torusguard 0.9.5 → 1.0.0

package/.torusguard/workflows/memory.md

@@ -0,0 +1,53 @@
+---
+description: TorusGuard Adaptive Security Memory Engine — view memory stats, export/import intelligence, apply TTL decay, and manage false positives.
+tools: Read, Grep, Glob, Bash
+version: 1.0.0
+agent: reviewer
+lifecycle-phase: Intelligence / Memory
+required-skills:
+  - torusguard
+scripts-binding:
+  - .torusguard/scripts/memory_engine.py
+---
+
+# /torusguard memory — Adaptive Security Memory Engine & Intelligence Management
+
+$ARGUMENTS
+
+---
+
+## Objective
+Inspect, manage, export, import, or compact persistent local security memory patterns, context window cards, and false positive suppressions.
+
+---
+
+## Subcommands & Usage
+
+| Command | Action | Description |
+| :--- | :--- | :--- |
+| `npx torusguard memory` | Status | Display memory stats, pattern count, and context token estimate |
+| `npx torusguard memory context` | Context Dump | Output the active pre-computed context window cards |
+| `npx torusguard memory fp --rule <RULE_ID>` | False Positive | Suppress rule as false positive across future scans |
+| `npx torusguard memory decay [--ttl 90]` | TTL Decay | Apply confidence decay to stale, unconfirmed patterns |
+| `npx torusguard memory export --path <FILE>` | Export | Export memory bundle for team sharing |
+| `npx torusguard memory import --path <FILE>` | Import | Merge external memory bundle into local project intelligence |
+| `npx torusguard memory compact` | Compaction | Archive raw events older than 30 days into single archive |
+
+---
+
+## Execution Steps
+
+1. **Verify Memory Subsystem:** Confirm `.torusguard/memory/` exists and is shielded by `.gitignore`.
+2. **Execute Requested Action:** Invoke `.torusguard/scripts/memory_engine.py` with appropriate action flag:
+   ```bash
+   python .torusguard/scripts/memory_engine.py --action status
+   ```
+3. **Verify Context Token Budget:** Confirm `context.json` remains within token budget ($\le 2,000$ tokens).
+4. **Display Intelligence Card:** Render summary card to user.
+
+---
+
+## Privacy & Security Invariants
+- Memory files remain strictly local under `.torusguard/memory/` and are always gitignored.
+- Memory files are never packaged into npm release tarballs.
+- Export operations only occur when explicitly invoked by user command.

package/README.md

@@ -6,8 +6,8 @@
   **Autonomous Security Guardrails, Governed Remediation, and Authorized Runtime Validation for AI-Built Web Applications.**
 
   [![npm version](https://img.shields.io/npm/v/torusguard.svg?style=flat-square&color=cb3837&logo=npm)](https://www.npmjs.com/package/torusguard)
-  [![GitHub Packages](https://img.shields.io/badge/GitHub%20Packages-v0.9.5-181717.svg?style=flat-square&logo=github)](https://github.com/githubmofo/TorusGuard/pkgs/npm/torusguard)
-  [![Release](https://img.shields.io/badge/Release-v0.9.5-blue.svg?style=flat-square)](https://github.com/githubmofo/TorusGuard/releases/latest)
+  [![GitHub Packages](https://img.shields.io/badge/GitHub%20Packages-v1.0.0-181717.svg?style=flat-square&logo=github)](https://github.com/githubmofo/TorusGuard/pkgs/npm/torusguard)
+  [![Release](https://img.shields.io/badge/Release-v1.0.0-blue.svg?style=flat-square)](https://github.com/githubmofo/TorusGuard/releases/latest)
   [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg?style=flat-square)](LICENSE)
   [![Python 3.10+](https://img.shields.io/badge/Python-3.10%2B-blue.svg?style=flat-square&logo=python&logoColor=white)](https://python.org)
   [![Node.js 18+](https://img.shields.io/badge/Node.js-18%2B-339933.svg?style=flat-square&logo=node.js&logoColor=white)](https://nodejs.org)
@@ -143,6 +143,7 @@ When Track 2 is initialized, the complete 11-command palette becomes available i
 | `/torusguard recheck`<br>*(or `/torusguard-recheck`)* | `skills/torusguard-recheck` | Phase 6 | Executes differential re-audit strictly on modified files to verify fix closure. | No |
 | `/torusguard report`<br>*(or `/torusguard-report`)* | `skills/torusguard-report` | Phase 7 | Emits executive summary markdown and OASIS SARIF v2.1.0 CI artifacts. | No |
 | `/torusguard status`<br>*(or `/torusguard-status`)* | `skills/torusguard-status` | Diagnostic | Inspects active security posture, thresholds, and recent run history. | No |
+| `/torusguard memory` | `skills/torusguard` | Intelligence | Inspects, exports, imports, or compacts persistent security memory context. | Yes (`.torusguard/memory/`) |
 | `/torusguard full` | `skills/torusguard-full` | End-to-End | Orchestrates the entire 7-stage security cycle in one coordinated sequence. | **Yes (Governed)** |
 
 ---
@@ -259,6 +260,14 @@ $$\text{Score} = (w_d \cdot D) + (w_e \cdot E) + (w_c \cdot C_{ast}) - P_{fp} -
 ### 3. Stable Line-Shift Invariant Fingerprinting (`primaryLocationLineHash`)
 Traditional static tools break finding identity when a developer inserts 2 lines at the top of a file. TorusGuard computes a stable SHA-256 hash across the AST node content, enclosing function scope, and syntactic tokens. Findings maintain permanent tracking identity across Git commits and branch renames.
 
+### 4. Adaptive Security Memory Engine (`.torusguard/memory/`)
+Traditional scanners are stateless — they scan, report, and forget. TorusGuard v1.0.0 introduces persistent, local-first intelligence that learns from every audit, fix, and verification:
+* **4-Tier Intelligence Architecture:** Raw event append-log (`events/`) ──► Distilled pattern store (`patterns.json`) ──► Pre-computed context window (`context.json`) ──► Project security profile (`profile.json`).
+* **Structured JSON Cards:** Pre-computes context cards within a strict $\le 2,000$ token budget for instant, hallucination-free injection into AI coding agent prompts.
+* **Confidence Amplification & TTL Decay:** Multi-file fix verifications boost pattern confidence up to 98%, while unconfirmed patterns decay gracefully over 90 days.
+* **Zero-Leakage Guarantee:** Memory is strictly gitignored (`*`), excluded from npm distribution tarballs, and stored only in the user's project.
+* **CLI Memory Management:** Inspect, export, import, or compact memory via `npx torusguard memory`.
+
 ---
 
 ## 🛡️ Rule Catalog & Detection Families (71 Canonical Rules)

package/bin/torusguard.js

@@ -49,7 +49,7 @@ function printHelp() {
   console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v0.9.5${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.0.0${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}   ${DIM}Autonomous Security Engine for AI-Built Applications${RESET}               ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
@@ -59,8 +59,9 @@ function printHelp() {
   ${CYAN}┌─────────────────────────────────────────────────────────────────────────┐${RESET}
   ${CYAN}│${RESET}  ${BOLD}Commands${RESET}                                                              ${CYAN}│${RESET}
   ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
-  ${CYAN}│${RESET}  ${GREEN}init${RESET}      Scaffold ${BOLD}.torusguard/${RESET} workspace + unlock 11 slash commands   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}status${RESET}    Display active security posture, rules, and stack info      ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}init${RESET}      Scaffold ${BOLD}.torusguard/${RESET} workspace + unlock 12 slash commands   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}status${RESET}    Display active security posture, memory, rules, and stack   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}memory${RESET}    Manage persistent security memory (export, import, decay)   ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}audit${RESET}     Run static AST security scan on the target project          ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}report${RESET}    Export OASIS SARIF v2.1.0 structured telemetry              ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}help${RESET}      Show this interactive command guide                         ${CYAN}│${RESET}
@@ -73,7 +74,7 @@ function printHelp() {
 
   ${BOLD}AI Chat Commands:${RESET}
     ${DIM}In your AI IDE chat, use any of these slash commands:${RESET}
-    ${CYAN}/torusguard${RESET}          Main orchestrator (status, audit, harden, etc.)
+    ${CYAN}/torusguard${RESET}          Main orchestrator (status, audit, harden, memory)
     ${CYAN}/torusguard-audit${RESET}    Static AST security scan
     ${CYAN}/torusguard-harden${RESET}   Generate governed fix patches
     ${CYAN}/torusguard-apply${RESET}    Apply patches with rollback snapshots
@@ -100,10 +101,32 @@ if (command === 'status') {
       const stackDb = cfg.detected_stack?.data_layer || 'Not yet detected';
       const stackStatus = cfg.detected_stack ? `${GREEN}Detected${RESET}` : `${YELLOW}Pending first audit${RESET}`;
 
+      // Memory telemetry
+      const memProfilePath = path.join(cwd, '.torusguard', 'memory', 'profile.json');
+      const memContextPath = path.join(cwd, '.torusguard', 'memory', 'context.json');
+      let memPatterns = 0;
+      let memEvents = 0;
+      let memTokens = 0;
+      let memFixRate = 'N/A';
+      if (fs.existsSync(memProfilePath)) {
+        try {
+          const prof = JSON.parse(fs.readFileSync(memProfilePath, 'utf-8'));
+          memPatterns = prof.active_patterns_count || 0;
+          memEvents = prof.total_events || 0;
+          memFixRate = prof.fix_rate_percentage !== null && prof.fix_rate_percentage !== undefined ? `${prof.fix_rate_percentage}%` : 'N/A';
+        } catch (e) {}
+      }
+      if (fs.existsSync(memContextPath)) {
+        try {
+          const ctx = JSON.parse(fs.readFileSync(memContextPath, 'utf-8'));
+          memTokens = ctx.token_estimate || 0;
+        } catch (e) {}
+      }
+
       console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v0.9.5${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.0.0${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
 
@@ -117,6 +140,13 @@ if (command === 'status') {
   ${CYAN}│${RESET}  Stack Detection:   ${stackStatus}
   ${CYAN}└─────────────────────────────────────────────────────────────────────────┘${RESET}
 
+  ${CYAN}┌── Security Memory Engine ───────────────────────────────────────────────┐${RESET}
+  ${CYAN}│${RESET}  Patterns Learned:  ${GREEN}${memPatterns} active patterns${RESET}
+  ${CYAN}│${RESET}  Events Recorded:   ${WHITE}${memEvents} events (local-first log)${RESET}
+  ${CYAN}│${RESET}  Context Window:    ${CYAN}${memTokens} / 2,000 tokens${RESET} (${Math.round((memTokens / 2000) * 100)}% utilized)
+  ${CYAN}│${RESET}  Fix Velocity Rate: ${YELLOW}${memFixRate}${RESET}
+  ${CYAN}└─────────────────────────────────────────────────────────────────────────┘${RESET}
+
   ${CYAN}┌── Governance Telemetry ─────────────────────────────────────────────────┐${RESET}
   ${CYAN}│${RESET}  Rules Catalog:     ${GREEN}71 Canonical Security Rules${RESET} (11 families)
   ${CYAN}│${RESET}  Severity Floor:    ${YELLOW}${cfg.severity_threshold || 'medium'}${RESET}
@@ -148,6 +178,70 @@ if (command === 'status') {
   }
 }
 
+// Subcommand: memory
+if (command === 'memory') {
+  const sub = args[1] || 'status';
+  const memScript = path.join(cwd, '.torusguard', 'scripts', 'memory_engine.py');
+  const fallbackMemScript = path.join(rootDir, '.torusguard', 'scripts', 'memory_engine.py');
+  const actualMemScript = fs.existsSync(memScript) ? memScript : fallbackMemScript;
+
+  let pyArgs = [actualMemScript];
+  if (sub === 'status') {
+    pyArgs.push('--action', 'status');
+  } else if (sub === 'context') {
+    pyArgs.push('--action', 'context');
+  } else if (sub === 'distill') {
+    pyArgs.push('--action', 'distill');
+  } else if (sub === 'decay') {
+    pyArgs.push('--action', 'decay');
+    const ttlIdx = args.indexOf('--ttl');
+    if (ttlIdx !== -1 && args[ttlIdx + 1]) {
+      pyArgs.push('--ttl', args[ttlIdx + 1]);
+    }
+  } else if (sub === 'compact') {
+    pyArgs.push('--action', 'compact');
+    const ageIdx = args.indexOf('--older-than');
+    if (ageIdx !== -1 && args[ageIdx + 1]) {
+      pyArgs.push('--older-than', args[ageIdx + 1]);
+    }
+  } else if (sub === 'export') {
+    pyArgs.push('--action', 'export');
+    const pathIdx = args.indexOf('--path') !== -1 ? args.indexOf('--path') : args.indexOf('-p');
+    if (pathIdx !== -1 && args[pathIdx + 1]) {
+      pyArgs.push('--target', args[pathIdx + 1]);
+    } else {
+      pyArgs.push('--target', 'torusguard-memory-export.json');
+    }
+  } else if (sub === 'import') {
+    pyArgs.push('--action', 'import');
+    const pathIdx = args.indexOf('--path') !== -1 ? args.indexOf('--path') : args.indexOf('-p');
+    if (pathIdx !== -1 && args[pathIdx + 1]) {
+      pyArgs.push('--source', args[pathIdx + 1]);
+    } else {
+      console.error(`${RED}Error: --path <file> is required for memory import${RESET}`);
+      process.exit(1);
+    }
+  } else if (sub === 'fp') {
+    pyArgs.push('--action', 'fp');
+    const ruleIdx = args.indexOf('--rule') !== -1 ? args.indexOf('--rule') : args.indexOf('-r');
+    if (ruleIdx !== -1 && args[ruleIdx + 1]) {
+      pyArgs.push('--rule-id', args[ruleIdx + 1]);
+    } else {
+      console.error(`${RED}Error: --rule <rule_id> is required for fp suppression${RESET}`);
+      process.exit(1);
+    }
+    const reasonIdx = args.indexOf('--reason');
+    if (reasonIdx !== -1 && args[reasonIdx + 1]) {
+      pyArgs.push('--reason', args[reasonIdx + 1]);
+    }
+  } else {
+    pyArgs.push('--action', sub, ...args.slice(2));
+  }
+
+  const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
 // Locate bootstrap / runner scripts
 const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
 const localInstall = path.join(rootDir, 'install.py');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "0.9.5",
+  "version": "1.0.0",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {

package/skills/torusguard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard
-description: "Autonomous security engine: 71 rules across 11 families, governed remediation (Ponytail Protocol), SARIF v2.1.0 exports, and 5-agent authority separation for Python & TypeScript web applications."
-version: 0.9.5
+description: "Autonomous security engine: 71 rules across 11 families, governed remediation (Ponytail Protocol), SARIF v2.1.0 exports, and persistent security memory context for Python & TypeScript web applications."
+version: 1.0.0
 ---
 
 # TorusGuard Master Security Router
@@ -11,7 +11,7 @@ version: 0.9.5
 ---
 
 ## ⚡ Workspace Bootstrap Check
-1. **If `.torusguard/` exists on disk:** Full governance active. Route slash commands to local specialist workflows below.
+1. **If `.torusguard/` exists on disk:** Full governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
 2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor). Apply in-memory security invariants:
    - Server-side auth & tenant scoping (`.filter(tenant=...)`).
    - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys).
@@ -36,6 +36,7 @@ Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 t
 | `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` |
 | `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` |
 | `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` |
+| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` |
 | `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* |
 
 *Note: Never load all skills simultaneously. Lazy-load strictly on demand.*

package/skills/torusguard/bootstrap.py

@@ -157,7 +157,7 @@ def print_already_initialized(target_root, cfg):
 
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '0.9.5')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.0.0')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -231,6 +231,70 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
     if not gitkeep_rules.exists():
         gitkeep_rules.write_text("", encoding="utf-8")
 
+    # ── Ensure memory subsystem is initialized (v1.0.0) ────────────────────
+    memory_dir = torusguard_target / "memory"
+    memory_dir.mkdir(parents=True, exist_ok=True)
+    events_dir = memory_dir / "events"
+    events_dir.mkdir(parents=True, exist_ok=True)
+
+    gitkeep_events = events_dir / ".gitkeep"
+    if not gitkeep_events.exists():
+        gitkeep_events.write_text("", encoding="utf-8")
+
+    mem_gitignore = memory_dir / ".gitignore"
+    if not mem_gitignore.exists():
+        mem_gitignore.write_text("*\n", encoding="utf-8")
+
+    decay_file = memory_dir / "decay.json"
+    if not decay_file.exists():
+        decay_file.write_text(json.dumps({
+            "default_ttl_days": 90,
+            "decay_rate": 0.15,
+            "last_decay_run": None
+        }, indent=2), encoding="utf-8")
+
+    patterns_file = memory_dir / "patterns.json"
+    if not patterns_file.exists():
+        patterns_file.write_text("[]", encoding="utf-8")
+
+    profile_file = memory_dir / "profile.json"
+    if not profile_file.exists():
+        profile_file.write_text(json.dumps({
+            "stack": [],
+            "total_events": 0,
+            "active_patterns_count": 0,
+            "fix_rate_percentage": None,
+            "top_vulnerabilities": [],
+            "last_updated": None
+        }, indent=2), encoding="utf-8")
+
+    context_file = memory_dir / "context.json"
+    if not context_file.exists():
+        context_file.write_text(json.dumps({
+            "version": "1.0.0",
+            "generated_at": None,
+            "token_estimate": 0,
+            "max_token_budget": 2000,
+            "project_profile": {
+                "stack": [],
+                "total_events": 0,
+                "active_patterns_count": 0,
+                "fix_rate_percentage": None,
+                "top_vulnerabilities": []
+            },
+            "cards": []
+        }, indent=2), encoding="utf-8")
+
+    # Ensure target project root .gitignore excludes .torusguard/memory/
+    root_gitignore = target_root / ".gitignore"
+    if root_gitignore.exists():
+        try:
+            gi_content = root_gitignore.read_text(encoding="utf-8")
+            if ".torusguard/memory" not in gi_content:
+                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard security memory (local only)\n.torusguard/memory/\n", encoding="utf-8")
+        except Exception:
+            pass
+
     # ── Step 2: Security Profile & Coverage (In-Process, Zero Subprocess) ──
     # Execute stack detection in-process without spawning child processes (Socket.dev safe)
     detected_stack = None
@@ -275,7 +339,7 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
     registered_ides = []
     tg_workflow_content = """---
 description: TorusGuard Autonomous Security Command Engine — run static security audits, authorized runtime web validation, governed remediation, and SARIF exports.
-version: 0.9.5
+version: 1.0.0
 tools: Read, Grep, Glob, Bash, Edit, Write
 agent: auditor
 ---

package/skills/torusguard/payload/.manifest.json

@@ -8,7 +8,7 @@
   "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "5390f0d26f8117a62e56c58147d3a0d2deab1a20956302b212703281d13fa84e",
-  "config/torusguard.json": "077bc6a948f9420aded8dba248577ff3ebf054cab64cf538a7a6d05223fe27bc",
+  "config/torusguard.json": "b979d6ead31e64a63729e050d820f3e3228d3c825972a60ccae2087e6b27f574",
   "references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
   "references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
   "references/express-security.md": "dff1db15e614d29d8c272f9da345b418077e62dc883fe210c7a50c552c76493f",
@@ -28,20 +28,24 @@
   "schemas/confidence.schema.json": "08b3a564d7370e123dd5bfadde9fb077d2954e36b523685b9e1d7bdd2aa4b8cb",
   "schemas/evidence.schema.json": "d3dcaa10fd2420a4046ea68836fb836a55d003ada4cdc6682229f232881182bf",
   "schemas/finding.schema.json": "e0a7c28fa4a5f84bdedb5cf5223da26348250d633479d2dbf7ce3ebd6790a852",
+  "schemas/memory-context.schema.json": "6b9e032c55ba87b2517dd1e7ca0043b8e2439e85fa4a6eac6fc6041f3091e571",
+  "schemas/memory-event.schema.json": "4f653610e04fd480325d0ec77a4339bea4690f85e1d2fa0bd4f6b654c813c905",
+  "schemas/memory-pattern.schema.json": "df4aae2a3034a7c64ec50b3ae27b6ee9296aac7371c2a1938508834e5f778afe",
   "schemas/provenance.schema.json": "781215801249532414643638b6608dc8f52febc9bca43ae03827b90aecc03256",
   "schemas/remediation.schema.json": "217cb2743ae1a912dc074382e9f05634da93f2e30a880c03f6020600ef7e43d3",
   "schemas/retest.schema.json": "773b764082f6d2e8c3656ea105e0ce09febd1020520bf262bbcd17f5924da11e",
   "schemas/runtime-evidence.schema.json": "dbe13741a7fb68cca2a044d47a644ee0bdaacb83a28621dc2a98bffdd59989a6",
-  "scripts/diff_guard.py": "227bf56d2e6c9aef293a51ad1a3209782e6d9204dc1775956d372c3a6851a736",
-  "scripts/finding_scorer.py": "b78c6315f22000fb64f5d4e6ff1f3467439769d3d5507aaa99380453df4eb464",
-  "scripts/manifest_builder.py": "b759131592966053db17ef710dc5f313127a9583295cb867a39ab22a7c996580",
+  "scripts/diff_guard.py": "5937b657c1047c78b7b9f0a36f3438cb699457cdb5ee56136d68b97edf56af42",
+  "scripts/finding_scorer.py": "c9f34c9153f5322c92bba824ce199ea281c450cd8edc637e61442c5f556d6183",
+  "scripts/manifest_builder.py": "136d5650a97dbb52fdf42c6d55b330a4f9593816e344b07913b0b2ba6b5cc409",
+  "scripts/memory_engine.py": "e99d34951b953bf3d96b6fca2413192de76778e6519278d4213fa3a72bc9b05f",
   "scripts/monorepo_detector.py": "38f1eb948ee2856f175e1212956bce211effdd1327d3a31f7303d32ba9478ebe",
-  "scripts/run_manager.py": "e853874e4fb0cb697596ea338f71ba7e955f2b41a6fc649733b45fa755e94768",
+  "scripts/run_manager.py": "b576fc3be9929ee6a52e67662e67f801e4e9317c158243582911e10c94a07619",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
   "scripts/stack_detect.py": "99b7bdf9829d58ff5b8c59afd6e8b6429bbb11d830ac73dec491101cbbc41574",
-  "skills/torusguard/SKILL.md": "31a115886ffb115f2b975c4d0670e780e11ea68201559b24b20d0d0ef456058f",
-  "skills/torusguard/bootstrap.py": "7e348065a622089ab1d51e9bf4864e5b0022aaee1ccb2ecbf7057c14e792e2c7",
+  "skills/torusguard/SKILL.md": "e772e348716aee26e424ec96be5bd6750dbebcefc248bc4dab0df1e6c0e24fcf",
+  "skills/torusguard/bootstrap.py": "7c5a13687578a8736aef25cf767d1ef3c8b82dcae0eb7efce41bf131d27a120f",
   "skills/torusguard/references/auth-and-sessions.md": "34c2843f8c0dbe3574e54f00a39a92a1f431527ec5f69b2d64c84240d424a39e",
   "skills/torusguard/references/business-logic-and-abuse.md": "0d6088936bc1a01023070332fccef0f2e0734358a5119379055f3d2895c22567",
   "skills/torusguard/references/cache-and-sensitive-responses.md": "8f920cacde29c50b1f5f98de341a60db0bc607fe8c212a7e618ef7af08c86511",
@@ -66,13 +70,13 @@
   "skills/torusguard/references/webhook-security.md": "a0c7efb663c664dd840ba99b689cb67d4688643106f8b6e80d18a424c6add386",
   "skills/torusguard/references/websocket-security.md": "5624a84abd75bbb4eed029cd217e0c794ee452cbecc0730a8ab4d0f371537cd7",
   "skills/torusguard-apply/SKILL.md": "9436fa5cdefa661677ada22936a3949de06aca276e4f4bb27e0ef5b7ea34edc3",
-  "skills/torusguard-audit/SKILL.md": "d0e0c21d6c36d9d128ccce6ad628b978ff771d27552ba80e0a4981e18b9f5a51",
+  "skills/torusguard-audit/SKILL.md": "f879e280d357ea7f124c647ce39af2b24b79db608c9edd018f26e5312625a8b5",
   "skills/torusguard-authorize/SKILL.md": "da849585f2e46c08ef528b89737be14647f1109fd365fd27f3f6da57a396724b",
   "skills/torusguard-exploit-check/SKILL.md": "e9a173e154a88cc9cb929c59d79a65ab13d5cf9567b4112bd7f272746cf9c3f9",
   "skills/torusguard-full/SKILL.md": "cc97684d37de378e51fefd12f6f9a7cd15cc469ce46079a0599440aa7b073f7b",
-  "skills/torusguard-harden/SKILL.md": "86a8dee6c614477e2122287752f5c16e3688c0451d0e7ae9bfd2a23802bcdde3",
+  "skills/torusguard-harden/SKILL.md": "326fa84bda4832f96b19d73824c3472dfe185247ed3e3db9715dd943d46d9874",
   "skills/torusguard-init/SKILL.md": "1f7844d66219955581fdb266029eefdc355dbebb5741b848daf0062e606202a2",
-  "skills/torusguard-recheck/SKILL.md": "4725a9be6a6ddedb3d389d1957c7ce3e0f9ce288107816fce85b5953951e13e5",
+  "skills/torusguard-recheck/SKILL.md": "457b2a1cce064a738fbe43f0dba6b4393f1630a82f60698ea5ebe655ec017e50",
   "skills/torusguard-report/SKILL.md": "bde44d114bdc85c04472644a644a7796ed2f182a23e0c057838a3251e4910a09",
   "skills/torusguard-status/SKILL.md": "4e71d03c71b240afd7f6108569530b7da3702634c512a74ca8dc3174f3c6b0fb",
   "skills/torusguard-verify/SKILL.md": "10c19e0926255686351e3b75ae774880cf35562d42bd30b87a877bb8f284fc1f",
@@ -87,6 +91,7 @@
   "workflows/exploit-check.md": "9684009b835a61d5aca8827a971ee686a24c800425d86ef96f963dd27de845b8",
   "workflows/harden.md": "509484f844c9dcd10dd14c8bb6e3456021928e6cf6abd374faaf34be8fc34ce2",
   "workflows/init.md": "3d1668a9f6b87417c31f47c887c495f863595ed4a29074e0c5a8ee1ece1d4a35",
+  "workflows/memory.md": "c034f9266380db3c05e9ffed943c2bb4ba73c060507e3508e47b543a035a5873",
   "workflows/recheck.md": "7d374c29a5585c31b81f84fb32d6a466f2e9cb339726dc0523dba25e57bc5d13",
   "workflows/report.md": "56b3449cff362172c63093ee6150446d11bf05e3c8143661966dad9d42df1470",
   "workflows/status.md": "921129646518c592cb47ad8e8ccf3d703e8d11ea6eb89bd21a206f545e022dba",

package/skills/torusguard/payload/config/torusguard.json

@@ -1,6 +1,6 @@
 {
   "$schema": "../schemas/torusguard-config.schema.json",
-  "version": "0.9.5",
+  "version": "1.0.0",
   "product": "TorusGuard Security Skill Kit",
   "severity_threshold": "medium",
   "auto_detect_stack": true,

package/skills/torusguard/payload/schemas/memory-context.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-context.schema.json",
+  "title": "TorusGuard Memory Context Window",
+  "description": "Pre-computed, token-budgeted context window for AI agent consumption formatted as structured JSON cards.",
+  "type": "object",
+  "required": ["version", "generated_at", "token_estimate", "max_token_budget", "project_profile", "cards"],
+  "properties": {
+    "version": {
+      "type": "string",
+      "description": "TorusGuard engine version (e.g., 1.0.0)."
+    },
+    "generated_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 UTC timestamp when this context window was computed."
+    },
+    "token_estimate": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Estimated token count of this context document."
+    },
+    "max_token_budget": {
+      "type": "integer",
+      "default": 2000,
+      "description": "Maximum allowed tokens for agent context injection (default: 2000)."
+    },
+    "project_profile": {
+      "type": "object",
+      "required": ["stack", "total_events", "active_patterns_count"],
+      "properties": {
+        "stack": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Detected technology stack frameworks/languages."
+        },
+        "total_events": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "active_patterns_count": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "fix_rate_percentage": {
+          "type": ["number", "null"],
+          "minimum": 0,
+          "maximum": 100
+        },
+        "top_vulnerabilities": {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "cards": {
+      "type": "array",
+      "description": "Ordered list of high-priority intelligence cards for LLM grounding.",
+      "items": {
+        "type": "object",
+        "required": ["card_id", "card_type", "priority", "title", "summary", "card_data"],
+        "properties": {
+          "card_id": {
+            "type": "string",
+            "description": "Unique card identifier (e.g., CARD-001)."
+          },
+          "card_type": {
+            "type": "string",
+            "enum": ["pattern", "profile", "regression_watch", "false_positive", "fix_idiom"],
+            "description": "Semantic category of this context card."
+          },
+          "priority": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 100,
+            "description": "Rank order priority (higher = more relevant/critical)."
+          },
+          "title": {
+            "type": "string",
+            "description": "Short, human-readable and agent-scannable card title."
+          },
+          "summary": {
+            "type": "string",
+            "description": "One-line operational summary for rapid agent reasoning."
+          },
+          "card_data": {
+            "type": "object",
+            "description": "Structured card payload containing rule_id, fix_strategy, confidence, affected_files, etc.",
+            "additionalProperties": true
+          }
+        }
+      }
+    }
+  }
+}

package/skills/torusguard/payload/schemas/memory-event.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-event.schema.json",
+  "title": "TorusGuard Memory Event",
+  "description": "Schema for individual memory events recorded during audit/fix/recheck cycles.",
+  "type": "object",
+  "required": ["event_id", "event_type", "timestamp", "version"],
+  "properties": {
+    "event_id": {
+      "type": "string",
+      "description": "Unique event identifier (UUID v4 or timestamp-based)."
+    },
+    "event_type": {
+      "type": "string",
+      "enum": ["audit_finding", "fix_applied", "fix_verified", "false_positive", "pattern_learned", "stack_changed"],
+      "description": "Category of security event."
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 UTC timestamp."
+    },
+    "version": {
+      "type": "string",
+      "description": "TorusGuard version that recorded this event."
+    },
+    "rule_id": {
+      "type": ["string", "null"],
+      "description": "TorusGuard rule ID (e.g., TG-DB-004)."
+    },
+    "file_path": {
+      "type": ["string", "null"],
+      "description": "Relative file path within the project."
+    },
+    "line_number": {
+      "type": ["integer", "null"],
+      "description": "Line number of the finding."
+    },
+    "severity": {
+      "type": ["string", "null"],
+      "enum": ["critical", "high", "medium", "low", "info", null]
+    },
+    "confidence_score": {
+      "type": ["integer", "null"],
+      "minimum": 0,
+      "maximum": 100
+    },
+    "code_hash": {
+      "type": ["string", "null"],
+      "description": "SHA-256 hash of the relevant code snippet for pattern matching."
+    },
+    "fix_strategy": {
+      "type": ["string", "null"],
+      "description": "Human-readable description of the fix approach used."
+    },
+    "verification_result": {
+      "type": ["string", "null"],
+      "enum": ["fixed", "regressed", "partial", "not_tested", null]
+    },
+    "suppression_reason": {
+      "type": ["string", "null"],
+      "description": "Reason for false positive suppression."
+    },
+    "metadata": {
+      "type": "object",
+      "description": "Additional event-specific metadata.",
+      "additionalProperties": true
+    }
+  }
+}