TR mirror drift in docs/guides/iso_soc2_deployer_guide.md: audit_log.jsonl append-only with HMAC + SHA-256 hash chain + genesis manifest sidecar (out of the box) (DOC-TR08-007) #321

Wave 1 · theme D1-10: Documentation-only fixes · highest severity High · 1 finding(s) · effort docs fix

Summary

Neither: HMAC only when FORGELM_AUDIT_SECRET is set; the SHA-256 chain is default.

Primary finding

DOC-TR08-007 — TR mirror drift in docs/guides/iso_soc2_deployer_guide.md: audit_log.jsonl append-only with HMAC + SHA-256 hash chain + genesis manifest sidecar (out of the box)

severity High

Where. EN docs/guides/iso_soc2_deployer_guide.md:23-25 · TR docs/guides/iso_soc2_deployer_guide-tr.md:23-25

English text. audit_log.jsonl append-only with HMAC + SHA-256 hash chain + genesis manifest sidecar (out of the box)

Turkish text. append-only HMAC + SHA-256 hash chain + genesis manifest sidecar

Which is correct. Neither: HMAC only when FORGELM_AUDIT_SECRET is set; the SHA-256 chain is default.

Proposed correction (Turkish text for the -tr page). append-only SHA-256 hash chain + genesis manifest sidecar; FORGELM_AUDIT_SECRET tanımlıysa satır başına HMAC de eklenir (tanımlı değilse zincir yalnız hash'tir, kasıtlı yeniden imzalamaya karşı korumaz).

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}