[workflow-audit] 3 unexplained change(s) on 2026-09-21

[github-actions]

3 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-09-20T12:16:02Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

4d5cbb4 — fix(self-host): close two manage verify gaps, and stop duplicating two values

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-20 23:15:37 -0700
• Refs: main,remotes/origin/fix/drop-dead-pending-drag-button remotes/origin/fix/walkthrough-per-stream-decoder,remotes/origin/main remotes/origin/renovate/github-actions,remotes/origin/renovate/node-24.x remotes/origin/renovate/node-24.x-lockfile,remotes/origin/renovate/tauri-apps-cli-2.x-lockfile remotes/origin/specs-security-audit,remotes/origin/tend/update-workflows
• Files:
  • .github/workflows/security-audit.yaml
• View diff

a20f69a — Merge branch 'main' into daily/review-runs-35344301870

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-20 23:44:18 -0700
• Refs: main,remotes/origin/fix/drop-dead-pending-drag-button remotes/origin/fix/walkthrough-per-stream-decoder,remotes/origin/main remotes/origin/renovate/github-actions,remotes/origin/renovate/node-24.x remotes/origin/renovate/node-24.x-lockfile,remotes/origin/renovate/tauri-apps-cli-2.x-lockfile remotes/origin/tend/update-workflows
• Files:
  • .github/workflows/security-audit.yaml
• View diff

b1ddc4f — docs(security): correct the audited specs and give SELF_HOST.md a rationale

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-20 23:15:36 -0700
• Refs: main,remotes/origin/fix/drop-dead-pending-drag-button remotes/origin/fix/walkthrough-per-stream-decoder,remotes/origin/main remotes/origin/renovate/github-actions,remotes/origin/renovate/node-24.x remotes/origin/renovate/node-24.x-lockfile,remotes/origin/renovate/tauri-apps-cli-2.x-lockfile remotes/origin/specs-security-audit,remotes/origin/tend/update-workflows
• Files:
  • .github/audit/application-security.md
  • .github/audit/supply-chain.md
• View diff

[dormouse-bot]

All three commits are accounted for: each one belongs to a pull request that was reviewed and merged to main this morning, and all three are ancestors of main today.

Commit	PR	Merged	What lands in the audit window
b1ddc4f	#708	06:39:59Z	.github/audit/application-security.md, .github/audit/supply-chain.md
4d5cbb4	#708	06:39:59Z	.github/workflows/security-audit.yaml
a20f69a	#700	06:47:38Z	.github/workflows/security-audit.yaml (via a main merge)

The audit-prompt edit is the one worth reading closely, since a commit that changes what gets audited without touching a workflow file is the persistence shape this job exists to catch. It moves in the opposite direction: application-security.md gains hosted/, vendor/, and both Hosted deploy workflows as required reading plus three new adversarial questions (Hosted origin isolation, login-to-terminal-access escalation, test/preview bleed into production), and supply-chain.md gains an instruction to re-run the secret-scanning and Dependabot checks under AUDIT_PAT, because the default workflow GITHUB_TOKEN lacks admin scope and makes both controls read as absent when they are enabled. Both edits widen coverage and remove a false-negative; neither narrows a check or drops a FAIL IF.

4d5cbb4's security-audit.yaml change is a rename inside the "Surface result" step — the file's parsed verdict is held in FILE_STATUS and never mutated, so the "audit wrote no verdict" note keys off FILE_STATUS = MISSING instead of the derived STATUS_FILE_VERDICT, which the escalation path could overwrite. a20f69a is a merge of main into daily/review-runs-35344301870; the same security-audit.yaml hunk appears in its first-parent diff because that is how the change reached #700's branch, not as an independent edit.

Both classifiers correctly declined all three: none is a Renovate uses:-only pin bump, and none reproduces from uvx tend init — .github/audit/ is not generated at all, and security-audit.yaml is hand-maintained.

This is provenance, not the accounting the issue asks for — a maintainer still owns confirming these are the changes they intended.