What
As of main@ccef0f7 (2026-09-30), several required-adjacent checks are already red on the default branch, independent of any specific PR:
governance / Guix packaging policy (Nix retired) — FAILUREgovernance / Actions lockfile verify — FAILUREmirror / mirror-disroot — FAILUREmirror / mirror-bitbucket — FAILUREmirror / mirror-gitea — FAILUREmirror / mirror-codeberg — FAILUREhypatia / Hypatia Neurosymbolic Analysis — FAILURECodeQL Security Analysis workflow — STARTUP_FAILURE (no check runs recorded)
Found while verifying that PR fix/launcher-xdg-state (predictable /tmp log path in check-language-compliance.sh, CWE-377) did not introduce new red checks: these same checks are red at the tip of main itself, so they are inherited, not caused by that PR.
Acceptance criteria
Filed per estate doctrine: a new/pre-existing red check is not a merge blocker in itself, but must be tracked as an issue with acceptance criteria rather than silently ignored.
What
As of
main@ccef0f7(2026-09-30), several required-adjacent checks are already red on the default branch, independent of any specific PR:governance / Guix packaging policy (Nix retired)— FAILUREgovernance / Actions lockfile verify— FAILUREmirror / mirror-disroot— FAILUREmirror / mirror-bitbucket— FAILUREmirror / mirror-gitea— FAILUREmirror / mirror-codeberg— FAILUREhypatia / Hypatia Neurosymbolic Analysis— FAILURECodeQL Security Analysisworkflow —STARTUP_FAILURE(no check runs recorded)Found while verifying that PR fix/launcher-xdg-state (predictable /tmp log path in check-language-compliance.sh, CWE-377) did not introduce new red checks: these same checks are red at the tip of
mainitself, so they are inherited, not caused by that PR.Acceptance criteria
main, or has a documented, owner-accepted reason it stays red (e.g. a retired mirror target, a known Guix/Nix transition item).CodeQL Security Analysis'sSTARTUP_FAILUREis root-caused (workflow config vs. permissions vs. missing language) and either fixed or the workflow is removed if no longer applicable.Filed per estate doctrine: a new/pre-existing red check is not a merge blocker in itself, but must be tracked as an issue with acceptance criteria rather than silently ignored.