torusguard 0.9.2

package/.torusguard/skills/torusguard-full/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: torusguard-full
+description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
+version: 0.9.2
+workflow: .torusguard/workflows/audit.md
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .torusguard/scripts/stack_detect.py
+  - .torusguard/scripts/safety_gate.py
+  - .torusguard/scripts/finding_scorer.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/sarif_exporter.py
+---
+
+# TorusGuard Full — Master 7-Stage Pipeline Orchestrator
+
+## Objective
+Execute the full, closed-loop TorusGuard security lifecycle from stack discovery through static scanning, runtime validation, Ponytail remediation, differential re-check, and SARIF export under strict governance.
+
+---
+
+## 7-Stage Security Pipeline
+0. Init (Baseline) ──► 1. Authorize (Scope) ──► 2. Audit (AST Scan) ──► 3. Validate (Evidence/Exploit) ──► 4. Harden (Ponytail Patch) ──► 5. Apply (Backup & Edit) ──► 6. Recheck (Regression) ──► 7. Report (SARIF)
+
+---
+
+## Specialist Skill Routing
+- **Phase 0:** `torusguard-init` (`profiler`)
+- **Phase 1:** `torusguard-authorize` (`reviewer`)
+- **Phase 2:** `torusguard-audit` (`auditor`)
+- **Phase 3:** `torusguard-verify` / `torusguard-exploit-check` (`validator`)
+- **Phase 4:** `torusguard-harden` (`remediator`)
+- **Phase 5:** `torusguard-apply` (`remediator`)
+- **Phase 6:** `torusguard-recheck` (`reviewer`)
+- **Phase 7:** `torusguard-report` (`reviewer`)
+
+---
+
+## Pipeline Execution Instructions
+1. **Init:** Detect stack via `stack_detect.py` and activate rules in `.torusguard/rules/active/`.
+2. **Authorize:** Verify target ownership and TTL in `.torusguard/config/scope.json`.
+3. **Audit:** Scan ASTs; assign fingerprints; cluster root causes; compute confidence scores.
+4. **Validate:** Audit evidence sufficiency; optionally send bounded probe canary.
+5. **Harden:** Formulate surgical diffs bound by Ponytail limits ($\le 35$ add, $\le 25$ del).
+6. **Apply:** Save `.bak` snapshot in `pre_apply/`; obtain Human Gate; apply patch.
+7. **Recheck:** Re-scan modified files; assert findings are `Fixed` with zero regressions.
+8. **Report:** Export OASIS SARIF v2.1.0 and emit signed markdown summary.
+
+---
+
+## Confidence Scoring Rubric
+Evaluates Evidence (35 pts), Reproduction (25 pts), Corroboration (15 pts), Environment (15 pts), and Review Status (10 pts) into 4 bands: Confirmed (90–100), High (70–89), Medium (50–69), Needs Review (<50).
+
+---
+
+## Safety & Governance
+- Human Gate mandatory before code modifications in Phase 5.
+- Enforce Ponytail line bounds ($\le 35$ additions, $\le 25$ deletions).
+- Never dispatch network probes outside authorized scope in `scope.json`.
+
+---
+
+## Output Format
+```markdown
+🏆 [TorusGuard] 7-Stage Security Pipeline Complete
+- Run ID: run-YYYYMMDD-HHMMSS | Status: SECURE / AUDITED
+- Findings: <Total> (<Fixed> Fixed · <Open> Remaining)
+- SARIF Log: `.torusguard/runs/<run_id>/results.sarif`
+- Report: `.torusguard/runs/<run_id>/report.md`
+```

package/.torusguard/skills/torusguard-harden/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: torusguard-harden
+description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions).
+version: 0.9.2
+workflow: .torusguard/workflows/harden.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/diff_guard.py
+---
+
+# TorusGuard Harden — Governed Remediation & Bundle Packaging
+
+## Objective
+Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs into auditable 4-artifact remediation bundles ready for review.
+
+---
+
+## The Ponytail Protocol
+- **Limits:** Additions $\le 35$, Deletions $\le 25$ lines per bundle.
+- **Invariants:** Zero full-file rewrites; preserve public APIs and tests.
+- **Overflow:** Partition into sequential sub-bundles.
+
+---
+
+## Bundle Directory Structure
+```
+.torusguard/runs/<run_id>/remediation/<finding_id>/
+├── patch.diff       # Standard unified diff with line numbers
+├── plan.md          # Rationale and root-cause breakdown
+├── verification.md  # Test instructions proving fix works
+└── rollback.md      # Command or steps to revert patch
+```
+
+---
+
+## Execution Steps
+
+1. **Select Finding:** Choose prioritized verified flaw from active run's `findings.md`.
+2. **Read AST Context:** View target file surrounding lines (±15) using `view_file`.
+3. **Formulate Minimal Fix:** Parameterize SQL, add tenant filters, insert validation schemas.
+4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$.
+5. **Package Bundle:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`).
+6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
+
+---
+
+## Safety Constraints
+- Dry-run only; do NOT apply modifications to source code during harden.
+- Keep surrounding formatting and comments intact.
+- Never touch files outside the targeted vulnerable sink.
+
+---
+
+## Output Format
+```markdown
+🛠️ [TorusGuard] Remediation Bundle Packaged
+- Finding Target: <Finding ID> | File: <Path>
+- Line Churn: +<Additions> / -<Deletions> (Ponytail: PASS)
+- Sensitive Path: <Yes/No>
+- Bundle Path: `.torusguard/runs/<run_id>/remediation/<finding_id>/`
+Next: Run `/torusguard apply` to review diff and apply with rollback backup.
+```

package/.torusguard/skills/torusguard-init/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: torusguard-init
+description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline.
+version: 0.9.2
+workflow: .torusguard/workflows/init.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/stack_detect.py
+---
+
+# TorusGuard Init — Project Stack Discovery & Rule Activation
+
+## Objective
+Auto-detect repository technology stack via indicators or `stack_detect.py`, activate framework-tailored `TG-*` security rules into `.torusguard/rules/active/`, and provision `torusguard.json` and `SECURITY.md`.
+
+---
+
+## Pre-Flight Check
+1. Verify `.torusguard/` layout (`config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`).
+2. If missing, unpack via `python skills/torusguard/bootstrap.py --target .`.
+3. Check existing `.torusguard/config/torusguard.json` before overwriting.
+
+---
+
+## Execution Steps
+
+1. **Stack Detection:** Run `python .torusguard/scripts/stack_detect.py .` to detect:
+   - Python: Django (`manage.py`), FastAPI (`fastapi`), Flask (`flask`), SQLAlchemy.
+   - Node: Next.js (`"next"`), Express (`"express"`), React/Vite (`"vite"`).
+   - BaaS: Supabase (`@supabase/supabase-js`), Firebase (`firebase-admin`).
+2. **Emit Stack Record:** Log detected language, framework, ORM, and client SDKs.
+3. **Activate Tailored Rules:** Copy matching `TG-*` rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
+4. **Provision Policy:** Create `SECURITY.md` if absent, configuring responsible disclosure contacts.
+5. **Write Configuration:** Persist detected stack and active rules count to `.torusguard/config/torusguard.json`.
+
+---
+
+## Safety Constraints
+- Never overwrite custom rules in `.torusguard/rules/active/` without prompt.
+- Retain existing `SECURITY.md` if already established by repository owners.
+- Strictly read-only detection against source files.
+
+---
+
+## Output Format
+```markdown
+🛡️ [TorusGuard] Workspace Initialized
+- Primary Stack: <Detected Stack> | Components: <Backend/Frontend/DB>
+- Active Rules: <Count> rules enabled in `.torusguard/rules/active/`
+- Configuration: `.torusguard/config/torusguard.json` written
+Next: Run `/torusguard audit` to execute static security scan.
+```

package/.torusguard/skills/torusguard-recheck/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: torusguard-recheck
+description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
+version: 0.9.2
+workflow: .torusguard/workflows/recheck.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Recheck — Targeted Differential Audit & Regression Verification
+
+## Objective
+Re-scan only files modified by remediation patches, confirming that targeted vulnerability sinks have been neutralized and verifying that no new security regressions were introduced.
+
+---
+
+## Execution Steps
+
+1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
+2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against the modified files.
+3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
+4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
+5. **Update State:** Record verified status in `findings.json`.
+6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
+
+---
+
+## State Transition Rules
+- **`Fixed`:** Targeted vulnerable AST pattern is absent and no new issues appear on modified lines.
+- **`Partially Fixed`:** Vulnerability surface was reduced but sanitization remains incomplete.
+- **`Not Fixed`:** Vulnerable AST sink remains present in patched file.
+- **`Regression`:** Patch introduced a new security rule violation on modified lines.
+
+---
+
+## Safety Constraints
+- Restrict AST scan strictly to modified files and direct callers.
+- If regression is detected, halt and recommend immediate rollback via `.bak` snapshot.
+- Read-only differential analysis.
+
+---
+
+## Output Format
+```markdown
+✅ [TorusGuard] Differential Recheck Completed
+- Modified Files Scanned: <Count>
+- Target Finding: <Finding ID> ──► FIXED
+- Regressions Detected: 0
+- Report: `.torusguard/runs/<run_id>/recheck-report.md`
+Next: Run `/torusguard report` to export final SARIF and release summary.
+```

package/.torusguard/skills/torusguard-report/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: torusguard-report
+description: Generate unified security posture reports and export OASIS SARIF v2.1.0 logs for CI/CD integration.
+version: 0.9.2
+workflow: .torusguard/workflows/report.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/sarif_exporter.py
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Report — Unified Security Posture Report & SARIF Export
+
+## Objective
+Aggregate findings, verification traces, and recheck results into a signed executive security summary and export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines.
+
+---
+
+## Execution Steps
+
+1. **Aggregate Run Data:** Read findings, verified evidence, and recheck records from active run.
+2. **Export OASIS SARIF v2.1.0:**
+   ```bash
+   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
+   ```
+3. **Compile Executive Markdown Report:** Generate `report.md` with posture score, open/closed finding tables, and risk breakdown.
+4. **Update Run Manifest:** Finalize `manifest.json` status counts.
+5. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
+
+---
+
+## SARIF v2.1.0 Output Specification
+- **Version:** `$schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`, `version: 2.1.0`.
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 0.9.2`, full rules catalog in `driver.rules`.
+- **Category Hygiene:** Set `automationDetails.id: "torusguard/static"` to avoid collisions in multi-analysis CI.
+- **Fingerprinting:** Populate `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
+
+---
+
+## Safety Constraints
+- Redact all tokens, passwords, and API keys before saving report.
+- Strictly read-only reporting; no source code modifications.
+- Ensure SARIF passes JSON schema validation.
+
+---
+
+## Output Format
+```markdown
+📊 [TorusGuard] Security Posture Report Emitted
+- Run ID: <Run ID> | Posture Score: <Score>/100
+- Findings: <Total> (<Fixed> Fixed · <Open> Open)
+- SARIF Export: `.torusguard/runs/<run_id>/results.sarif`
+- Executive Report: `.torusguard/runs/<run_id>/report.md`
+```

package/.torusguard/skills/torusguard-status/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: torusguard-status
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
+version: 0.9.2
+workflow: .torusguard/workflows/status.md
+tools: Read, Grep, Glob
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
+
+## Objective
+Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
+
+---
+
+## Execution Steps
+
+1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
+2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
+3. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
+4. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
+5. **Render Diagnostic Overview:** Output formatted status card.
+
+---
+
+## Safety Constraints
+- Read-only execution; zero file modifications.
+- Handle uninitialized workspaces gracefully with advice to run `/torusguard init`.
+
+---
+
+## Output Format
+```markdown
+🛡️ [TorusGuard] Workspace Status Overview
+- Version: v0.9.2 | Stack: <Detected Framework>
+- Active Rules: <Count> rules active in `.torusguard/rules/active/`
+- Historical Runs: <Count> runs recorded
+- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
+- Posture: <SECURE / ACTION REQUIRED>
+```

package/.torusguard/skills/torusguard-verify/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: torusguard-verify
+description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
+version: 0.9.2
+workflow: .torusguard/workflows/verify.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Verify — Finding Evidence Verification & Calibration
+
+## Objective
+Audit the evidence sufficiency of candidate findings by reading current disk lines, evaluating unbroken taint source-to-sink flow, filtering false alarms, and calibrating final 0–100 confidence scores.
+
+---
+
+## Execution Steps
+
+1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.
+2. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
+3. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
+4. **Calibrate Confidence Score:**
+   ```bash
+   python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
+   ```
+5. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
+6. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
+
+---
+
+## Evidence Sufficiency
+A finding is verified as sufficient when:
+- **Direct AST Match:** The vulnerable API or sink call exists on disk at the cited location.
+- **Exposed Surface:** The sink is reachable from an external route, view, or public method.
+- **Absence of Sanitizer:** No escaping function, parameterization, or validating middleware neutralizes the input.
+- **Taint Integrity:** Untrusted request data flows into the sink without structural validation.
+
+---
+
+## Safety Constraints
+- Read-only analysis; no files are modified.
+- Never guess line numbers; always verify via active disk read.
+- Downgrade findings with sanitizer presence to `False Positive`.
+
+---
+
+## Output Format
+```markdown
+🧪 [TorusGuard] Finding Verification Complete
+- Findings Audited: <Count> | Confirmed Real: <Count>
+- False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
+- Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`
+Next: Run `/torusguard harden` to formulate surgical fixes for confirmed flaws.
+```

package/.torusguard/skills/torusguard-web-validate/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: torusguard-web-validate
+description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
+version: 0.9.2
+workflow: .torusguard/workflows/web-validate.md
+tools: Read, Grep, Glob, Bash, Write
+scripts-binding:
+  - .torusguard/scripts/safety_gate.py
+---
+
+# TorusGuard Web Validate — Bounded HTTP Probing & Session Capture
+
+## Objective
+Safely probe live web applications within authorized scope, injecting transparent audit headers, verifying security headers and cookies, redacting sensitive tokens, and recording deterministic replay traces.
+
+---
+
+## Authorization Gate Check
+Before dispatching any HTTP request:
+1. Verify `.torusguard/config/scope.json` exists and contains target URL.
+2. Confirm current timestamp is prior to `expires_at` TTL.
+3. Assert target is local or non-production staging.
+
+---
+
+## Safety Gate
+All requests pass through `.torusguard/scripts/safety_gate.py`:
+- `Auto-Allowed`: Read-only `GET`, `HEAD`, `OPTIONS` on non-sensitive paths.
+- `Approval Required`: Requests touching auth, sessions, or parameters.
+- `Manual Only`: Any destructive method (`DELETE`, `DROP`) is strictly blocked.
+
+---
+
+## Execution Steps
+
+1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
+2. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
+3. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
+4. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
+5. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+6. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
+
+---
+
+## Credential Redaction
+All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk serialization (`Bearer [REDACTED]`).
+
+---
+
+## Safety Constraints
+- Max 50 requests per validation session.
+- Never test unauthorized domains or third-party APIs.
+- Zero state-changing destructive operations.
+
+---
+
+## Output Format
+```markdown
+🌐 [TorusGuard] Web Validation Completed
+- Target: <Host URL> | Endpoints Tested: <Count>
+- Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
+- Replay Trace: `.torusguard/runs/<run_id>/requests.json`
+Next: Run `/torusguard exploit-check` to confirm exploitability of candidate flaws.
+```

package/.torusguard/templates/audit-report.template.md

@@ -0,0 +1,54 @@
+# TorusGuard Security Audit & Runtime Verification Report
+
+> **TorusGuard Version:** `{{torusguard_version}}`  
+> **Target:** `{{target_name}}`  
+> **Run ID:** `{{run_id}}`  
+> **Timestamp:** `{{timestamp}}`  
+
+---
+
+## Detected Stack
+- **Language:** {{stack_language}}
+- **Framework:** {{stack_framework}}
+- **Data Layer:** {{stack_data_layer}}
+- **Dependency Files:** {{stack_dependency_files}}
+- **Detection Confidence:** {{stack_confidence}}
+
+---
+
+## Executive Posture
+**Posture:** {{posture_indicator}}  
+**Average Confidence Score:** `{{avg_confidence_score}}/100`
+
+### Finding Summary
+| Severity | Count | Confirmed | Needs Review | Remediated |
+| :--- | :---: | :---: | :---: | :---: |
+| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
+| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
+| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
+| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
+
+---
+
+## Root-Cause Clusters
+{{cluster_summary_table}}
+
+---
+
+## Detailed Findings
+{{finding_cards_section}}
+
+---
+
+## Governance & Safety Audit Statement
+This execution complied with TorusGuard v0.8.0 governance rules:
+- **Authorization Gate:** {{authorization_status}}
+- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
+- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
+
+---
+
+## Prioritized Next Steps
+1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
+2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
+3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.

package/.torusguard/templates/authorization.template.md

@@ -0,0 +1,34 @@
+# TorusGuard Target Authorization Record
+
+**Authorization ID:** `{{authorization_id}}`  
+**Generated At:** `{{timestamp}}`  
+**Valid Until:** `{{valid_until}}`  
+
+---
+
+## 1. Target Identification
+- **Project / Application:** `{{target_name}}`
+- **Target URL / Hosts:** `{{target_hosts}}`
+- **Scope Type:** `{{scope_type}}`
+
+---
+
+## 2. Permitted Boundaries
+- **Allowed Path Prefixes:**
+{{allowed_path_prefixes_list}}
+
+- **Explicitly Forbidden / Excluded Paths:**
+{{forbidden_paths_list}}
+
+- **Max Navigation Depth:** `{{max_depth}}`
+- **Max Request Budget:** `{{max_requests}}`
+- **Allow State-Changing Methods:** `{{allow_state_changing_methods}}`
+
+---
+
+## 3. Owner Confirmation & Legal Statement
+> [!IMPORTANT]
+> The target application owner has confirmed that this testing environment is authorized for non-destructive, bounded runtime security validation.
+
+- **Authorized By:** `{{authorized_by}}`
+- **Confirmation Status:** `Owner Confirmed`

package/.torusguard/templates/finding-card.template.md

@@ -0,0 +1,32 @@
+### [{{rule_id}}] {{finding_title}}
+
+**Severity:** `{{severity_badge}}` | **Auditable Confidence:** `{{confidence_score}}/100 {{confidence_band_badge}}`  
+**Finding ID:** `{{finding_id}}` | **Fingerprint:** `{{fingerprint_hash}}`  
+**Target Location:** `{{file_path}}:{{line_number}}` (`{{code_symbol}}`)  
+**Lifecycle Status:** `{{lifecycle_status}}` | **Exploitability:** `{{exploitability_status}}`  
+
+---
+
+#### 1. Provenance Chain
+- **Detection Rule:** `{{rule_id}}` (CWE-{{cwe_id}})
+- **Triggering Input:** `{{triggering_source}}`
+- **Sink Path:** `{{sink_expression}}`
+
+#### 2. Raw Verified Evidence
+```{{code_language}}
+{{raw_evidence_snippet}}
+```
+> **Evidence Checksum (SHA-256):** `{{evidence_sha256}}`
+
+#### 3. Objective Facts vs AI Interpretation
+- **Verified Facts:** {{raw_facts_summary}}
+- **AI Risk Analysis:** {{ai_interpretation}}
+
+#### 4. Remediation Diff (Minimal Churn)
+```diff
+{{remediation_diff_preview}}
+```
+
+#### 5. Retest & Verification
+- **Verification Method:** {{verification_method}}
+- **Current Retest Status:** `{{retest_status}}`

package/.torusguard/templates/remediation-bundle.template.md

@@ -0,0 +1,35 @@
+# Remediation Bundle: `{{bundle_id}}`
+
+**Cluster ID:** `{{cluster_id}}`  
+**Target Rule:** `{{rule_id}}` (`{{rule_title}}`)  
+**Affected Files:** `{{affected_files}}`  
+
+---
+
+## 1. Problem Statement & Risk
+{{problem_statement}}
+
+**Adversarial Abuse & Practical Impact:**  
+{{risk_explanation}}
+
+---
+
+## 2. Governed Minimal Patch Plan
+- **Max Additions Boundary:** $\le 35$ lines (Proposed: `+{{additions_count}}`)
+- **Max Deletions Boundary:** $\le 25$ lines (Proposed: `-{{deletions_count}}`)
+- **Governance Review Level:** `{{governance_review_level}}`
+
+### Framework-Native Diff
+```diff
+{{candidate_patch_diff}}
+```
+
+---
+
+## 3. Verification & Retest Method
+{{verification_method}}
+
+---
+
+## 4. Residual Risk & Edge Cases
+{{residual_risk_notes}}