AltimateAI
diff --git a/‎packages/opencode/src/altimate/review/risk-tier.ts‎
Lines changed: 53 additions & 0 deletions b/‎packages/opencode/src/altimate/review/risk-tier.ts‎
Lines changed: 53 additions & 0 deletions
diff --git a/‎packages/opencode/test/altimate/review.test.ts‎
Lines changed: 149 additions & 0 deletions b/‎packages/opencode/test/altimate/review.test.ts‎
Lines changed: 149 additions & 0 deletions
@@ -36,6 +36,22 @@ export interface FileChangeClass {
   incrementalLogicChange: boolean
   /** Structurally complex SQL (window/subquery/large plan) — never `trivial`. */
   complex: boolean
+  // R20 S4 — risk-signal promotion. Grounded in the 5-PR internal corpus study
+  // (see data-engineering-skills/docs/pr-review-corpus-findings-r20.md) where
+  // PRs D (test-only YAML on contracted marts) and E (cost-anchor redesign)
+  // both auto-approved despite each having 8+ substantive human findings.
+  /** schema.yml diff introduces or edits `data_tests:`, `constraints:`,
+   *  `unique_combination_of_columns`, or `contract:` — grain / constraint
+   *  territory reviewers repeatedly flagged as substantive. */
+  dbtRiskYmlChanges: boolean
+  /** File lives under `models/marts/` or `models/mart/` — mart-layer changes
+   *  land in the API surface downstream consumers depend on. */
+  martLayerChange: boolean
+  /** Path or filename contains a FinOps keyword
+   *  (`cost|saving|billing|credit|dbu|spend|revenue|price|rate`). The
+   *  highest-severity blockers in the corpus (cross-model rate asymmetry,
+   *  DBU savings > DBU cost, misanchored billing units) landed here. */
+  finopsPathToken: boolean
 }
 
 export interface ClassifyOptions {
@@ -50,6 +66,23 @@ export interface ClassifyOptions {
 const MATERIALIZATION_RE = /[+]?materialized\s*[:=]|config\s*\(\s*[^)]*materialized/i
 const INCREMENTAL_RE = /is_incremental\s*\(|unique_key|incremental_strategy|merge_update_columns|partition_by/i
 
+// R20 S4 — signals that lift a PR out of trivial / lite. See FileChangeClass docs.
+//
+// Anchored to YAML key position after the optional diff marker (`+`/`-`),
+// optional indentation, and optional list-item marker (`- `). Excludes comment
+// lines (`#`) and description strings that happen to contain the keyword. Two
+// forms because `data_tests`/`constraints`/`contract` are ALWAYS keys, whereas
+// `unique_combination_of_columns` is a TEST NAME that shows up as a list item
+// (`- dbt_utils.unique_combination_of_columns:`).
+const DBT_RISK_KEY_RE = /^[+-]?[ \t]*(?!#)(?:-[ \t]+)?(?:data_tests|constraints|contract)[ \t]*:/im
+const DBT_UNIQUE_COMBO_RE = /^[+-]?[ \t]*(?!#)-[ \t]+(?:[\w.]+\.)?unique_combination_of_columns[ \t]*:/im
+const MARTS_DIR_RE = /(?:^|\/)models\/marts?\//i
+// FinOps keyword must sit at a path or filename boundary so we don't fire on
+// arbitrary substrings (e.g. `broadcaster` matching `caste` never triggers
+// `cost`, but `_backups_of_cost_config.sql` would still catch on the `cost`
+// token via `_`). Cover common word / segment / extension boundaries.
+const FINOPS_TOKEN_RE = /(?:^|[\/_.-])(?:cost|costs|saving|savings|billing|credit|credits|dbu|dbus|spend|revenue|price|prices|rate|rates|pricing|invoice|invoices)(?:$|[\/_.-])/i
+
 /** The ADDED/REMOVED lines of a unified diff (excludes context + hunk headers),
  *  so signal detection fires on what actually changed, not surrounding context. */
 function changedLines(diff: string | undefined): string {
@@ -76,6 +109,10 @@ export function classifyFile(file: ChangedFile, opts: ClassifyOptions = {}): Fil
     materializationChange: kind === "model_sql" && !!changed && MATERIALIZATION_RE.test(changed),
     incrementalLogicChange: kind === "model_sql" && !!changed && INCREMENTAL_RE.test(changed),
     complex: opts.isComplexOf?.(file) ?? false,
+    dbtRiskYmlChanges:
+      kind === "schema_yml" && !!changed && (DBT_RISK_KEY_RE.test(changed) || DBT_UNIQUE_COMBO_RE.test(changed)),
+    martLayerChange: MARTS_DIR_RE.test(file.path),
+    finopsPathToken: FINOPS_TOKEN_RE.test(file.path),
   }
 }
 
@@ -91,6 +128,22 @@ export function fullTierReasons(c: FileChangeClass): string[] {
   if (c.materializationChange) reasons.push("materialization changed")
   if (c.incrementalLogicChange) reasons.push("incremental logic changed")
   if (c.blastRadius > 5) reasons.push(`${c.blastRadius} downstream models`)
+  // R20 S4 — trivial/lite promotion for signals the 5-PR corpus proved are
+  // reviewer-critical. Each reason surfaces in the signed envelope's
+  // `tierReasons`, so a customer can see WHY a nominally-tiny YAML-only diff
+  // ran at full tier.
+  //
+  // Path-based `martLayerChange` on its own is intentionally NOT a promotion
+  // reason — description-only edits under `models/marts/` are legitimately
+  // trivial. Promotion here requires diff-level evidence (`dbtRiskYmlChanges`)
+  // or a FinOps path token, either of which correlates with real reviewer
+  // blockers in the corpus. `martLayerChange` upgrades the WEIGHT of a
+  // dbtRiskYmlChanges hit but doesn't fire on its own.
+  if (c.dbtRiskYmlChanges) {
+    const loc = c.martLayerChange ? " under models/marts/ (mart-API surface)" : ""
+    reasons.push(`schema.yml diff touches data_tests/constraints/contract${loc}`)
+  }
+  if (c.finopsPathToken) reasons.push("path contains FinOps keyword (cost/saving/billing/dbu/etc.)")
   return reasons
 }
 
 
@@ -501,6 +501,155 @@ describe("risk-tier", () => {
     expect(r.tier).toBe("full")
     expect(r.reasons.join(" ")).toContain("source")
   })
+
+  // R20 S4 — triage-tier promotion for the two auto-approval failure modes
+  // exposed by the 5-PR internal corpus study. Historical baseline auto-
+  // approved PRs D (test-only YAML on contracted marts, 8 missed findings)
+  // and E (cost-anchor redesign, 11 missed findings). These tests lock in
+  // the "never auto-approve risk-bearing dbt metadata changes" contract.
+  test("R20 S4: full: schema.yml adds data_tests: [not_null] on a mart (PR D shape)", () => {
+    const diff =
+      "@@ -1,3 +1,6 @@\n" +
+      " models:\n" +
+      "   - name: mrt_column_lineage\n" +
+      "     columns:\n" +
+      "       - name: record_id\n" +
+      "+        data_tests:\n" +
+      "+          - not_null\n"
+    const r = classifyPR([file("models/marts/mrt_column_lineage.yml", diff)])
+    expect(r.tier).toBe("full")
+    expect(r.reasons.join(" ")).toContain("data_tests")
+    // Marts context flag surfaces so the customer sees where the promotion came from.
+    expect(r.reasons.join(" ")).toContain("mart-API surface")
+  })
+
+  test("R20 S4: full: schema.yml adds constraints: block on a contracted model", () => {
+    const diff =
+      "@@ -1,3 +1,5 @@\n" +
+      "     columns:\n" +
+      "       - name: id\n" +
+      "+        constraints:\n" +
+      "+          - type: not_null\n"
+    const r = classifyPR([file("models/intermediate/int_x.yml", diff)])
+    expect(r.tier).toBe("full")
+    expect(r.reasons.join(" ")).toContain("data_tests/constraints/contract")
+  })
+
+  test("R20 S4: full: schema.yml adds unique_combination_of_columns test", () => {
+    const diff =
+      "@@ -1,3 +1,7 @@\n" +
+      "     data_tests:\n" +
+      "+      - dbt_utils.unique_combination_of_columns:\n" +
+      "+          combination_of_columns:\n" +
+      "+            - metastore_id\n" +
+      "+            - sku_name\n"
+    const r = classifyPR([file("models/marts/mrt_billing_account_prices.yml", diff)])
+    expect(r.tier).toBe("full")
+  })
+
+  test("R20 S4: full: FinOps keyword in path (PR E shape — anchor cost redesign)", () => {
+    // Small SQL change on a cost-savings mart should NOT auto-approve at
+    // lite tier just because it's within the line limit — the corpus study
+    // showed these are the highest-severity blockers.
+    const r = classifyPR([file("models/marts/mrt_jobs_cost_savings.sql", "+select 1 as a\n")], {
+      blastRadiusOf: () => 1,
+    })
+    expect(r.tier).toBe("full")
+    expect(r.reasons.join(" ")).toContain("FinOps keyword")
+  })
+
+  test("R20 S4: full: FinOps keyword variants (billing/dbu/savings/spend) all promote", () => {
+    for (const path of [
+      "models/marts/mrt_billing_daily.sql",
+      "models/marts/mrt_dbu_by_workspace.sql",
+      "models/marts/mrt_credit_savings.sql",
+      "models/intermediate/int_query_cost.sql",
+      "models/staging/stg_warehouse_spend.sql",
+      "models/marts/mrt_list_price.sql",
+      "models/marts/mrt_daily_rate.sql",
+    ]) {
+      const r = classifyPR([file(path, "+select 1\n")], { blastRadiusOf: () => 0 })
+      expect(r.tier).toBe("full")
+      expect(r.reasons.join(" ")).toContain("FinOps keyword")
+    }
+  })
+
+  test("R20 S4: FinOps token does NOT over-fire on incidental substrings", () => {
+    // False-positive guard: the token regex requires path/word boundaries so
+    // words like `broadcaster.py` (has `caste`) or `precast_table.sql` (has
+    // `cast`) don't fire the cost/dbu/etc. rules.
+    const r1 = classifyPR([file("models/staging/stg_broadcaster.sql", "+select 1\n")], {
+      blastRadiusOf: () => 0,
+    })
+    expect(r1.tier).toBe("lite")
+
+    const r2 = classifyPR([file("models/marts/mrt_precast_table.sql", "+select 1\n")], {
+      blastRadiusOf: () => 0,
+    })
+    expect(r2.tier).toBe("lite")
+  })
+
+  test("R20 S4: trivial: description-only edits under models/marts/ still trivial (no risk keys)", () => {
+    // A schema.yml under marts that only changes descriptions/docs should
+    // stay trivial — the promotion requires diff-level risk signals, not
+    // just path membership. Precision guard against over-firing on doc PRs.
+    const r = classifyPR([file("models/marts/_m.yml", "+    description: better docs\n+    meta:\n+      owner: alice\n")])
+    expect(r.tier).toBe("trivial")
+  })
+
+  test("R20 S4: dbtRiskYmlChanges does NOT fire outside schema.yml (kind gate)", () => {
+    // The token `data_tests:` appearing in a .sql or .md file shouldn't
+    // promote — the rule keys off schema.yml kind + diff-level regex, not
+    // the token appearing in arbitrary text.
+    const r = classifyPR([file("models/intermediate/int_x.sql", "+-- note: data_tests: not_null on grain\n")], {
+      blastRadiusOf: () => 0,
+    })
+    expect(r.tier).toBe("lite")
+  })
+
+  test("R20 S4: dbtRiskYmlChanges does NOT fire on yml comment lines mentioning the key", () => {
+    // Comment lines starting with `#` (with or without diff `+`/`-` prefix)
+    // must not promote — a reviewer explaining `constraints:` in a schema.yml
+    // comment shouldn't trigger a full-tier run.
+    const diff =
+      "@@ -1,3 +1,4 @@\n" +
+      " models:\n" +
+      "   - name: foo\n" +
+      "+    # note: constraints: are handled at the mart layer\n" +
+      "+    description: foo model\n"
+    const r = classifyPR([file("models/intermediate/int_x.yml", diff)])
+    expect(r.tier).toBe("trivial")
+  })
+
+  test("R20 S4: dbtRiskYmlChanges does NOT fire on description strings mentioning the key", () => {
+    // A `description:` string containing the substring `data_tests:` or
+    // `constraints:` must not promote — the regex anchors to key position.
+    // Note: `contract:` in a description would trip the pre-existing
+    // `touchesContract` hard-floor rule (diff-filter.ts:139), which is out
+    // of S4 scope; keep this negative test on `data_tests` / `constraints`.
+    const diff =
+      "@@ -1,2 +1,3 @@\n" +
+      " models:\n" +
+      "   - name: foo\n" +
+      '+    description: "grain-key columns get data_tests: not_null via dbt_utils.unique_combination_of_columns"\n'
+    const r = classifyPR([file("models/intermediate/int_x.yml", diff)])
+    expect(r.tier).toBe("trivial")
+  })
+
+  test("R20 S4: dbtRiskYmlChanges fires on YAML key at nested indent (production shape)", () => {
+    // Sanity: the tightened regex still fires on realistic dbt YAML shapes
+    // where `data_tests:` sits under `columns:` at 8-space indent.
+    const diff =
+      "@@ -1,5 +1,7 @@\n" +
+      " models:\n" +
+      "   - name: mrt_order\n" +
+      "     columns:\n" +
+      "       - name: order_id\n" +
+      "+        data_tests:\n" +
+      "+          - not_null\n"
+    const r = classifyPR([file("models/marts/mrt_order.yml", diff)])
+    expect(r.tier).toBe("full")
+  })
 })
 
 // ---------------------------------------------------------------------------