[conatus]

Dependabot PRs pile up because we can't tell from CI alone whether a bump is safe: our test coverage doesn't reliably touch the code that uses each library. This adds a routine that builds that coverage one package at a time and fixes what upgrades break, so bumps reach a person ready to merge and can eventually merge themselves.

What's in it

/verify-dependabot skill (.claude/skills/verify-dependabot/SKILL.md). For a Dependabot PR it:

1. Finds where the bumped package touches our code. Most of our Dependabot PRs are transitive security bumps that we never import, so it traces them with npm why/composer why and classifies them: runtime (direct or transitive), build tooling, dev server, or test tooling.
2. Writes the smallest test of our use of the package (never of the library itself). For build and dev-server tooling, the build and the dev server are the test.
3. Proves the test can fail: it passes on the old version, fails when our code is broken, fails when the library's code in node_modules/vendor is changed, and passes on the new version.
4. Pushes the test plus a ledger entry to the Dependabot branch.
5. Fixes what breaks. If the upgrade breaks a new test, an existing test, the build, lint or E2E, it fixes our code until CI is green. It never skips or weakens a test, and never pins the package back.
6. Gets its commits reviewed. Once CI is green, a review agent with fresh context runs the code-review skill on the PR and posts its findings as inline review comments. The skill fixes what's reasonable and answers each thread: fixed threads get the commit and are resolved, declined ones get the reason and stay open. Then a new agent reviews again, until a reviewer is satisfied. After three rounds it stops and asks the person below for help. A status comment on the PR records the round, so the daily run resumes where it stopped.
7. Moves through gears:
   • First time a package is seen: once CI is green and a review agent is satisfied, it posts the evidence and requests review from whoever added the dependency (or the top-level dependency that pulls it in), falling back to whoever last changed it.
   • After that, minor and patch bumps: auto-merge on green CI, as long as the package isn't used anywhere new. If CI is red, it fixes it and the PR goes back to a person.
   • Major bumps (and 0.x minor bumps): always go to a person.

Ledger (.github/dependency-coverage/): one JSON file per package, recording its class, where we use it and which tests verify it. A file only reaches master through a reviewed Dependabot PR, so its presence on master is the approval record. One file per package means Dependabot PRs open at the same time never conflict.

Dev server check in CI (.github/workflows/dev-server.yml, scripts/dev-server-smoke.sh). Designers, engineers and headless Claude Code sessions all rely on the dev server, and nothing in CI ran it. The script starts it and checks the page, the hot-reloading bundle and the stubbed /join/v1/* endpoints. It fails when I add a syntax error to the source or change the stub route. Run it locally with npm --prefix packages/join-flow run test:dev-server.

scripts/bundled-packages.js tells the skill whether a package ships in the production bundle or is build tooling only.

First run

The skill was tried on #141 (fast-uri) before the fix-and-review loop was added. See the comment there: a build-only package, verified by the build and dev server, with @joaquimds requested as reviewer. The next daily run will put #141 through the review loop.

Before merging

• Merge this before Bump fast-uri from 3.1.8 to 3.1.9 in /packages/join-flow #141 so Bump fast-uri from 3.1.8 to 3.1.9 in /packages/join-flow #141's CI includes the Dev Server check.
• For gear 2 auto-merge to be safe, the repo needs "Allow auto-merge" turned on, and master needs required status checks. Without required checks, auto-merge merges as soon as it's enabled.
• A daily scheduled task (07:40 London) runs the skill over all open Dependabot PRs. It does nothing until this is merged.

🤖 Generated with Claude Code

https://claude.ai/code/session_019QZFw9N8p8vhvtvA3LDZG1