Incident-response SOP's 'Isolate' step (chmod 0500 on <output_dir>) does not stop writes to existing evidence files, subdirectories or open handles (F-W1-DOCS-TRUST-18) #881

Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix

Summary

During an audit-chain incident the runbook tells responders to run chmod 0500 on the output directory "to prevent further writes". A directory's mode only controls creating, renaming and deleting entries in that one directory. The owner can still append to audit_log.jsonl, the files under final_model/ and compliance/ keep their own modes, and processes that already hold a file open keep writing. The runbook calls the evidence isolated while it can still change.

Primary finding

F-W1-DOCS-TRUST-18 — The incident isolation command does not make existing evidence files read-only

severity Medium · confidence high · POSIX permission semantics; no evidence files were modified

What happens. Runbook step 1 in docs/qms/sop_incident_response.md:109-110 (Turkish mirror docs/qms/sop_incident_response-tr.md:108-109). ForgeLM's audit logger opens audit_log.jsonl in append mode for every event (forgelm/compliance.py:548), so the file's own permission bits — not the directory's — decide whether a write succeeds. A non-recursive chmod leaves subdirectories as they were, open descriptors are not re-checked, and privileged users ignore mode bits.

Where.

• docs/qms/sop_incident_response.md:109-110
• docs/qms/sop_incident_response-tr.md:108-109
• forgelm/compliance.py:548 (audit log opened in append mode for each event)

Evidence (re-verified on 2026-10-09).

• POSIX: write permission on a directory governs adding, removing and renaming its entries; writing to an existing file is governed by that file's own permissions (https://pubs.opengroup.org/onlinepubs/9799919799/functions/open.html).
• Both runbook pages are unchanged on development.

Recommended fix. Replace the one-command guarantee with a procedure: stop every writer first (running training or pipeline jobs, schedulers and CI jobs that use the directory); take a forensic copy or storage snapshot that preserves metadata (for example cp -a or rsync -a), including audit_log.jsonl, its .manifest.json sidecar and the compliance and model directories; record SHA-256 hashes of the copy; move it to read-only or write-once storage. State the point at which the evidence becomes immutable. If a permission change stays as an extra step, make it recursive on files and directories and say that it does not stop open handles or privileged users.

Acceptance criteria

• Neither runbook claims that a directory chmod prevents further writes.
• The procedure stops writers before preserving evidence, keeps the chain files with their metadata, and names when the evidence becomes immutable.
• The operations owner has walked through the procedure in a test environment with an active writer.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• The finding is resolved or explicitly closed with a reason.

_{Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.}