Estate health: 87% of default branches are red (388 of 447) — a red branch is no longer a signal

[hyperpolymath]

Finding

388 of 447 repositories with workflows have a RED default branch — 87%. Only
56 are green (3 indeterminate). This was measured while scoping the
ci-pipeline.yml adoption ratchet (#948) and is reported separately because it is
an estate-health fact in its own right, not a rollout input.

Measured

Estate population, via gh repo list + a paginated GraphQL census over default
branches (census2.sh, census3.sh):

repositories, both orgs	460
live (non-archived)	452
with any workflow	447
default branch green	56
default branch red	388 (87%)
indeterminate	3

⚠ gh repo list hyperpolymath --limit 300 returned exactly 300 — a truncation
masquerading as a total. At --limit 1000 the true figure is 392. Any earlier
estate count near 368 is understated.

It is not one chronic check

A statusCheckRollup is a combined verdict: one red check reddens the whole
repository. So 87% red does not by itself mean 87% of repos are broadly broken,
and standards itself scores FAILURE while most of its recent runs succeed. That
alternative had to be disproved rather than assumed.

Sampling 24 of the red repositories for individual failing check-runs:

failing check-runs	223
repositories affected	24 of 24
mean per repository	~9.3
distinct check names	88

The breadth is real. Largest clusters:

Cluster	Failing runs	Share
mirror/*	61	27%
governance/*	38	17%
rust-ci/*	7	3%

Top individual checks: mirror / mirror-gitea (12), mirror / mirror-disroot (12),
governance / Code quality + docs (11), mirror / mirror-bitbucket (10),
governance / Workflow security linter (7), mirror / mirror-codeberg (7).

The mirror cluster is filed separately as its own issue.

Why this matters to the ratchet

It does not set the ratchet's seed, and #948 explicitly refuses to use it as
one. The census answers "does this repository's existing CI pass"; the ratchet
needs "does ci-pipeline.yml pass here". Those populations are close to
independent — a repo with four dead mirror jobs and clean code passes gitleaks,
semgrep and the lint gates. Seeding 388 slugs from this number would have made the
ledger a rubber stamp on its first commit.

It matters for a different reason: a red default branch is not a usable signal.
At 87% red, "CI is failing" carries no information, and a genuinely new breakage is
indistinguishable from the background. That is the cost being carried.

Acceptance criteria

• A decision on whether 87% red is accepted as known debt or treated as a
  remediation campaign. This is an owner call, not an engineering one.
• If remediation: the mirror/* cluster first — 27% of all failures, one root
  cause, filed separately.
• governance/* (17%) triaged second; Code quality + docs (11) and
  Workflow security linter (7) are the two heads.
• Re-run the census after remediation and record the new green count. The
  census scripts are reusable and the per-repo rows are kept in census.json.

Related: #948 (the ratchet that this deliberately does not seed), #932, #933,
#934, #935. Decision surface: #787.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR