Audit-gate remediation tells operators to scrub a JSONL with forgelm ingest, which cannot read JSONL: exit 0, empty output, false 'no credentials detected' note, and the next au… (CR-A11-021) #394

Wave 1 · theme D1-4: Data audit, PII/secret detection and ingestion · highest severity High · 1 finding(s) · effort small

Summary

The secrets and PII gate messages, the README and three guides all say to fix a flagged corpus with forgelm ingest --secrets-mask / --pii-mask. The corpus those gates run on is a JSONL, and ingest supports only PDF/DOCX/EPUB/TXT/MD. Following the advice literally skips the file, exits 0, promotes a 0-byte JSONL over --output, and prints 'Secrets masking enabled — no credentials detected in this corpus'. Re-auditing the empty output exits 0 with 0 samples, so the exit-3 gate is cleared. With --output equal to the input path, the operator's dataset is erased. The single-file-unsupported-extension and empty-output behaviours are already reported; the new evidence is that the project's own remediation text sends the operator onto that path, and the misleading 'no credentials detected' note. The working alternative (the mask_secrets helper) is documented in data_audit.md:340 but not in the gate message.

Primary finding

CR-A11-021 — Audit-gate remediation tells operators to scrub a JSONL with forgelm ingest, which cannot read JSONL: exit 0, empty output, false 'no credentials detected' note, and the next audit passes

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. The secrets and PII gate messages, the README and three guides all say to fix a flagged corpus with forgelm ingest --secrets-mask / --pii-mask. The corpus those gates run on is a JSONL, and ingest supports only PDF/DOCX/EPUB/TXT/MD. Following the advice literally skips the file, exits 0, promotes a 0-byte JSONL over --output, and prints 'Secrets masking enabled — no credentials detected in this corpus'. Re-auditing the empty output exits 0 with 0 samples, so the exit-3 gate is cleared. With --output equal to the input path, the operator's dataset is erased. The single-file-unsupported-extension and empty-output behaviours are already reported; the new evidence is that the project's own remediation text sends the operator onto that path, and the misleading 'no credentials detected' note. The working alternative (the mask_secrets helper) is documented in data_audit.md:340 but not in the gate message.

Where.

• forgelm/cli/subcommands/_audit.py:86-95
• forgelm/cli/subcommands/_audit.py:146-155
• forgelm/data_audit/_summary.py:97-99
• forgelm/data_audit/_summary.py:135-138
• forgelm/ingestion.py:2537-2548
• README.md:135-140
• docs/guides/data_audit.md:129
• docs/guides/data_audit.md:170-175
• docs/usermanuals/en/data/secrets.md:76-81
• forgelm/ingestion.py:60

Evidence.

• Ran in the private snapshot copy. forgelm audit fx/c.jsonl printed the ERROR 'Scrub it with forgelm ingest --secrets-mask' and exited 3. forgelm ingest fx/c.jsonl --secrets-mask --output out/clean.jsonl exited 0 with 'processed=0 skipped=1', a 0-byte out/clean.jsonl and the note 'Secrets masking enabled — no credentials detected in this corpus'. forgelm audit out/clean.jsonl exited 0 with 'Total samples : 0'. forgelm ingest fx/d.jsonl --secrets-mask --output fx/d.jsonl exited 0 and le…

Recommended fix. Change the gate messages and docs to point at a JSONL-capable path (the mask_secrets/mask_pii helpers, or a new JSONL mode). Make the secrets note reflect 0 files processed.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}