Repository navigation
[Triage] site/js/translations.js: false denial — You cannot disable these for high-risk deployments (DOC-D4B09-027) #835
Description
Needs triage. Reviewers disagreed on this finding, so it is not counted in the backlog. Decide whether it is a real defect: if yes, set severity and wave; if not, close it with the reason.
DOC-D4B09-027 — site/js/translations.js: false denial — You cannot disable these for high-risk deployments
severity High · confidence disputed
Where. site/js/translations.js:1690,2085 (wizard.risk.high.callout.body) · type: false denial
The document says. You cannot disable these for high-risk deployments
What the code does. True inside the web wizard (wizard.js:358-362 coerceForRisk). In YAML, config.py:1822-1871 hard-requires only evaluation.safety.enabled for strict tiers: auto_revert only warns, and require_human_approval is not enforced.
Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.
Activity
cemililik commentedon Oct 20, 2026
The sentence is true only inside the in-browser wizard, where the approval and safety toggles are locked (wizard.js coerceForRisk). ForgeLM itself requires evaluation.safety.enabled for high-risk, only warns when auto_revert is off, and does not require require_human_approval; a high-risk YAML with approval disabled passes
--dry-run. The audit log and Annex IV export are not toggles at all.The sentence is unchanged on development in all six locales. The same wording is already tracked as DOC-D4B09-019 in #599, with a proposed rewording that separates what the wizard locks from what the engine enforces; this finding (DOC-D4B09-027) and its locale lines are recorded there. Closing as a duplicate of #599.
Triage round 1, checked against
developmenton 2026-10-20.