fix(inventory): two caller exemptions outlived their callers (backend#2243)

[saadqbal]

caller-drift.py failed the audit check on the staging promotion mirror (#292), and both findings are real:

- claude-skills: advance-deploy-env.yml is marked `exempt` but a caller exists
(advance-deploy-env.yml). The exemption is stale.
- release-train: fr-pass-comment.yml is marked `exempt` but a caller exists
(fr-pass-comment-caller.yml). The exemption is stale.

Verified against the live org, not taken on trust

$ gh api repos/tracebloc/claude-skills/contents/.github/workflows --jq '.[].name' | grep advance-deploy
advance-deploy-env.yml
$ gh api repos/tracebloc/release-train/contents/.github/workflows --jq '.[].name' | grep fr-pass
fr-pass-comment-caller.yml

Both callers exist. The inventory still claimed they were absent, with reasons ending UNREMEDIATED.

The change

Two entries promoted to required with the caller filename in the trailing comment — the remediation caller-drift.py prescribes in its own error text, and the convention every other tracked entry in this file already uses. Diff is 2 insertions, 4 deletions, nothing else touched.

repo-inventory.yml parses (checked with pyyaml; both entries read required), and scripts/tests/caller-drift-selftest.py is 197 pass / 0 fail. That suite is hermetic, so it proves the harness rather than this edit — the live audit check on this PR is the actual verification, and it is the check that was red.

One judgement call left for the reviewer

*advance_deploy_env_caller_missing is now an orphaned anchor — defined once, referenced zero times after this change. *fr_pass_comment_caller_missing still has one other user and stays needed.

I left the orphan in place deliberately rather than deleting it:

• an unreferenced YAML anchor is inert, and its text is only an assertion when referenced;
• deleting shared vocabulary is wider than the finding asks for;
• fix(2243): one branch→Status mapping — and it surfaced a column that does not exist #295 is open against adjacent logic in this area, and I would rather not create a conflict there.

Happy to drop it in a follow-up commit if you would rather the file carried no dead anchors.

Why this mattered

This is the exact failure mode #295 names as a Medium — "an exemption can outlive its reason while the check stays green" — except a different checker caught these, so they were loud instead of silent. They blocked .github's staging promotion at release while settle reported the repo ready, because settle polls the fr-gate and Bugbot threads and never looks at other required checks.

Worth noting separately: the same audit run reported 2 could not evaluate, i.e. two repos whose conformance is unknown. The headline error names only the drift, so that absence is quieter than the failure — probably worth its own look.

---

Note

Low Risk
Inventory-only contract update; no workflow or protection logic changes. The flips match existing callers, so the audit should go green rather than newly enforce missing workflows.

Overview
Fixes caller-drift audit failures where two inventory exemptions outlived their callers.

claude-skills now marks advance-deploy-env.yml as required (caller advance-deploy-env.yml exists). release-train now marks fr-pass-comment.yml as required (caller fr-pass-comment-caller.yml exists). The unused *advance_deploy_env_caller_missing anchor is left in place.

^{Reviewed by Cursor Bugbot for commit 8249726. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saadqbal]

@LukasWodka — could you approve this one when you get a chance? Small and load-bearing: it's what unblocks .github's staging promotion.

auditpasses on this PR (3m3s, green) — same check that was red on #292, now clean against the live org, which is the actual proof rather than the hermetic selftest. Both callers verified present with gh api before I touched the file; the inventory was claiming them absent with reasons ending UNREMEDIATED.

Diff is 2 insertions / 4 deletions — two entries promoted to required with the caller filename in the comment, which is the remediation caller-drift.py prescribes in its own error text.

One call left for you: *advance_deploy_env_caller_missing is now an orphaned anchor (defined once, referenced zero times). I left it rather than deleting it, partly to avoid conflicting with #295 in the same area. Say the word and I'll drop it.

Worth a look while you're here: the same audit run on #292 also reported 2 could not evaluate — two repos whose conformance is unknown — and the headline error names only the drift, so that absence reads quieter than the failure. Separate from this PR, but it's the shape #295's Medium is about.

[LukasWodka]

All three of your claims verify. I checked them independently rather than reading your evidence:

$ gh api repos/tracebloc/claude-skills/contents/.github/workflows --jq '...advance-deploy...'
advance-deploy-env.yml
$ gh api repos/tracebloc/release-train/contents/.github/workflows --jq '...fr-pass...'
fr-pass-comment-caller.yml

Both callers exist, both exemptions were stale, and the diff is exactly the 2/-4 you describe with the caller filename in the trailing comment matching the convention every other required entry uses. Nothing else touched.

Your judgement call: keep the orphan, but delete it after #295

I checked the anchor state directly — advance_deploy_env_caller_missing is now defined once, referenced zero times, and fr_pass_comment_caller_missing is defined once, referenced once, exactly as you said.

I agree with leaving it in this PR, and the conflict-avoidance reason is the one that decides it: #295 is open against adjacent logic in this same file, and a drive-by deletion buying a rebase is a bad trade for zero functional gain. Your call was right.

But I'd push back slightly on "an unreferenced YAML anchor is inert, and its text is only an assertion when referenced." It's inert to the parser. It is not inert as documentation, and here's what it now says:

advance_deploy_env_caller_missing: &advance_deploy_env_caller_missing >-no advance-deploy-env caller, so merges here never move a card to `On dev`. Measured absent2026-08-03. UNREMEDIATED.

That statement is now false — you just proved the caller exists — and it is sitting in the file under a name that invites reuse. The next person who needs an exemption for that caller reaches for the anchor whose name matches, and silently asserts a measured-absent claim from 2026-08-03 that no longer holds. That's not dead weight; it's a loaded one. Same family as the finding you just fixed: an exemption reason outliving its reason.

And nothing would catch it — I grepped scripts/caller-drift.py for any anchor/orphan/unreferenced handling and found none. So caller-drift.py audits exemptions that are referenced and is blind to a stale reason parked in the anchor block. Worth a follow-up beyond just deleting this one: an orphan check would be a few lines and would close the class rather than this instance.

So: keep it here, delete it (or add the orphan check) once #295 lands. Please don't drop it in a follow-up commit on this PR — that reopens the review for a cosmetic change on a diff that's currently minimal and obviously correct.

The observation I'd actually lift out of this PR

they blocked .github's staging promotion at release while settle reported the repo ready, because settle polls the fr-gate and Bugbot threads and never looks at other required checks.

That's a bigger finding than the two stale exemptions. A settle stage that reports ready on a repo whose required audit check is red is a gate that agrees with itself while disagreeing with the merge button — the promotion fails later and further along, where it's more expensive to diagnose. If that isn't already tracked somewhere I'd file it separately from #2243; it will outlive these two entries.

Not approving:audit and gate are both still pending on this head, and audit is the check these entries turned red — so it is the actual verification, exactly as you say. I'll approve next pass once it's green.

[LukasWodka]

Approving. audit and gate are both green on 82497269 — the same commit I reviewed, so nothing changed under the verdict — and audit is the check these two stale entries had turned red, which makes it the real verification rather than a proxy for one.

Everything from my comment stands and needs no action here: keep the orphaned advance_deploy_env_caller_missing anchor in this PR (the #295 conflict reason decides it), and pick it up afterwards along with the two things worth their own tickets — that caller-drift.py has no orphan detection at all, so a stale reason parked in the anchor block is invisible to it; and that settle reported this repo ready while a required check was red.

Gate: 13 pass, 1 skipping, MERGEABLE, zero unresolved threads.

[LukasWodka]

/fr-pass