medical-qa-tr template is documented as shipping risk_assessment + safety eval pre-wired, but contains neither (CR-A14-002) #97

Wave 0 · theme D0-5: Documented controls that are not implemented · highest severity Critical · 2 finding(s) · effort small

Summary

The document states: medical-qa-tr — 'Turkish-language medical QA (regulated domain — ships with risk_assessment + safety eval pre-wired).'. Observed in the code: The template contains only model/lora/training/data blocks: no risk_assessment block and no evaluation/safety block. The quickstart module states that templates ship with 'safety/compliance opt-in only', and quickstart only patches model.name_or_path and data.dataset_name_or_path.

Primary finding

CR-A14-002 — medical-qa-tr template is documented as shipping risk_assessment + safety eval pre-wired, but contains neither

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. forgelm/templates/medical-qa-tr/config.yaml has only model/lora/training/data blocks, and quickstart's _materialize_config (forgelm/quickstart.py:278-303) only patches model and dataset, while docs/usermanuals/{en,tr}/reference/yaml-templates.md:26 say the template 'ships with risk_assessment + safety eval pre-wired'.

Where.

• forgelm/templates/medical-qa-tr/config.yaml:1-41
• forgelm/quickstart.py:7-10
• forgelm/quickstart.py:301-302
• forgelm/templates/medical-qa-tr/config.yaml:1-43
• docs/usermanuals/en/reference/yaml-templates.md:26 (confirmed)
• docs/usermanuals/tr/reference/yaml-templates.md:26 (confirmed)
• forgelm/quickstart.py:105-116
• forgelm/templates/medical-qa-tr/config.yaml (confirmed)
• forgelm/quickstart.py:278-303
• forgelm/quickstart.py:471-481

Evidence.

• forgelm/templates/medical-qa-tr/config.yaml:1-41; forgelm/quickstart.py:7-10; forgelm/quickstart.py:302-303
• The quickstart output med.yaml has top-level keys model/lora/training/data only. grep for risk|safety|evaluation finds nothing.
• Dry-run of qs-medical-qa-tr.yaml printed 'safety_scoring: None', 'compliance_configured: False', 'risk_classification: None'. grep for safety/compliance/risk in the materialised YAML found nothing.

Recommended fix. Row text: "Turkish-language medical QA (regulated domain — safety evaluation and risk_assessment are NOT pre-wired; add evaluation.safety and risk_assessment: yourself before any non-demo use)." Code fix tracked separately.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

DOC-D3B04A-003 — docs/usermanuals/en/reference/yaml-templates.md: false claim — medical-qa-tr — 'Turkish-language medical QA (regulated domain — ships with risk_assessment + safety eval pre-wired).'

severity Critical

Where. docs/usermanuals/en/reference/yaml-templates.md:26 (Turkish mirror: docs/usermanuals/tr/reference/yaml-templates.md:26) · type: false claim

The document says. medical-qa-tr — 'Turkish-language medical QA (regulated domain — ships with risk_assessment + safety eval pre-wired).'

What the code does. The template contains only model/lora/training/data blocks: no risk_assessment block and no evaluation/safety block. The quickstart module states that templates ship with 'safety/compliance opt-in only', and quickstart only patches model.name_or_path and data.dataset_name_or_path.

Code references. forgelm/templates/medical-qa-tr/config.yaml:1-41, forgelm/quickstart.py:7-10, forgelm/quickstart.py:302-303

User impact. A user picking the medical template for a regulated domain believes a safety gate and Art. 9 risk record are active. The model trains and ships with no safety evaluation at all.

Proposed correction. Row text: "Turkish-language medical QA (regulated domain — safety evaluation and risk_assessment are NOT pre-wired; add evaluation.safety and risk_assessment: yourself before any non-demo use)." Code fix tracked separately.

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.
• The release note names the contract this fix restores.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}