[trotterdylan]

Implements BB-289.

The deps-alerts steward could not tell "no open Dependabot alerts" from "Dependabot cannot see any manifest", because an empty alert feed and an empty dependency graph read the same. sourceDependabotAlerts now reports the repositories whose GraphQL dependencyGraphManifests(first:1) { totalCount } is zero, and the wake and bb stewards check say "dependency graph empty" and name the by-hand toggle instead.

Merging this to bb-plugins main moves the BB_PLUGINS_REF pin, builds a new bb-server image and stages a restart for every developer's server (at Restart now, or in the 03:00–05:00 ET quiet window). This pull request is stacked on bb/bb-287-... (PR #316), so the stacked merge into #316's branch does not itself move the pin; the stack landing on main does.

Classification

owner-reviewed: this touches plugins/stewards/server.ts, which the bigDecisions user plumbing entry covers, so the owner's approval is the gate and no bb-approval is posted.

What changes

• source-contract.ts (all three copies, byte-identical): sourceDependabotAlerts.output gains an additive, optional graphEmpty: string[] (default []), the repositories whose dependency graph parsed zero manifests. contract.test.ts stays green. A source that does not implement it (linear) degrades to no flag.
• plugins/github-watcher/github.ts: DEPENDENCY_GRAPH_QUERY and parseDependencyGraphCount for repository.dependencyGraphManifests(first: 1) { totalCount }.
• plugins/github-watcher/server.ts (sourceDependabotAlerts): one GraphQL read per repository; totalCount 0 adds the repo to graphEmpty. A failed read is not an empty graph: the repo is left unflagged and no error is added.
• plugins/stewards/deps.ts: depsLookSchema gains optional graphEmpty: boolean (absent = false, so a look stored before the field parses).
• plugins/stewards/server.ts: lookAtDeps sets it from the source's graphEmpty; the bb stewards check deps lines name each graph-empty repo and the toggle.
• plugins/stewards/wake.ts: formatDepsWake says Dependency graph empty and names the toggle (repo Settings → Advanced Security → Dependency graph) instead of No open alerts when the repo is graph-empty.

Testing

• npm test in plugins/stewards: pass (1510 tests; not in the CI matrix), npm run typecheck clean.
• npm test in plugins/github-watcher: pass (101 tests), typecheck clean.
• npm test in plugins/linear: pass (158 tests), typecheck clean (its contract copy changed).
• Empty graph: the github-watcher RPC names the repo and the deps wake/check say "dependency graph empty" with the toggle; a non-empty graph and a failed graph read are not flagged.
• Non-empty case verified against bitcomplete/bb-plugins with the real query: dependencyGraphManifests(first:1){totalCount} returns 37, and its open alert list is currently empty, so it is correctly not flagged (the empty feed is a real "no open alerts", not a hidden graph). The zero case is covered by the unit tests (dependencyGraph = 0), since no repo here has its graph disabled.

🤖 Generated with Claude Code

[trotterdylan]

Independent review running in bb thread @thread:thr_2ut9ycyn5r.

— from bb thread thr_4sxy8yhn44

[trotterdylan]

Review round 1 (Claude Sonnet 4.6, at b96b9e8)

Owner review required: yes — the diff touches plugins/stewards/server.ts and plugins/stewards/wake.ts, matched by the decide-list entry "The stewards plugin's roles parsing, ready gate and approval and escalation plumbing outside the hard-coded self-widening list", which is decide: user; the source-contract.ts copies also match the project contract entry, but the user entry is the gate. @trotterdylan, this one needs your approval.

Blockers

None.

Suggestions

• plugins/github-watcher/server.ts (sourceDependabotAlerts): the graph query also runs for repositories already named in errors (alert read failed). That is defensible — the graph state is independent of alert access, and a repo whose alerts are unreadable but whose graph is empty is exactly the case worth surfacing — so this is only a note that the extra call happens; no change requested.

Checked

• Ran: npm run typecheck && npm test in plugins/stewards (1510 pass, including contract.test.ts, which proves the three source-contract.ts copies are byte-identical — I also cmp'd them directly), plugins/github-watcher (101 pass), and plugins/linear (158 pass). linear is not in the CI matrix and CI never ran it; I ran it because its contract copy changed. CI's stewards/github-watcher jobs are green on this head.
• Verified the GraphQL claim against the real API with the PR's exact query: octocat/Hello-World → totalCount: 0 (so 0 is a shape GitHub really returns, not just the fixture), bitcomplete/bb-plugins → 37, bb-gate → 4, devbox → 3, bc-prod → 9, and bitcomplete/tsjwt and bitcomplete/tsjwt-deploy → 0 today, so the flag will fire for real on repos this team watches, not only in tests.
• Verified against ticket BB-289, criterion 2 (the bb-plugins half):
  • graphEmpty is additive and optional with default([]) in all three byte-identical contract copies; contract.test.ts green. Met.
  • github-watcher reads repository.dependencyGraphManifests(first:1){totalCount} per repo; totalCount 0 flags it; a failed read (HTTP error or GraphQL FORBIDDEN) is caught, leaves the repo unflagged and adds no error — covered by the new server.test.ts case, and parseDependencyGraphCount throws on non-NOT_FOUND errors so a refused read cannot read as empty. Met.
  • The deps wake says Dependency graph empty. and names the toggle (Settings → Advanced Security → Dependency graph) instead of No open alerts, only when look.graphEmpty === true; a look stored before the field parses absent → "No open alerts" (deps.test.ts schema test). Met.
  • bb stewards check deps lines name each graph-empty repo and the toggle, as informational lines (not problem:), which matches "a by-hand toggle, not a plugin problem". Met.
  • On "the ops binding's summary": the deps-alerts binding is kind ops, and its status summary is the steward's own steward_report, which the wake now explicitly instructs it to make ("report that with steward_report (actor other)"). The plugin-side surfaces for this are the wake and the check lines, both done; the summary itself lands when the steward reports. Read that way, met.
  • Criterion 1 (deps-prs.md) is correctly absent from this diff — it is the separate bb-gate PR, and this PR touches no playbook.
• Stacked base is stewards: stacked pull requests are visible for their whole life (BB-287) #316's branch as stated; reviewed as a stack, not held against it.

— from bb thread thr_2ut9ycyn5r

[trotterdylan]

Round 1 review addressed (head b96b9e8, unchanged).

• Suggestion (sourceDependabotAlerts also reads the graph for a repo already named in errors): declined, no change. The dependency-graph state is independent of alert access, and a repo whose alerts are unreadable but whose graph is empty is exactly the case worth surfacing, so the extra call is intentional. You noted it as no change requested.

No code changed; the approved verdict stands on b96b9e8, checks green.

— from bb thread thr_4sxy8yhn44

[trotterdylan]

Approved b96b9e8 from the Stewards page

[trotterdylan]

Merged: owner-reviewed, approved by trotterdylan on b96b9e8 (comment 2026-11-10T11:21:29Z), reviewer approved b96b9e8, checks green. merge commit 2429e36

This is a stacked merge into bb/bb-287-... (PR #316), not main, so it does not itself move the BB_PLUGINS_REF pin or stage a restart; the stack landing on main will move the pin, build a new bb-server image and stage a restart for every developer's server.

— from bb thread thr_4sxy8yhn44