chore(promote): develop → main — fr-pass exit codes, fail-closed mutators, caller comment (backend#1412, #1413)

[LukasWodka]

Promotes the three fixes merged to develop today. Until this lands, none of them do anything — all 122 caller references across the org pin @main.

.github has no staging branch, so develop → main is the whole promotion.

What goes live

#121 — fr-pass-comment.yml	backend#1413. 6 of 9 exit paths now exit 1 instead of exit 0, so a refusal stops being indistinguishable from a success in gh run list. Plus a self-recognition marker so the bot can no longer answer its own refusal note.
#122 — kanban-archive.yml, kanban-reconcile.yml	backend#1412. Three mutators that counted failures, printed them and exited 0 now fail closed. Stderr is captured instead of discarded, a 404 is distinguished from a 403/rate-limit, and an empty SCOPE trips a floor assertion instead of reporting "Missing from board: 0" after sweeping nothing.
#123 — fr-pass-comment-caller.yml	Comment-only. The template described a FR on dev → Ready for staging transition retired by RFC-BACKEND-1405 D6. This is the file the 14 per-repo callers are copied from, so leaving it stale reintroduces the drift on the next repo enrolled.

Blast radius — read before merging

This is the repo D1 calls "the highest-leverage repo we own": 122 callers across 16 repos consume these workflows at @main, and they pick this up on their next run. There is no staged rollout.

Expect things to go red that were previously green — that is the point of #122. Those three mutators have been swallowing failures. Any condition they were quietly tolerating will now surface as a red run, most likely on the nightly kanban-reconcile cron. A red cron after this merge is the guard working, not a regression from it — but it is worth being ready to read the first one rather than assuming it is this PR's fault.

#121 is lower risk in the same direction: /fr-pass refusals that used to report success will now report failure. Same reasoning — those runs were already refusing, they were just lying about it.

Ordering

backend#1411 (wiring the Done column) must land after this. The work order sequences it that way deliberately: arming these assertions afterDone is wired enlarges the mutation population on the first run and turns a warning into a red cron. With this promoted first, #1411 lands against already-armed guards.

Verification

All three PRs passed actionlint (the required check here) plus check, set-status, add-to-project and Cursor Bugbot on develop. #122 was additionally verified in a bash:5 container rather than local bash 3.2, because the runner is Ubuntu and mapfile does not exist on macOS bash — the local shell was the wrong oracle for it.

🤖 Generated with Claude Code

---

Note

High Risk
Changes apply immediately to all org callers on @main and will turn previously green cron/comment runs red when underlying API or permission issues exist; mistakes affect production kanban state and release-train PR checks.

Overview
Org-wide reusable workflows at @main get stricter signal hygiene for kanban automation and functional review.

/fr-pass (fr-pass-comment.yml) — Deliberate refusals (not-authorised, self-signoff, not-on-project, ambiguous-item, no-status, wrong-column) now exit 1 so gh run list green no longer means “card moved.” Only advanced, already-advanced, and not-a-command stay exit 0. The job if also skips bot comments and bodies starting with <!-- fr-pass-handler -->; refusal notes prepend that marker when posted so the handler does not re-trigger on its own text. fr-pass-comment-caller.yml comments now describe the single gate FR on staging → Ready for prod (no retired “FR on dev” path).

Kanban archive & reconcile — Archive mutations and reconcile apply / membership add steps capture GraphQL stderr, print it on failure, and exit 1 if any item fails (including cards added without a Status). Membership scope probing uses HTTP status (404 vs 403/5xx) instead of exit-code-only, and MIN_SCOPE aborts an empty tracked-repo sweep.

WIP limit — wip-limit-check.yml is a documented no-op tombstone (inputs preserved for old callers); wip-limit-caller.yml is removed from this repo. Lingering @main references on older branches still resolve without a hard workflow failure.

^{Reviewed by Cursor Bugbot for commit 74ffb7f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 39 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#263 — docs(changelog): add missing fragment for fix(kanban): an INVERTED anchor pair is unreadable, not "nothing deployed" (backend#1994) #259 · author: @divyasinghds · no reviewer assigned
• averaging-service#273 — docs(ci): /fr-pass advances staging → prod only (backend#1405 D6) · author: @LukasWodka · no reviewer assigned
• backend#1146 — docs(rfc): platform cost & autoscaling architecture · author: @saadqbal · reviewer: @LukasWodka, @saqlainsyed007
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
• backend#1400 — ci: 4-digit release tags + GitHub Release on merge · author: @saqlainsyed007 · no reviewer assigned
• backend#1433 — docs(ci): /fr-pass advances staging → prod only (backend#1405 D6) · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)