[workflow-audit] 3 unexplained change(s) on 2026-09-19

[github-actions]

3 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-09-18T12:11:52Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

3ad55ff — Address review: anchor the delegate deadline to the caller's own

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-18 13:57:49 +0000
• Refs: remotes/origin/daily/review-runs-35344301870
• Files:
  • .github/audit/_preamble.md
• View diff

c63b312 — Tell a delegating audit domain to block, not end its turn

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-18 12:37:30 +0000
• Refs: remotes/origin/daily/review-runs-35344301870
• Files:
  • .github/audit/_preamble.md
  • .github/audit/orchestrator.md
• View diff

e5a1582 — Address review: bound the delegate wait, and align the third placeholder

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-18 12:48:58 +0000
• Refs: remotes/origin/daily/review-runs-35344301870
• Files:
  • .github/audit/_preamble.md
  • .github/workflows/security-audit.yaml
• View diff

[dormouse-bot]

All three are #700, an open
draft on daily/review-runs-35344301870 — no commit here has reached main,
whose head is still 795092f (2026-09-17).

Commit	What it is
c63b312	The PR's own change: .github/audit/_preamble.md gains the rule that a domain delegating to subagents must block on them rather than end its turn, and orchestrator.md stops naming a cut-off cause it cannot observe.
e5a1582	Review round 1 applied — bounds the new wait loop and aligns the third placeholder.
3ad55ff	Review round 2 applied — anchors the bound to the caller's own $RUNNER_TEMP/audit-deadline instead of the domain's clock, and gives each fragment its own deadline file.

Why the branch exists: security-audit run
35327271988
published no verdict because application-security issued its wait with
run_in_background: true and ended its turn while four delegates were still
running; every result was discarded twenty-one minutes inside the deadline. #700
is the prompt fix, pinned in scripts/security-audit.test.mjs.

Each commit was reviewed before the next — three tend-review rounds, findings
applied in the commit above. One thread from the last round is still open.

Nothing to account for beyond the PR, so this tracker can close whenever you
like; the diffs are on #700 where they can be reviewed as one change.