fix(inventory): e2e-test-agent's nine exemptions are remediated (backend#1552)

[LukasWodka]

Summary

e2e-test-agent#13 added the .github/workflows directory that repo had lacked since 2026-06-03. So nine exempt entries in repo-inventory.yml now assert the opposite of reality — exempt means the caller must be absent, and all nine are present.

This is time-sensitive. The last caller-drift run was 13:53 UTC; #13 merged at 14:13. Left alone, the next scheduled run goes red for a gap that has just been closed.

Why this block mattered

It was the largest single-repo block of UNREMEDIATED exemptions in the file — 11 of the 21 org-wide, where the next worst repo has 3. And the harm the exemptions recorded was real, not hypothetical: no issue or PR in that repo had ever reached the board, which is why e2e-test-agent#11 sat open and unreviewed for seven days.

RFC-BACKEND-1405 D1 always required this — "Exempt never means ungoverned: every repo keeps branch protection, the code-quality caller and kanban auto-add." This is compliance catching up, not a change of policy.

The flip

To the private-train-repo template, identical to frontend-app:

Entry	Before	After
advance-deploy-env / code-quality / customer-priority-bump / fr-gate / fr-pass-comment / kanban-closure-router / set-pr-status	exempt (UNREMEDIATED)	required
public-pii-gate	exempt (UNREMEDIATED)	exempt — *private_repo_no_public_exposure
wip-limit-check	exempt (UNREMEDIATED)	exempt — *wip_limit_check_has_no_callers
add-to-kanban, stale-backlog (copies)	exempt (UNREMEDIATED)	required

release_train deliberately stays false

caller-drift.py:562 verifies that field against release-train/repos.yml, so flipping it before the repos.yml entry lands would fail the guard. rfcs#12 D2 amends 1405 D1 to enrol the repo; the flip to true follows the repos.yml entry in a separate PR, not this one.

The *no_workflows_directory_at_all anchor stays — devex-bootstrap still uses it.

Verification

Ran the guard locally against live reality, not just a schema check:

python3 scripts/caller-drift.py --inventory repo-inventory.yml --source-dir .

Inventory: 20 repos x 9 reusables + 2 copies. Audited 20 of 20 on the develop-first branch.
No drift. Every repo read, every entry matched.

Exit 0.

Epic: tracebloc/backend#1552 · RFC: tracebloc/rfcs#12

🤖 Generated with Claude Code

---

Note

Low Risk
YAML-only inventory alignment with deployed workflows; no runtime or auth changes, and release_train is explicitly unchanged.

Overview
Updates e2e-test-agent in repo-inventory.yml so the inventory matches the repo after e2e-test-agent#13 added .github/workflows. Nine UNREMEDIATEDexempt entries that claimed callers must be absent are flipped to required for the standard private-repo callers and kanban copy workflows, aligned with frontend-app.

public-pii-gate and wip-limit-check stay exempt but now cite the shared anchors (*private_repo_no_public_exposure, *wip_limit_check_has_no_callers) instead of the old “no workflows directory” text. add-to-kanban and stale-backlog copies move from *no_workflows_directory_at_all to required.

Adds a block comment documenting the remediation, RFC-BACKEND-1405 compliance, and that release_train: false is intentional until release-train/repos.yml lists the repo (guard checks that field).

^{Reviewed by Cursor Bugbot for commit 2f5339c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

FR on staging → Ready for prod (staging FR sweep, 2026-08-06). Basis: content-only change — merged and live on staging. No product-behavior verification required for this class.