[Wave 4] Low/info — Module sweep: Packaging, container, CI/CD workflows & supply chain (part 3/3) #704

Wave 4 · 16 finding(s) in 16 fix package(s). Fix these whenever a pull request touches this module ("clean the module you touch").

Findings

• CR-A16-093 (code, Low) — ForgeLM declares no jinja2 floor even though its trust_remote_code=false guarantee relies on the Jinja sandbox for repo-supplied chat templates
  severity Low · reachability default · intent intended-but-harmful · confidence confirmed · independently confirmed · not reproduced (code trace)
  Failure scenario. An operator installs forgelm into an existing environment that has jinja2 3.1.4, which pip leaves in place because nothing requires newer, then runs forgelm chat on a hostile Hub model with trust_remote_code=false. If the advisories apply, the template's sandbox escape runs code in the operator's process.
  Where. pyproject.toml:45-69, forgelm/inference.py:178, forgelm/synthetic.py:264, forgelm/safety/_score_generation.py:143
  Recommended fix. Add a direct dependency jinja2>=3.1.6 (or at least the version that fixes the most recent sandbox advisory) and record the reason in pyproject's comment block. Optionally assert the version at chat, teacher and guard load time.

• CR-A16-094 (code, Low) — CC-BY-SA 4.0 seed data is redistributed in a wheel that declares only Apache-2.0, and the license and attribution never reach the quickstart user or the trained model's card
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end
  Failure scenario. An operator runs a quickstart template and publishes the adapter or the copied dataset with a ForgeLM-generated README. Nothing in the README or the dataset copy carries the CC-BY-SA notice and credit that LICENSES.md requires of derivatives, and a licence scanner reports the package as Apache-2.0 only.
  Where. pyproject.toml:23, pyproject.toml:34, forgelm/templates/LICENSES.md:3-5, forgelm/templates/LICENSES.md:27-28
  Recommended fix. Declare 'Apache-2.0 AND CC-BY-SA-4.0' (or a license-files entry) for the templates data. Print license_note in the text quickstart summary and the wizard prelude. Write a LICENSE/NOTICE next to the copied seed dataset, and add a dataset-license line to the model card when the dataset is a bundled seed.

• CR-A16-096 (code, Low) — Documented container runs write an unkeyed audit log (HMAC silently off) attributed to forgelm@; no container doc says to pass FORGELM_AUDIT_SECRET/FORGELM_OPERATOR, and neith…
  severity Low · reachability default · intent intended-but-harmful · confidence likely · independently confirmed · reproduced end to end
  Failure scenario. A deployer follows enterprise_deployment.md or docker compose run --rm train. The run completes with exit 0 and an audit_log.jsonl whose entries say operator=forgelm@3f9c2a1b7e4d, with no _hmac. Anyone with write access to ./output can rewrite any event (e.g. a gate decision) and re-chain it, and forgelm verify-audit still exits 0. The Article 12 record cannot identify who ran or who approved. Nothing in the run's logs or in doctor told the deployer the log was unkeyed.
  Where. docker-compose.yaml:27-48, docs/usermanuals/en/operations/docker.md:16-21, docs/usermanuals/en/operations/docker.md:57-60, docs/guides/enterprise_deployment.md:24-64
  Recommended fix. Add environment: [FORGELM_OPERATOR, FORGELM_AUDIT_SECRET, HF_TOKEN] (pass-through) to the compose train service. Add both variables to the docker.md / enterprise_deployment.md / cicd_pipeline.md container recipes and to the Security Checklist. Emit a one-time WARNING from AuditLogger when FORGELM_AUDIT_SECRET is unset. Add a doctor probe (warn) for an absent or short audit secret.

• CR-A16-097 (code, Low) — The sdist advertises 128 test files but omits the conftest, helpers, data fixtures and tools they need, so the tests in the sdist cannot run
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end
  Failure scenario. A distro or conda-forge packager runs the suite from the sdist, collection aborts, and they either skip tests or patch the sdist. Whatever tests do run execute without the conftest network guard.
  Where. MANIFEST.in:1-5, pyproject.toml:247-252, tests/test_check_bilingual_parity.py
  Recommended fix. Either ship a coherent test tree (graft tests, include tools/ checks), or exclude tests entirely (prune tests in MANIFEST.in). Do not ship a partial one.

• CR-A16-098 (code, Low) — All five local pre-commit guard hooks are structurally unable to fail on the drift they exist to catch; pre-commit hides their output, and the 'too slow' rationale for omitting --strict is false
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end
  Where. .pre-commit-config.yaml:38-43, .pre-commit-config.yaml:45-80, tools/check_bilingual_parity.py:496-498, tools/check_anchor_resolution.py:394-400
  Recommended fix. Add --strict to all five local hook entries (they cost 0.2 s each except ~5 s for the CLI check) or set verbose: true if truly advisory; add a test in tests/test_guard_wiring.py that every local hook entry carries --strict or verbose: true; correct the 'too slow' comment.

• CR-A16-099 (code, Low) — No automated update mechanism for workflow actions, pre-commit hooks or dependency pins; code-review.md prescribes a merge style for Dependabot PRs that cannot exist
  severity Low · reachability undocumented · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end
  Failure scenario. An upstream action or hook ships a security fix, a runtime migration (for example Node 20 to 24) or a breaking change. Nothing in the repository opens a PR or raises an alert for actions or hook revs. The pin stays on the old version until a maintainer happens to notice, typically when a workflow breaks at release time, as with the Node-20 removal. A reviewer who reads code-review.md:142 may wrongly conclude that dependency PRs are bot-driven.
  Where. .github/, docs/standards/code-review.md:142, docs/design/iso27001_soc2_alignment.md:173, docs/reference/supply_chain_security.md:154
  Recommended fix. Add .github/dependabot.yml with the github-actions ecosystem, the pip ecosystem (pyproject.toml) and the docker ecosystem (Dockerfile). Use groups: so that 'bulk updates' actually exist, and note that Dependabot rewrites SHA pins together with their version comments, which makes the M-A16-038 fix sustainable. Cover .pre-commit-config.yaml with pre-commit.ci autoupdate, Renovate or a scheduled `…

• CR-A16-100 (code, Low) — Nightly bandit step is skipped whenever the pip-audit gate fails
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. An upstream advisory with no fix lands. Nightly pip-audit fails every night until someone triages it, and the nightly bandit scan does not run during that window.
  Where. .github/workflows/nightly.yml:309-334, .github/workflows/nightly.yml:336-343
  Recommended fix. Add 'if: always()' (or 'if: !cancelled()') to the bandit step, or split the scans into separate jobs.

• CR-A16-102 (code, Info) — CI installs default (CUDA-bundled) torch wheels on CPU-only runners in many jobs, and the validate job repeats the full install
  severity Info · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. Each PR push spends several minutes per job downloading and unpacking multi-GB CUDA wheels, about five full installs per push. The runner pip cache (cache: pip) is only partly effective because of the size.
  Where. .github/workflows/ci.yml:80-90, .github/workflows/ci.yml:110-120, .github/workflows/nightly.yml:30-36, pyproject.toml:42
  Recommended fix. Preinstall torch from https://download.pytorch.org/whl/cpu before pip install -e .[dev] in CPU-only jobs, so the CUDA wheels are skipped. Fold the validate guards into an existing matrix cell, or reuse its environment. Expected gain: roughly 2-5 min and about 2-3 GB of download saved per job, order 10-20 runner-minutes per push.

• CR-A16-103 (code, Info) — Xxhash described as materially faster, code measures ~1.05x
  severity Info · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. An operator installs the extra for speed and gains almost nothing, and fingerprints stop matching reports from machines without it.
  Where. pyproject.toml:137-139, forgelm/data_audit/_optional.py:13-22, forgelm/data_audit/_simhash.py:61-74
  Recommended fix. Reword the pyproject comment to match the measurements.

• CR-A16-104 (code, Info) — The blanket DeprecationWarning filter is not what hid the three confirmed removals: no Python DeprecationWarning ever existed for them in the declared range, and the full suite plus nightly-equivalen…
  severity Info · reachability default · intent intended-and-acceptable · confidence confirmed · independently confirmed · reproduced end to end
  Where. pyproject.toml:287, forgelm/trainer.py:503, forgelm/trainer.py:765, forgelm/trainer.py:737
  Recommended fix. Do not justify removing the filter as a fix for M-X-009/010/011. Detect these through a signature-level compatibility test instead (see next finding), and capture transformers' logger deprecation notices (caplog on the 'transformers' logger) in a real-class construction test.

• CR-A16-107 (code, Info) — tools/ is outside the bandit scope; the scope is documented but no reason is given, and the scan would find nothing above LOW (task premise falsified)
  severity Info · reachability default · intent intended-and-acceptable · confidence likely · single reviewer · reproduced end to end
  Failure scenario. Today nothing is hidden. A future HIGH pattern in a tools/ script that runs in CI or the publish job (generate_sbom.py) would not be scanned, and nothing documents that this is a deliberate decision.
  Where. .github/workflows/ci.yml:511-524, .github/workflows/nightly.yml:329-334, docs/reference/supply_chain_security.md:163-165, docs/qms/sop_change_management.md:82
  Recommended fix. Either add -r forgelm/ tools/ to the CI, nightly and gauntlet commands (they are cheap and currently clean) or write the reason for excluding tools/ into supply_chain_security.md next to the 'Scope' sentence.

• CR-A16-109 (code, Info) — No test or CI step asserts that safety_prompts/default_probes.jsonl or wizard/_defaults.json are in a built artefact; dropping their package-data entries leaves the whole packaging test set green
  severity Info · reachability undocumented · intent intended-but-harmful · confidence likely · independently confirmed · reproduced end to end · already tracked: KNOWN-OPEN OPS-01 — docs/roadmap/phase-16-trust-surface-hardening.md:661-662
  Failure scenario. A pyproject refactor (for example a move to package-data = {"*": [...]}, or a deleted line) drops the safety_prompts or wizard entry. CI, the gauntlet, the nightly smoke and the release matrix all stay green. PyPI users get a wheel where '--default-probes' cannot find its probe file and the wizard quietly runs on fallback defaults.
  Where. tests/test_packaging.py:86-120, tests/test_wizard_phase22.py:1533-1545, tests/test_wizard_phase22.py:110-117, tests/test_library_api.py:251-256
  Recommended fix. Add a test or CI step that builds the wheel and compares its namelist to an expected package-data set (templates, safety_prompts/default_probes.jsonl, wizard/_defaults.json, py.typed). Alternatively extend wheel-install-smoke to run 'forgelm safety-eval --default-probes --help' / read the resources from the installed venv, and assert the _defaults.json load did not take the fallback path.

• CR-A16-110 (code, Info) — RC5r1-1013 must be narrowed to supply_chain_security.md:10-12,18-20,44-53
  severity Info · reachability undocumented · intent contract-violation · confidence likely · independently confirmed · reproduced end to end
  Where. docs/reference/supply_chain_security.md:21-22, docs/reference/supply_chain_security.md:14, docs/reference/supply_chain_security.md:16, docs/reference/supply_chain_security.md:17
  Recommended fix. In the final report, RC5r1-1013 should read: 'supply_chain_security.md:10-12,18-20,44-53 true as stated (CycloneDX 1.5 JSON; stdlib-only emitter; same-environment determinism modulo serialNumber and timestamp, pinned by a test that runs in CI)'. Add: 'lines 14-17 superseded by M5r2-A16-018; lines 21-22 superseded by M5r2-A16-015'.

• CR-A16-111 (code, Info) — RC5r1-0758 must be narrowed to same-environment determinism; 'correctly' and 'deterministic' (as tag-reproducible) are superseded
  severity Info · reachability unreachable · intent intended-and-acceptable · confidence likely · single reviewer · reproduced end to end
  Where. tools/generate_sbom.py:5, tools/generate_sbom.py:33, tools/generate_sbom.py:82, tools/generate_sbom.py:91
  Recommended fix. Rewrite RC5r1-0758 as: 'generate_sbom.py:20-30,65-81,98-132: stdlib-only; PEP 503 names; fails closed on missing fields; output content-identical within one environment (modulo serialNumber and timestamp)'. Mark it 'superseded in part by M5r1-A16-010 (not reproducible from the tag) and by the duplicate-bom-ref finding (not a correct BOM)'.

• CR-A16-112 (code, Info) — RC5r2-0830's 1-239 'read in full' clean range attests lines that carry verified findings; narrow it to its own assertion
  severity Info · reachability unreachable · intent intended-and-acceptable · confidence likely · independently confirmed · not reproduced (code trace)
  Where. docs/reference/supply_chain_security.md:41-42, docs/reference/supply_chain_security.md:62-65, docs/reference/supply_chain_security.md:62, docs/reference/supply_chain_security.md:87-88
  Recommended fix. Restate RC5r2-0830 as: 'the doc makes no claim that the build toolchain is pinned, reproducible or Scorecard-compliant; clean ranges 1-12, 18-20, 24-40, 44-53, 66-76, 147-153'. Do not carry the 1-239 range into the final report.

• CR-A16-113 (code, Info) — Reconciliation (2): M-A17b-003 should be narrowed (drop ci.yml, re-anchor nightly.yml) and widened (more false sentences in the EN doc and the TR mirror). RC-1447 stands
  severity Info · reachability undocumented · intent contract-violation · confidence likely · independently confirmed · reproduced end to end
  Failure scenario. An auditor reads that the bandit helper validates nosec justifications and that the development branch is scanned nightly, and records two controls that do not exist. An operator expecting the documented 'HIGH finding' for setuptools sees UNKNOWN instead and cannot match it to the doc.
  Where. docs/reference/supply_chain_security.md:87-88, docs/reference/supply_chain_security.md:117-119, docs/reference/supply_chain_security.md:192-194, docs/reference/supply_chain_security.md:171
  Recommended fix. Fix the EN and TR sentences (a)-(g). Remove ci.yml from M-A17b-003. Extend TestSupplyChainDocMatchesPipAuditPolicy to cover the bandit section (UNDEFINED, skips, the nosec claim).

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}