fix(conformance-gate): the gate was not in its own GUARDED list (backend#1681)

[LukasWodka]

The hole

A PR touching only.github/workflows/conformance-gate.yml matched nothing in GUARDED, so it took the "This PR does not touch the repo contract — nothing to verify" branch and exited 0.

That means the gate could be defanged on a green check — drop repo-inventory.yml from the list, or replace the poll with exit 0 — and a follow-up PR could then edit the contract against a gate that no longer guarded it. Two PRs, both green, no audit ever demanded.

The fix

One line: the gate is now in its own list. A change to it requires caller-drift to have passed on that exact head, the same as a change to the inventory or the checker.

Test plan

Verified offline against the real matcher (grep -qxF over the changed-file list), in both directions:

changed files	TOUCHED
.github/workflows/conformance-gate.yml	✅ conformance-gate.yml
repo-inventory.yml	✅ repo-inventory.yml
README.md, docs/thing.md	— (correctly nothing)
workflows/conformance-gate.yml (near miss)	— (correctly nothing; the match is whole-line)

actionlint clean.

This PR is also its own live test: it touches the file it adds to the list, so the gate must now demand the audit on this very PR. If gate goes green withoutaudit having passed on the head, the fix didn't work.

What this does NOT claim

pull_request workflows run from the PR's merge ref, so the gate evaluating a PR is that PR's version of the gate — and caller-drift.py is likewise supplied by the head. This family's integrity still rests on the required human review. This closes the silent path; it does not make the gate self-hosting. That caveat is written into the file rather than left for a reader to discover.

Found by the round-2 pipeline audit, backend#1681. Parent epic: backend#1680.

---

Note

Low Risk
CI guardrail tightening with no runtime or data-path changes; slightly increases when caller-drift runs on PRs that touch the gate file.

Overview
Closes a bypass where a PR that changed onlyconformance-gate.yml did not match GUARDED, so the conformance gate exited green without requiring caller-drift on that head—allowing the gate to be weakened in one PR and contract files edited in a follow-up with no audit.

conformance-gate.yml now lists itself in GUARDED (same treatment as repo-inventory.yml and caller-drift.yml), and adds inline comments documenting the hole (backend#1681) and that pull_request still runs the PR’s version of the workflow (human review remains the backstop).

caller-drift.ymlpull_request and pushpaths filters now include conformance-gate.yml so edits to the gate trigger the drift audit on that change, not only inventory/checker changes.

^{Reviewed by Cursor Bugbot for commit a21d7c9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a21d7c9. Configure here.}