torusguard 0.9.5 → 1.3.0

package/skills/torusguard/payload/skills/torusguard/references/rust-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Rust Security
+
+> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Memory Safety & Unsafe Blocks
+* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
+* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
+
+### 2. Database & SQL Queries
+* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
+* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
+
+### 3. Outbound Requests & TLS
+* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
+* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```rust
+// Safe sqlx Parameterized Query
+let user = sqlx::query_as!(
+    User,
+    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
+    user_id,
+    current_tenant_id
+)
+.fetch_one(&pool)
+.await?;
+
+// Safe reqwest Client (Strict TLS)
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(10))
+    .build()?;
+```

package/skills/torusguard/payload/skills/torusguard-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-audit
-description: Static security AST scanning, stable fingerprinting, root-cause clustering, and 0–100 confidence scoring.
-version: 0.9.2
+description: Static AST scanning, memory pattern boosting, and 0–100 confidence scoring.
+version: 1.0.0
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -9,36 +9,37 @@ scripts-binding:
   - .torusguard/scripts/run_manager.py
 ---
 
-# TorusGuard Audit — Static Code Analysis & Finding Clustering
+# TorusGuard Audit — Static Code Analysis & Memory Scanning
 
 ## Objective
-Execute static analysis across ASTs, generate line-shift invariant fingerprints, group findings into root causes, compute 0–100 confidence scores, and persist findings to `.torusguard/runs/`.
+Execute static AST analysis, query memory context, compute 0–100 confidence scores with memory boosts, and record findings to runs and memory.
 
 ---
 
 ## Execution Steps
 
-1. **Setup Run Directory:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
-2. **Load Active Rules:** Load rules from `.torusguard/rules/active/` and thresholds from `torusguard.json`.
+1. **Run Setup:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
+2. **Context & Rules:** Load `.torusguard/memory/context.json` for patterns and false positives. Load rules from `.torusguard/rules/active/`.
 3. **AST Scan Sinks:** Match files against active rules:
-   - `TG-SEC-*`: Leaked API keys, secrets.
-   - `TG-INPUT-*`: Unescaped SQL or unvalidated payloads.
-   - `TG-DB-*`: Unscoped queries omitting tenant filters (`Model.get(id=id)`).
-   - `TG-AUTH-*`: Missing `HttpOnly`/`Secure` flags; open CORS.
-   - `TG-CLIENT-*`: Admin credentials in client bundles.
-4. **Stable Fingerprinting:** Compute SHA-256 hash of normalized 3 surrounding AST lines.
-5. **Root-Cause Clustering:** Group findings by root cause (`cluster-tenant-isolation`, `cluster-raw-sql-sink`).
-6. **Confidence Scoring:** Calculate 0–100 score across 5-factor rubric via `finding_scorer.py`.
-7. **Write Run Artifacts:** Persist `findings.md`, `findings.json`, and `summary.md`.
+   - `TG-SEC-*`: Secrets and API keys.
+   - `TG-INPUT-*`: SQL injection, unvalidated input.
+   - `TG-DB-*`: Unscoped tenant queries (`Model.get(id=id)`).
+   - `TG-AUTH-*`: Insecure cookies, open CORS.
+   - `TG-CLIENT-*`: Client bundle secret leaks.
+4. **Stable Fingerprinting:** Compute SHA-256 hash of surrounding AST context.
+5. **Root-Cause Clustering:** Group findings by causal sink (`cluster-tenant-isolation`).
+6. **Scoring:** Calculate 0–100 score via `finding_scorer.py` (applies memory boost/suppression).
+7. **Write Artifacts:** Save `findings.json` and sync findings to memory engine.
 
 ---
 
 ## Confidence Scoring Rubric
-- **1. Evidence (35):** AST flow (35), regex match (20), indirect (10).
-- **2. Reproduction (25):** Deterministic test (25), simulated (15), hypothesis (0).
+- **1. Evidence (35):** AST flow (35), regex sink (20), heuristic (10).
+- **2. Reproduction (25):** Automated test (25), simulated (15), hypothesis (0).
 - **3. Corroboration (15):** >=3 files (15), 2 files (10), single (5).
-- **4. Environment (15):** Explicit route (15), minor ambiguity (8), unknown (0).
-- **5. Review Status (10):** Human verified (10), agent consensus (5), auto (0).
+- **4. Environment (15):** Explicit route (15), ambiguous (8), unknown (0).
+- **5. Review Status (10):** Human confirmed (10), agent verified (5), auto (0).
+- **Memory Modifier:** False positive (-30), regression (+15), recurring (+10).
 - **Bands:** 90–100 (`Confirmed`), 70–89 (`High`), 50–69 (`Medium`), <50 (`Review`).
 
 ---
@@ -46,17 +47,16 @@ Execute static analysis across ASTs, generate line-shift invariant fingerprints,
 ## Finding Card Format
 ```markdown
 ### [TG-DB-004] Missing Tenant Scoping in /invoices/
-- **Severity**: High | **Confidence**: 90/100 (Confirmed)
+- **Severity**: High | **Confidence**: 90/100 (Confirmed) | **Memory Boost**: +10
 - **File**: `views.py:42` | **Cluster**: `cluster-tenant-isolation`
-- **Evidence**: Unscoped query leaks records.
-- **Remediation**: Scope by `tenant=request.user.tenant`.
+- **Remediation**: Apply `.filter(tenant=request.user.tenant)`.
 ```
 
 ---
 
 ## Safety Constraints
-- Read-only execution; zero code modifications.
-- Exclude build folders (`node_modules/`, `.venv/`, `dist/`).
+- Read-only analysis; zero code modifications during audit.
+- Exclude build directories (`node_modules/`, `.venv/`, `dist/`).
 - Redact secrets before saving to `findings.md`.
 
 ---
@@ -65,6 +65,6 @@ Execute static analysis across ASTs, generate line-shift invariant fingerprints,
 ```markdown
 🛡️ [TorusGuard] Static Code Audit Completed
 - Run ID: run-YYYYMMDD-HHMMSS-audit | Files: <Count> | Findings: <Count>
-- Clusters: <Count> identified | Posture: ACTION REQUIRED
+- Clusters: <Count> identified | Memory Patterns Applied: <Count>
 Next: Run `/torusguard harden` to formulate surgical fixes.
 ```

package/skills/torusguard/payload/skills/torusguard-harden/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-harden
 description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions).
-version: 0.9.2
+version: 1.0.0
 workflow: .torusguard/workflows/harden.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -38,8 +38,8 @@ Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$
 
 1. **Select Finding:** Choose prioritized verified flaw from active run's `findings.md`.
 2. **Read AST Context:** View target file surrounding lines (±15) using `view_file`.
-3. **Formulate Minimal Fix:** Parameterize SQL, add tenant filters, insert validation schemas.
-4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$.
+3. **Formulate Minimal Fix:** Consult `.torusguard/memory/context.json` for verified idioms; parameterize SQL, add tenant filters.
+4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$ via `diff_guard.py`.
 5. **Package Bundle:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`).
 6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
 

package/skills/torusguard/payload/skills/torusguard-recheck/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-recheck
 description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
-version: 0.9.2
+version: 1.0.0
 workflow: .torusguard/workflows/recheck.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -19,10 +19,10 @@ Re-scan only files modified by remediation patches, confirming that targeted vul
 ## Execution Steps
 
 1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
-2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against the modified files.
+2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against modified files.
 3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
 4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
-5. **Update State:** Record verified status in `findings.json`.
+5. **Update State & Memory:** Record status in `findings.json` and sync verified results to memory engine.
 6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
 
 ---

package/skills/torusguard/payload/workflows/memory.md

@@ -0,0 +1,53 @@
+---
+description: TorusGuard Adaptive Security Memory Engine — view memory stats, export/import intelligence, apply TTL decay, and manage false positives.
+tools: Read, Grep, Glob, Bash
+version: 1.0.0
+agent: reviewer
+lifecycle-phase: Intelligence / Memory
+required-skills:
+  - torusguard
+scripts-binding:
+  - .torusguard/scripts/memory_engine.py
+---
+
+# /torusguard memory — Adaptive Security Memory Engine & Intelligence Management
+
+$ARGUMENTS
+
+---
+
+## Objective
+Inspect, manage, export, import, or compact persistent local security memory patterns, context window cards, and false positive suppressions.
+
+---
+
+## Subcommands & Usage
+
+| Command | Action | Description |
+| :--- | :--- | :--- |
+| `npx torusguard memory` | Status | Display memory stats, pattern count, and context token estimate |
+| `npx torusguard memory context` | Context Dump | Output the active pre-computed context window cards |
+| `npx torusguard memory fp --rule <RULE_ID>` | False Positive | Suppress rule as false positive across future scans |
+| `npx torusguard memory decay [--ttl 90]` | TTL Decay | Apply confidence decay to stale, unconfirmed patterns |
+| `npx torusguard memory export --path <FILE>` | Export | Export memory bundle for team sharing |
+| `npx torusguard memory import --path <FILE>` | Import | Merge external memory bundle into local project intelligence |
+| `npx torusguard memory compact` | Compaction | Archive raw events older than 30 days into single archive |
+
+---
+
+## Execution Steps
+
+1. **Verify Memory Subsystem:** Confirm `.torusguard/memory/` exists and is shielded by `.gitignore`.
+2. **Execute Requested Action:** Invoke `.torusguard/scripts/memory_engine.py` with appropriate action flag:
+   ```bash
+   python .torusguard/scripts/memory_engine.py --action status
+   ```
+3. **Verify Context Token Budget:** Confirm `context.json` remains within token budget ($\le 2,000$ tokens).
+4. **Display Intelligence Card:** Render summary card to user.
+
+---
+
+## Privacy & Security Invariants
+- Memory files remain strictly local under `.torusguard/memory/` and are always gitignored.
+- Memory files are never packaged into npm release tarballs.
+- Export operations only occur when explicitly invoked by user command.

package/skills/torusguard-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-audit
-description: Static security AST scanning, stable fingerprinting, root-cause clustering, and 0–100 confidence scoring.
-version: 0.9.2
+description: Static AST scanning, memory pattern boosting, and 0–100 confidence scoring.
+version: 1.0.0
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -9,36 +9,37 @@ scripts-binding:
   - .torusguard/scripts/run_manager.py
 ---
 
-# TorusGuard Audit — Static Code Analysis & Finding Clustering
+# TorusGuard Audit — Static Code Analysis & Memory Scanning
 
 ## Objective
-Execute static analysis across ASTs, generate line-shift invariant fingerprints, group findings into root causes, compute 0–100 confidence scores, and persist findings to `.torusguard/runs/`.
+Execute static AST analysis, query memory context, compute 0–100 confidence scores with memory boosts, and record findings to runs and memory.
 
 ---
 
 ## Execution Steps
 
-1. **Setup Run Directory:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
-2. **Load Active Rules:** Load rules from `.torusguard/rules/active/` and thresholds from `torusguard.json`.
+1. **Run Setup:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
+2. **Context & Rules:** Load `.torusguard/memory/context.json` for patterns and false positives. Load rules from `.torusguard/rules/active/`.
 3. **AST Scan Sinks:** Match files against active rules:
-   - `TG-SEC-*`: Leaked API keys, secrets.
-   - `TG-INPUT-*`: Unescaped SQL or unvalidated payloads.
-   - `TG-DB-*`: Unscoped queries omitting tenant filters (`Model.get(id=id)`).
-   - `TG-AUTH-*`: Missing `HttpOnly`/`Secure` flags; open CORS.
-   - `TG-CLIENT-*`: Admin credentials in client bundles.
-4. **Stable Fingerprinting:** Compute SHA-256 hash of normalized 3 surrounding AST lines.
-5. **Root-Cause Clustering:** Group findings by root cause (`cluster-tenant-isolation`, `cluster-raw-sql-sink`).
-6. **Confidence Scoring:** Calculate 0–100 score across 5-factor rubric via `finding_scorer.py`.
-7. **Write Run Artifacts:** Persist `findings.md`, `findings.json`, and `summary.md`.
+   - `TG-SEC-*`: Secrets and API keys.
+   - `TG-INPUT-*`: SQL injection, unvalidated input.
+   - `TG-DB-*`: Unscoped tenant queries (`Model.get(id=id)`).
+   - `TG-AUTH-*`: Insecure cookies, open CORS.
+   - `TG-CLIENT-*`: Client bundle secret leaks.
+4. **Stable Fingerprinting:** Compute SHA-256 hash of surrounding AST context.
+5. **Root-Cause Clustering:** Group findings by causal sink (`cluster-tenant-isolation`).
+6. **Scoring:** Calculate 0–100 score via `finding_scorer.py` (applies memory boost/suppression).
+7. **Write Artifacts:** Save `findings.json` and sync findings to memory engine.
 
 ---
 
 ## Confidence Scoring Rubric
-- **1. Evidence (35):** AST flow (35), regex match (20), indirect (10).
-- **2. Reproduction (25):** Deterministic test (25), simulated (15), hypothesis (0).
+- **1. Evidence (35):** AST flow (35), regex sink (20), heuristic (10).
+- **2. Reproduction (25):** Automated test (25), simulated (15), hypothesis (0).
 - **3. Corroboration (15):** >=3 files (15), 2 files (10), single (5).
-- **4. Environment (15):** Explicit route (15), minor ambiguity (8), unknown (0).
-- **5. Review Status (10):** Human verified (10), agent consensus (5), auto (0).
+- **4. Environment (15):** Explicit route (15), ambiguous (8), unknown (0).
+- **5. Review Status (10):** Human confirmed (10), agent verified (5), auto (0).
+- **Memory Modifier:** False positive (-30), regression (+15), recurring (+10).
 - **Bands:** 90–100 (`Confirmed`), 70–89 (`High`), 50–69 (`Medium`), <50 (`Review`).
 
 ---
@@ -46,17 +47,16 @@ Execute static analysis across ASTs, generate line-shift invariant fingerprints,
 ## Finding Card Format
 ```markdown
 ### [TG-DB-004] Missing Tenant Scoping in /invoices/
-- **Severity**: High | **Confidence**: 90/100 (Confirmed)
+- **Severity**: High | **Confidence**: 90/100 (Confirmed) | **Memory Boost**: +10
 - **File**: `views.py:42` | **Cluster**: `cluster-tenant-isolation`
-- **Evidence**: Unscoped query leaks records.
-- **Remediation**: Scope by `tenant=request.user.tenant`.
+- **Remediation**: Apply `.filter(tenant=request.user.tenant)`.
 ```
 
 ---
 
 ## Safety Constraints
-- Read-only execution; zero code modifications.
-- Exclude build folders (`node_modules/`, `.venv/`, `dist/`).
+- Read-only analysis; zero code modifications during audit.
+- Exclude build directories (`node_modules/`, `.venv/`, `dist/`).
 - Redact secrets before saving to `findings.md`.
 
 ---
@@ -65,6 +65,6 @@ Execute static analysis across ASTs, generate line-shift invariant fingerprints,
 ```markdown
 🛡️ [TorusGuard] Static Code Audit Completed
 - Run ID: run-YYYYMMDD-HHMMSS-audit | Files: <Count> | Findings: <Count>
-- Clusters: <Count> identified | Posture: ACTION REQUIRED
+- Clusters: <Count> identified | Memory Patterns Applied: <Count>
 Next: Run `/torusguard harden` to formulate surgical fixes.
 ```

package/skills/torusguard-harden/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-harden
 description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions).
-version: 0.9.2
+version: 1.0.0
 workflow: .torusguard/workflows/harden.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -38,8 +38,8 @@ Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$
 
 1. **Select Finding:** Choose prioritized verified flaw from active run's `findings.md`.
 2. **Read AST Context:** View target file surrounding lines (±15) using `view_file`.
-3. **Formulate Minimal Fix:** Parameterize SQL, add tenant filters, insert validation schemas.
-4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$.
+3. **Formulate Minimal Fix:** Consult `.torusguard/memory/context.json` for verified idioms; parameterize SQL, add tenant filters.
+4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$ via `diff_guard.py`.
 5. **Package Bundle:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`).
 6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
 

package/skills/torusguard-recheck/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-recheck
 description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
-version: 0.9.2
+version: 1.0.0
 workflow: .torusguard/workflows/recheck.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -19,10 +19,10 @@ Re-scan only files modified by remediation patches, confirming that targeted vul
 ## Execution Steps
 
 1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
-2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against the modified files.
+2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against modified files.
 3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
 4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
-5. **Update State:** Record verified status in `findings.json`.
+5. **Update State & Memory:** Record status in `findings.json` and sync verified results to memory engine.
 6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
 
 ---