feat(caller-drift): enumerate the SOURCE reusables, not just the inventory list (backend#1681)

[LukasWodka]

The blind spot

reusables is a hand-written list and the audit iterates it. So a reusable added to tracebloc/.github but never added to that list is compared against no repo and reported by nothing.

The guard checked that every listed reusable is handled. It never checked that every shipped reusable is listed — the one direction of drift it could not see.

How it surfaced

version-bump-pr.yml exists, has zero callers org-wide, and cannot be called as written: it requires a pr-token secret no repo supplies.

It's Layer 2 of backend#1563 — the automated post-release bump-PR opener, meant to prevent exactly the version staleness that stalled tracebloc-py-package's prod leg (backend#1561). It shipped, was never wired up, and nothing said so.

The check

check_source_reusables() walks the source workflow directory, parses each file, and refuses in both directions:

• a workflow_call workflow absent from the list → checked against nobody
• a listed name that isn't a reusable there → a rename or delete leaves every repo's row asserting a ghost

A die(), not a finding: the inventory is the contract, and a contract that doesn't mention half the artifacts it governs can't be audited against.

(on: is read as both "on" and True — YAML 1.1 parses the bare key as a boolean, which is a classic way this kind of check silently matches nothing.)

The inventory rows

version-bump-pr.yml is now listed and exempt in all 20 repos behind one shared reason stating plainly that it was never wired — the same posture as wip-limit-check. That converts an invisible gap into a written decision: wire it or delete it.

Test plan / evidence

check	result
selftest	97 → 102 pass, 0 fail
real source dir, before adding the rows	died, naming version-bump-pr.yml
real source dir, after	passes
mutation — remove any one entry from the list	dies (exit 2)
ruff --isolated --select E4,E7,E9,F scripts/	All checks passed!

New selftest cases: an unlisted reusable is refused, a listed-but-absent one is refused, a push-triggered workflow is correctly not demanded, a missing workflows dir is refused rather than passed, and a fully-tracked tree passes.

Note for the reviewer

Based on develop; #212 (rulesets) also touches repo-inventory.yml and caller-drift.py, so whichever lands second needs a trivial rebase. Kept separate per the one-self-contained-change-per-PR rule rather than stacking.

Found by the round-2 pipeline audit, backend#1681. Parent epic: backend#1680.

---

Note

Medium Risk
Changes org-wide conformance guard startup behavior so any future unlisted reusable blocks CI until inventory is updated; inventory-only YAML bulk change with no runtime app impact.

Overview
Closes a caller-drift blind spot: the audit only walked the hand-written reusables list, so a workflow_call workflow shipped in tracebloc/.github but never listed was never checked against any repo.

check_source_reusables() now scans the source checkout’s .github/workflows, treats each workflow_call file as a reusable (including YAML 1.1 on: / True), and die()s (exit 2) if the inventory is out of sync in either direction—unlisted reusables in source, or listed names that are not reusables there. It runs at the start of the guard, before per-repo drift.

Inventory follow-up for version-bump-pr.yml (surfaced by this check): added to reusables, documented via version_bump_pr_never_wired, and marked exempt on all 20 repos (never wired, no pr-token secret)—same written posture as wip-limit-check.

Selftests cover pass, unlisted reusable, phantom listed name, push-only workflows ignored, and missing workflows dir.

^{Reviewed by Cursor Bugbot for commit 6f1ccbd. Bugbot is set up for automated code reviews on this repo. Configure here.}