fix(inventory): claude-skills' two callers are wired, so mark them required

[LukasWodka]

Summary

claude-skills gained code-quality-caller.yml and bugbot-gate-caller.yml today. The inventory still carried both as exempt, so caller-drift.py reported two stale exemptions and the conformance gate went red on the .github staging mirror (#334) — which is what is currently holding .github out of staging, and therefore out of main.

Measured

Both callers are present in tracebloc/claude-skills/.github/workflows:

bugbot-gate-caller.yml
code-quality-caller.yml

With these two rows flipped, the audit is clean:

No drift. Every repo read, every entry matched.

Why this keeps happening

Worth recording, because the fix is one line and the pattern is not.

The audit is not a function of the commit — it is a function of the commit and the live state of every repo in the org. The same sha 669971apassed the audit at 12:52:54 and failed it at 14:20:51 today, because two callers landed in a third repo in between. GitHub evaluates the newest run per context, so the later failure is what blocks the merge.

That is why .github has now missed five prod hops with a different finding each time:

hop	finding
1	release-train's customer-priority-bump caller
2	rfcs — two board callers
3	design-system-v2 absent from the inventory
4	rfcs — code-quality + protection.develop
5	claude-skills — these two

Every fix was correct. Every one was overtaken before the mirror could merge. These exemptions are not defects in anyone's work — they are the inventory lagging a fleet that changes daily, which is the cost of gating a promotion on live org state.

Not proposing a mechanism change here; this PR is the two rows. But the recurrence is worth a decision of its own, because the current shape means .github can only merge in a window where no other repo has changed since its audit ran.

Type

fix

Test plan

python3 scripts/caller-drift.py against the live org, before and after:

• before:2 drift finding(s) — both claude-skills
• after:No drift. Every repo read, every entry matched.

No behaviour change beyond the two rows; repo-inventory.yml parses under yaml.safe_load.

Checklist

• Targets develop
• One self-contained change (2 lines)
• Assignee set, one reviewer requested
• No secrets, tokens or customer data

---

Note

Low Risk
Inventory and documentation only; no application or CI workflow behavior changes beyond what the drift audit already enforces.

Overview
Updates repo-inventory.yml so claude-skills matches org reality after code-quality-caller.yml landed: code-quality.yml goes from exempt: *code_quality_caller_missing to required, which should clear caller-drift for that stale exemption and unblock the conformance gate on .github.

The same entry flips fr-gate.yml from required to exempt with a structural reason (no staging branch or promotion PRs, so an fr-gate caller is not applicable). That addresses audit noise from a required row when no caller exists in the repo.

claude-skillsprod protection comments are rewritten so empty required_checks is documented as a measured decision on a non-train working main, not as “quality contexts dropped because code-quality is absent.” The shared code_quality_caller_missing anchor prose is refreshed so only release-train still cites it and claude-skills appears in remediation history.

^{Reviewed by Cursor Bugbot for commit a4e978b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saadqbal]

The bugbot-gate.yml hunk is already in #333, which is open, approved and CLEAN. Same file, same line, same replacement — bugbot-gate.yml: required # bugbot-gate-caller.yml. Whichever merges second conflicts, and #333 is the better home for it because it also corrects the anchor text, which is precisely what Bugbot's second thread here is asking for. Dropping that hunk leaves this PR with its own unique contribution and no overlap.

The other thread is real, and I verified it rather than relaying it.claude-skills' prod cell still reads:

# `exempt: *code_quality_caller_missing` above. Requiring a context
# ... this cell drops them BECAUSE the producer is absent, not because the

(repo-inventory.yml:719-721.) Flip code-quality.yml to required and "the producer is absent" is false of that cell. The required_checks list may well still be correct — but the reason stops being, which is the same defect I reviewed on .github#332 a couple of hours ago for rfcs: the list was right and only its justification had rotted, and correcting it in the same PR was the whole point of that one.

So: keep the code-quality.yml flip, fix the prod cell's reasoning alongside it, and let #333 carry the bugbot half.

Two checks are still pending as well, so nothing was approvable regardless.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 68634f0. Configure here.}

[saadqbal]

Both of my asks are addressed — the bugbot-gate.yml hunk is gone, and the new reasoning is right where the old one self-contradicted: once code-quality.yml flips to required, "the producer is absent" can't also be why the contexts are dropped. Keeping the client#665 lesson as an ordering rule rather than deleting it is the better save, and calling out that release-train keeps the original wording correctly stops the next person from "fixing" that one too.

One thing you should know rather than change: I can't reproduce the load-bearing measurement. GET /repos/tracebloc/claude-skills/branches/main/protection 404s for me — and it also 404s for .github/develop, which is certainly protected, so that's my token (maintain, not admin), not an absence. Dated + attributed is the right form for a claim like that; just be aware only an admin can re-check it.

Not approving yet: audit, gate, selftests and Bugbot are still pending. I'll pick it up next pass once they land.

[saadqbal]

Content's right, and I checked the counts rather than taking them: unanchored grep returns 3, anchored returns 1, and the one surviving alias at repo-inventory.yml:1225 is release-train's — which does have no code-quality caller (no matching workflow in my checkout). The two remaining hits are the comment mentions at 730 and 1205.

Bugbot's catch is the good one here, and your response is better than the fix: "a count in prose is falsified by the next flip, every time" is the general rule, and it's the same lesson as the anchored grep one layer out. Leaving release-train's original "BECAUSE the producer is absent" wording in place at 1205 is correct and now explicitly justified.

The red is not you.audit failed on HTTP 403 — API rate limit exceeded for user ID 54042461 — across seventeen repos: "0 clean, 1 drift, 2 could not evaluate". Failing closed on an unevaluable audit is the right design, so there's nothing to fix in the workflow either. gate is purely downstream of it (caller-drift.yml concluded 'failure'). Re-run both once that token's budget recovers and they should go green; my own budget is 4988/5000, so it isn't org-wide.

For the record: every finding I raised on this PR is cleared — the duplicate bugbot-gate.yml hunk, the self-contradicting cell reason, and now the anchor counts. My earlier change-request is still the standing decision only because I can't lift it without approving, and I won't approve over two red checks. Nothing is outstanding from me; ping me when the audit is green and I'll stamp it.

[saadqbal]

Evidence for the re-run, so you don't go digging: caller-drift.ymlsucceeded at 15:40 on 68634f00 and failed at 15:49 on a4d49e23. Same workflow, nine minutes apart, and the only difference in the failing run is the 403s. Just re-run it.

[saadqbal]

Green now, and the fr-gate flip is right. Verified claude-skills has no fr-gate-caller.yml and no staging branch — only develop, main and feature branches — so there is genuinely nothing for the gate to report on.

One thing worth fixing in the reason, because it's the difference between a decision and a symptom. It says the audit "began reporting ... mid-review, and the caller is genuinely absent" — which reads as though the absence were discovered. It wasn't: claude-skills#38removed the caller deliberately on 2026-08-25 as backend#2347's remainder, and its PR body names this exact row:

repo-inventory.yml records claude-skills -> fr-gate.yml: required # fr-gate-caller.yml. With the caller gone that row must flip to exempt

So this commit is the follow-up #38 asked for, and citing it says so. That also retires the "if the caller was removed by mistake, restore it and flip this back" branch — it wasn't a mistake, and the next reader shouldn't have to work that out from the audit log.

Everything else checks out: 3 unanchored / 1 anchored on the code-quality grep, the surviving alias is release-train's, and release-train really has no code-quality caller. Approving — fold the citation in whenever, it doesn't need another round.