TR mirror drift in docs/usermanuals/en/operations/cicd.md: GitLab audit job: forgelm audit data/train.jsonl --output-format json | jq -e '.verdict != "errors" and .pii_summary.severity != "high"' (… (DOC-TR15-001) #357

Wave 1 · theme D1-10: Documentation-only fixes · highest severity High · 1 finding(s) · effort docs fix

Summary

TR is structurally safer (the audit exit code 3 on critical secrets/PII is not masked by the pipe; GitLab aborts on the first failing script line). But BOTH keep a jq predicate on keys the audit JSON does not have (.verdict absent; .pii_summary is a type->count map, severity lives in .pii_severity.worst_tier; cli/subcommands/_audit.py:242-309), so the jq test is always true (null != "errors"). GitHub (en/tr:49) and Jenkins (en:124/tr:125) still use the pipe form without pipefail.

Primary finding

DOC-TR15-001 — TR mirror drift in docs/usermanuals/en/operations/cicd.md: GitLab audit job: forgelm audit data/train.jsonl --output-format json | jq -e '.verdict != "errors" and .pii_summary.severity != "high"' (…

severity High

Where. EN docs/usermanuals/en/operations/cicd.md:87 · TR docs/usermanuals/tr/operations/cicd.md:87-88

English text. GitLab audit job: forgelm audit data/train.jsonl --output-format json | jq -e '.verdict != "errors" and .pii_summary.severity != "high"' (single piped line).

Turkish text. GitLab audit job split into forgelm audit … --output-format json > audit.json then jq -e '…' audit.json.

Which is correct. TR is structurally safer (the audit exit code 3 on critical secrets/PII is not masked by the pipe; GitLab aborts on the first failing script line). But BOTH keep a jq predicate on keys the audit JSON does not have (.verdict absent; .pii_summary is a type->count map, severity lives in .pii_severity.worst_tier; cli/subcommands/_audit.py:242-309), so the jq test is always true (null != "errors"). Gi…

Proposed correction (Turkish text for the -tr page). Her üç sistemde de denetimi dosyaya yazıp çıkış kodunu koruyun ve doğru anahtarlarla sınayın: forgelm audit data/train.jsonl --output-format json > audit.json ardından jq -e '.success == true and .pii_gate.status != "failed" and .secrets_gate.status != "failed"' audit.json. forgelm audit kritik sır/PII bulursa zaten exit 3 verir; pipe kullanılacaksa set -o pipefail ekleyin.

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}