Browser wizard: the Compliance step throws ReferenceError (appendDetail is not in scope), so risk-assessment, benchmark and judge controls never render (F-W1-SITE-01) #879

Wave 1 · theme D1-11: Other high-severity packages · highest severity High · 1 finding(s) · effort small

Summary

Every visit to the in-browser config wizard's Compliance step throws ReferenceError: appendDetail is not defined. The Article 9 risk-assessment textareas and the benchmark and LLM-judge controls never render, and the step counter, YAML preview and saved state stop updating for that step. A user who picks the high-risk tier cannot fill the required risk fields, so the step's own validation can never pass through the UI.

Primary finding

F-W1-SITE-01 — The Compliance step of the browser wizard throws before it renders its risk and evaluation controls

severity High (rated Medium by the source review; raised here because it blocks the high-risk path for every visitor) · confidence high · re-verified by static scope analysis

What happens. makeRequiredTextarea, defined inside STEP_RENDERERS['compliance'], calls appendDetail (site/js/wizard.js:2379), and the same renderer calls it again for the vulnerable-groups row (:2421), the benchmark toggle (:2448) and the judge toggle (:2520). appendDetail is declared only as a local function inside three other renderers — dataset (:1701), training (:1807) and operations (:2617) — so it is not in scope in the compliance renderer, and no other script under site/js/ defines it. makeAccordion runs its buildBody callback eagerly, even for a collapsed accordion (site/js/wizard.js:1406), and the risk-assessment accordion is created for every risk tier (site/js/wizard.js:2342), so the error fires on every visit. render() (site/js/wizard.js:1055-1101) has no try/catch: the exception aborts the rest of the step and skips the counter, YAML-preview and persist work that follows the renderer call.

Where.

• site/js/wizard.js:2379 (call inside makeRequiredTextarea, compliance renderer)
• site/js/wizard.js:2421 (vulnerable-groups row)
• site/js/wizard.js:2448 (benchmark toggle)
• site/js/wizard.js:2520 (judge toggle)
• site/js/wizard.js:1701 (declaration inside the dataset renderer)
• site/js/wizard.js:1807 (declaration inside the training renderer)
• site/js/wizard.js:2617 (declaration inside the operations renderer)
• site/js/wizard.js:1406 (makeAccordion builds the body eagerly)
• site/js/wizard.js:1055-1101 (render() without try/catch)

Evidence (re-verified on 2026-10-09).

• Brace-matched scope analysis of site/js/wizard.js: the three appendDetail declarations sit in the blocks of STEP_RENDERERS['dataset'] (lines 1620-1791), ['training'] (1794-2163) and ['operations'] (2604-2938). The four calls at 2379, 2421, 2448 and 2520 lie inside STEP_RENDERERS['compliance'] (2166-2603), where none of the declarations is visible.
• appendDetail appears in no other file under site/js/ or site/*.html.
• The source review executed the unmodified renderers in a DOM emulator: entering the Compliance step raised ReferenceError: appendDetail is not defined and the step counter stayed on the previous step; a low-risk configuration could still advance, a high-risk one could not satisfy the step's validation.
• The site guards (tools/check_site_claims.py, tools/check_site_chrome_parity.py, tools/check_wizard_defaults_sync.py) check copy, page chrome and defaults; none executes the step renderers, so CI cannot see this.

Recommended fix. Declare appendDetail once at the wizard's shared scope (next to makeAccordion) and delete the three local copies, so every renderer uses the same helper. Add a check that would have caught it: a lint step that fails on undefined identifiers in site/js/ (for example ESLint's no-undef), or a DOM smoke test that renders all nine steps.

Acceptance criteria

• All nine wizard steps render without a console error, in beginner and expert mode and for every risk tier.
• On the Compliance step the three required risk-assessment textareas, the vulnerable-groups row and the benchmark and judge controls render and can be edited, and a high-risk configuration can pass the step's validation.
• The step counter, YAML preview and saved state track the Compliance step.
• A CI check (undefined-identifier lint or a renderer smoke test) fails on the current code and passes after the fix.
• The finding is resolved or explicitly closed with a reason.

_{Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.}