A Safe First Review of a dbt Project with Altimate Code

General-purpose coding agents can edit a SQL file. An analytics-engineering review needs more: dbt project context, warehouse-aware metadata, deterministic checks, and a clear safety boundary.

This walkthrough shows a conservative first run with Altimate Code. You will discover a local dbt project, switch to a read-only agent mode, review one model, and separate deterministic checks from model-assisted analysis. No production credentials are required: if you do not have a warehouse or dbt project available, the documented first-run flow can offer a bundled jaffle-shop project backed by DuckDB.

1. Install and start

npm install -g altimate-code
altimate

On first launch, choose a model provider. Altimate Base is documented as a no-signup, rate-limited option, but requests and responses may be logged. Do not send secrets or confidential code to it.

The optional first-run scan reads local configuration such as dbt_project.yml, .dbt/profiles.yml, and .git/config. According to the documentation, the scan does not read or send credentials. If it finds neither a dbt project nor a warehouse, choose the offered jaffle-shop/DuckDB sample.

2. Discover context, then make the review read-only

/discover
/agent analyst

Discovery looks for dbt projects, profiles, Git configuration, and available tools. Treat that inventory as context, not authorization to query production.

Altimate documents Analyst mode as read-only at the harness layer: data-changing statements such as INSERT, UPDATE, DELETE, and DROP are denied. Use that control together with least-privilege warehouse credentials. Do not use --yolo against a live warehouse; the CLI documentation says that option auto-approves permission prompts.

3. Review one model, not the whole project

Review models/marts/fct_orders.sql for SQL anti-patterns, likely cost risks,
dbt ref() usage, and downstream impact. Rank findings by severity, cite the
relevant lines, and return findings only. Do not modify files or execute write SQL.

A narrow prompt is easier to verify than “optimize my project.” Altimate also documents built-in workflows such as /sql-review, /dbt-analyze, and /dbt-test. Treat the output as a hypothesis: confirm SQL behavior with the normal dbt compile/test workflow and review every proposed change in version control.

4. Put deterministic checks first

The CLI reference separates altimate check, which performs deterministic SQL checks without an LLM, from altimate run, which sends a single model-assisted prompt. Inspect the installed flags before turning a check into a merge gate:

altimate check --help

altimate check target/compiled/fct_orders.sql \
  --format json \
  --checks lint,safety \
  --fail-on error

REPRODUCED LOCALLY

Raw dbt source and compiled SQL did not behave identically

I ran the deterministic checker from npm package version 0.12.3 against a small dbt-style model.

Raw dbt modelExit 1 · two encoding_bypass errors for raw {{ ref(...) }} expressions.

Compiled SQLExit 0 · no safety errors; one L030 select-without-limit warning.

This is not a reason to disable a safety rule globally. Define the CI input explicitly: use compiled output for executable-SQL analysis, or decide how known Jinja findings will be reviewed before gating raw dbt source. Keep both results separate.

5. Verify before acting

Does the finding cite the exact model and lines?
Is it a deterministic rule or a model judgment?
Does the recommendation preserve dbt ref() and source relationships?
Was downstream impact checked before a column rename or removal?
Can the change pass dbt compile, targeted tests, and code review?
Did proprietary SQL, schema, or sample data stay within the approved provider boundary?

What this walkthrough does not claim

It does not claim an agent finding is correct without dbt tests and human review.
It does not claim discovery makes a warehouse connection read-only.
It does not claim prompts or code never leave the machine; that depends on the configured provider.
It does not promise guaranteed savings, autonomous production fixes, or universal warehouse parity.
It does not rely on vendor benchmark percentages.

The safe first win is smaller: create a reproducible review artifact, with clear permissions and enough context for an engineer to verify every recommendation.