[Triage] README.md: false denial — N-10: Integrity manifest and audit log are not keyed without FORGELM_AUDIT_SECRET; editing the last log line leaves the chain self-consistent (DOC-D4B01-032) #834

Needs triage. Reviewers disagreed on this finding, so it is not counted in the backlog. Decide whether it is a real defect: if yes, set severity and wave; if not, close it with the reason.

DOC-D4B01-032 — README.md: false denial — N-10: Integrity manifest and audit log are not keyed without FORGELM_AUDIT_SECRET; editing the last log line leaves the chain self-consistent

severity High · confidence disputed

Where. README.md:120 · type: false denial

The document says. N-10: Integrity manifest and audit log are not keyed without FORGELM_AUDIT_SECRET; editing the last log line leaves the chain self-consistent

What the code does. The audit log is HMAC'd only when FORGELM_AUDIT_SECRET is set (compliance.py:238-260,575-579), so the negative holds for the log. 'Neither is keyed unless you set FORGELM_AUDIT_SECRET' and the advice to 'set the secret' are false for model_integrity.json, which is never keyed. generate_model_integrity (compliance.py:760-818) and the trainer writer (trainer.py:2157-2167) use no secret or HMAC, and the model.integrity_verified audit event records only an artifact count. forgelm/verify/_model_integrity.py has no HMAC path. The manifest can be re-stamped even with the secret set.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}