[workflow-audit] 5 unexplained change(s) on 2026-09-18

[github-actions]

5 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-09-17T12:33:38Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

852dd31 — Name the third report marker, and keep a cut-off FAIL a FAIL locally

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-17 16:32:26 +0000
• Refs: main,remotes/origin/fix/audit-fragment-incremental-35205193090 remotes/origin/main,remotes/origin/preserve-dir
• Files:
  • .github/workflows/security-audit.yaml
• View diff

8c03ebf — Merge remote-tracking branch 'origin/main' into fix/audit-wait-loop-returns

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-17 09:20:38 -0700
• Refs: main,remotes/origin/main remotes/origin/preserve-dir
• Files:
  • .github/workflows/security-audit.yaml
• View diff

8efd0e9 — fix(security-audit): mark a cut-off fragment in the no-report fallback

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-17 17:14:32 +0000
• Refs: main,remotes/origin/main remotes/origin/preserve-dir
• Files:
  • .github/workflows/security-audit.yaml
• View diff

c21beb6 — Merge origin/main (#682) into fix/audit-wait-loop-returns

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-17 09:47:07 -0700
• Refs: main,remotes/origin/main remotes/origin/preserve-dir
• Files:
  • .github/audit/orchestrator.md
  • .github/workflows/security-audit.yaml
• View diff

cb251fa — fix(security-audit): publish the fragments when the merge never ran

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-17 16:58:41 +0000
• Refs: main,remotes/origin/main remotes/origin/preserve-dir
• Files:
  • .github/workflows/security-audit.yaml
• View diff

[dormouse-bot]

All five commits trace to two pull requests, both merged to main yesterday: #682 (one commit) and #626 (four). Two of the five are the maintainer's own merges of main into #626's branch while both were in flight; only one of those resolved anything in the audit window.

Commit	Window change	Source
8c03ebf	none — mechanical merge of origin/main into fix/audit-wait-loop-returns	#626
852dd31	security-audit.yaml: the no-verdict note names the third report marker (_Incomplete …_) alongside UNVERIFIABLE and _No report …_	#682
c21beb6	orchestrator.md: hand-resolved conflict — #682 and this branch both rewrote the same until loop	#626
cb251fa	security-audit.yaml: the no-merged-report arm publishes each domain's fragment verbatim instead of one line	#626
8efd0e9	security-audit.yaml: that same arm runs the sentinel test and marks a cut-off fragment _Incomplete …_	#626

How each was checked

Every commit was mapped with GET /repos/diffplug/dormouse/commits/<sha>/pulls, and its window change read as git diff <sha>^1 <sha> -- .github/workflows/ .config/tend.yaml .github/audit/ .vscode/.

For the two merges, the window content was read with git show --cc — a file that matches at least one parent is suppressed, so an empty listing means nothing in the window was hand-written into the merge:

• 8c03ebf (2026-09-17 16:20 UTC) lists nothing in the window. It brought main into the branch and carried no resolution of its own; the workflow line the report attributes to it came in from main's side.
• c21beb6 (16:47 UTC, twenty minutes after the audit's Have audit domains append findings as they determine them #682 landed at 16:46) lists .github/audit/orchestrator.md. That resolution is real work and its message states it: Have audit domains append findings as they determine them #682 made the wait block on each fragment's completion sentinel, fix(security-audit): return an answer from every wait call, and publish the fragments when the merge never runs #626 made each wait call end itself under the harness's ten-minute Bash cap, and both rewrote the same loop. The merged loop waits on finished, breaks at 540 seconds or the 32-minute deadline, and prints a per-domain status followed by its answer — STILL WAITING, DEADLINE, or ALL FINISHED.

All five are on main today. The audit window's current state is the combination of the two PRs, and nothing here is unaccounted for.