Site, QMS SOP and ISO guide claim 'dual-controlled' model promotion; approve/reject never compare the approver with the trainer (CR-A18-007) #99

Wave 0 · theme D0-5: Documented controls that are not implemented · highest severity High · 1 finding(s) · effort small

Summary

The same user trains and runs forgelm approve, and the promotion succeeds. A SOC 2 reader of the site expects ForgeLM to have prevented it.

Primary finding

CR-A18-007 — Site, QMS SOP and ISO guide claim 'dual-controlled' model promotion; approve/reject never compare the approver with the trainer

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. compliance.art14.body (compliance.html:177) and compliance.iso.change.body (compliance.html:239, translations.js:3863/3880 + locales), docs/qms/sop_change_management.md:107-108 and docs/guides/iso_soc2_deployer_guide.md:28-29,153 say every promotion is dual-controlled. _resolve_approver_identity takes FORGELM_OPERATOR or getpass.getuser() (_approve.py:121-182) and _run_approve_cmd/_run_reject_cmd never compare it with the training operator; human_approval_gate.md:24,150 says segregation of duties is not enforced.

Where.

• site/compliance.html:177 (confirmed)
• site/compliance.html:239 (confirmed)
• site/js/translations.js:3880
• forgelm/cli/subcommands/_approve.py:121-178
• site/js/translations.js:3863
• docs/qms/sop_change_management.md:107-108
• docs/guides/iso_soc2_deployer_guide.md:28-29
• forgelm/cli/subcommands/_approve.py:121-182
• forgelm/cli/subcommands/_approve.py:597-603
• docs/guides/iso_soc2_deployer_guide.md:28 (confirmed)

Evidence.

• In reject_check.py the same identity 'reviewer-bob' started training, requested approval and rejected (rc 0, no warning). No code path compares approver to the training.started operator (grep of _approve.py and _approvals.py).
• No comparison between the training operator and the approver exists in _approve.py; the guide's own gate page lists 'Does not enforce segregation of duties'.

Recommended fix. Replace 'dual-controlled' with 'recorded (separation of duties is a deployer control; see human_approval_gate.md)'.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.
• The release note names the contract this fix restores.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}