docs/usermanuals/en/operations/troubleshooting.md: false claim — Webhooks not firing: check webhook.allow_private; 'Endpoint returns 4xx (silent in logs by default)'; 'Check audit_log.jsonl for web… (DOC-D3B04B-013) #231

Wave 1 · theme D1-10: Documentation-only fixes · highest severity High · 1 finding(s) · effort docs fix

Summary

Operators search the audit log for an event that never exists and set a key that fails validation. The claim that the body is included contradicts the redaction design.

Primary finding

DOC-D3B04B-013 — docs/usermanuals/en/operations/troubleshooting.md: false claim — Webhooks not firing: check webhook.allow_private; 'Endpoint returns 4xx (silent in logs by default)'; 'Check audit_log.jsonl for web…

severity High · already tracked: KNOWN-OPEN C31-DOC-SCHEMA-PROSE docs/roadmap/phase-16-trust-surface-hardening.md:785-786

Where. docs/usermanuals/en/operations/troubleshooting.md:152-159 (Turkish mirror: docs/usermanuals/tr/operations/troubleshooting.md:155-159) · type: false claim

The document says. Webhooks not firing: check webhook.allow_private; 'Endpoint returns 4xx (silent in logs by default)'; 'Check audit_log.jsonl for webhook_failed events; they include the response status and body.'

What the code does. No webhook_failed (or any webhook-failure) audit event exists, and webhook.py emits no audit events. Delivery failures are logged at WARNING only: 'Webhook HTTP %d ... response body suppressed', plus timeout, connection and SSRF-refusal warnings. The response body is deliberately never logged (forgelm/webhook.py:174-238). A non-2xx response is not silent. The key is webhook.allow_private_destinations (config introspection; webhook.allow_private fails validation).

Code references. forgelm/webhook.py:174-238, forgelm/config.py:1462

User impact. Operators search the audit log for an event that never exists and set a key that fails validation. The claim that the body is included contradicts the redaction design.

Proposed correction. Causes: private/loopback target without webhook.allow_private_destinations: true; TLS failure; non-2xx response; require_https: true with an http:// URL. Fix: check the training log for WARNING lines starting 'Webhook HTTP', 'Refusing to post webhook', 'Webhook request timed out' or 'Webhook connection failed' (response bodies are never logged); webhook failures are not recorded in audit_log.jsonl.

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}