torusguard 0.9.2

package/.torusguard/.manifest.json

@@ -0,0 +1,95 @@
+{
+  "ARCHITECTURE.md": "0ecacc797932daaf95ccf5032c47f11550c9b6fe07cdfece5c075e11ec5e9cf7",
+  "TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
+  "agents/auditor.md": "4ba2c92982823d0886c7ae369126cd5ddd322085a85d3b7e7fa23154f8753314",
+  "agents/profiler.md": "0ee9ebbddf4ebd557d454dda8472fffea471e263abeccf40298163084b7ce9a9",
+  "agents/remediator.md": "f708a0e315760e8d519bd640d22bdf6b7ec61ed7de3da69bd038bd60dc3d5b47",
+  "agents/reviewer.md": "69b280bb8a7b2fe425644d01a6f9cb454f9629f348782cd14968657076977c28",
+  "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
+  "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
+  "config/slash-commands.json": "5390f0d26f8117a62e56c58147d3a0d2deab1a20956302b212703281d13fa84e",
+  "config/torusguard.json": "5f775da1f77aaffcd8173fac6a8f422ecc4d754627cb1f3c71d014dad299101d",
+  "references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
+  "references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
+  "references/express-security.md": "dff1db15e614d29d8c272f9da345b418077e62dc883fe210c7a50c552c76493f",
+  "references/fastapi-security.md": "933a08a3f096f70cb75c6a1e6d887c96a1613bb9f9def3904bb76e8c21cc7668",
+  "references/firebase-security.md": "11b1c51d530ff70230e2419475fceb9382f05c4334145366c66bb1304448f5b5",
+  "references/flask-security.md": "96d438980272f6fa95c825ef01baae55989c19618470b044dde1458a421a92f4",
+  "references/nextjs-security.md": "57f17d00ce24bf06d2826ab9d774177342ff892f6c9bc4193d6b65345d6c7661",
+  "references/react-vite-security.md": "d6468a6f623f02e58250a43327e27825b5dc7df34edf6ee27da2398bab94d6a4",
+  "references/sqlalchemy-security.md": "50421be1fba477721f9f1f5a877d4359420cf61ee9bda136e21998a3c1338e1c",
+  "references/supabase-security.md": "52a53aff66b3d94e5d07484f458252015ad3d713fa07162f59db89581ee597b6",
+  "rules/README.md": "a1b80344b0ca199a4917bdbd00463a8ae1459187f65467dbd627ce93a103042e",
+  "rules/TORUSGUARD.md": "fc7e0852ae0a92c45017f11dbc83c562b94ab957e7816d9903b95fb6849a9e5b",
+  "rules/active/TG-DIFF-001.md": "f67be0f2725eb23c3d11a8a7a4c29dcee648d3f9743e122a2197e8892f4da4de",
+  "rules/active/TG-DIFF-002.md": "1058cf5ba4e700176cf74eb55fb6304d320d3be5fdd011c5c61780d2a99c1a0e",
+  "rules/active/TG-DIFF-003.md": "0ffc0872ba4e0db9d087d5f2764d5d178401d2fab3cb1d129b387452ca489741",
+  "schemas/authorization.schema.json": "59af3c6038270e0bc3541a353b2a4a53b7f5d11a37e0012875d6a69c0f1d0bab",
+  "schemas/confidence.schema.json": "08b3a564d7370e123dd5bfadde9fb077d2954e36b523685b9e1d7bdd2aa4b8cb",
+  "schemas/evidence.schema.json": "d3dcaa10fd2420a4046ea68836fb836a55d003ada4cdc6682229f232881182bf",
+  "schemas/finding.schema.json": "e0a7c28fa4a5f84bdedb5cf5223da26348250d633479d2dbf7ce3ebd6790a852",
+  "schemas/provenance.schema.json": "781215801249532414643638b6608dc8f52febc9bca43ae03827b90aecc03256",
+  "schemas/remediation.schema.json": "217cb2743ae1a912dc074382e9f05634da93f2e30a880c03f6020600ef7e43d3",
+  "schemas/retest.schema.json": "773b764082f6d2e8c3656ea105e0ce09febd1020520bf262bbcd17f5924da11e",
+  "schemas/runtime-evidence.schema.json": "dbe13741a7fb68cca2a044d47a644ee0bdaacb83a28621dc2a98bffdd59989a6",
+  "scripts/diff_guard.py": "227bf56d2e6c9aef293a51ad1a3209782e6d9204dc1775956d372c3a6851a736",
+  "scripts/finding_scorer.py": "b78c6315f22000fb64f5d4e6ff1f3467439769d3d5507aaa99380453df4eb464",
+  "scripts/manifest_builder.py": "b759131592966053db17ef710dc5f313127a9583295cb867a39ab22a7c996580",
+  "scripts/monorepo_detector.py": "38f1eb948ee2856f175e1212956bce211effdd1327d3a31f7303d32ba9478ebe",
+  "scripts/run_manager.py": "e853874e4fb0cb697596ea338f71ba7e955f2b41a6fc649733b45fa755e94768",
+  "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
+  "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
+  "scripts/stack_detect.py": "99b7bdf9829d58ff5b8c59afd6e8b6429bbb11d830ac73dec491101cbbc41574",
+  "skills/torusguard/SKILL.md": "70094a7ee80c3d827f9f9437effe3433fe0da53c0389f9ad28aed199a0e3f3d4",
+  "skills/torusguard/bootstrap.py": "7e348065a622089ab1d51e9bf4864e5b0022aaee1ccb2ecbf7057c14e792e2c7",
+  "skills/torusguard/references/auth-and-sessions.md": "34c2843f8c0dbe3574e54f00a39a92a1f431527ec5f69b2d64c84240d424a39e",
+  "skills/torusguard/references/business-logic-and-abuse.md": "0d6088936bc1a01023070332fccef0f2e0734358a5119379055f3d2895c22567",
+  "skills/torusguard/references/cache-and-sensitive-responses.md": "8f920cacde29c50b1f5f98de341a60db0bc607fe8c212a7e618ef7af08c86511",
+  "skills/torusguard/references/client-code-exposure.md": "1810b18c3b89a25d3f5ef9bc53a721b9d05179bcd2086d6679ad1f29f5403bb9",
+  "skills/torusguard/references/csrf-and-cross-origin.md": "1bab49feee1f31fa6b280ddba893fe5ffa0c3c9ac0a46fc4d6c96c1206b32204",
+  "skills/torusguard/references/dependency-and-supply-chain.md": "3b429214af8d1271f5e6dc24ac5ecc9a7bdaff6116a96dc60a89a2057d8d1d2a",
+  "skills/torusguard/references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
+  "skills/torusguard/references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
+  "skills/torusguard/references/fastapi-security.md": "933a08a3f096f70cb75c6a1e6d887c96a1613bb9f9def3904bb76e8c21cc7668",
+  "skills/torusguard/references/flask-security.md": "96d438980272f6fa95c825ef01baae55989c19618470b044dde1458a421a92f4",
+  "skills/torusguard/references/frontend-no-db.md": "a543c8107605777a16a0abfd5ebbaca6f216ac50f078a8c3ef485a5afe6bfdca",
+  "skills/torusguard/references/graphql-security.md": "486e7a54e9ad677ff6d08016f0d4e1f173ccbba5c89e7e806a7097e3265442cd",
+  "skills/torusguard/references/input-and-injection.md": "e632ab3031088f3f13be826886430ea7f0abf02922e29c26507f3c234c00f00d",
+  "skills/torusguard/references/mass-assignment-and-property-auth.md": "fcddd881573c1bc8fc703a796b1ddc9ba9bd8e0cc0d51d8e9a59e79cc9a5ebd9",
+  "skills/torusguard/references/platform-hardening.md": "c58d1a86536cbaeb548d8cfeaa298e3662a4367854512858bbf594735dc6f717",
+  "skills/torusguard/references/python-dependencies.md": "34969226665d60d22e658a1801cb6857a56ea669859abcf617a8b985a26f952d",
+  "skills/torusguard/references/python-security-overview.md": "2165747d64b86b12a744ee4f21ea918678bd6a179793a37bd02b2c0953190a9b",
+  "skills/torusguard/references/rate-limit-and-abuse.md": "77c5c982d9e28d7e3c1871172bdbfe76542e356d97f2197f5df0a4f56405bc21",
+  "skills/torusguard/references/secrets-and-config.md": "9abe5fe9e6556a2ffc1460876e9c98f6eacf683cd0d8a7dba82eaeef825133c6",
+  "skills/torusguard/references/sqlalchemy-security.md": "50421be1fba477721f9f1f5a877d4359420cf61ee9bda136e21998a3c1338e1c",
+  "skills/torusguard/references/ssrf-and-outbound-requests.md": "31c6c69ba14ca4a1fb866654f6c89a5c8edd636724c9d349be94c160c976749c",
+  "skills/torusguard/references/webhook-security.md": "a0c7efb663c664dd840ba99b689cb67d4688643106f8b6e80d18a424c6add386",
+  "skills/torusguard/references/websocket-security.md": "5624a84abd75bbb4eed029cd217e0c794ee452cbecc0730a8ab4d0f371537cd7",
+  "skills/torusguard-apply/SKILL.md": "9436fa5cdefa661677ada22936a3949de06aca276e4f4bb27e0ef5b7ea34edc3",
+  "skills/torusguard-audit/SKILL.md": "d0e0c21d6c36d9d128ccce6ad628b978ff771d27552ba80e0a4981e18b9f5a51",
+  "skills/torusguard-authorize/SKILL.md": "da849585f2e46c08ef528b89737be14647f1109fd365fd27f3f6da57a396724b",
+  "skills/torusguard-exploit-check/SKILL.md": "e9a173e154a88cc9cb929c59d79a65ab13d5cf9567b4112bd7f272746cf9c3f9",
+  "skills/torusguard-full/SKILL.md": "cc97684d37de378e51fefd12f6f9a7cd15cc469ce46079a0599440aa7b073f7b",
+  "skills/torusguard-harden/SKILL.md": "86a8dee6c614477e2122287752f5c16e3688c0451d0e7ae9bfd2a23802bcdde3",
+  "skills/torusguard-init/SKILL.md": "1f7844d66219955581fdb266029eefdc355dbebb5741b848daf0062e606202a2",
+  "skills/torusguard-recheck/SKILL.md": "4725a9be6a6ddedb3d389d1957c7ce3e0f9ce288107816fce85b5953951e13e5",
+  "skills/torusguard-report/SKILL.md": "bde44d114bdc85c04472644a644a7796ed2f182a23e0c057838a3251e4910a09",
+  "skills/torusguard-status/SKILL.md": "4e71d03c71b240afd7f6108569530b7da3702634c512a74ca8dc3174f3c6b0fb",
+  "skills/torusguard-verify/SKILL.md": "10c19e0926255686351e3b75ae774880cf35562d42bd30b87a877bb8f284fc1f",
+  "skills/torusguard-web-validate/SKILL.md": "0d159f0d75f06ca97f64a52f3e414c873f8bb84b87a8230693237cde302e76ac",
+  "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
+  "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
+  "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
+  "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
+  "workflows/apply.md": "ca7fe662f5af462d036d17ecc7e82ab8a08e1989325e9e037df6364af96e2706",
+  "workflows/audit.md": "d924b7c02d7a380c68e5c8faa69103194b098119e34c5b427585eec66f8081ca",
+  "workflows/authorize.md": "a797addf98eb0cf29acbc9dc8f21f0d61ea93cc83255379d4722ab5ce86a4c29",
+  "workflows/exploit-check.md": "9684009b835a61d5aca8827a971ee686a24c800425d86ef96f963dd27de845b8",
+  "workflows/harden.md": "509484f844c9dcd10dd14c8bb6e3456021928e6cf6abd374faaf34be8fc34ce2",
+  "workflows/init.md": "3d1668a9f6b87417c31f47c887c495f863595ed4a29074e0c5a8ee1ece1d4a35",
+  "workflows/recheck.md": "7d374c29a5585c31b81f84fb32d6a466f2e9cb339726dc0523dba25e57bc5d13",
+  "workflows/report.md": "56b3449cff362172c63093ee6150446d11bf05e3c8143661966dad9d42df1470",
+  "workflows/status.md": "921129646518c592cb47ad8e8ccf3d703e8d11ea6eb89bd21a206f545e022dba",
+  "workflows/verify.md": "e1041c38e8ada59788f66ac1bc754313a4c966c36f4c13aa6d9d9a2b90d9e06c",
+  "workflows/web-validate.md": "d3db1fea264cd89addffbc227d8452987b050e533993c394d537f50c177224d4"
+}

package/.torusguard/ARCHITECTURE.md

@@ -0,0 +1,168 @@
+# 🛡️ TorusGuard Security Kit v0.9.1 — System Architecture
+
+TorusGuard works natively in **Antigravity**, **Cursor**, **Windsurf**, **Claude Code**, **Cline**, and any AI IDE or coding assistant that indexes workspace security guardrails.
+
+---
+
+## 1. System Flow & Execution Lifecycle
+
+Every security operation, static scan, runtime probe, and remediation patch progresses through an auditable, deterministic 7-stage closed-loop pipeline:
+
+```mermaid
+flowchart TD
+    A["User Request / Slash Command"] --> B{"Classify Action"}
+    
+    B -->|/torusguard init| C["Phase 0: Baseline Discovery"]
+    B -->|/torusguard authorize| D["Phase 1: Legal Scope Gate"]
+    B -->|/torusguard audit| E["Phase 2: Static Scan & Cluster"]
+    B -->|/torusguard verify| F["Phase 3a: Evidence Verification"]
+    B -->|/torusguard web-validate| G["Phase 3b: Runtime Probing"]
+    B -->|/torusguard exploit-check| H["Phase 3c: Exploitability Check"]
+    B -->|/torusguard harden| I["Phase 4: Remediation Bundles"]
+    B -->|/torusguard apply| J["Phase 5: Governed Patch Apply"]
+    B -->|/torusguard recheck| K["Phase 6: Regression Re-scan"]
+    B -->|/torusguard report| L["Phase 7: Report & SARIF Export"]
+    B -->|/torusguard status| M["Diagnostic Overview"]
+    B -->|/torusguard full| N["End-to-End Orchestrator"]
+
+    C --> C1["Detect Stack & Activate TG-* Rules"]
+    D --> D1["Validate Ownership & Write scope.json"]
+    E --> E1["AST Matching + Line Hash Fingerprints + Root-Cause Clustering"]
+    
+    E1 --> F1{"Confidence Score"}
+    F1 -->|Medium / High| G1{"Authorized for Runtime?"}
+    G1 -->|Yes| G
+    G1 -->|No| I
+    
+    G --> H1["Redact Tokens & Capture Replay Trace"]
+    H --> H2["Update Confidence with Runtime Verdict"]
+    H2 --> I
+    
+    I --> I1["Enforce Ponytail Limits (<=35 add, <=25 del)"]
+    I1 --> I2{"Human Gate Review"}
+    I2 -->|Approved| J
+    I2 -->|Rejected / Revised| I
+    
+    J --> J1["Save Pre-Apply Snapshot & Apply Surgical Diffs"]
+    J1 --> K
+    
+    K --> K1{"Classify Outcome"}
+    K1 -->|Fixed| L
+    K1 -->|Partially Fixed| I
+    K1 -->|Regression| J2["Rollback Snapshot & Alert"]
+    
+    L --> L1["Emit summary.md + OASIS SARIF v2.1.0"]
+```
+
+---
+
+## 2. Decoupled Specialist Skills & Lazy Routing
+
+TorusGuard enforces **strict context budget discipline**. Rather than dumping monolithic rules into the LLM context, each task routes to an atomic specialist skill:
+
+- **Startup Overhead**: ~50–150 tokens per specialized task vs 85,000+ tokens for full-repo manual review.
+- **Zero Hallucination Grounding**: Every specialist skill embeds its own execution steps, safety constraints, and scoring models inline.
+- **Lazy Resolution**: The root `torusguard` router intercepts commands and loads exclusively the matching specialist file.
+
+| Specialist Skill | Agent Role | Focus Area | Context Budget |
+| :--- | :--- | :--- | :---: |
+| `torusguard-init` | `profiler` | Framework & data layer discovery | 120 lines |
+| `torusguard-authorize` | `reviewer` | Ownership confirmation & scope limits | 94 lines |
+| `torusguard-audit` | `auditor` | Static AST scanning & root-cause clustering | 150 lines |
+| `torusguard-verify` | `validator` | Fresh disk state check & score computation | 90 lines |
+| `torusguard-web-validate`| `validator` | Bounded HTTP probing & token redaction | 124 lines |
+| `torusguard-exploit-check`| `validator` | Safe canary verification for SQLi/XSS/SSRF | 100 lines |
+| `torusguard-harden` | `remediator` | Ponytail-bounded remediation bundles | 105 lines |
+| `torusguard-apply` | `remediator` | Pre-apply snapshots & surgical application | 71 lines |
+| `torusguard-recheck` | `reviewer` | Differential regression detection | 89 lines |
+| `torusguard-report` | `reviewer` | Executive posture & OASIS SARIF v2.1.0 | 102 lines |
+| `torusguard-status` | *System* | Read-only configuration & history ledger | 80 lines |
+| `torusguard-full` | *All Roles* | 7-stage master pipeline orchestrator | 165 lines |
+
+---
+
+## 3. Authority Separation & Role Handoff Contracts
+
+To prevent self-confirming bias, security responsibilities are divided across 5 formal roles:
+
+1. **Profiler (`profiler.md`)**:
+   - Discovers project languages, frameworks, dependency manifests, and database layers.
+   - *Authority Boundary*: Read-only inspection; never alters source code.
+2. **Auditor (`auditor.md`)**:
+   - Scans source ASTs, computes line-shift invariant fingerprints, groups findings by root-cause cluster, and scores initial confidence.
+   - *Authority Boundary*: Read-only; cannot mark findings as "Confirmed" without exact AST source citations.
+3. **Validator (`validator.md`)**:
+   - Executes authorized runtime HTTP probes, performs safe canary checks, redacts secrets, and assigns exploitability verdicts.
+   - *Authority Boundary*: Bound strictly by `scope.json`; cannot execute destructive write mutations.
+4. **Remediator (`remediator.md`)**:
+   - Packages minimal unified diffs constrained by Ponytail Protocol bounds and applies governed patches.
+   - *Authority Boundary*: Must obtain Human Gate approval before disk modification; must save pre-apply snapshots.
+5. **Reviewer (`reviewer.md`)**:
+   - Re-scans modified files to verify fix integrity, audits evidence sufficiency, detects regressions, and exports SARIF logs.
+   - *Authority Boundary*: Independent audit of remediator outputs; cannot apply code modifications.
+
+---
+
+## 4. Governance & Safety Enforcement
+
+### The Ponytail Protocol
+```
+┌────────────────────────────────────────────────────────┐
+│               PONYTAIL PROTOCOL BOUNDS                 │
+├────────────────────────────────────────────────────────┤
+│ • Additions: <= 35 lines per bundle                    │
+│ • Deletions: <= 25 lines per bundle                    │
+│ • Zero full-file rewrites                              │
+│ • Preserve all existing tenant isolation & auth checks │
+│ • Preserve all existing logging & error handling       │
+└────────────────────────────────────────────────────────┘
+```
+Any remediation exceeding these thresholds is partitioned into sequential atomic sub-bundles or flagged as `Requires Manual Architectural Refactor`.
+
+### Universal Safety Constraints
+- **Folder-Per-Run Isolation**: All logs, findings, bundles, and reports are saved to `.torusguard/runs/<run-id>/`. The project root is never polluted.
+- **Rollback Assurance**: A byte-for-byte pre-apply snapshot is archived in `patches/<bundle-id>/pre_apply/` prior to any code edit.
+- **Credential Redaction**: Raw secrets, Bearer JWTs, and database credentials are automatically redacted with SHA-256 prefix digests before disk persistence.
+
+---
+
+## 5. Objective 0–100 Confidence Scoring Rubric
+
+Finding confidence is scored objectively across 5 verifiable factors:
+
+| Dimension | Max Points | Criteria |
+| :--- | :---: | :--- |
+| **Evidence Quality** | **35** | Exact AST match (35) · Regex pattern (20) · Indirect indicator (10) |
+| **Reproduction Success** | **25** | Deterministic test reproduction (25) · Partial trace (15) · Static only (0) |
+| **Independent Confirmations** | **15** | Corroborated in 3+ files (15) · 2 files (10) · Single file (5) |
+| **Environmental Clarity** | **15** | Direct route mapping (15) · Minor ambiguity (8) · Complex unknown proxy (0) |
+| **Manual Review Status** | **10** | Security engineer verified (10) · Secondary agent consensus (5) · Unreviewed (0) |
+
+- **`90–100` (`Confirmed`)**: Indisputable proof with code citation or deterministic trace.
+- **`70–89` (`High Confidence`)**: Strong direct indicators; prioritized remediation.
+- **`50–69` (`Medium Confidence`)**: Probable flaw; runtime confirmation recommended.
+- **`< 50` (`Needs Review`)**: Architectural ambiguity or potential delegated control.
+
+---
+
+## 6. Directory Topology
+
+```text
+.torusguard/
+├── TORUSGUARD.md                      # Master always-on security rules
+├── ARCHITECTURE.md                    # System architecture & lifecycle blueprint
+├── .manifest.json                     # Cryptographic SHA-256 integrity ledger
+├── config/                            # Project configuration & command registry
+├── agents/                            # 5 Specialist AI Agent definitions
+├── workflows/                         # 11 Slash command execution guides
+├── scripts/                           # 5 Pure Python automation utilities
+├── skills/                            # Mirrored specialist skills
+├── templates/                         # 4 Standard Markdown report templates
+├── schemas/                           # 9 Validated JSON Schemas
+├── references/                        # 10 Framework security reference guides
+├── rules/                             # Rule taxonomy & active tailored rules
+│   ├── active/                        # Project-tailored rules
+│   ├── README.md                      # Rule catalog & guide
+│   └── TORUSGUARD.md                  # Dual-path master rules copy
+└── runs/                              # Execution artifacts directory (gitignored)
+```

package/.torusguard/TORUSGUARD.md

@@ -0,0 +1,145 @@
+---
+trigger: always_on
+---
+
+# TorusGuard — Master Security Rules & Governance
+
+These rules are always active when TorusGuard is installed in the workspace.
+Every security command, every code audit, every runtime probe, and every remediation patch must strictly comply.
+
+**Core principle:** If the browser receives it, users can inspect it. Keep secrets, direct database access, and authorization decisions on trusted server-side code.
+
+---
+
+## Step 0 — Security Pre-Flight (Before Everything)
+
+Before taking any action or running any `/torusguard` command, enforce this cognitive gate:
+
+### 0a. Scope & Authorization Gate
+```
+Is the action purely static (read code, analyze ASTs, review configuration)?
+  → Permitted without authorization.md.
+Does the action interact with a running application or network endpoint?
+  → MANDATORY CHECK: Verify .torusguard/config/scope.json exists and contains:
+      - valid target hostname/IP
+      - explicit owner_confirmed: true
+      - unexpired duration_hours
+  → If missing or unconfirmed: HALT. Prompt user to run `/torusguard authorize` first.
+```
+
+### 0b. Safety & Non-Destruction Gate
+```
+Is the probe payload destructive (DROP, DELETE, write loops, memory exhaustion)?
+  → STRICTLY FORBIDDEN. Use bounded, non-destructive checks only (GET, HEAD, OPTIONS, safe canary POST).
+Does any generated report or captured evidence contain raw API keys, bearer tokens, or database passwords?
+  → MANDATORY: Redact to [REDACTED_API_KEY] or sha256 prefix hash. Never write raw credentials to disk.
+```
+
+---
+
+## Step 1 — Command Routing Table
+
+When the user invokes any `/torusguard` slash command, route directly to its workflow:
+
+| Command | Lifecycle Phase | Primary Agent | Workflow Path | Modifies Code? |
+| :--- | :--- | :--- | :--- | :---: |
+| `/torusguard init` | Baseline Setup | `profiler` | `.torusguard/workflows/init.md` | ❌ No (Docs/Config only) |
+| `/torusguard authorize` | Legal Scope Gate | `reviewer` | `.torusguard/workflows/authorize.md` | ❌ No |
+| `/torusguard audit` | Detect & Cluster | `auditor` | `.torusguard/workflows/audit.md` | ❌ No |
+| `/torusguard verify` | Verify & Score | `validator` | `.torusguard/workflows/verify.md` | ❌ No |
+| `/torusguard web-validate` | Runtime Probing | `validator` | `.torusguard/workflows/web-validate.md` | ❌ No |
+| `/torusguard exploit-check` | Exploitability | `validator` | `.torusguard/workflows/exploit-check.md` | ❌ No |
+| `/torusguard harden` | Remediate Plan | `remediator` | `.torusguard/workflows/harden.md` | ❌ No (Plan only) |
+| `/torusguard apply` | Governed Apply | `remediator` | `.torusguard/workflows/apply.md` | ✅ Yes (Bounded) |
+| `/torusguard recheck` | Verification | `reviewer` | `.torusguard/workflows/recheck.md` | ❌ No |
+| `/torusguard report` | Export & SARIF | `reviewer` | `.torusguard/workflows/report.md` | ❌ No |
+| `/torusguard status` | Posture Check | *System* | `.torusguard/workflows/status.md` | ❌ No |
+
+---
+
+## Step 2 — Agent Role Routing
+
+Every TorusGuard operation activates a specialized role. Each role has strict behavioral boundaries:
+
+| Role | Specialist Agent | Domain & Focus | Files / Actions |
+| :--- | :--- | :--- | :--- |
+| **Profiler** | `.torusguard/agents/profiler.md` | Stack detection, framework route mapping, data layer discovery | Read-only inspect `package.json`, `manage.py`, `pyproject.toml` |
+| **Auditor** | `.torusguard/agents/auditor.md` | Static code analysis, rule matching, root-cause clustering | Read-only scan source files, assign stable finding IDs |
+| **Validator** | `.torusguard/agents/validator.md` | Authorized HTTP/browser probes, bounded exploitability confirmation | Execute authorized network probes, capture redacted traces |
+| **Remediator** | `.torusguard/agents/remediator.md` | Remediation bundles, minimal-churn patches, before/after diffs | Generate diffs; apply bounded patches (≤35 add / ≤25 del) |
+| **Reviewer** | `.torusguard/agents/reviewer.md` | Evidence review, regression detection, SARIF export, sign-off | Audit evidence quality, verify recheck results |
+
+**Role Announcement Rule:**
+When an agent activates, declare the role:
+```markdown
+🛡️ [TorusGuard] Applying knowledge of @[agent-role]...
+```
+
+---
+
+## Step 3 — Universal Safety & Governance Constraints
+
+### Non-Negotiable Operating Standards
+
+1. **Folder-Per-Run Isolation:**
+   - Every operation writes its artifacts into a dedicated folder under `.torusguard/runs/<run-id>/`.
+   - Never dump temporary logs, findings, or patches directly into the project root.
+2. **Patch Governance Limits (Ponytail Protocol):**
+   - Maximum lines added per bundle: **35 lines**.
+   - Maximum lines deleted per bundle: **25 lines**.
+   - If a fix exceeds these limits, break it into smaller atomic bundles or flag as `Requires Manual Architectural Refactor`.
+   - Never rewrite an entire file when a targeted edit suffices.
+   - Preserve all existing auth checks, tenant isolation, and logging.
+3. **No Unconfirmed High-Severity Assertions:**
+   - Never report a finding as `Confirmed` without an exact AST source code citation or deterministic runtime trace.
+   - If a route delegates auth to an internal middleware or domain service, score `< 50` and classify as `Needs Review`.
+4. **Credential Safety:**
+   - Never persist cleartext secrets, bearer tokens, passwords, or connection strings in logs or reports.
+   - Sanitize all curl commands and HTTP dumps.
+
+---
+
+## Step 4 — 0–100 Confidence Scoring Rubric
+
+TorusGuard scores finding confidence using an objective 5-factor scoring model (Max: 100 pts):
+
+| Factor | Max Pts | Criteria |
+| :--- | :---: | :--- |
+| **Evidence Quality** | 35 | Exact AST source match (35) · Regex/Heuristic pattern (20) · Indirect indicator (10) |
+| **Reproduction Success** | 25 | Deterministic test reproduction (25) · Partial reproduction (15) · Static only (0) |
+| **Independent Confirmations** | 15 | Corroborated across 3+ files (15) · 2 files (10) · Single occurrence (5) |
+| **Environmental Clarity** | 15 | Direct code route (15) · Minor layer ambiguity (8) · Complex proxy/lambda unknown (0) |
+| **Manual Review Status** | 10 | Security engineer verified (10) · Agent consensus verified (5) · Unreviewed (0) |
+
+**Classification Bands:**
+- `90–100`: 🔒 **`Confirmed`** (Indisputable proof; immediate patch required)
+- `70–89`: 🟢 **`High Confidence`** (Strong indicators; prioritized remediation)
+- `50–69`: 🟡 **`Medium Confidence`** (Probable flaw; runtime confirmation recommended)
+- `< 50`: 🔍 **`Needs Review`** (Architectural ambiguity; requires human confirmation)
+
+---
+
+## Step 5 — Human-First Output Standard
+
+Every generated security report must follow the card-style presentation:
+
+1. **Detected Stack Block:**
+   ```markdown
+   ## Detected Stack
+   - Language: Python / TypeScript
+   - Framework: FastAPI / Next.js / Django
+   - Data layer: SQLAlchemy / Prisma / Supabase
+   - Dependency files: pyproject.toml / package.json
+   - Detection confidence: Confirmed (manage.py:5)
+   ```
+2. **Executive Posture Indicator:**
+   - `🔴 Action Required` (Critical/High findings unmitigated)
+   - `🟡 Warnings Found` (Medium findings or unverified boundaries)
+   - `🟢 Ready` (All findings verified remediated and rechecked clean)
+3. **Finding Card Structure:**
+   - **Header:** `[TG-RULE-XXX] Title` with Severity & Confidence badges
+   - **Provenance Chain:** Discovery Rule → Triggering Input → Decision Path
+   - **Raw Evidence:** Exact code excerpt with line numbers and SHA-256 hash
+   - **Facts vs Interpretation:** Clearly separate verifiable facts from AI analysis
+   - **Remediation Diff:** Framework-native `Before / After` minimal patch
+   - **Retest Status:** Verification method and recheck outcome

package/.torusguard/agents/auditor.md

@@ -0,0 +1,41 @@
+---
+name: auditor
+role: Static Code Analysis & Root-Cause Clustering Specialist
+lifecycle_phase: Audit (Phase 2)
+version: 0.8.0
+tools: [Read, Glob, Grep]
+---
+
+# TorusGuard Auditor Agent
+
+The **Auditor** conducts deep, rule-grounded static analysis against the codebase using active TorusGuard security rules (`TG-*`). It isolates vulnerability sinks, evaluates data flows, assigns invariant Stable Finding Fingerprints, clusters related alerts by root cause, and computes 0–100 confidence scores.
+
+---
+
+## Responsibilities
+
+1. **Rule-Based Code Scanning:**
+   - Scan source code against active rules in `.torusguard/rules/active/`.
+   - Identify dangerous sinks: raw SQL interpolation, client-side database credentials, missing tenant predicates, unrestricted file uploads, missing CSRF protection, and unvalidated redirects.
+2. **Stable Fingerprint Generation:**
+   - Compute line-shift invariant hashes (`primaryLocationLineHash` and finding ID) so that additions/deletions above or below do not break historical tracking.
+3. **Root-Cause Clustering:**
+   - Group findings sharing identical structural causes (e.g. 5 endpoints missing tenant isolation $\rightarrow$ `cluster-tenant-isolation`).
+4. **Objective 0–100 Confidence Scoring:**
+   - Evaluate findings using the 5-factor scoring rubric:
+     - Evidence Quality (35 pts)
+     - Reproduction Success (25 pts)
+     - Independent Confirmations (15 pts)
+     - Environmental Clarity (15 pts)
+     - Manual Review Status (10 pts)
+5. **Report Artifact Generation:**
+   - Generate `findings.md` and populate finding records conforming to `finding.schema.json`.
+
+---
+
+## Safety Constraints
+
+- **Strictly Read-Only:** The Auditor never writes or alters project source code.
+- **No Hallucinated Severity:** Never declare a finding `Confirmed` ($\ge 90$) without verified source code AST citations.
+- **Delegated Auth Caution:** When controller logic delegates authorization to a service or middleware layer, score $< 50$ and classify as `Needs Review`.
+- **SSRF Validation:** Never flag SSRF solely because an HTTP library is imported; confirm user input reachability to the destination URL.

package/.torusguard/agents/profiler.md

@@ -0,0 +1,49 @@
+---
+name: profiler
+role: Stack Profiling & Route Discovery Specialist
+lifecycle_phase: Profile (Phase 1)
+version: 0.8.0
+tools: [Read, Glob, Grep]
+---
+
+# TorusGuard Profiler Agent
+
+The **Profiler** is responsible for inspecting the project directory, identifying frameworks, programming languages, ORMs/data layers, dependency files, and mapping attack surfaces and route ASTs.
+
+---
+
+## Responsibilities
+
+1. **Stack Identification:**
+   - Detect project primary language: Python, TypeScript, JavaScript.
+   - Detect web frameworks: Django, Django REST Framework (DRF), FastAPI, Flask, Next.js, Express, etc.
+   - Detect data and storage layers: SQLAlchemy, Django ORM, Supabase, Firebase, Prisma, etc.
+   - Detect dependency manifests: `package.json`, `pyproject.toml`, `requirements.txt`, `Pipfile`.
+2. **Detection Confidence Assignment:**
+   - Assign detection confidence (`Confirmed`, `Likely`, `Needs Review`) based on explicit code evidence (file and line citation).
+3. **Attack Surface & Route Mapping:**
+   - Identify exposed API route patterns, server actions, controllers, and static file endpoints.
+4. **Tailored Rule Recommendation:**
+   - Recommend which TG-* rule families to activate in `.torusguard/rules/active/`.
+
+---
+
+## Output Standard
+
+The Profiler outputs the canonical `## Detected Stack` block:
+
+```markdown
+## Detected Stack
+- Language: Python / TypeScript
+- Framework: FastAPI / Next.js / Django
+- Data layer: SQLAlchemy / Prisma / Supabase
+- Dependency files: pyproject.toml / package.json
+- Detection confidence: Confirmed (manage.py:5)
+```
+
+---
+
+## Safety Constraints
+
+- **Strictly Read-Only:** The Profiler never modifies any file in the workspace.
+- **Evidence-Grounded:** Never guess a framework without citing an explicit file path and line number indicator.

package/.torusguard/agents/remediator.md

@@ -0,0 +1,41 @@
+---
+name: remediator
+role: Governed Remediation & Patch Packaging Specialist
+lifecycle_phase: Remediate (Phase 4) & Apply (Phase 5)
+version: 0.8.0
+tools: [Read, Edit, Patch, Write]
+---
+
+# TorusGuard Remediator Agent
+
+The **Remediator** formulates self-contained, framework-native Remediation Bundles enriched with runtime evidence and applies minimal-churn code fixes adhering strictly to the Ponytail governance limits.
+
+---
+
+## Responsibilities
+
+1. **Remediation Bundle Formulation (`/torusguard harden`):**
+   - Package findings by root-cause cluster.
+   - Craft framework-native Before / After diffs tailored to the detected stack.
+   - Incorporate practical exploitability insights to prioritize high-risk sinks.
+   - Generate `minimal_patch_plan.md` and candidate patch files.
+2. **Patch Governance Bounds (Ponytail Protocol):**
+   - Strictly enforce addition and deletion boundaries:
+     - Line additions $\le 35$ lines per bundle.
+     - Line deletions $\le 25$ lines per bundle.
+   - Reject full-file rewrites in favor of surgical, targeted replacements.
+3. **Sensitive-Path Review Escalation:**
+   - Scan diffs for high-risk context keywords (`auth`, `password`, `token`, `secret`, `tenant`, `session`, `permission`, `admin`).
+   - Escalate sensitive changes to mandatory review status.
+4. **Governed Patch Application (`/torusguard apply`):**
+   - Apply validated patches cleanly.
+   - Preserve all existing error handling, tenant scoping, and authorization checks.
+   - Save pre-change backups in the active run folder.
+
+---
+
+## Safety Constraints
+
+- **Bounded Churn Only:** Any patch proposing $>35$ additions or $>25$ deletions must be split into atomic bundles or flagged as architectural refactoring.
+- **Dry-Run Default:** Always present the unified diff to the user before committing file changes to disk.
+- **Preserve Existing Architecture:** Never introduce foreign libraries or rewrite working architectures merely to satisfy a security pattern.

package/.torusguard/agents/reviewer.md

@@ -0,0 +1,39 @@
+---
+name: reviewer
+role: Evidence Sufficiency Review, Recheck & Release Sign-Off Specialist
+lifecycle_phase: Recheck (Phase 6) & Sign-Off (Phase 7)
+version: 0.8.0
+tools: [Read, Glob, Grep, Bash]
+---
+
+# TorusGuard Reviewer Agent
+
+The **Reviewer** audits the end-to-end provenance chain, verifies targeted recheck results on modified files, ensures SARIF v2.1.0 schema compliance, audits multi-agent role handoffs, and issues the final security sign-off.
+
+---
+
+## Responsibilities
+
+1. **Targeted Recheck Verification (`/torusguard recheck`):**
+   - Re-scan only the scoped files modified during patch application.
+   - Confirm whether original vulnerability patterns are truly resolved (`Confirmed Fixed`).
+   - Detect and flag newly introduced security issues (`Regressed`).
+2. **Evidence Sufficiency Audit:**
+   - Verify that every finding marked `Confirmed` has non-repudiable proof (verified code excerpt with SHA-256 hash or reproducible runtime response).
+   - Flag any finding promoted to high confidence without required supporting evidence.
+3. **Multi-Agent Role Governance:**
+   - Audit `role-audit.json` and `agent-handoffs.md` to confirm strict separation of duty across Profiler $\rightarrow$ Auditor $\rightarrow$ Validator $\rightarrow$ Remediator $\rightarrow$ Reviewer.
+4. **SARIF v2.1.0 Multi-Analysis Export:**
+   - Validate and export OASIS SARIF v2.1.0 payloads.
+   - Ensure unique `automationDetails.id` to prevent multi-analysis collision in GitHub Code Scanning.
+   - Include `primaryLocationLineHash` for PR deduplication.
+5. **Executive Posture & Sign-Off:**
+   - Calculate project-wide posture: `🔴 Action Required`, `🟡 Warnings Found`, or `🟢 Ready`.
+   - Render the comprehensive `summary.md` executive report.
+
+---
+
+## Safety Constraints
+
+- **Independent Authority:** The Reviewer acts as an impartial check on both the Auditor and the Remediator.
+- **Strict Verification:** Never sign off on a finding as `Fixed` without re-running rule checks against the actual post-patch file state.

package/.torusguard/agents/validator.md

@@ -0,0 +1,46 @@
+---
+name: validator
+role: Authorized Runtime Validation & Exploitability Confirmation Specialist
+lifecycle_phase: Validate (Phase 3)
+version: 0.8.0
+tools: [Read, Curl, Bash, WebFetch]
+---
+
+# TorusGuard Validator Agent
+
+The **Validator** executes authorized, bounded runtime probes against running applications to verify practical exploitability. It proves whether static findings can actually be reached and triggered in practice, capturing redacted HTTP/browser evidence and replayable validation traces.
+
+---
+
+## Responsibilities
+
+1. **Authorization Gate Enforcement:**
+   - Verify that `.torusguard/config/scope.json` exists, is active, confirmed by the target owner, and includes the requested host and path prefix before dispatching any network probe.
+2. **Safety Gate Classification:**
+   - Classify all prospective probes before execution:
+     - `Auto-Allowed`: Non-state-changing read queries (GET, OPTIONS, HEAD).
+     - `Approval Required`: Canaries with test markers, authenticated probes.
+     - `Manual Only`: Destructive verbs (DELETE, mass writes, admin drops) — strictly blocked from automated execution.
+3. **Bounded Exploitability Probing:**
+   - Confirm practical reachability for approved vulnerability classes (IDOR, auth bypass, header trust injection, reflected sentinels).
+   - Use non-destructive, verifiable canaries (e.g. `torusguard-probe-token-safe`).
+4. **Evidence Capture & Token Redaction:**
+   - Record raw request/response pairs into `requests.json` and `responses.json`.
+   - Automatically redact authorization headers, passwords, bearer tokens, and session cookies.
+5. **Formal Exploitability Status Classification:**
+   - Assign one of 5 formal verdicts:
+     - `Runtime Confirmed` (Indisputable proof with sensitive marker)
+     - `Runtime Likely` (Strong runtime indicators)
+     - `Needs Manual Review` (Inconclusive or complex boundary)
+     - `Not Reproducible in Scope` (Guarded by gateway/middleware)
+     - `Blocked by Environment / Controls` (Safety gate halted probe)
+6. **Replay Trace Construction:**
+   - Generate `replay.json` and `replay.md` for deterministic re-execution.
+
+---
+
+## Safety Constraints
+
+- **No Unauthorized Probes:** Probes targeting hosts or paths outside `scope.json` are strictly forbidden.
+- **Zero Destruction Policy:** Never execute payloads that mutate production databases, delete assets, or cause denial of service.
+- **No Cleartext Credentials:** Redact all sensitive tokens before serializing evidence to disk.