Release v0.8.0 — verify-integrity + remove deprecated --data-audit / evaluation.staging_ttl_days

CHANGELOG.md

@@ -4,10 +4,19 @@ All notable changes to ForgeLM are documented here.
 
 ## [Unreleased]
 
-_(v0.7.1 dev cycle — entries will land here as PRs merge.)_
+_(v0.8.1 dev cycle — entries will land here as PRs merge.)_
+
+## [0.8.0] — 2026-06-16
 
 ### Added
 
+- **Model-integrity verification.** New `forgelm verify-integrity MODEL_DIR`
+  subcommand and `forgelm.verify_integrity()` / `VerifyIntegrityResult` public
+  API: re-hashes a trained model directory against its EU AI Act Article 15
+  `model_integrity.json` SHA-256 manifest (written by the compliance export at
+  training time) and reports `changed` / `removed` / `added` artifacts. Exit
+  `0` (all match) / `1` (mismatch or input error) / `2` (runtime I/O failure);
+  `--output-format json` for CI gates. Bumps `__api_version__` to `1.1.0`.
 - **Config-driven merge hyperparameters.** `merge.ties_trim_fraction`,
   `merge.dare_drop_rate`, and `merge.dare_seed` expose the TIES/DARE knobs
   that were previously fixed module constants (defaults unchanged: `0.2`,
@@ -26,13 +35,6 @@ _(v0.7.1 dev cycle — entries will land here as PRs merge.)_
   weight per dataset (`1 primary + len(extra_datasets)`); a length
   mismatch raised no config error and silently fell back to uniform
   mixing at runtime. Both now fail fast at config time (exit 1).
-- **Deprecation removals deferred to v0.8.0.** `evaluation.staging_ttl_days`
-  and the `--data-audit` CLI flag were originally scheduled for removal in
-  v0.7.0, but v0.7.0 shipped with both still present to preserve the full
-  one-minor deprecation window. Every `DeprecationWarning`, `--help` text,
-  reference-doc note, and the release-standard worked example now name
-  **v0.8.0** consistently as the removal target. The `### Removed` section
-  lands in the v0.8.0 CHANGELOG.
 
 ### Deprecated
 
@@ -43,6 +45,18 @@ _(v0.7.1 dev cycle — entries will land here as PRs merge.)_
   `packing` instead — `sample_packing` is removed in **v0.9.0**. See
   [docs/standards/release.md](docs/standards/release.md#deprecation-cadence).
 
+### Removed
+
+- **`evaluation.staging_ttl_days`** (deprecated in v0.7.0) is removed. Use the
+  canonical `retention.staging_ttl_days`; `EvaluationConfig` is `extra="forbid"`,
+  so the legacy key now raises a validation error instead of forwarding.
+- **`forgelm --data-audit PATH`** CLI flag (deprecated in v0.7.0) is removed.
+  Use the first-class `forgelm audit PATH` subcommand — identical behaviour and
+  output. `argparse` now rejects the flag (exit 2).
+- **`cli.legacy_flag_invoked`** audit event is no longer emitted (it recorded
+  use of the removed `--data-audit` flag) and has been dropped from the
+  audit-event catalog.
+
 ### Fixed
 
 - **Eval artefact privacy-redaction documented.** `safety_results.json` and
@@ -2134,7 +2148,8 @@ Major release: ForgeLM goes from a basic SFT fine-tuning tool to a full-stack LL
 - Basic evaluation checks (max loss, baseline comparison)
 - Auto-revert on quality degradation
 
-[Unreleased]: https://github.com/HodeTech/ForgeLM/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/HodeTech/ForgeLM/compare/v0.8.0...HEAD
+[0.8.0]: https://github.com/HodeTech/ForgeLM/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/HodeTech/ForgeLM/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/HodeTech/ForgeLM/compare/v0.5.7...v0.6.0
 [0.5.7]: https://github.com/HodeTech/ForgeLM/compare/v0.5.6...v0.5.7

config_template.yaml

@@ -224,7 +224,8 @@ data:
 #   check_interval_hours: 24
 
 # Retention horizons — GDPR Article 5(1)(e) "storage limitation" + Article 17
-# "right to erasure".  Replaces deprecated `evaluation.staging_ttl_days`.
+# "right to erasure".  `staging_ttl_days` is the canonical staging-retention
+# field (the legacy `evaluation.staging_ttl_days` alias was removed in v0.8.0).
 # retention:
 #   audit_log_retention_days: 1825    # ~5 years (Article 12 record-keeping baseline)
 #   staging_ttl_days: 7               # final_model.staging.<run_id>/ TTL after `forgelm reject`

docs/guides/data_audit-tr.md

@@ -47,10 +47,6 @@ forgelm audit data/ --quality-filter
 forgelm audit data/ --workers 4
 ```
 
-> **Eski alias:** `forgelm --data-audit PATH` deprecation alias'ı
-> olarak korunuyor; çalışmaya devam ediyor ama bir uyarı log'lanıyor.
-> Yeni script'lerde `audit` subcommand'ını kullanın.
-
 `--output` varsayılan olarak `./audit/`'tir. Dizin yoksa oluşturulur;
 **tam** `data_audit_report.json` her zaman oraya yazılır. Stdout
 varsayılan olarak insan-okunabilir özet gösterir; `--output-format json`
@@ -529,11 +525,6 @@ default-AÇIK**) heuristic kalite skorlamasını çalıştırır;
 operatörler için opt-out sağlar. Credential/secrets taraması **her
 zaman açık** — kapatma flag'i yoktur.
 
-Eski `forgelm --data-audit PATH` flag'i deprecation alias olarak
-korunuyor; davranış aynı, sadece ek bir uyarı log'lanıyor.
-
-Üst düzey flag'tir (subcommand değil) — trainer'a dokunmadan çıkar.
-
 > **Not:** Bu davranış kılavuzun başındaki özetle eşleşir:
 > `--output-format json` stdout'a küçük bir zarf (success flag, üst
 > seviye metrikler, rapor yolu) yazar. Tam `data_audit_report.json`

docs/guides/data_audit.md

@@ -47,10 +47,6 @@ forgelm audit data/ --quality-filter
 forgelm audit data/ --workers 4
 ```
 
-> **Legacy alias:** `forgelm --data-audit PATH` keeps working unchanged
-> as a deprecation alias and logs a one-line notice. New scripts should
-> use the `audit` subcommand. Removal targeted no earlier than `v0.7.0`.
-
 `--output` defaults to `./audit/`. The directory is created if missing;
 the **full** `data_audit_report.json` is always written there. Stdout shows
 a human-readable summary by default; pass `--output-format json` to get
@@ -527,10 +523,6 @@ invariant is pinned by `tests/test_data_audit_workers.py` so a CI gate
 that compares the audit-report hash across runs continues to work
 when an operator switches from `--workers 1` to `--workers 4`.
 
-The legacy `forgelm --data-audit PATH` flag is preserved as a
-deprecation alias and logs a one-line notice. Behaviour is identical;
-new scripts should use the subcommand.
-
 ---
 
 ## Troubleshooting

docs/guides/gdpr_erasure-tr.md

@@ -83,17 +83,9 @@ retention:
 
 Herhangi bir horizon'u `0` olarak ayarlamak o artefact kind'ı için policy'yi devre dışı bırakır (sınırsız tut). `enforce`, trainer pre-flight gate'inin ihlallere nasıl tepki vereceğini kontrol eder.
 
-## Deprecation: `evaluation.staging_ttl_days`
+## Kaldırıldı: `evaluation.staging_ttl_days`
 
-Wave 1 `evaluation.staging_ttl_days` field'ı (v0.5.5'te shipped) **deprecate** edildi. Yerine `retention.staging_ttl_days` kullan:
-
-- "Set" kararı Pydantic v2'nin `model_fields_set` setine bakılarak verilir: bir field YAML'de açıkça yazıldıysa (örn. `evaluation.staging_ttl_days: 7`) Pydantic'in default'la doldurmasından bağımsız olarak "set" sayılır. Bu, "default değerle eşit" gibi heuristik tahminlerin operatörü yanıltmasını engeller.
-- Sadece legacy field açıkça set'liyse `retention.staging_ttl_days`'e alias-forward edilir ve tek bir `DeprecationWarning` yayılır.
-- Sadece canonical field açıkça set'liyse sessiz canonical path.
-- İkisi de **aynı** değerlerle açıkça set'liyse `DeprecationWarning` yayılır (canonical block kazanır).
-- İkisi de **farklı** değerlerle açıkça set'liyse config-load zamanında `ConfigError` raise edilir. Sessiz kazanan = yanlış kazanan.
-
-Deprecate edilen field **v0.8.0**'da kaldırılır.
+`evaluation.staging_ttl_days` field'ı (başlangıçta v0.5.5'te shipped) **v0.8.0'da kaldırıldı**. Bunun yerine kanonik field olan `retention.staging_ttl_days` kullanın. `evaluation.staging_ttl_days` hâlâ set edilmiş YAML dosyaları v0.8.0 ve sonrasında `EXIT_CONFIG_ERROR` ile config-load başarısızlığına yol açar.
 
 ## Audit-event sözlüğü
 

docs/guides/gdpr_erasure.md

@@ -83,17 +83,9 @@ retention:
 
 Setting any horizon to `0` disables the policy for that artefact kind (retain indefinitely). `enforce` controls how the trainer pre-flight gate reacts to violations.
 
-## Deprecation: `evaluation.staging_ttl_days`
+## Removed: `evaluation.staging_ttl_days`
 
-The Wave 1 `evaluation.staging_ttl_days` field (shipped in v0.5.5) is **deprecated**. Use `retention.staging_ttl_days` instead:
-
-- "Set" is determined by Pydantic v2's `model_fields_set`: a field is "set" when the operator wrote it in YAML (e.g. `evaluation.staging_ttl_days: 7`), independent of whether the value matches the Pydantic default. This replaces the earlier "non-default value" heuristic that mishandled operators who explicitly re-stated the default.
-- Setting only the legacy field explicitly alias-forwards to `retention.staging_ttl_days` and emits a single `DeprecationWarning`.
-- Setting only the canonical field explicitly is the silent canonical path.
-- Setting both explicitly with **identical** values emits a `DeprecationWarning` (the canonical block wins).
-- Setting both explicitly with **different** values raises `ConfigError` at config-load time. Silent winner = wrong winner.
-
-The deprecated field is removed in **v0.8.0**.
+The `evaluation.staging_ttl_days` field (originally shipped in v0.5.5) was **removed in v0.8.0**. Use `retention.staging_ttl_days` — the canonical field — instead. YAML files that still set `evaluation.staging_ttl_days` will fail config-load with `EXIT_CONFIG_ERROR` in v0.8.0 and later.
 
 ## Audit-event vocabulary
 

docs/qms/sop_data_management-tr.md

@@ -73,7 +73,7 @@ ForgeLM otomatik kontroller:
 - Trainer tipine göre format doğrulama (SFT, DPO, KTO, GRPO)
 - Metin temizleme (`clean_text: true`)
 - **ForgeLM audit pipeline (v0.5.0+, `forgelm audit <jsonl>`; legacy
-  `forgelm --data-audit` deprecated, v0.8.0'da kaldırılma planlandı)** —
+  `forgelm --data-audit` flag'i v0.8.0'da kaldırıldı)** —
   per-split sample sayıları, uzunluk dağılımı, top-3 dil tespiti,
   near-duplicate oranı (varsayılan 64-bit simhash, veya >50K-row
   corpora için `--dedup-method minhash` üzerinden **MinHash LSH**),

docs/qms/sop_data_management.md

@@ -72,7 +72,7 @@ ForgeLM automated checks:
 - Format validation per trainer type (SFT, DPO, KTO, GRPO)
 - Text cleaning (`clean_text: true`)
 - **ForgeLM audit pipeline (v0.5.0+, `forgelm audit <jsonl>`; legacy
-  `forgelm --data-audit` deprecated, removal scheduled v0.8.0)** —
+  `forgelm --data-audit` flag removed in v0.8.0)** —
   produces `data_audit_report.json` with per-split sample counts,
   length distribution, top-3 language detection, near-duplicate rate
   (default 64-bit simhash, or **MinHash LSH** via

docs/reference/audit_event_catalog-tr.md

@@ -102,7 +102,6 @@ Hash zinciri, satır diske düştükten (`flush` + `fsync`) sonra ilerler; kirli
 
 | Event                       | Ne zaman emit edilir                                                                                  | Payload                          | Madde |
 |-----------------------------|--------------------------------------------------------------------------------------------------------|----------------------------------|-------|
-| `cli.legacy_flag_invoked`   | Deprecated bir CLI flag'i kullanıldı (örn. `--data-audit`).                                            | `flag`, `replacement`, `version` | 12    |
 
 ### Audit-sistem event'leri (meta)
 

docs/reference/audit_event_catalog.md

@@ -102,7 +102,6 @@ The hash chain advances after the line lands on disk (`flush` + `fsync`), so an
 
 | Event                       | When emitted                                                                                       | Payload                          | Article |
 |-----------------------------|----------------------------------------------------------------------------------------------------|----------------------------------|---------|
-| `cli.legacy_flag_invoked`   | A deprecated CLI flag was used (e.g., `--data-audit`).                                             | `flag`, `replacement`, `version` | 12      |
 
 ### Audit-system events (meta)
 

docs/reference/configuration-tr.md

@@ -216,11 +216,11 @@ training:
 > Limitler sabittir (henüz config ile ayarlanamaz) — uzun biçimli ince ayarlar
 > için `min_score` ayarlarken bunu göz önünde bulundurun.
 >
-> **Kullanımdan kaldırıldı:** `evaluation.staging_ttl_days`,
+> **Kaldırıldı:** `evaluation.staging_ttl_days`,
 > [`retention.staging_ttl_days`](#retention-isteğe-bağlı--gdpr-madde-17-silme-ufukları)
-> tarafından devralınmıştır. Eski anahtar `DeprecationWarning` ile alias-forward
-> edilir ve v0.8.0'da kaldırılır.
-> Bkz. [release.md](../standards/release.md#deprecation-cadence).
+> tarafından devralınmış ve v0.8.0'da kaldırılmıştır. `retention.staging_ttl_days`
+> kullanın; eski anahtarı hâlâ set eden YAML dosyaları `EXIT_CONFIG_ERROR` ile
+> config-load başarısızlığına yol açar.
 
 ---
 
@@ -236,16 +236,15 @@ uzatmasını engeller.
 | Alan | Tip | Varsayılan | Açıklama |
 |------|-----|-----------|----------|
 | `audit_log_retention_days` | int | `1825` (~5 yıl) | `audit_log.jsonl` dosyasının Madde 5(1)(e) kapsamında "geciken" olarak işaretlenmeden önce saklanacağı gün sayısı. `0` süresiz saklamayı belirtir (Madde 17(3)(b) savunması). |
-| `staging_ttl_days` | int | `7` | `forgelm reject` kararından sonra `final_model.staging.<run_id>/` dizininin planlı temizlenmeden önce saklanacağı gün sayısı. `0` süresiz saklama anlamına gelir. Kullanımdan kaldırılan `evaluation.staging_ttl_days` yerine geçer; deprecation penceresinde her iki anahtar da aynı değerlerle kabul edilir (eski anahtar v0.8.0'da kaldırılır). |
+| `staging_ttl_days` | int | `7` | `forgelm reject` kararından sonra `final_model.staging.<run_id>/` dizininin planlı temizlenmeden önce saklanacağı gün sayısı. `0` süresiz saklama anlamına gelir. v0.8.0'da kaldırılan `evaluation.staging_ttl_days` yerine geçer. |
 | `ephemeral_artefact_retention_days` | int | `90` | Uyumluluk paketleri, veri denetim raporları ve diğer çalışma kapsamlı türetilmiş artefaktların saklanma süresi (gün). `0` süresiz saklama. |
 | `raw_documents_retention_days` | int | `90` | İngest edilmiş ham belgelerin (PDF / DOCX / EPUB / TXT / Markdown) operatörün ingestion-output dizininde saklanma süresi (gün). `0` süresiz saklama. |
 | `enforce` | string | `"log_only"` | Politika uygulama modu: `"log_only"` (yalnızca audit log), `"warn_on_excess"` (stderr'e yapılandırılmış uyarı), `"block_on_excess"` (`EXIT_EVAL_FAILURE` = 3 ile trainer ön-kontrolünü iptal eder). |
 
-> **Kullanımdan kaldırma:** `evaluation.staging_ttl_days`, v0.5.5 itibarıyla
-> `retention.staging_ttl_days` lehine kullanımdan kaldırılmıştır. Eski anahtar
-> v0.8.0'daki kaldırılışına kadar `DeprecationWarning` ile alias-forward edilir.
-> Tam deprecation politikası için
-> [release.md](../standards/release.md#deprecation-cadence).
+> **Kaldırıldı:** `evaluation.staging_ttl_days` (v0.5.5 itibarıyla kullanımdan
+> kaldırılmıştı) v0.8.0'da kaldırılmıştır. Artık geçerli tek form
+> `retention.staging_ttl_days`'dir. Eski anahtarı hâlâ set eden YAML dosyaları
+> `EXIT_CONFIG_ERROR` ile config-load başarısızlığına yol açar.
 
 ---
 

docs/reference/configuration.md

@@ -226,10 +226,10 @@ across retries. Each retry attempt is logged to the audit trail.
 > are fixed (not yet config-driven) — keep this in mind when tuning `min_score`
 > for long-form fine-tunes.
 >
-> **Deprecated:** `evaluation.staging_ttl_days` is superseded by
-> [`retention.staging_ttl_days`](#retention-optional--gdpr-article-17-erasure-horizons).
-> The legacy key is alias-forwarded with a `DeprecationWarning` and removed in
-> v0.8.0. See [release.md](../standards/release.md#deprecation-cadence).
+> **Removed:** `evaluation.staging_ttl_days` was superseded by
+> [`retention.staging_ttl_days`](#retention-optional--gdpr-article-17-erasure-horizons)
+> and was removed in v0.8.0. Use `retention.staging_ttl_days`; YAML files that
+> still set the legacy key will fail config-load with `EXIT_CONFIG_ERROR`.
 
 ---
 
@@ -244,16 +244,14 @@ silently extend the retention horizon by re-using a stale workspace.
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
 | `audit_log_retention_days` | int | `1825` (~5 years) | Days to retain `audit_log.jsonl` before flagging it as overdue under Article 5(1)(e). Set to `0` to retain indefinitely (Article 17(3)(b) defence). |
-| `staging_ttl_days` | int | `7` | Days to retain `final_model.staging.<run_id>/` after a `forgelm reject` decision before scheduled cleanup. Set to `0` to retain indefinitely. Replaces the deprecated `evaluation.staging_ttl_days`; both keys accepted with identical values during the deprecation window (legacy key removed in v0.8.0). |
+| `staging_ttl_days` | int | `7` | Days to retain `final_model.staging.<run_id>/` after a `forgelm reject` decision before scheduled cleanup. Set to `0` to retain indefinitely. Replaces the removed `evaluation.staging_ttl_days` (removed in v0.8.0). |
 | `ephemeral_artefact_retention_days` | int | `90` | Days to retain compliance bundles, data audit reports, and other run-scoped derived artefacts. Set to `0` to retain indefinitely. |
 | `raw_documents_retention_days` | int | `90` | Days to retain ingested raw documents (PDF / DOCX / EPUB / TXT / Markdown) under the operator's ingestion-output directory. Set to `0` to retain indefinitely. |
 | `enforce` | string | `"log_only"` | Policy enforcement mode: `"log_only"` (audit-log only), `"warn_on_excess"` (structured stderr warning), `"block_on_excess"` (abort trainer pre-flight with `EXIT_EVAL_FAILURE` = 3). |
 
-> **Deprecation:** `evaluation.staging_ttl_days` is deprecated as of v0.5.5 in
-> favour of `retention.staging_ttl_days`. The legacy key is alias-forwarded
-> with a `DeprecationWarning` until its removal in v0.8.0. See
-> [release.md](../standards/release.md#deprecation-cadence) for the full
-> deprecation cadence policy.
+> **Removed:** `evaluation.staging_ttl_days` (deprecated as of v0.5.5) was
+> removed in v0.8.0. `retention.staging_ttl_days` is now the only accepted form.
+> YAML files that still set the legacy key will fail config-load with `EXIT_CONFIG_ERROR`.
 
 ---
 

docs/reference/soc2_trust_criteria_mapping-tr.md

@@ -96,7 +96,7 @@ Güçlü ForgeLM katkısı.
 | P2.1 Seçim ve onay | `evaluation.require_human_approval` Madde 14 gate |
 | P3.1 Toplama | `data.governance.personal_data_included`; `dpia_completed` |
 | P3.2 Kişisel veri kalitesi | `data_audit_report.json` quality stats |
-| P4.1 Kullanım, saklama ve imha | `retention.staging_ttl_days` (kanonik; eski takma ad `evaluation.staging_ttl_days` v0.5.5 → v0.6.x deprecation penceresi boyunca şeffaf yönlendirir); `forgelm purge --check-policy` |
+| P4.1 Kullanım, saklama ve imha | `retention.staging_ttl_days` (kanonik; eski takma ad `evaluation.staging_ttl_days` v0.8.0'da kaldırıldı); `forgelm purge --check-policy` |
 | P5.1 Erişim | `forgelm reverse-pii` Madde 15 scan; salted query-hash |
 | P5.2 Sorular ve şikayetler | (Operatör-tarafı workflow) |
 | P6.1 Üçüncü taraflara açıklama | `safe_post` webhook discipline (yalnız TLS, SSRF koruması, yönlendirme reddi); not: webhook gövdeleri HMAC ile imzalanmaz — bkz. ISO 27001 A.8.21 |

docs/reference/soc2_trust_criteria_mapping.md

@@ -97,7 +97,7 @@ Strong ForgeLM contribution.
 | P2.1 Choice and consent | `evaluation.require_human_approval` Article 14 gate |
 | P3.1 Collection | `data.governance.personal_data_included`; `dpia_completed` |
 | P3.2 Quality of personal data | `data_audit_report.json` quality stats |
-| P4.1 Use, retention, and disposal | `retention.staging_ttl_days` (canonical; legacy alias `evaluation.staging_ttl_days` forwards transparently during the v0.5.5 → v0.6.x deprecation window); `forgelm purge --check-policy` |
+| P4.1 Use, retention, and disposal | `retention.staging_ttl_days` (canonical; legacy alias `evaluation.staging_ttl_days` was removed in v0.8.0); `forgelm purge --check-policy` |
 | P5.1 Access | `forgelm reverse-pii` Article 15 scan; salted query-hash |
 | P5.2 Inquiries and complaints | (Deployer-side workflow) |
 | P6.1 Disclosure to third parties | `safe_post` webhook discipline (TLS-only, SSRF guard, redirect refusal); note: webhook bodies are NOT HMAC-signed — see ISO 27001 A.8.21 |