compliance_summary.md says verify-audit exits 0 or 1 for any failure (stale; tamper is exit 6) (CR-MISC-005) #454

Wave 1 · theme D1-8: Docs describing features that do not exist (doc side of code findings) · highest severity High · 1 finding(s) · effort trivial

Summary

An operator configures CI from compliance_summary.md and alarms only on exit 1, so a real tamper (exit 6) is not handled as documented there.

Primary finding

CR-MISC-005 — compliance_summary.md says verify-audit exits 0 or 1 for any failure (stale; tamper is exit 6)

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end · already tracked: KNOWN-OPEN C31-EXIT-CODE-PROSE (OPS-24) — docs/roadmap/phase-16-trust-surface-hardening.md:196-197,782-785

What happens. docs/reference/compliance_summary.md:240-245 says verify-audit 'exits 0 (valid) or 1 (any failure — parse error, HMAC mismatch, manifest divergence, file not found, option error)'. This contradicts the shipped contract (exit 6 for chain/HMAC/manifest failures, exit 2 for I/O; _verify_audit.py:109-149; verify-audit.md:121-130) and CLAUDE.md's rule to wire alarms to 6. A reader of this reference page would alarm on 1 and treat 6 as unexpected.

Where.

• docs/reference/compliance_summary.md:240-245
• docs/reference/compliance_summary-tr.md:242-247
• forgelm/cli/subcommands/_verify_audit.py:95-105
• forgelm/cli/_exit_codes.py:11-12,39
• forgelm/cli/subcommands/_verify_audit.py:191-268
• forgelm/cli/_dispatch.py:116-117
• forgelm/compliance.py:113-119
• docs/reference/verify_audit.md:23,35
• docs/usermanuals/en/compliance/verify-audit.md

Evidence.

• Dynamic runs show exit 6 for HMAC mismatch and manifest mismatch (audit_repro.py), whereas compliance_summary.md:241-243 lists those under exit 1.

Recommended fix. Update the line (and the TR mirror) to the 0/1/2/6 table from verify-audit.md.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}