Wave 0 — next release: restore the security contract

Open

Due by October 28, 2026

•Last updated Oct 15, 2026

Critical findings and urgent ('now') currency items with their companions: the contract the next release must restore. Holds the October and September 2026 review findings and roadmap items of this priority. The release number is set at the cut (docs/standards/release.md), not by this milestone.

4% complete

docs/reference/iso27001_control_mapping.md: false claim — A.5.3 Segregation of duties: human_approval.required/granted enforces trainer ≠ approver (DOC-D1B06-002)
HodeTech/ForgeLM#73 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
--offline / model.offline only sets HF env vars; webhooks, API judge, API teacher and trackers still reach the network, contrary to the air-gap manual (CR-A01-001)
HodeTech/ForgeLM#74 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
1
Regulation: EU AI Act: High-risk application dates stated in docs/product_strategy.md:28,139(,149), docs/guides/safety_compliance.md:244, their TR mirrors and docs/roadmap/risks-and-decisions.md (inc… (TECH-T10-001)
HodeTech/ForgeLM#75 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
verify-gguf without the gguf package and without a sidecar accepts any file that starts with 'GGUF' (CR-A09-002)
HodeTech/ForgeLM#83 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Forgelm export never writes the <gguf>.sha256 sidecar that verify-gguf and the docs rely on, so verify-gguf passes a tampered export with exit 0 (CR-A09-005)
HodeTech/ForgeLM#84 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
gguf-export.md (EN+TR) shows verify-gguf checking vocab size, manifest sha256 and tokenizer round-trip, none of which exist (CR-A09-006)
HodeTech/ForgeLM#85 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Site copy in six languages says verify-gguf 're-checks the SHA-256 + size manifest stamped at export time'. It checks no size, and nothing reads the export-stamped record (CR-A18-009)
HodeTech/ForgeLM#86 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Safety gate with evaluation_completed=False (no usable evidence) ends the run as a success: exit 0, success:true, pipeline.completed, even with auto_revert (CR-A02-001)
HodeTech/ForgeLM#87 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
1
Default evaluation.safety.test_prompts 'safety_prompts.jsonl' does not exist and is not shipped; enabling safety with the default never evaluates (CR-A01-004)
HodeTech/ForgeLM#88 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Code does not match site/compliance.html: Benchmark gates per-task floor; if the post-train number drops below the floor, the run fails (exit 3). (CR-A01-010)
HodeTech/ForgeLM#89 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
docs/guides/iso_soc2_deployer_guide.md: false claim — evaluation.require_human_approval: true for every high-risk/unacceptable run — 'F-compliance-110 raises ConfigError if you forget.' (DOC-D2B03-003)
HodeTech/ForgeLM#90 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
docs/roadmap/completed-phases.md: false claim — The per-turn Llama Guard screen is planned; 'today operators get the same screening by enabling safety: enabled: true in the YAML config the chat REP… (DOC-D2B07-001)
HodeTech/ForgeLM#91 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
retention.enforce (block_on_excess / warn_on_excess) has no runtime reader: the documented trainer pre-flight gate never runs (CR-A01-006)
HodeTech/ForgeLM#92 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Code does not match site/compliance.html: forgelm approve / reject + forgelm approvals drive the dual-controlled sign-off ... every model promotion is dual-controlled and forensic… (CR-A01-009)
HodeTech/ForgeLM#94 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Privacy page and air-gap manual promise 'does not phone home / no telemetry', but every online training run sends TRL usage telemetry to huggingface.co (CR-A01-015)
HodeTech/ForgeLM#95 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Code does not match docs/usermanuals/en/getting-started/first-run.md: The run produces checkpoints/customer-support/artifacts/ with annex_iv_metadata.json, audit_log.jsonl, data… (CR-A02-023)
HodeTech/ForgeLM#96 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
medical-qa-tr template is documented as shipping risk_assessment + safety eval pre-wired, but contains neither (CR-A14-002)
HodeTech/ForgeLM#97 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Wizard presents retention.enforce and monitoring.* as active enforcement and hooks, but no runtime code reads them (CR-A18-003)
HodeTech/ForgeLM#98 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Site, QMS SOP and ISO guide claim 'dual-controlled' model promotion; approve/reject never compare the approver with the trainer (CR-A18-007)
HodeTech/ForgeLM#99 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Code does not match docs/usermanuals/en/operations/air-gap.md: --offline: W&B/MLflow/Comet Disabled; OpenAI/Anthropic judges Disabled; Webhooks Disabled (or restricted via webhook… (CR-MISC-004)
HodeTech/ForgeLM#100 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
1
GDPR page claims masked JSONL holds no identifiable subjects and that no person's data is recoverable from the model; its YAML example is rejected (CR-A11-001)
HodeTech/ForgeLM#101 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
1
Memorisation warning looks only at <output_dir>/final_model, and output_dir defaults to the corpus folder, so a default invocation never warns (CR-A10-022)
HodeTech/ForgeLM#102 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
training.rope_scaling (as documented and as the wizard emits it) crashes every model load on transformers 5.x, while the validator and --dry-run accept it (CR-A01-005)
HodeTech/ForgeLM#103 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
FSDP wiring uses the deprecated string form; no_shard/hybrid_shard raise and backward_prefetch/auto_wrap are ignored under transformers' FSDP2 default (CR-A02-006)
HodeTech/ForgeLM#104 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
Trainer tests fake, patch or skip every real TRL config construction, so TRL/transformers API drift is undetectable (CR-A02-011)
HodeTech/ForgeLM#105 · opened on Oct 9, 2026 · Wave 0 — next release: restore the security contract
1

Navigation Menu

Wave 0 — next release: restore the security contract

docs/reference/iso27001_control_mapping.md: false claim — A.5.3 Segregation of duties: `human_approval.required/granted` enforces trainer ≠ approver (DOC-D1B06-002)

--offline / model.offline only sets HF env vars; webhooks, API judge, API teacher and trackers still reach the network, contrary to the air-gap manual (CR-A01-001)

Regulation: EU AI Act: High-risk application dates stated in docs/product_strategy.md:28,139(,149), docs/guides/safety_compliance.md:244, their TR mirrors and docs/roadmap/risks-and-decisions.md (inc… (TECH-T10-001)

verify-gguf without the gguf package and without a sidecar accepts any file that starts with 'GGUF' (CR-A09-002)

Forgelm export never writes the <gguf>.sha256 sidecar that verify-gguf and the docs rely on, so verify-gguf passes a tampered export with exit 0 (CR-A09-005)

gguf-export.md (EN+TR) shows verify-gguf checking vocab size, manifest sha256 and tokenizer round-trip, none of which exist (CR-A09-006)

Site copy in six languages says verify-gguf 're-checks the SHA-256 + size manifest stamped at export time'. It checks no size, and nothing reads the export-stamped record (CR-A18-009)

Safety gate with evaluation_completed=False (no usable evidence) ends the run as a success: exit 0, success:true, pipeline.completed, even with auto_revert (CR-A02-001)

Default evaluation.safety.test_prompts 'safety_prompts.jsonl' does not exist and is not shipped; enabling safety with the default never evaluates (CR-A01-004)

Code does not match site/compliance.html: Benchmark gates per-task floor; if the post-train number drops below the floor, the run fails (exit 3). (CR-A01-010)

docs/guides/iso_soc2_deployer_guide.md: false claim — `evaluation.require_human_approval: true` for every high-risk/unacceptable run — 'F-compliance-110 raises ConfigError if you forget.' (DOC-D2B03-003)

docs/roadmap/completed-phases.md: false claim — The per-turn Llama Guard screen is planned; 'today operators get the same screening by enabling `safety: enabled: true` in the YAML config the chat REP… (DOC-D2B07-001)

retention.enforce (block_on_excess / warn_on_excess) has no runtime reader: the documented trainer pre-flight gate never runs (CR-A01-006)

Code does not match site/compliance.html: forgelm approve / reject + forgelm approvals drive the dual-controlled sign-off ... every model promotion is dual-controlled and forensic… (CR-A01-009)

Privacy page and air-gap manual promise 'does not phone home / no telemetry', but every online training run sends TRL usage telemetry to huggingface.co (CR-A01-015)

Code does not match docs/usermanuals/en/getting-started/first-run.md: The run produces `checkpoints/customer-support/artifacts/` with annex_iv_metadata.json, audit_log.jsonl, data… (CR-A02-023)

medical-qa-tr template is documented as shipping risk_assessment + safety eval pre-wired, but contains neither (CR-A14-002)

Wizard presents retention.enforce and monitoring.* as active enforcement and hooks, but no runtime code reads them (CR-A18-003)

Site, QMS SOP and ISO guide claim 'dual-controlled' model promotion; approve/reject never compare the approver with the trainer (CR-A18-007)

Code does not match docs/usermanuals/en/operations/air-gap.md: --offline: W&B/MLflow/Comet Disabled; OpenAI/Anthropic judges Disabled; Webhooks Disabled (or restricted via webhook… (CR-MISC-004)

GDPR page claims masked JSONL holds no identifiable subjects and that no person's data is recoverable from the model; its YAML example is rejected (CR-A11-001)

Memorisation warning looks only at <output_dir>/final_model, and output_dir defaults to the corpus folder, so a default invocation never warns (CR-A10-022)

training.rope_scaling (as documented and as the wizard emits it) crashes every model load on transformers 5.x, while the validator and --dry-run accept it (CR-A01-005)

FSDP wiring uses the deprecated string form; no_shard/hybrid_shard raise and backward_prefetch/auto_wrap are ignored under transformers' FSDP2 default (CR-A02-006)

Trainer tests fake, patch or skip every real TRL config construction, so TRL/transformers API drift is undetectable (CR-A02-011)

Issues