feat(check): .labelle-check-allow — the migration ledger

[apotema]

The flying-platform packs migration (its docs/packs-migration.md) carries 26 known cross-pack reads with per-phase retirement plans, and explicitly assumes a labelle check allowlist that never existed — so every run buries a NEW violation under 26 known ones, which teaches people to grep past the lint entirely.

Format (.labelle-check-allow at the project root, # comments):

<rule-slug> <file-path> [message-substring]
cross-pack-registry-access packs/industry/scripts/kitchen_gate.zig Worker

• Path: slash-normalized /-boundary suffix match — one ledger works on every OS, and s/foo.zig can't claim packs/foo.zig.
• Optional substring narrows to specific findings — a file can allow its Worker read while a newly-added foreign name still fails.
• No line numbers by design: they drift on every edit and a stale ledger is worse than none.

Never silent: the report prints N known finding(s) suppressed, entries that matched nothing get a stale-entry warning naming their line, and the exit code follows the filtered count.

Proven live on flying-platform: 26/26 suppressed by a phase-annotated ledger; a synthetic rooms__Bed read added to an allowlisted file still fails the run. 4 unit tests (parser, boundary/needle/stale matcher, passthrough, fixture e2e). Local failure set byte-identical to main's (the known Windows-env set).

🤖 Generated with Claude Code

https://claude.ai/code/session_014pbwN1ytAa8tctZMaTMjAk

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • Added support for a .labelle-check-allow file to suppress known check findings by rule, path, and optional message text.
  • Check results now show suppression counts and warn about allowlist entries that no longer match findings.
  • Checks exit successfully when all findings are allowlisted, while remaining findings still cause failure.

• Tests

  • Added coverage for allowlist parsing, filtering, path matching, stale entries, and end-to-end behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

The check command now reads .labelle-check-allow, matches entries against findings, suppresses matching findings, reports stale entries, and exits unsuccessfully only for remaining findings.

Changes

Check allowlist support

Layer / File(s)	Summary
Allowlist contracts and matching src/check_cmd.zig	The change adds allowlist parsing, path normalization, rule and message matching, stale-entry tracking, and unit tests for these behaviors.
Check command reporting and fixture validation src/check_cmd.zig	cmdCheck applies allowlist results before reporting. End-to-end tests verify suppression and stale-entry output.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant cmdCheck
  participant AllowlistFile
  participant parseAllowlist
  participant applyAllowlist
  participant Reporter
  cmdCheck->>AllowlistFile: Read .labelle-check-allow
  cmdCheck->>parseAllowlist: Parse entries
  cmdCheck->>applyAllowlist: Match findings
  applyAllowlist-->>cmdCheck: Return kept, suppressed, stale
  cmdCheck->>Reporter: Report remaining findings and stale entries

Loading

Possibly related PRs

• labelle-toolkit/labelle-assembler#486: Provides the lint findings that this allowlist filtering extends.

Poem

A rabbit reads rules in a neat little file,
Hops past known findings with a whiskered smile.
Three vanish quietly, one stale remains,
The check reports clearly through all its domains.
“Boundaries and messages now match just right!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the new .labelle-check-allow feature and matches the pull request's main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/check-allowlist

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/check_cmd.zig`:
- Around line 104-110: Move the allowlist loading, filtering, and stale-entry
reporting in the command flow before the zero-pack early return around
applyAllowlist. Ensure projects with no packs still process entries and report
unmatched allowlist entries, while returning success when filtered.kept is
empty; preserve the existing OutOfMemory propagation and unreadable-allowlist
fallback behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c13e97f-4c6a-45a5-90f1-dd434a206125

📥 Commits

Reviewing files that changed from the base of the PR and between 1cf89ad and f69716e.

📒 Files selected for processing (1)

• src/check_cmd.zig

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Process the allowlist before the zero-pack return.

Lines 97-102 return before this new flow runs. When a project has no packs, every allowlist entry matches no finding, but the command emits no stale-entry warning. Move allowlist filtering and stale reporting before that return. Preserve a successful exit when filtered.kept is empty.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/check_cmd.zig` around lines 104 - 110, Move the allowlist loading,
filtering, and stale-entry reporting in the command flow before the zero-pack
early return around applyAllowlist. Ensure projects with no packs still process
entries and report unmatched allowlist entries, while returning success when
filtered.kept is empty; preserve the existing OutOfMemory propagation and
unreadable-allowlist fallback behavior.