Skip to content

v0.5.5 — Closure Cycle Bundle + Phase 22 Wizard + Site Documentation Sweep

Choose a tag to compare

View all tags
@cemililik cemililik released this 10 May 11:39
· 335 commits to development since this release
v0.5.5
This tag was signed with the committer’s verified signature.
cemililik Cemil ILIK
GPG key ID: 95E64DF0865C6CDA
Verified
Learn about vigilant mode.
b78bb64
This commit was signed with the committer’s verified signature.
cemililik Cemil ILIK
GPG key ID: 95E64DF0865C6CDA
Verified
Learn about vigilant mode.

Closure Cycle Bundle + Phase 22 Wizard + Site Documentation Sweep

v0.5.5 promotes ForgeLM from a CLI fine-tuning tool to a complete enterprise pipeline. The release ships a stable Python library API for downstream embedders, GDPR Article 15 + 17 tooling, an environment / supply-chain / verification toolbelt of operational subcommands, the ISO 27001 / SOC 2 Type II alignment artefacts, a CLI wizard surface that reaches parity with the in-browser counterpart, and a tag-driven cross-OS release pipeline with per-combo CycloneDX SBOM. Every claim on forgelm.dev was re-validated against the live code; the forgelm/cli.py and forgelm/data_audit.py monoliths were split into focused sub-packages while preserving their public import surface.

⚠️ Intel Mac (x86_64) users: install v0.5.6 instead of v0.5.5 — pip install -U forgelm on v0.5.5 silently downgrades to v0.5.0 because PyPI has no torch>=2.3 wheel for Intel Mac. v0.5.6 is a dependency-only patch that lowers the floor to torch>=2.2.0 and restores Intel Mac installability. Apple Silicon / Linux / Windows users can install either v0.5.5 or v0.5.6.

Highlights

  • Library API (forgelm.__all__) — every CLI surface has a stable Python entry point with PEP 561 typing (py.typed), lazy-import facade (import forgelm does not pull torch), and __api_version__ decoupled from the CLI __version__.
  • GDPR Article 17 (forgelm purge) — three-mode dispatcher (row erasure / run-scoped artefact / read-only policy report) with per-output-dir-salted SHA-256 audit events; RetentionConfig Pydantic block with four configurable horizons.
  • GDPR Article 15 (forgelm reverse-pii) — locate identifier matches across JSONL artefacts; literal / email / phone / regional-id / regex modes; identifier salted-and-hashed before audit emission.
  • Operational subcommands — forgelm doctor (env / GPU / CUDA / extras pre-flight + JSON envelope), cache-models + cache-tasks (air-gap pre-cache for HF Hub + lm-eval), safety-eval (standalone Llama Guard with bundled 50-prompt × 14-category default probes), verify-audit / verify-annex-iv / verify-gguf (compliance + artefact integrity toolbelt), approve / reject / approvals (Article 14 staging-gate management).
  • CLI wizard parity-with-web — same 9-step flow as forgelm.dev/quickstart, schema-driven defaults shared between the two surfaces (CI guard fails on drift), idempotent re-run via --wizard-start-from <yaml>, distinct EXIT_WIZARD_CANCELLED = 5 exit code (additive; public surface now 0–5).
  • ISO 27001 / SOC 2 Type II alignment — 93-control deployer cookbook, 4 new QMS docs (encryption at rest, access control, risk treatment plan, statement of applicability) with 10 new TR mirrors, 2 new reference tables.
  • Supply-chain security — CycloneDX 1.5 SBOM per release-tag matrix combo, pip-audit + bandit nightly + on-tag (HIGH/CRITICAL → exit 1, MEDIUM → warning), opt-in gitleaks pre-commit, new [security] extra.
  • Cross-OS release-tag matrix — publish.yml runs Linux + macOS + Windows × Python 3.10 / 3.11 / 3.12 / 3.13 = 12 combos before PyPI publish; OIDC trusted publishing.
  • forgelm/cli/ + forgelm/data_audit/ package splits — legacy 2300-line + 3098-line monoliths decomposed into 24-module + 14-module sub-packages while preserving public import surface.
  • Site documentation correction sweep — every visible YAML / artefact-path / CLI / schema claim on site/*.html validated against the live forgelm/ surface; i18n parity at 731 keys per locale across EN + TR + DE + FR + ES + ZH.

Breaking changes (deliberate)

  • High-risk / unacceptable risk_classification combined with evaluation.safety.enabled=false now raises ConfigError at config-load time (was a warning). EU AI Act Article 9 risk-management evidence cannot be derived from a disabled safety eval.
  • WebhookConfig.timeout default raised from 5s to 10s.
  • --data-audit flag fully removed (was deprecated in v0.5.0). Use the forgelm audit subcommand instead.

Installation

# Apple Silicon / Linux / Windows
pip install forgelm==0.5.5

# Intel Mac (x86_64) — install v0.5.6 instead
pip install forgelm==0.5.6

If pip install -U forgelm resolves to an older version, run pip show torch to check the installed torch — pip's resolver silently downgrades ForgeLM when the local torch can't satisfy the dependency floor (v0.5.5 requires torch>=2.3.0; v0.5.6 lowers this to torch>=2.2.0).

Full changelog

See CHANGELOG.md [0.5.5] for the complete list of additions, changes, fixes, deprecations, and removals.

Assets 2
Loading