GDPR page claims data_audit_report.json has per-row source attribution and a SHA-256 tamper-evidence manifest; it has neither (CR-A11-016) #390

Wave 1 · theme D1-4: Data audit, PII/secret detection and ingestion · highest severity High · 1 finding(s) · effort trivial

Summary

A regulator asks which document a row came from or whether the report was altered. data_audit_report.json holds no such field and no hash, contrary to the manual.

Primary finding

CR-A11-016 — GDPR page claims data_audit_report.json has per-row source attribution and a SHA-256 tamper-evidence manifest; it has neither

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. gdpr.md (EN and TR) lists, as Art. 5(2) accountability evidence, 'Source attribution (which document each row came from)' and 'SHA-256 manifest for tamper-evidence' in data_audit_report.json. The AuditReport schema has neither. Ingested JSONL rows carry only text, so no row-to-document link exists to report. Operators relying on this for a regulator answer would be overstating their evidence.

Where.

• docs/usermanuals/en/compliance/gdpr.md:40-43
• docs/usermanuals/tr/compliance/gdpr.md:43-46
• forgelm/data_audit/_types.py:122-152
• forgelm/ingestion.py:2143
• forgelm/data_audit/_orchestrator.py:475-494

Evidence.

• tmp/a review run/a1-W78/audit: ingest of alpha.txt + beta.md -> rows {"text"} only. The audit report has no 'sha256' string and no source file names.

Recommended fix. Either remove the two bullets (EN+TR) or implement them: an optional per-row source field in ingest and a report digest or manifest. Doc fix is the minimal change.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}