Croissant card is documented as mlcroissant-validated but omits FileObject checksums and the dct:conformsTo context mapping (CR-A11-028) #366

Wave 1 · theme D1-11: Other high-severity packages · highest severity High · 4 finding(s) · effort small

Summary

An operator publishes the card relying on the documented conformance, and mlcroissant validate rejects it (missing sha256/md5) or misreads the version.

Primary finding

CR-A11-028 — Croissant card is documented as mlcroissant-validated but omits FileObject checksums and the dct:conformsTo context mapping

severity Medium · reachability documented-opt-in · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. _build_croissant_metadata (forgelm/data_audit/_croissant.py:138-147) emits cr:FileObject entries without sha256/md5 (an error in mlcroissant), and _CROISSANT_CONTEXT (:43-77) lacks dct and conformsTo, so conformsTo expands under @​vocab to schema.org; the docs claim the card was validated with mlcroissant.

Where.

• forgelm/data_audit/_croissant.py:43-77 (confirmed)
• forgelm/data_audit/_croissant.py:138-147 (confirmed)
• forgelm/data_audit/_croissant.py:128-131
• docs/guides/data_audit.md:479-482
• forgelm/data_audit/_croissant.py:208-229
• docs/usermanuals/en/data/croissant-card.md:61-88

Evidence.

• Static reading only. mlcroissant is not installed in any lane (snapshot, extras, latest, lower) and the network is forbidden, so validation could not be run.
• Reproduced the card via audit_dataset(emit_croissant=True): FileObject keys are @​type, @​id, name, contentUrl, encodingFormat and description only; url == 'd_jsonl'. Programmatic context diff against docs/croissant-spec-1.0.md Appendix 1 shows missing = [citeAs, column, conformsTo, dct, examples, fileSet, md5, rai] and no value mismatches. mlcroissant sources fetched from GitHub tags v1.0.8, v1.0.22 and v1.1.0.

Recommended fix. Compute sha256 per split file (the audit already streams it), add the dct context terms, dedup split and file @​ids, and add a test that runs mlcroissant when it is installed. Otherwise soften the conformance claim.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

TECH-T06-007 — Data-audit methods: Croissant card conformance (JSON-LD context, required properties) (incorrect-claim)

severity Next release

Item. Croissant card conformance (JSON-LD context, required properties) · verdict: incorrect-claim · urgency: Next release

State in ForgeLM. forgelm/data_audit/_croissant.py:43-77 sets '@​vocab': 'https://schema.org/' and defines neither a 'dct' prefix nor a 'conformsTo': 'dct:conformsTo' alias. The card omits license and creator (croissant-card.md:72-77). _croissant.py:5-7 says the subset is 'valid against the spec', and _croissant.py:98-99 calls license optional. docs/usermanuals/en/data/croissant-card.md:83-86 says the card is conformant and has been 'validated against' mlcroissant validate and the HF datasets parser.

State of the ecosystem on 2026-10-01. The Croissant 1.0 'Required' table lists @​context, @​type, dct:conformsTo, description, license, name, url, creator and datePublished, and the Appendix 1 context maps 'conformsTo': 'dct:conformsTo' with dct = http://purl.org/dc/terms/. The 1.1 spec keeps both. JSON-LD 1.1 (W3C Recommendation 2020-07-16) says '@​vocab Used to expand properties ... with a common prefix IRI', so an unmapped 'conformsTo' expands to https://schema.org/conformsTo. mlcroissant 1.1.0 expands the document with its own @​context through rdflib (json_ld.py), reads conforms_to from DCTERMS_CONFORMS_TO (metadata.py), and returns V_0_8 without any error when that value is empty (context.py). In mlcroissant, license only triggers an optional-property check.

Impact. A JSON-LD consumer will not see ForgeLM's version declaration, and mlcroissant would silently treat the card as Croissant 0.8. The required license and creator are missing. The documented 'validated against mlcroissant' claim is unsupported. mlcroissant could not be run (not installed, pip not permitted), so this was established by reading the spec and the source; repro_needs: mlcroissant.

Recommendation. Add "dct": "http://purl.org/dc/terms/" and "conformsTo": "dct:conformsTo" (ideally copying the spec's Appendix 1 context in full) to _CROISSANT_CONTEXT. Emit license and creator placeholders, or say the card is not conformant until hand-edited. Add a CI test that runs mlcroissant validate on a generated card. Fix croissant-card.md:83-86 and _croissant.py:5-7 and :98-99.

Sources.

• Croissant Format Specification Version 1.0 (Published 2024/03/01): Required properties, Appendix 1 context (2024-03-01)
• Croissant Format Specification 1.1 (dct:conformsTo required; context appendix) (2026-01-29)
• mlcroissant v1.1.0 metadata.py (conforms_to url=DCTERMS_CONFORMS_TO) (2026-04-16)
• mlcroissant v1.1.0 json_ld.py (expand_jsonld via rdflib) (2026-04-16)
• JSON-LD 1.1, W3C Recommendation 16 July 2020 (@vocab default vocabulary) (2020-07-16)

DOC-D3B07-006 — docs/usermanuals/en/data/croissant-card.md: misleading — The audit report already carries every signal an EU AI Act Article 10 reviewer needs

severity High · already tracked: KNOWN-OPEN DOCS-06 docs/roadmap/phase-16-trust-surface-hardening.md:747,853-857

Where. docs/usermanuals/en/data/croissant-card.md:8 (Turkish mirror: docs/usermanuals/tr/data/croissant-card.md:8) · type: misleading

The document says. The audit report already carries every signal an EU AI Act Article 10 reviewer needs

What the code does. The report covers PII/secrets/dedup/leakage/quality/language counts. It has no bias examination or representativeness analysis, which Art. 10 data governance also covers.

Code references. forgelm/data_audit/_types.py:122-152

User impact. Overstates compliance coverage, so users may skip the remaining Art. 10 work.

Proposed correction. The audit report carries several Article 10 data-quality signals (PII counts, secrets summary, near-duplicates, cross-split leakage, language distribution); it is not a complete Article 10 assessment.

Turkish mirror. the Turkish page has the same error; fix both in the same PR

DOC-BLEGAL-125 — docs/usermanuals/en/data/croissant-card.md: false claim — [IS-T06-05] 'The emitted card is conformant against the canonical Croissant 1.0 spec. It's been validated against: The Croissant validator (`…

severity Medium

Where. docs/usermanuals/en/data/croissant-card.md:83-86 (Turkish mirror: docs/usermanuals/tr/data/croissant-card.md:83-86) · type: false claim

The document says. [IS-T06-05] 'The emitted card is conformant against the canonical Croissant 1.0 spec. It's been validated against: The Croissant validator (mlcroissant validate). HuggingFace's dataset card parser'

What the code does. The Croissant 1.0 Required table lists @​context, @​type, dct:conformsTo, description, license, name, url, creator and datePublished, and its context maps conformsTo to dct:conformsTo. ForgeLM's @​context (forgelm/data_audit/_croissant.py:43-77) does not map it, so under @​vocab it expands to schema.org/conformsTo. mlcroissant 1.1.0 reads that as missing and falls back to version 0.8. The card also omits license and creator.

User impact. Operators publish dataset cards as Croissant 1.0-conformant evidence when they are not.

Proposed correction. Remove the conformance and validation claim until the @​context maps conformsTo to dct:conformsTo and the card carries license and creator; then state the mlcroissant version actually validated against.

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}