torusguard 0.9.2

package/skills/torusguard/payload/skills/torusguard-recheck/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: torusguard-recheck
+description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
+version: 0.9.2
+workflow: .torusguard/workflows/recheck.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Recheck — Targeted Differential Audit & Regression Verification
+
+## Objective
+Re-scan only files modified by remediation patches, confirming that targeted vulnerability sinks have been neutralized and verifying that no new security regressions were introduced.
+
+---
+
+## Execution Steps
+
+1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
+2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against the modified files.
+3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
+4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
+5. **Update State:** Record verified status in `findings.json`.
+6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
+
+---
+
+## State Transition Rules
+- **`Fixed`:** Targeted vulnerable AST pattern is absent and no new issues appear on modified lines.
+- **`Partially Fixed`:** Vulnerability surface was reduced but sanitization remains incomplete.
+- **`Not Fixed`:** Vulnerable AST sink remains present in patched file.
+- **`Regression`:** Patch introduced a new security rule violation on modified lines.
+
+---
+
+## Safety Constraints
+- Restrict AST scan strictly to modified files and direct callers.
+- If regression is detected, halt and recommend immediate rollback via `.bak` snapshot.
+- Read-only differential analysis.
+
+---
+
+## Output Format
+```markdown
+✅ [TorusGuard] Differential Recheck Completed
+- Modified Files Scanned: <Count>
+- Target Finding: <Finding ID> ──► FIXED
+- Regressions Detected: 0
+- Report: `.torusguard/runs/<run_id>/recheck-report.md`
+Next: Run `/torusguard report` to export final SARIF and release summary.
+```

package/skills/torusguard/payload/skills/torusguard-report/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: torusguard-report
+description: Generate unified security posture reports and export OASIS SARIF v2.1.0 logs for CI/CD integration.
+version: 0.9.2
+workflow: .torusguard/workflows/report.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/sarif_exporter.py
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Report — Unified Security Posture Report & SARIF Export
+
+## Objective
+Aggregate findings, verification traces, and recheck results into a signed executive security summary and export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines.
+
+---
+
+## Execution Steps
+
+1. **Aggregate Run Data:** Read findings, verified evidence, and recheck records from active run.
+2. **Export OASIS SARIF v2.1.0:**
+   ```bash
+   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
+   ```
+3. **Compile Executive Markdown Report:** Generate `report.md` with posture score, open/closed finding tables, and risk breakdown.
+4. **Update Run Manifest:** Finalize `manifest.json` status counts.
+5. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
+
+---
+
+## SARIF v2.1.0 Output Specification
+- **Version:** `$schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`, `version: 2.1.0`.
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 0.9.2`, full rules catalog in `driver.rules`.
+- **Category Hygiene:** Set `automationDetails.id: "torusguard/static"` to avoid collisions in multi-analysis CI.
+- **Fingerprinting:** Populate `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
+
+---
+
+## Safety Constraints
+- Redact all tokens, passwords, and API keys before saving report.
+- Strictly read-only reporting; no source code modifications.
+- Ensure SARIF passes JSON schema validation.
+
+---
+
+## Output Format
+```markdown
+📊 [TorusGuard] Security Posture Report Emitted
+- Run ID: <Run ID> | Posture Score: <Score>/100
+- Findings: <Total> (<Fixed> Fixed · <Open> Open)
+- SARIF Export: `.torusguard/runs/<run_id>/results.sarif`
+- Executive Report: `.torusguard/runs/<run_id>/report.md`
+```

package/skills/torusguard/payload/skills/torusguard-status/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: torusguard-status
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
+version: 0.9.2
+workflow: .torusguard/workflows/status.md
+tools: Read, Grep, Glob
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
+
+## Objective
+Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
+
+---
+
+## Execution Steps
+
+1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
+2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
+3. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
+4. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
+5. **Render Diagnostic Overview:** Output formatted status card.
+
+---
+
+## Safety Constraints
+- Read-only execution; zero file modifications.
+- Handle uninitialized workspaces gracefully with advice to run `/torusguard init`.
+
+---
+
+## Output Format
+```markdown
+🛡️ [TorusGuard] Workspace Status Overview
+- Version: v0.9.2 | Stack: <Detected Framework>
+- Active Rules: <Count> rules active in `.torusguard/rules/active/`
+- Historical Runs: <Count> runs recorded
+- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
+- Posture: <SECURE / ACTION REQUIRED>
+```

package/skills/torusguard/payload/skills/torusguard-verify/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: torusguard-verify
+description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
+version: 0.9.2
+workflow: .torusguard/workflows/verify.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Verify — Finding Evidence Verification & Calibration
+
+## Objective
+Audit the evidence sufficiency of candidate findings by reading current disk lines, evaluating unbroken taint source-to-sink flow, filtering false alarms, and calibrating final 0–100 confidence scores.
+
+---
+
+## Execution Steps
+
+1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.
+2. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
+3. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
+4. **Calibrate Confidence Score:**
+   ```bash
+   python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
+   ```
+5. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
+6. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
+
+---
+
+## Evidence Sufficiency
+A finding is verified as sufficient when:
+- **Direct AST Match:** The vulnerable API or sink call exists on disk at the cited location.
+- **Exposed Surface:** The sink is reachable from an external route, view, or public method.
+- **Absence of Sanitizer:** No escaping function, parameterization, or validating middleware neutralizes the input.
+- **Taint Integrity:** Untrusted request data flows into the sink without structural validation.
+
+---
+
+## Safety Constraints
+- Read-only analysis; no files are modified.
+- Never guess line numbers; always verify via active disk read.
+- Downgrade findings with sanitizer presence to `False Positive`.
+
+---
+
+## Output Format
+```markdown
+🧪 [TorusGuard] Finding Verification Complete
+- Findings Audited: <Count> | Confirmed Real: <Count>
+- False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
+- Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`
+Next: Run `/torusguard harden` to formulate surgical fixes for confirmed flaws.
+```

package/skills/torusguard/payload/skills/torusguard-web-validate/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: torusguard-web-validate
+description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
+version: 0.9.2
+workflow: .torusguard/workflows/web-validate.md
+tools: Read, Grep, Glob, Bash, Write
+scripts-binding:
+  - .torusguard/scripts/safety_gate.py
+---
+
+# TorusGuard Web Validate — Bounded HTTP Probing & Session Capture
+
+## Objective
+Safely probe live web applications within authorized scope, injecting transparent audit headers, verifying security headers and cookies, redacting sensitive tokens, and recording deterministic replay traces.
+
+---
+
+## Authorization Gate Check
+Before dispatching any HTTP request:
+1. Verify `.torusguard/config/scope.json` exists and contains target URL.
+2. Confirm current timestamp is prior to `expires_at` TTL.
+3. Assert target is local or non-production staging.
+
+---
+
+## Safety Gate
+All requests pass through `.torusguard/scripts/safety_gate.py`:
+- `Auto-Allowed`: Read-only `GET`, `HEAD`, `OPTIONS` on non-sensitive paths.
+- `Approval Required`: Requests touching auth, sessions, or parameters.
+- `Manual Only`: Any destructive method (`DELETE`, `DROP`) is strictly blocked.
+
+---
+
+## Execution Steps
+
+1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
+2. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
+3. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
+4. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
+5. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+6. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
+
+---
+
+## Credential Redaction
+All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk serialization (`Bearer [REDACTED]`).
+
+---
+
+## Safety Constraints
+- Max 50 requests per validation session.
+- Never test unauthorized domains or third-party APIs.
+- Zero state-changing destructive operations.
+
+---
+
+## Output Format
+```markdown
+🌐 [TorusGuard] Web Validation Completed
+- Target: <Host URL> | Endpoints Tested: <Count>
+- Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
+- Replay Trace: `.torusguard/runs/<run_id>/requests.json`
+Next: Run `/torusguard exploit-check` to confirm exploitability of candidate flaws.
+```

package/skills/torusguard/payload/templates/audit-report.template.md

@@ -0,0 +1,54 @@
+# TorusGuard Security Audit & Runtime Verification Report
+
+> **TorusGuard Version:** `{{torusguard_version}}`  
+> **Target:** `{{target_name}}`  
+> **Run ID:** `{{run_id}}`  
+> **Timestamp:** `{{timestamp}}`  
+
+---
+
+## Detected Stack
+- **Language:** {{stack_language}}
+- **Framework:** {{stack_framework}}
+- **Data Layer:** {{stack_data_layer}}
+- **Dependency Files:** {{stack_dependency_files}}
+- **Detection Confidence:** {{stack_confidence}}
+
+---
+
+## Executive Posture
+**Posture:** {{posture_indicator}}  
+**Average Confidence Score:** `{{avg_confidence_score}}/100`
+
+### Finding Summary
+| Severity | Count | Confirmed | Needs Review | Remediated |
+| :--- | :---: | :---: | :---: | :---: |
+| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
+| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
+| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
+| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
+
+---
+
+## Root-Cause Clusters
+{{cluster_summary_table}}
+
+---
+
+## Detailed Findings
+{{finding_cards_section}}
+
+---
+
+## Governance & Safety Audit Statement
+This execution complied with TorusGuard v0.8.0 governance rules:
+- **Authorization Gate:** {{authorization_status}}
+- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
+- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
+
+---
+
+## Prioritized Next Steps
+1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
+2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
+3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.

package/skills/torusguard/payload/templates/authorization.template.md

@@ -0,0 +1,34 @@
+# TorusGuard Target Authorization Record
+
+**Authorization ID:** `{{authorization_id}}`  
+**Generated At:** `{{timestamp}}`  
+**Valid Until:** `{{valid_until}}`  
+
+---
+
+## 1. Target Identification
+- **Project / Application:** `{{target_name}}`
+- **Target URL / Hosts:** `{{target_hosts}}`
+- **Scope Type:** `{{scope_type}}`
+
+---
+
+## 2. Permitted Boundaries
+- **Allowed Path Prefixes:**
+{{allowed_path_prefixes_list}}
+
+- **Explicitly Forbidden / Excluded Paths:**
+{{forbidden_paths_list}}
+
+- **Max Navigation Depth:** `{{max_depth}}`
+- **Max Request Budget:** `{{max_requests}}`
+- **Allow State-Changing Methods:** `{{allow_state_changing_methods}}`
+
+---
+
+## 3. Owner Confirmation & Legal Statement
+> [!IMPORTANT]
+> The target application owner has confirmed that this testing environment is authorized for non-destructive, bounded runtime security validation.
+
+- **Authorized By:** `{{authorized_by}}`
+- **Confirmation Status:** `Owner Confirmed`

package/skills/torusguard/payload/templates/finding-card.template.md

@@ -0,0 +1,32 @@
+### [{{rule_id}}] {{finding_title}}
+
+**Severity:** `{{severity_badge}}` | **Auditable Confidence:** `{{confidence_score}}/100 {{confidence_band_badge}}`  
+**Finding ID:** `{{finding_id}}` | **Fingerprint:** `{{fingerprint_hash}}`  
+**Target Location:** `{{file_path}}:{{line_number}}` (`{{code_symbol}}`)  
+**Lifecycle Status:** `{{lifecycle_status}}` | **Exploitability:** `{{exploitability_status}}`  
+
+---
+
+#### 1. Provenance Chain
+- **Detection Rule:** `{{rule_id}}` (CWE-{{cwe_id}})
+- **Triggering Input:** `{{triggering_source}}`
+- **Sink Path:** `{{sink_expression}}`
+
+#### 2. Raw Verified Evidence
+```{{code_language}}
+{{raw_evidence_snippet}}
+```
+> **Evidence Checksum (SHA-256):** `{{evidence_sha256}}`
+
+#### 3. Objective Facts vs AI Interpretation
+- **Verified Facts:** {{raw_facts_summary}}
+- **AI Risk Analysis:** {{ai_interpretation}}
+
+#### 4. Remediation Diff (Minimal Churn)
+```diff
+{{remediation_diff_preview}}
+```
+
+#### 5. Retest & Verification
+- **Verification Method:** {{verification_method}}
+- **Current Retest Status:** `{{retest_status}}`

package/skills/torusguard/payload/templates/remediation-bundle.template.md

@@ -0,0 +1,35 @@
+# Remediation Bundle: `{{bundle_id}}`
+
+**Cluster ID:** `{{cluster_id}}`  
+**Target Rule:** `{{rule_id}}` (`{{rule_title}}`)  
+**Affected Files:** `{{affected_files}}`  
+
+---
+
+## 1. Problem Statement & Risk
+{{problem_statement}}
+
+**Adversarial Abuse & Practical Impact:**  
+{{risk_explanation}}
+
+---
+
+## 2. Governed Minimal Patch Plan
+- **Max Additions Boundary:** $\le 35$ lines (Proposed: `+{{additions_count}}`)
+- **Max Deletions Boundary:** $\le 25$ lines (Proposed: `-{{deletions_count}}`)
+- **Governance Review Level:** `{{governance_review_level}}`
+
+### Framework-Native Diff
+```diff
+{{candidate_patch_diff}}
+```
+
+---
+
+## 3. Verification & Retest Method
+{{verification_method}}
+
+---
+
+## 4. Residual Risk & Edge Cases
+{{residual_risk_notes}}

package/skills/torusguard/payload/workflows/apply.md

@@ -0,0 +1,95 @@
+---
+description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 0.9.2
+agent: remediator
+lifecycle-phase: Phase 5 (Patch Application)
+required-skills:
+  - torusguard-apply
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/diff_guard.py
+---
+
+# /torusguard apply — Governed Patch Application & Rollback Snapshot
+
+$ARGUMENTS
+
+---
+
+## Objective
+Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect bundle validity and file safety before modifying disk code:
+1. **Bundle Verification:** Assert `patch.diff` exists in active run's remediation folder.
+2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.bak` or `pre_apply/`) prior to editing.
+3. **Uncommitted Changes:** Check git status; ensure target file has clean baseline.
+4. **Ponytail Check:** Re-verify that patch additions $\le 35$ and deletions $\le 25$.
+5. **Human Gate:** Confirm operator approval before committing edits to disk.
+6. **Workspace Cleanliness:** Verify git working tree has no uncommitted merge conflicts.
+7. **Execution Privilege:** Verify write access to targeted file locations.
+
+---
+
+## When to Use /torusguard apply
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Applying an approved remediation patch to disk | Run `/torusguard apply` |
+| Generating patch diff without modifying disk | Run `/torusguard harden` |
+| Verifying that patch eliminated flaw without regression | Run `/torusguard recheck` |
+| Reverting an applied patch | Restore from `.bak` snapshot |
+| Checking workspace status | Run `/torusguard status` |
+
+---
+
+## Execution Steps
+
+1. **Load Remediation Bundle:** Read `patch.diff` and metadata from active run directory.
+2. **Audit Patch Invariants:** Run `python .torusguard/scripts/diff_guard.py <patch.diff>`.
+3. **Create Rollback Backup:** Copy target file to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
+4. **Apply Minimal Diff:** Execute precise surgical edit using `replace_file_content` or `patch`.
+5. **Assert Syntax & Integrity:** Check that modified file compiles cleanly without syntax errors.
+6. **Log Application Ledger:** Record timestamp, original SHA-256, and patched SHA-256 in `apply-log.json`.
+
+---
+
+## Failure Recovery
+
+- **Syntax Error After Patch:** Instantly revert target file from `.bak` backup snapshot.
+- **Merge / Context Conflict:** Re-run `/torusguard harden` to regenerate diff against latest disk lines.
+- **Missing Backup File:** Do not apply patch if backup copy cannot be written.
+- **Halt Trigger:** Abort if git working tree is dirty on conflicting lines.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never apply code changes without creating an exact pre-apply rollback backup first.
+- ❌ Never touch files not explicitly listed in the approved `patch.diff`.
+- ✅ Always verify syntax compilation immediately after modifying source files.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🚀 TorusGuard Patch Application
+- **Finding Addressed:** `TG-XXX-HASH`
+- **File Patched:** `src/path/to/file.py`
+- **Rollback Backup:** `.torusguard/runs/<run_id>/pre_apply/<file>.bak`
+- **Churn Applied:** +[Additions] / -[Deletions] lines
+- **Syntax Check:** PASSED (clean compile)
+- **Status:** APPLIED — run `/torusguard recheck` to verify fix
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard recheck` to perform differential audit on the modified file.
+2. Run test suites to verify that business logic and regressions remain intact.

package/skills/torusguard/payload/workflows/audit.md

@@ -0,0 +1,93 @@
+---
+description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
+tools: Read, Grep, Glob, Bash, Write
+version: 0.9.2
+agent: auditor
+lifecycle-phase: Phase 2 (Static Audit & Clustering)
+required-skills:
+  - torusguard-audit
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# /torusguard audit — Static Security Code Scan & Clustering
+
+$ARGUMENTS
+
+---
+
+## Objective
+Static security AST scanning, stable fingerprinting, root-cause clustering, and 0-100 scoring.
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect workspace prerequisites before launching static audit:
+1. **Init State (`torusguard.json`):** Assert repository is initialized.
+2. **Active Rules (`rules/active/`):** Confirm rule definitions exist.
+3. **Exclusions:** Assert `node_modules/`, `.venv/`, `dist/`, `.git/` are skipped.
+4. **Run Folder:** Allocate isolated folder in `.torusguard/runs/`.
+5. **Syntax Check:** Check for syntax errors before parsing ASTs.
+
+---
+
+## When to Use /torusguard audit
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| First-time scan of repository or new branch | Run `/torusguard audit` |
+| Pre-commit review and PR security checks | Run `/torusguard audit` |
+| Uninitialized project | Run `/torusguard init` first |
+| Live endpoint or runtime probing | Run `/torusguard web-validate` |
+| Differential check after patch | Run `/torusguard recheck` |
+
+---
+
+## Execution Steps
+
+1. **Allocate Run Folder:** Run `python .torusguard/scripts/run_manager.py create audit`.
+2. **Scan Codebase ASTs:** Match active rules against source trees.
+3. **Compute Stable Fingerprints:** Hash AST context to produce stable IDs.
+4. **Cluster Root Causes:** Group findings sharing identical sinks.
+5. **Score Confidence (0–100):** Run `python .torusguard/scripts/finding_scorer.py --run <run_dir>`.
+6. **Emit Artifacts:** Write `findings.md`, `findings.json`, and `summary.md`.
+
+---
+
+## Failure Recovery
+
+- **Zero Rules Active:** Re-run `/torusguard init` to activate rules.
+- **AST Parse Error:** Log syntax error on malformed file, skip, and continue.
+- **Scorer Failure:** Ensure Python 3.10+; verify finding JSON structure.
+- **Halt Trigger:** Abort if run folder cannot be allocated or disk write fails.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never invent finding IDs without AST line hashing.
+- ❌ Never flag test fixtures as critical security flaws.
+- ✅ Always calculate scores using `.torusguard/scripts/finding_scorer.py`.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🔎 TorusGuard Static Audit Results
+- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
+- **Files Scanned:** [Count] source files
+- **Total Findings:** [Count] ([Critical] Critical, [High] High)
+- **Root Cause Clusters:** [Count] architectural issues
+- **Confidence:** [Score]/100
+- **Artifact:** `.torusguard/runs/<run_id>/findings.md`
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard verify` to validate exploitability and review evidence.
+2. Run `/torusguard harden` to generate minimal surgical remediation plans.