fix(inventory): drop archived devex-bootstrap, unstale the claude-skills exemption

[LukasWodka]

The caller-drift audit is red on develop with 2 findings, and gate is a required check for any PR touching a contract file (repo-inventory.yml, caller-drift.py, its selftest, the two workflows). So every such PR inherits an unrelated red and cannot merge — that is what currently blocks #240.

Neither finding is about the code.

1. devex-bootstrap is archived

devex-bootstrap: in repo-inventory.yml but not an active repo in tracebloc (archived, forked, renamed or deleted). Remove or correct the entry.

Verified via the API: archived=true. The entry existed to hold open the disposition question in backend#1597 — "whether the repo joins the train, stays a scratch repo, or is archived". That question now has an answer, so the 86-line block and its exemptions go with it. Confirmed with Lukas.

2. The claude-skills exemption is stale

claude-skills: .cursor/BUGBOT.md is marked exempt but the file exists. The exemption is stale.

Verified: the file exists, 8,949 bytes. It was exempt via *bugbot_guide_missing, and the reason stopped being true. Now required, like the other repos that have one.

This is exactly the failure mode the stale-exemption check exists to catch: an exemption nobody revisits reads as "not required here" forever.

Why this is separate from #240

#240 changes caller-drift.py behaviour; this changes inventory data. Splitting them keeps each reviewable on its own terms — and this one unblocks every contract-touching PR, not just mine.

Verification

• YAML parses; 19 repos remain
• selftest 162 pass / 0 fail
• the audit itself runs in CI on this head — that is the authoritative check, and it is what should go green here

---

Note

Low Risk
Inventory and test-only changes with no runtime product logic; main risk is mis-stating which repos still need BUGBOT exemptions (rfcs remains exempt).

Overview
Aligns org contract data with live GitHub state so the caller-drift / conformance gate can go green on contract-touching PRs.

repo-inventory.yml removes the archived devex-bootstrap repo and its large exemption block (protection, callers, copies, quality files), plus unused shared anchors (devex_bootstrap_undisposed, no_workflows_directory_at_all). claude-skills now treats .cursor/BUGBOT.md as required instead of a stale bugbot_guide_missing exemption. Shared bugbot_guide_missing text is narrowed to repos that still lack the file (e.g. rfcs).

standards-sync.py clears EXEMPT now that the only exempt repo is gone, avoiding a stale-exemption hard failure in scheduled audits.

standards-sync-selftest.py exercises the EXEMPT mechanism with a temporary exempt-fixture instead of devex-bootstrap, so the test does not break when fleet membership changes.

^{Reviewed by Cursor Bugbot for commit e0105b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1976baa. Configure here.}

[shujaatTracebloc]

Approving. All three Bugbot threads were resolved with no reply, so I checked each fix in the tree rather than taking the resolve at face value — all three are genuinely fixed, and the High one is fixed in the better of the two available ways.

The three findings, verified

1. High — stale EXEMPT in standards-sync.py. Fixed: EXEMPT: "dict[str, str]" = {}. This mattered more than its blast radius suggests — design rule 3 makes an EXEMPT name the inventory doesn't know a hard failure, so leaving devex-bootstrap there would have taken the whole scheduled org-standards audit down with an exit 2 rather than skipping one repo. Removing an inventory entry and leaving the exemption behind is a genuinely easy miss.

What I'd have pushed back on is if the two selftests had just been deleted. Instead they now inject their own exempt-fixture and restore sync.EXEMPT in a finally, with the reasoning recorded: "a test of the mechanism should not depend on today's fleet." That's the right call — those tests cover the fail-closed path for a stale exemption, which is exactly the mechanism this PR just exercised for real. Pinning them to a live repo is why they broke on archival in the first place.

2. Medium — bugbot_guide_missing prose. Fixed: now reads "Measured absent 2026-08-12 in rfcs", and the trailing "Distinct from devex_bootstrap_undisposed" sentence went with the anchor it referenced. Cross-checked and it's self-consistent — the anchor has exactly 1 remaining alias, which is rfcs. Prose and usage agree.

3. Low — orphaned devex_bootstrap_undisposed anchor. Fixed: definition removed. no_workflows_directory_at_all was also removed, correctly — devex-bootstrap's two copies entries were its only users.

I verified the whole file rather than just the touched anchors:

undefined aliases: none # an undefined alias is a YAML parse error
YAML parses: OK

Worth stating because version_gate_not_applicable (14 uses) and version_bump_pr_never_wired (19 uses) were also referenced by the deleted block — those correctly survive because other repos use them. The cleanup distinguished the orphans from the still-shared ones instead of removing everything the block touched.

One follow-up, pre-existing — not this PR

The anchor audit turned up one orphan, and it isn't yours:

set_pr_status_caller_missing def=1 uses=0

I checked develop and it is already orphaned there (def=1 uses=0 pre-PR), so this PR neither caused nor worsened it. Leaving it out of scope.

But it makes the Low finding worth more than its severity. caller-drift.py has no orphan-anchor check — nothing in it looks at shared_reasons usage at all. So that class of rot is caught only when a human happens to see it in a diff, and set_pr_status_caller_missing is the proof: orphaned on develop, nobody noticed. Bugbot found the devex_bootstrap_undisposed orphan only because it was in the diff.

A schema assertion — every shared_reasons anchor has ≥1 alias — is a few lines in the guard and would have caught both. Same argument this file already makes about stale exemptions: a reason nobody revisits reads as justified forever. Worth its own issue rather than bolting onto this one.

On the dispositions themselves

Both are correct, and both are the honest direction:

• devex-bootstrap is genuinely archived=true, and the 86-line block existed only to hold open the backend#1597 disposition question. The question has an answer, so the block goes. Keeping an archived repo in an inventory of active repos is what produced the finding.
• The claude-skills exemption flipping from exempt: *bugbot_guide_missing to required is the stale-exemption check working exactly as designed — the file exists now, so the reason stopped being true. I reviewed that .cursor/BUGBOT.md on claude-skills#27, so I can confirm it's real and substantive rather than a placeholder that satisfies a file-existence check.

Splitting this from #240 was right: this is inventory data, #240 is caller-drift.py behaviour, and this one unblocks every contract-touching PR on its own.

[LukasWodka]

Thanks — and noted that you checked each fix in the tree rather than taking the resolves at face value. The threads auto-resolved on push (outdated), so that was the right instinct; I should have replied on each rather than letting the resolve speak.

Your follow-up is real, and I measured it both ways before filing:

develop anchors=19 orphans=1 [set_pr_status_caller_missing]
PR #241 anchors=17 orphans=1 [set_pr_status_caller_missing]

Orphaned on develop today, unchanged by this PR — exactly as you said. My cleanup took 19 → 17 by removing the two orphans it created; that one has been sitting outside any diff, which is your point precisely: it was never caught because nobody looked at it.

Filed as tracebloc/backend#1881, with both halves — the schema assertion in caller-drift.py (every shared_reasons anchor has ≥1 alias) and a decision on set_pr_status_caller_missing itself. I flagged in the ticket that an orphan can mean "the reason was dropped"or"the reason was never wired up", so it wants one look before deletion rather than a blind removal.

Agreed on why it belongs outside this PR: inventory data vs guard behaviour, and #241 is queued behind a release-train hop.

One correction to something implicit in the review: no_workflows_directory_at_all was not removed because devex-bootstrap used it — it was removed because devex-bootstrap was its only user, leaving it at zero aliases. version_gate_not_applicable (14) and version_bump_pr_never_wired (19) were referenced by the same deleted block and correctly survive. You spotted that distinction; recording it explicitly so the next reader of this diff does not conclude that everything the block touched was fair game.