[Wave 3] Medium — Security-contract fixes: Lost safety settings and footguns #644

Wave 3 · 2 finding(s) in 2 fix package(s). Medium-severity findings that touch the security contract (exit codes, secrets, paths, provenance): do these before the rest of wave 3.

Findings

• CR-A01-060 (code, Medium) — Root model.trust_remote_code opt-in follows the pipeline model swap: --input-model (Hub repo or third-party local dir) and adapter-named bases run their bundled code
  severity Medium · reachability documented-opt-in · intent intended-but-harmful · confidence confirmed · independently confirmed · reproduced end to end
  Failure scenario. Base model X needs trust_remote_code, so the root sets it to true. An operator re-runs one stage with --input-model on a third-party checkpoint, a Hub repo or a downloaded directory. That checkpoint's modeling_*.py runs with the training host's credentials (HF token, FORGELM_AUDIT_SECRET in env). Nothing in the --input-model docs says the opt-in applies to the new source, and the only warning is the generic 'trust_remote_code is ENABLED'.
  Where. forgelm/config.py:2224-2229, forgelm/model.py:567-585, forgelm/model.py:573-585, docs/guides/pipeline.md:105
  Recommended fix. Do not carry trust_remote_code across a name_or_path swap. Require an explicit opt-in (for example a stage model block, or --input-model-trust-remote-code), or at least log a WARNING that names the new source. Document the carry-over beside --input-model. Qualify the ISO 27001 A.8.4 claim for local and pipeline sources.

• CR-A14-033 (code, Medium) — Reconfiguring the webhook on --wizard-start-from silently drops require_https, tls_ca_bundle, allow_private_destinations and timeout, and resets url_env and the notify flags
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end · already tracked: KNOWN-OPEN CLI-09 — docs/roadmap/phase-16-trust-surface-hardening.md:502-503,512-513 (S7 open; unit id inferred)
  Failure scenario. A regulated deployment has webhook.require_https: true and url_env: MY_HOOK. The operator reruns the wizard to change one training knob, answers 'y' at the webhook gate to keep notifications, and presses Enter. The saved YAML reads FORGELM_WEBHOOK_URL (unset in CI), so all failure and approval notifications stop silently. If that variable is later set to an http:// endpoint, payloads are sent in cleartext where they were previously refused. Exit 0 and validation pass.
  Where. forgelm/wizard/_collectors.py:254-259, forgelm/wizard/_collectors.py:264-269, forgelm/wizard/_orchestrator.py:761-763, forgelm/webhook.py:172
  Recommended fix. Give collect_webhook_config an existing= argument. Default the URL prompt to 'env:' or the existing url, seed the notify* defaults from it, carry every non-prompted field (require_https, tls_ca_bundle, allow_private_destinations, timeout) through with setdefault, and fix the notify_on_start comment.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}