docs/design/iso27001_soc2_alignment.md: wrong detail — §2: forgelm verify-audit → 'exit 0/1/2/3'; forgelm verify-integrity → 'exit 0/1/2'. (DOC-D2B03-005) #183

Wave 1 · theme D1-10: Documentation-only fixes · highest severity High · 1 finding(s) · effort docs fix

Summary

Deployers wiring alarms from this inventory would watch for 3 and miss 6, the documented tamper signal.

Primary finding

DOC-D2B03-005 — docs/design/iso27001_soc2_alignment.md: wrong detail — §2: forgelm verify-audit → 'exit 0/1/2/3'; forgelm verify-integrity → 'exit 0/1/2'.

severity High · already tracked: KNOWN-OPEN C31-EXIT-CODE-PROSE — docs/roadmap/phase-16-trust-surface-hardening.md:782-784

Where. docs/design/iso27001_soc2_alignment.md:105,126 · type: wrong detail

The document says. §2: forgelm verify-audit → 'exit 0/1/2/3'; forgelm verify-integrity → 'exit 0/1/2'.

What the code does. verify-audit exits 0 (intact), 1 (not found / empty / usage), 2 (unreadable) or 6 (chain, HMAC or manifest integrity failure, or non-UTF-8 body); it never exits 3. verify-integrity exits 0, 1, 2 or 6, with 6 for any changed, removed or added artefact. Exit 6 is the public tamper signal.

Code references. forgelm/cli/subcommands/_verify_audit.py:124-149, forgelm/compliance.py:113-119, forgelm/cli/subcommands/_verify_integrity.py:19-35, forgelm/cli/subcommands/_verify_integrity.py:157

User impact. Deployers wiring alarms from this inventory would watch for 3 and miss 6, the documented tamper signal.

Proposed correction. verify-audit: "exit 0/1/2/6 (6 = tampering or corruption detected), JSON envelope"; verify-integrity: "exit 0/1/2/6 (6 = artefact changed, removed or added), JSON envelope".

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}