docs/reference/verify_annex_iv_subcommand.md: broken example — A clean pipeline run verifies 'OK: … (hash verified, N stage artefact(s))' with exit 0; an archive without a hash prints 'OK (UNVERIFIED… (DOC-D1B04-011) #164

Wave 1 · theme D1-10: Documentation-only fixes · highest severity High · 1 finding(s) · effort docs fix

Summary

A CI gate following the page sees exit 1 on every run without the audit secret.

Primary finding

DOC-D1B04-011 — docs/reference/verify_annex_iv_subcommand.md: broken example — A clean pipeline run verifies 'OK: … (hash verified, N stage artefact(s))' with exit 0; an archive without a hash prints 'OK (UNVERIFIED…

severity High · already tracked: KNOWN-OPEN TRUST-05 — docs/roadmap/phase-16-trust-surface-hardening.md:438-441

Where. docs/reference/verify_annex_iv_subcommand.md:79-85,236-252,264-277 (Turkish mirror: docs/reference/verify_annex_iv_subcommand-tr.md:79-85,238,247,264-277) · type: broken example

The document says. A clean pipeline run verifies 'OK: … (hash verified, N stage artefact(s))' with exit 0; an archive without a hash prints 'OK (UNVERIFIED): …' with exit 0.

What the code does. The corroboration layer adds an UNVERIFIED violation (exit 1, 'FAIL:' text) when there is no audit_log.jsonl at the pipeline root, when FORGELM_AUDIT_SECRET is not set at verify time, when any log line lacks _hmac, or when the run's pipeline.completed is missing. Exit 0 requires a run recorded with the secret and verified with it. Reproduced: no log → exit 1; unsigned log → exit 1; keyed log → exit 0.

Code references. forgelm/compliance.py:3426-3490, forgelm/cli/subcommands/_verify_annex_iv.py:104-114

User impact. A CI gate following the page sees exit 1 on every run without the audit secret.

Proposed correction. 'Exit 0 additionally requires a keyed audit log: without FORGELM_AUDIT_SECRET (at record and verify time) the corroboration layer reports UNVERIFIED (exit 1).' Update the examples and the hash_state table.

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}