torusguard 0.9.4 → 1.0.0

package/skills/torusguard/bootstrap.py

@@ -10,7 +10,6 @@ import sys
 import shutil
 import json
 import argparse
-import subprocess
 from pathlib import Path
 
 # Ensure UTF-8 stdout/stderr on Windows consoles
@@ -25,6 +24,19 @@ if sys.stderr and hasattr(sys.stderr, "reconfigure"):
     except Exception:
         pass
 
+# ─── ANSI Color Helpers ───────────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+BG_GREEN = "\033[42m"
+BG_CYAN = "\033[46m"
+
 
 def find_project_root(start_dir=None):
     """Detect project root directory by searching for standard repo root markers."""
@@ -45,6 +57,114 @@ def find_project_root(start_dir=None):
     return current
 
 
+def print_header():
+    """Print the branded TorusGuard header card."""
+    print(f"""
+  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
+  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v0.9.5{RESET}   {CYAN}│{RESET}
+  {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
+  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
+""")
+
+
+def print_step_1_assets(file_count):
+    """Print the enhanced Step 1 asset unpacking card."""
+    print(f"""  {CYAN}┌─ {BOLD}Step 1/3{RESET} {CYAN}──────────────────────── {WHITE}Unpacking Governance Assets{RESET} {CYAN}──────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}  {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}             {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}            {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}            {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}           {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}                                               {BOLD}{WHITE}{file_count} files unpacked{RESET}   {CYAN}│{RESET}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_step_2_profile(detected_stack=None):
+    """Print the security profile & coverage card (in-process stack alignment)."""
+    if detected_stack and detected_stack.get("framework") and detected_stack.get("framework") != "None":
+        fw = str(detected_stack.get("framework"))
+        lang = str(detected_stack.get("language", ""))
+        label = f"Auto-aligned stack: {fw} ({lang})"
+        pad = " " * max(0, 66 - len(label))
+        status_line = f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {BOLD}Auto-aligned stack:{RESET} {WHITE}{fw}{RESET} {DIM}({lang}){RESET}{pad}{CYAN}│{RESET}"
+    else:
+        status_line = f"  {CYAN}│{RESET}   {DIM}ℹ Stack auto-detected on first /torusguard-audit run{RESET}              {CYAN}│{RESET}"
+
+    print(f"""  {CYAN}┌─ {BOLD}Step 2/3{RESET} {CYAN}──────────────────── {WHITE}Security Profile & Coverage{RESET} {CYAN}────────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}Rule Families:{RESET}                                                      {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety    {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication     {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection    {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless         {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net       {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-BIZ{RESET}     Business Logic                                      {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}Supported Stacks:{RESET}                                                  {CYAN}│{RESET}
+  {CYAN}│{RESET}     {GREEN}Python{RESET}    Django {DIM}·{RESET} FastAPI {DIM}·{RESET} Flask {DIM}·{RESET} DRF {DIM}·{RESET} SQLAlchemy              {CYAN}│{RESET}
+  {CYAN}│{RESET}     {GREEN}Node.js{RESET}   Next.js {DIM}·{RESET} Express {DIM}·{RESET} React {DIM}·{RESET} Supabase {DIM}·{RESET} Firebase       {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+{status_line}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_step_3_bridges(registered_ides):
+    """Print the IDE command registration card."""
+    lines = ""
+    for r in registered_ides:
+        lines += f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {r:<67} {CYAN}│{RESET}\n"
+
+    print(f"""  {CYAN}┌─ {BOLD}Step 3/3{RESET} {CYAN}─────────────────── {WHITE}AI IDE Command Registration{RESET} {CYAN}─────────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+{lines}  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_success_card():
+    """Print the final success card with next steps."""
+    print(f"""  {GREEN}╔═══════════════════════════════════════════════════════════════════════╗{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {GREEN}{BOLD}✅  WORKSPACE INITIALIZED SUCCESSFULLY{RESET}                               {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}╠═══════════════════════════════════════════════════════════════════════╣{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {BOLD}Next Steps:{RESET}                                                         {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}              {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}2.{RESET} In Terminal      {WHITE}npx torusguard status{RESET}                       {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}3.{RESET} In CI/CD         {WHITE}npx torusguard audit{RESET}                        {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {DIM}Docs{RESET}   {CYAN}https://github.com/githubmofo/TorusGuard{RESET}                   {GREEN}║{RESET}
+  {GREEN}║{RESET}   {DIM}NPM{RESET}    {CYAN}https://npmjs.com/package/torusguard{RESET}                       {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}╚═══════════════════════════════════════════════════════════════════════╝{RESET}
+""")
+
+
+def print_already_initialized(target_root, cfg):
+    """Print the already-initialized status card."""
+    print(f"""
+  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}                           {GREEN}[Active]{RESET}         {CYAN}│{RESET}
+  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
+
+  {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
+  {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.0.0')}{RESET}
+  {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
+
+  {DIM}To refresh templates or re-scaffold, run:{RESET}
+     {CYAN}npx torusguard init --force{RESET}
+""")
+
+
 def scaffold_workspace(target_root=None, force=False, full_commands=False):
     """Scaffold the .torusguard workspace into the target project root."""
     target_root = Path(target_root or find_project_root()).resolve()
@@ -53,40 +173,25 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
     payload_dir = script_dir / "payload"
 
     if torusguard_target.exists() and not force:
-        print("""
-  ╭──────────────────────────────────────────────────────────────────────────╮
-  │ 🛡️  TORUSGUARD WORKSPACE STATUS                           [Active]       │
-  ╰──────────────────────────────────────────────────────────────────────────╯
-""")
-        print(f"  ▸ Project Root:       {target_root}")
-        print(f"  ▸ Workspace:          .torusguard/ (Already Initialized)")
         config_file = torusguard_target / "config" / "torusguard.json"
+        cfg = {}
         if config_file.exists():
             try:
                 with open(config_file, "r", encoding="utf-8") as f:
                     cfg = json.load(f)
-                print(f"  ▸ Version:            {cfg.get('version', '0.9.3')}")
-                print(f"  ▸ Severity Floor:     {cfg.get('severity_threshold', 'medium')}")
             except Exception:
                 pass
-        print("""
-  💡 Workspace already exists. To refresh templates or re-scaffold, run:
-     npx torusguard init --force
-""")
+        print_already_initialized(target_root, cfg)
         return True
 
-    print("""
-  ╭──────────────────────────────────────────────────────────────────────────╮
-  │ 🛡️  TORUSGUARD WORKSPACE INITIALIZATION                   v0.9.3         │
-  │ Governed Remediation & AI Application Guardrails                         │
-  ╰──────────────────────────────────────────────────────────────────────────╯
-""")
-    print(f"  ▸ Target Project:     {target_root}")
-    print(f"  ▸ Destination:        {torusguard_target}")
+    # ── Header ──────────────────────────────────────────────────────────────
+    print_header()
+    print(f"  {BOLD}▸ Target Project:{RESET}     {WHITE}{target_root}{RESET}")
+    print(f"  {BOLD}▸ Destination:{RESET}        {WHITE}{torusguard_target}{RESET}")
 
-    # 1. Unpack Payload Template
+    # ── Step 1: Unpack Payload ──────────────────────────────────────────────
+    file_count = 93
     if payload_dir.is_dir():
-        print("\n  ▸ Step 1/3: Unpacking Offline Governance Assets...")
         try:
             if torusguard_target.exists() and force:
                 shutil.rmtree(torusguard_target)
@@ -95,22 +200,25 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
                 torusguard_target,
                 ignore=shutil.ignore_patterns("runs", "*.pyc", "__pycache__", ".git*")
             )
-            print("    ✔ Copied canonical rules, schemas, scripts, and workflows (93 files)")
+            # Count actual files
+            file_count = sum(1 for _ in torusguard_target.rglob("*") if _.is_file())
         except Exception as e:
-            print(f"    ❌ Failed to unpack payload: {e}")
+            print(f"\n  {RED}✖ Failed to unpack payload: {e}{RESET}")
             return False
     else:
         # Fallback: create base structure
-        print("\n1. Bundled payload not found. Creating core skeleton...")
         subdirs = [
             "config", "agents", "workflows", "scripts", "templates",
             "schemas", "references", "rules/active", "runs"
         ]
         for s in subdirs:
             (torusguard_target / s).mkdir(parents=True, exist_ok=True)
-        print("  [WARN] Bare skeleton created; full assets should be pulled from repository.")
+        file_count = 0
 
-    # 2. Ensure runs and rules/active directories exist
+    print()
+    print_step_1_assets(file_count)
+
+    # ── Ensure runs and rules/active directories exist ──────────────────────
     runs_dir = torusguard_target / "runs"
     runs_dir.mkdir(parents=True, exist_ok=True)
     gitkeep_runs = runs_dir / ".gitkeep"
@@ -123,50 +231,115 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
     if not gitkeep_rules.exists():
         gitkeep_rules.write_text("", encoding="utf-8")
 
-    # 3. Stack Detection & Tailoring
-    print("\n  ▸ Step 2/3: Executing Stack Detection & Rule Alignment...")
+    # ── Ensure memory subsystem is initialized (v1.0.0) ────────────────────
+    memory_dir = torusguard_target / "memory"
+    memory_dir.mkdir(parents=True, exist_ok=True)
+    events_dir = memory_dir / "events"
+    events_dir.mkdir(parents=True, exist_ok=True)
+
+    gitkeep_events = events_dir / ".gitkeep"
+    if not gitkeep_events.exists():
+        gitkeep_events.write_text("", encoding="utf-8")
+
+    mem_gitignore = memory_dir / ".gitignore"
+    if not mem_gitignore.exists():
+        mem_gitignore.write_text("*\n", encoding="utf-8")
+
+    decay_file = memory_dir / "decay.json"
+    if not decay_file.exists():
+        decay_file.write_text(json.dumps({
+            "default_ttl_days": 90,
+            "decay_rate": 0.15,
+            "last_decay_run": None
+        }, indent=2), encoding="utf-8")
+
+    patterns_file = memory_dir / "patterns.json"
+    if not patterns_file.exists():
+        patterns_file.write_text("[]", encoding="utf-8")
+
+    profile_file = memory_dir / "profile.json"
+    if not profile_file.exists():
+        profile_file.write_text(json.dumps({
+            "stack": [],
+            "total_events": 0,
+            "active_patterns_count": 0,
+            "fix_rate_percentage": None,
+            "top_vulnerabilities": [],
+            "last_updated": None
+        }, indent=2), encoding="utf-8")
+
+    context_file = memory_dir / "context.json"
+    if not context_file.exists():
+        context_file.write_text(json.dumps({
+            "version": "1.0.0",
+            "generated_at": None,
+            "token_estimate": 0,
+            "max_token_budget": 2000,
+            "project_profile": {
+                "stack": [],
+                "total_events": 0,
+                "active_patterns_count": 0,
+                "fix_rate_percentage": None,
+                "top_vulnerabilities": []
+            },
+            "cards": []
+        }, indent=2), encoding="utf-8")
+
+    # Ensure target project root .gitignore excludes .torusguard/memory/
+    root_gitignore = target_root / ".gitignore"
+    if root_gitignore.exists():
+        try:
+            gi_content = root_gitignore.read_text(encoding="utf-8")
+            if ".torusguard/memory" not in gi_content:
+                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard security memory (local only)\n.torusguard/memory/\n", encoding="utf-8")
+        except Exception:
+            pass
+
+    # ── Step 2: Security Profile & Coverage (In-Process, Zero Subprocess) ──
+    # Execute stack detection in-process without spawning child processes (Socket.dev safe)
+    detected_stack = None
     stack_detect_script = torusguard_target / "scripts" / "stack_detect.py"
-    detected_stack = {"language": "Unknown", "framework": "None", "data_layer": "None", "confidence": "Uncertain"}
-    
-    if stack_detect_script.exists():
+    if stack_detect_script.is_file():
         try:
-            res = subprocess.run(
-                [sys.executable, str(stack_detect_script), str(target_root), "--json"],
-                capture_output=True,
-                text=True,
-                timeout=10
-            )
-            if res.returncode == 0 and res.stdout.strip():
-                detected_stack = json.loads(res.stdout)
-                print(f"    ⎿ Language:         {detected_stack.get('language')}")
-                print(f"    ⎿ Framework:        {detected_stack.get('framework')}")
-                print(f"    ⎿ Data Layer:       {detected_stack.get('data_layer')}")
-        except Exception as e:
-            print(f"    ⚠ Stack detection warning: {e}")
+            import importlib.util
+            spec = importlib.util.spec_from_file_location("stack_detect", str(stack_detect_script))
+            if spec and spec.loader:
+                sd_mod = importlib.util.module_from_spec(spec)
+                spec.loader.exec_module(sd_mod)
+                if hasattr(sd_mod, "detect_stack"):
+                    detected_stack = sd_mod.detect_stack(target_root)
+        except Exception:
+            detected_stack = None
 
-    # 4. Update torusguard.json configuration
     config_file = torusguard_target / "config" / "torusguard.json"
     if config_file.exists():
         try:
             with open(config_file, "r", encoding="utf-8") as f:
                 cfg = json.load(f)
-            cfg["detected_stack"] = {
-                "language": detected_stack.get("language"),
-                "framework": detected_stack.get("framework"),
-                "data_layer": detected_stack.get("data_layer")
-            }
+            if detected_stack and detected_stack.get("framework") != "None":
+                cfg["detected_stack"] = {
+                    "language": detected_stack.get("language"),
+                    "framework": detected_stack.get("framework"),
+                    "data_layer": detected_stack.get("data_layer")
+                }
+            else:
+                cfg["detected_stack"] = {
+                    "language": "Unknown",
+                    "framework": "None",
+                    "data_layer": "None"
+                }
             with open(config_file, "w", encoding="utf-8") as f:
                 json.dump(cfg, f, indent=2)
-            print("    ✔ Configured .torusguard/config/torusguard.json (71 Rules Active)")
-        except Exception as e:
-            print(f"    ⚠ Config update error: {e}")
+        except Exception:
+            pass
+
+    print_step_2_profile(detected_stack)
 
-    # 5. Register Slash Commands for AI IDEs (.agent, .claude, .cursor)
-    print("\n  ▸ Step 3/3: Registering AI IDE Command Bridges...")
+    # ── Step 3: Register Slash Commands for AI IDEs ─────────────────────────
     registered_ides = []
     tg_workflow_content = """---
 description: TorusGuard Autonomous Security Command Engine — run static security audits, authorized runtime web validation, governed remediation, and SARIF exports.
-version: 0.9.2
+version: 1.0.0
 tools: Read, Grep, Glob, Bash, Edit, Write
 agent: auditor
 ---
@@ -192,16 +365,16 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         agents_wf.mkdir(parents=True, exist_ok=True)
         (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
         dest_workflow_dirs.append(agents_wf)
-        registered_ides.append("Antigravity / Gemini (.agents/workflows/torusguard.md)")
+        registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
 
     agent_wf = target_root / ".agent" / "workflows"
     agent_wf.mkdir(parents=True, exist_ok=True)
     (agent_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
     dest_workflow_dirs.append(agent_wf)
-    registered_ides.append("Antigravity / Tribunal (.agent/workflows/torusguard.md)")
+    registered_ides.append("Tribunal Agent Kit       .agent/workflows/torusguard.md")
 
     # When full_commands is requested (e.g. via NPM package npx torusguard init),
-    # unlock and register all 11 individual slash commands (/torusguard-audit, /torusguard-harden, etc.)
+    # unlock and register all 11 individual slash commands
     if full_commands:
         src_wf = torusguard_target / "workflows"
         if src_wf.is_dir():
@@ -213,7 +386,7 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
                 for d in dest_workflow_dirs:
                     shutil.copy2(wf_file, d / cmd_filename)
                 count += 1
-            registered_ides.append(f"Unlocked {count} Individual Slash Commands (/torusguard-audit, /torusguard-apply, etc.)")
+            registered_ides.append(f"{count} Slash Commands          /torusguard-audit, -harden, -apply, ...")
 
     # Claude Code (.claude/commands)
     claude_dir = target_root / ".claude"
@@ -221,7 +394,7 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         claude_commands = claude_dir / "commands"
         claude_commands.mkdir(parents=True, exist_ok=True)
         (claude_commands / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-        registered_ides.append("Claude Code (.claude/commands/torusguard.md)")
+        registered_ides.append("Claude Code              .claude/commands/torusguard.md")
 
     # Cursor (.cursor/rules)
     cursor_dir = target_root / ".cursor"
@@ -229,7 +402,7 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         cursor_rules = cursor_dir / "rules"
         cursor_rules.mkdir(parents=True, exist_ok=True)
         (cursor_rules / "torusguard.mdc").write_text(tg_workflow_content, encoding="utf-8")
-        registered_ides.append("Cursor (.cursor/rules/torusguard.mdc)")
+        registered_ides.append("Cursor                   .cursor/rules/torusguard.mdc")
 
     # Windsurf (.windsurfrules)
     if (target_root / ".windsurfrules").exists() or (target_root / ".windsurf").exists():
@@ -237,7 +410,7 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         current_content = windsurf_rules.read_text(encoding="utf-8") if windsurf_rules.exists() else ""
         if "TorusGuard" not in current_content:
             windsurf_rules.write_text(current_content + "\n\n" + tg_workflow_content, encoding="utf-8")
-        registered_ides.append("Windsurf (.windsurfrules)")
+        registered_ides.append("Windsurf                 .windsurfrules")
 
     # VS Code / GitHub Copilot (.github/copilot-instructions.md)
     github_dir = target_root / ".github"
@@ -246,28 +419,19 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         current_content = copilot_file.read_text(encoding="utf-8") if copilot_file.exists() else ""
         if "TorusGuard" not in current_content:
             copilot_file.write_text(current_content + "\n\n# TorusGuard Security Instructions\n" + tg_workflow_content, encoding="utf-8")
-        registered_ides.append("VS Code / Copilot (.github/copilot-instructions.md)")
+        registered_ides.append("VS Code / Copilot        .github/copilot-instructions.md")
 
     # Universal AGENTS.md (Kimi, Codex, Open Agent Standard)
     agents_md = target_root / "AGENTS.md"
     current_agents = agents_md.read_text(encoding="utf-8") if agents_md.exists() else ""
     if "TorusGuard" not in current_agents:
         agents_md.write_text(current_agents + ("\n\n" if current_agents else "") + "# TorusGuard Security Guardrails\n\nRun `/torusguard audit` to scan the codebase or refer to `.torusguard/` for security guidelines.\n", encoding="utf-8")
-        registered_ides.append("Universal Agent Standard (AGENTS.md for Kimi / Open Agents)")
+        registered_ides.append("Universal AGENTS.md      Kimi / Open Agent Standard")
 
-    for r in registered_ides:
-        print(f"    ✔ {r}")
+    print_step_3_bridges(registered_ides)
 
-    print(f"""
-  ╭──────────────────────────────────────────────────────────────────────────╮
-  │ ✨ TorusGuard Workspace Initialized Successfully!                        │
-  │                                                                          │
-  │ 🚀 Next Steps:                                                           │
-  │   1. In AI Chat:     Type `/torusguard-audit` or `/torusguard` to scan   │
-  │   2. In Terminal:    Run `npx torusguard status` for security posture    │
-  │   3. In CI/CD:       Run `npx torusguard audit` to generate SARIF data   │
-  ╰──────────────────────────────────────────────────────────────────────────╯
-""")
+    # ── Success Card ────────────────────────────────────────────────────────
+    print_success_card()
     return True
 
 

package/skills/torusguard/payload/.manifest.json

@@ -8,7 +8,7 @@
   "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "5390f0d26f8117a62e56c58147d3a0d2deab1a20956302b212703281d13fa84e",
-  "config/torusguard.json": "218eeae10b538aca9b548d1b756d7d4f91a5b624e0bce07533f0c187860586e6",
+  "config/torusguard.json": "b979d6ead31e64a63729e050d820f3e3228d3c825972a60ccae2087e6b27f574",
   "references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
   "references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
   "references/express-security.md": "dff1db15e614d29d8c272f9da345b418077e62dc883fe210c7a50c552c76493f",
@@ -28,20 +28,24 @@
   "schemas/confidence.schema.json": "08b3a564d7370e123dd5bfadde9fb077d2954e36b523685b9e1d7bdd2aa4b8cb",
   "schemas/evidence.schema.json": "d3dcaa10fd2420a4046ea68836fb836a55d003ada4cdc6682229f232881182bf",
   "schemas/finding.schema.json": "e0a7c28fa4a5f84bdedb5cf5223da26348250d633479d2dbf7ce3ebd6790a852",
+  "schemas/memory-context.schema.json": "6b9e032c55ba87b2517dd1e7ca0043b8e2439e85fa4a6eac6fc6041f3091e571",
+  "schemas/memory-event.schema.json": "4f653610e04fd480325d0ec77a4339bea4690f85e1d2fa0bd4f6b654c813c905",
+  "schemas/memory-pattern.schema.json": "df4aae2a3034a7c64ec50b3ae27b6ee9296aac7371c2a1938508834e5f778afe",
   "schemas/provenance.schema.json": "781215801249532414643638b6608dc8f52febc9bca43ae03827b90aecc03256",
   "schemas/remediation.schema.json": "217cb2743ae1a912dc074382e9f05634da93f2e30a880c03f6020600ef7e43d3",
   "schemas/retest.schema.json": "773b764082f6d2e8c3656ea105e0ce09febd1020520bf262bbcd17f5924da11e",
   "schemas/runtime-evidence.schema.json": "dbe13741a7fb68cca2a044d47a644ee0bdaacb83a28621dc2a98bffdd59989a6",
-  "scripts/diff_guard.py": "227bf56d2e6c9aef293a51ad1a3209782e6d9204dc1775956d372c3a6851a736",
-  "scripts/finding_scorer.py": "b78c6315f22000fb64f5d4e6ff1f3467439769d3d5507aaa99380453df4eb464",
-  "scripts/manifest_builder.py": "b759131592966053db17ef710dc5f313127a9583295cb867a39ab22a7c996580",
+  "scripts/diff_guard.py": "5937b657c1047c78b7b9f0a36f3438cb699457cdb5ee56136d68b97edf56af42",
+  "scripts/finding_scorer.py": "c9f34c9153f5322c92bba824ce199ea281c450cd8edc637e61442c5f556d6183",
+  "scripts/manifest_builder.py": "136d5650a97dbb52fdf42c6d55b330a4f9593816e344b07913b0b2ba6b5cc409",
+  "scripts/memory_engine.py": "e99d34951b953bf3d96b6fca2413192de76778e6519278d4213fa3a72bc9b05f",
   "scripts/monorepo_detector.py": "38f1eb948ee2856f175e1212956bce211effdd1327d3a31f7303d32ba9478ebe",
-  "scripts/run_manager.py": "e853874e4fb0cb697596ea338f71ba7e955f2b41a6fc649733b45fa755e94768",
+  "scripts/run_manager.py": "b576fc3be9929ee6a52e67662e67f801e4e9317c158243582911e10c94a07619",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
   "scripts/stack_detect.py": "99b7bdf9829d58ff5b8c59afd6e8b6429bbb11d830ac73dec491101cbbc41574",
-  "skills/torusguard/SKILL.md": "5282a9e73c2faad97f079ff527def34b96709615c0dd297fe9b1bb2894f03e20",
-  "skills/torusguard/bootstrap.py": "7e348065a622089ab1d51e9bf4864e5b0022aaee1ccb2ecbf7057c14e792e2c7",
+  "skills/torusguard/SKILL.md": "e772e348716aee26e424ec96be5bd6750dbebcefc248bc4dab0df1e6c0e24fcf",
+  "skills/torusguard/bootstrap.py": "7c5a13687578a8736aef25cf767d1ef3c8b82dcae0eb7efce41bf131d27a120f",
   "skills/torusguard/references/auth-and-sessions.md": "34c2843f8c0dbe3574e54f00a39a92a1f431527ec5f69b2d64c84240d424a39e",
   "skills/torusguard/references/business-logic-and-abuse.md": "0d6088936bc1a01023070332fccef0f2e0734358a5119379055f3d2895c22567",
   "skills/torusguard/references/cache-and-sensitive-responses.md": "8f920cacde29c50b1f5f98de341a60db0bc607fe8c212a7e618ef7af08c86511",
@@ -66,13 +70,13 @@
   "skills/torusguard/references/webhook-security.md": "a0c7efb663c664dd840ba99b689cb67d4688643106f8b6e80d18a424c6add386",
   "skills/torusguard/references/websocket-security.md": "5624a84abd75bbb4eed029cd217e0c794ee452cbecc0730a8ab4d0f371537cd7",
   "skills/torusguard-apply/SKILL.md": "9436fa5cdefa661677ada22936a3949de06aca276e4f4bb27e0ef5b7ea34edc3",
-  "skills/torusguard-audit/SKILL.md": "d0e0c21d6c36d9d128ccce6ad628b978ff771d27552ba80e0a4981e18b9f5a51",
+  "skills/torusguard-audit/SKILL.md": "f879e280d357ea7f124c647ce39af2b24b79db608c9edd018f26e5312625a8b5",
   "skills/torusguard-authorize/SKILL.md": "da849585f2e46c08ef528b89737be14647f1109fd365fd27f3f6da57a396724b",
   "skills/torusguard-exploit-check/SKILL.md": "e9a173e154a88cc9cb929c59d79a65ab13d5cf9567b4112bd7f272746cf9c3f9",
   "skills/torusguard-full/SKILL.md": "cc97684d37de378e51fefd12f6f9a7cd15cc469ce46079a0599440aa7b073f7b",
-  "skills/torusguard-harden/SKILL.md": "86a8dee6c614477e2122287752f5c16e3688c0451d0e7ae9bfd2a23802bcdde3",
+  "skills/torusguard-harden/SKILL.md": "326fa84bda4832f96b19d73824c3472dfe185247ed3e3db9715dd943d46d9874",
   "skills/torusguard-init/SKILL.md": "1f7844d66219955581fdb266029eefdc355dbebb5741b848daf0062e606202a2",
-  "skills/torusguard-recheck/SKILL.md": "4725a9be6a6ddedb3d389d1957c7ce3e0f9ce288107816fce85b5953951e13e5",
+  "skills/torusguard-recheck/SKILL.md": "457b2a1cce064a738fbe43f0dba6b4393f1630a82f60698ea5ebe655ec017e50",
   "skills/torusguard-report/SKILL.md": "bde44d114bdc85c04472644a644a7796ed2f182a23e0c057838a3251e4910a09",
   "skills/torusguard-status/SKILL.md": "4e71d03c71b240afd7f6108569530b7da3702634c512a74ca8dc3174f3c6b0fb",
   "skills/torusguard-verify/SKILL.md": "10c19e0926255686351e3b75ae774880cf35562d42bd30b87a877bb8f284fc1f",
@@ -87,6 +91,7 @@
   "workflows/exploit-check.md": "9684009b835a61d5aca8827a971ee686a24c800425d86ef96f963dd27de845b8",
   "workflows/harden.md": "509484f844c9dcd10dd14c8bb6e3456021928e6cf6abd374faaf34be8fc34ce2",
   "workflows/init.md": "3d1668a9f6b87417c31f47c887c495f863595ed4a29074e0c5a8ee1ece1d4a35",
+  "workflows/memory.md": "c034f9266380db3c05e9ffed943c2bb4ba73c060507e3508e47b543a035a5873",
   "workflows/recheck.md": "7d374c29a5585c31b81f84fb32d6a466f2e9cb339726dc0523dba25e57bc5d13",
   "workflows/report.md": "56b3449cff362172c63093ee6150446d11bf05e3c8143661966dad9d42df1470",
   "workflows/status.md": "921129646518c592cb47ad8e8ccf3d703e8d11ea6eb89bd21a206f545e022dba",

package/skills/torusguard/payload/config/torusguard.json

@@ -1,6 +1,6 @@
 {
   "$schema": "../schemas/torusguard-config.schema.json",
-  "version": "0.9.4",
+  "version": "1.0.0",
   "product": "TorusGuard Security Skill Kit",
   "severity_threshold": "medium",
   "auto_detect_stack": true,

package/skills/torusguard/payload/schemas/memory-context.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-context.schema.json",
+  "title": "TorusGuard Memory Context Window",
+  "description": "Pre-computed, token-budgeted context window for AI agent consumption formatted as structured JSON cards.",
+  "type": "object",
+  "required": ["version", "generated_at", "token_estimate", "max_token_budget", "project_profile", "cards"],
+  "properties": {
+    "version": {
+      "type": "string",
+      "description": "TorusGuard engine version (e.g., 1.0.0)."
+    },
+    "generated_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 UTC timestamp when this context window was computed."
+    },
+    "token_estimate": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Estimated token count of this context document."
+    },
+    "max_token_budget": {
+      "type": "integer",
+      "default": 2000,
+      "description": "Maximum allowed tokens for agent context injection (default: 2000)."
+    },
+    "project_profile": {
+      "type": "object",
+      "required": ["stack", "total_events", "active_patterns_count"],
+      "properties": {
+        "stack": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Detected technology stack frameworks/languages."
+        },
+        "total_events": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "active_patterns_count": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "fix_rate_percentage": {
+          "type": ["number", "null"],
+          "minimum": 0,
+          "maximum": 100
+        },
+        "top_vulnerabilities": {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "cards": {
+      "type": "array",
+      "description": "Ordered list of high-priority intelligence cards for LLM grounding.",
+      "items": {
+        "type": "object",
+        "required": ["card_id", "card_type", "priority", "title", "summary", "card_data"],
+        "properties": {
+          "card_id": {
+            "type": "string",
+            "description": "Unique card identifier (e.g., CARD-001)."
+          },
+          "card_type": {
+            "type": "string",
+            "enum": ["pattern", "profile", "regression_watch", "false_positive", "fix_idiom"],
+            "description": "Semantic category of this context card."
+          },
+          "priority": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 100,
+            "description": "Rank order priority (higher = more relevant/critical)."
+          },
+          "title": {
+            "type": "string",
+            "description": "Short, human-readable and agent-scannable card title."
+          },
+          "summary": {
+            "type": "string",
+            "description": "One-line operational summary for rapid agent reasoning."
+          },
+          "card_data": {
+            "type": "object",
+            "description": "Structured card payload containing rule_id, fix_strategy, confidence, affected_files, etc.",
+            "additionalProperties": true
+          }
+        }
+      }
+    }
+  }
+}