[Wave 4] Low/info — TR mirror: docs/reference/ (part 2/2) #809

Wave 4 · 6 finding(s) in 6 fix package(s). Mirror drift across small document pairs in this directory.

Findings

• DOC-TR04-036 (TR mirror, Low) — TR mirror drift in docs/reference/iso27001_control_mapping.md: A.8.9: per-run config_hash bound into training_manifest.yaml
  severity Low
  Where. EN docs/reference/iso27001_control_mapping.md:110 · TR docs/reference/iso27001_control_mapping-tr.md:109
  English text. A.8.9: per-run config_hash bound into training_manifest.yaml
  Turkish text. koşum başına config_hash ... training_manifest.yaml'a ... bağlanır
  Which is correct. Both overstate. config_hash is a hash of the redacted validated config (hf_token and api_key redacted; compliance.py:1331-1356). Secret-only changes do not alter it.
  Proposed correction (Turkish text for the -tr page). 'koşum başına config_hash (secret alanları redakte edilmiş config'in SHA-256'sı; bkz. compute_config_hash)'

• DOC-TR04-037 (TR mirror, Low) — TR mirror drift in docs/reference/iso27001_control_mapping.md: see forgelm/compliance.py:104-114
  severity Low
  Where. EN docs/reference/iso27001_control_mapping.md:125 · TR docs/reference/iso27001_control_mapping-tr.md:124
  English text. see forgelm/compliance.py:104-114
  Turkish text. bkz. forgelm/compliance.py:104-114
  Which is correct. Neither. The key derivation is hashlib.sha256(raw_secret.encode() + run_id.encode()) at compliance.py:258 (writer) and :2429 (verifier).
  Proposed correction. 'bkz. AuditLogger.__init__ (forgelm/compliance.py) ve _verify_hmac_for_entry'

• DOC-TR04-038 (TR mirror, Low) — TR mirror drift in docs/reference/iso27001_control_mapping.md: A.8.29: pytest ~1493 tests
  severity Low
  Where. EN docs/reference/iso27001_control_mapping.md:130 · TR docs/reference/iso27001_control_mapping-tr.md:129
  English text. A.8.29: pytest ~1493 tests
  Turkish text. pytest ~1493 test
  Which is correct. Neither. The snapshot has 128 test modules and about 3933 def test_ functions (count excludes parametrisation).
  Proposed correction (Turkish text for the -tr page). Sabit sayı yerine 'kapsamlı pytest paketi (CI'da çalışır)' yazın veya sayıyı check_doc_numerical_claims ile senkron tutun.

• DOC-TR04-039 (TR mirror, Low) — TR mirror drift in docs/reference/soc2_trust_criteria_mapping.md: CC7.3: data.erasure_failed, pipeline.failed events with error_class + error_message
  severity Low
  Where. EN docs/reference/soc2_trust_criteria_mapping.md:55 · TR docs/reference/soc2_trust_criteria_mapping-tr.md:55
  English text. CC7.3: data.erasure_failed, pipeline.failed events with error_class + error_message
  Turkish text. CC7.3: data.erasure_failed, pipeline.failed olayları error_class + error_message ile
  Which is correct. Neither. data.erasure_failed has both fields. pipeline.failed carries only error (trainer.py:1702).
  Proposed correction (Turkish text for the -tr page). 'data.erasure_failed (error_class + error_message) ve pipeline.failed (error) olayları'

• DOC-TR04-040 (TR mirror, Low) — TR mirror drift in docs/reference/soc2_trust_criteria_mapping.md: PI1.3: model_card.md
  severity Low
  Where. EN docs/reference/soc2_trust_criteria_mapping.md:81 · TR docs/reference/soc2_trust_criteria_mapping-tr.md:80
  English text. PI1.3: model_card.md
  Turkish text. PI1.3: model_card.md
  Which is correct. Neither. The file is README.md (model_card.py:342).
  Proposed correction. 'README.md (model card)'

• DOC-TR04-041 (TR mirror, Low) — TR mirror drift in docs/reference/soc2_trust_criteria_mapping.md: PI1.5: Annex IV bundle co-locates manifest + report + audit + integrity
  severity Low
  Where. EN docs/reference/soc2_trust_criteria_mapping.md:83 · TR docs/reference/soc2_trust_criteria_mapping-tr.md:82
  English text. PI1.5: Annex IV bundle co-locates manifest + report + audit + integrity
  Turkish text. Annex IV bundle manifest + report + audit + integrity'i co-locate eder
  Which is correct. Neither. The compliance directory holds manifest and reports. audit_log.jsonl is in <output_dir> and model_integrity.json is in final_model/; the ZIP helper (export_evidence_bundle) only zips the directory passed to it.
  Proposed correction (Turkish text for the -tr page). 'Uyumluluk dizini manifest + raporları içerir; audit_log.jsonl ve model_integrity.json ayrı konumlardadır ve delil paketine operatör tarafından eklenmelidir'

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}