Build1 distinct publisher3 min readUpdated
A dev.to tutorial builds ownership and co-change answers out of pull request metadata, with no graph database and no model. The binding constraint turns out to be the API rate limit.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
Start with the request budget, because it decides whether this is a tool or a demo. The default crawl reads up to 10 recently closed pull requests and spends at most 21 API calls doing it: one to list the pull requests, then a files call and a reviews call for each merged one [8]. Unauthenticated GitHub allows 60 requests an hour [10]. That is two complete builds in an hour, and the third does not fit [1]. The four commands the tutorial advertises, run once each, come to 84 requests, which is 24 past the anonymous ceiling [2]. The token is listed as optional [10]. It is optional the way a spare tyre is optional.
The 21 is a ceiling rather than a price. It assumes all ten closed pull requests were merged, since the follow-up calls only fire for merged ones and `merged_at` is nullable [8][16]; a closed-unmerged pull request costs nothing extra [3].
None of the query work is inference. "Who understands checkout.ts" is the path person AUTHORED pull request MODIFIED file, and "what changes alongside it" is two MODIFIED edges hanging off the same pull request [7][2]. The joins run on node ids of the form `person:bobby` and `pr:acme/storefront#41` [17], which is the actual reason no vector store or model appears anywhere in the stack [3]. Similarity search is for when you do not know the key. Here the key is a filename GitHub already handed you.
Every edge carries an evidence object: source, url, summary, and an observedAt timestamp [11]. That is what separates a recommendation from a citation. When the CLI names a reviewer, the edge it named them from can be opened.
The window is the weak spot. Ten recent closed pull requests describe what a team touched lately, not who knows a file [8]. A module whose two real authors last worked on it half a year ago has no AUTHORED edge in this graph at all, so the experts query returns silence or returns whoever last ran a formatter over it [7]. Co-change inherits the same problem from the other direction: two files appearing in one pull request is a single observation, and the traversal counts it without distinguishing genuine coupling from a lockfile that moves whenever anything moves.
Two things in the type definitions suggest where the cheap improvements are. Additions and deletions already arrive on every file record [15], so weighting an author by how much of the file they actually rewrote costs no further requests. And because fetching lives in `github.ts` while the graph lives in `graph.ts` with a test file beside it [12], the traversal logic can be exercised without spending any allowance at all [14].
The omission that matters is persistence. Node ids are stable and every edge is stamped with when it was observed [17][11], so this graph is trivially serialisable, and the tutorial instead rebuilds it on every command [9]. That single choice is what turns a 21-request crawl into the dominant cost of asking a second question.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
The tutorial states the project needs no graph database, no vector database and no AI model: just TypeScript and GitHub's API.
A dev.to tutorial, "Build a Mini Engineering Graph With TypeScript and GitHub", builds a small TypeScript CLI that turns real GitHub pull requests into an engineering graph.
The tutorial frames the problem as three questions about a problem file called checkout.ts: why the code was changed, who actually understands it, and what other files usually change alongside it, with the answers scattered across pull requests, reviews, file histories and people's memories.
The CLI exposes four commands: npm run dev -- vercel/ai, npm run dev -- vercel/ai pr 123, npm run dev -- vercel/ai experts "src/example.ts", and npm run dev -- vercel/ai related "src/example.ts".
The graph has four node types: repository, pull_request, file and person.
The graph has four relationship types: BELONGS_TO, AUTHORED, MODIFIED and REVIEWED.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Self-contained and checkable, but single-source
Every factual claim is directly inspectable in the tutorial's own code and setup instructions - schema, traversals, file list, type shapes, test script and request budget - which makes the material internally specific and reproducible in principle. But it is one self-published post with no independent corroboration, no recorded run output, and no third-party confirmation of the 21-request budget or of the quality of the ownership answers.
No adoption signal in supplied sources
The cluster contains no release, deployment, download, star, benchmark or usage-disclosure evidence for the tutorial's project or for the pattern it teaches. The example repository (vercel/ai) appears only as a command argument, which says nothing about who is using this code.
Slightly overstated framing, partly self-corrected
The 'engineering graph' framing and the 'no graph database, no vector database, no AI model' line are grander than the artefact, which is an in-memory sample of up to ten pull requests rebuilt on every command. The overstatement is modest because the tutorial itself discloses the 60-requests-per-hour ceiling, the per-command rebuild, and that it is making existing relationships visible rather than inventing information; what it omits is the arithmetic consequence - two builds per hour unauthenticated, roughly 84 requests for one pass through the four commands.
Author-visibility incentive, no vendor or product stake evident
The piece is a personally bylined tutorial on a developer publishing platform, which carries a normal audience-and-reputation incentive to make the build sound cleaner than it is. Against that, the supplied source promotes no product, service, paid tier or sponsor, sells no database or model, and directs readers to a third-party API they can use free of charge, so no commercial distortion is observable in the material.
Claims are solid, significance is not
Confidence that the descriptive claims are accurate is high, because they are drawn from code and explicit setup text and the derived figures follow arithmetically from the tutorial's own numbers. Confidence in the story's wider significance is low: one publisher, no adoption evidence, and no independent test of whether pull request metadata really answers the ownership and co-change questions well.
build
A GAN beauty filter is a device budget allocation, not a feature toggle1 distinct publisher
build
The 2-4 seconds you pay per file: batch tsc once per agent session, not once per edit1 distinct publisher
build
Yadda 3's real artifact is not the code, it is the rules the agent could not rewrite1 distinct publisher
build
The closed tab that keeps billing: cancellation propagation is a spend control1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 23, 2026