's closing
test+docs ticket..." so Markdown linter accepts it: either remove the leading
"#" to make it a plain paragraph or insert a space after the "#" to make it a
valid ATX heading (e.g., "# 124 is the epic's closing test+docs ticket...");
locate the exact string "`#124` is the epic's closing test+docs ticket" in the
file and update accordingly.

In `@CLAUDE.md`:
- Around line 14-20: The fenced code block showing the pipeline diagram in
CLAUDE.md (the block beginning with the lines "model.sql + manifest + project
ctx" through "emit graded YAML + diff with per-artifact "why"") is missing a
language tag; update the opening fence to include a language identifier (for
example change ``` to ```text) so markdown linters and renderers treat it as
plain text and avoid lint/render warnings.

In `@docs/warehouse-adapter-ops.md`:
- Line 802: Update the error-table row for MaterialisationNotSupportedError so
it no longer claims “any non-BigQuery adapter in v0.2”; instead state it applies
only to adapters that still inherit the default raising implementation
(WarehouseAdapter.materialise_sample) and therefore do not implement
materialise_sample (exclude Snowflake, which now implements materialise_sample);
keep the suggested mitigations (set prune.sample_strategy: oneshot or wait for
v0.3) unchanged.

In `@plans/super/104-ingest-external-tests.md`:
- Around line 222-225: The fenced code block showing the dependency graph (the
block containing "US-001 ── US-002 ─┬─ US-003 ─┐" and "└─ US-004 ─┴─ US-005 ──
US-006 ── US-007 (Quality Gate) ── US-008 (Patterns & Memory)") lacks a language
tag and triggers MD040; update that fence to include the language identifier
text (i.e., change the opening ``` to ```text) so the block is treated as plain
text and markdown lint no longer flags it.
- Line 247: The second occurrence of the heading "## Detailed breakdown (Phase
4)" duplicates an earlier anchor and causes TOC ambiguity; update the duplicate
heading (the one at the bottom of the Phase 4 section) to a unique title (for
example "## Detailed breakdown (Phase 4) — continued" or "## Additional details
(Phase 4)"), or remove it if redundant, ensuring only one "## Detailed breakdown
(Phase 4)" heading remains.

In `@plans/super/105-prune-existing-cli.md`:
- Around line 99-101: The fenced code blocks containing the message "Skipped 3
unsupported tests: custom-or-generic-test×2, unsupported-test-type×1" are
missing a language tag and will fail MD040; update those triple-backtick fences
to include a language (e.g., use ```text) for the block shown and the other
similar block referenced around lines 173-177 so both code fences are labeled
(use `text` or an appropriate language).

In `@plans/super/124-snowflake-test-docs.md`:
- Around line 214-220: The fenced code block that contains the dependency graph
(the block starting with the triple backticks followed by the lines with US-001,
US-002, US-003, etc.) is missing a language tag; update that opening fence to
include a language identifier such as text (e.g., change ``` to ```text) so
markdownlint MD040 is satisfied and docs checks pass.

In `@README.md`:
- Around line 46-52: The fenced code block containing the ASCII flowchart (the
block that begins with ``` and shows the boxed diagram lines like
"┌──────────────┐    ┌──────────────┐...") lacks a language tag; update its
opening fence to use ```text to satisfy markdownlint MD040 so the flowchart is
treated as plain text and the linter stops flagging it.

In `@src/signalforge/cli/prune_existing.py`:
- Around line 305-317: The _resolve_project_dir path resolution currently uses
Path(override).resolve() which can silently stop on symlink loops; change it to
resolve(strict=True) and handle OSError(ELOOP) (and other resolution errors) by
raising a CliPathError with the same message/remediation used for missing
dbt_project.yml so the CLI surfaces a user-facing error; update the logic around
the override variable in prune_existing._resolve_project_dir to attempt
candidate = Path(override).resolve(strict=True) and convert resolution
exceptions into the existing CliPathError.

In `@src/signalforge/ingest/anchor.py`:
- Around line 67-80: When validating tests, don't assume test.column is always
set — treat None as valid for model-level/custom_sql tests: in the column-scoped
loop (column.tests) only enforce test.column == column.name and membership in
model_columns when test.column is not None, and in the model/candidate loop
(candidate.tests) only check that test.column exists in model_columns when
test.column is not None; this preserves valid model-level custom_sql
(test.column is None) and avoids falsely flagging column-scoped custom_sql.

In `@src/signalforge/prune/compiler.py`:
- Around line 726-734: In _is_multi_table branch where you build partition_sql
via _render_partition_filter and create replacement for own_qualified, change
the current single-occurrence replacement to rewrite all self-references of the
model table in resolved_sql (not just the first). Locate the block using
variables own_qualified, resolved_sql and partition_filter and replace the
.replace(..., 1) behavior with a global replacement (or a regex-based global
replace with appropriate word-boundary anchoring for own_qualified) so every
occurrence of the model table is wrapped with the partitioned subquery.
- Around line 691-710: Those except branches (_RequiresFutureData and
_InvalidIdentifier returns) are currently using only the exception class name in
the reason; change them to include the exception message/details (e.g., str(exc)
or exc.args[0]) so the prune audit shows which ref()/source()/Jinja element
failed. Specifically, update the handlers for
RefNotFoundError/SourceNotFoundError (returning _RequiresFutureData),
AmbiguousRefError (returning _InvalidIdentifier), and TemplateResolutionError
(returning _InvalidIdentifier) to include the exception text alongside the
existing context string (for example: reason=f"...: {type(exc).__name__}:
{str(exc)}"). Ensure each returned reason remains a concise one-line
explanation.

In `@src/signalforge/prune/engine.py`:
- Around line 897-914: The empty-candidate fast path returns before
`_validate_trusted_models`, allowing typos in `trusted_models` to pass silently;
fix by invoking `_validate_trusted_models(...)` (using the same arguments passed
into the surrounding function — e.g. `model` and `trusted_models`) before the
`if not pairs:` early-return and keep the existing
`_maybe_emit_kept_rate_warning` and `PruneResult` return logic unchanged so
validation always runs at entry even when there are zero candidates.

In `@src/signalforge/warehouse/adapters/snowflake.py`:
- Around line 546-555: The _execute and _execute_to_dicts helpers are leaving DB
cursors open; update both functions (the blocks creating cursor =
self._get_connection().cursor()) to ensure the cursor is closed on all paths by
using a try/finally (or a context manager) that calls cursor.close() in the
finally, and keep the existing exception mapping logic
(map_snowflake_exception(...)) intact so you still map and re-raise mapped
exceptions (raise mapped from exc) after closing the cursor; make sure
successful returns (e.g., list(cursor.fetchall()) and whatever _execute_to_dicts
returns) also close the cursor before returning.
- Around line 275-283: The Snowflake auth parameters private_key_path,
private_key_passphrase, and authenticator captured on the adapter are not
forwarded to make_real_client; update the client creation call in the Snowflake
adapter where self._connection is set (the make_real_client(...) invocation) to
pass these parameters (e.g., private_key_path=self._private_key_path,
private_key_passphrase=self._private_key_passphrase,
authenticator=self._authenticator) so profile-based auth modes are honored.

---

Outside diff comments:
In `@docs/audits.md`:
- Line 22: Update the table entry for `.signalforge/diff.json` so its top-level
schema indicates `audit_schema_version: 3` (currently `2`); locate the row
referencing `.signalforge/diff.json` and change the documented
`audit_schema_version` value from 2 to 3 to match the type bump (Literal[3] = 3)
described later in the file and referenced by
`tests/diff/test_drift_detector.py`.

In `@docs/diff-ops.md`:
- Line 80: Update the public API docs to reflect the bumped audit schema
version: change the documented type for DiffReport.audit_schema_version from
Literal[2] to Literal[3], and ensure the surrounding description (the note about
external sidecar consumers gating on >= value) mentions the new contract value 3
so downstream parsers/version-gating use the correct audit_schema_version;
update any adjacent examples or mentions of "bumped 1 → 2 in issue `#50`" if
necessary to reference the correct bump history for clarity.

In `@src/signalforge/cli/generate.py`:
- Around line 313-320: Update the help text for the "--estimate" argument in the
write_group.add_argument call so it no longer states "BigQuery dryRun only" and
instead references both BigQuery and Snowflake (or "warehouse dry-run for
BigQuery and Snowflake") as supported backends; edit the help string assigned to
the "--estimate" argument in generate.py (the write_group.add_argument block for
"--estimate") to mention Snowflake-backed estimates and keep the rest of the
wording about count_tokens, dry-run semantics, and mutual exclusivity with
--write/--dry-run unchanged.

---

Nitpick comments:
In `@src/signalforge/diff/_renderers.py`:
- Around line 964-989: The code emits untrusted clean_path directly inside the
Markdown inline-code heading in _render_test_files_section; to harden it,
sanitize the path after ANSI stripping by converting it to a slug-safe filename
(e.g. call the existing anchor_to_filename or a slugify helper) and use that
sanitized value in the f"### `...`" line instead of clean_path; ensure you still
call strip_ansi_escapes(proposed.path) first, then pass that result through
anchor_to_filename (or equivalent) and use the returned safe string when
appending the heading.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b96de05b-39fe-4a9c-88fa-4ddedb9e61b5

📥 Commits

Reviewing files that changed from the base of the PR and between 5556864 and 0f8d8ad.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (191)

• .claude/rules/business-rule-tests.md
• .claude/rules/ci-supply-chain.md
• .claude/rules/cli-layer.md
• .claude/rules/grade-layer.md
• .claude/rules/ingest-layer.md
• .claude/rules/llm-drafter.md
• .claude/rules/prune-engine.md
• .claude/rules/python-build.md
• .claude/rules/testing-signal.md
• .claude/rules/warehouse-adapters.md
• .env.example
• .github/workflows/ci.yml
• CHANGELOG.md
• CLAUDE.md
• CONTRIBUTING.md
• README.md
• docs/audits.md
• docs/cli-ops.md
• docs/diff-ops.md
• docs/draft-ops.md
• docs/ingest-ops.md
• docs/prune-ops.md
• docs/snowflake-e2e-setup.md
• docs/warehouse-adapter-ops.md
• mkdocs.yml
• plans/super/104-ingest-external-tests.md
• plans/super/105-prune-existing-cli.md
• plans/super/116-business-rule-tests.md
• plans/super/119-snowflake-skeleton.md
• plans/super/120-snowflake-profile.md
• plans/super/121-prune-snowflake-dialect.md
• plans/super/122-snowflake-sampling.md
• plans/super/123-snowflake-estimate-degrade.md
• plans/super/124-snowflake-test-docs.md
• plans/super/130-snowflake-estimate-explain.md
• plans/super/139-snowflake-sample-shape.md
• pyproject.toml
• src/signalforge/__init__.py
• src/signalforge/_common/artifact_id.py
• src/signalforge/_common/json_payload.py
• src/signalforge/_common/path_safety.py
• src/signalforge/cli/__init__.py
• src/signalforge/cli/_estimate.py
• src/signalforge/cli/_helpers.py
• src/signalforge/cli/generate.py
• src/signalforge/cli/lint.py
• src/signalforge/cli/prune_existing.py
• src/signalforge/demo/__init__.py
• src/signalforge/demo/errors.py
• src/signalforge/diff/__init__.py
• src/signalforge/diff/_emitter.py
• src/signalforge/diff/_renderers.py
• src/signalforge/diff/_test_file_writer.py
• src/signalforge/diff/engine.py
• src/signalforge/diff/errors.py
• src/signalforge/diff/models.py
• src/signalforge/draft/config.py
• src/signalforge/draft/models.py
• src/signalforge/draft/parser.py
• src/signalforge/draft/prompts.py
• src/signalforge/grade/parser.py
• src/signalforge/ingest/__init__.py
• src/signalforge/ingest/anchor.py
• src/signalforge/ingest/errors.py
• src/signalforge/ingest/models.py
• src/signalforge/ingest/parser.py
• src/signalforge/ingest/reader.py
• src/signalforge/manifest/__init__.py
• src/signalforge/manifest/errors.py
• src/signalforge/manifest/loader.py
• src/signalforge/manifest/models.py
• src/signalforge/manifest/template.py
• src/signalforge/prune/compiler.py
• src/signalforge/prune/engine.py
• src/signalforge/warehouse/__init__.py
• src/signalforge/warehouse/_sample_id.py
• src/signalforge/warehouse/_sample_sql.py
• src/signalforge/warehouse/_sql_safety.py
• src/signalforge/warehouse/adapters/_snowflake_client.py
• src/signalforge/warehouse/adapters/bigquery.py
• src/signalforge/warehouse/adapters/snowflake.py
• src/signalforge/warehouse/base.py
• src/signalforge/warehouse/errors.py
• src/signalforge/warehouse/models.py
• src/signalforge/warehouse/profiles.py
• tests/_common/test_json_payload.py
• tests/_common/test_path_safety.py
• tests/cli/_e2e_helpers.py
• tests/cli/test_5_surface_parity_force.py
• tests/cli/test_5_surface_parity_prune_existing.py
• tests/cli/test_e2e_business_rules.py
• tests/cli/test_e2e_helpers.py
• tests/cli/test_e2e_snowflake_smoke.py
• tests/cli/test_estimate_engine.py
• tests/cli/test_estimate_render.py
• tests/cli/test_exit_codes.py
• tests/cli/test_generate.py
• tests/cli/test_generate_estimate.py
• tests/cli/test_prune_existing.py
• tests/cli/test_subprocess_smoke.py
• tests/diff/_snapshot_inputs.py
• tests/diff/test_artifact_id.py
• tests/diff/test_drift_detector.py
• tests/diff/test_emitter.py
• tests/diff/test_engine.py
• tests/diff/test_models.py
• tests/diff/test_public_api.py
• tests/diff/test_renderers.py
• tests/diff/test_snapshot_fixtures.py
• tests/diff/test_test_file_writer.py
• tests/draft/test_drift_detector.py
• tests/draft/test_exclude_tests.py
• tests/draft/test_models.py
• tests/draft/test_parser.py
• tests/draft/test_prompts.py
• tests/fixtures/diff/diff_report_v1.json
• tests/fixtures/diff/full_with_grade.json
• tests/fixtures/diff/proposed_test_files.ansi
• tests/fixtures/diff/proposed_test_files.md
• tests/fixtures/draft/candidate_schema_v1.json
• tests/fixtures/e2e_helpers/happy/.signalforge/diff.json
• tests/fixtures/error_paths/non_dict_root.json
• tests/fixtures/ingest/custom_sql_files/assert_customers_have_email.sql
• tests/fixtures/ingest/custom_sql_files/assert_orders_amount_positive.sql
• tests/fixtures/ingest/custom_sql_files/assert_orders_with_macro.sql
• tests/fixtures/ingest/schema_austin_bikeshare.yml
• tests/fixtures/ingest/schema_codegen_shaped.yml
• tests/fixtures/profiles/dbt_snowflake_drift_v1_x.yml
• tests/fixtures/profiles/snowflake_password.yml
• tests/fixtures/prune/compiled_sql/custom_sql.sql
• tests/fixtures/prune/compiled_sql/custom_sql_fullscan.sql
• tests/fixtures/prune/compiled_sql/custom_sql_sample.sql
• tests/fixtures/prune/compiled_sql/snowflake/accepted_values.sql
• tests/fixtures/prune/compiled_sql/snowflake/accepted_values_sample.sql
• tests/fixtures/prune/compiled_sql/snowflake/custom_sql.sql
• tests/fixtures/prune/compiled_sql/snowflake/custom_sql_fullscan.sql
• tests/fixtures/prune/compiled_sql/snowflake/custom_sql_sample.sql
• tests/fixtures/prune/compiled_sql/snowflake/not_null.sql
• tests/fixtures/prune/compiled_sql/snowflake/not_null_sample.sql
• tests/fixtures/prune/compiled_sql/snowflake/relationships.sql
• tests/fixtures/prune/compiled_sql/snowflake/relationships_sample.sql
• tests/fixtures/prune/compiled_sql/snowflake/unique.sql
• tests/fixtures/prune/compiled_sql/snowflake/unique_sample.sql
• tests/fixtures/snowflake/README.md
• tests/fixtures/snowflake/_gen_manifest.py
• tests/fixtures/snowflake/dbt_project.yml
• tests/fixtures/snowflake/models/staging/sources.yml
• tests/fixtures/snowflake/models/staging/stg_tpch_customers.sql
• tests/fixtures/snowflake/profiles.yml
• tests/fixtures/snowflake/target/manifest.json
• tests/fixtures/warehouse/snowflake/README.md
• tests/fixtures/warehouse/snowflake/explain_using_json_no_stats.json
• tests/fixtures/warehouse/snowflake/explain_using_json_sample.json
• tests/grade/test_parser.py
• tests/ingest/test_anchor.py
• tests/ingest/test_models.py
• tests/ingest/test_parser.py
• tests/ingest/test_reader.py
• tests/ingest/test_test_files.py
• tests/llm/test_prompt_cache_stability.py
• tests/manifest/test_loader.py
• tests/manifest/test_models.py
• tests/manifest/test_resolve.py
• tests/manifest/test_template.py
• tests/prune/test_compiler.py
• tests/prune/test_compiler_fakesnow.py
• tests/prune/test_compiler_import_guard.py
• tests/prune/test_engine.py
• tests/test_audit_completeness.py
• tests/test_demo.py
• tests/warehouse/_fake_snowflake.py
• tests/warehouse/test_base.py
• tests/warehouse/test_bigquery_unit.py
• tests/warehouse/test_errors.py
• tests/warehouse/test_models.py
• tests/warehouse/test_profiles.py
• tests/warehouse/test_sample_id.py
• tests/warehouse/test_sample_sql.py
• tests/warehouse/test_snowflake_adapter_fakesnow.py
• tests/warehouse/test_snowflake_client.py
• tests/warehouse/test_snowflake_client_confinement.py
• tests/warehouse/test_snowflake_estimate.py
• tests/warehouse/test_snowflake_estimate_live.py
• tests/warehouse/test_snowflake_exception_mapping.py
• tests/warehouse/test_snowflake_lifecycle.py
• tests/warehouse/test_snowflake_materialise.py
• tests/warehouse/test_snowflake_prune_live.py
• tests/warehouse/test_snowflake_sampling.py
• tests/warehouse/test_snowflake_seed_loads.py
• tests/warehouse/test_snowflake_stub.py
• tests/warehouse/test_sql_safety.py

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix malformed heading syntax at Line 228.

#124 is the epic's closing test+docs ticket... should be a plain paragraph or a proper heading (# 124 ...) to satisfy markdown linting and consistent rendering.

🧰 Tools

🪛 markdownlint-cli2 (0.22.1)

[warning] 228-228: No space after hash on atx style heading

(MD018, no-missing-space-atx)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.claude/rules/warehouse-adapters.md at line 228, Replace the malformed
heading token "`#124` is the epic's closing test+docs ticket..." so Markdown
linter accepts it: either remove the leading "#" to make it a plain paragraph or
insert a space after the "#" to make it a valid ATX heading (e.g., "# 124 is the
epic's closing test+docs ticket..."); locate the exact string "`#124` is the
epic's closing test+docs ticket" in the file and update accordingly.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a language tag to the fenced block starting at Line 14.

Use something like ```text for the pipeline diagram block to keep markdown lint clean and rendering consistent.

🧰 Tools

🪛 markdownlint-cli2 (0.22.1)

[warning] 14-14: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CLAUDE.md` around lines 14 - 20, The fenced code block showing the pipeline
diagram in CLAUDE.md (the block beginning with the lines "model.sql + manifest +
project ctx" through "emit graded YAML + diff with per-artifact "why"") is
missing a language tag; update the opening fence to include a language
identifier (for example change ``` to ```text) so markdown linters and renderers
treat it as plain text and avoid lint/render warnings.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Narrow MaterialisationNotSupportedError scope in error table

Line 802 still says this applies to “any non-BigQuery adapter in v0.2,” but this file now documents Snowflake materialise_sample as implemented. Please update this row so it only references adapters that still inherit the default raise path.

🧰 Tools

🪛 LanguageTool

[grammar] ~802-~802: Ensure spelling is correct
Context: ...oneshotto bypass materialisation. | |MaterialisationNotSupportedError(v0.2)|WarehouseAdapter.materialise_s...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/warehouse-adapter-ops.md` at line 802, Update the error-table row for
MaterialisationNotSupportedError so it no longer claims “any non-BigQuery
adapter in v0.2”; instead state it applies only to adapters that still inherit
the default raising implementation (WarehouseAdapter.materialise_sample) and
therefore do not implement materialise_sample (exclude Snowflake, which now
implements materialise_sample); keep the suggested mitigations (set
prune.sample_strategy: oneshot or wait for v0.3) unchanged.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a language to this fenced code block.

This unlabeled fence will keep tripping markdown lint (MD040). Use text for the dependency graph block.

🧰 Tools

🪛 markdownlint-cli2 (0.22.1)

[warning] 222-222: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plans/super/104-ingest-external-tests.md` around lines 222 - 225, The fenced
code block showing the dependency graph (the block containing "US-001 ── US-002
─┬─ US-003 ─┐" and "└─ US-004 ─┴─ US-005 ── US-006 ── US-007 (Quality Gate) ──
US-008 (Patterns & Memory)") lacks a language tag and triggers MD040; update
that fence to include the language identifier text (i.e., change the opening ```
to ```text) so the block is treated as plain text and markdown lint no longer
flags it.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Avoid duplicate section heading text.

## Detailed breakdown (Phase 4) is already used earlier (Line 147). Rename this second heading (or remove it) to avoid duplicate-anchor/TOC ambiguity.

🧰 Tools

🪛 markdownlint-cli2 (0.22.1)

[warning] 247-247: Multiple headings with the same content

(MD024, no-duplicate-heading)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plans/super/104-ingest-external-tests.md` at line 247, The second occurrence
of the heading "## Detailed breakdown (Phase 4)" duplicates an earlier anchor
and causes TOC ambiguity; update the duplicate heading (the one at the bottom of
the Phase 4 section) to a unique title (for example "## Detailed breakdown
(Phase 4) — continued" or "## Additional details (Phase 4)"), or remove it if
redundant, ensuring only one "## Detailed breakdown (Phase 4)" heading remains.

[coderabbitai]

🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Include the actual template-resolution detail in the sentinel reason.

These branches currently collapse the failure down to the exception class name, so the prune diff/audit still does not tell the operator which ref() / source() / Jinja construct needs fixing.

💡 Suggested change

     except (RefNotFoundError, SourceNotFoundError) as exc:
+        detail = str(exc).splitlines()[0]
         return _RequiresFutureData(
-            reason=f"custom_sql references a manifest-absent target: {type(exc).__name__}"
+            reason=f"custom_sql references a manifest-absent target: {detail}"
         )
     except AmbiguousRefError as exc:
-        return _InvalidIdentifier(reason=f"custom_sql ref() is ambiguous: {type(exc).__name__}")
+        detail = str(exc).splitlines()[0]
+        return _InvalidIdentifier(reason=f"custom_sql ref() is ambiguous: {detail}")
     except TemplateResolutionError as exc:
+        detail = str(exc).splitlines()[0]
         return _InvalidIdentifier(
-            reason=f"custom_sql Jinja could not be resolved: {type(exc).__name__}"
+            reason=f"custom_sql Jinja could not be resolved: {detail}"
         )

Based on learnings: Every kept/dropped artifact must ship with a one-line 'why' explanation; do not add black-box code paths that drop or keep artifacts without recording the reason.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	except (RefNotFoundError, SourceNotFoundError) as exc:
	# The ref()/source() target is not in the manifest yet — the
	# referenced model/source simply isn't built. Mirror the
	# relationships missing-target precedent (DEC-026): route to
	# requires-future-data so the operator revisits when the
	# dependency lands. NEVER raise — these are ManifestError
	# siblings of TemplateResolutionError, not subclasses, so the
	# broader handler below would not catch them.
	return _RequiresFutureData(
	reason=f"custom_sql references a manifest-absent target: {type(exc).__name__}"
	)
	except AmbiguousRefError as exc:
	# Genuine user ambiguity (the ref() name matches multiple
	# packages), not future data. Route to kept-without-evidence so a
	# reviewer disambiguates with the two-arg ref('pkg','name') form.
	return _InvalidIdentifier(reason=f"custom_sql ref() is ambiguous: {type(exc).__name__}")
	except TemplateResolutionError as exc:
	# Covers both UnsupportedJinjaError and the residual-{{ }} case.
	return _InvalidIdentifier(
	reason=f"custom_sql Jinja could not be resolved: {type(exc).__name__}"
	except (RefNotFoundError, SourceNotFoundError) as exc:
	# The ref()/source() target is not in the manifest yet — the
	# referenced model/source simply isn't built. Mirror the
	# relationships missing-target precedent (DEC-026): route to
	# requires-future-data so the operator revisits when the
	# dependency lands. NEVER raise — these are ManifestError
	# siblings of TemplateResolutionError, not subclasses, so the
	# broader handler below would not catch them.
	detail = str(exc).splitlines()[0]
	return _RequiresFutureData(
	reason=f"custom_sql references a manifest-absent target: {detail}"
	)
	except AmbiguousRefError as exc:
	# Genuine user ambiguity (the ref() name matches multiple
	# packages), not future data. Route to kept-without-evidence so a
	# reviewer disambiguates with the two-arg ref('pkg','name') form.
	detail = str(exc).splitlines()[0]
	return _InvalidIdentifier(reason=f"custom_sql ref() is ambiguous: {detail}")
	except TemplateResolutionError as exc:
	# Covers both UnsupportedJinjaError and the residual-{{ }} case.
	detail = str(exc).splitlines()[0]
	return _InvalidIdentifier(
	reason=f"custom_sql Jinja could not be resolved: {detail}"
	)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/signalforge/prune/compiler.py` around lines 691 - 710, Those except
branches (_RequiresFutureData and _InvalidIdentifier returns) are currently
using only the exception class name in the reason; change them to include the
exception message/details (e.g., str(exc) or exc.args[0]) so the prune audit
shows which ref()/source()/Jinja element failed. Specifically, update the
handlers for RefNotFoundError/SourceNotFoundError (returning
_RequiresFutureData), AmbiguousRefError (returning _InvalidIdentifier), and
TemplateResolutionError (returning _InvalidIdentifier) to include the exception
text alongside the existing context string (for example: reason=f"...:
{type(exc).__name__}: {str(exc)}"). Ensure each returned reason remains a
concise one-line explanation.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Partition-rewrite all self-references, not just the first one.

The multi-table path only rewrites the first occurrence of own_qualified. A custom_sql self-join or correlated subquery can still reference the model table multiple times, which leaves later scans unpartitioned and changes the evaluated row set.

🐛 Suggested change

         if partition_filter is not None:
             partition_sql = _render_partition_filter(partition_filter, dialect)
             replacement = f"(SELECT * FROM {own_qualified} WHERE {partition_sql})"
             if own_qualified in resolved_sql:
-                return resolved_sql.replace(own_qualified, replacement, 1)
+                return resolved_sql.replace(own_qualified, replacement)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/signalforge/prune/compiler.py` around lines 726 - 734, In _is_multi_table
branch where you build partition_sql via _render_partition_filter and create
replacement for own_qualified, change the current single-occurrence replacement
to rewrite all self-references of the model table in resolved_sql (not just the
first). Locate the block using variables own_qualified, resolved_sql and
partition_filter and replace the .replace(..., 1) behavior with a global
replacement (or a regex-based global replace with appropriate word-boundary
anchoring for own_qualified) so every occurrence of the model table is wrapped
with the partitioned subquery.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep trusted_models validation ahead of the empty-candidate return.

This fast path exits before _validate_trusted_models, so a typo in trusted_models now passes silently whenever a model has zero candidates. That breaks the documented “validate at entry before any warehouse call” contract.

🔧 Suggested change

-    if not pairs:
+    _validate_trusted_models(resolved_config, manifest)
+
+    if not pairs:
         _maybe_emit_kept_rate_warning(
             [],
             model_unique_id=model.unique_id,
             threshold=resolved_config.min_kept_rate_warn,
         )
         return PruneResult(
             model_unique_id=model.unique_id,
             decisions=(),
             elapsed_ms=max(0, _now_monotonic_ms() - start_ms),
             signalforge_version=_SIGNALFORGE_VERSION,
         )
-
-    # Validate trusted_models BEFORE any warehouse call (DEC-008).
-    _validate_trusted_models(resolved_config, manifest)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/signalforge/prune/engine.py` around lines 897 - 914, The empty-candidate
fast path returns before `_validate_trusted_models`, allowing typos in
`trusted_models` to pass silently; fix by invoking
`_validate_trusted_models(...)` (using the same arguments passed into the
surrounding function — e.g. `model` and `trusted_models`) before the `if not
pairs:` early-return and keep the existing `_maybe_emit_kept_rate_warning` and
`PruneResult` return logic unchanged so validation always runs at entry even
when there are zero candidates.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Forward Snowflake auth parameters when creating the real client.

private_key_path, private_key_passphrase, and authenticator are captured on the adapter but never passed into make_real_client, so those profile modes are effectively ignored at connection time.

Suggested fix

             self._connection = make_real_client(
                 account=self._account or "",
                 user=self._user or "",
                 password=self._password or "",
                 role=self._role,
                 warehouse=self._warehouse,
                 database=self._database,
                 schema=self._schema,
+                private_key_path=self._private_key_path,
+                private_key_passphrase=self._private_key_passphrase,
+                authenticator=self._authenticator,
             )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/signalforge/warehouse/adapters/snowflake.py` around lines 275 - 283, The
Snowflake auth parameters private_key_path, private_key_passphrase, and
authenticator captured on the adapter are not forwarded to make_real_client;
update the client creation call in the Snowflake adapter where self._connection
is set (the make_real_client(...) invocation) to pass these parameters (e.g.,
private_key_path=self._private_key_path,
private_key_passphrase=self._private_key_passphrase,
authenticator=self._authenticator) so profile-based auth modes are honored.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Close cursors in _execute and _execute_to_dicts to avoid resource leaks.

Both helpers leave cursors open on success and failure paths.

Suggested fix

     def _execute(self, sql: str, *, table: TableRef) -> list[Any]:
@@
         cursor = self._get_connection().cursor()
         try:
             cursor.execute(sql)
             return list(cursor.fetchall())
         except Exception as exc:
             mapped = map_snowflake_exception(exc, context={"table": table.qualified_name})
             if mapped is exc:
                 raise
             raise mapped from exc
+        finally:
+            cursor.close()
@@
     def _execute_to_dicts(self, sql: str, *, table: TableRef) -> list[dict[str, Any]]:
@@
         cursor = self._get_connection().cursor()
         try:
             cursor.execute(sql)
             rows = list(cursor.fetchall())
         except Exception as exc:
             mapped = map_snowflake_exception(exc, context={"table": table.qualified_name})
             if mapped is exc:
                 raise
             raise mapped from exc
-        return self._rows_to_dicts(cursor, rows)
+        finally:
+            cursor.close()
+        return self._rows_to_dicts(cursor, rows)

Also applies to: 565-574

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/signalforge/warehouse/adapters/snowflake.py` around lines 546 - 555, The
_execute and _execute_to_dicts helpers are leaving DB cursors open; update both
functions (the blocks creating cursor = self._get_connection().cursor()) to
ensure the cursor is closed on all paths by using a try/finally (or a context
manager) that calls cursor.close() in the finally, and keep the existing
exception mapping logic (map_snowflake_exception(...)) intact so you still map
and re-raise mapped exceptions (raise mapped from exc) after closing the cursor;
make sure successful returns (e.g., list(cursor.fetchall()) and whatever
_execute_to_dicts returns) also close the cursor before returning.