fix(inventory): rfcs' two board callers are wired, so mark them required

[LukasWodka]

Summary

repo-inventory.yml marked two reusables as exempt under rfcs while both callers
actually exist. caller-drift reports it as 2 stale-exemption findings, and that
fails conformance-gate — a required status check on develop — which is what is
blocking #318, the staging → main promotion.

Both entries flip to required. No check logic changed.

Why this is data, not a judgement call

Both exemptions were written as explicitly STAGED, with the flip condition spelled
out in the file: flip

once rfcs#41 has reached rfcs' DEFAULT branch, which is main

That condition is met:

claim	how it was checked	result
caller 1 on rfcs' audited branch	gh api repos/tracebloc/rfcs/contents/.github/workflows/advance-deploy-env.yml	present on main, uses: …/advance-deploy-env.yml@main
caller 2 on rfcs' audited branch	same, kanban-closure-routing.yml	present on main, uses: …/kanban-closure-router.yml@main
audited branch is main	release_train: false + audit_branch: develop-first-on-train → default branch; audit prints rfcs @ main	confirmed
rfcs#41 is the referenced PR	gh pr view 41 --repo tracebloc/rfcs	MERGED to develop 2026-08-23; adds both callers + .kanban.yml
how it reached main	gh api …/commits?sha=main&path=…	rfcs#45, "reconcile develop into main", 2026-08-24

Worth noting for the record: rfcs#41 itself merged to develop, not main. The
flip condition is about the caller reaching main, and rfcs#45 is what carried it. The
condition is satisfied; the PR number that satisfied it is not the one named.

Filename mismatch is expected, not a second bug

The caller in rfcs is named kanban-closure-routing.yml, while the reusable — and so
the inventory key — is kanban-closure-router.yml. That is why the entry reads
required # kanban-closure-routing.yml: the trailing comment records the local
filename. caller-drift.py's own rule #2 is "MATCH ON uses: CONTENT, NEVER ON
FILENAME", so the key stays the reusable and the match is derived from each repo's
parsed uses: values. start-training already records this exact pair the same way.

Anchor cleanup, as the note instructed

kanban_closure_router_caller_missing was defined once and cited once — here. Flipping
would leave it defined and uncited, and no check flags an orphaned YAML anchor, so the
definition is deleted in the same commit.

Both staging notes are deleted rather than reworded, per their own clause that a
sequencing note outliving its landing "has stopped being a sequencing note and become a
written excuse … a defect then, not a justification" — following the
stale_backlog_migration_in_flight precedent (#293).

Why a one-line flip is worth a careful PR

#318 is the hop that carries #313 / backend#2348 — "a bug-labelled issue lands in
Ready, not Backlog" — to main. Verified: #313 merged to develop 2026-08-23 and
is present on develop and staging, but 404 on main. Every repo's caller pins
@main, so until #318 lands the rule is not live anywhere: bug-labelled issues keep
landing in Backlog instead of Ready, which is not the queue anyone pulls from.

Measured on the board just now — of the ten work-type:bug issues opened in backend
on 2026-08-24, eight are sitting in Backlog: #2452, #2443, #2441, #2439, #2438,
#2436, #2428, #2419. (The two in Ready, #2429 and #2426, were put there by something
other than this rule.) #2404 from 2026-08-23 is in Backlog too.

So this unblocks a required check that is holding a behavioural fix out of production.

Verification

Full fleet audit against the live org, before and after:

• Before (release-train: staging -> main #318 head, run 32728798718): CODE=1, FINDINGS_TOTAL=2, both on rfcs, verbatim —
  • rfcs: advance-deploy-env.yml is marked exempt but a caller exists (advance-deploy-env.yml)
  • rfcs: kanban-closure-router.yml is marked exempt but a caller exists (kanban-closure-routing.yml)
• After (make audit, this branch): exit 0 — "No drift. Every repo read, every entry matched." 19 of 19 repos read, rfcs row all-OK.

These were the only two findings across all 19 repos, so this closes the whole
class, not one instance of it. Nothing else is exempt-but-present or required-but-absent.

Local, at CI severity:

check	result
python3 -c "import yaml…"	parses; both entries read required
make selftests	exit 0 — every suite 0 failed (incl. caller-drift-selftest)
make lint	exit 0
make mutations	exit 0 — 36 mutations, 0 stale, 0 uncaught
make audit	exit 0, no drift

Mutation proof of this change. Reverted rfcs.advance-deploy-env.yml to exempt:
the audit went red with exactly one finding naming that entry, then restored
byte-identical (diff -q) and green again.

One thing that is itself worth reporting: the first mutation attempt anchored on the
bare line advance-deploy-env.yml: required # advance-deploy-env.yml, which occurs
18 times in this file. The occurrences-must-be-1 assertion caught it and refused to
write, so the mutation was re-anchored to be rfcs-scoped. An unguarded
search-and-replace there would have silently mutated a different repo's entry and
produced a passing-looking result about the wrong row.

Ran in a dedicated worktree — the mutation harnesses edit tracked files in place
(backend#2441), so two concurrent make runs in one checkout corrupt each other.

🤖 Generated with Claude Code

---

Note

Low Risk
Data-only inventory update that matches already-present callers; no auth, workflow, or checker logic changes. Wrong flips would redden caller-drift, which is the intended guard.

Overview
Aligns repo-inventory.yml with callers that already exist on rfcs main, so caller-drift stops reporting two stale exemptions and conformance-gate can go green.

advance-deploy-env.yml and kanban-closure-router.yml under rfcs flip from STAGED exempt to required. The local closure workflow is still named kanban-closure-routing.yml; the inventory key stays the reusable because matching is on uses:.

Deletes the now-uncited kanban_closure_router_caller_missing anchor and the sequencing notes that said to flip once rfcs#41 reached default main (carried there by rfcs#45). No checker or workflow logic changes.

^{Reviewed by Cursor Bugbot for commit cf1d66d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saqlainsyed007]

Approving — clean, data-only inventory flip, and the diff matches the claims.

Verified:

• Anchor deletion is safe. kanban_closure_router_caller_missing was cited exactly once (the kanban-closure-router.yml entry this PR flips), so deleting the definition leaves no dangling alias — and the YAML-parse + make audit in CI are green, which is the actual proof.
• The flips are correct, not a judgement call. Both rfcs reusables (advance-deploy-env.yml, kanban-closure-router.yml) move exempt→required because both callers now exist on rfcs@main — the branch the audit reads for a release_train: false repo. The audit going green with the flip is the confirmation; a premature flip would have reddened caller-drift.
• Filename mismatch is handled right. The key stays the reusable (kanban-closure-router.yml) with the local caller name (kanban-closure-routing.yml) in the trailing comment, consistent with caller-drift's match-on-uses: rule and the start-training precedent.
• No check logic changed; the staging notes are deleted per their own outlived-sequencing clause.

Green gate satisfied (CI all pass, Bugbot pass, no open threads, mergeable). This unblocks the conformance-gate required check on promotion #318. LGTM.

[shujaatTracebloc]

Approving. This PR is entirely a claim about the state of another repo, so I re-derived the claims rather than reading the table, and every one holds:

claim	independently checked	result
rfcs' audited branch is main	gh api repos/tracebloc/rfcs -q .default_branch	main
caller 1 on main	contents API @ ref=main	present, uses: …/advance-deploy-env.yml@main
caller 2 on main	contents API @ ref=main	present, uses: …/kanban-closure-router.yml@main
rfcs#45 carried them to main	gh pr view 45 --repo tracebloc/rfcs	MERGED to main 2026-08-24
rfcs#41 merged to develop, not main	gh pr view 41	MERGED to develop 2026-08-23 — as the body says

The filename mismatch is a non-issue and the body's reason for it is the right one. caller-drift.py's rule #2 reads "MATCH ON uses: CONTENT, NEVER ON FILENAME," and collect_uses walks the parsed YAML for uses: values — so keying the entry on the reusable while the trailing comment records the local kanban-closure-routing.yml is exactly the convention, and the other nineteen repos in the file record the same pair the same way.

The anchor cleanup is the part I most wanted to check, and it's correct. Deleting kanban_closure_router_caller_missing's definition while a live *alias still referenced it would be a hard YAML parse error, not a lint. On cf1d66d8 the only surviving occurrence of that name is inside a comment, and the file parses clean — I loaded it with yaml.safe_load to be sure rather than trusting the grep.

Two things worth naming, because they're the reason this reviews quickly:

• The deleted note enforced its own expiry. It said that if it outlived rfcs#41 reaching main it had "stopped being a sequencing note and become a written excuse — treat it as a defect then, not a justification." Deleting it rather than restating it is the note being honoured, and it follows the precedent it named (stale_backlog_migration_in_flight, .github#293). A staged exemption that can't expire is just a permanent one with better manners.
• Flagging that rfcs#41 isn't the PR that satisfied its own flip condition. That's a small imprecision the author could have papered over silently, and surfacing it is what let me check the right thing.

Gate: all checks SUCCESS (audit, gate, selftest, selftests, actionlint, Bugbot) with quality / format skipped; no unresolved threads; MERGEABLE. Nothing outstanding from me.