umbrella(guards): 85 enumerating files outside repo_tests/ are covered by no reach check — 5 verified instances #17400

Parent: #15826.

#15826's meta-guard was built — repo_tests/guard_reach_meta_test.py fails when a new tree-scanning guard arrives with no floor, carries a shrink-only GRANDFATHERED list mirrored against _GRANDFATHERED_BASELINE, and proves itself with a planted unfloored guard. That half is done and is not what this issue is about.

What this issue is about is the boundary that guard states about itself, in its own docstring:

• Only repo_tests/. 301 tracked .py files repo-wide carry an enumerator — 13 in scripts/, 32 in tools/, 8 in pipeline-scripts/, 32 under autobot-infrastructure/. Those are out of scope here and are not covered by any equivalent check.

That is a correctly declared gap, not a hidden one — and it is still a gap. 85 enumerating files across four directories are covered by no reach check at all, and those directories hold the guards that actually run in pre-commit and CI.

Verified instances

Five guards outside repo_tests/ were read in full and confirmed to render "I could not look" as "I looked and it is clean". Each is a child of this issue.

These are instances, not the disease. The disease is that nothing would have caught any of them, because no check examines that population.

What to build

• Extend the meta-guard's population beyond repo_tests/ to scripts/, tools/ and pipeline-scripts/, grandfathering the existing unfloored guards in a shrink-only list that fails in both directions, exactly as GRANDFATHERED/_GRANDFATHERED_BASELINE already do.
• Decide autobot-infrastructure/ (32 files) explicitly — in scope with its own wave, or excluded with the reason recorded in the guard, never left ambiguous.
• Prove the extension against a planted unfloored guard in each newly covered directory, the way planted_unfloored_guard_test.py already proves the repo_tests/ half. A meta-guard that cannot fail on the thing it exists for is the defect it is checking for.
• Route the hand-rolled enumerators through tools/lint/_scan_helpers.py:tracked_paths, which already raises EmptyEnumeration rather than returning []. Known call sites: scripts/check_nosec_format.py:107, scripts/check_script_exec_bits.py:99, scripts/check_python_file_size.py:176, scripts/check_shell_file_size.py:145. This is the cheapest systemic fix — it converts each empty-scan hole into a raise for free.
• Each child below closed with its own evidence.

Relationship to #14896

#14896 proposed tracked_paths for the 35-checker harness and measured "33 of 35 checkers treat an empty scan as a clean scan" on 2026-08-22. tracked_paths now exists (tools/lint/_scan_helpers.py:200-204); the migration of call sites did not follow. #14896 owns the harness consolidation; this issue owns making coverage non-optional and the five verified instances. They should be sequenced, not merged — but they touch overlapping files, so one agent should hold both.

Acceptance criteria

• A new tree-scanning guard added under scripts/, tools/ or pipeline-scripts/ with no reach floor fails CI.
• The grandfather list for the newly covered directories fails in both directions — an unrecorded shrink is as much a defect as growth.
• The extension is proved by a planted unfloored guard per newly covered directory.
• All five child issues are closed with code evidence.
• The guard states what it still cannot see, rather than implying full coverage.

Task tree

• Extend the meta-guard population beyond repo_tests/ (this issue's own deliverable)
  • scripts/ (13 enumerating files)
  • tools/ (32)
  • pipeline-scripts/ (8)
  • autobot-infrastructure/ (32) — in scope with its own wave, or excluded with the reason recorded
• bug(guards): a parse failure in check_websockets_cap is laundered into "dependency absent", retiring the cap #17401 — check_websockets_cap: a parse failure retires the cap
• bug(guards): check_no_literal_ttl_seconds's own reach counter is written, documented and never called by main() #17402 — check_no_literal_ttl_seconds: its own reach counter is never called
• bug(guards): check_nosec_format never checks git's exit code, has no floor, and prints nothing on success #17403 — check_nosec_format: no git rc check, no floor, silent on success
• bug(guards): check_constraint_drift enumerates from the process CWD and asserts "no drift" over an unvalidated scan set #17404 — check_constraint_drift: CWD-anchored enumeration, unvalidated scan set
• bug(guards): audit_api_wiring's baseline buckets never reconcile, and its frontend walk has no floor #17405 — audit_api_wiring: buckets never reconcile, frontend walk has no floor (blocked by audit_api_wiring.py is uneditable: function-length and size-ceiling gates interlock #17368)

Sequencing: #17403 and #17404 share the tracked_paths migration and should ride one PR. #17401 and #17402 are independent and small. #17405 cannot start until #17368 lifts the edit interlock. #17403 must be batched with #13554 (same file, different defect).

Related, not duplicated

• tech-debt(guards): 79 of 133 tree-scanning guards can report clean having examined nothing #15826 — parent. The meta-guard it asked for was built (repo_tests/guard_reach_meta_test.py); this issue covers the population it explicitly does not reach.
• refactor(lint): 35 checkers reimplement the same harness — 6 fork git ls-files, 5 of those unanchored, and 33 report clean on an empty scan #14896 — the 35-checker harness consolidation and tracked_paths. Overlapping files, so one owner; sequence rather than merge.
• The Python and shell size gates duplicate ~90% of their logic, and the Python ratchet test's monkeypatching blocks the obvious fix #17377 — the Python/shell size-gate convergence already owns the unreadable-file divergence between those two ratchets; evidence posted there, not filed here.
• security(ci): bandit and pip-audit parsers read a failed scan as zero findings, and pip-audit is gated at --fail-on any #16185 — the same class in the bandit/pip-audit parsers.
• ci: nothing verifies that a workflow path filter resolves to anything, so a mis-scoped filter silently skips a required guard #14659 — nothing verifies a workflow path filter resolves to anything (the "guard never selected" rung).

Provenance

Found by an external-source comparison whose own conclusion was that our doctrine and our remedy plan are both ahead of the reference work; the useful output was this audit of our own tree, not anything adopted. Analysis: docs/research/evidence-first-readiness-gating-toolkit.md.

Numbers quoted from guard_reach_meta_test.py's docstring and read in the tree at bcd7c8dbea; the 79 of 133 in #15826 was not re-measured in this pass.