feat(sisters): add Dependabot config-coverage check (#25)

New check 11 verifies each sister's .github/dependabot.yml covers its shipped manifests (uv/npm/cargo/docker/github-actions), recognizing documented deferrals and skipping templates/ + tools/ noise (mirrors check 7's primary-manifest scope).

Also refreshes the check-list summaries in docs/skills/sisters.md + docs/examples.md, which had fallen behind checks 8-10 (branch protection, codecov, log-retention).

Author: ajbarea

ROADMAP.md

@@ -83,11 +83,6 @@ wild.
   toggle; Dependabot keeps SHA pins fresh once adopted.
   research(2026-05): github.blog/changelog/2025-08-15 (policy enforcement
   + immutable releases).
-- **Dependabot config drift check in `/techne:sisters`** — compare each
-  sister's `.github/dependabot.yml` against
-  `templates/dependabot.yml.example`: ecosystem coverage vs detected
-  manifests, plus schedule/group shape. Closes the gap where the
-  template exists but nothing enforces sisters tracking it.
 - **Renovate revisit trigger** — if the fleet consolidates into a
   monorepo or wants cross-repo shared presets + auto-merge, re-evaluate
   Renovate (shared `extends` preset). Also re-enable the `uv` ecosystem
@@ -123,6 +118,13 @@ wild.
 
 One-liner per item, newest first. Detail moves to git history when work lands.
 
+- 2026-05-25 — **Sisters audit: Dependabot config coverage (check 11)** —
+  `/techne:sisters` now verifies each sister's `.github/dependabot.yml`
+  covers its shipped manifests (uv/npm/cargo/docker/github-actions),
+  recognizing documented deferrals and skipping `templates/` + `tools/`
+  noise (mirrors check 7's primary-manifest scope). Also refreshed the
+  stale check-list summaries in `docs/skills/sisters.md` +
+  `docs/examples.md` (they'd fallen behind checks 8–10)
 - 2026-05-25 — **Dependabot fleet rollout** — canonical
   `templates/dependabot.yml.example` + techne's own
   `.github/dependabot.yml` (uv + github-actions), rolled out per-ecosystem

docs/examples.md

@@ -8,7 +8,7 @@ You maintain a few related repos and want to make sure their CI pins, toolchain
 
 1. Configure the linked repos in `~/.claude/techne.toml` (see [Configuration](configuration.md)).
 2. Run `/techne:sisters`.
-3. Read the drift report. It groups findings by category: action-pin drift, toolchain-pin drift, GitHub merge-setting drift, open PRs, stale branches, local `main` divergence.
+3. Read the drift report. It groups findings by category: action-pin drift, toolchain-pin drift, GitHub merge-setting + branch-protection drift, Codecov config, log-retention, Dependabot coverage, open PRs, stale branches, local `main` divergence.
 4. Apply fixes in each repo. Re-run `/techne:sisters` to confirm the drift is gone.
 
 The skill is read-only; you commit the fixes manually.

docs/skills/sisters.md

@@ -1,6 +1,6 @@
 # `techne:sisters`
 
-Cross-repo drift audit across the sister repos listed in `~/.claude/techne.toml`. Read-only inspection: CI action pins, toolchain pins in `pyproject.toml`, skill-context structural parity, GitHub merge settings, open PRs, and branch hygiene.
+Cross-repo drift audit across the sister repos listed in `~/.claude/techne.toml`. Read-only inspection: CI action pins, toolchain pins in `pyproject.toml`, skill-context structural parity, GitHub merge settings + branch protection, Codecov config, `make clean` log-retention, Dependabot config coverage, open PRs, and branch hygiene.
 
 ## When to use
 
@@ -16,7 +16,7 @@ Invoke by name in Claude Code:
 /techne:sisters
 ```
 
-The skill reads the active sister list from `~/.claude/techne.toml`, runs all checks in parallel, and outputs a single audit block grouped by category: merge settings, skill-context parity, action-pin drift, toolchain-pin drift, open PRs, stale branches, and local main sync.
+The skill reads the active sister list from `~/.claude/techne.toml`, runs all checks in parallel, and outputs a single audit block grouped by category: merge settings, skill-context parity, action-pin drift, toolchain-pin drift, branch protection, Codecov config, log-retention policy, Dependabot coverage, open PRs, stale branches, and local main sync.
 
 The skill is read-only. It surfaces findings; it does not edit files, push branches, or change GitHub settings.
 

plugins/techne/skills/sisters/SKILL.md

@@ -257,6 +257,55 @@ Report:
 - Any sister whose threshold differs from 30 days (the canonical pin) — flag the value and ask whether to converge.
 - Sisters with no `logs/` dir are silently skipped — this is a conditional check.
 
+### 11. Dependabot config coverage
+
+Every sister should carry `.github/dependabot.yml` covering each dependency surface it actually ships. The canonical config + per-ecosystem guidance live in `templates/dependabot.yml.example`. This check maps detected manifests to expected `package-ecosystem` entries and flags gaps — except where the config documents a deliberate deferral.
+
+Scope mirrors check 7: inspect primary manifests only. Skip `templates/` (scaffolding emitted to generated projects) and `tools/` (dev experiments) — those aren't the repo's shipped dependency surface and only generate noise. `uv` is the canonical Python ecosystem (GA 2025-03-13); `pip` still provides coverage but should be migrated. Docker maps from a literal `Dockerfile` only — Dependabot doesn't auto-detect `*.Dockerfile` custom names (dependabot/feedback#145), so a repo using that convention legitimately omits docker.
+
+```
+for repo in $SISTERS; do
+  cfg="$WORKSPACE/$repo/.github/dependabot.yml"
+  [ -f "$cfg" ] || cfg="$WORKSPACE/$repo/.github/dependabot.yaml"
+  if [ ! -f "$cfg" ]; then
+    echo "$repo: NO .github/dependabot.yml -> add one (template: templates/dependabot.yml.example)"
+    continue
+  fi
+  declared=$(grep -oE "package-ecosystem:[[:space:]]*['\"]?[a-z-]+" "$cfg" \
+             | grep -oE '[a-z-]+$' | sort -u | tr '\n' ' ')
+  manifests=$(git -C "$WORKSPACE/$repo" ls-files 2>/dev/null | grep -vE '(^|/)(templates|tools)/')
+  expected=""
+  echo "$manifests" | grep -qE '(^|/)(pyproject\.toml|uv\.lock)$' && expected="$expected uv"
+  echo "$manifests" | grep -qE '(^|/)package\.json$'            && expected="$expected npm"
+  echo "$manifests" | grep -qE '(^|/)Cargo\.toml$'              && expected="$expected cargo"
+  echo "$manifests" | grep -qE '(^|/)Dockerfile$'               && expected="$expected docker"
+  expected="$expected github-actions"
+  missing=""
+  for eco in $expected; do
+    if [ "$eco" = uv ]; then
+      echo " $declared " | grep -qE ' (uv|pip) ' && continue
+    else
+      echo " $declared " | grep -q " $eco " && continue
+    fi
+    # documented deferral: an in-config comment naming the ecosystem + defer/skip
+    grep -iE '^[[:space:]]*#' "$cfg" | grep -i "$eco" | grep -qiE 'defer|skip' && continue
+    missing="$missing $eco"
+  done
+  if [ -n "$missing" ]; then
+    echo "$repo: missing ecosystem(s) for present manifests:$missing | declared: $declared"
+  else
+    echo "$repo: coverage OK | declared: $declared"
+  fi
+done
+```
+
+Report:
+
+- Any sister with no `.github/dependabot.yml`.
+- Any sister with a shipped manifest (`pyproject.toml`/`uv.lock`, `package.json`, `Cargo.toml`, literal `Dockerfile`) but no matching `package-ecosystem` entry and no documented deferral.
+- Any sister still on the `pip` ecosystem — flag for migration to native `uv`.
+- Deferrals (e.g., kourai's `uv` pending dependabot-core#14004) are recognized via an in-config comment naming the ecosystem + "defer"/"skip", so they don't false-positive.
+
 ## Output format
 
 A single block, no preamble (concrete repo names below are illustrative — substitute the actual entries from `$SISTERS`):
@@ -308,6 +357,10 @@ A single block, no preamble (concrete repo names below are illustrative — subs
 - repo-b: no logs/ dir — skip
 - repo-c: logs/ present, no age-based prune → add 30-day prune to clean
 
+### Dependabot coverage
+- All sisters: dependabot.yml covers every shipped manifest (deferrals documented) ✓
+  (or list drift: "repo-c: has package.json but no npm ecosystem → add it")
+
 ### Verdict
 
 <"N drift items to address." | "All sisters coherent.">