Code does not match site/compliance.html: Article 10: 'Bias detection, PII redaction...'; data_audit_report.json is an 'Article 10 quality/PII/bias scan'. (CR-A11-011) #480

Wave 2 · theme D2-5: Data audit, masking and ingestion: medium effort · highest severity High · 2 finding(s) · effort not estimated

Summary

The document states: Article 10: 'Bias detection, PII redaction...'; data_audit_report.json is an 'Article 10 quality/PII/bias scan'.. Observed in the code: forgelm/data_audit has no bias detector. A grep for 'bias' in forgelm/data_audit/.py finds only a code comment at aggregator.py:240. The only bias-related data is the free-text data.governance.known_biases field that the operator writes, copied into data_governance_report.json (forgelm/compliance.py:654-665). The audit report keys are croissant, cross_split_overlap, near_duplicate_summary, pii, quality_summary, secrets_summary and splits (checked by running forgelm audit).

Primary finding

CR-A11-011 — Code does not match site/compliance.html: Article 10: 'Bias detection, PII redaction...'; data_audit_report.json is an 'Article 10 quality/PII/bias scan'.

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed

What happens. This is a C1 promise (F-053) with no implementation behind it. Implementing bias detection is a feature decision, so the practical remedy is to correct the document.

Where.

• forgelm/data_audit/_types.py:132-150
• forgelm/compliance.py:654-665
• site/compliance.html:149
• site/compliance.html:280
• site/js/translations.js:3855
• site/js/translations.js:3914
• site/js/translations.js:3973
• site/js/translations.js:4016
• site/js/translations.js:4059
• site/js/translations.js:4102

Evidence.

• forgelm/data_audit/_types.py:138-141; forgelm/compliance.py:654-665

Recommended fix. Replace 'Bias detection' with 'Operator-declared known biases (data.governance.known_biases)' and change the tree comment to 'Article 10 quality/PII/secrets/leakage scan'.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

DOC-D4B08-003 — site/compliance.html: false claim — Article 10: 'Bias detection, PII redaction...'; data_audit_report.json is an 'Article 10 quality/PII/bias scan'.

severity High

Where. site/compliance.html:149, site/compliance.html:280; site/js/translations.js:3855 · type: false claim

The document says. Article 10: 'Bias detection, PII redaction...'; data_audit_report.json is an 'Article 10 quality/PII/bias scan'.

What the code does. forgelm/data_audit has no bias detector. A grep for 'bias' in forgelm/data_audit/.py finds only a code comment at aggregator.py:240. The only bias-related data is the free-text data.governance.known_biases field that the operator writes, copied into data_governance_report.json (forgelm/compliance.py:654-665). The audit report keys are croissant, cross_split_overlap, near_duplicate_summary, pii, quality_summary, secrets_summary and splits (checked by running forgelm audit).

Code references. forgelm/data_audit/_types.py:138-141, forgelm/compliance.py:654-665

User impact. Deployers may believe the bias examination of Art. 10(2)(f) is automated and evidenced by ForgeLM, when it is only an operator-declared text field.

Proposed correction. Replace 'Bias detection' with 'Operator-declared known biases (data.governance.known_biases)' and change the tree comment to 'Article 10 quality/PII/secrets/leakage scan'.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}