User manual claims a per-run compliance bundle manifest.json with SHA-256 over every artifact for tamper-evidence; no such manifest is written (CR-A07-021) #441

Wave 1 · theme D1-8: Docs describing features that do not exist (doc side of code findings) · highest severity High · 1 finding(s) · effort medium

Summary

An operator runs forgelm --config cfg.yaml (exit 0) and hands the bundle to a reviewer, telling them 'every file is hashed in manifest.json'. No manifest exists, so an edit to compliance_report.json or risk_assessment.json is undetectable by any ForgeLM verifier.

Primary finding

CR-A07-021 — User manual claims a per-run compliance bundle manifest.json with SHA-256 over every artifact for tamper-evidence; no such manifest is written

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. first-run.md:170,176 (EN and TR), exit-codes.md:109 ('A run that exits 0 has ... Written manifest.json with SHA-256 over all artifacts') and project-layout.md:131 promise a bundle-level integrity manifest over the compliance evidence directory. export_compliance_artifacts writes six files into <output_dir>/compliance/ and hashes none of them in any manifest. The only hash artefacts are the Annex IV self-hash, model_integrity.json (model weights only) and the audit-log genesis pin. The compliance.artifacts_exported audit event records file names only. An auditor or operator relying on the documented manifest has no integrity check for compliance_report.json, data_provenance.json, risk_assessment.json, training_manifest.yaml or data_governance_report.json. The project's own compliance/overview.md:89 contradicts the claim.

Where.

• docs/usermanuals/en/getting-started/first-run.md:176
• docs/usermanuals/tr/getting-started/first-run.md:176
• docs/usermanuals/en/reference/exit-codes.md:109
• docs/usermanuals/en/getting-started/project-layout.md:131
• forgelm/compliance.py:2137-2291
• forgelm/trainer.py:2087-2142
• forgelm/trainer.py:2143 (compliance.artifacts_exported emit)
• docs/usermanuals/en/compliance/overview.md:~86-90
• docs/usermanuals/en/compliance/overview.md:89
• docs/usermanuals/tr/reference/exit-codes.md:109

Evidence.

• run1: exit 0. find out -type f lists compliance/.json, compliance/training_manifest.yaml, audit_log.jsonl(.manifest.json) and final_model/. There is no manifest.json and no artifacts/ directory. The audit entry compliance.artifacts_exported carries files:[...names] and no hashes.

Recommended fix. Either write a bundle manifest (per-file sha256 over compliance/, ideally HMAC-keyed under FORGELM_AUDIT_SECRET and referenced from the audit chain) with a verifier, or remove the claim from first-run.md (EN and TR), exit-codes.md, project-layout.md and gdpr.md:47 and point readers at overview.md:89.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}