cemililik · May 6, 2026 · May 5, 2026 · May 5, 2026 · May 5, 2026 · May 5, 2026
@@ -210,3 +210,17 @@ jobs:
           test -f LICENSE || (echo "LICENSE file missing" && exit 1)
           head -1 LICENSE | grep -q "Apache" || (echo "Expected Apache License" && exit 1)
           echo "License: OK"
+
+      # Wave 4 / Faz 23: bandit static-security analysis on forgelm/.
+      # tests/ is excluded via [tool.bandit] in pyproject.toml because
+      # test fixtures legitimately use insecure patterns (assert, dummy
+      # secrets).  HIGH severity → fail; MEDIUM → warn; LOW → silent.
+      # See tools/check_bandit.py for the severity-tiering helper.
+      - name: bandit (static security analysis)
+        run: |
+          python -m pip install 'bandit[toml]>=1.7.0,<2.0.0'
+          # bandit returns exit 1 on ANY findings.  We capture the JSON
+          # report and apply our own severity policy via the tiering
+          # helper (tools/check_bandit.py).
+          bandit -c pyproject.toml -r forgelm/ -f json -o /tmp/bandit.json || true
+          python3 tools/check_bandit.py /tmp/bandit.json
@@ -215,9 +215,66 @@ jobs:
       - name: Run tests
         run: pytest tests/ -q --tb=short
 
+  supply-chain-security:
+    # ------------------------------------------------------------------
+    # Wave 4 / Faz 23: ISO 27001 / SOC 2 Type II alignment supply-chain
+    # security gate.
+    #
+    # Two scans, both run on the latest published deps so we catch CVEs
+    # the moment a dependency advisory drops, even before the team
+    # re-bumps versions:
+    #
+    # - pip-audit (transitive CVEs against the OSV / GHSA databases)
+    # - bandit (static-analysis on forgelm/ production code only)
+    #
+    # Severity policy (per tools/check_pip_audit.py + tools/check_bandit.py):
+    # HIGH/CRITICAL → fail nightly; MEDIUM → ::warning::; LOW → silent.
+    # Operators install the same tooling locally via
+    # `pip install forgelm[security]`.
+    # ------------------------------------------------------------------
+    name: Supply-chain security (pip-audit + bandit)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install ForgeLM with [security] extra
+        run: |
+          pip install --upgrade pip
+          pip install -e ".[security]"
+
+      - name: pip-audit (transitive CVE scan)
+        run: |
+          # pip-audit returns non-zero on any finding; capture the JSON
+          # and apply our own severity policy via tools/check_pip_audit.py.
+          pip-audit --format json --output /tmp/pip-audit.json || true
+          python3 tools/check_pip_audit.py /tmp/pip-audit.json
+
+      - name: bandit (static security analysis)
+        run: |
+          # Same scope/severity policy as ci.yml; nightly cadence catches
+          # newly-introduced HIGH issues even on long-lived branches.
+          bandit -c pyproject.toml -r forgelm/ -f json -o /tmp/bandit.json || true
+          python3 tools/check_bandit.py /tmp/bandit.json
+
+      - name: Upload security scan artifacts
+        if: always()
+        uses: actions/upload-artifact@v5
+        with:
+          name: supply-chain-scans
+          path: |
+            /tmp/pip-audit.json
+            /tmp/bandit.json
+
   notify-failure:
     name: Notify on failure
-    needs: [test-latest-deps, test-min-deps, wheel-install-smoke]
+    needs: [test-latest-deps, test-min-deps, wheel-install-smoke, supply-chain-security]
     if: failure()
     runs-on: ubuntu-latest
     permissions:

@@ -24,6 +24,9 @@ docs/analysis/code_reviews/*
 !docs/analysis/code_reviews/wave2b-final-merge-review-prompt.md
 !docs/analysis/code_reviews/wave3-review-prompt.md
 !docs/analysis/code_reviews/wave3-followup-review-prompt.md
+!docs/analysis/code_reviews/iso27001-soc2-alignment-202605052315.md
+!docs/analysis/code_reviews/wave4-review-prompt.md
+!docs/analysis/code_reviews/wave4-followup-review-prompt.md
 
 # Generated by tools/build_usermanuals.py — produced from
 # docs/usermanuals/<lang>/**/*.md during the CI deploy. Not committed;

@@ -4,6 +4,158 @@ All notable changes to ForgeLM are documented here.
 
 ## [Unreleased]
 
+### Wave 4 — Faz 22 + 23 + 26 + 30 (`closure/wave4-integration`)
+
+ISO 27001 / SOC 2 Type II alignment + QMS bilingual sweep + final
+documentation pass.
+
+**Faz 22 — ISO 27001 / SOC 2 alignment design**
+
+- New design document at
+  [`docs/analysis/code_reviews/iso27001-soc2-alignment-202605052315.md`](docs/analysis/code_reviews/iso27001-soc2-alignment-202605052315.md)
+  (~865 lines).  Maps every ISO 27001:2022 Annex A control (93
+  controls across A.5 + A.6 + A.7 + A.8) and every SOC 2 Trust
+  Services Criterion (Common Criteria CC1.x–CC9.x mandatory + 4
+  optional categories) to the ForgeLM feature that produces audit
+  evidence.  Coverage tally: FL (full) 11 / FL-helps 48 / OOS 34
+  (row-by-row recount of §3.1–§3.4; per-theme split A.5: 3 / 24 /
+  10, A.6: 0 / 5 / 3, A.7: 0 / 0 / 14, A.8: 8 / 19 / 7).
+  10-row Decision Log + 10-question deployer FAQ.
+
+**Faz 23 — ISO 27001 / SOC 2 alignment implementation**
+
+Supply-chain security tooling:
+
+- `pyproject.toml` — new `[security]` optional extra (`pip-audit`,
+  `bandit[toml]`).
+- `tools/check_pip_audit.py` (new) — pip-audit JSON severity gate;
+  HIGH / CRITICAL → exit 1, MEDIUM → `::warning::`, LOW silent.
+- `tools/check_bandit.py` (new) — bandit JSON severity gate; same
+  HIGH / MEDIUM / LOW tiering.
+- `.github/workflows/ci.yml` — `bandit` step on `forgelm/`
+  (production code only; tests/ excluded).
+- `.github/workflows/nightly.yml` — new `supply-chain-security` job
+  running `pip-audit` + `bandit` daily at 03:00 UTC.
+- `tests/test_supply_chain_security.py` (new) — 16 tests pinning
+  SBOM determinism contract + check_pip_audit + check_bandit
+  severity-tiering logic.
+
+QMS additions (EN ships now; TR mirrors land in Faz 26):
+
+- `docs/qms/encryption_at_rest.md` (new) — substrate-side encryption
+  guidance per ForgeLM artefact class.
+- `docs/qms/access_control.md` (new) — operator identity contract;
+  `FORGELM_OPERATOR` form recommendations; `FORGELM_AUDIT_SECRET`
+  rotation cadence; CI runner identity binding examples for GHA /
+  GitLab / Jenkins.
+- `docs/qms/risk_treatment_plan.md` (new) — pre-populated 12-row
+  ISO 27005 risk register covering ForgeLM-introduced risks
+  (training-data poisoning, supply-chain compromise, audit-log
+  tampering, memorisation residual, ReDoS, etc.).
+- `docs/qms/statement_of_applicability.md` (new) — 93-control SoA
+  matrix in QMS-style format.
+- `docs/qms/sop_incident_response.md` — Wave 4 §4 expansion (security
+  incidents: audit-chain integrity violation, credential leak,
+  supply-chain CVE, webhook compromise, GDPR Art. 15/17 DSAR
+  playbooks).
+- `docs/qms/sop_change_management.md` — Wave 4 §4 expansion (CI
+  gates as formal change-control mechanism — 11-row table mapping
+  each gate to ISO controls; Article 14 approval gate as CAB
+  substitute; config-drift + SBOM-drift detection).
+
+Operator guide + reference docs (EN+TR):
+
+- `docs/guides/iso_soc2_deployer_guide.md` (+ `-tr.md`) — deployer
+  audit cookbook covering 8 common audit-floor questions with the
+  exact ForgeLM artefact + grep / command answer.
+- `docs/reference/iso27001_control_mapping.md` (+ `-tr.md`) — ISO
+  Annex A reference table (93 controls × ForgeLM evidence).
+- `docs/reference/soc2_trust_criteria_mapping.md` (+ `-tr.md`) — SOC
+  2 TSC reference table.
+- `docs/reference/supply_chain_security.md` (+ `-tr.md`) — SBOM +
+  pip-audit + bandit overview for compliance teams.
+
+Cross-cutting:
+
+- `README.md` — new "ISO 27001 / SOC 2 Type II Alignment" bullet
+  under Enterprise & MLOps with explicit "alignment, not certified"
+  framing (closes the design doc's D-22-01 wording decision).
+- `tools/check_bilingual_parity.py` `_PAIRS` registry — added 14 new
+  pairs total (4 Faz-23 pairs: deployer guide + 3 reference docs;
+  10 Faz-26 QMS pairs); registry tally now 23 (was 9).
+- `docs/standards/localization.md` — `docs/qms/*.md` row flipped
+  from "No (yet)" to "Yes" to reflect the bilingual sweep.
+
+**Migration notes (Wave 4)**
+
+- **Rotation guidance reframed (`FORGELM_AUDIT_SECRET`).** Prior
+  0.5.x guidance recommended quarterly rotation. Wave 4 reframes
+  this to **between output-dir lifecycles** — every audit entry's
+  HMAC keys to the secret live at emit time, so rotating mid
+  output-dir breaks `forgelm verify-audit --require-hmac` for the
+  cross-secret span. Deployers running quarterly KMS-rotation
+  cron jobs today must align rotation to fresh `<output_dir>`
+  provisioning (rotate the secret + cut a new output-dir together).
+  See `docs/qms/access_control.md` §3.4 for the corrected procedure
+  and §8 verification checklist for the auditor-facing signal.
+- **`tools/check_bandit.py` malformed-report behaviour.** A bandit
+  JSON report carrying `{"results": null}` (malformed; rare) now
+  fails the gate (exit 1) where the prior `or []` collapse silently
+  treated it as a clean run. Operators whose nightly runs previously
+  passed against a corrupt bandit invocation must now investigate
+  the upstream bandit failure instead of consuming the silent pass.
+
+**Faz 26 — QMS bilingual mirror + compliance_summary cleanup**
+
+- 6 existing QMS TR mirrors: `README-tr.md`,
+  `roles_responsibilities-tr.md`, `sop_model_training-tr.md`,
+  `sop_data_management-tr.md`, `sop_incident_response-tr.md`,
+  `sop_change_management-tr.md`.
+- 4 new-Faz-23 QMS TR mirrors: `encryption_at_rest-tr.md`,
+  `access_control-tr.md`, `risk_treatment_plan-tr.md`,
+  `statement_of_applicability-tr.md`.
+- `docs/qms/README.md` (+ `-tr.md`) — table extended with the 4
+  Wave 4 QMS rows; "See also" section linking to compliance_summary
+  + ISO/SOC 2 deployer guide + audit event catalog.
+- `docs/reference/compliance_summary.md` — full rewrite: H1 + scope
+  blockquote, 11 stale `forgelm/x.py#L33`-style line anchors
+  replaced with module-path + symbol-name references that survive
+  refactor, "50 prompts × 3 categories" → "140 × 6", linked from
+  QMS README.
+- `tools/check_anchor_resolution.py` (new) — markdown link
+  resolution guard; advisory mode by default + `--strict` opt-in
+  for CI wire-up once tree is clean.  21 regression tests.
+
+**Faz 30 — Final documentation pass (partial)**
+
+Tier 1 ghost-feature drift fixes + stat-block updates:
+
+- GH-008 `verify-log` → `verify-audit` rename in
+  `usermanuals/{en,tr}/compliance/audit-log.md`.
+- GH-021 `forgelm chat` slash commands aligned with parser:
+  removed `/load`, `/top_p`, `/max_tokens`, `/safety on|off`;
+  `/quit` → `/exit`.  EN+TR mirror.
+- GH-022 `q6_k` quant level removed from
+  `usermanuals/{en,tr}/deployment/gguf-export.md` (parser only
+  supports `q2_k|q3_k_m|q4_k_m|q5_k_m|q8_0|f16`); `f16` row
+  added.
+- GH-024 `FORGELM_RESUME_TOKEN` env var removed from
+  `usermanuals/{en,tr}/compliance/human-oversight.md`; replaced
+  the API-automation block with the canonical CLI subcommand
+  flow (`forgelm approve` / `reject` + `forgelm approvals
+  --pending`); the v0.6.0+ Pro CLI roadmap callout flagged.
+- GH-025 `FORGELM_CACHE_DIR` env var removed from
+  `usermanuals/{en,tr}/getting-started/project-layout.md`;
+  `HF_HOME` declared canonical.
+- `docs/standards/testing.md` stat block: 48 → 67 test modules,
+  ~1410 tests.
+
+Deferred to Faz 30 follow-up (closure-plan task A + remaining O
+items + tasks J + N): GH-016/018/019/020 reference/cli.md cleanup,
+sample-audit user-facing doc triplet completion,
+`tools/check_cli_help_consistency.py`, full-suite anchor-checker
+`--strict` CI wire-up.
+
 ### Wave 3 — Faz 24 + 28 + 38 (`closure/wave3-integration`)
 
 Single integration branch covering three closure-plan phases:

@@ -54,6 +54,7 @@
 ### Enterprise & MLOps
 - **Config-Driven**: Declarative YAML — built for CI/CD pipelines, not notebooks
 - **EU AI Act Compliance**: Auto-generated audit trails, data provenance (SHA-256), training manifests
+- **ISO 27001 / SOC 2 Type II Alignment**: Software cannot be ISO/SOC 2 *certified* — only organisations can — but ForgeLM produces the audit-trail, change-management, data-lineage, and supply-chain evidence the deployer's auditor explicitly asks for. CycloneDX 1.5 SBOM per release, `pip-audit` nightly, `bandit` CI, append-only HMAC-chained audit log (HMAC integrity is active **only when** `FORGELM_AUDIT_SECRET` is set + KMS-managed + rotated between output-dir lifecycles — see [`docs/qms/access_control.md`](docs/qms/access_control.md) §3.4), Article 14 staging gate, Article 15/17 GDPR tooling. See [`docs/guides/iso_soc2_deployer_guide.md`](docs/guides/iso_soc2_deployer_guide.md) for the deployer audit cookbook + 93-control coverage map.
 - **Docker**: Official Dockerfile and docker-compose for portable deployment
 - **Offline / Air-Gapped**: Full operation without internet for regulated industries
 - **JSON Output**: Machine-readable results with `--output-format json` for pipeline integration

@@ -91,15 +91,15 @@ Her faz bir veya birden çok PR'la kapanır. Sıralama dependency-driven; parale
 | **19** | **Library API support — Implementation** | Tek PR | 1 | Faz 18 | ✅ Wave 2b (PR #30) |
 | **20** | **GDPR right-to-erasure — Analysis & design** | Tek PR | 1 | Faz 6 + 9 (audit + staging) | ✅ Wave 2a (PR #28) |
 | **21** | **GDPR right-to-erasure — Implementation** | Tek PR | 1 | Faz 20 | ✅ Wave 2b (PR #30) |
-| **22** | **ISO 27001 / SOC 2 Type II — Analysis & gap assessment** | Tek PR | 1 | Faz 3, 6, 7, 8, 9, 21 (security + compliance baseline) | ⏳ PENDING |
-| **23** | **ISO 27001 / SOC 2 Type II — Implementation** | Tek PR (büyük) | 1 | Faz 22 | ⏳ PENDING |
+| **22** | **ISO 27001 / SOC 2 Type II — Analysis & gap assessment** | Tek PR | 1 | Faz 3, 6, 7, 8, 9, 21 (security + compliance baseline) | ✅ Wave 4 (PR pending) |
+| **23** | **ISO 27001 / SOC 2 Type II — Implementation** | Tek PR (büyük) | 1 | Faz 22 | ✅ Wave 4 (PR pending) |
 | **24** | Bilingual TR mirror sweep (configuration-tr, distributed-tr, ingestion-tr, EN/TR user-manual H2 drift) | Tek PR | 1 | Faz 16 (description= migration ile config docs auto-gen) | ✅ Wave 3 (PR #31) |
 | **25** | Site picker honesty + site-as-tested-surface CI guard | Tek PR | 1 | Faz 1 (site honesty fixes önce) | ✅ DONE |
-| **26** | QMS bilingual EN+TR mirror + compliance docs cleanup | Tek PR | 1 | Faz 23 (ISO/SOC 2 dokümanları QMS ile lockstep) | ⏳ PENDING |
+| **26** | QMS bilingual EN+TR mirror + compliance docs cleanup | Tek PR | 1 | Faz 23 (ISO/SOC 2 dokümanları QMS ile lockstep) | ✅ Wave 4 (PR pending) |
 | **27** | Silent `except Exception:` sweep (Theme D residual) | Tek PR | 1 | — | ✅ DONE |
 | **28** | Remaining Major + Minor cleanup | Tek PR | 1 | Hepsi öncesindekilere bağlı | ✅ Wave 3 (PR #31; tier 1+2 absorbed) |
 | **29** | Nit sweep (40 madde mass-edit) | Tek PR | 1 | — | ✅ DONE |
-| **30** | **Final documentation + site finalization (EN+TR only)** — tüm `docs/` + `docs/usermanuals/{en,tr}/` + `site/*` v0.5.5 nihai durumuna senkron | Tek PR | 1 | **Faz 1-29 + 34-38** (tüm fonksiyonel iş bitmiş olmalı) | ⏳ PENDING |
+| **30** | **Final documentation + site finalization (EN+TR only)** — tüm `docs/` + `docs/usermanuals/{en,tr}/` + `site/*` v0.5.5 nihai durumuna senkron | Tek PR | 1 | **Faz 1-29 + 34-38** (tüm fonksiyonel iş bitmiş olmalı) | ✅ Wave 4 (PR pending; partial — Tier 1 ghost feature drift + stat blocks; full sweep deferred to Faz 30 follow-up) |
 | **31** | **Cross-OS release-tag matrix workflow** | Tek PR | 1 | — (release öncesi her şeyden) | ✅ DONE |
 | **32** | `.pre-commit-config.yaml` (opsiyonel — kullanıcı tercihi) | Tek PR | 1 | — | ✅ DONE |
 | **34** | **`forgelm doctor` env-check subcommand** (GH-001 — onboarding bloker) | Tek PR | 1 | Faz 15 (cli/ split) | ✅ Wave 2a (PR #28) |
@@ -116,6 +116,7 @@ Her faz bir veya birden çok PR'la kapanır. Sıralama dependency-driven; parale
 - ✅ Wave 2a (PR #28) — `closure/wave2a-integration` → development, 2026-05-04; faz tamamlandı.
 - ✅ Wave 2b (PR #30) — `closure/wave2b-integration` → development, 2026-05-05 (merge commit `b05edb5`); faz tamamlandı.
 - ✅ Wave 3 (PR #31) — `closure/wave3-integration` → development, 2026-05-05 (merge commit `b87c872`); faz tamamlandı.
+- ✅ Wave 4 (PR pending) — `closure/wave4-integration` → development, 2026-05-06; ISO 27001 / SOC 2 alignment dalı + QMS bilingual mirror sweep + Faz 30 partial (Tier 1 ghost-feature drift + stat blocks).
 - ⏳ PENDING — henüz başlanmadı; bağımlılıkları sağlanan ilk batch sıradaki Wave 4+'da açılır.
 - ⏳ POST-WAVE — release fazı (33), tüm fonksiyonel iş bittikten sonra son.
 
@@ -127,7 +128,9 @@ Her faz bir veya birden çok PR'la kapanır. Sıralama dependency-driven; parale
 
 **Wave 3 kapanış özeti (post-merge, 2026-05-05):** 3 faz tamamlandı (Faz 24 bilingual TR mirror sweep + `tools/check_bilingual_parity.py` CI guard, Faz 28 curated tier 1+2 cleanup, Faz 38 `forgelm reverse-pii` GDPR Article 15 subcommand). PR #31 → development (merge commit `b87c872`). Yeni: 1 CLI subcommand (`reverse-pii`), 1 audit event (`data.access_request_query`), 1 yeni CI guard tool (`tools/check_bilingual_parity.py`). Behaviour change: high-risk + unacceptable + safety-disabled artık `ConfigError` raise eder (F-compliance-110, OR-across-fields strict gate). Webhook timeout default 5s → 10s (F-compliance-106). 12 commit (1 ana + 11 absorption rounds: 4-agent original review + 5 SonarCloud findings + 14 inline review comments across CodeRabbit/Gemini/inline + 5 follow-up multi-agent review absorptions). Suite 1298 → 1374 tests (+76 net).
 
-**Kalan iş (Wave 4+):** 4 faz + 1 release. Pending: Faz 22 (ISO 27001/SOC 2 design), Faz 23 (ISO 27001/SOC 2 impl), Faz 26 (QMS bilingual mirror), Faz 30 (final docs + site finalization). Release: Faz 33 (v0.5.5 PyPI publish). Bağımlılık zinciri: 22 → 23 → 26 (QMS lockstep ISO/SOC 2 docs ile), Faz 30 tüm fonksiyonel iş bittikten sonra (yani 22+23+26 kapanmadan açılmaz), Faz 33 son.
+**Wave 4 kapanış özeti (2026-05-06, PR #33 pending):** 4 faz tamamlandı (Faz 22 ISO 27001 / SOC 2 alignment design, Faz 23 implementation, Faz 26 QMS bilingual mirror + compliance_summary cleanup + anchor checker, Faz 30 partial Tier 1 ghost-feature drift + stat blocks). Branch: `closure/wave4-integration`. Yeni: 1 design dosyası (~865 satır), 4 yeni QMS doküman (encryption_at_rest, access_control, risk_treatment_plan, statement_of_applicability) + bunların TR mirror'ları + 6 mevcut QMS dosyası için yeni TR mirror (toplam 10 yeni QMS TR mirror), 1 yeni guide (deployer cookbook EN+TR), 3 yeni reference (iso27001_control_mapping EN+TR, soc2_trust_criteria_mapping EN+TR, supply_chain_security EN+TR), 3 yeni tool (`tools/check_pip_audit.py`, `tools/check_bandit.py`, `tools/check_anchor_resolution.py`), 1 yeni `[security]` optional extra (pip-audit + bandit), 1 yeni nightly job (supply-chain-security). Behaviour change: yok. Suite 1374 → 1411 tests (+37 net: 16 supply-chain + 21 anchor checker yeni dosyalardan). compliance_summary.md tam rewrite (line-anchored references symbol-references'a geçti). Bilingual parity 9/9 → 23/23 (4 Faz-23 + 10 Faz-26 QMS pair'i eklendi).
+
+**Kalan iş (Wave 4+):** 1 release. Pending: Faz 33 (v0.5.5 PyPI publish, post-wave). Optional follow-up before release: Faz 30 full sweep (kalan Tier 1 ghost-feature drift items GH-016/018/019/020, sample-audit user-facing doc triplet completion, tools/check_cli_help_consistency.py addition, full-suite anchor-checker --strict CI wire-up).
 
 ---