[workflow-audit] 3 unexplained change(s) on 2026-09-22 #751

Activity

1. dormouse-bot commented on Sep 22, 2026

   

   dormouse-bot

   on Sep 22, 2026

   Collaborator

   More actions

   All three commits are accounted for, and unlike yesterday's batch none of them is on main — each is the head or an ancestor of an open pull request, so nothing here has landed yet.

   Commit	Branch	PR	Author	Audited files
   dac9993	pgstencil-provenance	#745	nedtwigg	.github/audit/application-security.md
   fc56b46	hosted-audit-domain	#746	nedtwigg	.github/audit/{application-security,hosted,orchestrator}.md, .github/workflows/security-audit.yaml
   f1888e9	audit-external-obligations	#748	dormouse-bot	.github/audit/_preamble.md

   git merge-base --is-ancestor <sha> origin/main fails for all three. dac9993 shows up on two branches because #746 stacks on #745. Each carries a bot review on its head; none is a Renovate uses: pin bump and none reproduces from uvx tend init, so both classifiers were right to decline all three.

   dac9993 is the one that narrows a check, and it says where the coverage went. application-security.md stops auditing the contents of the vendor/ tarballs and verifies the link instead: hash each archive against vendor/build.json, read the archive's own package/dist/provenance.json and check it names that commit and is not dirty, then confirm the commit is on diffplug/pgstencil main and that its security-audit check run passed. The packed code is audited in diffplug/pgstencil against that repository's own SECURITY.md. The same commit also relaxes the domain's "no GitHub API access" rule to allow those two public-repo reads, with UNVERIFIABLE prescribed if the API is unreachable.

   f1888e9 changes what a verdict means, which is worth a close read. It adds a preamble rule that a condition on state outside the repository — a provisioning step, a Cloudflare zone setting — is not an undetermined check but no check at all: verdict the in-repo half, record the external obligation as INFO. security-hosted.md moves the Cloudflare script-injection exclusion out of its FAIL IF and into the activation paragraph, and security-audit.md gains the rule for future authors. The trigger is #747: two consecutive nightlies read those two sentences opposite ways, and the second returned INCONCLUSIVE on a 375-PASS, 0-FAIL run, holding the release gate shut. The FAIL IF's actual condition — no marketing scripts, analytics, provider avatars, or remote fonts in the Hosted frontend — is unchanged and still determinable.

   fc56b46 widens rather than drops. Hosted accounts become a fourth audit domain with its own prompt, fragment, and Opus subagent; PASS requires all four domains to pass, and AUDIT_FRAGMENTS, the redactor's argv, the reporting loop, and scripts/security-audit.test.mjs all move together. The stated reason is that application-security had overrun its 32-minute deadline more than once and took the Hosted results down with it.

   This is provenance, not the accounting the issue asks for — a maintainer still owns confirming these are the changes they intended, and two of the three are still open for review.
2. nedtwigg

   closed this as completedon Sep 23, 2026