feat(review): [R20 S4] triage promotion — never auto-approve risk-bearing dbt metadata

packages/opencode/src/altimate/review/config.ts

@@ -46,6 +46,34 @@ export const ReviewConfig = z.object({
  rubric: Rubric.partial().default({}),
  /** Extra path suffixes to exclude from review. */
  exclude: z.array(z.string()).default([]),
+ /**
+ * Path-token categories that promote a change to `full` when a token
+ * appears at a path/word boundary. This is business-vertical opinion
+ * (billing, PII-adjacent, safety-critical) — hardcoding it into the
+ * reviewer core would leak one team's naming convention onto every
+ * consumer. Empty by default; teams opt in by naming categories and
+ * listing tokens.
+ *
+ * Example — enable the shipped `finops` preset (billing/cost/etc.):
+ * riskTierPathTokens:
+ * finops: [preset:finops]
+ *
+ * Or a custom category:
+ * riskTierPathTokens:
+ * pci: [card, pan, cvv]
+ * patient: [phi, mrn, diagnosis]
+ *
+ * Matching is case-insensitive at path/word/digit boundaries — a token
+ * `cost` fires on `mrt_cost_daily.sql` and `mrt_cost2024.sql` but not
+ * inside `broadcaster.sql` or `precast_table.sql`. The `preset:<name>`
+ * marker expands to the current shipped list at reviewer startup.
+ */
+ // Tokens must be non-empty. An empty string here compiles into a regex
+ // alternative that matches everywhere between two boundary characters
+ // (`(?:|foo)` matches the empty string), silently over-promoting paths
+ // like `stg__orders.sql` where two boundary chars are adjacent.
+ // Cubic-review P2 on PR #1028.
+ riskTierPathTokens: z.record(z.string(), z.array(z.string().min(1))).default({}),
 })
 export type ReviewConfig = z.infer<typeof ReviewConfig>
 

packages/opencode/src/altimate/review/orchestrate.ts

@@ -9,7 +9,7 @@ import {
  SEVERITY_ORDER,
 } from "./finding"
 import { type ChangedFile, filterChangedFiles } from "./diff-filter"
-import { classifyPR, TIER_LANES } from "./risk-tier"
+import { classifyPR, compilePathTokenResolver, TIER_LANES } from "./risk-tier"
 import { type Rubric, exclusionReason, clampSeverity } from "./rubric"
 import { type ReviewConfig } from "./config"
 import { type ReviewMode, type VerdictEnvelope, buildEnvelope, signEnvelope } from "./verdict"
@@ -1092,14 +1092,41 @@ export async function runReview(input: OrchestrateInput): Promise<VerdictEnvelop
  // A run is degraded when model files exist but none resolved against a manifest.
  const runDegraded = modelFiles.length > 0 ? !anyManifest : reviewable.length === 0
 
+ // High-risk path tokens are user-configured (billing/pci/patient/etc.) —
+ // the reviewer core carries no default list. `undefined` when no
+ // categories are configured, which keeps `highRiskPathTokenCategory`
+ // undefined per file and no promotion fires.
+ //
+ // `compilePathTokenResolver` throws on an unknown `preset:<name>` (typo
+ // guard, cubic + harness-bot P2). Catch that here so a single config
+ // typo in `.altimate/review.yml` doesn't crash every review run in the
+ // project's CI — surface the error to stderr AND propagate a
+ // `configError` reason into the envelope so the reader can see what
+ // broke. The review continues with no path-token promotion (the
+ // conservative safe fallback), so users notice their opt-in is dead
+ // rather than getting silent auto-approve on billing/PCI/etc. paths
+ // (cubic-review P2 on PR #1028 risk-tier.ts:134).
+ let pathTokenCategoryOf: ((p: string) => string | undefined) | undefined
+ let pathTokenConfigError: string | undefined
+ try {
+ pathTokenCategoryOf = compilePathTokenResolver(input.config.riskTierPathTokens)
+ } catch (e: any) {
+ pathTokenConfigError = `riskTierPathTokens config invalid: ${e?.message ?? String(e)}`
+ process.stderr.write(`⚠️ ${pathTokenConfigError}\n Review continuing without path-token promotion.\n`)
+ pathTokenCategoryOf = undefined
+ }
  const tierResult = classifyPR(reviewable, {
  blastRadiusOf: (p) => {
  const c = ctxByPath.get(p)
  return c ? c.impact.directCount + c.impact.transitiveCount : 0
  },
  touchesPiiOf: (f) => (ctxByPath.get(f.path)?.pii.length ?? 0) > 0,
  isComplexOf: (f) => ctxByPath.get(f.path)?.complex ?? false,
+ pathTokenCategoryOf,
  })
+ // Surface config errors in the tier-reasons stream so a reader of the
+ // envelope (or PR comment) sees WHY their opt-in didn't fire.
+ if (pathTokenConfigError) tierResult.reasons.unshift(pathTokenConfigError)
  const classifiedTier = tierResult.tier
  // G2 — --force-tier overrides the classifier. Envelope records both the
  // forced tier and the original classification whenever the flag is passed
@@ -1400,7 +1427,13 @@ export async function runReview(input: OrchestrateInput): Promise<VerdictEnvelop
  manifestHash: input.manifestHash,
  generatedAt: input.generatedAt,
  degraded,
- tierReasons: input.explainTier || tierForced ? tierReasons : undefined,
+ // Include tierReasons whenever `--explain-tier` / `--force-tier` is set,
+ // OR when a riskTierPathTokens config error was caught above — the error
+ // must surface in the envelope (and downstream PR comment) even in a
+ // normal `comment`/`gate` run, otherwise a config typo silently kills
+ // the user's opt-in with only a stderr trace they'll never see
+ // (coderabbit review, PR #1028 orchestrate.ts:1129).
+ tierReasons: input.explainTier || tierForced || pathTokenConfigError ? tierReasons : undefined,
  tierForced: tierForced ? true : undefined,
  tierClassified: tierForced ? classifiedTier : undefined,
  })