Close the audit's findings on itself, and run application-security on Opus

.github/audit/_preamble.md

@@ -16,7 +16,11 @@ for a check you could not determine — a transient network error, or an area yo
 ran out of room to reach — and say which it was. It is never a substitute for a
 check you could have run.
 
-Write your findings to the file named in your own prompt, with two sections:
+Write your findings to the file named in your own prompt. **Its very first
+line must be literally `VERDICT: PASS` or `VERDICT: FAIL`** — nothing else on
+that line. The reporting step greps for it, so it is the one part of your
+report a machine reads: a `FAIL` there cannot be lost in a merge, and it is
+what stops an optimistic summary from overriding you. Then two sections:
 `### FAIL IF results` (one line per check) and `### Qualitative findings`
 (severity-tagged). **Write that file before you return** — your caller reads
 the file, not your reply, and a fragment that does not exist fails the whole

.github/audit/application-security.md

@@ -40,10 +40,28 @@ gap is known (revocation, the audit trail, the two `workflow-audit` window
 evasions), do not re-report it as a finding — report only if the situation has
 changed or is worse than described.
 
-You also own the **rest of the repository** qualitatively, so that no top-level
-path is outside every domain: `lib/`, `server/`, `server-lib-common/`,
-`standalone/`, `vscode-ext/`, `dor/`, `dor-lib-common/`, `canopy/`, `deploy/`,
-`docs/`, and the root files. Remote control is where the depth goes; the rest
-is a sweep for anything that would be a security hole in a terminal that runs
-local shells — command construction, path handling, deserialization of
-persisted state, IPC that crosses a trust boundary.
+You are also the **catch-all** domain, and this is defined by subtraction, not
+by a list: you own everything in the repository that `supply-chain.md` and
+`ci-and-secrets.md` do not explicitly claim. Run `ls -A` and work out the
+remainder rather than trusting any enumeration — an enumeration goes stale the
+moment someone adds a directory, which is exactly how `.vscode/` and
+`.impeccable/` ended up owned by nobody.
+
+Subtraction is **recursive, not top-level**. Where another domain claims a
+subdirectory rather than a whole tree, the rest of that tree is yours — so
+check one level down wherever a claim is partial, or the same orphaning
+happens inside a directory instead of beside it. `website/` is *not* an
+example of this any more: `supply-chain` claims all of it except
+`website/public/`, so none of it is yours. That was fixed by stating the claim
+as a subtraction rather than as two named subdirectories, which is the shape
+to prefer when you find the next one.
+
+Today the remainder is `lib/`, `server/`, `server-lib-common/`, `standalone/`,
+`vscode-ext/`, `dor/`, `dor-lib-common/`, `canopy/`, `deploy/`, `docs/`,
+`.impeccable/`, and the root files — but treat that as a description of the
+current tree, not as your scope. Your scope is the remainder.
+
+Remote control is where the depth goes; the rest is a sweep for anything that
+would be a security hole in a terminal that runs local shells — command
+construction, path handling, deserialization of persisted state, IPC that
+crosses a trust boundary.

.github/audit/ci-and-secrets.md

@@ -35,6 +35,14 @@ write scopes.
 ## Qualitative pass
 
 You own `.github/` (including `.github/audit/`, which holds this audit's own
-prompts), `.config/`, `.claude/`, `scripts/`, and `website/public/` — the Tauri
-updater manifest shipped apps fetch lives there, so it is a release artifact
-rather than marketing. You also own any code anywhere that touches a secret.
+prompts), `.config/`, `.claude/`, `.vscode/`, `scripts/`, and
+`website/public/` — the Tauri updater manifest shipped apps fetch lives there,
+so it is a release artifact rather than marketing. You also own any code
+anywhere that touches a secret.
+
+`.vscode/` is here rather than with the product code because it is
+configuration that can execute: a `tasks.json` entry with
+`"runOn": "folderOpen"` runs on checkout when a maintainer opens the folder,
+which is the same shape of persistence `workflow-audit.yaml` watches workflows
+for. There is no such task today; the point is that adding one should be a
+finding, not a quiet config change.

.github/audit/orchestrator.md

@@ -14,13 +14,21 @@ adversarially — and one context holding all three degrades the third.
 ## 1. Spawn all three
 
 Spawn them with the Task tool **in a single message** so they run
-concurrently. Give each subagent, verbatim:
+concurrently, using these three `subagent_type` values:
 
-- the shared preamble in `.github/audit/_preamble.md`, then
-- its own file: `.github/audit/supply-chain.md`,
-  `.github/audit/ci-and-secrets.md`, `.github/audit/application-security.md`.
+- `supply-chain`
+- `ci-and-secrets`
+- `application-security`
 
-Read all four files before you spawn anything.
+Each is already defined with the prompt it needs — pointing at
+`.github/audit/_preamble.md` plus its own domain file — and with the model it
+should run on. `application-security` is deliberately on a stronger model than
+the other two; do not override it, and do not paste prompt text into the Task
+call. A one-line instruction such as "begin your audit" is enough, because the
+agent definition carries the rest.
+
+Do not read the domain files yourself. They are long, you are not auditing,
+and holding all three in your context is the thing this split exists to avoid.
 
 ## 2. Wait without ending your turn
 

.github/audit/supply-chain.md

@@ -25,7 +25,13 @@ enumeration is the shortcut that goes stale.
 
 ## Qualitative pass
 
-You own the dependency graph, the lockfile, and `website/src/`. Look at:
+You own the dependency graph, the lockfile, and **all of `website/` except
+`website/public/`**, which is `ci-and-secrets`' because the Tauri updater
+manifest lives there. So `website/src/`, `website/scripts/`, and the build
+config (`package.json`, `vite.config.ts`, `react-router.config.ts`,
+`tsconfig.json`) are all yours. `generate-deps.js` is in that set: audit the
+whole generator, not just the `productDependencyFilters` array the
+root-completeness bullet names.
 
 - newly added or upgraded runtime dependencies since the last audit
 - anything in the lockfile that resolves outside the registry

.github/renovate.json

@@ -4,6 +4,18 @@
   "dependencyDashboard": true,
   "timezone": "America/Los_Angeles",
   "schedule": ["* * * * 1"],
+  "vulnerabilityAlerts": {
+    "description": [
+      "Security fixes must not wait for the Monday window. Everything else here is batched to one day a week, which is right for routine bumps and wrong for a known-vulnerable dependency, so this overrides the schedule only.",
+      "`minimumReleaseAge` is set here EXPLICITLY, and must stay that way. Renovate\u0027s own default for this block is `minimumReleaseAge: null`, force-applied before lookup — so omitting it does not inherit the cooldown from packageRules, it DROPS the cooldown entirely. Stating it is the only way to keep it.",
+      "Keeping it is the deliberate choice: the cooldown guards the opposite threat — a compromised release that gets yanked within a day — and a reviewer reading a Renovate diff cannot detect a supply-chain compromise the way the ecosystem\u0027s own yank process can. Nothing here auto-merges, and the Dependabot alert already makes the vulnerability visible the moment it is published, so what the cooldown costs is a day before the remediation PR appears, not a day before anyone knows.",
+      "See SECURITY.md, Dependency Supply Chain."
+    ],
+    "enabled": true,
+    "schedule": [],
+    "minimumReleaseAge": "1 day",
+    "labels": ["security", "dependencies"]
+  },
   "packageRules": [
     {
       "matchManagers": ["npm", "cargo"],