[Wave 3] Medium — TR mirror: docs/qms/ #637

Wave 3 · 5 finding(s) in 5 fix package(s). Mirror drift across small document pairs in this directory.

Findings

• DOC-TR04-012 (TR mirror, Medium) — TR mirror drift in docs/qms/README.md: benchmark_results.json, safety_results.json | Automatic per run
  severity Medium
  Where. EN docs/qms/README.md:39 · TR docs/qms/README-tr.md:39
  English text. benchmark_results.json, safety_results.json | Automatic per run
  Turkish text. benchmark_results.json, safety_results.json | Koşum başına otomatik
  Which is correct. Neither. benchmark_results.json is written only by the benchmark step (forgelm/benchmark.py:109-111) and safety_results.json only by the safety step (forgelm/safety/_results.py:106). Both are opt-in evaluation blocks, so they are not produced on every run. The Turkish text repeats the English error.
  Proposed correction (Turkish text for the -tr page). | Değerlendirme kanıtı | benchmark_results.json, safety_results.json | Yalnızca ilgili değerlendirme (benchmark / safety) config'te etkinse üretilir |

• DOC-TR04-013 (TR mirror, Medium) — TR mirror drift in docs/qms/access_control.md: Operator id propagated to webhook payload; 'Every payload carries the FORGELM_OPERATOR identity so the receiving system can attribute the notification'
  severity Medium
  Where. EN docs/qms/access_control.md:28,233-235,243-245 · TR docs/qms/access_control-tr.md:29,235,244-245
  English text. Operator id propagated to webhook payload; 'Every payload carries the FORGELM_OPERATOR identity so the receiving system can attribute the notification'
  Turkish text. Webhook lifecycle olayları | Operatör id webhook payload'a yayılır; 'Her payload FORGELM_OPERATOR kimliğini taşır böylece alıcı sistem ... bildirimi attribute edebilir'
  Which is correct. Neither. WebhookNotifier payloads (forgelm/webhook.py, event=training.start|success|failure|reverted, approval.required, pipeline.*) contain no operator field. The curated payload carries run name, status, metrics or reason only. The operator exists only in audit events.
  Proposed correction (Turkish text for the -tr page). Satır 29: '| Webhook lifecycle olayları | Webhook payload'ı operatör kimliğini TAŞIMAZ; atıf yalnız audit-log girişlerindeki operatör alanıyla yapılır |'. §7 son cümle: 'Webhook payload'ları kasıtlı olarak kürate edilir ve FORGELM_OPERATOR kimliğini içermez; alıcı sistemde atıf için run adı ile audit log çapraz-referanslanmalıdır.' §7 (b) maddesi ('curated payload içinde taşınan FORGELM_OPERATOR kimliği') de kaldırılmalı.

• DOC-TR04-014 (TR mirror, Medium) — TR mirror drift in docs/qms/access_control.md: The webhook wire-format event vocabulary (5 events) is training.start, training.success, training.failure, training.reverted, approval.required
  severity Medium
  Where. EN docs/qms/access_control.md:237-243 · TR docs/qms/access_control-tr.md:239-246
  English text. The webhook wire-format event vocabulary (5 events) is training.start, training.success, training.failure, training.reverted, approval.required
  Turkish text. Webhook wire-format olay sözlüğü (5 olay): training.start, training.success, training.failure, training.reverted, approval.required — Phase 8
  Which is correct. Neither. webhook.py also emits pipeline.started, pipeline.completed and pipeline.stage_reverted (notify_pipeline_), so the vocabulary has 8 events. The 5-event list is a Phase-8 snapshot.
  Proposed correction (Turkish text for the -tr page). 'Webhook wire-format olay sözlüğü 8 olaydır: training.start, training.success, training.failure, training.reverted, approval.required ve çok-aşamalı pipeline için pipeline.started, pipeline.completed, pipeline.stage_reverted.' notify_ metot listesine notify_pipeline_started / notify_pipeline_completed / notify_pipeline_reverted da eklenmeli.

• DOC-TR04-015 (TR mirror, Medium) — TR mirror drift in docs/qms/encryption_at_rest.md: once .manifest.json is signed over a specific byte range, any encryption that perturbs that range breaks forgelm verify-audit
  severity Medium
  Where. EN docs/qms/encryption_at_rest.md:102-104 · TR docs/qms/encryption_at_rest-tr.md:104-106
  English text. once .manifest.json is signed over a specific byte range, any encryption that perturbs that range breaks forgelm verify-audit
  Turkish text. .manifest.json belirli bir bayt aralığı üzerinde imzalandıktan sonra, o aralığı bozan herhangi bir şifreleme forgelm verify-audit'i bozar
  Which is correct. Neither. The manifest is not signed. It pins first_entry_sha256 and run_id (compliance.py:443-460, :2479). verify-audit breaks because the per-line prev_hash chain is computed over the exact serialized bytes, not because of a signed byte range.
  Proposed correction (Turkish text for the -tr page). '.manifest.json ilk girişin SHA-256 hash'ini (genesis pin) saklar ve zincirdeki her satır önceki satırın bayt-bazlı hash'ini taşıdığından, baytları yeniden sıralayan/yeniden çerçeveleyen herhangi bir şifreleme forgelm verify-audit'i bozar.'

• DOC-TR04-016 (TR mirror, Medium) — TR mirror drift in docs/qms/encryption_at_rest.md: The forgelm --compliance-export ZIP aggregates every artefact above into one file ... Receipt confirmation logged back into the audit chain via c… severity **Medium** **Where.** EN [docs/qms/encryption_at_rest.md:182-191](https://github.com/HodeTech/ForgeLM/blob/cab2947/docs/qms/encryption_at_rest.md#L182-L191) · TR [docs/qms/encryption_at_rest-tr.md:190-200](https://github.com/HodeTech/ForgeLM/blob/cab2947/docs/qms/encryption_at_rest-tr.md#L190-L200) **English text.** The forgelm --compliance-exportZIP aggregates every artefact above into one file ... Receipt confirmation logged back into the audit chain viacompliance.artifacts_exportedevent. **Turkish text.**forgelm --compliance-exportZIP yukarıdaki her artefaktı tek bir dosyada aggregate eder ...compliance.artifacts_exported event üzerinden audit chain'e geri receipt confirmation log'u. **Which is correct.** Neither. --compliance-export writes loose files into a directory (_no_train_modes.py:248-262) and emits no audit event. It cannot include the corpus, weights or salt. compliance.artifacts_exported is emitted by the trainer when it writes the export (trainer.py:2143-2147, fields output_dir, files, governance_ok). It records the export, not a receipt by the auditor. **Proposed correction (Turkish text for the -tr page).** 'forgelm --compliance-exportuyumluluk artefaktlarını (compliance_report.json, data_provenance.json vb.) bir dizine yazar; eğitim verisini, model ağırlıklarını veya salt'ı İÇERMEZ. Eğitim sırasında üretilen dışa aktarımcompliance.artifacts_exported` olayıyla kaydedilir; bu olay dışa aktarımı kaydeder, denetçinin teslim aldığını DEĞİL. Teslim onayını operatör ayrıca kaydetmelidir.'

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}