[Wave 3] Medium — TR mirror: docs/reference/ #638

Wave 3 · 13 finding(s) in 13 fix package(s). Mirror drift across small document pairs in this directory.

Findings

• DOC-TR01-002 (TR mirror, Medium) — TR mirror drift in docs/reference/data_preparation.md: guarantees the highest possible fine-tuning accuracy with zero manual effort
  severity Medium
  Where. EN docs/reference/data_preparation.md:46 · TR docs/reference/data_preparation-tr.md:48
  English text. guarantees the highest possible fine-tuning accuracy with zero manual effort
  Turkish text. SOTA (En ileri teknoloji) standardında maksimum model uyumluluğu ve eğitim doğruluğu sağlar
  Which is correct. Neither: the claim is false because chat templates are not used (data.py:411-430). TR adds a SOTA claim EN lacks.
  Proposed correction (Turkish text for the -tr page). Cümleyi sil; yerine: 'Biçimlendirme sabit etiketlerle yapılır; modelinizin sohbet şablonu otomatik uygulanmaz.'

• DOC-TR01-003 (TR mirror, Medium) — TR mirror drift in docs/reference/usage.md: risk_assessment.json (if configured); annex_iv_metadata.json (if configured); benchmark/ (if enabled); safety/ (if enabled)
  severity Medium
  Where. EN docs/reference/usage.md:290-294 · TR docs/reference/usage-tr.md:261-274
  English text. risk_assessment.json (if configured); annex_iv_metadata.json (if configured); benchmark/ (if enabled); safety/ (if enabled)
  Turkish text. risk_assessment.json # Risk beyanı (Madde 9); annex_iv_metadata.json # Annex IV metadata; benchmark/; safety/ (no conditionals)
  Which is correct. EN: these are conditional (compliance.py:2203, 2218-2243; trainer.py:1912-1950).
  Proposed correction (Turkish text for the -tr page). 'risk_assessment.json # Risk beyanı (yapılandırıldıysa)', 'annex_iv_metadata.json # Annex IV (yapılandırıldıysa)', 'benchmark/ # (etkinse)', 'safety/ # (etkinse)'.

• DOC-TR04-017 (TR mirror, Medium) — TR mirror drift in docs/reference/distributed_training.md: # DeepSpeed pip install forgelm[distributed]
  severity Medium
  Where. EN docs/reference/distributed_training.md:5-12, 219-222 · TR docs/reference/distributed_training-tr.md:5-12, 227-230
  English text. # DeepSpeed pip install forgelm[distributed]
  Turkish text. # DeepSpeed pip install forgelm[distributed]
  Which is correct. Neither is complete. On Windows the extra installs nothing (marker sys_platform != 'win32', pyproject.toml:115-117); trainer.py:570-590 then raises ImportError naming the extra. The doc does not mention this limit.
  Proposed correction (Turkish text for the -tr page). 'Not: DeepSpeed Windows için wheel yayınlamaz; forgelm[distributed] Windows'ta hiçbir şey kurmaz. Windows'ta distributed.strategy: "fsdp" kullanın veya Linux'ta çalıştırın.'

• DOC-TR04-018 (TR mirror, Medium) — TR mirror drift in docs/reference/distributed_training.md: unsloth | No | Single-GPU only — ForgeLM will warn if distributed config is set
  severity Medium
  Where. EN docs/reference/distributed_training.md:159 · TR docs/reference/distributed_training-tr.md:164
  English text. unsloth | No | Single-GPU only — ForgeLM will warn if distributed config is set
  Turkish text. unsloth | Hayır | Yalnızca tek GPU — dağıtık config ayarlanırsa ForgeLM uyarı verir
  Which is correct. Neither. config.py:1938-1942 raises ValueError('Unsloth backend does not support multi-GPU distributed training...') at config validation, so the run does not start (exit 1).
  Proposed correction (Turkish text for the -tr page). 'Yalnızca tek GPU — distributed.strategy ayarlanırsa config doğrulaması hata verir (exit 1); backend: "transformers" kullanın.'

• DOC-TR04-019 (TR mirror, Medium) — TR mirror drift in docs/reference/distributed_training.md: The forgelm:full image can run DeepSpeed/FSDP multi-GPU training.
  severity Medium · already tracked: KNOWN-OPEN C31-DOCKER-RUNBOOK docs/roadmap/phase-16-trust-surface-hardening.md:689-695
  Where. EN docs/reference/distributed_training.md:195-200, 219-222 · TR docs/reference/distributed_training-tr.md:203-209, 227-230
  English text. The forgelm:full image can run DeepSpeed/FSDP multi-GPU training.
  Turkish text. forgelm:full imajı ile çoklu GPU eğitimi (docker run ... forgelm:full torchrun ...)
  Which is correct. Neither. forgelm:full is built with INSTALL_EVAL=true and INSTALL_UNSLOTH=true (Dockerfile header). The Dockerfile never installs the distributed extra (DeepSpeed), and the unsloth backend is single-GPU.
  Proposed correction (Turkish text for the -tr page). 'forgelm:full imajı DeepSpeed içermez ve Unsloth tek-GPU'dur. DeepSpeed için imajı pip install "forgelm[distributed]" ekleyen bir katmanla genişletin.'

• DOC-TR04-020 (TR mirror, Medium) — TR mirror drift in docs/reference/iso27001_control_mapping.md: The synthetic teacher is pinned by teacher_revision and its resolved commit is recorded under model_lineage.component_revisions
  severity Medium
  Where. EN docs/reference/iso27001_control_mapping.md:43, 133 · TR docs/reference/iso27001_control_mapping-tr.md:42, 132
  English text. The synthetic teacher is pinned by teacher_revision and its resolved commit is recorded under model_lineage.component_revisions
  Turkish text. sentetik teacher kendi *_revision alanlarıyla sabitlenir ve çözülen her commit model_lineage.component_revisions altına kaydedilir
  Which is correct. Neither is exact. synthetic.teacher_revision applies only to a locally loaded teacher (config.py:1402-1416). The record goes into the in-process registry (model.py ROLE_TEACHER_MODEL), and --generate-data is a separate mode (_no_train_modes.py), so a later training manifest does not contain it.
  Proposed correction (Turkish text for the -tr page). 'Sentetik teacher yalnızca teacher_backend: local ise synthetic.teacher_revision ile sabitlenir; çözülen commit --generate-data koşumunun kendi sürecinde kaydedilir ve ayrı bir eğitim koşumunun component_revisions listesinde YER ALMAZ.'

• DOC-TR04-021 (TR mirror, Medium) — TR mirror drift in docs/reference/iso27001_control_mapping.md: A.5.32: License extraction in SBOM
  severity Medium
  Where. EN docs/reference/iso27001_control_mapping.md:56 · TR docs/reference/iso27001_control_mapping-tr.md:55
  English text. A.5.32: License extraction in SBOM
  Turkish text. A.5.32: SBOM'da lisans çıkarımı
  Which is correct. Neither. tools/generate_sbom.py (pip-list based, hand-rolled) emits name, version and purl and has no license handling.
  Proposed correction (Turkish text for the -tr page). 'HF model-card metadata; SBOM bileşenleri lisans bilgisi İÇERMEZ (lisans denetimi operatörün sorumluluğundadır)'

• DOC-TR04-022 (TR mirror, Medium) — TR mirror drift in docs/reference/iso27001_control_mapping.md: A.8.11 Data masking (FL): forgelm audit regex + Presidio ML-NER
  severity Medium
  Where. EN docs/reference/iso27001_control_mapping.md:112 · TR docs/reference/iso27001_control_mapping-tr.md:111
  English text. A.8.11 Data masking (FL): forgelm audit regex + Presidio ML-NER
  Turkish text. A.8.11 Veri maskeleme | FL | forgelm audit regex + Presidio ML-NER
  Which is correct. Neither. forgelm audit detects PII; masking is a separate ingest-time step. Presidio is optional and its adapter is disabled unless installed (data_audit/_optional.py). A FL (directly supported) tier overstates the control.
  Proposed correction (Turkish text for the -tr page). 'forgelm audit PII/secret TESPİTİ (regex; opsiyonel Presidio ML-NER adaptörü); maskeleme forgelm ingest tarafında uygulanır' ve katmanı FL-helps'e indirin.

• DOC-TR04-023 (TR mirror, Medium) — TR mirror drift in docs/reference/soc2_trust_criteria_mapping.md: The synthetic teacher is pinned and recorded under model_lineage.component_revisions
  severity Medium
  Where. EN docs/reference/soc2_trust_criteria_mapping.md:39,60 · TR docs/reference/soc2_trust_criteria_mapping-tr.md:39,60
  English text. The synthetic teacher is pinned and recorded under model_lineage.component_revisions
  Turkish text. sentetik teacher ... model_lineage.component_revisions altına kaydedilir
  Which is correct. Neither is exact. It applies only to synthetic.teacher_backend: local, and the record sits in the --generate-data process (see ISO A.5.19).
  Proposed correction (Turkish text for the -tr page). 'Sentetik teacher yalnızca yerel (local) teacher backend'inde sabitlenir; kayıt --generate-data sürecindedir ve eğitim manifest'ine otomatik taşınmaz.'

• DOC-TR04-024 (TR mirror, Medium) — TR mirror drift in docs/reference/soc2_trust_criteria_mapping.md: CC9.2: license extraction (SBOM)
  severity Medium
  Where. EN docs/reference/soc2_trust_criteria_mapping.md:60 · TR docs/reference/soc2_trust_criteria_mapping-tr.md:60
  English text. CC9.2: license extraction (SBOM)
  Turkish text. CC9.2: lisans çıkarımı
  Which is correct. Neither. The SBOM has no license data (tools/generate_sbom.py).
  Proposed correction (Turkish text for the -tr page). Satırdan 'lisans çıkarımı' ifadesini kaldırın.

• DOC-TR04-025 (TR mirror, Medium) — TR mirror drift in docs/reference/supply_chain_security.md: Each SBOM lists 'every dependency' of ForgeLM per (OS x Python) cell.
  severity Medium · already tracked: KNOWN-OPEN OPS-02|OPS-03|OPS-04|OPS-05|OPS-06|OPS-15|OPS-16|OPS-19 docs/roadmap/phase-16-trust-surface-hardening.md:665-668
  Where. EN docs/reference/supply_chain_security.md:8-23, 41, 68-72 · TR docs/reference/supply_chain_security-tr.md:41-42, 70-71
  English text. Each SBOM lists 'every dependency' of ForgeLM per (OS x Python) cell.
  Turkish text. Her bağımlılık adı + sürümünü listele; (OS × Python) hücresi başına bir SBOM
  Which is correct. Neither. The SBOM is a pip list of the CI environment: the wheel, its resolved deps, pytest, and on Linux the qlora, ingestion and eval extras. It has no dependency graph, no hashes and no licenses, and the distributed, unsloth and security extras are not installed.
  Proposed correction (Turkish text for the -tr page). 'Her SBOM, ilgili CI hücresinde kurulu paketlerin (forgelm wheel'i, çözümlenen bağımlılıkları, pytest ve Linux'ta qlora/ingestion/eval extra'ları) düz listesidir; bağımlılık grafiği, hash veya lisans içermez, distributed/unsloth extra'ları kapsanmaz.'

• DOC-TR04-026 (TR mirror, Medium) — TR mirror drift in docs/reference/supply_chain_security.md: A '# nosec B603 B607 — ...' comment on its own line above 'result = subprocess.run(...)' suppresses the finding.
  severity Medium
  Where. EN docs/reference/supply_chain_security.md:186-190 · TR docs/reference/supply_chain_security-tr.md:188-192
  English text. A '# nosec B603 B607 — ...' comment on its own line above 'result = subprocess.run(...)' suppresses the finding.
  Turkish text. # nosec B603 B607 — args literal, operatör-kontrollü değil\nresult = subprocess.run(...)
  Which is correct. Neither, per the verified EN finding. Bandit honours # nosec on the flagged line (for multi-line calls, the call's first or last line), not on a separate preceding line. The repo itself uses inline form (tools/generate_sbom.py: ... # NOSONAR ...; nosec B603,B607 — ... on the subprocess.run line). Not re-run here.
  Proposed correction (Turkish text for the -tr page). Örnek: result = subprocess.run([...], ...) # nosec B603 B607 — args literal, operatör-kontrollü değil (yorum, bulgunun bulunduğu satırda olmalı).

• DOC-TR04-027 (TR mirror, Medium) — TR mirror drift in docs/reference/supply_chain_security.md: tools/check_bandit.py confirms the suppression is justified by the trailing prose.
  severity Medium
  Where. EN docs/reference/supply_chain_security.md:192-194 · TR docs/reference/supply_chain_security-tr.md:194-196
  English text. tools/check_bandit.py confirms the suppression is justified by the trailing prose.
  Turkish text. tools/check_bandit.py suppression'ın trailing prose ile gerekçelendirildiğini teyit eder.
  Which is correct. Neither. check_bandit.py only buckets findings by severity (HIGH fails, MEDIUM warns). It does not read nosec comments or check any justification text.
  Proposed correction (Turkish text for the -tr page). 'Bandit ilgili satırı yok sayar; gerekçe metninin varlığı otomatik DENETLENMEZ, bu yüzden gerekçe code review'da kontrol edilmelidir.'

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}