torusguard 0.9.2

package/skills/torusguard/references/platform-hardening.md

@@ -0,0 +1,56 @@
+# Platform and HTTP Hardening
+
+## When to load
+
+Load during `/TorusGuard check platform`, deployment prep, or `/TorusGuard verify`.
+
+## Linked rules
+
+- [TG-PLATFORM-001](../../rules/TG-PLATFORM-001-wildcard-cors-with-credentials.md) — Wildcard CORS + Credentials (High)
+- [TG-PLATFORM-002](../../rules/TG-PLATFORM-002-missing-security-headers.md) — Missing Security Headers (Medium)
+- [TG-PLATFORM-003](../../rules/TG-PLATFORM-003-production-stack-trace-exposure.md) — Stack Trace Exposure (Medium)
+- [TG-PLATFORM-004](../../rules/TG-PLATFORM-004-missing-request-size-limits.md) — Missing Request Size Limits (Medium)
+
+## Hard bans
+
+- No `Access-Control-Allow-Origin: *` with credentials
+- No production stack traces or raw DB errors to clients
+- No debug mode in production
+- No missing body limits on public JSON endpoints
+- No executable uploads in public web directories
+
+## Safe defaults
+
+- CORS explicit allowlist
+- Helmet or equivalent: CSP, `X-Content-Type-Options`, HSTS (production), `Referrer-Policy`, clickjacking protection
+- Generic user-facing errors; detailed logs server-side with request ID
+- HTTPS enforced in production
+- `express.json({ limit: '100kb' })` or appropriate caps
+- Dependency audit before deploy
+
+## Audit checklist
+
+- [ ] CORS allowlist (TG-PLATFORM-001)
+- [ ] Security headers configured (TG-PLATFORM-002)
+- [ ] Errors sanitized (TG-PLATFORM-003)
+- [ ] Request/upload limits set (TG-PLATFORM-004)
+
+## Framework notes
+
+- **Express** — Helmet + central error handler
+- **Next.js** — headers in `next.config` or middleware
+- **Reverse proxy** — TLS termination, HSTS, rate limits
+
+## Manual review
+
+- CSP compatibility with actual script/style sources
+- Infrastructure firewall and WAF rules
+- Backup and monitoring configuration
+
+## Related rules
+
+TG-RATE-003, TG-SEC-004, TG-CLIENT-001
+
+## Framework guide
+
+[Express Security](../../guides/express-security.md)

package/skills/torusguard/references/python-dependencies.md

@@ -0,0 +1,16 @@
+# TorusGuard Skill Reference: Python Dependencies and Supply Chain
+
+> **Loaded When:** Python dependency manifests (`requirements.txt`, `pyproject.toml`, `Pipfile`, `poetry.lock`, `uv.lock`) or `.github/workflows/*.yml` are detected.
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Lockfile Integrity
+* `TG-SUPPLY-001`: Verify that deterministic lockfiles exist alongside manifests and are not excluded in `.gitignore`.
+
+### 2. Known CVE Vulnerability Auditing
+* `TG-SUPPLY-002`: Check for vulnerable dependencies using `pip-audit`. Avoid recommending blind major-version upgrades that introduce breaking changes without tests.
+
+### 3. CI/CD Workflow Hardening
+* `TG-SUPPLY-004`: Inspect `.github/workflows/*.yml` for unpinned 3rd-party actions and overbroad default permissions.

package/skills/torusguard/references/python-security-overview.md

@@ -0,0 +1,12 @@
+# TorusGuard Skill Reference: Python Security Overview
+
+> **Loaded When:** Any Python project is detected (`requirements.txt`, `pyproject.toml`, `Pipfile`, `.py` source files).
+
+---
+
+## 🐍 Python Platform Security Principles
+
+1. **Explicit Boundaries Over Dynamic Magic:** Avoid unpacking arbitrary user dictionaries directly into database ORM models or data structures (`**req.dict()`, `**request.json`).
+2. **Server-Side Authorization First:** Route decorators (`@login_required`) verify identity, but database queries must verify resource ownership (`user_id == current_user.id`).
+3. **Outbound Request Bounding (SSRF):** Always validate scheme, resolve DNS, and block private CIDR blocks before calling `requests.get()` or `httpx.get()`.
+4. **Deterministic Environments:** Always maintain virtual environment isolation and commit cryptographically verifiable lockfiles (`poetry.lock`, `uv.lock`, `requirements.lock`).

package/skills/torusguard/references/rate-limit-and-abuse.md

@@ -0,0 +1,57 @@
+# Rate Limiting and Abuse Prevention
+
+## When to load
+
+Load during `/TorusGuard check rate-limit`, auth endpoint reviews, or public API design.
+
+## Linked rules
+
+- [TG-RATE-001](../../rules/TG-RATE-001-unlimited-auth-endpoint.md) — Unlimited Auth Endpoint (High)
+- [TG-RATE-002](../../rules/TG-RATE-002-unlimited-public-write-endpoint.md) — Unlimited Public Write (Medium)
+- [TG-RATE-003](../../rules/TG-RATE-003-unbounded-resource-consumption.md) — Unbounded Resource Use (High)
+
+## Hard bans
+
+- Never rely only on frontend throttling
+- Never leave login, reset, OTP, or contact endpoints unlimited in production
+- Never use in-memory-only rate limits as sole protection in distributed production
+
+## Configurable default limits
+
+| Endpoint | Suggested starting point |
+|----------|-------------------------|
+| Login | 5 / IP / 15 min + account backoff |
+| Password reset | 3 / email / hour |
+| OTP | 3 / identifier / 15 min |
+| Contact/feedback | 5 / IP / hour |
+| Public API | 60 / IP / minute |
+| Search | 30 / IP / minute |
+| Upload | 10 / IP / hour + size limits |
+| AI/LLM | Per-user and per-IP cost limits |
+
+Adjust for your traffic profile — these are defaults, not universal values.
+
+## Safe defaults
+
+- Per-IP limits on public endpoints
+- Per-account limits on auth flows
+- HTTP 429 with `Retry-After` when practical
+- Body, upload, and pagination caps (TG-RATE-003)
+- Timeouts and concurrency limits on expensive endpoints
+- Shared store (Redis) for multi-instance deployments
+
+## Audit checklist
+
+- [ ] Auth endpoints rate-limited (TG-RATE-001)
+- [ ] Public write/AI endpoints protected (TG-RATE-002)
+- [ ] Body/upload/pagination limits set (TG-RATE-003)
+
+## Manual review
+
+- Webhook endpoints (signature + IP limits)
+- GraphQL complexity/depth limits
+- Spend alerts for metered third-party APIs
+
+## Related rules
+
+TG-AUTH-005, TG-PLATFORM-004, TG-INPUT-004

package/skills/torusguard/references/secrets-and-config.md

@@ -0,0 +1,64 @@
+# Secrets and Environment Configuration
+
+## When to load
+
+Load during `/TorusGuard check secrets`, secret-related audits, or before adding environment variables, CI config, or deployment secrets.
+
+## Linked rules
+
+- [TG-SEC-001](../../rules/TG-SEC-001-hardcoded-secrets.md) — Hardcoded Secret (Critical)
+- [TG-SEC-002](../../rules/TG-SEC-002-public-environment-secrets.md) — Public Environment Secret (Critical)
+- [TG-SEC-003](../../rules/TG-SEC-003-tracked-env-file.md) — Tracked Environment File (High)
+- [TG-SEC-004](../../rules/TG-SEC-004-sensitive-logging.md) — Sensitive Data Logging (Medium)
+
+## Hard bans
+
+- Never hardcode database URLs, JWT secrets, passwords, or API keys in source
+- Never expose service-role or admin credentials to the browser
+- Never put secrets in `VITE_*`, `NEXT_PUBLIC_*`, or `REACT_APP_*` variables
+- Never log passwords, tokens, session IDs, API keys, or full authorization headers
+- Never commit `.env`, credentials JSON, or private key files
+
+## Frontend env prefixes are public
+
+| Prefix | Reaches browser? |
+|--------|------------------|
+| `VITE_` | Yes |
+| `NEXT_PUBLIC_` | Yes |
+| `REACT_APP_` | Yes |
+| (no prefix) | Server only |
+
+Only intentionally public configuration may use client prefixes.
+
+## Safe defaults
+
+1. Server-only env for all secrets
+2. `.env` in `.gitignore`
+3. `.env.example` with placeholder values only
+4. Rotate/revoke any discovered leaked secret immediately
+5. Separate dev/test/production secret stores where applicable
+
+## Audit checklist
+
+- [ ] No real secrets in tracked source (TG-SEC-001)
+- [ ] No sensitive values in public env vars (TG-SEC-002)
+- [ ] `.env` not tracked by Git (TG-SEC-003)
+- [ ] Logs redact auth material (TG-SEC-004)
+- [ ] `.env.example` exists with safe placeholders
+
+## Framework notes
+
+- **Vite/CRA/Next public vars** — treat as published in the client bundle
+- **Supabase** — anon key in browser OK; service-role server-only
+- **Firebase** — client config public; Admin SDK credentials server-only
+- **CI/CD** — use platform secret stores, not plaintext in workflow files
+
+## Manual review
+
+- Verify secret rotation after any exposure
+- Review CI logs for accidental secret echo
+- Confirm production secrets differ from development
+
+## Related rules
+
+TG-DB-002, TG-DB-003, TG-CLIENT-002

package/skills/torusguard/references/sqlalchemy-security.md

@@ -0,0 +1,16 @@
+# TorusGuard Skill Reference: SQLAlchemy Security
+
+> **Loaded When:** Project uses `sqlalchemy` dependencies or imports.
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. SQL Injection in Raw Query Clauses
+* `TG-INPUT-003`: Search for `text(f"...")`, `text("..." + ...)`, or `.format()` inside `text()` constructs. Ensure parameter mapping `text("... WHERE col = :val")` is used.
+
+### 2. Tenant Scoping & Object Ownership
+* `TG-AUTH-007`: Verify queries on tenant-isolated tables include tenant/user ID predicates in `.filter()` or `.filter_by()`.
+
+### 3. Mass Assignment via Bulk Updates
+* `TG-AUTH-006`: Inspect `.update(dict)` calls to ensure input dictionaries are filtered against permitted field allowlists.

package/skills/torusguard/references/ssrf-and-outbound-requests.md

@@ -0,0 +1,46 @@
+# SSRF and Outbound Requests
+
+## When the reference applies
+Applies to any endpoint that fetches a URL.
+
+## User-controlled URL detection
+Always check if the URL is user-controlled.
+
+## URL scheme validation
+Only allow expected schemes.
+
+## Hostname and IP validation
+Validate hostnames carefully.
+
+## Private-network blocking
+Block internal IP addresses.
+
+## Cloud metadata protection
+Block 169.254.169.254 and similar.
+
+## Redirect handling
+Disable redirects or validate them.
+
+## DNS rebinding considerations
+Check DNS at resolution time.
+
+## Timeout and response-size limits
+Enforce timeouts and max response sizes.
+
+## Network isolation
+Run fetches from isolated networks if possible.
+
+## Safe logging
+Avoid logging raw URLs with credentials.
+
+## Manual-review checklist
+- [ ] Is the outbound URL user-controlled?
+- [ ] Is HTTPS required?
+- [ ] Is the hostname allowlisted?
+- [ ] Are loopback and private IPs blocked?
+- [ ] Are cloud metadata endpoints blocked?
+- [ ] Are redirects disabled or revalidated?
+- [ ] Is DNS resolution checked safely?
+- [ ] Is there a timeout?
+- [ ] Is response size limited?
+- [ ] Is the server isolated from sensitive networks?

package/skills/torusguard/references/webhook-security.md

@@ -0,0 +1,15 @@
+# Webhook Security
+
+- Signature verification over the raw request body.
+- Timestamp tolerance.
+- Replay protection.
+- Event-type allowlisting.
+- Payload schema validation.
+- Idempotency keys or event IDs.
+- Safe retry behavior.
+- Rate and size limits.
+- Generic response errors.
+- No trust in event fields before signature verification.
+
+## Workflow
+Receive raw body → Verify signature → Verify timestamp → Check event ID/idempotency → Validate event schema → Authorize event source/tenant → Process within transaction → Return safe response

package/skills/torusguard/references/websocket-security.md

@@ -0,0 +1,12 @@
+# WebSocket Security
+
+- Authentication during handshake.
+- Re-authentication or token expiry.
+- Origin validation.
+- Per-room and per-channel authorization.
+- Message schema validation.
+- Message-size limits.
+- Connection and subscription limits.
+- Tenant isolation.
+- Disconnect behavior.
+- Logging and abuse detection.

package/skills/torusguard-apply/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: torusguard-apply
+description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation.
+version: 0.9.2
+workflow: .torusguard/workflows/apply.md
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/diff_guard.py
+---
+
+# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
+
+## Objective
+Safely apply approved remediation bundles to disk source files, capturing a byte-for-byte pre-apply backup snapshot and asserting syntax validity post-patch.
+
+---
+
+## Execution Steps
+
+1. **Load Bundle:** Read `patch.diff` and metadata from `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
+2. **Pre-Apply Snapshot:** Save exact backup to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
+3. **Obtain Human Gate:** Confirm user approval for proposed diff.
+4. **Apply Patch:** Execute surgical modification using `replace_file_content` or `patch`.
+5. **Assert Integrity:** Verify modified file compiles cleanly without syntax errors.
+6. **Record Ledger:** Log timestamp, file path, and post-patch SHA-256 in `apply-log.json`.
+
+---
+
+## Governance & Safety Rules
+- Hard limit: additions $\le 35$, deletions $\le 25$ lines.
+- Always create a rollback snapshot before modifying disk code.
+- If compile or syntax error occurs, instantly restore from `.bak`.
+- Require explicit operator confirmation before writing changes.
+
+---
+
+## Output Format
+```markdown
+🚀 [TorusGuard] Patch Applied Successfully
+- Finding Target: <Finding ID> | File: <Path>
+- Churn: +<Additions> / -<Deletions>
+- Rollback Backup: `.torusguard/runs/<run_id>/pre_apply/<file>.bak`
+- Compile Check: PASSED
+Next: Run `/torusguard recheck` to verify vulnerability is closed.
+```

package/skills/torusguard-audit/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: torusguard-audit
+description: Static security AST scanning, stable fingerprinting, root-cause clustering, and 0–100 confidence scoring.
+version: 0.9.2
+workflow: .torusguard/workflows/audit.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/finding_scorer.py
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Audit — Static Code Analysis & Finding Clustering
+
+## Objective
+Execute static analysis across ASTs, generate line-shift invariant fingerprints, group findings into root causes, compute 0–100 confidence scores, and persist findings to `.torusguard/runs/`.
+
+---
+
+## Execution Steps
+
+1. **Setup Run Directory:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
+2. **Load Active Rules:** Load rules from `.torusguard/rules/active/` and thresholds from `torusguard.json`.
+3. **AST Scan Sinks:** Match files against active rules:
+   - `TG-SEC-*`: Leaked API keys, secrets.
+   - `TG-INPUT-*`: Unescaped SQL or unvalidated payloads.
+   - `TG-DB-*`: Unscoped queries omitting tenant filters (`Model.get(id=id)`).
+   - `TG-AUTH-*`: Missing `HttpOnly`/`Secure` flags; open CORS.
+   - `TG-CLIENT-*`: Admin credentials in client bundles.
+4. **Stable Fingerprinting:** Compute SHA-256 hash of normalized 3 surrounding AST lines.
+5. **Root-Cause Clustering:** Group findings by root cause (`cluster-tenant-isolation`, `cluster-raw-sql-sink`).
+6. **Confidence Scoring:** Calculate 0–100 score across 5-factor rubric via `finding_scorer.py`.
+7. **Write Run Artifacts:** Persist `findings.md`, `findings.json`, and `summary.md`.
+
+---
+
+## Confidence Scoring Rubric
+- **1. Evidence (35):** AST flow (35), regex match (20), indirect (10).
+- **2. Reproduction (25):** Deterministic test (25), simulated (15), hypothesis (0).
+- **3. Corroboration (15):** >=3 files (15), 2 files (10), single (5).
+- **4. Environment (15):** Explicit route (15), minor ambiguity (8), unknown (0).
+- **5. Review Status (10):** Human verified (10), agent consensus (5), auto (0).
+- **Bands:** 90–100 (`Confirmed`), 70–89 (`High`), 50–69 (`Medium`), <50 (`Review`).
+
+---
+
+## Finding Card Format
+```markdown
+### [TG-DB-004] Missing Tenant Scoping in /invoices/
+- **Severity**: High | **Confidence**: 90/100 (Confirmed)
+- **File**: `views.py:42` | **Cluster**: `cluster-tenant-isolation`
+- **Evidence**: Unscoped query leaks records.
+- **Remediation**: Scope by `tenant=request.user.tenant`.
+```
+
+---
+
+## Safety Constraints
+- Read-only execution; zero code modifications.
+- Exclude build folders (`node_modules/`, `.venv/`, `dist/`).
+- Redact secrets before saving to `findings.md`.
+
+---
+
+## Output Format
+```markdown
+🛡️ [TorusGuard] Static Code Audit Completed
+- Run ID: run-YYYYMMDD-HHMMSS-audit | Files: <Count> | Findings: <Count>
+- Clusters: <Count> identified | Posture: ACTION REQUIRED
+Next: Run `/torusguard harden` to formulate surgical fixes.
+```

package/skills/torusguard-authorize/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: torusguard-authorize
+description: Register and validate runtime target authorization boundaries — scope boundaries, ownership proofs, TTL expiration, and Safety Gate enforcement.
+version: 0.9.2
+workflow: .torusguard/workflows/authorize.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/safety_gate.py
+---
+
+# TorusGuard Authorize — Legal Scope & Safety Gate Registration
+
+## Objective
+Define and validate legal runtime authorization boundaries, verify target ownership, enforce maximum rate limits, and persist a cryptographically auditable `.torusguard/config/scope.json`.
+
+---
+
+## Execution Steps
+
+1. **Capture Scope Parameters:** Collect target host URL, allowed path prefixes, forbidden prefixes, and session TTL.
+2. **Validate Environment:** Assert target is local (`localhost`, `127.0.0.1`) or staging (`*.staging.*`). Block production targets without explicit override.
+3. **Verify Host Ownership:** Confirm ownership token or local process socket binding.
+4. **Invoke Safety Gate:**
+   ```bash
+   python .torusguard/scripts/safety_gate.py check --url <target_url>
+   ```
+5. **Write Scope Record:** Persist authorized targets, rate limits, and expiration timestamp into `.torusguard/config/scope.json`.
+6. **Validate Schema:** Confirm `scope.json` adheres to `auth-boundary.schema.json`.
+
+---
+
+## Safety Constraints
+- Never authorize wildcard hosts (`*`) or third-party domains.
+- State-changing destructive actions (`DELETE`, bulk drops) are disabled by default.
+- Set strict TTL (default 4 hours, maximum 24 hours).
+
+---
+
+## Output Format
+```markdown
+🔒 [TorusGuard] Target Scope Authorized
+- Target Host: <Host URL> | Environment: <Local / Staging>
+- Allowed Paths: <Prefixes> | Rate Limit: <Max Req/sec>
+- Expiration TTL: <Timestamp>
+- Scope File: `.torusguard/config/scope.json`
+Next: Run `/torusguard web-validate` to begin safe runtime probing.
+```

package/skills/torusguard-exploit-check/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: torusguard-exploit-check
+description: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.
+version: 0.9.2
+workflow: .torusguard/workflows/exploit-check.md
+tools: Read, Grep, Glob, Bash, Write
+scripts-binding:
+  - .torusguard/scripts/safety_gate.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Exploit Check — Bounded Exploitability Confirmation
+
+## Objective
+Confirm whether candidate findings are practically exploitable using safe, single-step sentinel canaries without data loss or weaponized execution.
+
+---
+
+## Authorization Gate Check
+Before dispatching any exploitability probe:
+1. Verify target route is explicitly authorized in `.torusguard/config/scope.json`.
+2. Verify authorization TTL has not expired.
+3. Assert probe passes `.torusguard/scripts/safety_gate.py`.
+
+---
+
+## Bounded Probe Strategies
+- **SQLi:** Mathematical identity canary (`' OR 1=1--`) asserting differential response without altering data.
+- **XSS:** Inert HTML marker tag (`<tg-canary-tag>`) checking unescaped reflection in DOM.
+- **IDOR:** Cross-tenant GET using secondary tenant session; assert 403 vs leak.
+- **Auth:** Omit auth header on protected route; assert 401.
+
+---
+
+## Execution Steps
+
+1. **Verify Scope:** Read `scope.json`; assert authorized endpoint.
+2. **Select Canary:** Choose matching non-destructive probe strategy.
+3. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
+4. **Classify Status:** Transition finding into one of 5 canonical outcomes:
+   - `Confirmed`: Canary reflected or secondary tenant data leaked.
+   - `Not Reproducible`: Endpoint responded with 401/403 or sanitized input.
+   - `Needs Review`: Ambiguous status code or incomplete response.
+   - `Blocked by Controls`: WAF or rate limiter stopped probe.
+   - `Out of Scope`: Target endpoint is not authorized.
+5. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
+
+---
+
+## Safety Constraints
+- Zero destructive payloads (`DROP`, `DELETE`, `UPDATE`).
+- No denial-of-service or continuous fuzzing loops.
+- Redact tokens before recording traces.
+
+---
+
+## Output Format
+```markdown
+🎯 [TorusGuard] Exploitability Confirmation
+- Finding ID: <Finding ID> | Target: <Route>
+- Status: <Confirmed / Not Reproducible / Blocked>
+- Evidence: <Response snippet or status code>
+Next: Run `/torusguard harden` to formulate surgical remediation bundle.
+```

package/skills/torusguard-full/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: torusguard-full
+description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
+version: 0.9.2
+workflow: .torusguard/workflows/audit.md
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .torusguard/scripts/stack_detect.py
+  - .torusguard/scripts/safety_gate.py
+  - .torusguard/scripts/finding_scorer.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/sarif_exporter.py
+---
+
+# TorusGuard Full — Master 7-Stage Pipeline Orchestrator
+
+## Objective
+Execute the full, closed-loop TorusGuard security lifecycle from stack discovery through static scanning, runtime validation, Ponytail remediation, differential re-check, and SARIF export under strict governance.
+
+---
+
+## 7-Stage Security Pipeline
+0. Init (Baseline) ──► 1. Authorize (Scope) ──► 2. Audit (AST Scan) ──► 3. Validate (Evidence/Exploit) ──► 4. Harden (Ponytail Patch) ──► 5. Apply (Backup & Edit) ──► 6. Recheck (Regression) ──► 7. Report (SARIF)
+
+---
+
+## Specialist Skill Routing
+- **Phase 0:** `torusguard-init` (`profiler`)
+- **Phase 1:** `torusguard-authorize` (`reviewer`)
+- **Phase 2:** `torusguard-audit` (`auditor`)
+- **Phase 3:** `torusguard-verify` / `torusguard-exploit-check` (`validator`)
+- **Phase 4:** `torusguard-harden` (`remediator`)
+- **Phase 5:** `torusguard-apply` (`remediator`)
+- **Phase 6:** `torusguard-recheck` (`reviewer`)
+- **Phase 7:** `torusguard-report` (`reviewer`)
+
+---
+
+## Pipeline Execution Instructions
+1. **Init:** Detect stack via `stack_detect.py` and activate rules in `.torusguard/rules/active/`.
+2. **Authorize:** Verify target ownership and TTL in `.torusguard/config/scope.json`.
+3. **Audit:** Scan ASTs; assign fingerprints; cluster root causes; compute confidence scores.
+4. **Validate:** Audit evidence sufficiency; optionally send bounded probe canary.
+5. **Harden:** Formulate surgical diffs bound by Ponytail limits ($\le 35$ add, $\le 25$ del).
+6. **Apply:** Save `.bak` snapshot in `pre_apply/`; obtain Human Gate; apply patch.
+7. **Recheck:** Re-scan modified files; assert findings are `Fixed` with zero regressions.
+8. **Report:** Export OASIS SARIF v2.1.0 and emit signed markdown summary.
+
+---
+
+## Confidence Scoring Rubric
+Evaluates Evidence (35 pts), Reproduction (25 pts), Corroboration (15 pts), Environment (15 pts), and Review Status (10 pts) into 4 bands: Confirmed (90–100), High (70–89), Medium (50–69), Needs Review (<50).
+
+---
+
+## Safety & Governance
+- Human Gate mandatory before code modifications in Phase 5.
+- Enforce Ponytail line bounds ($\le 35$ additions, $\le 25$ deletions).
+- Never dispatch network probes outside authorized scope in `scope.json`.
+
+---
+
+## Output Format
+```markdown
+🏆 [TorusGuard] 7-Stage Security Pipeline Complete
+- Run ID: run-YYYYMMDD-HHMMSS | Status: SECURE / AUDITED
+- Findings: <Total> (<Fixed> Fixed · <Open> Remaining)
+- SARIF Log: `.torusguard/runs/<run_id>/results.sarif`
+- Report: `.torusguard/runs/<run_id>/report.md`
+```

package/skills/torusguard-harden/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: torusguard-harden
+description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions).
+version: 0.9.2
+workflow: .torusguard/workflows/harden.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/diff_guard.py
+---
+
+# TorusGuard Harden — Governed Remediation & Bundle Packaging
+
+## Objective
+Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs into auditable 4-artifact remediation bundles ready for review.
+
+---
+
+## The Ponytail Protocol
+- **Limits:** Additions $\le 35$, Deletions $\le 25$ lines per bundle.
+- **Invariants:** Zero full-file rewrites; preserve public APIs and tests.
+- **Overflow:** Partition into sequential sub-bundles.
+
+---
+
+## Bundle Directory Structure
+```
+.torusguard/runs/<run_id>/remediation/<finding_id>/
+├── patch.diff       # Standard unified diff with line numbers
+├── plan.md          # Rationale and root-cause breakdown
+├── verification.md  # Test instructions proving fix works
+└── rollback.md      # Command or steps to revert patch
+```
+
+---
+
+## Execution Steps
+
+1. **Select Finding:** Choose prioritized verified flaw from active run's `findings.md`.
+2. **Read AST Context:** View target file surrounding lines (±15) using `view_file`.
+3. **Formulate Minimal Fix:** Parameterize SQL, add tenant filters, insert validation schemas.
+4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$.
+5. **Package Bundle:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`).
+6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
+
+---
+
+## Safety Constraints
+- Dry-run only; do NOT apply modifications to source code during harden.
+- Keep surrounding formatting and comments intact.
+- Never touch files outside the targeted vulnerable sink.
+
+---
+
+## Output Format
+```markdown
+🛠️ [TorusGuard] Remediation Bundle Packaged
+- Finding Target: <Finding ID> | File: <Path>
+- Line Churn: +<Additions> / -<Deletions> (Ponytail: PASS)
+- Sensitive Path: <Yes/No>
+- Bundle Path: `.torusguard/runs/<run_id>/remediation/<finding_id>/`
+Next: Run `/torusguard apply` to review diff and apply with rollback backup.
+```