Triage: 3 pre-existing red checks surfaced by the actions.lock cure (PR #97) #99

Summary

hyperpolymath/julia-professional-registry#97 carries the actions.lock desync cure from the estate campaign (hyperpolymath/standards#968). The lockfile change itself verifies clean. The checks listed below are pre-existing reds that only became visible once the cure revived the workflows that run them.

Per the standing stopping rule, a pre-existing red is an issue with acceptance criteria, not a merge blocker. This is that issue for this repo.

Failing checks (3)

governance / Allowlist Preflight

• Determine whether governance / Allowlist Preflight is fixed, retired, or accepted with a documented exemption. It may not stay undetermined.
• Record whether governance / Allowlist Preflight is also red on main. If it is, it measures the estate, not this change, and nothing is required of this branch that its base does not satisfy.
• If fixed: the check is green on this PR head, and the fix is in the repo — not continue-on-error, not a demotion to a warning, not removal from the required set.

governance / Guix packaging policy (Nix retired)

• Determine whether governance / Guix packaging policy (Nix retired) is fixed, retired, or accepted with a documented exemption. It may not stay undetermined.
• Record whether governance / Guix packaging policy (Nix retired) is also red on main. If it is, it measures the estate, not this change, and nothing is required of this branch that its base does not satisfy.
• If fixed: the check is green on this PR head, and the fix is in the repo — not continue-on-error, not a demotion to a warning, not removal from the required set.

governance / Workflow security linter

Also red on main in several repos. Confirm whether this repo's main is red before treating it as a branch defect.

• Determine whether governance / Workflow security linter is fixed, retired, or accepted with a documented exemption. It may not stay undetermined.
• Record whether governance / Workflow security linter is also red on main. If it is, it measures the estate, not this change, and nothing is required of this branch that its base does not satisfy.
• If fixed: the check is green on this PR head, and the fix is in the repo — not continue-on-error, not a demotion to a warning, not removal from the required set.

Acceptance criteria for closing this issue

• Every check above has a recorded determination (fix / retire / exempt).
• Any check determined fixed is green on a run of this repo's default branch.
• Any check determined retired is removed from the workflow and from the repo's required-check set in the same change.
• Any check determined exempt has the exemption written down with its reason and a review date.
• No check was closed by muting it. Repair or retire; never silence.

Context

• Campaign roll-up: actions.lock step-level desync: 39 repos with silently dead CI (startup_failure) standards#968
• Cross-cutting classes (this repo's reds are mostly instances of them): Cross-cutting governance reds surfaced by the actions.lock cure — 9 classes across 17 PRs (incl. a live gate for the retired A2ML) standards#994
• Lock policy + the pin bump that disarms the latent blocker: actions.lock policy: job-level reusable refs are reported, never required — and the pin bump that disarms the latent blocker standards#993

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm