docs/guides/iso_soc2_deployer_guide.md: false claim — evaluation.require_human_approval: true for every high-risk/unacceptable run — 'F-compliance-110 raises ConfigError if you forget.' (DOC-D2B03-003) #90

Wave 0 · theme D0-5: Documented controls that are not implemented · highest severity Critical · 1 finding(s) · effort docs fix

Summary

Operators relying on the claimed guard can run high-risk models through to final_model/ with no Article 14 human-oversight gate and no error.

Primary finding

DOC-D2B03-003 — docs/guides/iso_soc2_deployer_guide.md: false claim — evaluation.require_human_approval: true for every high-risk/unacceptable run — 'F-compliance-110 raises ConfigError if you forget.'

severity Critical

Where. docs/guides/iso_soc2_deployer_guide.md:64-66 (Turkish mirror: docs/guides/iso_soc2_deployer_guide-tr.md:65-68) · type: false claim

The document says. evaluation.require_human_approval: true for every high-risk/unacceptable run — 'F-compliance-110 raises ConfigError if you forget.'

What the code does. F-compliance-110 (_enforce_safety_gate_for_strict_tier, called from _warn_high_risk_compliance) raises ConfigError only when evaluation.safety is disabled. It never checks require_human_approval and does not even warn about it; the only strict-tier warning concerns auto_revert. Reproduced: risk_classification high-risk or unacceptable with safety enabled and require_human_approval=false is accepted.

Code references. forgelm/config.py:1822-1842, forgelm/config.py:1849-1876, forgelm/config.py:1220, review-probe:f110.py

User impact. Operators relying on the claimed guard can run high-risk models through to final_model/ with no Article 14 human-oversight gate and no error.

Proposed correction. "Set evaluation.require_human_approval: true for every risk_classification ∈ {high-risk, unacceptable} run. ForgeLM does NOT enforce this: F-compliance-110 only refuses these tiers when evaluation.safety.enabled is false. Enforce human approval in your config review or a CI policy check."

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.
• The release note names the contract this fix restores.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}