Trainer tests fake, patch or skip every real TRL config construction, so TRL/transformers API drift is undetectable (CR-A02-011) #105

Wave 0 · theme D0-7: Dependency ranges and security floors · highest severity High · 1 finding(s) · effort medium

Summary

An operator sets trainer_type orpo, simpo or grpo. The run ends in an ImportError or TypeError after the model and data load, so the documented six-trainer promise is false, yet the CI test suite is green.

Primary finding

CR-A02-011 — Trainer tests fake, patch or skip every real TRL config construction, so TRL/transformers API drift is undetectable

severity High · reachability default · intent intended-but-harmful · confidence confirmed · independently confirmed · reproduced end to end · already tracked: KNOWN-OPEN GAP-03 — docs/roadmap/phase-16-trust-surface-hardening.md:406-409,965-967 (S4 open)

What happens. tests/test_trainer_max_length.py, test_trainer_grpo_config.py and test_trainer_sft_config.py replace the TRL config classes with fakes via patch.object(trl, X, Fake) or skip when ORPOConfig/CPOConfig are missing (test_trainer_max_length.py:52-55), and the integration smoke uses --dry-run, which never builds a TRL config. _build_simple_trl_trainer and the SimPO/ORPO branches have no coverage, so the import, max_prompt_length and warmup_ratio breaks pass CI green.

Where.

• forgelm/trainer.py:687-776 (_get_training_args_for_type; the line numbers 723, 737, 765 are correct)
• forgelm/trainer.py:737
• forgelm/trainer.py:765
• forgelm/trainer.py:1009-1012
• tests/test_trainer_max_length.py:64
• tests/test_trainer_grpo_config.py
• tests/test_trainer_sft_config.py
• tests/test_trainer_max_length.py:43-72 (the preference-trainer test) and :75-97 (the GRPO test)
• tests/test_trainer_max_length.py:92
• tests/test_trainer_grpo_config.py:98

Evidence.

• fpy probe_orpo.py (tmp dir) builds a real ForgeConfig then calls _get_training_args_for_type. main venv trl 1.7.1: sft/dpo/kto OK; orpo ImportError cannot import name 'ORPOConfig'; simpo ImportError 'CPOConfig'; grpo TypeError GRPOConfig.init() got an unexpected keyword argument 'max_prompt_length'. lower trl 1.0.0: same three failures. latest trl 1.14.1: sft/dpo/kto/grpo TypeError unexpected keyword 'warmup_ratio', orpo/simpo ImportError. probe_sig.py: GRPOConfig has no max_prompt_le…
• Private copy, latest venv: pytest -q -p no:randomly -o addopts='' tests/test_trainer*.py tests/test_integration.py tests/test_alignment.py tests/test_grpo*.py -> 251 passed, 2 skipped. Default venv: test_trainer_max_length.py, test_trainer_grpo_config.py and test_alignment.py -> 22 passed, 2 skipped.

Recommended fix. Add at least one test per trainer type that builds the real TRL config object from the real ForgeTrainer kwargs with no fake class (CPU only, tiny output_dir) and fails, not skips, when the class is missing. Replace the skip-on-AttributeError with an assertion that the documented import path exists. Run that test against the lower and latest TRL pins in CI. Assert trainer class and loss-specific kwargs (SimPO cpo_alpha/loss_type) at construction.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.
• The release note names the contract this fix restores.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}