[workflow-audit] 3 unexplained change(s) on 2026-09-22

Start with the workflow-audit run summary and the three linked commit diffs. Review .github/audit/application-security.md, .github/audit/_preamble.md, .github/audit/hosted.md, .github/audit/orchestrator.md, and .github/workflows/security-audit.yaml in the context of their listed refs. Done means each unexplained commit has a documented human account or an explicit audit decision.

3 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-09-21T14:00:40Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

dac9993 — Verify vendored pgstencil provenance and defer its code audit to pgstencil

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-21 17:39:09 -0700
• Refs: remotes/origin/hosted-audit-domain,remotes/origin/pgstencil-provenance
• Files:
  • .github/audit/application-security.md
• View diff

f1888e9 — Keep provisioning obligations out of the FAIL IF list so the audit can decide

• Author: dormouse-bot dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-09-22 10:14:25 +0000
• Refs: remotes/origin/audit-external-obligations
• Files:
  • .github/audit/_preamble.md
• View diff

fc56b46 — Split Hosted accounts into a fourth audit domain

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-09-21 17:39:13 -0700
• Refs: remotes/origin/hosted-audit-domain
• Files:
  • .github/audit/application-security.md
  • .github/audit/hosted.md
  • .github/audit/orchestrator.md
  • .github/workflows/security-audit.yaml
• View diff