[Wave 4] Low/info — Module sweep: Compliance core: Annex IV, audit log, integrity manifest, provenance (part 5/5) #660

Wave 4 · 4 finding(s) in 4 fix package(s). Fix these whenever a pull request touches this module ("clean the module you touch").

Findings

• CR-A07-149 (code, Info) — The audit HMAC key is bound at AuditLogger construction, not 'at emit time' as documented
  severity Info · reachability undocumented · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end
  Failure scenario. An operator in a long-lived process or notebook rotates FORGELM_AUDIT_SECRET mid-run, expecting new entries to use the new key. Verification with the new secret then fails for the whole chain.
  Where. forgelm/compliance.py:238-260, docs/guides/iso_soc2_deployer_guide.md:52-57
  Recommended fix. Say 'bound to the secret in effect when the run's AuditLogger was created'.

• CR-A07-150 (code, Info) — A non-object stage row is reported twice in the pipeline violations list
  severity Info · reachability default · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end
  Failure scenario. An auditor counting violations in the JSON envelope sees two defects for one malformed row.
  Where. forgelm/compliance.py:2105-2108, forgelm/verify/_pipeline_evidence.py:451-455, forgelm/verify/_pipeline_evidence.py:614-616
  Recommended fix. Emit the type violation in one place only, for example drop the append at _pipeline_evidence.py:453 and keep record_stage.

• CR-A07-151 (code, Info) — AuditLogger chain-head read doubles its window up to the full length of an oversized last line, costing about 2x the line in I/O and 5.5x in RSS on every purge/approve/reject start
  severity Info · reachability default · intent intended-and-acceptable · confidence likely · independently confirmed · reproduced end to end
  Failure scenario. An audit log whose last line is very large makes every command that opens an AuditLogger allocate several times that line before doing anything.
  Where. forgelm/compliance.py:262-331
  Recommended fix. Hash the last line incrementally by reading backwards in fixed blocks to the previous newline and feeding sha256 chunk by chunk: memory O(block) instead of about 5x the line, one pass instead of window doubling (about 2x less I/O).

• CR-A07-152 (code, Info) — RTP risk matrix applies L x I inconsistently (Med x Low is MED for R-01 but LOW for R-07), and sections 2 and 5 disagree on which residuals need acceptance; R-01 (residual MED) has no acceptance row
  severity Info · reachability unreachable · intent contract-violation · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. A deployer following section 5 leaves a MED residual (R-01) unaccepted. One following section 2 does not see the conflict. An ISO 27001 auditor finds the methodology applied inconsistently.
  Where. docs/qms/risk_treatment_plan.md:31, docs/qms/risk_treatment_plan.md:49, docs/qms/risk_treatment_plan.md:115, docs/qms/risk_treatment_plan.md:191
  Recommended fix. Publish an explicit L x I lookup table, re-score R-01 or R-07 against it, align sections 2 and 5 on one acceptance threshold, and add any MED residual to the log, in EN and TR.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}