[cemililik]

Summary

Wave 4 closure-plan sweep: 4 phases consolidated on closure/wave4-integration.

• Faz 22 — ISO 27001 / SOC 2 Type II alignment design (docs/analysis/code_reviews/iso27001-soc2-alignment-202605052315.md, ~865 lines, 93 Annex A controls + 5 SOC 2 categories mapped, 10-row Decision Log + 10-question deployer FAQ).
• Faz 23 — ISO/SOC 2 alignment implementation: pip-audit + bandit CI/nightly; new tools/check_pip_audit.py + tools/check_bandit.py; [security] optional extra in pyproject.toml; 4 new QMS docs (encryption_at_rest, access_control, risk_treatment_plan, statement_of_applicability); deployer guide (EN+TR); 3 new reference docs (iso27001 / soc2 / supply_chain_security, EN+TR); README + CHANGELOG updates; 16 new supply-chain tests.
• Faz 26 — QMS bilingual mirror: 6 existing QMS TR mirrors + 4 new-Faz-23 QMS TR mirrors; full rewrite of compliance_summary.md (H1 + scope blockquote + line-anchor cleanup); tools/check_anchor_resolution.py advisory-mode-default markdown link checker; 21 new tests.
• Faz 30 partial — Tier 1 ghost-feature drift fixes (Nightly CI failure — 2026-04-26 #8/021/022/024/025); stat-block update; closure-plan sync. Remaining Faz 30 items (sample-audit user-facing doc completion, Feat/site multilang user guide #16/018/019/020, tools/check_cli_help_consistency.py, anchor-strict CI wire-up) explicitly deferred — see CHANGELOG for the deferral list.

No behaviour change. Wave 4 ships docs, supply-chain CI tooling, and 4 new QMS / 6 new doc-pair files. Zero CLI subcommand additions; zero Pydantic schema changes; no wizard / notebook integration needed.

Türkçe özet

Wave 4 dört fazlık ISO 27001 / SOC 2 uyum dalını + QMS bilingual sweep'i + Faz 30 final-doc pass'ının partial ilk turunu kapatıyor.

• Faz 22 — Tasarım dosyası. ForgeLM'in yazılım olarak ISO sertifika alamayacağı gerçeğini açıkça belirten, ama deployer'ın kendi ISO 27001 + SOC 2 Type II denetiminde ForgeLM'in ürettiği audit-trail / change-control / data-lineage / supply-chain kanıtlarını nasıl kullanabileceğini 93 ISO Annex A kontrolü + 5 SOC 2 kategorisi üzerinde uçtan uca eşleştiren ~865 satırlık tasarım dökümanı.
• Faz 23 — Implementation. pip-audit + bandit nightly + CI gate'leri. SBOM zaten Wave 2'de shipped (CycloneDX 1.5); Faz 23 onun üzerine determinism contract testi ekledi. 4 yeni QMS dokümanı (encryption-at-rest, access control, risk treatment plan, statement of applicability) + 1 yeni deployer cookbook + 3 yeni reference tablo. Hepsi EN+TR. Bilingual parity 9 → 13 doc çiftine yükseldi.
• Faz 26 — QMS bilingual + compliance_summary cleanup. Wave 0 dönemindeki 6 QMS dokümanının TR mirror'ları + Faz 23'te eklenen 4 yeni QMS'in TR mirror'ları (toplam 10 yeni TR dosyası). compliance_summary.md tamamen yeniden yazıldı: H1 + scope blockquote eklendi, 11 stale forgelm/x.py#L33 line anchor'ı symbol-name reference'a geçti, "50 prompts × 3 categories" → "140 × 6" güncellendi. Yeni tools/check_anchor_resolution.py markdown anchor + relative-link guard'ı (advisory-mode default + --strict opt-in) + 21 regression test.
• Faz 30 — Final docs partial. En kritik 5 ghost-feature drift düzeltmesi (verify-log → verify-audit, FORGELM_RESUME_TOKEN kaldırma, FORGELM_CACHE_DIR → HF_HOME, q6_k removal, chat slash command alignment) + testing.md stat block güncellemesi (48 → 67 module). Faz 30'un kalan büyük kısmı (17-row user-facing doc triplet completion, kalan ghost-feature drift, yeni CLI consistency checker tool) explicit olarak Faz 30 follow-up'a ertelendi — closure plan'da ve CHANGELOG'da listelendi.

Behaviour change YOK. Wave 4 yalnızca docs + supply-chain CI tooling + 4 yeni QMS + 6 yeni doc-pair gönderiyor. CLI subcommand eklenmedi; Pydantic schema değişmedi; wizard / notebook entegrasyonu gerekmiyor.

Test plan

• ruff format + ruff check clean across forgelm/, tests/, tools/.
• pytest tests/ — 1397 passed, 14 skipped (was 1374 → +23 net: 16 supply-chain + 21 anchor checker - 14 displaced).
• python3 tools/check_bilingual_parity.py --strict → 13/13 OK (was 9/9; added 4 new pairs).
• python3 tools/check_anchor_resolution.py (advisory) → 36 broken-link warnings unchanged from pre-Faz-26 baseline; will shrink to 0 in Faz 30 follow-up.
• forgelm --config config_template.yaml --dry-run → green.
• python3 tools/generate_sbom.py → emits valid CycloneDX 1.5 JSON.
• Closure plan synced to ✅ Wave 4 (PR pending) for Faz 22/23/26/30.

Files

• 5 new code/tool files (tools/check_pip_audit.py, tools/check_bandit.py, tools/check_anchor_resolution.py, tests/test_supply_chain_security.py, tests/test_check_anchor_resolution.py).
• 1 new design doc (docs/analysis/code_reviews/iso27001-soc2-alignment-202605052315.md, 865 lines).
• 4 new QMS docs (EN) + 10 new QMS TR mirrors (4 new-Faz-23 + 6 existing-QMS).
• 1 new guide pair (deployer cookbook EN+TR).
• 3 new reference pairs (iso27001 / soc2 / supply_chain_security EN+TR).
• 5 modified usermanual EN+TR pairs (audit-log, human-oversight, chat, gguf-export, project-layout) for ghost-feature drift.
• pyproject.toml, README.md, CHANGELOG.md, docs/standards/testing.md, docs/qms/sop_*.md, docs/qms/README.md, docs/reference/compliance_summary.md, tools/check_bilingual_parity.py, .github/workflows/ci.yml, .github/workflows/nightly.yml, docs/analysis/code_reviews/closure-plan-202604300906.md.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added ISO 27001 / SOC 2 Type II compliance alignment tooling and evidence artifacts.
  • Integrated supply-chain security scanning (pip-audit and bandit in CI/nightly workflows).

• Documentation

  • Expanded compliance guides: ISO/SOC 2 deployer audit cookbook, risk treatment plans, and QMS templates.
  • Added comprehensive bilingual documentation (English/Turkish) for governance, access control, and encryption.
  • Enhanced GDPR erasure guidance with audit salt and identifier-hashing clarifications.

• Chores

  • Automated anchor-link resolution verification across documentation.
  • Refined bilingual parity checks for new compliance and reference materials.

[qodo-code-review]

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

[sourcery-ai]

Sorry @cemililik, your pull request is larger than the review limit of 150000 diff characters

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5e624cbe-f282-4a03-bb77-31aa6f526ac9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch closure/wave4-integration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codacy-production]

Not up to standards ⛔

🔴 Issues 100 minor

Alerts:
⚠ 100 issues (≤ 0 issues of at least minor severity)

Results:
100 new issues

Category	Results
CodeStyle	100 minor

View in Codacy

🟢 Metrics 220 complexity · 4 duplication

Metric	Results
Complexity	220
Duplication	4

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[gemini-code-assist]

Code Review

This pull request implements the ISO 27001 / SOC 2 Type II alignment for ForgeLM, including new security tooling (pip-audit, bandit), QMS documentation, and compliance guides. The review identified a missing registration of new QMS documents in the bilingual parity check and a syntax error in a jq command used for auditing segregation of duties. Both issues have been addressed with actionable feedback.

[gemini-code-assist]

This pull request introduces 10 new QMS documents with their Turkish translations, but they don't seem to be added to the _PAIRS tuple for the bilingual parity check. This means their structural parity won't be enforced by the CI.

The PR description mentions:

• 6 existing QMS TR mirrors
• 4 new-Faz-23 QMS TR mirrors

Please add these 10 new QMS document pairs to the _PAIRS tuple to ensure they are covered by the parity check.

[cemililik]

Absorbed in ffceaf7 — _PAIRS now registers all 10 QMS pairs (4 Faz-23 + 6 existing). python3 tools/check_bilingual_parity.py --strict now reports 23/23 OK. docs/standards/localization.md was also flipped to allow QMS bilingual mirrors (the standard had said "No (yet)" before this wave reversed the policy).

[gemini-code-assist]

This jq query appears to be syntactically incorrect and will not work as intended. The expression [.|.run_id == .. .run_id ...] is not valid jq syntax.

To find approvals where the trainer is the same as the approver, you could use jq variables to store the context. Here is a corrected version of the command that should achieve your goal:

Suggested change

	# Find approvals where trainer == approver (segregation violation)
	forgelm verify-audit --output-dir ./outputs --json | jq '
	.events[] |
	select(.event == "human_approval.granted") |
	.matching_training_event = (
	[.|.run_id == .. .run_id and .event == "training.started"] | first
	) |
	select(.operator == .matching_training_event.operator) |
	.'
	```
	forgelm verify-audit --output-dir ./outputs --json | jq '
	.events as $all_events |
	.events[] |
	select(.event == "human_approval.granted") |
	. as $approval_event |
	.matching_training_event = (
	$all_events[] | select(.run_id == $approval_event.run_id and .event == "training.started") | first
	) |
	select(.matching_training_event and .operator == .matching_training_event.operator)
	'

[cemililik]

Absorbed in ffceaf7 — the entire jq snippet was replaced with a --slurpfile-based two-pass that actually parses. Side-effect: the same commit also fixed the broken forgelm verify-audit --output-dir ./outputs --json invocation (those flags do not exist on the parser; positional log_path + --require-hmac is the shipping form).

[coderabbitai]

Actionable comments posted: 8

Note

Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docs/standards/testing.md (1)

8-37: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Directory tree is stale relative to the updated module count.

The header now claims 67 test modules but the "Current structure" tree still lists only 23 test_*.py files. The new modules added in this wave (e.g., test_supply_chain_security.py, test_check_anchor_resolution.py) are not reflected. A contributor counting tree entries will get 23, not 67, and the discrepancy undermines the doc as a reference.

The tree should either enumerate the missing modules or note explicitly that it shows a representative subset.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/standards/testing.md` around lines 8 - 37, The header "Current structure
(67 test modules, one per feature area; ~1410 tests)" is inconsistent with the
listed tree block; update docs/standards/testing.md so the "Current structure"
either enumerates the missing test files (e.g., add entries like
test_supply_chain_security.py, test_check_anchor_resolution.py and any other new
test_*.py modules) to match the stated count, or change the heading and add a
clear note that the shown tree is a representative subset rather than a full
listing; locate the header string "Current structure (67 test modules, one per
feature area; ~1410 tests)" and the following code block to make this change.

🟡 Minor comments (13)

docs/usermanuals/en/deployment/gguf-export.md-28-29 (1)

28-29: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Line 118 uses incorrect flag --quant fp16 instead of --quant f16.

The quantisation table (line 28) correctly shows f16 at 13 GB, but the "Direct conversion" example (line 118) incorrectly uses --quant fp16. The codebase only recognizes f16; using fp16 will fail. Additionally, the section states ~14 GB for a 7B model versus 13 GB in the table—a minor variance, but both should reflect the same lossless format.

Change line 118 from --quant fp16 to --quant f16 for consistency with the table and correctness against the codebase.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/usermanuals/en/deployment/gguf-export.md` around lines 28 - 29, Replace
the incorrect quant flag used in the "Direct conversion" example by changing the
flag value `--quant fp16` to the recognized `--quant f16` (ensure the example
command uses `--quant f16`), and update the size mention to match the
quantisation table's lossless `f16` entry (change "~14 GB" to "13 GB") so the
example and the table are consistent; look for the example command and size text
that reference `--quant fp16` and "~14 GB" and edit them accordingly.

docs/analysis/code_reviews/ghost-features-analysis-20260502.md-604-604 (1)

604-604: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Internal contradiction with GH-1 “no _doctor.py” claim

Line 604 now says _doctor.py exists, but Line 110 still states there is no _doctor.py. Please reconcile these statements (or explicitly time-scope Line 604) so the report remains self-consistent.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/analysis/code_reviews/ghost-features-analysis-20260502.md` at line 604,
The document has contradictory statements about _doctor.py (Line 604 shows
forgelm/cli/subcommands/_doctor.py exists referencing FORGELM_RESUME_TOKEN,
while Line 110 claims no _doctor.py); update the GH-001 claim or the Line 604
wording so they match: either change the GH-001 assertion (the _doctor.py file
exists but only contains a defensive secret-mask entry for FORGELM_RESUME_TOKEN
and does not read the env var) or add a clear time-scope/clarifier at Line 604
stating this is a defensive mask-only reference to avoid future accidental
exposure; ensure you reference the file name forgelm/cli/subcommands/_doctor.py
and the symbol FORGELM_RESUME_TOKEN in the revised sentence so the reader sees
they refer to the same artifact.

docs/usermanuals/tr/compliance/human-oversight.md-83-83 (1)

83-83: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Unify audit event naming across this document.

This line introduces dotted event names (human_approval.granted / human_approval.rejected) while other sections in the same file still use underscore variants (e.g., human_approval_granted, human_approval_request). Please standardize to one canonical event schema to avoid operator confusion and mismatched grep/automation queries in runbooks.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/usermanuals/tr/compliance/human-oversight.md` at line 83, The document
mixes dotted and underscored audit event names (e.g., human_approval.granted /
human_approval.rejected vs human_approval_granted and human_approval_request);
pick a single canonical schema (either dotted or underscored), then update all
occurrences to that form—including the examples in this sentence (replace
human_approval.granted / human_approval.rejected to the chosen form) and any
other mentions of human_approval_granted or human_approval_request to maintain
consistency across the file and ensure grep/automation queries work reliably.

docs/guides/iso_soc2_deployer_guide.md-262-265 (1)

262-265: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Overstated verifier contract around manifest sidecar (Line 263).

This says forgelm verify-audit requires audit_log.manifest.json, but the verifier checks the sidecar when present rather than hard-requiring it. Please soften wording to “required for truncate-and-resume detection/higher assurance” to match runtime behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/iso_soc2_deployer_guide.md` around lines 262 - 265, The wording
overstates the verifier's requirement: change the sentence that says "`forgelm
verify-audit` requires `audit_log.manifest.json`" to a softer statement that the
manifest sidecar (`audit_log.manifest.json`) is not strictly required but is
necessary for truncate-and-resume detection and provides higher assurance;
update the text around "Back BOTH up." to reflect that the verifier will check
the sidecar when present and that backing up both files is recommended for full
tamper-detection coverage.

docs/qms/statement_of_applicability.md-154-158 (1)

154-158: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Internal section reference appears wrong (Line 154).

The text says “Row-by-row recount of §3.1–§3.4,” but the control tables are in §2.1–§2.4. Please correct the section pointer.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/qms/statement_of_applicability.md` around lines 154 - 158, Replace the
incorrect internal section reference "Row-by-row recount of §3.1–§3.4" with the
correct pointer "Row-by-row recount of §2.1–§2.4" (search for the exact string
"§3.1–§3.4" in the document); update any adjacent mentions that reference "§3"
coverage tallies to "§2" if they were intended to point to the control tables,
and run a quick scan for other mismatched §3/§2 references to ensure consistency
with the control tables in §2.1–§2.4.

docs/qms/sop_incident_response-tr.md-10-12 (1)

10-12: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Duplicate phrase in purpose statement (Line 10-12).

“güvenlik olaylarını” is repeated in the same sentence. Removing one occurrence will improve clarity.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/qms/sop_incident_response-tr.md` around lines 10 - 12, Remove the
duplicated phrase "güvenlik olaylarını" in the purpose sentence so it reads
smoothly; update the sentence containing "Dağıtılan fine-tuned modeller için
güvenlik olaylarını, model arızalarını, **güvenlik olaylarını** ve düzeltici
eylemleri yönetme prosedürünü tanımla." to a single instance (e.g., "Dağıtılan
fine-tuned modeller için güvenlik olaylarını, model arızalarını ve düzeltici
eylemleri yönetme prosedürünü tanımla.") and leave the Wave 4 / Faz 23 reference
unchanged.

docs/guides/iso_soc2_deployer_guide.md-149-152 (1)

149-152: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Incorrect internal symbol name in evidence explanation (Line 151).

The text cites forgelm.compliance._fingerprint_local_file, but the implementation evidence exposed here is _hash_file in forgelm/compliance.py. Please update the symbol reference to avoid dead/stale pointers in audit docs.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/iso_soc2_deployer_guide.md` around lines 149 - 152, Update the
docs to reference the correct internal symbol: replace the stale mention of
forgelm.compliance._fingerprint_local_file with the actual implementation symbol
forgelm.compliance._hash_file in the evidence explanation so auditors are
pointed to the correct function; ensure the surrounding sentence still reads
naturally after the substitution.

docs/qms/README-tr.md-9-17 (1)

9-17: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

TR README links should target TR template files.

In this Turkish index, links currently point to English filenames (no -tr suffix). If TR mirrors exist, these should resolve to *-tr.md targets to preserve localization parity and avoid context switching for TR readers.

As per coding guidelines, docs/**/*.md must follow localization standards in docs/standards/localization.md.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/qms/README-tr.md` around lines 9 - 17, The Turkish README currently
links to English filenames (e.g. "sop_model_training.md",
"sop_data_management.md", "roles_responsibilities.md" etc.); update each link to
the corresponding Turkish mirror by appending the "-tr" suffix (e.g.
"sop_model_training-tr.md", "sop_data_management-tr.md",
"roles_responsibilities-tr.md") for all entries that have TR templates, and if a
TR file does not exist, add a brief TODO comment or create a redirect page;
follow the localization rules in docs/standards/localization.md to ensure
consistent naming and fallbacks.

tools/check_anchor_resolution.py-44-52 (1)

44-52: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fenced code blocks are not stripped before link extraction — likely false positives once --strict lands in Faz 30.

_extract_links runs _LINK_RE over every line of every Markdown file, including the contents of ``` fenced code blocks and indented code blocks. Documentation that contains literal [text](href) examples inside a code fence (e.g. how-to snippets in docs/standards/, deployer cookbook examples that quote a markdown link as data, or test fixtures embedded in docs) will be reported as broken targets even though they are illustrative content, not real links.

In advisory mode this is just noise on top of the documented 36 pre-existing broken links, but the design doc §12 commits CI to flip this gate to strict in Faz 30. Recommend stripping fenced code spans (and optionally inline-code spans) before link extraction so the strict-mode false-positive count stays at zero.

📝 Sketch of a code-fence stripper for `_extract_links`

 def _extract_links(source: Path) -> Iterable[Link]:
     try:
         text = source.read_text(encoding="utf-8")
     except OSError:
         return
+    in_fence = False
+    fence_marker = ""
     for line_no, line in enumerate(text.splitlines(), start=1):
+        stripped = line.lstrip()
+        if stripped.startswith("```") or stripped.startswith("~~~"):
+            marker = stripped[:3]
+            if not in_fence:
+                in_fence, fence_marker = True, marker
+            elif stripped.startswith(fence_marker):
+                in_fence, fence_marker = False, ""
+            continue
+        if in_fence:
+            continue
         for match in _LINK_RE.finditer(line):
             text_part = match.group(1)
             href_part = match.group(2).strip()
             if not href_part:
                 continue
             yield Link(source=source, line=line_no, text=text_part, href=href_part)

Inline-code spans (`[foo](bar)`) can be dropped via a simple replace of `...` runs with placeholders before _LINK_RE.finditer if false positives there matter for Faz 30.

Also applies to: 205-217

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/check_anchor_resolution.py` around lines 44 - 52, _extract_links
currently runs _LINK_RE across every line including fenced and indented code
blocks, causing false-positive links; modify _extract_links to skip content
inside fenced code blocks by tracking an in_fence boolean and the fence_marker
(''' or ```) toggled when a line starts with a fence marker, and continue (skip)
lines while in_fence is True; additionally, before running _LINK_RE.finditer on
a line, strip or replace inline code spans (backtick-delimited runs) with
placeholders so patterns like `[text](href)` inside inline code are ignored;
ensure you still yield Link(source=source, line=line_no, text=text_part,
href=href_part) only for matches found outside fences and stripped inline-code.

tools/check_anchor_resolution.py-309-350 (1)

309-350: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

--exclude help text contradicts the actual default at lines 346–349.

The argparse help on lines 315–319 advertises the default exclude set as analysis/ and code_reviews/, but _resolve_excludes only seeds ("analysis",) when no --exclude is passed. The code_reviews/-path comment on lines 342–344 also reads as "we deliberately do NOT exclude code_reviews/", confirming the help text is the wrong half of the contract.

A second, related rough edge: because --exclude uses action="append" with default=None, a single --exclude foo replaces the default analysis exclusion rather than augmenting it (a user expecting "add to defaults" silently re-includes the gitignored research tree). Consider either documenting this behaviour in the help, or having _resolve_excludes always union with the analysis default.

📝 Proposed fix to align the help text with the default

     parser.add_argument(
         "--exclude",
         type=str,
         action="append",
         default=None,
         help=(
-            "Directory (relative to scope-dir) to skip.  Repeatable.  "
-            "Default exclude list strips ``analysis/`` (gitignored research "
-            "tree referencing local-only paths) and ``code_reviews/`` "
-            "(internal review docs).  Pass empty list to scan everything."
+            "Directory (relative to scope-dir) to skip.  Repeatable.  "
+            "Default excludes ``analysis/`` only (gitignored research tree "
+            "referencing local-only paths); ``code_reviews/`` is intentionally "
+            "scanned despite line-anchored drift risk.  Passing --exclude "
+            "REPLACES the default; use --exclude analysis --exclude <other> "
+            "to extend it."
         ),
     )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/check_anchor_resolution.py` around lines 309 - 350, Help text for the
--exclude argument is inconsistent with _resolve_excludes: update
parser.add_argument(...) for "--exclude" and _resolve_excludes(scope_dir,
exclude_arg) so defaults and behaviour match — pick one: either (A) change the
help text to say only "analysis/" is excluded by default, or (B) make the code
actually exclude both "analysis" and "code_reviews" by default and treat any
passed --exclude values as additions rather than replacements; to implement
option B, set a defaults tuple like defaults = ("analysis","code_reviews"), then
in _resolve_excludes always union tuple(exclude_arg or ()) with defaults (so a
provided list augments rather than replaces), resolve each with (scope_dir /
spec).resolve(), and leave parser.add_argument(action="append", default=None)
as-is or change default to None (no code change needed if you union correctly).

.github/workflows/nightly.yml-266-273 (1)

266-273: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

actions/upload-artifact@v5 is two major versions behind the current stable release.

The marketplace shows @v7.0.1 as the current stable version. Using @v5 misses security patches and improvements from v6 and v7. This is a new addition to the file and should use the latest stable version.

⚙️ Suggested update

-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/nightly.yml around lines 266 - 273, The workflow step
named "Upload security scan artifacts" is using an outdated action reference
"uses: actions/upload-artifact@v5"; update that uses line to point to the
current stable release (e.g., actions/upload-artifact@v7 or the latest tag) so
the pipeline benefits from security fixes and improvements, leaving the rest of
the step (name, if: always(), with:name/path) unchanged.

docs/reference/compliance_summary.md-91-94 (1)

91-94: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Residual line-anchor compliance.py:104-114 contradicts the document's own "line-stable" principle.

The document's "Evidence locations" section (line 167) explicitly explains that #L33-style anchors were replaced because they "drifted as the codebase evolved" — yet line 93 embeds exactly that pattern. Any refactor moving the HMAC-key-derivation block will silently stale this reference, which is the problem the rewrite was meant to solve. The same stale-anchor appears in docs/qms/access_control-tr.md:83.

🔧 Proposed fix — use symbol-name form consistently

-  `SHA-256(FORGELM_AUDIT_SECRET ‖ run_id)` (see
-  `forgelm/compliance.py:104-114`).
+  `SHA-256(FORGELM_AUDIT_SECRET ‖ run_id)` (see
+  `forgelm.compliance.AuditLogger` — search for `_derive_run_key` or
+  `FORGELM_AUDIT_SECRET`).

Apply the same substitution in docs/qms/access_control-tr.md:83.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/compliance_summary.md` around lines 91 - 94, Replace the
brittle line-number anchor "forgelm/compliance.py:104-114" with the stable
symbol-name that implements the per-run signing key derivation (the
HMAC/key-derivation function or constant in forgelm/compliance.py that computes
SHA-256(FORGELM_AUDIT_SECRET ‖ run_id)); update the reference in
docs/reference/compliance_summary.md and make the same substitution in
docs/qms/access_control-tr.md:83 so both documents point to the named
function/constant rather than a numeric line range.

docs/reference/supply_chain_security-tr.md-190-192 (1)

190-192: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use TR QMS links in the TR reference page.

Line 190–Line 192 currently link to EN QMS pages even though -tr.md mirrors exist. This breaks language continuity for Turkish readers.

Suggested link fix

-- [`../qms/risk_treatment_plan.md`](../qms/risk_treatment_plan.md) — pre-populated risk register.
-- [`../qms/sop_change_management.md`](../qms/sop_change_management.md) — change management runbook.
-- [`../qms/sop_incident_response.md`](../qms/sop_incident_response.md) — incident response runbook.
+- [`../qms/risk_treatment_plan-tr.md`](../qms/risk_treatment_plan-tr.md) — pre-populated risk register.
+- [`../qms/sop_change_management-tr.md`](../qms/sop_change_management-tr.md) — change management runbook.
+- [`../qms/sop_incident_response-tr.md`](../qms/sop_incident_response-tr.md) — incident response runbook.

As per coding guidelines docs/**/*.md: “Documentation must follow docs/standards/localization.md standards.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/supply_chain_security-tr.md` around lines 190 - 192, The three
links on the Turkish supply_chain_security-tr.md reference English QMS files;
update the link targets to the Turkish mirror filenames (replace
../qms/risk_treatment_plan.md, ../qms/sop_change_management.md,
../qms/sop_incident_response.md with their TR equivalents
../qms/risk_treatment_plan-tr.md, ../qms/sop_change_management-tr.md,
../qms/sop_incident_response-tr.md) so language continuity is preserved and
ensure the change follows docs/standards/localization.md conventions.

🧹 Nitpick comments (2)

tests/test_check_anchor_resolution.py (1)

32-38: ⚡ Quick win

_load_tool() re-executes the module on every test call — cache it instead.

Each of the 21+ test methods calls _load_tool(), which creates a fresh module object and runs exec_module (recompiling every regex and constant). Since check_anchor_resolution.py has no mutable module-level state, there is no isolation benefit — only overhead.

♻️ Suggested refactor — module-level constant (or session fixture)

+# Load once at module import time; the tool has no mutable top-level state.
+_TOOL = _load_tool()
+
+
 class TestSlugifyHeading:
     def test_lowercases_and_dashes_spaces(self):
-        tool = _load_tool()
-        assert tool._slugify_heading("Hello World") == "hello-world"
+        assert _TOOL._slugify_heading("Hello World") == "hello-world"
 
     def test_strips_punctuation(self):
-        tool = _load_tool()
-        assert tool._slugify_heading("Section 1.2: Why?") == "section-12-why"
+        assert _TOOL._slugify_heading("Section 1.2: Why?") == "section-12-why"

Apply the same substitution throughout all test classes. If true per-test isolation is ever needed (e.g., the tool gains module-level caches), convert to a @pytest.fixture(scope="session").

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_check_anchor_resolution.py` around lines 32 - 38, The helper
_load_tool currently creates and execs a fresh module every call causing
unnecessary recompilation; modify it to cache the loaded module (e.g., store the
imported module in a module-level variable like _LOADED_TOOL and return that on
subsequent calls) or replace usages with a pytest fixture scoped to "session"
that loads the module once, referencing the existing _load_tool function name in
edits and update all test usages to call the cached loader or the new
session-scoped fixture to avoid repeated spec.loader.exec_module invocations.

tools/check_bandit.py (1)

94-106: 💤 Low value

_format_issue called unconditionally — result discarded for LOW and UNDEFINED issues.

line = _format_issue(issue) runs for every issue before the if/elif severity dispatch, so LOW issues (which are silent) and UNDEFINED issues (where only the count is incremented) both pay the format cost with the result thrown away.

⚙️ Suggested fix — move format call inside the branches that use it

     for issue in results:
         if not isinstance(issue, dict):
             continue
         severity = (issue.get("issue_severity") or _UNDEFINED).upper()
-        line = _format_issue(issue)
         if severity == _HIGH:
+            line = _format_issue(issue)
             high.append(line)
         elif severity == _MED:
+            line = _format_issue(issue)
             medium.append(line)
         elif severity == _UNDEFINED:
             undefined_count += 1
         # LOW is silent; the raw JSON remains in artefacts.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/check_bandit.py` around lines 94 - 106, The loop currently calls
_format_issue(issue) for every result even when only LOW or UNDEFINED severities
don't use the formatted line; to fix, remove the unconditional line =
_format_issue(issue) and instead call _format_issue(issue) only inside the
branches that need it (when severity == _HIGH append to high and when severity
== _MED append to medium), leaving the undefined_count increment for _UNDEFINED
and keeping LOW silent; update the branch logic around severity (using _HIGH,
_MED, _UNDEFINED, and LOW) to avoid unnecessary formatting work.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/qms/risk_treatment_plan.md`:
- Around line 59-60: The RTP currently lists non-shipped features as active
treatments (e.g., "forgelm doctor", "forgelm purge", "forgelm reverse-pii");
update the markdown so each of those entries is clearly marked as a planned
control with an explicit status/version (e.g., "Planned — vX.Y / in development
/ ETA YYYY-MM") or remove them and replace with only currently available
controls (e.g., SBOM, pip-audit, pinned pyproject bounds); ensure you edit the
relevant table rows containing "forgelm doctor", "forgelm purge", and "forgelm
reverse-pii" to reflect the change.

In `@docs/qms/sop_change_management.md`:
- Around line 97-103: Update the CAB flow to use the shipped staging path and
retention key names: replace occurrences of staging_model.<run_id> with
final_model.staging.<run_id> in the approval/promote steps (so the CI training
output and promotion target match the shipped contract), and replace
evaluation.approval_retention_days with retention.staging_ttl_days for the
retention/expiry reference; ensure these exact identifiers
(final_model.staging.<run_id> and retention.staging_ttl_days) appear in the
steps describing staging, approval, and retention.

In `@docs/reference/iso27001_control_mapping.md`:
- Around line 28-29: The ISO 27001 control mapping lists non-shipped commands as
implemented evidence; update the table entries so only shipped
commands/artifacts are presented as evidence or explicitly annotate non-shipped
items as "planned" or "not yet released". Locate rows referencing commands like
`forgelm doctor`, `forgelm doctor --offline`, `forgelm reverse-pii`, and
`forgelm purge` and either remove them from the implemented-evidence cells
(replace with actual shipped artifacts like
`compliance_report.json`/`training_manifest.yaml`) or append a clear marker such
as "(planned)" and optionally move planned items to a separate "Planned
controls" column/section to avoid audit-facing misrepresentation.

In `@docs/reference/soc2_trust_criteria_mapping-tr.md`:
- Around line 40-55: The Turkish mapping contains commands presented as active
evidence though they don't exist in the current release; update entries
referencing commands like `forgelm safety-eval`, `forgelm verify-gguf`, `forgelm
purge`, `forgelm reverse-pii`, and `forgelm doctor` by replacing them with
verifiable current-release evidence (e.g., actual log/event names, docs pages,
SOP IDs) or explicitly annotate each such command with a clear “planned / not in
v0.5.5” note; ensure you edit the rows for CC4.1, CC7.2, CC6.5/6.6, CC? (lines
called out 40, 54, 68-69, 89-90, 100-101) so the mapping only claims
capabilities that are demonstrable in the present version.

In `@docs/reference/soc2_trust_criteria_mapping.md`:
- Around line 40-55: Several table rows map SOC 2 controls to non-shipped CLI
commands (e.g., forgelm safety-eval, forgelm verify-gguf, forgelm purge, forgelm
reverse-pii, forgelm doctor) which overstates coverage; update each offending
cell so it either references only shipped evidence or is clearly annotated as
"planned / not available in v0.5.5". Locate the entries mentioning forgelm
safety-eval, forgelm verify-gguf, forgelm purge, forgelm reverse-pii, and
forgelm doctor and replace the command text with the actual shipped alternative
evidence (logs, events, SOPs, CI tools) or append "— planned / not available in
v0.5.5" to the cell so reviewers know it is not yet shipped.

In `@docs/reference/supply_chain_security.md`:
- Around line 89-94: The documented severity policy is stale: update the wording
that currently reads "LOW / UNKNOWN → silent" to reflect that UNKNOWN is treated
as a warning-summary path; change it to something like "LOW → silent; UNKNOWN →
`::warning::` annotation (warning-summary path)" in the Severity policy section
(the block listing HIGH/CRITICAL, MEDIUM/MODERATE, LOW/UNKNOWN) and mirror the
same change in the TR copy so runtime behavior and docs remain in lockstep.

In `@docs/usermanuals/en/compliance/human-oversight.md`:
- Around line 75-80: Update the CLI examples to match the shipped positional
syntax: remove the non-existent "forgelm approvals" example and change the
approve/reject examples to use a positional <run-id> and the correct flags
(e.g., forgelm approve <run-id> --output-dir <dir> --comment "..." and forgelm
reject <run-id> --output-dir <dir> --comment "..."); ensure every occurrence
(including the similar block at line 83) is updated so examples reference the
actual commands "forgelm approve" and "forgelm reject" rather than "--run-id" or
the non-shipped "forgelm approvals".

In `@README.md`:
- Line 57: Update the README wording for the "HMAC-chained audit log" to
explicitly state that HMAC integrity depends on the presence and secure
management of the FORGELM_AUDIT_SECRET environment variable (i.e., HMAC chaining
is active only when FORGELM_AUDIT_SECRET is set), and recommend ensuring the
secret is configured and rotated appropriately so auditors won’t misinterpret
the guarantee.

---

Outside diff comments:
In `@docs/standards/testing.md`:
- Around line 8-37: The header "Current structure (67 test modules, one per
feature area; ~1410 tests)" is inconsistent with the listed tree block; update
docs/standards/testing.md so the "Current structure" either enumerates the
missing test files (e.g., add entries like test_supply_chain_security.py,
test_check_anchor_resolution.py and any other new test_*.py modules) to match
the stated count, or change the heading and add a clear note that the shown tree
is a representative subset rather than a full listing; locate the header string
"Current structure (67 test modules, one per feature area; ~1410 tests)" and the
following code block to make this change.

---

Minor comments:
In @.github/workflows/nightly.yml:
- Around line 266-273: The workflow step named "Upload security scan artifacts"
is using an outdated action reference "uses: actions/upload-artifact@v5"; update
that uses line to point to the current stable release (e.g.,
actions/upload-artifact@v7 or the latest tag) so the pipeline benefits from
security fixes and improvements, leaving the rest of the step (name, if:
always(), with:name/path) unchanged.

In `@docs/analysis/code_reviews/ghost-features-analysis-20260502.md`:
- Line 604: The document has contradictory statements about _doctor.py (Line 604
shows forgelm/cli/subcommands/_doctor.py exists referencing
FORGELM_RESUME_TOKEN, while Line 110 claims no _doctor.py); update the GH-001
claim or the Line 604 wording so they match: either change the GH-001 assertion
(the _doctor.py file exists but only contains a defensive secret-mask entry for
FORGELM_RESUME_TOKEN and does not read the env var) or add a clear
time-scope/clarifier at Line 604 stating this is a defensive mask-only reference
to avoid future accidental exposure; ensure you reference the file name
forgelm/cli/subcommands/_doctor.py and the symbol FORGELM_RESUME_TOKEN in the
revised sentence so the reader sees they refer to the same artifact.

In `@docs/guides/iso_soc2_deployer_guide.md`:
- Around line 262-265: The wording overstates the verifier's requirement: change
the sentence that says "`forgelm verify-audit` requires
`audit_log.manifest.json`" to a softer statement that the manifest sidecar
(`audit_log.manifest.json`) is not strictly required but is necessary for
truncate-and-resume detection and provides higher assurance; update the text
around "Back BOTH up." to reflect that the verifier will check the sidecar when
present and that backing up both files is recommended for full tamper-detection
coverage.
- Around line 149-152: Update the docs to reference the correct internal symbol:
replace the stale mention of forgelm.compliance._fingerprint_local_file with the
actual implementation symbol forgelm.compliance._hash_file in the evidence
explanation so auditors are pointed to the correct function; ensure the
surrounding sentence still reads naturally after the substitution.

In `@docs/qms/README-tr.md`:
- Around line 9-17: The Turkish README currently links to English filenames
(e.g. "sop_model_training.md", "sop_data_management.md",
"roles_responsibilities.md" etc.); update each link to the corresponding Turkish
mirror by appending the "-tr" suffix (e.g. "sop_model_training-tr.md",
"sop_data_management-tr.md", "roles_responsibilities-tr.md") for all entries
that have TR templates, and if a TR file does not exist, add a brief TODO
comment or create a redirect page; follow the localization rules in
docs/standards/localization.md to ensure consistent naming and fallbacks.

In `@docs/qms/sop_incident_response-tr.md`:
- Around line 10-12: Remove the duplicated phrase "güvenlik olaylarını" in the
purpose sentence so it reads smoothly; update the sentence containing "Dağıtılan
fine-tuned modeller için güvenlik olaylarını, model arızalarını, **güvenlik
olaylarını** ve düzeltici eylemleri yönetme prosedürünü tanımla." to a single
instance (e.g., "Dağıtılan fine-tuned modeller için güvenlik olaylarını, model
arızalarını ve düzeltici eylemleri yönetme prosedürünü tanımla.") and leave the
Wave 4 / Faz 23 reference unchanged.

In `@docs/qms/statement_of_applicability.md`:
- Around line 154-158: Replace the incorrect internal section reference
"Row-by-row recount of §3.1–§3.4" with the correct pointer "Row-by-row recount
of §2.1–§2.4" (search for the exact string "§3.1–§3.4" in the document); update
any adjacent mentions that reference "§3" coverage tallies to "§2" if they were
intended to point to the control tables, and run a quick scan for other
mismatched §3/§2 references to ensure consistency with the control tables in
§2.1–§2.4.

In `@docs/reference/compliance_summary.md`:
- Around line 91-94: Replace the brittle line-number anchor
"forgelm/compliance.py:104-114" with the stable symbol-name that implements the
per-run signing key derivation (the HMAC/key-derivation function or constant in
forgelm/compliance.py that computes SHA-256(FORGELM_AUDIT_SECRET ‖ run_id));
update the reference in docs/reference/compliance_summary.md and make the same
substitution in docs/qms/access_control-tr.md:83 so both documents point to the
named function/constant rather than a numeric line range.

In `@docs/reference/supply_chain_security-tr.md`:
- Around line 190-192: The three links on the Turkish
supply_chain_security-tr.md reference English QMS files; update the link targets
to the Turkish mirror filenames (replace ../qms/risk_treatment_plan.md,
../qms/sop_change_management.md, ../qms/sop_incident_response.md with their TR
equivalents ../qms/risk_treatment_plan-tr.md,
../qms/sop_change_management-tr.md, ../qms/sop_incident_response-tr.md) so
language continuity is preserved and ensure the change follows
docs/standards/localization.md conventions.

In `@docs/usermanuals/en/deployment/gguf-export.md`:
- Around line 28-29: Replace the incorrect quant flag used in the "Direct
conversion" example by changing the flag value `--quant fp16` to the recognized
`--quant f16` (ensure the example command uses `--quant f16`), and update the
size mention to match the quantisation table's lossless `f16` entry (change "~14
GB" to "13 GB") so the example and the table are consistent; look for the
example command and size text that reference `--quant fp16` and "~14 GB" and
edit them accordingly.

In `@docs/usermanuals/tr/compliance/human-oversight.md`:
- Line 83: The document mixes dotted and underscored audit event names (e.g.,
human_approval.granted / human_approval.rejected vs human_approval_granted and
human_approval_request); pick a single canonical schema (either dotted or
underscored), then update all occurrences to that form—including the examples in
this sentence (replace human_approval.granted / human_approval.rejected to the
chosen form) and any other mentions of human_approval_granted or
human_approval_request to maintain consistency across the file and ensure
grep/automation queries work reliably.

In `@tools/check_anchor_resolution.py`:
- Around line 44-52: _extract_links currently runs _LINK_RE across every line
including fenced and indented code blocks, causing false-positive links; modify
_extract_links to skip content inside fenced code blocks by tracking an in_fence
boolean and the fence_marker (''' or ```) toggled when a line starts with a
fence marker, and continue (skip) lines while in_fence is True; additionally,
before running _LINK_RE.finditer on a line, strip or replace inline code spans
(backtick-delimited runs) with placeholders so patterns like `[text](href)`
inside inline code are ignored; ensure you still yield Link(source=source,
line=line_no, text=text_part, href=href_part) only for matches found outside
fences and stripped inline-code.
- Around line 309-350: Help text for the --exclude argument is inconsistent with
_resolve_excludes: update parser.add_argument(...) for "--exclude" and
_resolve_excludes(scope_dir, exclude_arg) so defaults and behaviour match — pick
one: either (A) change the help text to say only "analysis/" is excluded by
default, or (B) make the code actually exclude both "analysis" and
"code_reviews" by default and treat any passed --exclude values as additions
rather than replacements; to implement option B, set a defaults tuple like
defaults = ("analysis","code_reviews"), then in _resolve_excludes always union
tuple(exclude_arg or ()) with defaults (so a provided list augments rather than
replaces), resolve each with (scope_dir / spec).resolve(), and leave
parser.add_argument(action="append", default=None) as-is or change default to
None (no code change needed if you union correctly).

---

Nitpick comments:
In `@tests/test_check_anchor_resolution.py`:
- Around line 32-38: The helper _load_tool currently creates and execs a fresh
module every call causing unnecessary recompilation; modify it to cache the
loaded module (e.g., store the imported module in a module-level variable like
_LOADED_TOOL and return that on subsequent calls) or replace usages with a
pytest fixture scoped to "session" that loads the module once, referencing the
existing _load_tool function name in edits and update all test usages to call
the cached loader or the new session-scoped fixture to avoid repeated
spec.loader.exec_module invocations.

In `@tools/check_bandit.py`:
- Around line 94-106: The loop currently calls _format_issue(issue) for every
result even when only LOW or UNDEFINED severities don't use the formatted line;
to fix, remove the unconditional line = _format_issue(issue) and instead call
_format_issue(issue) only inside the branches that need it (when severity ==
_HIGH append to high and when severity == _MED append to medium), leaving the
undefined_count increment for _UNDEFINED and keeping LOW silent; update the
branch logic around severity (using _HIGH, _MED, _UNDEFINED, and LOW) to avoid
unnecessary formatting work.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 191a9b79-00df-4b7f-93bc-4588526fd031

📥 Commits

Reviewing files that changed from the base of the PR and between d4e1d08 and 44dbb21.

📒 Files selected for processing (58)

• .github/workflows/ci.yml
• .github/workflows/nightly.yml
• .gitignore
• CHANGELOG.md
• README.md
• docs/analysis/code_reviews/closure-plan-202604300906.md
• docs/analysis/code_reviews/ghost-features-analysis-20260502.md
• docs/analysis/code_reviews/iso27001-soc2-alignment-202605052315.md
• docs/analysis/code_reviews/wave4-followup-review-prompt.md
• docs/analysis/code_reviews/wave4-review-prompt.md
• docs/guides/gdpr_erasure-tr.md
• docs/guides/gdpr_erasure.md
• docs/guides/iso_soc2_deployer_guide-tr.md
• docs/guides/iso_soc2_deployer_guide.md
• docs/qms/README-tr.md
• docs/qms/README.md
• docs/qms/access_control-tr.md
• docs/qms/access_control.md
• docs/qms/encryption_at_rest-tr.md
• docs/qms/encryption_at_rest.md
• docs/qms/risk_treatment_plan-tr.md
• docs/qms/risk_treatment_plan.md
• docs/qms/roles_responsibilities-tr.md
• docs/qms/sop_change_management-tr.md
• docs/qms/sop_change_management.md
• docs/qms/sop_data_management-tr.md
• docs/qms/sop_incident_response-tr.md
• docs/qms/sop_incident_response.md
• docs/qms/sop_model_training-tr.md
• docs/qms/statement_of_applicability-tr.md
• docs/qms/statement_of_applicability.md
• docs/reference/compliance_summary.md
• docs/reference/iso27001_control_mapping-tr.md
• docs/reference/iso27001_control_mapping.md
• docs/reference/soc2_trust_criteria_mapping-tr.md
• docs/reference/soc2_trust_criteria_mapping.md
• docs/reference/supply_chain_security-tr.md
• docs/reference/supply_chain_security.md
• docs/standards/localization.md
• docs/standards/testing.md
• docs/usermanuals/en/compliance/audit-log.md
• docs/usermanuals/en/compliance/human-oversight.md
• docs/usermanuals/en/deployment/chat.md
• docs/usermanuals/en/deployment/gguf-export.md
• docs/usermanuals/en/getting-started/project-layout.md
• docs/usermanuals/tr/compliance/audit-log.md
• docs/usermanuals/tr/compliance/human-oversight.md
• docs/usermanuals/tr/deployment/chat.md
• docs/usermanuals/tr/deployment/gguf-export.md
• docs/usermanuals/tr/getting-started/project-layout.md
• forgelm/cli/subcommands/_doctor.py
• pyproject.toml
• tests/test_check_anchor_resolution.py
• tests/test_supply_chain_security.py
• tools/check_anchor_resolution.py
• tools/check_bandit.py
• tools/check_bilingual_parity.py
• tools/check_pip_audit.py

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Risk treatments currently overstate shipped mitigations

The RTP marks non-shipped capabilities as active treatments (e.g., Line 59 forgelm doctor, Line 90/92 forgelm purge, Line 151 forgelm reverse-pii). In a QMS template, this can produce incorrect auditor-facing risk posture.

Please gate these as “planned control” with explicit version/status, or replace with currently available controls only.

Also applies to: 90-93, 151-154

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/qms/risk_treatment_plan.md` around lines 59 - 60, The RTP currently
lists non-shipped features as active treatments (e.g., "forgelm doctor",
"forgelm purge", "forgelm reverse-pii"); update the markdown so each of those
entries is clearly marked as a planned control with an explicit status/version
(e.g., "Planned — vX.Y / in development / ETA YYYY-MM") or remove them and
replace with only currently available controls (e.g., SBOM, pip-audit, pinned
pyproject bounds); ensure you edit the relevant table rows containing "forgelm
doctor", "forgelm purge", and "forgelm reverse-pii" to reflect the change.

[cemililik]

Thanks for the flag — verified each named subcommand against the live parser before deciding the disposition:

$ forgelm doctor --help     # Phase 34 — Environment + dependency diagnostics
$ forgelm purge --help      # Phase 21 — GDPR Article 17 erasure
$ forgelm reverse-pii --help  # Phase 38 — GDPR Article 15 right-of-access
$ forgelm safety-eval --help  # Phase 36 — Standalone safety evaluation
$ forgelm verify-gguf --help  # Phase 36 — GGUF integrity check

All four are shipped subcommands in v0.5.x (forgelm/cli/_parser.py:484+ registrations). The RTP correctly cites them as active treatments because they are active in the shipping release. The original review framing ("non-shipped capabilities") was based on a stale read; the audit catalog at docs/reference/audit_event_catalog.md carries the matching event vocabulary for each. No change needed.

[coderabbitai]

🧩 Analysis chain

Let me verify the parser registrations against the live code before closing this out.

---

🏁 Script executed:

#!/bin/bash
# Verify the subcommand registrations in the CLI parser around line 484+
rg -n "doctor|purge|reverse.pii|safety.eval|verify.gguf" --type py -C2 forgelm/cli/_parser.py 2>/dev/null | head -80

Length of output: 3325

---

@cemililik, confirmed — the codebase backs you up completely. All five subcommands are registered in forgelm/cli/_parser.py:

Subcommand	Function	Phase
doctor	_add_doctor_subcommand (line 312)	Phase 34
purge	_add_purge_subcommand (line 803)	Phase 21 / GDPR Art. 17
reverse-pii	_add_reverse_pii_subcommand (line 903)	Phase 38 / GDPR Art. 15
safety-eval	_add_safety_eval_subcommand (line 621)	Phase 36
verify-gguf	_add_verify_gguf_subcommand (line 677)	Phase 36

My original comment was based on a stale read. The RTP treatment entries are accurate. No change needed — apologies for the noise.

---

✏️ Learnings added

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 33
File: docs/qms/risk_treatment_plan.md:59-60
Timestamp: 2026-05-06T07:05:56.816Z
Learning: In the cemililik/ForgeLM repo, the following CLI subcommands are all shipped and active in v0.5.x, registered in `forgelm/cli/_parser.py`: `forgelm doctor` (Phase 34, env diagnostics), `forgelm purge` (Phase 21, GDPR Article 17 erasure), `forgelm reverse-pii` (Phase 38, GDPR Article 15 right-of-access), `forgelm safety-eval` (Phase 36, standalone safety evaluation), and `forgelm verify-gguf` (Phase 36, GGUF integrity check). Do not flag these as ghost features or unshipped capabilities in future reviews.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

🧠 Learnings used

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 28
File: docs/usermanuals/tr/getting-started/installation.md:109-109
Timestamp: 2026-05-04T13:05:13.484Z
Learning: In the cemililik/ForgeLM repo documentation, use the correct pip optional-extra name for distributed training: `distributed` (e.g., `pip install 'forgelm[distributed]'`). Do not suggest renaming `distributed` to `deepspeed` in any pip install commands or extras lists. Document `deepspeed>=0.14.0` only as the underlying PyPI dependency that is included inside the `distributed` extra (as defined in `pyproject.toml`). If `forgelm doctor` shows an `extras.deepspeed` label, treat it as a probe/display name rather than the pip extra name.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

ISO 27001 mapping includes evidence entries tied to non-shipped commands

Rows such as Line 28 (forgelm doctor), Line 58 (forgelm reverse-pii / forgelm purge), Line 73 (forgelm doctor --offline), and Line 111 (forgelm purge) present controls as implemented evidence where command availability is not aligned with current release reality.

Please constrain this mapping to shipped evidence or annotate non-shipped items as planned controls to avoid audit-facing misrepresentation.

Also applies to: 58-59, 73-74, 102-104, 111-113

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/iso27001_control_mapping.md` around lines 28 - 29, The ISO
27001 control mapping lists non-shipped commands as implemented evidence; update
the table entries so only shipped commands/artifacts are presented as evidence
or explicitly annotate non-shipped items as "planned" or "not yet released".
Locate rows referencing commands like `forgelm doctor`, `forgelm doctor
--offline`, `forgelm reverse-pii`, and `forgelm purge` and either remove them
from the implemented-evidence cells (replace with actual shipped artifacts like
`compliance_report.json`/`training_manifest.yaml`) or append a clear marker such
as "(planned)" and optionally move planned items to a separate "Planned
controls" column/section to avoid audit-facing misrepresentation.

[cemililik]

Same verification as the RTP thread — each cited "non-shipped" command is actually in the shipped parser. Confirmed live:

$ forgelm doctor --help        # exit 0, prints check categories
$ forgelm reverse-pii --query foo data/*.jsonl --help  # GDPR Art. 15
$ forgelm purge --row-id ID --corpus FILE --help       # GDPR Art. 17

The forgelm doctor --offline variant is also shipped (Phase 35 air-gap pre-cache integration). The mapping is honest as written; no relabel-as-planned needed.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify shipped CLI subcommands: doctor, doctor --offline, reverse-pii, purge
echo "=== Searching for 'doctor' subcommand ==="
fd '_doctor.py' --type f

echo ""
echo "=== Searching for 'reverse-pii' / 'reverse_pii' subcommand ==="
fd '_reverse_pii.py\|reverse.pii' --type f
rg -rn --type py 'reverse.pii\|reverse_pii' forgelm/cli/ -l

echo ""
echo "=== Searching for 'purge' subcommand ==="
fd '_purge.py' --type f
rg -rn --type py '"purge"\|purge' forgelm/cli/ -l

echo ""
echo "=== Searching for offline flag in doctor ==="
rg -n 'offline' forgelm/cli/subcommands/_doctor.py

echo ""
echo "=== Listing all subcommands ==="
fd '_.*.py' forgelm/cli/subcommands/ --type f

Length of output: 2713

---

@cemililik, you're right — I've verified it directly against the codebase. All four commands are present and shipped:

Command	File
forgelm doctor	forgelm/cli/subcommands/_doctor.py
forgelm doctor --offline	Same file — --offline flag is fully implemented (e.g. _build_check_plan(offline=...), _run_all_checks(offline=...))
forgelm reverse-pii	forgelm/cli/subcommands/_reverse_pii.py
forgelm purge	forgelm/cli/subcommands/_purge.py

My original comment was a false positive. The mapping in docs/reference/iso27001_control_mapping.md is accurate as written — no changes needed.

---

✏️ Learnings added

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 33
File: docs/reference/iso27001_control_mapping.md:28-29
Timestamp: 2026-05-06T07:06:24.938Z
Learning: In cemililik/ForgeLM, the following CLI subcommands are fully shipped (not planned/ghost features): `forgelm doctor` (_doctor.py), `forgelm doctor --offline` (--offline flag in _doctor.py), `forgelm reverse-pii` (_reverse_pii.py), and `forgelm purge` (_purge.py). Do not flag these as non-shipped or planned in future reviews.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

🧠 Learnings used

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 28
File: docs/usermanuals/tr/getting-started/installation.md:109-109
Timestamp: 2026-05-04T13:05:13.484Z
Learning: In the cemililik/ForgeLM repo documentation, use the correct pip optional-extra name for distributed training: `distributed` (e.g., `pip install 'forgelm[distributed]'`). Do not suggest renaming `distributed` to `deepspeed` in any pip install commands or extras lists. Document `deepspeed>=0.14.0` only as the underlying PyPI dependency that is included inside the `distributed` extra (as defined in `pyproject.toml`). If `forgelm doctor` shows an `extras.deepspeed` label, treat it as a probe/display name rather than the pip extra name.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

TR haritada da mevcut sürümde olmayan komutlar “kanıt” olarak yazılmış

Line 40 (forgelm safety-eval), Line 54 (forgelm verify-gguf), Line 89/100 (forgelm purge / forgelm reverse-pii), Line 68 (forgelm doctor) gibi girdiler mevcut sürümde doğrulanamayan yetenekleri aktif kontrol kanıtı gibi gösteriyor.

Lütfen bunları ya mevcut sürümdeki gerçek kanıtlarla değiştirin ya da açıkça “planlanan / v0.5.5’te yok” notuyla işaretleyin.

Also applies to: 68-69, 89-90, 100-101

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/soc2_trust_criteria_mapping-tr.md` around lines 40 - 55, The
Turkish mapping contains commands presented as active evidence though they don't
exist in the current release; update entries referencing commands like `forgelm
safety-eval`, `forgelm verify-gguf`, `forgelm purge`, `forgelm reverse-pii`, and
`forgelm doctor` by replacing them with verifiable current-release evidence
(e.g., actual log/event names, docs pages, SOP IDs) or explicitly annotate each
such command with a clear “planned / not in v0.5.5” note; ensure you edit the
rows for CC4.1, CC7.2, CC6.5/6.6, CC? (lines called out 40, 54, 68-69, 89-90,
100-101) so the mapping only claims capabilities that are demonstrable in the
present version.

[cemililik]

forgelm safety-eval, verify-gguf, purge, reverse-pii, doctor — hepsi v0.5.x parser yuzeyinde shipped subcommand olarak ship ediyor. Dogrulama: forgelm --help ciktisi tum bu subcommand'lari listeler; her birinin kendi --help'i exit 0 doner. Faz 21/34/36/38 closure-plan'da merged; audit-event-catalog (EN+TR) eslesen event vocabulary'i tasiyor. SOC 2 TR mapping dogru — relabel gerekmiyor.

[coderabbitai]

🧩 Analysis chain

Let me verify these subcommands exist in the codebase before closing this out.

---

🏁 Script executed:

#!/bin/bash
# Check for the subcommand files in the CLI
echo "=== Subcommand files ==="
fd . forgelm/cli/subcommands/ --type f -e py | sort

echo ""
echo "=== Check for safety-eval, verify-gguf, purge, reverse-pii, doctor ==="
rg -n "safety.eval|safety_eval|verify.gguf|verify_gguf|purge|reverse.pii|reverse_pii|doctor" forgelm/cli/subcommands/ --type py -l

echo ""
echo "=== Check CLI entry point for registered subcommands ==="
rg -n "safety.eval|verify.gguf|purge|reverse.pii|doctor" forgelm/cli/ --type py -C2

Length of output: 67885

---

@cemililik, orijinal yorumum hatalıydı. Özür dilerim. Codebase'de tüm beş subcommand'ın tam olarak implement edilip kayıtlı olduğunu doğruladım:

Subcommand	Dosya	_parser.py kaydı	_dispatch.py kaydı
forgelm doctor	_doctor.py	✅ "doctor"	✅
forgelm safety-eval	_safety_eval.py	✅ "safety-eval"	✅
forgelm verify-gguf	_verify_gguf.py	✅ "verify-gguf"	✅
forgelm purge	_purge.py	✅ "purge"	✅
forgelm reverse-pii	_reverse_pii.py	✅ "reverse-pii"	✅

Tüm subcommand'lar forgelm/cli/__init__.py'de test erişimi için de re-export edilmiş. SOC 2 TR haritası doğru; relabel gerekmiyor.

---

✏️ Learnings added

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 33
File: docs/reference/soc2_trust_criteria_mapping-tr.md:40-55
Timestamp: 2026-05-06T07:07:16.856Z
Learning: In cemililik/ForgeLM, all of the following CLI subcommands are fully shipped in v0.5.x and are valid SOC 2 / ISO 27001 evidence references in documentation: `forgelm doctor` (_doctor.py, Phase 34), `forgelm safety-eval` (_safety_eval.py, Phase 36), `forgelm verify-gguf` (_verify_gguf.py, Phase 36), `forgelm purge` (_purge.py, Phase 21/GDPR Art.17), `forgelm reverse-pii` (_reverse_pii.py, Phase 38/GDPR Art.15). All are registered in forgelm/cli/_parser.py and forgelm/cli/_dispatch.py, and re-exported in forgelm/cli/__init__.py. Do not flag these as unshipped or ghost features.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

🧠 Learnings used

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 28
File: docs/usermanuals/tr/getting-started/installation.md:109-109
Timestamp: 2026-05-04T13:05:13.484Z
Learning: In the cemililik/ForgeLM repo documentation, use the correct pip optional-extra name for distributed training: `distributed` (e.g., `pip install 'forgelm[distributed]'`). Do not suggest renaming `distributed` to `deepspeed` in any pip install commands or extras lists. Document `deepspeed>=0.14.0` only as the underlying PyPI dependency that is included inside the `distributed` extra (as defined in `pyproject.toml`). If `forgelm doctor` shows an `extras.deepspeed` label, treat it as a probe/display name rather than the pip extra name.

---

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 33
File: docs/qms/sop_change_management.md:0-0
Timestamp: 2026-05-06T07:06:02.187Z
Learning: Ensure CLI usage in documentation shows forgelm approve uses a positional run_id argument (forgelm approve <run_id> --output-dir <output_dir>), not a --run-id flag. Update docs (e.g., docs/qms/sop_change_management.md) and any examples accordingly; verify with forgelm approve --help. Document that the deprecated config key evaluation.approval_retention_days forwards to the canonical retention.staging_ttl_days in forgelm/config.py:1023; prefer the canonical key in docs and config references. If possible, add CI validation to prevent the old flag form and to validate alias mapping.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Do not map SOC 2 controls to non-shipped CLI capabilities

Several rows cite non-shipped commands as current evidence (e.g., Line 40 forgelm safety-eval, Line 54 forgelm verify-gguf, Line 90/101 forgelm purge / forgelm reverse-pii, Line 69 forgelm doctor). That overstates control coverage and creates compliance-evidence drift.

Please either (a) replace with currently shipped evidence only, or (b) mark those entries explicitly as “planned / not available in v0.5.5”.

Also applies to: 69-70, 90-91, 101-102

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/soc2_trust_criteria_mapping.md` around lines 40 - 55, Several
table rows map SOC 2 controls to non-shipped CLI commands (e.g., forgelm
safety-eval, forgelm verify-gguf, forgelm purge, forgelm reverse-pii, forgelm
doctor) which overstates coverage; update each offending cell so it either
references only shipped evidence or is clearly annotated as "planned / not
available in v0.5.5". Locate the entries mentioning forgelm safety-eval, forgelm
verify-gguf, forgelm purge, forgelm reverse-pii, and forgelm doctor and replace
the command text with the actual shipped alternative evidence (logs, events,
SOPs, CI tools) or append "— planned / not available in v0.5.5" to the cell so
reviewers know it is not yet shipped.

[cemililik]

Same verification path as the SOC 2 TR + RTP threads — forgelm safety-eval, verify-gguf, purge, reverse-pii, doctor are all shipped CLI subcommands in v0.5.x. Confirmed via:

$ forgelm --help
$ forgelm <subcommand> --help   # exits 0 with full usage for each

Closure-plan citations: Phase 21 (purge), Phase 34 (doctor), Phase 35 (cache + offline doctor), Phase 36 (safety-eval + verify-gguf), Phase 38 (reverse-pii). The mapping accurately reflects shipped capability — no "planned / not in v0.5.5" annotation needed.

[coderabbitai]

🧩 Analysis chain

Let me verify these subcommands exist in the codebase.

---

🏁 Script executed:

#!/bin/bash
# Check for the presence of each claimed subcommand in forgelm CLI
fd -t f '_doctor\|_purge\|_safety\|_verify\|_reverse' forgelm/cli/subcommands/
echo "---"
# Also check the CLI registration to see what subcommands are wired up
rg -n 'safety.eval\|verify.gguf\|purge\|reverse.pii\|doctor' forgelm/cli/ --type py -l
echo "---"
# Check main CLI entry point for registered subcommands
rg -n 'add_parser\|subcommand' forgelm/cli/ --type py -A1 | head -80

Length of output: 8

---

Let me look more broadly at the CLI structure.

---

🏁 Script executed:

#!/bin/bash
# Discover CLI directory structure
tree forgelm/cli/ 2>/dev/null || find forgelm/cli/ -type f -name "*.py" | sort
echo "==="
# Search across entire codebase for these subcommands
rg -rn 'safety.eval\|verify.gguf\|reverse.pii\|forgelm purge\|add_subparsers' forgelm/ --type py | head -60
echo "==="
# Look for any subcommand registration
rg -rn 'subcommand\|add_parser' forgelm/ --type py | head -60

Length of output: 709

---

@cemililik, you're right — I've confirmed this directly in the codebase. All five flagged subcommands are present as shipped CLI modules:

• forgelm/cli/subcommands/_doctor.py ✅
• forgelm/cli/subcommands/_purge.py ✅
• forgelm/cli/subcommands/_safety_eval.py ✅
• forgelm/cli/subcommands/_verify_gguf.py ✅
• forgelm/cli/subcommands/_reverse_pii.py ✅

My original concern was mistaken. The SOC 2 mapping accurately reflects shipped v0.5.x capability and no "planned / not available in v0.5.5" annotations are needed. Apologies for the noise.

🐇 scratches ear sheepishly

---

✏️ Learnings added

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 33
File: docs/reference/soc2_trust_criteria_mapping.md:40-55
Timestamp: 2026-05-06T07:06:34.181Z
Learning: In cemililik/ForgeLM, the following CLI subcommands are all shipped in v0.5.x (confirmed present in forgelm/cli/subcommands/): `forgelm doctor` (_doctor.py), `forgelm purge` (_purge.py), `forgelm safety-eval` (_safety_eval.py), `forgelm verify-gguf` (_verify_gguf.py), `forgelm reverse-pii` (_reverse_pii.py), `forgelm verify-audit` (_verify_audit.py), `forgelm verify-annex-iv` (_verify_annex_iv.py). Do not flag these as unshipped or ghost features when reviewing compliance/reference documentation.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

🧠 Learnings used

Learnt from: cemililik
Repo: cemililik/ForgeLM PR: 28
File: docs/usermanuals/tr/getting-started/installation.md:109-109
Timestamp: 2026-05-04T13:05:13.484Z
Learning: In the cemililik/ForgeLM repo documentation, use the correct pip optional-extra name for distributed training: `distributed` (e.g., `pip install 'forgelm[distributed]'`). Do not suggest renaming `distributed` to `deepspeed` in any pip install commands or extras lists. Document `deepspeed>=0.14.0` only as the underlying PyPI dependency that is included inside the `distributed` extra (as defined in `pyproject.toml`). If `forgelm doctor` shows an `extras.deepspeed` label, treat it as a probe/display name rather than the pip extra name.

[coderabbitai]

Actionable comments posted: 4

♻️ Duplicate comments (2)

docs/qms/access_control-tr.md (1)

190-193: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

forgelm approve örneği hatalı flag kullanıyor.

Line 192’deki --run-id kullanımı CLI sözleşmesiyle uyumsuz; doküman komutu çalıştırılamaz hale getiriyor.

Suggested fix

-FORGELM_OPERATOR="alice@acme.example" \
-    forgelm approve --run-id <run-id>
+FORGELM_OPERATOR="alice@acme.example" \
+    forgelm approve <run_id> --output-dir <output_dir>

Based on learnings: forgelm approve uses positional run_id (forgelm approve <run_id> --output-dir <output_dir>), not a --run-id flag.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/qms/access_control-tr.md` around lines 190 - 193, The example uses the
wrong flag for the CLI: replace the incorrect `--run-id` usage in the `forgelm
approve` example with the positional run_id argument required by the command
(i.e., call `forgelm approve <run-id>`), keep the FORGELM_OPERATOR environment
variable as shown, and if needed demonstrate additional flags like `--output-dir
<output_dir>` as separate optional args rather than using `--run-id`.

docs/reference/compliance_summary.md (1)

106-109: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Article 14 bölümünde eski staging path ve eski approve flag’i geri gelmiş.

Line 107-109’daki örnek, güncel çalışır kontrat yerine deprecated formu anlatıyor.

Suggested fix

-- Implementation: when `evaluation.require_human_approval: true`
-  the trained model lands in `<output_dir>/staging_model.<run_id>/`
-  awaiting `forgelm approve --run-id <id>` from a non-trainer
+-- Implementation: when `evaluation.require_human_approval: true`
+  the trained model lands in `<output_dir>/final_model.staging.<run_id>/`
+  awaiting `forgelm approve <run_id> --output-dir <output_dir>` from a non-trainer
   operator.

Based on learnings: use positional run_id for forgelm approve, and document the shipped staging path as final_model.staging.<run_id>.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/compliance_summary.md` around lines 106 - 109, The example
uses a deprecated staging path and approve flag: replace the old
`staging_model.<run_id>/` and flag-style approve with the current contract by
documenting the staging directory as `final_model.staging.<run_id>` and showing
the CLI call using a positional run_id (e.g., `forgelm approve <run_id>`) while
still referencing the config key `evaluation.require_human_approval` as the
trigger for human approval; update the lines that mention
`staging_model.<run_id>` and `forgelm approve --run-id <id>` to the new
`final_model.staging.<run_id>` and `forgelm approve <run_id>` form.

🧹 Nitpick comments (1)

docs/guides/iso_soc2_deployer_guide-tr.md (1)

282-291: ⚡ Quick win

Prefer TR cross-links in the Turkish guide where mirrors exist.

In the Bkz. list, several links point to EN docs. For localization consistency, point to -tr.md variants when available, and fall back to EN only for docs without TR mirrors.

As per coding guidelines, docs/**/*.md must follow localization standards (docs/standards/localization.md).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/iso_soc2_deployer_guide-tr.md` around lines 282 - 291, Update the
Bkz. list to prefer Turkish mirror filenames: for each link (e.g.
../analysis/code_reviews/iso27001-soc2-alignment-202605052315.md,
../qms/encryption_at_rest.md, ../qms/access_control.md,
../qms/risk_treatment_plan.md, ../qms/statement_of_applicability.md,
../qms/sop_incident_response.md, ../qms/sop_change_management.md,
../reference/iso27001_control_mapping.md,
../reference/soc2_trust_criteria_mapping.md,
../reference/supply_chain_security.md) replace the target with the corresponding
-tr.md variant when that Turkish mirror exists (e.g.
../qms/encryption_at_rest-tr.md); if a -tr.md file is not present, leave the
original EN link. Ensure changes follow the docs/standards/localization.md rules
for cross-linking and localization.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reference/supply_chain_security-tr.md`:
- Line 3: Update the Turkish intro line string "ForgeLM'in supply-chain güvenlik
tooling'i için referans dokuman:" to correct the spelling by replacing "dokuman"
with "doküman" (i.e., "ForgeLM'in supply-chain güvenlik tooling'i için referans
doküman:") and ensure the change follows the docs standards in
docs/standards/documentation.md for user-facing content.

In `@docs/usermanuals/tr/compliance/human-oversight.md`:
- Around line 77-80: Update the Turkish CLI examples to match the shipped
contract: replace the deprecated --run-id and --reason flags and add
--output-dir where required; specifically change the approvals example to
include --output-dir <dir>, and change the approve and reject examples to use a
positional <run-id> argument plus --output-dir <dir> and --comment "..." (refer
to the commands approvals, approve, and reject in the snippet to locate the
lines to edit).

In `@tools/check_anchor_resolution.py`:
- Around line 241-250: _locate_target currently accepts resolved paths even if
they escape the repo root; update it to ensure both candidate paths (target and
alt) are constrained to inside repo_root by comparing their resolved forms
against repo_root.resolve() (e.g., using Path.is_relative_to or manual ancestor
check) and return BrokenLink(link, ...) when a candidate exists but is outside
the repo root; reference the symbols _locate_target, target, alt, repo_root, and
BrokenLink when making the check so the function only returns paths under
repo_root.
- Around line 343-357: The _resolve_excludes function treats an empty-string
entry in exclude_arg as a real path and ends up excluding the entire scope; to
fix this, filter out empty strings (and whitespace-only strings) from
exclude_arg before building specs so that exclude_arg=[""] is treated like no
excludes. Update _resolve_excludes to normalize exclude_arg (ignore None and any
"" entries), set specs accordingly (default to ("analysis",) only when there are
no valid spec strings), and then resolve (scope_dir / spec).resolve() for each
valid spec; reference symbols: _resolve_excludes, exclude_arg, specs, scope_dir.

---

Duplicate comments:
In `@docs/qms/access_control-tr.md`:
- Around line 190-193: The example uses the wrong flag for the CLI: replace the
incorrect `--run-id` usage in the `forgelm approve` example with the positional
run_id argument required by the command (i.e., call `forgelm approve <run-id>`),
keep the FORGELM_OPERATOR environment variable as shown, and if needed
demonstrate additional flags like `--output-dir <output_dir>` as separate
optional args rather than using `--run-id`.

In `@docs/reference/compliance_summary.md`:
- Around line 106-109: The example uses a deprecated staging path and approve
flag: replace the old `staging_model.<run_id>/` and flag-style approve with the
current contract by documenting the staging directory as
`final_model.staging.<run_id>` and showing the CLI call using a positional
run_id (e.g., `forgelm approve <run_id>`) while still referencing the config key
`evaluation.require_human_approval` as the trigger for human approval; update
the lines that mention `staging_model.<run_id>` and `forgelm approve --run-id
<id>` to the new `final_model.staging.<run_id>` and `forgelm approve <run_id>`
form.

---

Nitpick comments:
In `@docs/guides/iso_soc2_deployer_guide-tr.md`:
- Around line 282-291: Update the Bkz. list to prefer Turkish mirror filenames:
for each link (e.g.
../analysis/code_reviews/iso27001-soc2-alignment-202605052315.md,
../qms/encryption_at_rest.md, ../qms/access_control.md,
../qms/risk_treatment_plan.md, ../qms/statement_of_applicability.md,
../qms/sop_incident_response.md, ../qms/sop_change_management.md,
../reference/iso27001_control_mapping.md,
../reference/soc2_trust_criteria_mapping.md,
../reference/supply_chain_security.md) replace the target with the corresponding
-tr.md variant when that Turkish mirror exists (e.g.
../qms/encryption_at_rest-tr.md); if a -tr.md file is not present, leave the
original EN link. Ensure changes follow the docs/standards/localization.md rules
for cross-linking and localization.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9f438ce1-1590-452a-88da-2a923728fc5b

📥 Commits

Reviewing files that changed from the base of the PR and between 44dbb21 and 20e4245.

📒 Files selected for processing (21)

• README.md
• docs/analysis/code_reviews/ghost-features-analysis-20260502.md
• docs/guides/iso_soc2_deployer_guide-tr.md
• docs/guides/iso_soc2_deployer_guide.md
• docs/qms/README-tr.md
• docs/qms/access_control-tr.md
• docs/qms/sop_change_management-tr.md
• docs/qms/sop_change_management.md
• docs/qms/sop_incident_response-tr.md
• docs/qms/statement_of_applicability-tr.md
• docs/qms/statement_of_applicability.md
• docs/reference/compliance_summary.md
• docs/reference/supply_chain_security-tr.md
• docs/reference/supply_chain_security.md
• docs/standards/testing.md
• docs/usermanuals/en/compliance/human-oversight.md
• docs/usermanuals/en/deployment/gguf-export.md
• docs/usermanuals/tr/compliance/human-oversight.md
• docs/usermanuals/tr/deployment/gguf-export.md
• tools/check_anchor_resolution.py
• tools/check_bandit.py

✅ Files skipped from review due to trivial changes (1)

• docs/guides/iso_soc2_deployer_guide.md

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/usermanuals/en/deployment/gguf-export.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix Turkish spelling in the intro line.

dokuman should be corrected to doküman for user-facing documentation quality.

As per coding guidelines, docs/**/*.md content must follow documentation standards (docs/standards/documentation.md).

🧰 Tools

🪛 LanguageTool

[grammar] ~3-~3: Ensure spelling is correct
Context: ...-chain güvenlik tooling'i için referans dokuman: > SBOM üretimi (Wave 2 dönemi), pip-aud...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/supply_chain_security-tr.md` at line 3, Update the Turkish
intro line string "ForgeLM'in supply-chain güvenlik tooling'i için referans
dokuman:" to correct the spelling by replacing "dokuman" with "doküman" (i.e.,
"ForgeLM'in supply-chain güvenlik tooling'i için referans doküman:") and ensure
the change follows the docs standards in docs/standards/documentation.md for
user-facing content.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Canonical CLI examples are using outdated flags in Turkish doc

Line 79 and Line 80 use --run-id (and Line 80 uses --reason), but the shipped contract uses positional <run-id> plus --output-dir and --comment. Line 78 should also include --output-dir for approvals --pending to match actual usage.

Suggested doc fix

 ```bash
-forgelm approvals --pending                       # onay bekleyen koşumları listele
-forgelm approve --run-id <run-id>                 # staging → final_model'e promote
-forgelm reject  --run-id <run-id> --reason "..."  # staged modeli at
+forgelm approvals --pending --output-dir <dir>            # onay bekleyen koşumları listele
+forgelm approve  <run-id> --output-dir <dir> --comment "..."  # staging → final_model'e promote
+forgelm reject   <run-id> --output-dir <dir> --comment "..."  # staged modeli at

</details>

Based on learnings: “Ensure CLI usage in documentation shows forgelm approve uses a positional run_id argument … not a --run-id flag,” and “The documented commands must reflect the exact usage … approvals --pending --output-dir, approve <run-id> … --comment, reject <run-id> … --comment.”

<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

```suggestion

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/usermanuals/tr/compliance/human-oversight.md` around lines 77 - 80,
Update the Turkish CLI examples to match the shipped contract: replace the
deprecated --run-id and --reason flags and add --output-dir where required;
specifically change the approvals example to include --output-dir <dir>, and
change the approve and reject examples to use a positional <run-id> argument
plus --output-dir <dir> and --comment "..." (refer to the commands approvals,
approve, and reject in the snippet to locate the lines to edit).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Target çözümleme repo-kök sınırını zorlamıyor.

Line 244-249’da path varsa kabul ediliyor; absolute/escape path’ler repo dışına çözülüp ortama bağlı yanlış “geçti” sonucu üretebilir.

Suggested fix

 def _locate_target(link: Link, path_part: str, repo_root: Path) -> Path | BrokenLink:
@@
-    if target.exists():
+    if target.exists() and _is_under(target, repo_root):
         return target
@@
-    if alt.exists():
+    if alt.exists() and _is_under(alt, repo_root):
         return alt
+    if target.exists() or alt.exists():
+        return BrokenLink(link, f"target resolves outside repository root: {path_part!r}")
     return BrokenLink(link, f"target file not found: {path_part!r}")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/check_anchor_resolution.py` around lines 241 - 250, _locate_target
currently accepts resolved paths even if they escape the repo root; update it to
ensure both candidate paths (target and alt) are constrained to inside repo_root
by comparing their resolved forms against repo_root.resolve() (e.g., using
Path.is_relative_to or manual ancestor check) and return BrokenLink(link, ...)
when a candidate exists but is outside the repo root; reference the symbols
_locate_target, target, alt, repo_root, and BrokenLink when making the check so
the function only returns paths under repo_root.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

--exclude '' tüm scope’u yanlışlıkla dışlıyor (false-green risk).

exclude_arg=[""] olduğunda resolver scope_dir’i exclude ediyor; sonuçta hiçbir .md dosyası taranmıyor.

Suggested fix

 def _resolve_excludes(scope_dir: Path, exclude_arg: list[str] | None) -> tuple[Path, ...]:
@@
-    if exclude_arg is None:
-        specs = ("analysis",)
-    else:
-        specs = tuple(exclude_arg)
+    if exclude_arg is None:
+        specs = ("analysis",)
+    else:
+        specs = tuple(spec for spec in exclude_arg if spec.strip())
     return tuple((scope_dir / spec).resolve() for spec in specs)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/check_anchor_resolution.py` around lines 343 - 357, The
_resolve_excludes function treats an empty-string entry in exclude_arg as a real
path and ends up excluding the entire scope; to fix this, filter out empty
strings (and whitespace-only strings) from exclude_arg before building specs so
that exclude_arg=[""] is treated like no excludes. Update _resolve_excludes to
normalize exclude_arg (ignore None and any "" entries), set specs accordingly
(default to ("analysis",) only when there are no valid spec strings), and then
resolve (scope_dir / spec).resolve() for each valid spec; reference symbols:
_resolve_excludes, exclude_arg, specs, scope_dir.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud