ci(2284): the gate has its first caller, so the row and the anchor say so

[LukasWodka]

Refs tracebloc/backend#2284

Why now

claude-skills#36 merged at 13:46 — the first bugbot-gate caller anywhere in the org, from the backend#2284 pilot. That immediately makes two things false:

1. claude-skills' row. A caller present against an exempt entry is the stale-exemption finding (caller-drift.py:2309). Flipped to required # bugbot-gate-caller.yml.
2. The anchor's own text.bugbot_gate_rollout_pending asserted "bugbot-gate has ZERO callers anywhere in the org" — true when written 2026-08-23, false from 13:46. The reason rotted the moment the thing it described changed, which is exactly backend#2449's shape.

The anchor stays — 19 repos still cite it and it is still accurate for them.

The derivation is anchored deliberately

The replacement instruction reads:

grep -nE '^\s*exempt: \*bugbot_gate_rollout_pending\s*' repo-inventory.yml

not the bare identifier — because the bare identifier also matches the paragraph describing it, so an unanchored grep would count its own documentation. That is backend#2507, filed today after the same defect was caught by hand five times.

Scope

One row, one anchor paragraph. No branch protection is changed and bugbot / review is NOT required anywhere — the pilot's recommendation was explicitly proceed as advice, do not go required until the Dependabot question is settled (Bugbot does not review Dependabot PRs, so a required context would leave them permanently red with no route to green).

---

Note

Low Risk
Documentation and inventory contract updates in repo-inventory.yml; no CI wiring or branch protection changes.

Overview
After claude-skills landed the org’s first bugbot-gate caller (claude-skills#36, backend#2284 pilot), this PR fixes caller-drift inventory drift: claude-skills’s bugbot-gate.yml entry flips from exempt: *bugbot_gate_rollout_pending to required with bugbot-gate-caller.yml, so a present caller is no longer recorded as rollout-pending.

The shared bugbot_gate_rollout_pending anchor stays for the other repos still exempt, but its prose is updated—it no longer claims zero callers org-wide—and it now tells readers to re-derive who still cites the anchor with an anchored grep (backend#2507), avoiding a bare identifier match on the paragraph itself.

No branch protection changes and bugbot / review is not made required anywhere; inventory contract only.

^{Reviewed by Cursor Bugbot for commit aabdac4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saadqbal]

Green — 14 pass, nothing pending, no open threads. Approving.

I have direct lineage on this one: the caller that made the row false is the one I approved on claude-skills#36, and bugbot-gate-caller.yml is on claude-skills' default branch at blob 2a207ea2 — the same blob from that diff. So the flip to required # bugbot-gate-caller.yml describes something that actually exists.

And the anchored derivation is measured, not asserted. Ran both against this head: the prescribed ^\s*exempt: \*bugbot_gate_rollout_pending\s*$ returns 19, the bare identifier returns 21. The two extra are the anchor's definition line and the instruction line inside the anchor itself, so the warning about a grep counting its own documentation is exactly right, and the anchored form excludes both. Worth noting it does not match the line that documents it either — the first hits are real exempt: rows.

Correcting the anchor rather than deleting it is the right call at 19 remaining citations, and rewriting it as "had ZERO callers when this was written… THAT IS NO LONGER TRUE" keeps the history that explains why the exemption exists at all.

Staying advisory until the Dependabot question is settled is the part I'd have argued for if it weren't already here — Bugbot doesn't review Dependabot PRs, so a required context would park them red with no route to green, which is client#665 with a different name.