[Wave 4] Low/info — TR mirror: docs/qms/ #807

Wave 4 · 17 finding(s) in 17 fix package(s). Mirror drift across small document pairs in this directory.

Findings

• DOC-TR04-028 (TR mirror, Low) — TR mirror drift in docs/qms/access_control.md: EN keeps two roles apart: 'deployer' (the organisation) and 'operator' (the FORGELM_OPERATOR identity).
  severity Low
  Where. EN docs/qms/access_control.md:1-281 (terminology) · TR docs/qms/access_control-tr.md:1-281
  English text. EN keeps two roles apart: 'deployer' (the organisation) and 'operator' (the FORGELM_OPERATOR identity).
  Turkish text. TR renders both as 'operatör' (e.g. 'operatör-tarafı kontrol', 'operatörün IdP'sinde', 'Operatör kimliği').
  Which is correct. EN is clearer. The collision makes sentences such as 'Aynı FORGELM_OPERATOR'ı paylaşan iki operatör...' ambiguous in a document where separation of duties is the subject.
  Proposed correction (Turkish text for the -tr page). 'deployer' için tutarlı olarak 'dağıtımı yapan kurum (deployer)' veya 'deployer', 'operator/FORGELM_OPERATOR' için 'operatör kimliği' kullanın.

• DOC-TR04-029 (TR mirror, Low) — TR mirror drift in docs/qms/access_control.md: ForgeLM resolves the operator identity at audit-event emit time
  severity Low
  Where. EN docs/qms/access_control.md:41 · TR docs/qms/access_control-tr.md:42
  English text. ForgeLM resolves the operator identity at audit-event emit time
  Turkish text. ForgeLM operatör kimliğini audit-event emit anında resolve eder
  Which is correct. Neither. Resolution runs once per AuditLogger instance in init (compliance.py:171-230). A FORGELM_OPERATOR change after the logger exists has no effect on its events.
  Proposed correction (Turkish text for the -tr page). 'ForgeLM operatör kimliğini AuditLogger oluşturulurken (koşum başlangıcında) bir kez resolve eder ve o koşumun tüm olaylarına aynı değeri damgalar:'

• DOC-TR04-030 (TR mirror, Low) — TR mirror drift in docs/qms/access_control.md: see AuditLogger.__init__ at forgelm/compliance.py:164
  severity Low
  Where. EN docs/qms/access_control.md:82 · TR docs/qms/access_control-tr.md:82
  English text. see AuditLogger.__init__ at forgelm/compliance.py:164
  Turkish text. AuditLogger.__init__ (forgelm/compliance.py:164) içinde ...
  Which is correct. Neither. The cited line is stale. init starts at compliance.py:171 and the key derivation is at :258.
  Proposed correction (Turkish text for the -tr page). 'AuditLogger.__init__ (forgelm/compliance.py, anahtar türetimi ~satır 258) içinde ...' Satır numarası yerine sembol adıyla atıf yapmak daha dayanıklıdır.

• DOC-TR04-031 (TR mirror, Low) — TR mirror drift in docs/qms/access_control.md: Audit logs in <output_dir> inherit the dir's perm; do not chmod individually unless your KMS substrate requires read access.
  severity Low
  Where. EN docs/qms/access_control.md:172 · TR docs/qms/access_control-tr.md:174-176
  English text. Audit logs in <output_dir> inherit the dir's perm; do not chmod individually unless your KMS substrate requires read access.
  Turkish text. <output_dir>'deki audit log'ları dizinin perm'ini devralır; KMS substrate'iniz read access gerektirmiyorsa bireysel chmod yapma.
  Which is correct. Neither. Files do not inherit directory mode on POSIX. AuditLogger only calls os.makedirs(output_dir, exist_ok=True) (compliance.py:174) and creates files with the process umask. Only .forgelm_audit_salt is explicitly 0600 (_purge.py:81). The two texts are logically equivalent (the TR 'if not required, don't chmod' equals the EN 'unless required').
  Proposed correction (Turkish text for the -tr page). 'Audit log dosyaları process umask'ı ile oluşturulur (dizin modunu miras ALMAZ); chmod 0700 <output_dir> dizin üzerinden erişimi kısıtlar, ancak log dosyasının kendisi umask'a göre 0644 olabilir. Gerekirse umask 077 ile çalıştırın veya dosyaya açıkça chmod uygulayın.'

• DOC-TR04-032 (TR mirror, Low) — TR mirror drift in docs/qms/encryption_at_rest.md: Compliance bundle (Annex IV) at <output_dir>/compliance/ ZIP
  severity Low
  Where. EN docs/qms/encryption_at_rest.md:30 · TR docs/qms/encryption_at_rest-tr.md:31
  English text. Compliance bundle (Annex IV) at <output_dir>/compliance/ ZIP
  Turkish text. Uyumluluk paketi (Annex IV) | <output_dir>/compliance/ ZIP
  Which is correct. Neither. The trainer writes a directory of files under <output_dir>/compliance/. --compliance-export OUTPUT_DIR writes loose files to OUTPUT_DIR (default ./compliance). A ZIP is produced only by export_evidence_bundle (compliance.py:2296) when that path is used.
  Proposed correction (Turkish text for the -tr page). '<output_dir>/compliance/ dizini (--compliance-export ile --output dizini); ZIP yalnızca evidence-bundle dışa aktarımı kullanıldığında oluşur'

• DOC-TR04-033 (TR mirror, Low) — TR mirror drift in docs/qms/encryption_at_rest.md: rotating mid-output-dir invalidates forgelm verify-audit's salted-hash assumptions for prior events
  severity Low
  Where. EN docs/qms/encryption_at_rest.md:136-138 · TR docs/qms/encryption_at_rest-tr.md:141-143
  English text. rotating mid-output-dir invalidates forgelm verify-audit's salted-hash assumptions for prior events
  Turkish text. output-dir-ortasında rotate etmek forgelm verify-audit'in önceki olaylar için salted-hash varsayımlarını geçersiz kılar
  Which is correct. Neither. verify-audit never reads the salt. Rotating the salt (or changing FORGELM_AUDIT_SECRET, which changes the XOR-derived salt and the salt_source field) makes purge and reverse-pii hashes of the same identifier stop matching earlier events. That is the real consequence.
  Proposed correction (Turkish text for the -tr page). 'Salt output-dir ortasında değiştirilirse forgelm verify-audit etkilenmez, ancak aynı tanımlayıcının purge / reverse-pii hash'leri önceki olaylardakiyle eşleşmez; eski olayları sorgulama yeteneği kaybolur.'

• DOC-TR04-034 (TR mirror, Low) — TR mirror drift in docs/qms/encryption_at_rest.md: data.dataset_id + data_provenance.json SHA-256 fingerprint
  severity Low
  Where. EN docs/qms/encryption_at_rest.md:155 · TR docs/qms/encryption_at_rest-tr.md:162-163
  English text. data.dataset_id + data_provenance.json SHA-256 fingerprint
  Turkish text. data.dataset_id + data_provenance.json SHA-256 fingerprint
  Which is correct. Neither. There is no data.dataset_id config field cited as such. The fingerprint dict gets dataset_id only for Hub datasets (compliance.py:1116). Local files get a file SHA-256 fingerprint.
  Proposed correction (Turkish text for the -tr page). 'data_provenance.json içindeki dataset SHA-256 fingerprint'i (yerel dosya) veya Hub dataset id + commit SHA'sı'

• DOC-TR05-003 (TR mirror, Low) — TR mirror drift in docs/qms/risk_treatment_plan.md: deployer pipeline halts on non-zero exit
  severity Low
  Where. EN docs/qms/risk_treatment_plan.md:105 · TR docs/qms/risk_treatment_plan-tr.md:106
  English text. deployer pipeline halts on non-zero exit
  Turkish text. operatör pipeline'ı non-zero exit'te durur
  Which is correct. Neither; TR faithfully copies the EN claim. Only difference is the term 'deployer' rendered as 'operatör'.
  Proposed correction (Turkish text for the -tr page). EN düzeltildikten sonra TR'ye aynen yansıtılmalı. 'deployer' için tutarlı bir karşılık seçin ('dağıtımcı (deployer)') ve 'operatör' sözcüğünü yalnızca işi çalıştıran kişi için kullanın.

• DOC-TR05-004 (TR mirror, Low) — TR mirror drift in docs/qms/roles_responsibilities.md: Mermaid labels in English
  severity Low
  Where. EN docs/qms/roles_responsibilities.md:10-14 · TR docs/qms/roles_responsibilities-tr.md:10-14
  English text. Mermaid labels in English
  Turkish text. Mermaid labels translated (Hesap Verebilirlik, Teknik Gözetim, Düzenleyici, Yürütme, Veri Kalitesi, Gizlilik)
  Which is correct. Stylistic translation, same hierarchy; no substantive divergence (flagged only because the mechanical pre-diff lists it).
  Proposed correction. Gerek yok.

• DOC-TR05-005 (TR mirror, Low) — TR mirror drift in docs/qms/roles_responsibilities.md: Reviews evidence bundle (forgelm --config job.yaml --compliance-export ./archive/), maintains QMS documentation
  severity Low
  Where. EN docs/qms/roles_responsibilities.md:66 · TR docs/qms/roles_responsibilities-tr.md:66
  English text. Reviews evidence bundle (forgelm --config job.yaml --compliance-export ./archive/), maintains QMS documentation
  Turkish text. Evidence bundle (--compliance-export) inceler, QMS dokümantasyonunu yürütür
  Which is correct. EN gives the full runnable command; TR shortens it to the bare flag. Both are factually consistent with the CLI, TR is less actionable.
  Proposed correction (Turkish text for the -tr page). Evidence bundle'ı (forgelm --config job.yaml --compliance-export ./archive/) inceler, QMS dokümantasyonunu yürütür

• DOC-TR05-006 (TR mirror, Low) — TR mirror drift in docs/qms/sop_data_management.md: annotation_process: "Two annotators per sample, adjudication by senior annotator" (YAML example values)
  severity Low
  Where. EN sop_data_management.md:63,Code block data.governance · TR docs/qms/sop_data_management-tr.md:64
  English text. annotation_process: "Two annotators per sample, adjudication by senior annotator" (YAML example values)
  Turkish text. annotation_process: "Örnek başına iki annotator, kıdemli annotator tarafından arabuluculuk"
  Which is correct. Translated example values only; keys identical. No substantive divergence.
  Proposed correction (Turkish text for the -tr page). Gerek yok ('arabuluculuk' yerine 'hakemlik/karar verme (adjudication)' daha doğru olurdu, stilistik).

• DOC-TR05-007 (TR mirror, Low) — TR mirror drift in docs/qms/sop_data_management.md: ... shipped together in the v0.5.0 consolidation release (PyPI 2026-04-30); the per-feature list above describes the v0.5.0 surface.
  severity Low
  Where. EN docs/qms/sop_data_management.md:90-92 · TR docs/qms/sop_data_management-tr.md:90-92
  English text. ... shipped together in the v0.5.0 consolidation release (PyPI 2026-04-30); the per-feature list above describes the v0.5.0 surface.
  Turkish text. ... v0.5.0 consolidation release'inde gönderildi (PyPI 2026-04-30).
  Which is correct. EN carries an extra sentence limiting the list to the v0.5.0 surface; TR omits it. Given D-0427 (quality filter default changed in v0.6.0), the omitted caveat matters.
  Proposed correction (Turkish text for the -tr page). Cümleyi ekleyin: 'Yukarıdaki özellik listesi v0.5.0 yüzeyini tanımlar; sonraki sürümlerde değişen varsayılanlar (ör. --quality-filter v0.6.0'dan beri varsayılan olarak açıktır) için güncel forgelm audit --help çıktısına bakın.'

• DOC-TR05-008 (TR mirror, Low) — TR mirror drift in docs/qms/sop_incident_response.md: echo "EMPTY LOG — treat as Critical, continue this playbook"
  severity Low
  Where. EN docs/qms/sop_incident_response.md:96 · TR docs/qms/sop_incident_response-tr.md:95
  English text. echo "EMPTY LOG — treat as Critical, continue this playbook"
  Turkish text. echo "EMPTY LOG — Critical say, bu playbook'a devam et"
  Which is correct. Meaning preserved; TR mixes English prefix with an awkward Turkish tail ('Critical say'). The shell output string differs between languages (the mechanical code-block diff).
  Proposed correction. echo "EMPTY LOG — Critical olarak ele al, bu playbook'a devam et"

• DOC-TR05-009 (TR mirror, Low) — TR mirror drift in docs/qms/sop_incident_response.md: Notify deployers ...
  severity Low
  Where. EN docs/qms/sop_incident_response.md:203 · TR docs/qms/sop_incident_response-tr.md:200
  English text. Notify deployers ...
  Turkish text. Operatörleri bilgilendir ...
  Which is correct. Terminology: 'deployer' (EU AI Act role) rendered as 'operatör'; same recipients intended.
  Proposed correction (Turkish text for the -tr page). Dağıtımcıları (deployer) bilgilendirin ...

• DOC-TR05-010 (TR mirror, Low) — TR mirror drift in docs/qms/sop_incident_response.md: Rotate the webhook URL and destination-side bearer token immediately (URL is resolved via webhook.url_env from your secret manager; ForgeLM does…
  severity Low
  Where. EN docs/qms/sop_incident_response.md:220-223 · TR docs/qms/sop_incident_response-tr.md:218-221
  English text. Rotate the webhook URL and destination-side bearer token immediately (URL is resolved via webhook.url_env from your secret manager; ForgeLM does not currently HMAC-sign webhook bodies).
  Turkish text. ... (URL'yi webhook.url_env ile resolve ediyorsan, secret manager'da yeni değeri set'le; ForgeLM şu an gövdeleri HMAC ile imzalamıyor).
  Which is correct. TR turns the EN statement of fact into a conditional instruction; slightly different. Code (webhook.py:80-82) also allows an inline webhook.url, so the conditional is actually the more accurate wording.
  Proposed correction (Turkish text for the -tr page). Webhook URL'sini ve hedef tarafındaki bearer token'ı hemen rotate edin (URL secret manager'daki webhook.url_env değişkeninden çözümleniyorsa yeni değeri orada güncelleyin; URL config'te inline yazılmışsa config'i de değiştirin; ForgeLM webhook gövdelerini HMAC ile imzalamaz).

• DOC-TR05-011 (TR mirror, Low) — TR mirror drift in docs/qms/statement_of_applicability.md: Applicable to deployer? / Deployer-side action
  severity Low
  Where. EN docs/qms/statement_of_applicability.md:88,107 · TR docs/qms/statement_of_applicability-tr.md:89,108
  English text. Applicable to deployer? / Deployer-side action
  Turkish text. Operatöre Applicable? / Operatör-tarafı eylem
  Which is correct. Terminology only: 'deployer' (EU AI Act legal role) is consistently rendered 'operatör' throughout the QMS TR files, which also uses 'operatör' for the person running forgelm; the distinction matters for Art. 26 obligations.
  Proposed correction (Turkish text for the -tr page). 'Dağıtımcıya (deployer) uygulanabilir mi?' / 'Dağıtımcı tarafı eylem'; ya da localization.md sözlüğüne tek bir karşılık ekleyin.

• DOC-TR05-012 (TR mirror, Low) — TR mirror drift in docs/qms/statement_of_applicability.md: docs/design/iso27001_soc2_alignment.md
  severity Low
  Where. EN docs/qms/statement_of_applicability.md:5,170 · TR docs/qms/statement_of_applicability-tr.md:5,171
  English text. docs/design/iso27001_soc2_alignment.md
  Turkish text. ../design/iso27001_soc2_alignment.md
  Which is correct. Both hrefs resolve identically (no TR mirror of the design doc exists in docs/design/); only the visible code-span text differs (docs/design/... vs ../design/...). The EN text is repo-rooted and clearer.
  Proposed correction (Turkish text for the -tr page). docs/design/iso27001_soc2_alignment.md (görünen metni EN ile aynı yapın)

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}