[Wave 4] Low/info — Docs: docs/design/iso27001_soc2_alignment.md #720

Wave 4 · 9 finding(s) in 9 fix package(s). One pass over this document; keep the Turkish mirror in sync.

Findings

• DOC-BLEGAL-169 (docs, Low) — docs/design/iso27001_soc2_alignment.md: wrong detail — | A.5.10 Acceptable use of information | ... | A.5.31 Identification of legal, statutory, regulatory and contractual requirements |
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:162,183 · type: wrong detail
  The document says. | A.5.10 Acceptable use of information | ... | A.5.31 Identification of legal, statutory, regulatory and contractual requirements |
  What the code does. The 37/8/14/34 = 93 counts and the internal tally are correct, and all 93 IDs are present. Seven titles differ from the official ISO/IEC 27002:2022 contents. Four are harmless abbreviations (:153, :154, :161, :212). Others are real errors: :162 A.5.10 should read 'Acceptable use of information and other associated assets', and :183 A.5.31's official title begins 'Legal, ...' rather than 'Identifi…
  Proposed correction. Use the official Annex A titles verbatim (A.5.10 'Acceptable use of information and other associated assets'; A.5.31 'Legal, statutory, regulatory and contractual requirements') and recheck all §3 titles against Table A.1.

• DOC-D2B03-034 (docs, Low) — docs/design/iso27001_soc2_alignment.md: stale — 'The README ISO / SOC 2 section follows this rule explicitly'; §13.4 '[x] README.md — 1 paragraph "ISO 27001 / SOC 2 Type II alignment" section'.
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:20-22,399-400,726-727 · type: stale
  The document says. 'The README ISO / SOC 2 section follows this rule explicitly'; §13.4 '[x] README.md — 1 paragraph "ISO 27001 / SOC 2 Type II alignment" section'.
  What the code does. The README has no ISO/SOC 2 paragraph or section; it has only a link to the deployer guide under 'Compliance & safety'.
  Code references. README.md:115-124
  Proposed correction. "The README links to the deployer guide (no separate ISO/SOC 2 section)", or restore the paragraph.

• DOC-D2B03-035 (docs, Low) — docs/design/iso27001_soc2_alignment.md: misleading — 'the deployer ships them [audit events] to Splunk / Datadog / etc. via webhook or filebeat'.
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:70-71 · type: misleading
  The document says. 'the deployer ships them [audit events] to Splunk / Datadog / etc. via webhook or filebeat'.
  What the code does. Webhooks carry lifecycle notifications (training., approval.required, pipeline.), not audit-log entries. Shipping audit events needs a log shipper.
  Code references. forgelm/webhook.py:429-661
  Proposed correction. "... ships audit_log.jsonl with a log shipper (filebeat etc.); webhooks carry only lifecycle notifications".

• DOC-D2B03-036 (docs, Low) — docs/design/iso27001_soc2_alignment.md: stale — 'Cited symbols are real (verified against ... b87c872)': _data_governance_block, generate_model_integrity delegating to _hash_file, notify_start… severity **Low** **Where.** [docs/design/iso27001_soc2_alignment.md:100](https://github.com/HodeTech/ForgeLM/blob/cab2947/docs/design/iso27001_soc2_alignment.md#L100),121,124,125,255,752 · type: stale **The document says.** 'Cited symbols are real (verified against ... b87c872)': _data_governance_block, generate_model_integritydelegating to_hash_file, notify_start/succeeded/failed/reverted/awaiting_approval, AuditLogger.__init__ at forgelm/compliance.py:164. **What the code does.** _data_governance_blockdoes not exist (the real names are_governance_sectionandgenerate_data_governance_report). The hash helper is the public hash_file. The notifier methods are notify_success and notify_failure, not succeeded and failed. AuditLogger.__init__ is at compliance.py:171 and the key derivation at :258. **Code references.** [forgelm/compliance.py:654](https://github.com/HodeTech/ForgeLM/blob/cab2947/forgelm/compliance.py#L654), [forgelm/compliance.py:707](https://github.com/HodeTech/ForgeLM/blob/cab2947/forgelm/compliance.py#L707), [forgelm/compliance.py:743](https://github.com/HodeTech/ForgeLM/blob/cab2947/forgelm/compliance.py#L743), [forgelm/compliance.py:171`](https://github.com/HodeTech/ForgeLM/blob/cab2947/forgelm/compliance.py#L171)
  Proposed correction. Update the symbol names and line reference, and drop the frozen 'verified against b87c872' assertion.

• DOC-D2B03-039 (docs, Low) — docs/design/iso27001_soc2_alignment.md: stale — A.8.29: 'pytest test suite across ~70 modules (post-Wave 5)'.
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:260 · type: stale
  The document says. A.8.29: 'pytest test suite across ~70 modules (post-Wave 5)'.
  What the code does. There are 128 test modules (tests/test_*.py).
  Code references. tests/
  Proposed correction. "across 128 test modules" (or drop the number).

• DOC-D2B03-040 (docs, Low) — docs/design/iso27001_soc2_alignment.md: wrong detail — tools/generate_sbom.py is '177 lines, pure stdlib emitter'; publish.yml runs it 'in the cross-os-tests job (line 94–101)'; 'zero external depe…
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:414-417,428-429 · type: wrong detail
  The document says. tools/generate_sbom.py is '177 lines, pure stdlib emitter'; publish.yml runs it 'in the cross-os-tests job (line 94–101)'; 'zero external dependencies (pure stdlib + importlib.metadata)'.
  What the code does. The file is 188 lines. It shells out to python -m pip list --format=json, so it needs pip. The publish step is at lines 104-111.
  Code references. tools/generate_sbom.py:33-62, .github/workflows/publish.yml:104-111
  Proposed correction. "(188 lines; stdlib plus a pip list subprocess) ... (publish.yml lines 104–111)".

• DOC-D2B03-041 (docs, Low) — docs/design/iso27001_soc2_alignment.md: false claim — 'The deployer guide in Faz 23 documents this choice and offers the user a "convert with cyclonedx-py" recipe if SPDX is required.'
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:431-434 · type: false claim
  The document says. 'The deployer guide in Faz 23 documents this choice and offers the user a "convert with cyclonedx-py" recipe if SPDX is required.'
  What the code does. docs/guides/iso_soc2_deployer_guide.md contains no SPDX or cyclonedx-py content.
  Code references. docs/guides/iso_soc2_deployer_guide.md:198-213
  Proposed correction. Remove the sentence or add the recipe to the guide.

• DOC-D2B03-042 (docs, Low) — docs/design/iso27001_soc2_alignment.md: wrong detail — §8-9 outline: staging dir staging_model.<run_id>/; R-03 '[ingestion-pii-ml] secrets scan'; R-06 treatment for classifier load failure is 'F-…
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:519,561,564,596 · type: wrong detail
  The document says. §8-9 outline: staging dir staging_model.<run_id>/; R-03 '[ingestion-pii-ml] secrets scan'; R-06 treatment for classifier load failure is 'F-compliance-110 strict gate raises ConfigError'; IR runbook captures the audit log's '.sha256 sidecar'.
  What the code does. The staging dir is final_model.staging.<run_id>/. The secrets scan is core and always on, not part of the ingestion-pii-ml extra. F-compliance-110 only rejects strict-tier configs with safety disabled, and a classifier load failure today exits 0 with the model kept (see guide Q7). The audit log has only the .manifest.json sidecar.
  Code references. forgelm/trainer.py:1611, forgelm/data_audit/_secrets.py:62-115, forgelm/config.py:1822-1842, forgelm/trainer.py:1458-1460
  Proposed correction. Correct the artefact names and replace the R-06 treatment with the actual behaviour (audit.classifier_load_failed + safety.evaluation_completed passed=false; see the Q7 code fix).

• DOC-D2B03-043 (docs, Low) — docs/design/iso27001_soc2_alignment.md: false claim — §18: docs/qms/ holds templates for '... key management, retention'.
  severity Low
  Where. docs/design/iso27001_soc2_alignment.md:873-875 · type: false claim
  The document says. §18: docs/qms/ holds templates for '... key management, retention'.
  What the code does. docs/qms/ holds README, access_control, encryption_at_rest, risk_treatment_plan, roles_responsibilities, sop_change_management, sop_data_management, sop_incident_response, sop_model_training and statement_of_applicability (each with a -tr mirror). There is no key-management or retention template.
  Code references. docs/qms/
  Proposed correction. List the actual QMS documents.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}