fix: comments

Signed-off-by: Uroš Marolt <uros@marolt.me>

Author: themarolt

services/apps/packages_worker/src/deps-dev/README.md

@@ -68,13 +68,12 @@ The override logic lives in `src/deps-dev/activities/bqExportToGcs.ts`.
 
 ## Environment variables
 
-| Variable                       | Required  | Purpose                                                                                            |
-| ------------------------------ | --------- | -------------------------------------------------------------------------------------------------- |
-| `OSSPCKGS_GCP_PROJECT`         | yes       | GCP project ID for BQ and GCS                                                                      |
-| `OSSPCKGS_GCS_BUCKET`          | yes       | GCS bucket for Parquet exports                                                                     |
-| `OSSPCKGS_GCP_CREDENTIALS_B64` | yes       | Base64-encoded GCP service account JSON                                                            |
-| `OSSPCKGS_DEPS_TABLE`          | no        | Set to `B` to use `DependenciesLatest` (ADR-0003 Option B) instead of `DependencyGraphEdgesLatest` |
-| `CROWD_TEMPORAL_SERVER_URL`    | yes       | Temporal server address                                                                            |
-| `CROWD_TEMPORAL_NAMESPACE`     | yes       | Temporal namespace (overrides `backend-config` default)                                            |
-| `CROWD_TEMPORAL_CERTIFICATE`   | prod only | Base64-encoded mTLS client certificate                                                             |
-| `CROWD_TEMPORAL_PRIVATE_KEY`   | prod only | Base64-encoded mTLS private key                                                                    |
+| Variable                       | Required  | Purpose                                                 |
+| ------------------------------ | --------- | ------------------------------------------------------- |
+| `OSSPCKGS_GCP_PROJECT`         | yes       | GCP project ID for BQ and GCS                           |
+| `OSSPCKGS_GCS_BUCKET`          | yes       | GCS bucket for Parquet exports                          |
+| `OSSPCKGS_GCP_CREDENTIALS_B64` | yes       | Base64-encoded GCP service account JSON                 |
+| `CROWD_TEMPORAL_SERVER_URL`    | yes       | Temporal server address                                 |
+| `CROWD_TEMPORAL_NAMESPACE`     | yes       | Temporal namespace (overrides `backend-config` default) |
+| `CROWD_TEMPORAL_CERTIFICATE`   | prod only | Base64-encoded mTLS client certificate                  |
+| `CROWD_TEMPORAL_PRIVATE_KEY`   | prod only | Base64-encoded mTLS private key                         |

services/apps/packages_worker/src/deps-dev/activities/bqExportToGcs.ts

@@ -198,7 +198,10 @@ export async function bqExportToGcs(input: BqExportToGcsInput): Promise<BqExport
     const dryRunBytes = Number(dryRunJob.metadata.statistics.totalBytesProcessed ?? 0)
     // Log the effective ceiling (env override may differ from the default maxBytesGb) and the
     // computed byte ceiling, so ops can see what the abort decision is actually compared against.
-    log.info({ jobKind, dryRunBytes, maxBytesGb, effectiveMaxBytesGb, ceiling }, 'BQ dry-run complete')
+    log.info(
+      { jobKind, dryRunBytes, maxBytesGb, effectiveMaxBytesGb, ceiling },
+      'BQ dry-run complete',
+    )
     if (dryRunBytes > ceiling) {
       throw new Error(
         `BQ dry-run for ${jobKind} reports ${dryRunBytes} bytes > ceiling ${ceiling} — aborting`,

services/apps/packages_worker/src/deps-dev/config.ts

@@ -12,10 +12,6 @@ export const GCS_BUCKET = requireEnv('OSSPCKGS_GCS_BUCKET')
 export const DEPS_DEV_DATASET = 'bigquery-public-data.deps_dev_v1'
 export const SCORECARD_DATASET = 'openssf.scorecardcron'
 
-// ADR-0003: Option A = DependencyGraphEdgesLatest (prod default, has version_constraint).
-// Set OSSPCKGS_DEPS_TABLE=B locally to use DependenciesLatest (cheaper, no version_constraint).
-export const DEPS_TABLE_OPTION: 'A' | 'B' = process.env.OSSPCKGS_DEPS_TABLE === 'B' ? 'B' : 'A'
-
 const credentials = JSON.parse(
   Buffer.from(requireEnv('OSSPCKGS_GCP_CREDENTIALS_B64'), 'base64').toString('utf8'),
 )

services/apps/packages_worker/src/deps-dev/workflows/ingestDependencies.ts

@@ -233,7 +233,14 @@ export async function ingestDependencies(opts: {
   // scanning the live snapshot. Both full (*Latest = newest snapshot) and incremental can hit
   // a bad snapshot, so the guard runs for both. Probes only resolved-graph ecosystems; a clean
   // GO/NUGET-only run finds no canaries and passes through.
-  if (!opts.reuseExports) {
+  //
+  // Option A only: the guard's canary ratios are DependencyGraphEdges-schema-specific. Option B
+  // ingests the separate Dependencies/DependenciesLatest table, which the 2026-06 corruption was
+  // never observed in and has no calibrated baseline — probing Edges there would "validate" a table
+  // we don't ingest (false confidence) and could abort a healthy Option B run when only Edges is bad.
+  // Option B is a manual, non-scheduled cost-experiment path (--deps-table-b); leave it unguarded by
+  // design rather than invent a guard for an unproven threat. Option A is the production default.
+  if (!opts.reuseExports && tableOption === 'A') {
     const guard = await checkEdgeSnapshotQuality({ snapshotDate: opts.today, ecosystems, fullScan })
     if (!guard.ok) {
       throw ApplicationFailure.nonRetryable(