[workflow-audit] 2 unexplained change(s) on 2026-09-20

[github-actions]

2 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-09-19T11:54:05Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

215fc59 — fix(self-host): close two manage verify gaps, and stop duplicating two values

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-20 01:12:56 -0700
• Refs: remotes/origin/specs-security-audit
• Files:
  • .github/workflows/security-audit.yaml
• View diff

eaad659 — docs(security): correct the audited specs and give SELF_HOST.md a rationale

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-20 01:05:13 -0700
• Refs: remotes/origin/specs-security-audit
• Files:
  • .github/audit/application-security.md
  • .github/audit/supply-chain.md
• View diff

[dormouse-bot]

Both commits are #715, an open draft on specs-security-audit stacked under #714 — neither has reached main, whose head is still 209ba5d (2026-09-19).

Commit	Window change
eaad659	supply-chain.md gains the GH_TOKEN=$AUDIT_PAT prefix its secret-scanning and Dependabot checks need — a workflow GITHUB_TOKEN has no admin scope, so GitHub omits security_and_analysis and answers 403 on the alert endpoint, and both checks read as absent when they are on. application-security.md gains the Hosted paths security-hosted.md's Deployment boundary quantifies over (hosted/scripts/, wrangler.jsonc, the two hosted-* workflows), three Hosted questions for the qualitative pass, and hosted//vendor/ in the remainder-scope description.
215fc59	security-audit.yaml parses the status file into FILE_STATUS once and assigns STATUS from it, deleting STATUS_FILE_VERDICT — a derived variable with one reader that existed only because STATUS was mutated in place. The no-verdict note now tests FILE_STATUS = MISSING directly. No behavior change.

Both are audit-window changes in the direction of the window's own purpose: the first makes two domains able to see controls they were reporting as absent, the second is a refactor inside the reporting step. The rest of each commit is outside the window — 215fc59's subject is two manage verify gaps in the installers, eaad659's is spec corrections the spec audit found.

How each was checked

Provenance with gh api repos/diffplug/dormouse/commits/<sha>/pulls; both answer #715, state: open, merged_at: null. Reachability with git merge-base --is-ancestor <sha> origin/main — both NO. Window content with git diff <sha>^1 <sha> -- .github/workflows/ .config/tend.yaml .github/audit/ .vscode/.

Neither commit is signed; the nedtwigg attribution is GitHub's email association, not proof of origin. The control that will gate them is the review and merge of #715.

Nothing to account for beyond #715, so this tracker can close whenever you like — the diffs are reviewable there as one change.