CI plumbing: a committed allowlist (.firebreak.exs) and a finding baseline so a pipeline can fail only on new coupling, not on the backlog it inherited.

Two complementary mechanisms:

• Suppression — .firebreak.exs in the project root lists findings the team has reviewed and accepted. They are dropped from the report entirely.
• Baseline diff — a snapshot of the findings present at some known-good commit. A later run reports (and gates on) only the findings whose signature is absent from that snapshot — the regressions.

Both match findings by Firebreak.Finding.signature/1, which is stable across line moves and message-wording changes, so the allowlist/baseline doesn't churn every time unrelated code shifts.

.firebreak.exs format

The file evaluates to a map (or a bare list of matchers):

%{
  suppress: [
    # match every finding of a check on a module
    %{check: :cross_tree_coupling, module: MyApp.Cache.Supervisor},
    # match every finding on a module, any check
    %{module: MyApp.LegacyServer},
    # match every finding of a check, any module
    %{check: :default_restart_intensity},
    # or pin an exact finding by its signature string
    "boot_order_dependency:MyApp.Early/MyApp.Late"
  ]
}