Split Hosted accounts into a fourth audit domain

[nedtwigg]

Stacked on #745 (pgstencil-provenance), which is on #742.

Why

application-security carried remote control, local boundaries, Hosted accounts, and the catch-all sweep, and has overrun the orchestrator's 32-minute deadline more than once (rationale -> "Domains"). Hosted is a disjoint tree with its own spec. Giving it its own domain means a cut-off remote-control pass no longer loses the Hosted results, and the pgstencil-provenance checks from #745 sit in a prompt that is about them.

What

• .github/audit/hosted.md — new domain: scope docs/specs/security-hosted.md, fragment audit-hosted.md, Opus. Owns hosted/ and vendor/; reads but does not own the two hosted-*.yml workflows, whose credentials and environments stay with ci-and-secrets.
• application-security.md drops Hosted from its scope, paragraph, bullets, and remainder list.
• Workflow, orchestrator, local runner, and security-audit.test.mjs fan out to four fragments; both code-reading domains pinned to Opus in CI and locally.
• docs/specs/security-audit.md, security.md, and the rationale updated (four domains, the hosted row, the dedicated-subagent and stronger-model FAIL IFs cover both). No budget ratchet needed.

Verified

pnpm lint:specs (check 16 confirms every security spec has exactly one owner), node --test scripts/security-audit.test.mjs (41 pass), spec-lint-selftest, public-docs-lint, bash -n on the runner, actionlint on the workflow (no new findings), and a stubbed-claude run of scripts/security-audit-local.sh hosted. The audit itself was not run.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	b0db18f
Status:	✅  Deploy successful!
Preview URL:	https://74974de2.mouseterm.pages.dev
Branch Preview URL:	https://hosted-audit-domain.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on work in progress, not a merge verdict — mark the PR ready when you want the full review.

One sentence in the contract was left behind by the split; suggestion inline.

[dormouse-bot]

Feedback on work in progress, not a merge verdict — mark the PR ready when you want the full review.

audit-hosted.md is pinned in emit, in the local runner's fragment-existence check, and in the workflow's AUDIT_FRAGMENTS guards — but not in the orchestrator's until predicate (.github/audit/orchestrator.md §2). Deleting && finished audit-hosted.md from that predicate leaves the shipped suite green at 41/41: orchestrator wait: fragments still being written keep the wait going already holds two other fragments unfinished, and every domain finished writes all four, so neither case reaches the dropped clause. With it gone the orchestrator merges and publishes the moment the other three finish, while hosted is still writing. The reporting step's fragment guards catch that and downgrade to INCONCLUSIVE, so it fails closed — at the cost of the night's Hosted audit and a held release gate.

Suggestion inline: one case per fragment, pinning the predicate's membership to AUDIT_FRAGMENTS the way the status lines in the same block already are. It goes red on exactly that mutation and green as shipped (45/45).