torusguard 1.0.0 → 1.3.0

package/bin/torusguard.js

@@ -49,7 +49,7 @@ function printHelp() {
   console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.0.0${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.3.0${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}   ${DIM}Autonomous Security Engine for AI-Built Applications${RESET}               ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
@@ -61,11 +61,22 @@ function printHelp() {
   ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
   ${CYAN}│${RESET}  ${GREEN}init${RESET}      Scaffold ${BOLD}.torusguard/${RESET} workspace + unlock 12 slash commands   ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}status${RESET}    Display active security posture, memory, rules, and stack   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}memory${RESET}    Manage persistent security memory (export, import, decay)   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}rules${RESET}     Auto-sync memory to AI IDE rules (.cursorrules, CLAUDE.md)  ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}memory${RESET}    Manage persistent security memory (export, hook, learn)     ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}audit${RESET}     Run static AST security scan on the target project          ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}report${RESET}    Export OASIS SARIF v2.1.0 structured telemetry              ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}report${RESET}    Export OASIS SARIF v2.1.0 or single-file visual HTML report ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}diff-guard${RESET} Scan diffs or wire pre-commit hook (--install-hook)        ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}help${RESET}      Show this interactive command guide                         ${CYAN}│${RESET}
   ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
+  ${CYAN}│${RESET}  ${BOLD}AI & Memory Subcommands${RESET}                                               ${CYAN}│${RESET}
+  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
+  ${CYAN}│${RESET}  ${WHITE}rules sync${RESET}       ${DIM}[--format all|cursor|claude|agent|windsurf]${RESET}        ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}report --html${RESET}    ${DIM}[--out <path>] Self-contained visual HTML dashboard${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory context${RESET}   ${DIM}[--role auditor|remediator|reviewer] [--file <f>]${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory hook${RESET}      ${DIM}[install|uninstall] Git pre-commit regression hook${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory learn${RESET}     ${DIM}[--commits <range>] Ingest security commit fixes${RESET}     ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory export${RESET}    ${DIM}[--path <file>] [--sanitized] Safe team sharing${RESET}      ${CYAN}│${RESET}
+  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
   ${CYAN}│${RESET}  ${BOLD}Options${RESET}                                                               ${CYAN}│${RESET}
   ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
   ${CYAN}│${RESET}  ${GRAY}--target <dir>${RESET}   Target directory to analyze or scaffold ${DIM}(default: .)${RESET}  ${CYAN}│${RESET}
@@ -126,7 +137,7 @@ if (command === 'status') {
       console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.0.0${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.3.0${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
 
@@ -190,6 +201,18 @@ if (command === 'memory') {
     pyArgs.push('--action', 'status');
   } else if (sub === 'context') {
     pyArgs.push('--action', 'context');
+    const roleIdx = args.indexOf('--role');
+    if (roleIdx !== -1 && args[roleIdx + 1]) {
+      pyArgs.push('--role', args[roleIdx + 1]);
+    }
+    const fileIdx = args.indexOf('--file') !== -1 ? args.indexOf('--file') : args.indexOf('-f');
+    if (fileIdx !== -1 && args[fileIdx + 1]) {
+      pyArgs.push('--file', args[fileIdx + 1]);
+    }
+    const ruleIdx = args.indexOf('--rule') !== -1 ? args.indexOf('--rule') : args.indexOf('-r');
+    if (ruleIdx !== -1 && args[ruleIdx + 1]) {
+      pyArgs.push('--rule-id', args[ruleIdx + 1]);
+    }
   } else if (sub === 'distill') {
     pyArgs.push('--action', 'distill');
   } else if (sub === 'decay') {
@@ -212,6 +235,9 @@ if (command === 'memory') {
     } else {
       pyArgs.push('--target', 'torusguard-memory-export.json');
     }
+    if (args.includes('--sanitized')) {
+      pyArgs.push('--sanitized');
+    }
   } else if (sub === 'import') {
     pyArgs.push('--action', 'import');
     const pathIdx = args.indexOf('--path') !== -1 ? args.indexOf('--path') : args.indexOf('-p');
@@ -221,6 +247,21 @@ if (command === 'memory') {
       console.error(`${RED}Error: --path <file> is required for memory import${RESET}`);
       process.exit(1);
     }
+  } else if (sub === 'hook') {
+    const hookAction = args[2] === 'uninstall' ? 'hook-uninstall' : 'hook-install';
+    pyArgs.push('--action', hookAction);
+  } else if (sub === 'learn') {
+    pyArgs.push('--action', 'learn');
+    const commitsIdx = args.indexOf('--commits');
+    if (commitsIdx !== -1 && args[commitsIdx + 1]) {
+      pyArgs.push('--commits', args[commitsIdx + 1]);
+    }
+    const daysIdx = args.indexOf('--days');
+    if (daysIdx !== -1 && args[daysIdx + 1]) {
+      pyArgs.push('--days', args[daysIdx + 1]);
+    }
+  } else if (sub === 'recipe') {
+    pyArgs.push('--action', 'recipe', ...args.slice(2));
   } else if (sub === 'fp') {
     pyArgs.push('--action', 'fp');
     const ruleIdx = args.indexOf('--rule') !== -1 ? args.indexOf('--rule') : args.indexOf('-r');
@@ -242,6 +283,69 @@ if (command === 'memory') {
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
+// Subcommand: diff-guard
+if (command === 'diff-guard') {
+  const diffScript = path.join(cwd, '.torusguard', 'scripts', 'diff_guard.py');
+  const fallbackDiffScript = path.join(rootDir, '.torusguard', 'scripts', 'diff_guard.py');
+  const actualDiffScript = fs.existsSync(diffScript) ? diffScript : fallbackDiffScript;
+
+  const proc = spawnSync(pythonCmd, [actualDiffScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: rules
+if (command === 'rules') {
+  const sub = args[1] || 'sync';
+  const rulesScript = path.join(cwd, '.torusguard', 'scripts', 'rules_sync.py');
+  const fallbackRulesScript = path.join(rootDir, '.torusguard', 'scripts', 'rules_sync.py');
+  const actualRulesScript = fs.existsSync(rulesScript) ? rulesScript : fallbackRulesScript;
+
+  let pyArgs = [actualRulesScript];
+  if (sub === 'sync') {
+    const fmtIdx = args.indexOf('--format');
+    if (fmtIdx !== -1 && args[fmtIdx + 1]) {
+      pyArgs.push('--format', args[fmtIdx + 1]);
+    }
+    const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : args.indexOf('--target');
+    if (rootIdx !== -1 && args[rootIdx + 1]) {
+      pyArgs.push('--root', args[rootIdx + 1]);
+    }
+    if (args.includes('--json')) {
+      pyArgs.push('--json');
+    }
+  } else {
+    pyArgs.push(...args.slice(1));
+  }
+
+  const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: report
+if (command === 'report') {
+  if (args.includes('--html') || args[1] === 'html') {
+    const htmlScript = path.join(cwd, '.torusguard', 'scripts', 'html_reporter.py');
+    const fallbackHtmlScript = path.join(rootDir, '.torusguard', 'scripts', 'html_reporter.py');
+    const actualHtmlScript = fs.existsSync(htmlScript) ? htmlScript : fallbackHtmlScript;
+
+    let pyArgs = [actualHtmlScript];
+    const outIdx = args.indexOf('--out');
+    if (outIdx !== -1 && args[outIdx + 1]) {
+      pyArgs.push('--out', args[outIdx + 1]);
+    }
+    const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : args.indexOf('--target');
+    if (rootIdx !== -1 && args[rootIdx + 1]) {
+      pyArgs.push('--root', args[rootIdx + 1]);
+    }
+    if (args.includes('--json')) {
+      pyArgs.push('--json');
+    }
+
+    const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
+    process.exit(proc.status !== null ? proc.status : 0);
+  }
+}
+
 // Locate bootstrap / runner scripts
 const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
 const localInstall = path.join(rootDir, 'install.py');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.0.0",
+  "version": "1.3.0",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {

package/skills/torusguard/bootstrap.py

@@ -15,12 +15,12 @@ from pathlib import Path
 # Ensure UTF-8 stdout/stderr on Windows consoles
 if sys.stdout and hasattr(sys.stdout, "reconfigure"):
     try:
-        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
     except Exception:
         pass
 if sys.stderr and hasattr(sys.stderr, "reconfigure"):
     try:
-        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+        getattr(sys.stderr, "reconfigure")(encoding="utf-8", errors="replace")
     except Exception:
         pass
 

package/skills/torusguard/payload/.manifest.json

@@ -1,5 +1,5 @@
 {
-  "ARCHITECTURE.md": "0ecacc797932daaf95ccf5032c47f11550c9b6fe07cdfece5c075e11ec5e9cf7",
+  "ARCHITECTURE.md": "cdc690a856e82574a6574ab6b1ad8a2d8b3b8264c36931c6212321066eed82e4",
   "TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
   "agents/auditor.md": "4ba2c92982823d0886c7ae369126cd5ddd322085a85d3b7e7fa23154f8753314",
   "agents/profiler.md": "0ee9ebbddf4ebd557d454dda8472fffea471e263abeccf40298163084b7ce9a9",
@@ -7,94 +7,108 @@
   "agents/reviewer.md": "69b280bb8a7b2fe425644d01a6f9cb454f9629f348782cd14968657076977c28",
   "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
-  "config/slash-commands.json": "5390f0d26f8117a62e56c58147d3a0d2deab1a20956302b212703281d13fa84e",
-  "config/torusguard.json": "b979d6ead31e64a63729e050d820f3e3228d3c825972a60ccae2087e6b27f574",
-  "references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
-  "references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
-  "references/express-security.md": "dff1db15e614d29d8c272f9da345b418077e62dc883fe210c7a50c552c76493f",
-  "references/fastapi-security.md": "933a08a3f096f70cb75c6a1e6d887c96a1613bb9f9def3904bb76e8c21cc7668",
-  "references/firebase-security.md": "11b1c51d530ff70230e2419475fceb9382f05c4334145366c66bb1304448f5b5",
-  "references/flask-security.md": "96d438980272f6fa95c825ef01baae55989c19618470b044dde1458a421a92f4",
-  "references/nextjs-security.md": "57f17d00ce24bf06d2826ab9d774177342ff892f6c9bc4193d6b65345d6c7661",
-  "references/react-vite-security.md": "d6468a6f623f02e58250a43327e27825b5dc7df34edf6ee27da2398bab94d6a4",
-  "references/sqlalchemy-security.md": "50421be1fba477721f9f1f5a877d4359420cf61ee9bda136e21998a3c1338e1c",
-  "references/supabase-security.md": "52a53aff66b3d94e5d07484f458252015ad3d713fa07162f59db89581ee597b6",
+  "config/slash-commands.json": "305c1dc5b556e8d64ad9dd585dafac1a9955cf1bd5321429955b19b7a62736b6",
+  "config/torusguard.json": "55dbde335997421a01c97709fd1672ad70fa921bfe8346dd57552b799db2419e",
+  "references/csharp-security.md": "d6e267855b08ed4fdff26f3b876f089ae1f90a7ec6546cba7e8173380d9daa9d",
+  "references/django-security.md": "26ea5535ac435e61489df1e381ac62b19e81702edfe095e78c937be93fa15ea7",
+  "references/drf-security.md": "c6796398317b0f264d89fff598404e126d819e69e1ea0a5129924a5eb2a7af9d",
+  "references/express-security.md": "3b9896c4c9cfac3199c830db07c661bad1d4529863cab77605db760550def98e",
+  "references/fastapi-security.md": "45136325e7cc65aa78af848636f6e18fc0e871978599505cff3ac95c5823d3d4",
+  "references/firebase-security.md": "c49eaf58e28b7aa37234ea09f13716fe78357521cdd260d5e536d920e9f406b7",
+  "references/flask-security.md": "f359ffdb6ca8c60eaccde2767c8177ed1e2d4fd1391d869405026262fda79f25",
+  "references/go-security.md": "a008606e7698c372140c2c5f5e0ec3c11ac34ae760847650a99c0aee102e6138",
+  "references/java-security.md": "6f27483e271be9d73af0d00fee280a74aeafb08f584cd3313ca349936f779ee6",
+  "references/nextjs-security.md": "4cfa06225a31bc415501ca7d58adc8c12078cc263b78770ae398c7dadcb1e7a2",
+  "references/polyglot-security-matrix.md": "d69453814969b5fd33800baa77433b7ae9564264153cddfd45aa0b87756ed919",
+  "references/react-vite-security.md": "bcc6c38644ff6c939059f12d0f4fc34d3abd338a6c1a0e8406addcd3e50fae45",
+  "references/rust-security.md": "3975f69bb0d983171b521766ca9e0022632acff83439d2f0406599a551702a64",
+  "references/sqlalchemy-security.md": "a3671325d4d0dfac95c2f9ef41fa7fccb440400e35dd53bcd0c1984e48626cb2",
+  "references/supabase-security.md": "4f057d247c9b35a29105ed5e9f74c61b378b33cbc674cbcfa82dbb8174f98ac5",
   "rules/README.md": "a1b80344b0ca199a4917bdbd00463a8ae1459187f65467dbd627ce93a103042e",
-  "rules/TORUSGUARD.md": "fc7e0852ae0a92c45017f11dbc83c562b94ab957e7816d9903b95fb6849a9e5b",
-  "rules/active/TG-DIFF-001.md": "f67be0f2725eb23c3d11a8a7a4c29dcee648d3f9743e122a2197e8892f4da4de",
-  "rules/active/TG-DIFF-002.md": "1058cf5ba4e700176cf74eb55fb6304d320d3be5fdd011c5c61780d2a99c1a0e",
-  "rules/active/TG-DIFF-003.md": "0ffc0872ba4e0db9d087d5f2764d5d178401d2fab3cb1d129b387452ca489741",
-  "schemas/authorization.schema.json": "59af3c6038270e0bc3541a353b2a4a53b7f5d11a37e0012875d6a69c0f1d0bab",
-  "schemas/confidence.schema.json": "08b3a564d7370e123dd5bfadde9fb077d2954e36b523685b9e1d7bdd2aa4b8cb",
-  "schemas/evidence.schema.json": "d3dcaa10fd2420a4046ea68836fb836a55d003ada4cdc6682229f232881182bf",
-  "schemas/finding.schema.json": "e0a7c28fa4a5f84bdedb5cf5223da26348250d633479d2dbf7ce3ebd6790a852",
+  "rules/TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
+  "rules/active/TG-DIFF-001.md": "9633466d6aa787ddb0d9df40a18b1bc31c1e12d59d2e11e7ceac4ad8e042770c",
+  "rules/active/TG-DIFF-002.md": "330f5200eb93da0b7a25515d3cc0f37839e0d91cc8ee0b870663f70c554211a3",
+  "rules/active/TG-DIFF-003.md": "f87730a95446f685f80ac859740883013d832a3c681355fe34ddab0b45e377b8",
+  "rules/custom/README.md": "f2128661ad3bc4085a69ddfbabbb2211930215fc42a25e2ab2d3e7a4b749a639",
+  "schemas/authorization.schema.json": "84885c9edc930a22c777d8685219f1f25b5320c0c6062722e3ba09f1fe417ad4",
+  "schemas/confidence.schema.json": "09c5098f55f3936e9231ba417ace4fa7aa9ebc49233b4bfa88a4103ef6f1202c",
+  "schemas/evidence.schema.json": "7dff029c34965e9aeee932028d11bf30d4f3ff76f8137af382bf3d3dc2c0df10",
+  "schemas/finding.schema.json": "2cf5f7e29b2544e9dc92069394f5eb2b77bc06e8e3daaccfeea5021d177758a8",
+  "schemas/golden-recipe.schema.json": "027d7216e3d000b742ee53d8a5653586aca6a25c69e7b35de4321075ab0206d4",
   "schemas/memory-context.schema.json": "6b9e032c55ba87b2517dd1e7ca0043b8e2439e85fa4a6eac6fc6041f3091e571",
   "schemas/memory-event.schema.json": "4f653610e04fd480325d0ec77a4339bea4690f85e1d2fa0bd4f6b654c813c905",
   "schemas/memory-pattern.schema.json": "df4aae2a3034a7c64ec50b3ae27b6ee9296aac7371c2a1938508834e5f778afe",
-  "schemas/provenance.schema.json": "781215801249532414643638b6608dc8f52febc9bca43ae03827b90aecc03256",
-  "schemas/remediation.schema.json": "217cb2743ae1a912dc074382e9f05634da93f2e30a880c03f6020600ef7e43d3",
-  "schemas/retest.schema.json": "773b764082f6d2e8c3656ea105e0ce09febd1020520bf262bbcd17f5924da11e",
-  "schemas/runtime-evidence.schema.json": "dbe13741a7fb68cca2a044d47a644ee0bdaacb83a28621dc2a98bffdd59989a6",
-  "scripts/diff_guard.py": "5937b657c1047c78b7b9f0a36f3438cb699457cdb5ee56136d68b97edf56af42",
-  "scripts/finding_scorer.py": "c9f34c9153f5322c92bba824ce199ea281c450cd8edc637e61442c5f556d6183",
-  "scripts/manifest_builder.py": "136d5650a97dbb52fdf42c6d55b330a4f9593816e344b07913b0b2ba6b5cc409",
-  "scripts/memory_engine.py": "e99d34951b953bf3d96b6fca2413192de76778e6519278d4213fa3a72bc9b05f",
-  "scripts/monorepo_detector.py": "38f1eb948ee2856f175e1212956bce211effdd1327d3a31f7303d32ba9478ebe",
+  "schemas/provenance.schema.json": "8b8e8ddb5c2ca643ae2d5ef6503eceddad3bd4ebe7ae8dd2449090c2ad24e818",
+  "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
+  "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
+  "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
+  "scripts/diff_guard.py": "c2bb88f6e958063c16c06d35eba747ee259bbe79077c7194c3e2eb427195bf70",
+  "scripts/finding_scorer.py": "54c574019b31065dd8fe3bd61676657c2db0f0cf7275e308b7bf933536d422b9",
+  "scripts/html_reporter.py": "540929c9c79369bc8b6fae58857bb80b6fd492041168f5f1e4ea69ab6d324d84",
+  "scripts/manifest_builder.py": "ce351a18ed5092099019d4f469a8cf9c4ae186a426ff9c711ee2c0402755abb9",
+  "scripts/memory_engine.py": "05ae1f17e7b4dc9a79aab429427c2cf401846d9e710dd6c3fe317d834b157529",
+  "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
+  "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
   "scripts/run_manager.py": "b576fc3be9929ee6a52e67662e67f801e4e9317c158243582911e10c94a07619",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
-  "scripts/stack_detect.py": "99b7bdf9829d58ff5b8c59afd6e8b6429bbb11d830ac73dec491101cbbc41574",
+  "scripts/stack_detect.py": "7848006e3cd6e828f7dbe189a8c9728abd58e021ff02efbc4230ef8ca3444596",
   "skills/torusguard/SKILL.md": "e772e348716aee26e424ec96be5bd6750dbebcefc248bc4dab0df1e6c0e24fcf",
-  "skills/torusguard/bootstrap.py": "7c5a13687578a8736aef25cf767d1ef3c8b82dcae0eb7efce41bf131d27a120f",
-  "skills/torusguard/references/auth-and-sessions.md": "34c2843f8c0dbe3574e54f00a39a92a1f431527ec5f69b2d64c84240d424a39e",
-  "skills/torusguard/references/business-logic-and-abuse.md": "0d6088936bc1a01023070332fccef0f2e0734358a5119379055f3d2895c22567",
-  "skills/torusguard/references/cache-and-sensitive-responses.md": "8f920cacde29c50b1f5f98de341a60db0bc607fe8c212a7e618ef7af08c86511",
-  "skills/torusguard/references/client-code-exposure.md": "1810b18c3b89a25d3f5ef9bc53a721b9d05179bcd2086d6679ad1f29f5403bb9",
-  "skills/torusguard/references/csrf-and-cross-origin.md": "1bab49feee1f31fa6b280ddba893fe5ffa0c3c9ac0a46fc4d6c96c1206b32204",
-  "skills/torusguard/references/dependency-and-supply-chain.md": "3b429214af8d1271f5e6dc24ac5ecc9a7bdaff6116a96dc60a89a2057d8d1d2a",
-  "skills/torusguard/references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
-  "skills/torusguard/references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
-  "skills/torusguard/references/fastapi-security.md": "933a08a3f096f70cb75c6a1e6d887c96a1613bb9f9def3904bb76e8c21cc7668",
-  "skills/torusguard/references/flask-security.md": "96d438980272f6fa95c825ef01baae55989c19618470b044dde1458a421a92f4",
-  "skills/torusguard/references/frontend-no-db.md": "a543c8107605777a16a0abfd5ebbaca6f216ac50f078a8c3ef485a5afe6bfdca",
-  "skills/torusguard/references/graphql-security.md": "486e7a54e9ad677ff6d08016f0d4e1f173ccbba5c89e7e806a7097e3265442cd",
-  "skills/torusguard/references/input-and-injection.md": "e632ab3031088f3f13be826886430ea7f0abf02922e29c26507f3c234c00f00d",
-  "skills/torusguard/references/mass-assignment-and-property-auth.md": "fcddd881573c1bc8fc703a796b1ddc9ba9bd8e0cc0d51d8e9a59e79cc9a5ebd9",
-  "skills/torusguard/references/platform-hardening.md": "c58d1a86536cbaeb548d8cfeaa298e3662a4367854512858bbf594735dc6f717",
-  "skills/torusguard/references/python-dependencies.md": "34969226665d60d22e658a1801cb6857a56ea669859abcf617a8b985a26f952d",
-  "skills/torusguard/references/python-security-overview.md": "2165747d64b86b12a744ee4f21ea918678bd6a179793a37bd02b2c0953190a9b",
-  "skills/torusguard/references/rate-limit-and-abuse.md": "77c5c982d9e28d7e3c1871172bdbfe76542e356d97f2197f5df0a4f56405bc21",
-  "skills/torusguard/references/secrets-and-config.md": "9abe5fe9e6556a2ffc1460876e9c98f6eacf683cd0d8a7dba82eaeef825133c6",
-  "skills/torusguard/references/sqlalchemy-security.md": "50421be1fba477721f9f1f5a877d4359420cf61ee9bda136e21998a3c1338e1c",
-  "skills/torusguard/references/ssrf-and-outbound-requests.md": "31c6c69ba14ca4a1fb866654f6c89a5c8edd636724c9d349be94c160c976749c",
-  "skills/torusguard/references/webhook-security.md": "a0c7efb663c664dd840ba99b689cb67d4688643106f8b6e80d18a424c6add386",
-  "skills/torusguard/references/websocket-security.md": "5624a84abd75bbb4eed029cd217e0c794ee452cbecc0730a8ab4d0f371537cd7",
-  "skills/torusguard-apply/SKILL.md": "9436fa5cdefa661677ada22936a3949de06aca276e4f4bb27e0ef5b7ea34edc3",
+  "skills/torusguard/bootstrap.py": "01aaf2d627eeff27b5b7343125cb0a7de09371b157d44e622eae59082b2b8e41",
+  "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
+  "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
+  "skills/torusguard/references/cache-and-sensitive-responses.md": "81b4a7a08e11dafa4ec58d868c4a35f1f891d0dcdcfbcefaef81e1b9ba94f5a1",
+  "skills/torusguard/references/client-code-exposure.md": "b1628410e3dc51990a1653d6d3e3aaefbc2b5f43477b4424b46da6141bfe6984",
+  "skills/torusguard/references/csharp-security.md": "d6e267855b08ed4fdff26f3b876f089ae1f90a7ec6546cba7e8173380d9daa9d",
+  "skills/torusguard/references/csrf-and-cross-origin.md": "2e5001f9e5668beea29985be59dd7272f85640877b55af49c877f5fb8aa70320",
+  "skills/torusguard/references/dependency-and-supply-chain.md": "f54cc745217a8c49b86673794e58fd12e91774e7a2fd66d7e9d27f1a7fde16a8",
+  "skills/torusguard/references/django-security.md": "26ea5535ac435e61489df1e381ac62b19e81702edfe095e78c937be93fa15ea7",
+  "skills/torusguard/references/drf-security.md": "c6796398317b0f264d89fff598404e126d819e69e1ea0a5129924a5eb2a7af9d",
+  "skills/torusguard/references/fastapi-security.md": "45136325e7cc65aa78af848636f6e18fc0e871978599505cff3ac95c5823d3d4",
+  "skills/torusguard/references/flask-security.md": "f359ffdb6ca8c60eaccde2767c8177ed1e2d4fd1391d869405026262fda79f25",
+  "skills/torusguard/references/frontend-no-db.md": "f0aa4e25c8a144b8a05b0c4c27a4d779e49ba63c4ca6b1cc591ab5a15e7762ba",
+  "skills/torusguard/references/go-security.md": "a008606e7698c372140c2c5f5e0ec3c11ac34ae760847650a99c0aee102e6138",
+  "skills/torusguard/references/graphql-security.md": "081135fd7709fcbd2ed7bd63452454153e8e42d6b0e1118edac4155b21e180d2",
+  "skills/torusguard/references/input-and-injection.md": "dfef3af6162eb5ad9b9f516e25f69827f065b36f238facc51554eeecab4d2038",
+  "skills/torusguard/references/java-security.md": "6f27483e271be9d73af0d00fee280a74aeafb08f584cd3313ca349936f779ee6",
+  "skills/torusguard/references/mass-assignment-and-property-auth.md": "124c697286476990591d43d5a11a1a65db8b0fa72e2e6cd37c60796d2b2ccf5e",
+  "skills/torusguard/references/platform-hardening.md": "b21a2cf735711890982e86ff5c385e7574febcd7011637f35997c6dc203ccc63",
+  "skills/torusguard/references/polyglot-security-matrix.md": "d69453814969b5fd33800baa77433b7ae9564264153cddfd45aa0b87756ed919",
+  "skills/torusguard/references/python-dependencies.md": "1fc00572c52583ecf38e561add0818298085e7f9bdfb329532a6d78b9ec6ca83",
+  "skills/torusguard/references/python-security-overview.md": "a234646fc8ccf77fb84decd2fbb18b057a196807796603d0d453ece8c18397f7",
+  "skills/torusguard/references/rate-limit-and-abuse.md": "cbf5776f0ef57a54e76ab3d0d6d5b24d77c1cd4efbc6a24e4c827d8623ea98de",
+  "skills/torusguard/references/rust-security.md": "3975f69bb0d983171b521766ca9e0022632acff83439d2f0406599a551702a64",
+  "skills/torusguard/references/secrets-and-config.md": "21dac9bb94d1b08f2eef938afa073270f8be54b454dbfaf454347a1503ef8e8e",
+  "skills/torusguard/references/sqlalchemy-security.md": "a3671325d4d0dfac95c2f9ef41fa7fccb440400e35dd53bcd0c1984e48626cb2",
+  "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
+  "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
+  "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
+  "skills/torusguard-apply/SKILL.md": "09ddf90b436eae0fd54264dbf3c34f564a4481ec4806e2dcf311bfee5ce44d6b",
   "skills/torusguard-audit/SKILL.md": "f879e280d357ea7f124c647ce39af2b24b79db608c9edd018f26e5312625a8b5",
-  "skills/torusguard-authorize/SKILL.md": "da849585f2e46c08ef528b89737be14647f1109fd365fd27f3f6da57a396724b",
-  "skills/torusguard-exploit-check/SKILL.md": "e9a173e154a88cc9cb929c59d79a65ab13d5cf9567b4112bd7f272746cf9c3f9",
-  "skills/torusguard-full/SKILL.md": "cc97684d37de378e51fefd12f6f9a7cd15cc469ce46079a0599440aa7b073f7b",
+  "skills/torusguard-authorize/SKILL.md": "689729cfebbf6880869ef4ab1b43657f35c873a782f87a03f26727550f7964d4",
+  "skills/torusguard-exploit-check/SKILL.md": "c674040a917d95190e198b5fe386a0f08b00424e2037b814a133fa8bf1449f73",
+  "skills/torusguard-full/SKILL.md": "f7da4dbd708b31710bddeb5a1f30e1273b134fee1daae89399a17b596ff0128b",
   "skills/torusguard-harden/SKILL.md": "326fa84bda4832f96b19d73824c3472dfe185247ed3e3db9715dd943d46d9874",
-  "skills/torusguard-init/SKILL.md": "1f7844d66219955581fdb266029eefdc355dbebb5741b848daf0062e606202a2",
+  "skills/torusguard-init/SKILL.md": "534a1a4aff2510dbf7924fe74d7d338ed352f757a23b1c5427b9f758019cd911",
   "skills/torusguard-recheck/SKILL.md": "457b2a1cce064a738fbe43f0dba6b4393f1630a82f60698ea5ebe655ec017e50",
-  "skills/torusguard-report/SKILL.md": "bde44d114bdc85c04472644a644a7796ed2f182a23e0c057838a3251e4910a09",
-  "skills/torusguard-status/SKILL.md": "4e71d03c71b240afd7f6108569530b7da3702634c512a74ca8dc3174f3c6b0fb",
-  "skills/torusguard-verify/SKILL.md": "10c19e0926255686351e3b75ae774880cf35562d42bd30b87a877bb8f284fc1f",
-  "skills/torusguard-web-validate/SKILL.md": "0d159f0d75f06ca97f64a52f3e414c873f8bb84b87a8230693237cde302e76ac",
+  "skills/torusguard-report/SKILL.md": "f6f6de3a8b56c4538d02307c5afaf99c508561140cccfe8ea16c2ae87768b64d",
+  "skills/torusguard-status/SKILL.md": "23afc632b70b80304952e2559a109d5877f97a048039a818a65b378dc604e19e",
+  "skills/torusguard-verify/SKILL.md": "842ca8ca3ad194886605a7fafb98d4309cba695b86a627b24206b5b139eef5c6",
+  "skills/torusguard-web-validate/SKILL.md": "b3cd9952601cfe89dbe98765bd61be22b434e5aaf5700751348591919e595ad4",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "ca7fe662f5af462d036d17ecc7e82ab8a08e1989325e9e037df6364af96e2706",
-  "workflows/audit.md": "d924b7c02d7a380c68e5c8faa69103194b098119e34c5b427585eec66f8081ca",
-  "workflows/authorize.md": "a797addf98eb0cf29acbc9dc8f21f0d61ea93cc83255379d4722ab5ce86a4c29",
-  "workflows/exploit-check.md": "9684009b835a61d5aca8827a971ee686a24c800425d86ef96f963dd27de845b8",
-  "workflows/harden.md": "509484f844c9dcd10dd14c8bb6e3456021928e6cf6abd374faaf34be8fc34ce2",
-  "workflows/init.md": "3d1668a9f6b87417c31f47c887c495f863595ed4a29074e0c5a8ee1ece1d4a35",
+  "workflows/apply.md": "dc66ef6c59ecf1996d45921ac83ba5dd2503a9f3624c8e6f24568745a072b871",
+  "workflows/audit.md": "969df4767b311f6468fb10ad4c98c302feb7112bafa86c14c59c8b9f5d481c89",
+  "workflows/authorize.md": "1ac2e3adb367a04bd20b2b6a062f6a65703e4aa6a815fe0affc0697faa433588",
+  "workflows/exploit-check.md": "67073930ea86219a4efd54dac4206dfc37775a660ff1b6960ed2bfea0528b4a0",
+  "workflows/harden.md": "56d7f8098f19c34bc581a49b5e4bacc42858606ebf1cc35c848bdfaca8744409",
+  "workflows/init.md": "d1e6ae9a98c30b2c3b46081c8195f524bcd8d3bc9004562d230b56c704fec02b",
   "workflows/memory.md": "c034f9266380db3c05e9ffed943c2bb4ba73c060507e3508e47b543a035a5873",
-  "workflows/recheck.md": "7d374c29a5585c31b81f84fb32d6a466f2e9cb339726dc0523dba25e57bc5d13",
-  "workflows/report.md": "56b3449cff362172c63093ee6150446d11bf05e3c8143661966dad9d42df1470",
-  "workflows/status.md": "921129646518c592cb47ad8e8ccf3d703e8d11ea6eb89bd21a206f545e022dba",
-  "workflows/verify.md": "e1041c38e8ada59788f66ac1bc754313a4c966c36f4c13aa6d9d9a2b90d9e06c",
-  "workflows/web-validate.md": "d3db1fea264cd89addffbc227d8452987b050e533993c394d537f50c177224d4"
+  "workflows/recheck.md": "106442712bfb87c6c1c9bc0ed660c6c291d4d6a0a6b860f4f93397440dba08d5",
+  "workflows/report.md": "35c7cc44d94ee49d8fea6b75ae7ea524790fd0e6208b5f27b84bc4fdab469b0c",
+  "workflows/status.md": "a14a92b8b4c30fdf9e9c073c51de4d0057f43519df03e9661117e62e65ac1d08",
+  "workflows/verify.md": "f96e8db92f067395d82f7ef8fd32c7c00e6c41ea1731347aadba2fbaed118cdf",
+  "workflows/web-validate.md": "5ef05154671582d95b2d05358f0a4f7ea52fe6ff3d3f238b732b3490925bc7f7"
 }

package/skills/torusguard/payload/references/csharp-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: C# & ASP.NET Core Security
+
+> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Authentication & Authorization
+* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
+* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
+
+### 2. Entity Framework Core & SQL Injection
+* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
+* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
+* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
+
+### 3. Anti-Forgery & TLS
+* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
+* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```csharp
+// Safe Entity Framework Parameterized Query
+var user = await context.Users
+    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
+    .FirstOrDefaultAsync();
+
+// Safe Global Query Filter in DbContext
+modelBuilder.Entity<Invoice>()
+    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
+
+// Safe Controller Security
+[Authorize]
+[ApiController]
+[Route("api/[controller]")]
+public class InvoicesController : ControllerBase { ... }
+```

package/skills/torusguard/payload/references/go-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: Go Security
+
+> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Database & SQL Injection
+* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
+* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
+
+### 2. TLS & Network Security
+* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
+* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
+
+### 3. Concurrency & Goroutine Safety
+* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
+* Use mutexes or channels to prevent data races on shared state.
+
+### 4. Input Validation & Path Traversal
+* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```go
+// Safe Parameterized Query
+row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
+
+// Safe GORM Scoping
+var invoice Invoice
+result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
+
+// Safe TLS Client
+tlsConfig := &tls.Config{
+    MinVersion: tls.VersionTLS13,
+}
+client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
+```

package/skills/torusguard/payload/references/java-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Java & Spring Security
+
+> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Spring Security & CSRF
+* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
+* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
+
+### 2. JPA & Hibernate SQL Injection
+* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
+* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
+
+### 3. Insecure Deserialization & XML
+* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
+* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```java
+// Safe JPA Query
+@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
+Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
+
+// Safe Spring Security Configuration
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        .authorizeHttpRequests(auth -> auth
+            .requestMatchers("/public/**").permitAll()
+            .anyRequest().authenticated()
+        );
+    return http.build();
+}
+```

package/skills/torusguard/payload/references/polyglot-security-matrix.md

@@ -0,0 +1,25 @@
+# TorusGuard Universal Polyglot Security Matrix
+
+> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
+
+---
+
+## 🛡️ Cross-Language Invariant Mappings
+
+| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
+|---|---|---|---|---|---|---|
+| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
+| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
+| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
+| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
+| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
+| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
+| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
+
+---
+
+## 🚀 Polyglot Hardening Rules of Thumb
+
+1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
+2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
+3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.

package/skills/torusguard/payload/references/rust-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Rust Security
+
+> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Memory Safety & Unsafe Blocks
+* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
+* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
+
+### 2. Database & SQL Queries
+* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
+* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
+
+### 3. Outbound Requests & TLS
+* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
+* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```rust
+// Safe sqlx Parameterized Query
+let user = sqlx::query_as!(
+    User,
+    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
+    user_id,
+    current_tenant_id
+)
+.fetch_one(&pool)
+.await?;
+
+// Safe reqwest Client (Strict TLS)
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(10))
+    .build()?;
+```

package/skills/torusguard/payload/rules/custom/.gitkeep

@@ -0,0 +1 @@
+# Retain custom rules directory

package/skills/torusguard/payload/rules/custom/README.md

@@ -0,0 +1,30 @@
+# TorusGuard Custom Rules Directory
+
+Place your custom organization-specific, framework-specific, or proprietary library rules here.
+Any markdown files (`*.md`) or JSON files (`*.json`) placed in this directory will be automatically indexed during `/torusguard-audit` and finding scoring.
+
+---
+
+## Example Custom Rule: `TG-CUSTOM-001.md`
+
+```markdown
+# TG-CUSTOM-001: Require Organization UUID on All Multi-Tenant Queries
+
+**Rule ID:** TG-CUSTOM-001
+**Severity:** High
+**Category:** database-safety
+**Confidence Base:** 85
+
+### Description
+Ensure all database operations on multi-tenant tables enforce explicit `org_id` or `tenant_id` boundaries.
+
+### Unsafe Pattern
+```python
+db.execute("SELECT * FROM invoices WHERE status = 'paid'")
+```
+
+### Safe Remediation
+```python
+db.execute("SELECT * FROM invoices WHERE status = 'paid' AND org_id = %s", [current_org_id])
+```
+```