fix(2243): two orphaned exemption anchors and a count that was never true

[saadqbal]

Finishes the cleanup #298 deliberately left for
the reviewer to decide on. Bugbot decided it on the staging mirror
(#292), where the two findings are what is
holding the promotion. Both are real; both counted rather than trusted.

Same defect in two shapes: anchor prose, or an anchor's lifetime, drifting out of step with the
aliases that use it.

Finding 1 (Medium) — orphaned advance_deploy_env_caller_missing

0 aliases. #298 flipped claude-skills to required and left the definition behind. Verified
against the live org rather than the report: gh api repos/tracebloc/claude-skills/contents/.github/workflows lists advance-deploy-env.yml.
Definition removed.

Finding 2 (Low) — fr_pass_comment_caller_missing said "5 repos"

It has one citation, claude-skills. The finding's arithmetic is right about the result and
wrong about the premise: the anchor has only ever been aliased twice, so the 5 was never its
reach.

revision	date	aliases
cd640e8 (the anchor's birth commit)	2026-08-03	2
8a516f2 (just before #298)	2026-08-21	2
5b074b7 (#298)	2026-08-21	1

5 was the org-wide sweep's count of repos lacking the caller, worn in a sentence that reads
as the anchor's citation list. The new text separates the two, and re-measures the one remaining
citation instead of inheriting a date: no fr-pass-comment caller in claude-skills as of
2026-08-21. Then it points at grep -n '\*fr_pass_comment_caller_missing', which is what
code_quality_caller_missing above already learned to do after the same drift.

rfcs' inline reason cross-referenced "the fr_pass_comment_caller_missingrepos" in the
plural. It names the one repo now — the same statement, no longer false.

What the sweep turned up

Every &anchor in the block, against its real alias set:

anchor	aliases	prose count claim	verdict
advance_deploy_env_caller_missing	0	—	orphan, removed (finding 1)
set_pr_status_caller_missing	0	—	orphan, removed (new)
fr_pass_comment_caller_missing	1 (claude-skills)	"5 repos"	corrected (finding 2)
code_quality_caller_missing	3 (claude-skills, release-train, rfcs)	"THREE … " + names them	accurate
not_a_pipeline_prod_branch	3 (same three)	names the same three	accurate
the other 11	1–19	no count asserted	accurate

set_pr_status_caller_missing is a third instance, found by sweeping. It has 0 aliases and
never had one — git log -S'*set_pr_status_caller_missing' -- repo-inventory.yml is empty
back to cd640e8, the commit that defined it. That makes it worse than orphaned: it asserts an
UNREMEDIATED gap that is false in every repo, because set-pr-status.yml is required in all
19 entries. Removed as the same class, in the same PR.

Reported, not fixed

The block header says the anchors are "Reasons cited by more than one repo". Six are now cited
by exactly one (fr_pass_comment, kanban_closure_router, no_staging_branch_no_hop_to_gate,
develop_unprotected_non_train, stale_backlog_not_a_backlog,
stale_backlog_exemption_needs_redeciding). Same family of drift, but reconciling it means
either inlining six reasons or softening the block's stated design — a decision, not a count fix.
Left for whoever wants to take it.

For #295 — mechanical detection, described not implemented

#295 carries a Medium making exactly this point
("an exemption can outlive its reason while the check stays green"). One cheap detector, and one
reason it has to be built a particular way:

caller-drift.py cannot see this defect at all today, and not for want of a check. PyYAML
resolves aliases during parsing, so by the time the script has a dict there are no anchors and no
aliases left — only N equal strings. The orphan is invisible in the parsed structure by
construction. A detector has to make one raw-text pass over the file, before or beside the
parse:

text=open(inventory).read()
defined=set(re.findall(r'^\s*\w+:\s*&(\w+)', text, re.M))
aliased=set(re.findall(r':\s*\*(\w+)\s*$', text, re.M))
orphans=defined-aliased# a name nothing citesdangling=aliased-defined# already a YAML error, but assert it anyway

Two properties worth having beyond the finding itself:

• The alias regex must be anchored to end-of-line (\*(\w+)\s*$), or prose that names an
  anchor with a \* — which this file does deliberately, twice, and now three times — counts as
  a citation and an orphan hides behind its own documentation.
• Assert the count, not just emptiness. The stale-prose half of this defect (finding 2) is
  not detectable from the file alone; it needs the anchor to state its reach in a machine-readable
  way. The cheap version: forbid a bare integer or number-word in a shared_reasons value unless
  it matches that anchor's alias count. That is opinionated enough to belong in a reviewed PR
  rather than smuggled in here.

Naturally suited to the selftest tier — no token, no network, one file.

Verification

• YAML, parsed in a scratch venv (pyyaml is not installable system-wide here, PEP-668):
  16 shared_reasons, 0 orphans asserted post-parse on resolved values; claude-skills is the
  sole citation of fr_pass_comment_caller_missing; set-pr-status.yml is required in 19/19.
• Structural diff of the parsed tree vs origin/develop: exactly two leaf changes —
  claude-skills.callers.fr-pass-comment.yml.exempt and
  rfcs.callers.fr-pass-comment.yml.exempt — with every other top-level key byte-identical. The
  two anchor removals are provably inert; no repo's policy moved.
• make check green (PYTHON pointed at the venv, so guard-pyyaml passed rather than being
  skipped): ruff clean, shellcheck clean, house-rules 0 findings, mint-scope 14 mints / no
  findings, actionlint 0 findings, selftests-cover 11/11 + 1 mutation runner, all 11 selftests
  pass. caller-drift-selftest.py: 197 pass / 0 fail, unchanged from baseline.
• make audit against the live org: zero caller or exemption findings. It exits 2 on 16
  ruleset reads where this token cannot see bypass_actors, plus the known public-repo protection
  divergences — pre-existing, token scope, untouched by this diff.

Rolls up under backend#2243 per CLAUDE.md — a Bugbot drive-by inside an already-tracked task,
so no new ticket and no card moved.

🤖 Generated with Claude Code

---

Note

Low Risk
Inventory comment/anchor cleanup only; parsed policy is unchanged except wording on two exemption strings. No auth, callers, or protection posture changes.

Overview
Cleans shared_reasons in repo-inventory.yml so exemption anchors match their real aliases. No repo policy flips: set-pr-status.yml stays required everywhere.

Removes unused advance_deploy_env_caller_missing and set_pr_status_caller_missing (zero aliases; the latter never had one). Rewrites fr_pass_comment_caller_missing to name its one remaining citation (claude-skills) instead of an org-wide “5 repos” count, and points reviewers at grep rather than the prose. rfcs’s inline fr-pass reason now names that single repo instead of a plural “repos” list.

^{Reviewed by Cursor Bugbot for commit d4d2820. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

This is the right way to finish #298, and the part I want to single out is that you corrected the finding's premise while accepting its conclusion:

The finding's arithmetic is right about the result and wrong about the premise: the anchor has only ever been aliased twice, so the 5 was never its reach.

That distinction is the whole difference between fixing a number and understanding why it was wrong. "5" was the org-wide sweep's count wearing a sentence that reads as the anchor's citation list — so the old text wasn't stale arithmetic, it was a category error, and only the second diagnosis tells you the class of bug to look for elsewhere. Right about the smell, wrong about the mechanism is exactly the trap this repo has been bitten by before.

I verified the counts myself rather than trusting the table:

anchor	on develop	on this branch
advance_deploy_env_caller_missing	defined 1, aliases 0	removed
set_pr_status_caller_missing	defined 1, aliases 0	removed
fr_pass_comment_caller_missing	defined 1, aliases 1	kept, prose corrected

Both orphans confirmed at zero. And set_pr_status_caller_missing was not in the Bugbot finding — your own sweep of every &anchor against its real alias set found it. Sweeping the class rather than fixing the two reported instances is the difference between closing a finding and closing the hole.

Your birth-commit claim also checks out: git show cd640e8:repo-inventory.yml | grep -c '\*fr_pass_comment_caller_missing' → 2. Never five.

One real problem: the grep you tell readers to trust over-counts

Both corrected anchors now end with a variant of:

trust grep -n '\*fr_pass_comment_caller_missing' over this sentence.

That instruction is itself matched by that grep. On this branch:

391: `grep -n '\*fr_pass_comment_caller_missing'` over this sentence. <- the instruction
676: exempt: *fr_pass_comment_caller_missing <- the only real alias

So a reader who follows the instruction literally counts 2 and concludes there are two citations. Your prose says one, and one is correct — but the mechanism you point them at disagrees with you.

It's worse on the anchor you cite as precedent. code_quality_caller_missing:

total matches: 7
real aliases (exempt: *anchor): 3
- 1 is the "trust the grep" instruction (:376)
- 3 are comments *referring* to the alias (:655, :1111, :1186)

7 vs 3. The count that replaced a drifting hand-written number over-counts by more than 2×, and it will drift further every time someone adds a comment mentioning the anchor. That's the same defect one level up: a claim that should be a machine check, made as prose pointing at a check that doesn't measure what it says.

Cheapest fix is to make the instruction match the alias form rather than the name:

grep -nE "^\s+exempt: \*fr_pass_comment_caller_missing"

That returns 1 here and 3 for code_quality_caller_missing — the real counts. Better still, this is the second time in two PRs that caller-drift.py's blindness to the anchor block has cost something: it has no orphan detection (my note on #298) and no alias-count check either. Both are a few lines against a parsed YAML, and either would make "an anchor cannot state its own reach" enforced instead of asserted.

Not blocking — the diff is correct, the removals are right, and the prose is a strict improvement on what it replaces. But I'd fix the grep expression in this PR while it's open, since the whole point of that sentence is to be the thing a reader relies on instead of the sentence.

Not approving yet:audit and gate are both pending, and audit is the check these findings are holding on the mirror. I'll approve next pass once it's green.

[LukasWodka]

Approving. All checks green on d4d2820b — the same commit my comment was on — including audit and gate, which are the checks these findings were holding on the mirror. 13 pass, 1 skipping, MERGEABLE, zero unresolved threads.

I said the grep finding was not blocking and I'm holding to that: the diff is correct, both orphan removals are verified at zero aliases, and the corrected prose is a strict improvement on what it replaces. Landing it is better than holding it.

But the finding is unaddressed on this head, so recording it plainly so it doesn't evaporate with the merge:

Both corrected anchors still end with trust grep -n '*' over this sentence, and that instruction is matched by its own grep. Measured on this branch:

• fr_pass_comment_caller_missing — 2 matches, 1 real alias (:391 is the instruction, :676 the alias)
• code_quality_caller_missing — 7 matches, 3 real aliases (:376 instruction, :655/:1111/:1186 comments about the alias)

So the mechanism that replaced a drifting hand-written count over-counts by more than 2× on the anchor cited as precedent, and drifts further with each new comment mentioning it. grep -nE "^\s+exempt: \*<anchor>" returns the true counts.

Worth a follow-up rather than a re-roll here — and the better version is in caller-drift.py, which now has two demonstrated blind spots from two consecutive PRs: no orphan detection (#298) and no alias-count check (this one). Both are a few lines against the parsed YAML, and either turns "an anchor cannot state its own reach" from a sentence into a check.

[LukasWodka]

/fr-pass