fix(repo-inventory): record design-system-v2's armed protection and client-runtime's strict develop as measured

[LukasWodka]

Summary

Reconciles repo-inventory.yml with the protection state measured on 2026-09-08. Caller-drift run 34232408109 reported 8 findings; 6 were inventory-side (the inventory still described design-system-v2 as fully unarmed, and client-runtime develop as fleet-default strict). Every cell below was checked against what evaluate_protection / evaluate_rulesets actually assert before it was changed - two rows were deliberately NOT promoted, see below.

Local audit against the live fleet (this branch): 8 findings -> 4. All 20 repos read, none unreadable.

Rows changed, with the measured evidence

Repo / cell	Before	After	Evidence (2026-09-08)
design-system-v2 protection.develop	exempt ("carries NO protection of either kind")	divergent - required_checks = the repo's four suites	branches/develop/protection 200: 1 review, dismiss_stale_reviews true, no bypass allowances, allow_force_pushes/allow_deletions false, required_conversation_resolution true, strict false. rules/branches/develop = []. Required contexts: Unit tests (Vitest), Lint (ESLint), Type check, Format (Prettier), set-status / closing-ref - none of the three fleet quality / * gates, so required would produce a new real finding. All three quality gates run and passed on the last merged PR (design-system-v2#306, head 38ee4e84), so arming them is a branch setting, not caller work. set-status / closing-ref is required today but not asserted (advisory by design since .github#434; required_checks is a floor).
design-system-v2 rulesets.promotion_merge_commit_only	exempt ("ZERO rulesets")	required	Ruleset 22171656 promotion-branches-merge-commit-only, created 2026-09-03T08:26:29+02:00, enforcement: active, target branch, one pull_request rule with allowed_merge_methods: ["merge"], includes refs/heads/main + refs/heads/staging, bypass_actors: []. Matches every policy property.
design-system-v2 rulesets.tag_trust_root	exempt ("ZERO rulesets")	required	Ruleset 22171688 Protect v* release tags (supply-chain trust root), created 2026-09-03T08:26:58+02:00, active, target tag, rules creation/update/deletion, includes refs/tags/v*, bypass exactly OrganizationAdmin + Team:18304481 (release-managers). Matches the policy allowlist exactly.
design-system-v2 protection.staging	exempt ("NO protection of either kind")	stays exempt, reason rewritten to the measured state	branches/staging/protection -> 404 Branch not protected; rules/branches/staging -> only ruleset 22171656 (0 required reviews, no thread resolution, no deletion rule, no required checks, no train bypass).
design-system-v2 protection.prod	exempt ("NO protection of either kind")	stays exempt, reason rewritten to the measured state	branches/main/protection -> 404 Branch not protected; rules/branches/main -> only ruleset 22171656, same shape as staging.
client-runtime protection.develop	required	divergent - strict: true	required_status_checks.strict: true (set 2026-09-04 after two same-day green-onto-green breaks on this repo: client-runtime#503 merged onto client-runtime#498, client-runtime#500 onto client-runtime#497). Every other key matches the develop baseline: 1 review, no bypass, force-push/deletion blocked, conversation resolution on, quality / gitleaks, quality / house-rules, quality / action-pins + pytest, quality / ruff, quality / shellcheck, Schema drift check required. The fleet default stays strict: false (decision 2 of the protection policy); this is a per-repo override on this repo's own incident, following the existing divergent pattern.

Why design-system-v2 staging and prod were NOT promoted

required on either branch would fail classic_protection, min_reviews (0 < 1), bypass_reviews (train bypass missing), block_deletions (a pull_request rule does not block deletion), require_conversation_resolution and required_checks (nothing required) - and on main also enforce_admins. divergent cannot help: classic_protection and block_deletions are not in OVERRIDABLE by design. There is no cell shape that reads green over a ruleset-only promotion branch, and there should not be one - a branch the train promotes through with zero required checks and zero required reviews is a gap.

So both rows stay exempt with the measured state written down, and the audit will keep reporting them as stale exemptions. That finding is correct. It clears the moment an admin applies the fleet staging/prod classic shape to design-system-v2 staging and main (1 review, App:tracebloc-release-train review bypass, gate / gate + the three quality / * gates required, force-push/deletion blocked, conversation resolution, enforce_admins on main) - then both cells flip to required in the same hop. This needs a decision + an org admin; it is not fixable from this file.

The 4 findings that remain after this PR

1. design-system-v2 protection.staging - stale exemption (see above; needs classic protection armed).
2. design-system-v2 protection.prod - stale exemption (same).
3. .github staging does not REQUIRE selftests - live setting, the inventory already asserts it correctly; an org admin has to add the context.
4. rfcs main conversation resolution=True, policy (divergent cell) wants False - live setting; either flip the branch setting or re-decide the cell. Not touched here.

Consequence: conformance-gate on this PR stays red until (1)-(4) are resolved live, because it requires the audit to pass on this exact head. That is the gate working as designed; this PR is a draft for that reason.

Related

Reconciles the inventory-side half of caller-drift run 34232408109. No ticket is closed by this PR.

Type of change

• Tech-debt / refactor
• Feature
• Bug fix
• Docs
• Security / hardening
• Breaking change

Test plan

• python3 -c "import yaml; yaml.safe_load(open('repo-inventory.yml'))" - clean.
• make selftest-caller-drift - pass=197 fail=0.
• python3 scripts/reason-citations.py (live) - 37 citations across 131 reasons, 0 findings. New reasons cite only open issues or merged PRs; PR citations are written owner-qualified (client-runtime#498, not #498, which would resolve against this repo).
• make house-rules - no findings.
• python3 scripts/caller-drift.py --inventory repo-inventory.yml --source-dir . against the live fleet - exit 1 with 4 findings (listed above), down from 8; client-runtime and both design-system-v2 ruleset cells now read OK in the matrix.
• Live API reads used as evidence are quoted in the table; nothing was written to any repo setting.

Checklist

• Sibling check - every exempt protection/ruleset row for design-system-v2 was re-measured (5 rows); no other repo's protection rows were reported by the audit. grep -n "measured 2026-08-27" repo-inventory.yml now returns nothing for this repo's cells.
• Tests added / updated and passing locally (selftest + live audit, see above)
• Docs updated if behavior or config changed (the inventory IS the doc; block comments rewritten)
• No secrets / credentials in the diff
• For security-sensitive paths: appropriate reviewer requested
• Nothing depends on another repo's change

---

Note

Low Risk
YAML inventory and audit-contract documentation only; no application or workflow logic changes, though conformance-gate may stay red until unrelated live branch settings are fixed.

Overview
Brings repo-inventory.yml in line with 2026-09-08 live measurements so caller-drift stops flagging inventory cells that still described August’s “fully unarmed” state.

For design-system-v2, protection.develop moves from exempt to divergent, documenting classic protection plus repo Vitest/ESLint/type/format checks instead of the fleet quality / * gates (still owed on the branch). Both ruleset rows flip exempt → required now that promotion merge-commit-only and v* tag trust rulesets exist and match policy. staging and main stay exempt with rewritten reasons: ruleset-only today, classic fleet shape still UNREMEDIATED—the guard will keep reporting those as stale exemptions until an org admin arms the branches.

For client-runtime, protection.develop changes from required to divergent with strict: true, recording the 2026-09-04 per-repo override after same-day green-on-stale-base merges; fleet default remains strict: false.

Block comments document why staging/prod were not promoted and which audit findings remain (four total after this PR).

^{Reviewed by Cursor Bugbot for commit e2d5b1a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e2d5b1a. Configure here.}