[workflow-audit] 3 unexplained change(s) on 2026-09-22

[github-actions]

3 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-09-21T14:00:40Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

dac9993 — Verify vendored pgstencil provenance and defer its code audit to pgstencil

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-21 17:39:09 -0700
• Refs: remotes/origin/hosted-audit-domain,remotes/origin/pgstencil-provenance
• Files:
  • .github/audit/application-security.md
• View diff

f1888e9 — Keep provisioning obligations out of the FAIL IF list so the audit can decide

• Author: dormouse-bot dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-22 10:14:25 +0000
• Refs: remotes/origin/audit-external-obligations
• Files:
  • .github/audit/_preamble.md
• View diff

fc56b46 — Split Hosted accounts into a fourth audit domain

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-21 17:39:13 -0700
• Refs: remotes/origin/hosted-audit-domain
• Files:
  • .github/audit/application-security.md
  • .github/audit/hosted.md
  • .github/audit/orchestrator.md
  • .github/workflows/security-audit.yaml
• View diff

[dormouse-bot]

All three commits are accounted for, and unlike yesterday's batch none of them is on main — each is the head or an ancestor of an open pull request, so nothing here has landed yet.

Commit	Branch	PR	Author	Audited files
dac9993	pgstencil-provenance	#745	nedtwigg	.github/audit/application-security.md
fc56b46	hosted-audit-domain	#746	nedtwigg	.github/audit/{application-security,hosted,orchestrator}.md, .github/workflows/security-audit.yaml
f1888e9	audit-external-obligations	#748	dormouse-bot	.github/audit/_preamble.md

git merge-base --is-ancestor <sha> origin/main fails for all three. dac9993 shows up on two branches because #746 stacks on #745. Each carries a bot review on its head; none is a Renovate uses: pin bump and none reproduces from uvx tend init, so both classifiers were right to decline all three.

dac9993 is the one that narrows a check, and it says where the coverage went. application-security.md stops auditing the contents of the vendor/ tarballs and verifies the link instead: hash each archive against vendor/build.json, read the archive's own package/dist/provenance.json and check it names that commit and is not dirty, then confirm the commit is on diffplug/pgstencil main and that its security-audit check run passed. The packed code is audited in diffplug/pgstencil against that repository's own SECURITY.md. The same commit also relaxes the domain's "no GitHub API access" rule to allow those two public-repo reads, with UNVERIFIABLE prescribed if the API is unreachable.

f1888e9 changes what a verdict means, which is worth a close read. It adds a preamble rule that a condition on state outside the repository — a provisioning step, a Cloudflare zone setting — is not an undetermined check but no check at all: verdict the in-repo half, record the external obligation as INFO. security-hosted.md moves the Cloudflare script-injection exclusion out of its FAIL IF and into the activation paragraph, and security-audit.md gains the rule for future authors. The trigger is #747: two consecutive nightlies read those two sentences opposite ways, and the second returned INCONCLUSIVE on a 375-PASS, 0-FAIL run, holding the release gate shut. The FAIL IF's actual condition — no marketing scripts, analytics, provider avatars, or remote fonts in the Hosted frontend — is unchanged and still determinable.

fc56b46 widens rather than drops. Hosted accounts become a fourth audit domain with its own prompt, fragment, and Opus subagent; PASS requires all four domains to pass, and AUDIT_FRAGMENTS, the redactor's argv, the reporting loop, and scripts/security-audit.test.mjs all move together. The stated reason is that application-security had overrun its 32-minute deadline more than once and took the Hosted results down with it.

This is provenance, not the accounting the issue asks for — a maintainer still owns confirming these are the changes they intended, and two of the three are still open for review.