[Wave 4] Low/info — Docs: docs/guides/iso_soc2_deployer_guide.md #726

Wave 4 · 5 finding(s) in 5 fix package(s). One pass over this document; keep the Turkish mirror in sync.

Findings

• DOC-BLEGAL-190 (docs, Low) — docs/guides/iso_soc2_deployer_guide.md: wrong detail — Production runs without operator identity are an ISO A.6.4 + A.6.5 finding.
  severity Low
  Where. docs/guides/iso_soc2_deployer_guide.md:325-326 (Turkish mirror: docs/guides/iso_soc2_deployer_guide-tr.md:324-325) · type: wrong detail
  The document says. Production runs without operator identity are an ISO A.6.4 + A.6.5 finding.
  What the code does. In ISO/IEC 27002:2022, which ISO/IEC 27001:2022 Annex A follows, 6.4 is 'Disciplinary process' and 6.5 is 'Responsibilities after termination or change of employment'. Missing operator identity on logged events relates to 5.16 'Identity management' and 8.15 'Logging'.
  Proposed correction. 'Production runs without operator identity are an ISO A.5.16 (identity management) + A.8.15 (logging) finding.' Mirror in the TR file.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B03-044 (docs, Low) — docs/guides/iso_soc2_deployer_guide.md: misleading — 'pip-audit nightly + bandit CI for static + dynamic security scanning.'
  severity Low
  Where. docs/guides/iso_soc2_deployer_guide.md:36-38 (Turkish mirror: docs/guides/iso_soc2_deployer_guide-tr.md:37-39) · type: misleading
  The document says. 'pip-audit nightly + bandit CI for static + dynamic security scanning.'
  What the code does. pip-audit is dependency vulnerability scanning and bandit is static analysis. No dynamic security testing exists.
  Code references. .github/workflows/nightly.yml:309-334, .github/workflows/ci.yml:517-524
  Proposed correction. "... adds pip-audit (nightly dependency-vulnerability scan) and bandit (static analysis in CI and nightly)."
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B03-045 (docs, Low) — docs/guides/iso_soc2_deployer_guide.md: misleading — 'The promoted artefacts remain hash-verified through model_integrity.json / the model.integrity_verified event.'
  severity Low
  Where. docs/guides/iso_soc2_deployer_guide.md:133-135 (Turkish mirror: docs/guides/iso_soc2_deployer_guide-tr.md:134-135) · type: misleading
  The document says. 'The promoted artefacts remain hash-verified through model_integrity.json / the model.integrity_verified event.'
  What the code does. model.integrity_verified is emitted when model_integrity.json is generated after training. forgelm approve does not re-hash anything at promotion. Verification requires running forgelm verify-integrity, which exits 6 on a mismatch.
  Code references. forgelm/trainer.py:2157-2167, forgelm/cli/subcommands/_approve.py:512-629, forgelm/cli/subcommands/_verify_integrity.py:19-35
  Proposed correction. "The promoted artefacts remain hash-verifiable: run forgelm verify-integrity ./outputs/final_model (exit 6 on mismatch). model.integrity_verified records when the manifest was written."
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B03-046 (docs, Low) — docs/guides/iso_soc2_deployer_guide.md: misleading — 'The CycloneDX 1.5 JSON lists every transitive dependency with its purl and version.'
  severity Low
  Where. docs/guides/iso_soc2_deployer_guide.md:211-213 (Turkish mirror: docs/guides/iso_soc2_deployer_guide-tr.md:211-213) · type: misleading
  The document says. 'The CycloneDX 1.5 JSON lists every transitive dependency with its purl and version.'
  What the code does. The generator emits every distribution installed in the runner's environment, read from pip list. In publish.yml that environment also holds pytest and pytest-cov, and on Linux the qlora, ingestion and eval extras. Components carry only type, name, version, purl and bom-ref: no dependency graph and no licences.
  Code references. tools/generate_sbom.py:33-62, tools/generate_sbom.py:77-88, .github/workflows/publish.yml:75-85
  Proposed correction. "... lists every package installed in that matrix cell's environment (ForgeLM's dependency closure plus test tooling and, on Linux, the qlora/ingestion/eval extras) with purl and version; it carries no dependency graph or licence data."
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B03-047 (docs, Low) — docs/guides/iso_soc2_deployer_guide.md: broken example — The reverse-pii command shown returns a 'JSON envelope { matches: [...], match_count: N }'.
  severity Low
  Where. docs/guides/iso_soc2_deployer_guide.md:264-267 (Turkish mirror: docs/guides/iso_soc2_deployer_guide-tr.md:264-266) · type: broken example
  The document says. The reverse-pii command shown returns a 'JSON envelope { matches: [...], match_count: N }'.
  What the code does. The JSON envelope is printed only with --output-format json, which the command omits. With the flag, the keys are success, query_hash, identifier_type, scan_mode, salt_source, matches, files_scanned and match_count (reproduced).
  Code references. forgelm/cli/subcommands/_reverse_pii.py:428-470
  Proposed correction. Add --output-format json to the example command.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}