Triage: 5 workflows red, stale, superseded or dormant on main — measured by the new CI check ledger #147

Summary

Issue #138 named one check (lint-workflows, rendered twice) as this repo's pre-existing reds. Building the CI check ledger (docs/audits/ci-check-ledger.json, PR to follow) measured the whole default branch instead of one workflow, and the real state is larger. This issue is the triage home for the checks that are not green on main, with a determination and acceptance criteria for each.

Measured 2026-10-14 against main @ ac5946d, from the GitHub Actions API (latest completed run per workflow, plus the workflow's own enabled/disabled state):

Green on main (13): boj-build, cargo-audit, codeql, dogfood-gate, governance, hypatia-scan, label-triage, labels, lock-sync-gate, rust-ci, scorecard, secret-scanner, workflow-linter.

Why this is separate from #138

#138's acceptance criteria are about one check name and can be closed on its own evidence. These are different checks; "repair or retire; never silence" applies to each, and none of them was in that issue's list. Nothing here is a merge blocker for unrelated work.

Determinations and acceptance criteria

1. mirror.yml — red (owner decision required)

Two of seven mirror legs fail; five succeed.

• mirror-gitea exits 1 — the first command in the step is ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }}; exit 1 with no host argument is the usage error, which points at vars.GITEA_HOST being unset. The GITEA_MIRROR_ENABLED variable must be true for the job to run at all, and GITEA_SSH_KEY must be non-empty for the step to run rather than print the skip notice, so neither of those is the cause.
• mirror-disroot exits 128 — git's fatal exit, i.e. the git push was refused (missing mirror repo, revoked key, or a changed host key).
• The repository declares three mirrors: .machine_readable/6a2/META.a2ml (forges = ["github", "gitlab", "bitbucket", "codeberg"]), README.adoc §Multi-Forge Distribution and ROADMAP.adoc all agree. Seven legs are enabled. gitea and disroot are enabled but undeclared; sourcehut and radicle are enabled, undeclared, and currently succeeding.

Acceptance criteria:

• Decide, per enabled forge, declare-or-disable. Either update .machine_readable/6a2/META.a2ml + README.adoc to declare it, or disable the variable (GITEA_MIRROR_ENABLED, DISROOT_MIRROR_ENABLED, and for the undeclared-but-working pair SOURCEHUT_MIRROR_ENABLED, RADICLE_MIRROR_ENABLED).
• vars.GITEA_HOST is either set to the real Gitea host or the Gitea leg is retired.
• The Disroot leg's rejection is diagnosed (mirror repo exists? deploy key still authorised? host key unchanged?) or the leg is retired.
• Declaration and configuration agree afterwards; no leg is left enabled-but-broken. Removing a leg from the workflow is not a substitute for the decision — the variable is the switch, and standards is where the leg itself lives.

2. cflite_batch.yml / cflite_pr.yml — red, but the runs are stale

Both workflows run google/clusterfuzzlite against a real harness (.clusterfuzzlite/{Dockerfile,build.sh,project.yaml} and fuzz/fuzz_targets/fuzz_main.rs exist; the build.sh messages show the +nightly and vulnerabilities.sarif problems were already diagnosed and fixed in-file). The recorded failures are older than those repairs, so the current state of the workflow file is unmeasured, not known-red.

Acceptance criteria:

• Re-measure on the current file: push a change under **/*.rs (triggers cflite_pr) or run ClusterFuzzLite Batch from the Actions UI.
• If it passes: record the run in the ledger and close this item — the assertion is that the repair is real, not that the old failure is forgotten.
• If it fails: fix the harness or retire both workflows and their actions.lock entries in the same change (an orphaned lock entry fails the lock gate).

3. casket-pages.yml — superseded, never deploys

cancelled runs alternate with startup_failure; there is no successful Pages deployment in the window measured. docs-site is a declared capability in .machine_readable/rsr-profile.a2ml, so the workflow is intended to matter.

Acceptance criteria:

• Determine whether GitHub Pages is enabled for this repository with "GitHub Actions" as the source. A Pages workflow cannot start when the site is not configured — that is the shape startup_failure takes here.
• If it is enabled and the failure is elsewhere: fix it and link a green run.
• If Pages is not wanted: retire the workflow and its actions.lock entry, and drop docs-site from the RSR profile capabilities in the same change.

4. instant-sync.yml / push-email-notify.yml — dormant

Both are disabled_manually in GitHub and have not run since 2026-07-14. Nothing is broken; a decision was taken and never written down.

Acceptance criteria:

• Record the decision in the ledger entry (it is already recorded as dormant with this issue linked).
• If the dormancy is permanent, delete the workflow files and their actions.lock entries; if it is temporary, say what unblocks it.

What is already done elsewhere (not part of this issue)

• cargo-audit.yml now reconciles its own issue instead of creating an undated duplicate every run.
• mirror.yml gains a preflight job that names unconfigured or undeclared enabled forges before the fan-out, instead of leaving an exit code to be guessed at.
• The ledger makes every one of these states visible and re-checks them on the default branch, so none can silently return.

Estate context: metadatastician/standards#1070 (the 14-repo pre-existing-red family, where rpa-elysium#138 is listed as "2 reds") and metadatastician/standards#994 (the cross-cutting check classes).