retention.staging_ttl_days promises 'scheduled cleanup' that nothing performs (CR-A01-087) #368

Wave 1 · theme D1-11: Other high-severity packages · highest severity High · 2 finding(s) · effort small

Summary

An operator expects rejected staging models, which may contain personal-data memorisation, to be deleted after 7 days. They persist indefinitely.

Primary finding

CR-A01-087 — retention.staging_ttl_days promises 'scheduled cleanup' that nothing performs

severity Low · reachability default · intent contract-violation · confidence likely · single reviewer · not reproduced (code trace)

What happens. The field description and configuration.md:262 say staging dirs are retained 'before scheduled cleanup'. No scheduler, TTL sweep or automatic deletion exists. The value is used only by the read-only purge --check-policy report, and removal requires a manual forgelm purge --run-id --kind staging.

Where.

• docs/reference/configuration.md:263
• forgelm/config.py:1559-1567
• forgelm/cli/subcommands/_purge.py:1220

Evidence.

• rg staging_ttl_days over forgelm/ finds only config.py, the wizard and _purge.py's report-only scan.

Recommended fix. Reword the docs to say the TTL is reported by purge --check-policy and cleared with purge --kind staging, or implement the sweep.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

DOC-D3B02-013 — docs/usermanuals/en/compliance/human-oversight.md: false claim — retention.staging_ttl_days wires into the GDPR Article 17 retention pipeline, "which physically prunes the directory after the confi…

severity High

Where. docs/usermanuals/en/compliance/human-oversight.md:102 (Turkish mirror: docs/usermanuals/tr/compliance/human-oversight.md:102) · type: false claim

The document says. retention.staging_ttl_days wires into the GDPR Article 17 retention pipeline, "which physically prunes the directory after the configured horizon".

What the code does. No code prunes staging directories. staging_ttl_days is read only by forgelm purge --check-policy, a read-only report that exits 0. A staging dir is removed only by an explicit forgelm purge --run-id <id> --kind staging. The schema description still promises "scheduled cleanup". retention.enforce is not read anywhere outside config.py.

Code references. forgelm/config.py:1559-1566, forgelm/cli/subcommands/_purge.py:1108-1235, forgelm/cli/subcommands/_purge.py:821-950

User impact. Rejected or abandoned staged models, possibly trained on personal data, stay on disk indefinitely while operators believe they expire.

Proposed correction. Code fix (see rationale). Doc text until then: "retention.staging_ttl_days is reported by forgelm purge --check-policy; ForgeLM does not delete staging directories automatically — run forgelm purge --run-id <id> --kind staging for each expired run."

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}