[bench] docs: state the dependency-PR governance boundary honestly

CLAUDE.md

@@ -90,7 +90,16 @@ non-Anthropic model families remain out of scope.
 
 ### Absolute
 
-1. Every file change is governed. No exceptions. No bypasses.
+1. Every file change made through Claude Code's Write/Edit/MultiEdit tools is
+   governed. No exceptions and no bypasses on that path. One category sits
+   outside it and cannot be brought in: a bot-authored dependency PR, where
+   Dependabot edits requirements.txt on GitHub, never reaches the PreToolUse
+   hook, so it merges without a verdict or a ledger entry. Merge those by
+   deliberate human decision after reading the diff, and do not enable
+   auto-merge on them. That last point is project policy, not constitutional
+   text: C-007 binds changes to the pipeline files themselves, so it does not
+   literally reach a GitHub merge setting, though auto-merge would defeat the
+   same verification it exists to protect.
 2. The ledger is append-only. Never modify, delete, or overwrite entries.
 3. The hash chain must remain intact. Every entry references the previous.
 4. Constitution is loaded as a snapshot per pipeline run. All three stages

README.md

@@ -40,8 +40,15 @@ See [bench.json](bench.json) for the current constraints.
 
 ## Self-Governance
 
-This tool was built under its own governance. Every change in this codebase
-was challenged, defended, ruled on, and recorded by Bench itself.
+This tool was built under its own governance. Every change authored through
+Claude Code's file tools was challenged, defended, ruled on, and recorded by
+Bench itself.
+
+One category is outside that boundary and is named here rather than glossed
+over: bot-authored dependency PRs. Dependabot edits `requirements.txt` on
+GitHub, which never reaches the PreToolUse hook, so those changes merge on a
+human decision and carry no ledger entry. Bench governs what a model proposes
+through the tools it hooks, not everything that can reach a branch.
 
 During the build, Bench vetoed a change to its own governance pipeline code
 under constraint C-007 (governance pipeline integrity). The change would have

SECURITY.md

@@ -116,7 +116,13 @@ Understanding these will save you time deciding whether a finding is in scope.
   contents of governed files accordingly.
 - **Only the PreToolUse path is governed.** Direct shell commands, editors, and
   anything that does not route through Claude Code's Write/Edit/MultiEdit tools
-  is outside Bench's reach by design.
+  is outside Bench's reach by design. The recurring case worth stating plainly
+  is a bot-authored dependency PR: Dependabot edits `requirements.txt` on
+  GitHub, so it never touches the hook and merges without a verdict or a ledger
+  entry. Read those diffs before merging and do not enable auto-merge. A report
+  that Bench "failed to govern" such a change is not a vulnerability, because
+  it was never in scope; a way to make an ordinary tool-path change *look* like
+  one in order to skip adjudication would be.
 
 ## Credentials