torusguard 1.0.0 → 1.3.1

package/.torusguard/runs/run-20260908-113127-audit/remediation.md

@@ -0,0 +1,262 @@
+# TorusGuard Governed Remediation Catalog
+**Run ID:** `run-20260908-113127-audit`  
+**Generated:** `2026-09-08 11:49:42 IST`  
+**Candidate Bundles Formulated:** `16`  
+
+---
+## Formulated Candidate Patches
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Target:** `examples/vulnerable-react-express/client/src/App.jsx:53` | **Bundle ID:** `bnd-tg-input-003-53-d167b4`
+- **Strategy:** Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `examples/vulnerable-react-express/server/index.js:9` | **Bundle ID:** `bnd-tg-sec-001-9-f51467`
+- **Strategy:** Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const secret = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Target:** `harness/engine/fixture_manager.py:128` | **Bundle ID:** `bnd-tg-input-002-128-7809a1`
+- **Strategy:** Replaced unsafe Python SQL f-string interpolation with parameterized SQL query placeholder
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/engine/fixture_manager.py
++++ b/harness/engine/fixture_manager.py
+@@ -126,5 +126,5 @@
+                 vulnerable_variant=FixtureVariant(
+                     relative_path="examples/python/sqlalchemy-vuln",
+-                    code_pattern="session.execute(f'SELECT * FROM items WHERE name LIKE {q}')",
++                    code_pattern="session.execute('SELECT * FROM items WHERE name LIKE %s')",
+                     expected_findings_count=4,
+                 ),
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/master_validation.py:257` | **Bundle ID:** `bnd-tg-sec-001-257-89bf34`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('MASKED_PWD')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/master_validation.py
++++ b/harness/master_validation.py
+@@ -255,5 +255,5 @@
+         self.log("Redaction", "JWT Token Redaction", "Bearer ***REDACTED_JWT***" in masked_jwt and "doNotLeakSignature" not in masked_jwt)
+ 
+-        masked_pwd = mask_sensitive_data("DB_PASSWORD = 'super_secret_database_password_123'")
++        masked_pwd = os.environ.get("MASKED_PWD", "")
+         self.log("Redaction", "Password Variable Redaction", "***REDACTED***" in masked_pwd and "super_secret_database_password_123" not in masked_pwd)
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/master_validation.py:334` | **Bundle ID:** `bnd-tg-db-004-334-cb819d`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/master_validation.py
++++ b/harness/master_validation.py
+@@ -332,5 +332,5 @@
+                 "severity": SeverityLevel.CRITICAL,
+                 "path": "rules/TG-DB-004-missing-tenant-query-isolation.md",
+-                "vuln_sample": "record = Invoice.objects.get(id=invoice_id)",
++                "vuln_sample": "record = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)",
+                 "hard_sample": "record = Invoice.objects.filter(id=invoice_id, tenant_id=request.user.tenant_id).first()",
+                 "remediation": "Enforce composite tenant scoping on every data lookup (tenant_id == current_user.tenant_id) and override DRF ViewSet get_queryset().",
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/runner.py:209` | **Bundle ID:** `bnd-tg-sec-001-209-4f6424`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('RAW_SNIPPET')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -207,5 +207,5 @@
+             type=EvidenceType.SOURCE,
+             location="server/auth.py:42",
+-            raw_snippet="SECRET_KEY = 'super_secret_jwt_key'",
++            raw_snippet = os.environ.get("RAW_SNIPPET", "")
+             rationale="Hardcoded secret credential.",
+             confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/runner.py:503` | **Bundle ID:** `bnd-tg-db-004-503-d11cf8`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -501,5 +501,5 @@
+ 
+             # 2. Stable Finding Identity
+-            code_a = "def view():\n    return Item.objects.get(id=id)"
++            code_a = "def view():\n    return Item.objects.get(organization_id=request.user.organization_id, id=id)"
+             code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+             fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Target:** `harness/runner.py:232` | **Bundle ID:** `bnd-tg-input-002-232-1b45d1`
+- **Strategy:** Replaced unsafe Python SQL f-string interpolation with parameterized SQL query placeholder
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -230,5 +230,5 @@
+             type=EvidenceType.SOURCE,
+             location="views.py:15",
+-            raw_snippet="User.objects.raw(f'SELECT * FROM users WHERE name = {name}')",
++            raw_snippet="User.objects.raw('SELECT * FROM users WHERE name = %s')",
+             rationale="Direct string concatenation into SQL query.",
+             confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/validate_e2e.py:355` | **Bundle ID:** `bnd-tg-sec-001-355-7b190b`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('RAW_CODE')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_e2e.py
++++ b/harness/validate_e2e.py
+@@ -353,5 +353,5 @@
+ 
+     def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:
+-        raw_code = "API_KEY = 'sk_live_998877665544332211'\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'" if secret_test else f"# Unsafe logic for {rule_id}\nrole = request.headers.get('X-User-Role')"
++        raw_code = os.environ.get("RAW_CODE", "")
+         
+         ev = Evidence(
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/validate_qa_v0_6_0.py:64` | **Bundle ID:** `bnd-tg-sec-001-64-5af31a`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('DEBUG')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_qa_v0_6_0.py
++++ b/harness/validate_qa_v0_6_0.py
+@@ -62,5 +62,5 @@
+             "tiny-repo": {
+                 "vulnerable": {
+-                    "app.py": 'DEBUG = True\nSECRET_KEY = "sk_live_1234567890"\n\ndef index():\n    return "Welcome"\n'
++                    DEBUG = os.environ.get("DEBUG", "")
+                 },
+                 "hardened": {
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/validate_v0_6_1_scale.py:115` | **Bundle ID:** `bnd-tg-db-004-115-9a059e`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v0_6_1_scale.py
++++ b/harness/validate_v0_6_1_scale.py
+@@ -113,5 +113,5 @@
+                 "severity": "High",
+                 "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+-                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
++                "evidence": {"code_snippet": "Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)"},
+             },
+             # FastAPI Microservice
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/validate_v0_6_2_modern_stacks.py:341` | **Bundle ID:** `bnd-tg-sec-001-341-ce228c`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('DATABASE_PASSWORD')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v0_6_2_modern_stacks.py
++++ b/harness/validate_v0_6_2_modern_stacks.py
+@@ -339,5 +339,5 @@
+ COPY . .
+ # Running as root user & hardcoding secrets
+-ENV DATABASE_PASSWORD="secret_in_docker"
++DATABASE_PASSWORD = os.environ.get("DATABASE_PASSWORD", "")
+ CMD ["python", "main.py"]
+ """, encoding="utf-8")
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/validate_v0_6_3_hardening.py:119` | **Bundle ID:** `bnd-tg-db-004-119-61557c`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v0_6_3_hardening.py
++++ b/harness/validate_v0_6_3_hardening.py
+@@ -117,5 +117,5 @@
+         snippet_v1 = """def process_invoice(req, inv_id):
+     # Retrieve invoice
+-    inv = Invoice.objects.get(id=inv_id)
++    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)
+     return inv
+ """
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/validate_v1_0_0_memory.py:265` | **Bundle ID:** `bnd-tg-db-004-265-996ca3`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v1_0_0_memory.py
++++ b/harness/validate_v1_0_0_memory.py
+@@ -263,5 +263,5 @@
+ -    return Bill.objects.filter(id=id, tenant=tenant)
+ +def get_bill(id):
+-+    return Bill.objects.get(id=id)
+++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)
+ """
+         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Target:** `harness/validate_v1_1_0_advanced_memory.py:107` | **Bundle ID:** `bnd-tg-input-002-107-516a40`
+- **Strategy:** Replaced unsafe Python SQL f-string interpolation with parameterized SQL query placeholder
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v1_1_0_advanced_memory.py
++++ b/harness/validate_v1_1_0_advanced_memory.py
+@@ -105,5 +105,5 @@
+         memory_engine.ensure_memory_structure(root_dir=test_root)
+ 
+-        valid_before = "cursor.execute(f'SELECT * FROM users WHERE id = {uid}')"
++        valid_before = "cursor.execute('SELECT * FROM users WHERE id = %s')"
+         valid_after = "cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+         valid_diff = "- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `tests/test_v0_6_0_governed_remediation.py:79` | **Bundle ID:** `bnd-tg-db-004-79-91f41f`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/tests/test_v0_6_0_governed_remediation.py
++++ b/tests/test_v0_6_0_governed_remediation.py
+@@ -77,5 +77,5 @@
+         def get_invoice(request, invoice_id):
+             # Fetch invoice directly without tenant filter
+-            invoice = Invoice.objects.get(id=invoice_id)
++            invoice = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)
+             return JsonResponse({"id": invoice.id})
+         """
+```

package/.torusguard/runs/run-20260908-113127-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260908-113127-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 46
+- Root-Cause Clusters: 5
+- Generated: 2026-09-08 11:31:27 IST

package/.torusguard/runs/run-20260908-115240-audit/apply_plan.md

@@ -0,0 +1,6 @@
+# TorusGuard Governed Application Plan: run-20260908-115240-audit
+- **Total Candidate Patches:** 17
+- **Successfully Applied:** 17
+- **Skipped by Human Gate:** 0
+- **Execution Timestamp:** 2026-09-08 11:52:52 IST
+- **Rollback Directory:** `.torusguard/snapshots/run-20260908-115240-audit`

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-115-9a059e/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-115-9a059e",
+  "finding_id": "TG-DB-004-9a2f13c7",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/validate_v0_6_1_scale.py",
+  "line_number": 115,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/validate_v0_6_1_scale.py\n+++ b/harness/validate_v0_6_1_scale.py\n@@ -113,5 +113,5 @@\n                 \"severity\": \"High\",\n                 \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n-                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n+                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\"},\n             },\n             # FastAPI Microservice\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "\"\"\"\nTorusGuard v6.1 \u2014 Scale & Complexity Hardening Validation Harness\nValidates reliability, performance, and noise control on large, messier, and realistic repositories:\n- Complex monorepo with multiple apps (Django, FastAPI, Flask, Shared ORM)\n- Deeply nested directories (8+ levels)\n- Generated / vendor files mixed with source files (migrations, protobuf, min.js)\n- High-density vulnerability flood (250+ findings) collapsing into root-cause clusters\n- Performance benchmarks: scan, cluster, report, recheck, and SARIF generation under load\n- Generates QA-SUMMARY-v6.1.md\n\"\"\"\n\nimport os\nimport sys\nimport time\nimport json\nimport shutil\nimport tempfile\nfrom datetime import datetime\nfrom pathlib import Path\nfrom typing import Dict, List, Any\n\nPROJECT_ROOT = Path(__file__).resolve().parent.parent\nsys.path.insert(0, str(PROJECT_ROOT))\n\nfrom core.identity import IdentityEngine\nfrom core.clustering import ClusteringEngine, is_generated_file\nfrom core.bundle import BundleManager\nfrom core.governance import PatchGovernor\nfrom core.rechecker import TargetedRechecker, RecheckOutcome\nfrom core.run_manager import RunManager\nfrom core.sarif import SarifExporter\nfrom core.v6_workflow import V6Workflow\n\n\nclass ScaleBenchmarkRunner:\n    \"\"\"\n    Executes scale and complexity hardening verification for TorusGuard v6.1.\n    \"\"\"\n\n    def __init__(self, qa_root: Path):\n        self.qa_root = qa_root\n        self.runs_dir = qa_root / \"runs\"\n        self.reports_dir = qa_root / \"reports\"\n        self.logs_dir = qa_root / \"logs\"\n\n        self.runs_dir.mkdir(parents=True, exist_ok=True)\n        self.reports_dir.mkdir(parents=True, exist_ok=True)\n        self.logs_dir.mkdir(parents=True, exist_ok=True)\n\n        self.passed_tests = 0\n        self.failed_tests = 0\n        self.benchmarks: Dict[str, float] = {}\n        self.results: List[Dict[str, Any]] = []\n\n    def log_test(self, category: str, test_name: str, passed: bool, details: str = \"\"):\n        status = \"PASS\" if passed else \"FAIL\"\n        if passed:\n            self.passed_tests += 1\n            print(f\"  [{status}] [{category}] {test_name}\")\n        else:\n            self.failed_tests += 1\n            print(f\"  [{status}] [{category}] {test_name} -> {details}\")\n\n        self.results.append({\n            \"category\": category,\n            \"name\": test_name,\n            \"passed\": passed,\n            \"details\": details\n        })\n\n    def run_all(self) -> bool:\n        print(\"=\" * 80)\n        print(\"TORUSGUARD v6.1 \u2014 SCALE & COMPLEXITY HARDENING BENCHMARK\")\n        print(\"=\" * 80)\n\n        # 1. Complex Monorepo & Nested Fixture\n        print(\"\\n--- 1. Testing Complex Monorepo & Deeply Nested Architectures ---\")\n        self._test_monorepo_complexity()\n\n        # 2. Generated & Vendor Noise Suppression\n        print(\"\\n--- 2. Testing Generated File Noise Filtering ---\")\n        self._test_generated_file_filtering()\n\n        # 3. High-Density Vulnerability Flood & Clustering\n        print(\"\\n--- 3. Testing High-Density Vulnerability Collapsing (250+ findings) ---\")\n        self._test_high_density_clustering()\n\n        # 4. Performance & Scale Stress Benchmarks\n        print(\"\\n--- 4. Performance Benchmarks at Scale (2,500+ Files / 500+ Findings) ---\")\n        self._test_performance_benchmarks()\n\n        # 5. Patch Governance at Scale\n        print(\"\\n--- 5. Patch Governance & Monorepo Cross-Boundary Escalation ---\")\n        self._test_patch_governance_scale()\n\n        # 6. Generate v6.1 QA Sign-Off\n        print(\"\\n--- 6. Generating TorusGuard v6.1 QA Sign-Off Report ---\")\n        self._generate_qa_v6_1_report()\n\n        print(\"=\" * 80)\n        print(f\"SCALE BENCHMARK SUMMARY: {self.passed_tests} Passed | {self.failed_tests} Failed\")\n        print(\"=\" * 80)\n\n        return self.failed_tests == 0\n\n    def _test_monorepo_complexity(self):\n        # Monorepo with multiple apps and nested paths\n        monorepo_findings = [\n            # Django Core App\n            {\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Tenant Query Scoping in Billing\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\"},\n            },\n            # FastAPI Microservice\n            {\n                \"rule_id\": \"TG-SSRF-001\",\n                \"title\": \"Unvalidated Outbound Destination in Ingestion Service\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/fastapi_service/routes/fetcher.py\", \"line_start\": 18, \"line_end\": 18},\n                \"evidence\": {\"code_snippet\": \"httpx.get(target_url)\"},\n            },\n            # Flask Webhook Handler\n            {\n                \"rule_id\": \"TG-WEBHOOK-001\",\n                \"title\": \"Missing Webhook HMAC Verification\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/flask_webhook/handler.py\", \"line_start\": 12, \"line_end\": 12},\n                \"evidence\": {\"code_snippet\": \"payload = request.json\"},\n            },\n            # Deeply nested folder (8 levels)\n            {\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": \"Path Traversal in Deep Analytics Worker\",\n                \"severity\": \"High\",\n                \"target\": {\n                    \"file_path\": \"services/core/v1/subsystems/analytics/processors/workers/storage.py\",\n                    \"line_start\": 88,\n                    \"line_end\": 88\n                },\n                \"evidence\": {\"code_snippet\": \"open(os.path.join(DIR, filename), 'wb')\"},\n            },\n            # CI/CD Workflow file\n            {\n                \"rule_id\": \"TG-SUPPLY-001\",\n                \"title\": \"Unpinned GitHub Action in Production Pipeline\",\n                \"severity\": \"Medium\",\n                \"target\": {\"file_path\": \"infra/.github/workflows/deploy.yml\", \"line_start\": 15, \"line_end\": 15},\n                \"evidence\": {\"code_snippet\": \"uses: actions/checkout@v2\"},\n            }\n        ]\n\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(monorepo_findings, target_name=\"complex-monorepo\", run_id=\"qa-scale-monorepo-01\", export_sarif=True)\n\n        self.log_test(\"Monorepo\", \"All Monorepo Applications Discovered & Fingerprinted\", len(monorepo_findings) == 5)\n        self.log_test(\"Monorepo\", \"Run Folder Isolated for Monorepo with 10 Standard Artifacts\", run_mgr.summary_file.exists() and run_mgr.sarif_file.exists())\n\n        # Check clusters in monorepo\n        clusters = ClusteringEngine.cluster_findings(monorepo_findings)\n        self.log_test(\"Monorepo\", \"Disparate Framework Findings Clustered Accurately\", len(clusters) == 5)\n        self.log_test(\"Monorepo\", \"Hotspot Modules Computed Correctly\", any(c.hotspot_module == \"apps/django_core\" for c in clusters))\n\n    def _test_generated_file_filtering(self):\n        test_paths = [\n            (\"apps/core/models.py\", False),\n            (\"apps/core/migrations/0001_initial.py\", True),\n            (\"frontend/dist/bundle.js\", True),\n            (\"frontend/src/App.tsx\", False),\n            (\"proto/models_pb2.py\", True),\n            (\"static/js/vendor.min.js\", True),\n            (\"services/worker/handler.py\", False),\n        ]\n\n        for path, expected_ignored in test_paths:\n            actual = is_generated_file(path)\n            self.log_test(\"Filtering\", f\"Filter Classification for {path} (Ignored: {expected_ignored})\", actual == expected_ignored)\n\n    def _test_high_density_clustering(self):\n        # Generate 250 repeated findings across 30 files under 3 systemic root causes\n        high_density_findings = []\n        for i in range(120):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_db_{i}\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": f\"Missing Tenant Scoping in Endpoint {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 92,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"services/api/module_{i % 15}/views.py\", \"line_start\": 10 + i, \"line_end\": 12 + i},\n                \"evidence\": {\"code_snippet\": f\"Model_{i}.objects.get(id=id)\"},\n            })\n\n        for i in range(80):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_input_{i}\",\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": f\"Path Traversal in Uploader {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 90,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"services/uploads/uploader_{i % 10}.py\", \"line_start\": 5 + i, \"line_end\": 7 + i},\n                \"evidence\": {\"code_snippet\": f\"open(os.path.join(DIR, name_{i}))\"},\n            })\n\n        for i in range(50):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_auth_{i}\",\n                \"rule_id\": \"TG-AUTH-008\",\n                \"title\": f\"Untrusted Header in Service {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 88,\n                \"confidence_band\": \"High Confidence\",\n                \"target\": {\"file_path\": f\"services/gateway/auth_{i % 5}.py\", \"line_start\": 20 + i, \"line_end\": 22 + i},\n                \"evidence\": {\"code_snippet\": f\"request.headers.get('X-Role-{i}')\"},\n            })\n\n        # Test Clustering Collapsing\n        clusters = ClusteringEngine.cluster_findings(high_density_findings)\n        self.log_test(\"Clustering\", \"250 Findings Successfully Collapsed into Exactly 3 Clusters\", len(clusters) == 3)\n        self.log_test(\"Clustering\", \"High-Density Flag Set on Major Clusters\", all(c.is_high_density for c in clusters))\n\n        # Test Report Rendering with Collapsible Sections\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(high_density_findings, target_name=\"high-density-flood\", run_id=\"qa-scale-flood-01\", export_sarif=True)\n\n        with open(run_mgr.findings_file, \"r\", encoding=\"utf-8\") as f:\n            findings_txt = f.read()\n\n        self.log_test(\"Reporting\", \"High-Density Report Collapses Findings (>25 items) to Prevent Bloat\", \"Collapsed High-Density Findings\" in findings_txt)\n        self.log_test(\"Reporting\", \"Summary Table Lists All 3 Systemic Clusters Cleanly\", \"cluster-tenant-isolation\" in run_mgr.summary_file.read_text(encoding=\"utf-8\"))\n\n    def _test_performance_benchmarks(self):\n        # Benchmark 1: Generate & Fingerprint 500 Findings\n        t0 = time.perf_counter()\n        test_findings = []\n        for i in range(500):\n            fp = IdentityEngine.generate_identity(\n                rule_id=\"TG-DB-004\",\n                file_path=f\"apps/service_{i % 25}/models/query_{i}.py\",\n                code_snippet=f\"def query_{i}():\\n    return Model.objects.filter(id={i})\\n\",\n                sink_signature=\"Model.objects.filter\"\n            )\n            test_findings.append({\n                \"finding_id\": fp.fingerprint_id,\n                \"fingerprint_id\": fp.fingerprint_id,\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": f\"Tenant Query Issue {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 90,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"apps/service_{i % 25}/models/query_{i}.py\", \"line_start\": 1, \"line_end\": 5},\n                \"evidence\": {\"code_snippet\": \"Model.objects.filter(id=x)\"},\n            })\n        t_fingerprint = time.perf_counter() - t0\n        self.benchmarks[\"fingerprint_500_items_sec\"] = t_fingerprint\n        self.log_test(\"Performance\", f\"500 Finding Fingerprints Generated in {t_fingerprint:.4f}s (< 0.5s)\", t_fingerprint < 0.5)\n\n        # Benchmark 2: Clustering 500 Findings\n        t0 = time.perf_counter()\n        clusters = ClusteringEngine.cluster_findings(test_findings)\n        t_cluster = time.perf_counter() - t0\n        self.benchmarks[\"clustering_500_items_sec\"] = t_cluster\n        self.log_test(\"Performance\", f\"500 Findings Clustered in {t_cluster:.4f}s (< 0.1s)\", t_cluster < 0.1)\n\n        # Benchmark 3: SARIF Exporter (1,000 Result Payload)\n        t0 = time.perf_counter()\n        large_sarif_findings = test_findings * 2  # 1,000 findings\n        sarif_payload = SarifExporter.generate_sarif(large_sarif_findings, tool_version=\"6.1.0\")\n        t_sarif = time.perf_counter() - t0\n        self.benchmarks[\"sarif_1000_items_sec\"] = t_sarif\n        self.log_test(\"Performance\", f\"1,000 Result SARIF Export Generated in {t_sarif:.4f}s (< 0.3s)\", t_sarif < 0.3)\n        self.log_test(\"SARIF\", \"SARIF Result Count Matches 1,000 Items\", len(sarif_payload[\"runs\"][0][\"results\"]) == 1000)\n\n        # Benchmark 4: Targeted Rechecker Throughput (100 Scoped Evaluations)\n        t0 = time.perf_counter()\n        recheck_scenarios = [\n            {\n                \"finding_id\": f\"fnd-{i}\",\n                \"rule_id\": \"TG-DB-004\",\n                \"target_file\": f\"services/query_{i}.py\",\n                \"orig_snippet\": \"Model.all()\",\n                \"post_snippet\": \"Model.filter(tenant=t)\",\n                \"is_safe\": True,\n                \"is_unsafe\": False,\n            }\n            for i in range(100)\n        ]\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(test_findings[:5], target_name=\"perf-bench\", run_id=\"qa-scale-perf-01\")\n        recheck_results = wf.execute_recheck(run_mgr, recheck_scenarios)\n        t_recheck = time.perf_counter() - t0\n        self.benchmarks[\"recheck_100_items_sec\"] = t_recheck\n        self.log_test(\"Performance\", f\"100 Scoped Rechecks Executed in {t_recheck:.4f}s (< 0.2s)\", t_recheck < 0.2)\n        self.log_test(\"Recheck\", \"All 100 Rechecks Evaluated to Confirmed Fixed\", len(recheck_results) == 100 and all(r.outcome == RecheckOutcome.CONFIRMED_FIXED for r in recheck_results))\n\n    def _test_patch_governance_scale(self):\n        gov = PatchGovernor(max_additions_per_file=25, max_deletions_per_file=15)\n\n        # Cross-application boundary diff (touching both apps/django and apps/fastapi)\n        cross_boundary_diff = \"\"\"--- a/apps/django_core/views.py\n+++ b/apps/django_core/views.py\n@@ -1,1 +1,1 @@\n-old_auth()\n+new_auth()\n--- a/apps/fastapi_service/main.py\n+++ b/apps/fastapi_service/main.py\n@@ -1,1 +1,1 @@\n-old_gw()\n+new_gw()\n--- a/packages/shared/db.py\n+++ b/packages/shared/db.py\n@@ -1,1 +1,1 @@\n-old_db()\n+new_db()\n\"\"\"\n        decision = gov.evaluate_diff(cross_boundary_diff)\n        self.log_test(\"Governance\", \"Cross-App Multi-File Diff Rejected (> 2 files touched)\", not decision.allowed_auto_apply)\n        self.log_test(\"Governance\", \"High-Risk Keyword Escalation Triggered on Auth Context\", decision.escalation_required)\n\n    def _generate_qa_v6_1_report(self):\n        lines = [\n            \"# TorusGuard v0.6.1 \u2014 Scale & Complexity Hardening Sign-Off Report\",\n            f\"\\n**Execution Date:** {datetime.utcnow().strftime('%B %d, %Y')}\",\n            \"**Target Branch:** `v6`\",\n            \"**Architecture Version:** `v0.6.1`\",\n            f\"**Total Verification Checks:** {len(self.results)}\",\n            f\"**Passed Checks:** {self.passed_tests}\",\n            f\"**Failed Checks:** {self.failed_tests}\",\n            f\"**Final Verdict:** {'\u2705 READY FOR v0.6.1 RELEASE' if self.failed_tests == 0 else '\u274c BLOCKED'}\\n\",\n            \"---\",\n            \"\\n## 1. Scale Performance Benchmarks\\n\",\n            \"| Benchmark Dimension | Workload Volume | Execution Time | Threshold | Status |\",\n            \"|---|---|---:|---:|:---:|\",\n            f\"| **Fingerprinting & ID Generation** | 500 Findings | {self.benchmarks.get('fingerprint_500_items_sec', 0):.4f}s | $< 0.50\\\\text{{s}}$ | **PASS** |\",\n            f\"| **Root-Cause Clustering & Hotspots** | 500 Findings | {self.benchmarks.get('clustering_500_items_sec', 0):.4f}s | $< 0.10\\\\text{{s}}$ | **PASS** |\",\n            f\"| **SARIF v2.1.0 JSON Serialization** | 1,000 Findings | {self.benchmarks.get('sarif_1000_items_sec', 0):.4f}s | $< 0.30\\\\text{{s}}$ | **PASS** |\",\n            f\"| **Targeted Scoped Rechecks** | 100 Endpoints | {self.benchmarks.get('recheck_100_items_sec', 0):.4f}s | $< 0.20\\\\text{{s}}$ | **PASS** |\",\n            \"\\n---\",\n            \"\\n## 2. Complexity & Noise Control Verification\\n\",\n            \"- **Monorepo Support:** Successfully parsed, isolated, and triaged multi-application repositories (Django + FastAPI + Flask + Shared ORM) in a single unified run.\",\n            \"- **Deep Hierarchy Resolution:** Handled 8-level deeply nested file paths without truncation or identity collision.\",\n            \"- **Noise Suppression:** Automatically ignored non-actionable vendor and generated paths (`migrations/`, `dist/`, `build/`, `*.min.js`, `*.pb.go`).\",\n            \"- **High-Density Clustering:** Successfully collapsed 250+ repeated vulnerability alerts into exactly 3 actionable root-cause clusters with primary hotspot tracking.\",\n            \"- **Readable Output Guarantee:** Automatically applies `<details>` collapsing when finding count exceeds 25 items, preventing unreadable Markdown report bloat.\",\n            \"- **Monorepo Patch Governance:** Enforced strict file-boundary checks to prevent unintentional cross-service multi-file automated edits.\",\n            \"\\n---\",\n            \"\\n## 3. Scale Readiness Checklist\\n\",\n            \"- [x] TorusGuard remains stable on large repos (1,000+ findings modeled).\",\n            \"- [x] No duplicate-finding chaos (stable invariant IDs across line shifts and reruns).\",\n            \"- [x] No broken run folders (all 10 artifacts generated reliably under load).\",\n            \"- [x] No oversized auto-generated patches (governor strictly blocks large or multi-file diffs).\",\n            \"- [x] Recheck remains targeted and fast ($< 2\\\\text{ms}$ per recheck scenario).\",\n            \"- [x] SARIF v2.1.0 output remains 100% schema-valid at 1,000+ item volume.\",\n        ]\n\n        with open(self.reports_dir / \"QA-SUMMARY-v0.6.1.md\", \"w\", encoding=\"utf-8\") as f:\n            f.write(\"\\n\".join(lines) + \"\\n\")\n\n\nif __name__ == \"__main__\":\n    qa_root = Path(tempfile.mkdtemp(prefix=\"torusguard-scale-qa-\"))\n    try:\n        runner = ScaleBenchmarkRunner(qa_root)\n        success = runner.run_all()\n    finally:\n        shutil.rmtree(qa_root, ignore_errors=True)\n    sys.exit(0 if success else 1)\n    sys.exit(0 if success else 1)"
+}

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-115-9a059e/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-115-9a059e
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `harness/validate_v0_6_1_scale.py:115`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/harness/validate_v0_6_1_scale.py
++++ b/harness/validate_v0_6_1_scale.py
+@@ -113,5 +113,5 @@
+                 "severity": "High",
+                 "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+-                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
++                "evidence": {"code_snippet": "Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)"},
+             },
+             # FastAPI Microservice
+
+```

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-115-9a059e/patch.diff

@@ -0,0 +1,9 @@
+--- a/harness/validate_v0_6_1_scale.py
++++ b/harness/validate_v0_6_1_scale.py
+@@ -113,5 +113,5 @@
+                 "severity": "High",
+                 "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+-                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
++                "evidence": {"code_snippet": "Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)"},
+             },
+             # FastAPI Microservice

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-119-61557c/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-119-61557c",
+  "finding_id": "TG-DB-004-e33fd263",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/validate_v0_6_3_hardening.py",
+  "line_number": 119,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/validate_v0_6_3_hardening.py\n+++ b/harness/validate_v0_6_3_hardening.py\n@@ -117,5 +117,5 @@\n         snippet_v1 = \"\"\"def process_invoice(req, inv_id):\n     # Retrieve invoice\n-    inv = Invoice.objects.get(id=inv_id)\n+    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\n     return inv\n \"\"\"\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "\"\"\"\nTorusGuard v6.3 Final Drift, Upload, and Sensitive-Path Hardening Validation Suite\nExecutes all 5 phases of the TorusGuard v6.3 Final Hardening Plan:\n1. Phase 1 \u2014 Cross-Run Drift & Identity Stability (Line shifts, comment refactors)\n2. Phase 2 \u2014 GitHub Code Scanning SARIF Upload Validation (partialFingerprints, deduplication)\n3. Phase 3 \u2014 Sensitive-Path Governance & Escalation (Auth, tenancy, secrets, crypto, uploads, CI/CD)\n4. Phase 4 \u2014 Modern-Stack Negative Tests (Zero False Positives on safe async, dependency injection, 2.0 select)\n5. Phase 5 \u2014 Report Consistency & Structured Export Audit\n\"\"\"\n\nimport os\nimport sys\nimport json\nimport time\nimport shutil\nimport tempfile\nfrom datetime import datetime\nfrom pathlib import Path\nfrom typing import Dict, List, Any\n\nPROJECT_ROOT = Path(__file__).resolve().parent.parent\nsys.path.insert(0, str(PROJECT_ROOT))\n\nfrom core.identity import IdentityEngine, FindingFingerprint\nfrom core.clustering import ClusteringEngine, RootCauseCluster\nfrom core.bundle import BundleManager, RemediationBundle\nfrom core.governance import PatchGovernor, PatchPolicyDecision, SENSITIVE_CATEGORIES\nfrom core.rechecker import TargetedRechecker, TargetedRecheckResult, RecheckOutcome\nfrom core.run_manager import RunManager\nfrom core.sarif import SarifExporter\nfrom core.v6_reporter import V6Reporter\nfrom core.v6_workflow import V6Workflow\nfrom core.stack_profiler import StackProfiler\n\n\nclass V63HardeningRunner:\n    \"\"\"\n    Executes the comprehensive TorusGuard v6.3 Hardening Validation Suite.\n    \"\"\"\n\n    def __init__(self, qa_root: Path):\n        self.qa_root = qa_root\n        self.runs_dir = qa_root / \"runs\"\n        self.reports_dir = qa_root / \"reports\"\n        self.drift_fixtures_dir = qa_root / \"drift_fixtures\"\n        self.negative_fixtures_dir = qa_root / \"negative_fixtures\"\n\n        self.runs_dir.mkdir(parents=True, exist_ok=True)\n        self.reports_dir.mkdir(parents=True, exist_ok=True)\n        self.drift_fixtures_dir.mkdir(parents=True, exist_ok=True)\n        self.negative_fixtures_dir.mkdir(parents=True, exist_ok=True)\n\n        self.passed_tests = 0\n        self.failed_tests = 0\n        self.results: List[Dict[str, Any]] = []\n\n    def log_test(self, phase: str, check_desc: str, passed: bool, details: str = \"\"):\n        status = \"PASS\" if passed else \"FAIL\"\n        if passed:\n            self.passed_tests += 1\n            print(f\"  [{status}] [{phase}] {check_desc}\")\n        else:\n            self.failed_tests += 1\n            print(f\"  [{status}] [{phase}] {check_desc} -> {details}\")\n\n        self.results.append({\n            \"phase\": phase,\n            \"description\": check_desc,\n            \"passed\": passed,\n            \"details\": details,\n            \"timestamp\": datetime.utcnow().isoformat() + \"Z\"\n        })\n\n    def run_all(self) -> bool:\n        print(\"=\" * 80)\n        print(\"TORUSGUARD v6.3 \u2014 FINAL DRIFT, UPLOAD & SENSITIVE-PATH HARDENING\")\n        print(\"=\" * 80)\n\n        # Phase 1: Drift Testing\n        print(\"\\n--- Phase 1: Cross-Run Drift & Identity Stability ---\")\n        self._test_phase_1_drift()\n\n        # Phase 2: SARIF Upload Validation\n        print(\"\\n--- Phase 2: GitHub Code Scanning SARIF Upload Validation ---\")\n        self._test_phase_2_sarif_upload()\n\n        # Phase 3: Sensitive-Path Governance\n        print(\"\\n--- Phase 3: Sensitive-Path Governance & Escalation Enforcement ---\")\n        self._test_phase_3_sensitive_paths()\n\n        # Phase 4: Modern-Stack Negative Tests\n        print(\"\\n--- Phase 4: Modern-Stack Negative Tests (Zero False Positives) ---\")\n        self._test_phase_4_negative_tests()\n\n        # Phase 5: Report & Structured Export Audit\n        print(\"\\n--- Phase 5: Final Report & Cross-Artifact Audit ---\")\n        self._test_phase_5_report_consistency()\n\n        # Final Sign-Off Generation\n        print(\"\\n--- Phase 6: Generating QA-SUMMARY-v6.3.md Sign-Off ---\")\n        self._generate_qa_v6_3_report()\n\n        print(\"=\" * 80)\n        print(f\"v6.3 HARDENING RESULT: {self.passed_tests} Passed | {self.failed_tests} Failed\")\n        print(\"=\" * 80)\n\n        return self.failed_tests == 0\n\n    def _test_phase_1_drift(self):\n        \"\"\"\n        Tests that findings maintain 100% stable identity across multiple simulated commit changes:\n        - Commit 1: Original code snippet\n        - Commit 2: Line shifted down by 15 lines (added comments/imports in file)\n        - Commit 3: Variable whitespace and single-line comment edits\n        \"\"\"\n        # Commit 1\n        snippet_v1 = \"\"\"def process_invoice(req, inv_id):\n    # Retrieve invoice\n    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\n    return inv\n\"\"\"\n        fp1 = IdentityEngine.generate_identity(\"TG-DB-004\", \"apps/billing/views.py\", snippet_v1, \"Invoice.objects.get\")\n\n        # Commit 2: Surrounding line shifted down, snippet has same logic\n        snippet_v2 = \"\"\"def process_invoice(req, inv_id):\n    # Retrieve invoice\n    inv = Invoice.objects.get(id=inv_id)\n    return inv\n\"\"\"\n        fp2 = IdentityEngine.generate_identity(\"TG-DB-004\", \"apps/billing/views.py\", snippet_v2, \"Invoice.objects.get\")\n\n        # Commit 3: Altered inline comments and trailing whitespace inside the function\n        snippet_v3 = \"\"\"def process_invoice(req, inv_id):\n    # Different comment text here\n    inv = Invoice.objects.get(id=inv_id)   \n    return inv\n\"\"\"\n        fp3 = IdentityEngine.generate_identity(\"TG-DB-004\", \"apps/billing/views.py\", snippet_v3, \"Invoice.objects.get\")\n\n        self.log_test(\"Phase 1\", \"Fingerprint ID Invariant Across Line Shifts (Commit 1 vs Commit 2)\", fp1.fingerprint_id == fp2.fingerprint_id)\n        self.log_test(\"Phase 1\", \"Fingerprint ID Invariant Across Inline Comment Edits (Commit 1 vs Commit 3)\", fp1.fingerprint_id == fp3.fingerprint_id)\n        self.log_test(\"Phase 1\", \"Rule & Sink Signatures Preserved\", fp1.rule_id == \"TG-DB-004\" and fp2.sink_signature == \"Invoice.objects.get\")\n\n        # Cluster Stability Across Reruns\n        findings_run1 = [{\"finding_id\": fp1.fingerprint_id, \"rule_id\": \"TG-DB-004\", \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 5, \"line_end\": 5}}]\n        findings_run2 = [{\"finding_id\": fp2.fingerprint_id, \"rule_id\": \"TG-DB-004\", \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 20, \"line_end\": 20}}]\n\n        clusters_1 = ClusteringEngine.cluster_findings(findings_run1)\n        clusters_2 = ClusteringEngine.cluster_findings(findings_run2)\n\n        self.log_test(\"Phase 1\", \"Cluster ID and Title Identical Across Shifted Commits\", clusters_1[0].cluster_id == clusters_2[0].cluster_id and clusters_1[0].title == clusters_2[0].title)\n\n    def _test_phase_2_sarif_upload(self):\n        \"\"\"\n        Validates SARIF v2.1.0 output against GitHub Code Scanning upload requirements:\n        - Schema & version headers\n        - Non-empty rule driver\n        - Valid result ruleIds, URIs, and levels\n        - partialFingerprints with primaryLocationLineHash and torusguard identity for alert deduplication\n        \"\"\"\n        test_findings = [\n            {\n                \"finding_id\": \"TG-FND-8a3b2c1d4e5f\",\n                \"fingerprint_id\": \"TG-FND-8a3b2c1d4e5f\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Multi-Tenant Query Scoping\",\n                \"severity\": \"High\",\n                \"confidence_score\": 95,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 12, \"line_end\": 14},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n                \"cluster_id\": \"cluster-tenant-isolation\",\n                \"recheck_status\": \"Confirmed Fixed\",\n            },\n            {\n                \"finding_id\": \"TG-FND-7f6e5d4c3b2a\",\n                \"fingerprint_id\": \"TG-FND-7f6e5d4c3b2a\",\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": \"Unsafe File Path Traversal\",\n                \"severity\": \"High\",\n                \"confidence_score\": 92,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"services/uploader/storage.py\", \"line_start\": 45, \"line_end\": 48},\n                \"evidence\": {\"code_snippet\": \"open(os.path.join(DIR, filename))\"},\n                \"cluster_id\": \"cluster-path-traversal\",\n                \"recheck_status\": \"Unrechecked\",\n            }\n        ]\n\n        sarif_dict = SarifExporter.generate_sarif(test_findings, tool_version=\"6.3.0\")\n        is_valid, validation_errors = SarifExporter.validate_github_sarif(sarif_dict)\n\n        self.log_test(\"Phase 2\", \"SARIF Schema Compliant with OASIS v2.1.0 Specification\", is_valid, str(validation_errors))\n        self.log_test(\"Phase 2\", \"GitHub Code Scanning partialFingerprints Present on All Results\", all(\"partialFingerprints\" in r for r in sarif_dict[\"runs\"][0][\"results\"]))\n        self.log_test(\"Phase 2\", \"primaryLocationLineHash Deduplication Key Formatted (16 chars)\", len(sarif_dict[\"runs\"][0][\"results\"][0][\"partialFingerprints\"][\"primaryLocationLineHash\"]) == 16)\n        self.log_test(\"Phase 2\", \"Rule Driver Contains Semantic Version 6.3.0 & Info URI\", sarif_dict[\"runs\"][0][\"tool\"][\"driver\"][\"semanticVersion\"] == \"6.3.0\")\n        self.log_test(\"Phase 2\", \"Result Levels Mapped Correctly (error/warning/note)\", sarif_dict[\"runs\"][0][\"results\"][0][\"level\"] == \"error\")\n\n    def _test_phase_3_sensitive_paths(self):\n        \"\"\"\n        Tests sensitive path governance and escalation levels across:\n        - Authentication & JWT\n        - Multi-Tenant models\n        - Secrets & API keys\n        - File uploads & storage\n        - CI/CD workflows (.github/workflows)\n        \"\"\"\n        gov = PatchGovernor(max_additions_per_file=35, max_deletions_per_file=25)\n\n        # 1. Auth diff with large churn -> Mandatory Security Sign-Off & Blocked\n        auth_diff = \"\"\"--- a/apps/auth/jwt_service.py\n+++ b/apps/auth/jwt_service.py\n@@ -1,5 +1,18 @@\n-def verify_token(token):\n-    return jwt.decode(token, SECRET)\n+def verify_token(token):\n+    try:\n+        payload = jwt.decode(\n+            token,\n+            PUBLIC_KEY,\n+            algorithms=[\"RS256\"],\n+            audience=\"my_app\",\n+            issuer=\"auth_server\"\n+        )\n+        if not payload.get(\"active\"):\n+            raise ValueError(\"Token revoked\")\n+        return payload\n+    except jwt.PyJWTError as e:\n+        logger.error(f\"JWT Verification failed: {e}\")\n+        return None\n\"\"\"\n        dec_auth = gov.evaluate_diff(auth_diff)\n        self.log_test(\"Phase 3\", \"Large Auth Diff Escalated to 'Mandatory Security Sign-Off'\", dec_auth.review_level == \"Mandatory Security Sign-Off\")\n        self.log_test(\"Phase 3\", \"Large Auth Diff Auto-Apply Blocked (Requires Human Review)\", not dec_auth.allowed_auto_apply)\n\n        # 2. Tenancy diff with minimal churn (<= 10 lines) -> Peer Review Recommended & Allowed\n        tenant_diff = \"\"\"--- a/apps/billing/tenant_models.py\n+++ b/apps/billing/tenant_models.py\n@@ -10,1 +10,1 @@\n-    invoice = Invoice.objects.get(id=inv_id)\n+    invoice = Invoice.objects.get(id=inv_id, tenant_id=req.user.tenant_id)\n\"\"\"\n        dec_tenant = gov.evaluate_diff(tenant_diff)\n        self.log_test(\"Phase 3\", \"Minimal Tenancy Diff Escalated to 'Peer Review Recommended'\", dec_tenant.review_level == \"Peer Review Recommended\")\n        self.log_test(\"Phase 3\", \"Minimal Tenancy Diff Allowed with Governance Badge\", dec_tenant.allowed_auto_apply)\n\n        # 3. CI/CD Workflow diff -> Escalated\n        ci_diff = \"\"\"--- a/.github/workflows/deploy.yml\n+++ b/.github/workflows/deploy.yml\n@@ -5,1 +5,2 @@\n-      - uses: actions/checkout@v2\n+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29\n+        with: { persist-credentials: false }\n\"\"\"\n        dec_ci = gov.evaluate_diff(ci_diff)\n        self.log_test(\"Phase 3\", \"CI/CD Workflow Diff Flagged as Sensitive Context\", dec_ci.escalation_required)\n\n        # 4. Standard non-sensitive utility file -> Automatic\n        util_diff = \"\"\"--- a/utils/formatters.py\n+++ b/utils/formatters.py\n@@ -3,1 +3,1 @@\n-def fmt(s): return s.strip()\n+def fmt(s): return s.strip().lower()\n\"\"\"\n        dec_util = gov.evaluate_diff(util_diff)\n        self.log_test(\"Phase 3\", \"Non-Sensitive File Assigned 'Automatic' Review Level\", dec_util.review_level == \"Automatic\" and dec_util.allowed_auto_apply)\n\n    def _test_phase_4_negative_tests(self):\n        \"\"\"\n        Verifies that safe modern code patterns produce ZERO false positive findings:\n        1. Safe Django 5.x Async Query\n        2. Safe FastAPI Annotated Dependency\n        3. Safe SQLAlchemy 2.0 select().where()\n        4. Safe Next.js 14 Server Action with auth() barrier\n        5. Safe File Storage with resolve() and secure_filename()\n        6. Safe GitHub Actions with SHA Pinning and permissions: read-all\n        \"\"\"\n        # 1. Safe Django 5.x\n        safe_django_code = \"\"\"from django.shortcuts import aget_object_or_404\nasync def view_invoice(request, invoice_id):\n    # Fully scoped query\n    invoice = await aget_object_or_404(Invoice, id=invoice_id, tenant_id=request.user.tenant_id)\n    return JsonResponse({\"id\": invoice.id})\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe Django 5.x Async Query Validated (No Missing Tenant Scope)\", \"tenant_id=request.user.tenant_id\" in safe_django_code)\n\n        # 2. Safe FastAPI Annotated Dependency\n        safe_fastapi_code = \"\"\"from typing import Annotated\nfrom fastapi import FastAPI, Depends, HTTPException\n\nasync def admin_endpoint(current_user: Annotated[User, Depends(get_verified_current_user)]):\n    if \"admin\" not in current_user.roles:\n        raise HTTPException(status_code=403)\n    return {\"status\": \"ok\"}\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe FastAPI Annotated Dependency Validated (No Untrusted Header)\", \"Depends(get_verified_current_user)\" in safe_fastapi_code)\n\n        # 3. Safe SQLAlchemy 2.0 select()\n        safe_sqla_code = \"\"\"from sqlalchemy import select\nasync def get_user_account(session: AsyncSession, acc_id: int, tenant_id: str):\n    stmt = select(Account).where(Account.id == acc_id, Account.tenant_id == tenant_id)\n    res = await session.scalars(stmt)\n    return res.first()\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe SQLAlchemy 2.0 select() Validated (Tenant Predicate Chained)\", \"Account.tenant_id == tenant_id\" in safe_sqla_code)\n\n        # 4. Safe Next.js 14 Server Action\n        safe_nextjs_code = \"\"\"\"use server\";\nexport async function deleteItem(itemId: string) {\n    const session = await auth();\n    if (!session || !session.user) throw new Error(\"Unauthorized\");\n    await db.item.delete({ where: { id: itemId, userId: session.user.id } });\n}\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe Next.js 14 Server Action Validated (Auth Barrier & User Scoping)\", \"const session = await auth()\" in safe_nextjs_code)\n\n        # 5. Safe Upload Storage\n        safe_upload_code = \"\"\"import os\nfrom pathlib import Path\nfrom werkzeug.utils import secure_filename\n\nBASE_DIR = Path(\"/var/uploads\").resolve()\ndef save_file(upload_file):\n    safe_name = secure_filename(upload_file.filename)\n    dest = (BASE_DIR / safe_name).resolve()\n    if not str(dest).startswith(str(BASE_DIR)):\n        raise ValueError(\"Traversal blocked\")\n    with open(dest, \"wb\") as f:\n        f.write(upload_file.read())\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe Storage Upload Validated (Path Traversal Boundary Enforced)\", \"secure_filename\" in safe_upload_code and \"startswith(str(BASE_DIR))\" in safe_upload_code)\n\n    def _test_phase_5_report_consistency(self):\n        \"\"\"\n        Audits cross-artifact consistency across all generated files in a run folder:\n        manifest.json <-> summary.md <-> findings.md <-> remediation.md <-> sarif.json <-> evidence.json\n        \"\"\"\n        audit_findings = [\n            {\n                \"finding_id\": \"fnd-audit-01\",\n                \"fingerprint_id\": \"TG-FND-0123456789ab\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Multi-Tenant Query Scoping\",\n                \"severity\": \"High\",\n                \"confidence_score\": 95,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 10, \"line_end\": 10},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n                \"what_is_wrong\": \"Unscoped tenant query.\",\n                \"what_should_change\": \"Scope query by tenant_id.\",\n                \"proposed_diff\": \"--- a/views.py\\n+++ b/views.py\\n@@ -1,1 +1,1 @@\\n-old\\n+new\\n\",\n                \"verification_steps\": \"Query another tenant invoice.\",\n            }\n        ]\n\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(audit_findings, target_name=\"consistency_audit\", run_id=\"qa-consistency-01\", export_sarif=True)\n        bundles = wf.execute_harden(run_mgr, audit_findings)\n        recheck_res = wf.execute_recheck(run_mgr, [{\n            \"finding_id\": \"fnd-audit-01\",\n            \"rule_id\": \"TG-DB-004\",\n            \"target_file\": \"apps/billing/views.py\",\n            \"orig_snippet\": \"old\",\n            \"post_snippet\": \"new\",\n            \"is_safe\": True,\n            \"is_unsafe\": False\n        }])\n\n        # 1. Manifest vs Finding count\n        with open(run_mgr.manifest_file, \"r\", encoding=\"utf-8\") as f:\n            manifest_data = json.load(f)\n        total_in_manifest = manifest_data.get(\"status_counts\", {}).get(\"total_findings\", 0)\n        self.log_test(\"Phase 5\", \"Manifest Total Finding Count Matches (1 item)\", total_in_manifest == 1)\n\n        # 2. SARIF vs Finding Artifacts\n        with open(run_mgr.sarif_file, \"r\", encoding=\"utf-8\") as f:\n            sarif_data = json.load(f)\n        sarif_fnd_id = sarif_data[\"runs\"][0][\"results\"][0][\"properties\"][\"finding_id\"]\n        findings_md_txt = run_mgr.findings_file.read_text(encoding=\"utf-8\")\n        self.log_test(\"Phase 5\", \"SARIF Finding ID Aligns with Findings Report Finding ID\", sarif_fnd_id in findings_md_txt)\n\n        # 3. Summary Markdown mentions Cluster and Verified Status\n        summary_txt = run_mgr.summary_file.read_text(encoding=\"utf-8\")\n        self.log_test(\"Phase 5\", \"Summary Report Accurately Summarizes Root-Cause Cluster\", \"cluster-tenant-isolation\" in summary_txt)\n        self.log_test(\"Phase 5\", \"Recheck Markdown Accurately Classifies Status (Confirmed Fixed)\", \"Confirmed Fixed\" in run_mgr.recheck_file.read_text(encoding=\"utf-8\"))\n\n    def _generate_qa_v6_3_report(self):\n        lines = [\n            \"# TorusGuard v0.6.3 \u2014 Final Drift, Upload, and Sensitive-Path Sign-Off Report\",\n            f\"\\n**Execution Date:** {datetime.utcnow().strftime('%B %d, %Y')}\",\n            \"**Target Branch:** `v6`\",\n            \"**Architecture Version:** `v0.6.3`\",\n            f\"**Total Verification Checks:** {len(self.results)}\",\n            f\"**Passed Checks:** {self.passed_tests}\",\n            f\"**Failed Checks:** {self.failed_tests}\",\n            f\"**Final Verdict:** {'\u2705 READY FOR v0.6.3 RELEASE (v0.6.x Cycle Complete)' if self.failed_tests == 0 else '\u274c BLOCKED'}\\n\",\n            \"---\",\n            \"\\n## 1. Five-Phase Hardening Breakdown\\n\",\n            \"| Phase | Subsystem Under Verification | Passed / Total | Status | Key Highlights |\",\n            \"|---|---|:---:|:---:|---|\",\n            \"| **Phase 1** | Cross-Run Drift & Identity Stability | 4/4 | \u2705 **PASS** | Fingerprint invariant across 3 simulated commits with line shifts & comment edits. |\",\n            \"| **Phase 2** | GitHub Code Scanning SARIF Upload | 5/5 | \u2705 **PASS** | `partialFingerprints` (`primaryLocationLineHash`) verified for alert deduplication. |\",\n            \"| **Phase 3** | Sensitive-Path Governance & Escalation | 4/4 | \u2705 **PASS** | Strict escalation (`Mandatory Security Sign-Off`) enforced on Auth, Tenancy, & CI/CD. |\",\n            \"| **Phase 4** | Modern-Stack Negative Tests | 5/5 | \u2705 **PASS** | Zero false positives on safe Django async, FastAPI `Annotated`, SQLAlchemy 2.0, & Next.js. |\",\n            \"| **Phase 5** | Cross-Artifact Report Audit | 4/4 | \u2705 **PASS** | 100% data consistency verified across Manifest, Summary, SARIF, Recheck, & Bundles. |\",\n            \"\\n---\",\n            \"\\n## 2. GitHub Code Scanning Compatibility Sign-Off\\n\",\n            \"- **Schema Validation:** Fully compliant with OASIS SARIF v2.1.0 JSON specification.\",\n            \"- **Alert Deduplication:** Emits deterministic `partialFingerprints` so GitHub tracks issues across commits without creating duplicate alerts.\",\n            \"- **Level Mapping:** Accurately maps severity levels to SARIF levels (`error` for Critical/High, `warning` for Medium, `note` for Low).\",\n            \"- **URI Normalization:** Standardizes relative path resolution under `%SRCROOT%`.\",\n            \"\\n---\",\n            \"\\n## 3. Sensitive-Path Governance Policy Matrix\\n\",\n            \"| Domain | Sensitive Keywords / Paths | Low Churn ($\\le 10$ lines) | High Churn ($> 10$ lines) / Multi-File |\",\n            \"|---|---|:---:|:---:|\",\n            \"| **Authentication** | `auth`, `login`, `jwt`, `token`, `session`, `password` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **Multi-Tenancy** | `tenant`, `tenant_id`, `organization_id`, `org_id` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **Secrets & Crypto** | `secret`, `api_key`, `private_key`, `crypto`, `hmac` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **File Storage** | `upload`, `storage`, `filepath`, `save_file` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **CI/CD Workflows** | `.github/workflows/`, `Dockerfile`, `compose.yaml` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **Standard Code** | General utility functions, UI formatting | \u2705 Automatic Apply | Peer Review Recommended |\",\n            \"\\n---\",\n            \"\\n## 4. Final Release Readiness Checklist\\n\",\n            \"- [x] Stable finding identities across reruns and line shifts.\",\n            \"- [x] No duplicate alert noise in GitHub SARIF upload.\",\n            \"- [x] Sensitive changes escalate correctly and block unsafe auto-apply.\",\n            \"- [x] Modern safe patterns remain unflagged (zero false positives).\",\n            \"- [x] Reports remain consistent, trustworthy, and complete.\",\n            \"- [x] TorusGuard v0.6.x is fully hardened and ready for v7 development.\",\n        ]\n\n        with open(self.reports_dir / \"QA-SUMMARY-v0.6.3.md\", \"w\", encoding=\"utf-8\") as f:\n            f.write(\"\\n\".join(lines) + \"\\n\")\n\n\nif __name__ == \"__main__\":\n    qa_root = Path(tempfile.mkdtemp(prefix=\"torusguard-harden-qa-\"))\n    try:\n        runner = V63HardeningRunner(qa_root)\n        success = runner.run_all()\n    finally:\n        shutil.rmtree(qa_root, ignore_errors=True)\n    sys.exit(0 if success else 1)\n    sys.exit(0 if success else 1)"
+}

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-119-61557c/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-119-61557c
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `harness/validate_v0_6_3_hardening.py:119`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/harness/validate_v0_6_3_hardening.py
++++ b/harness/validate_v0_6_3_hardening.py
+@@ -117,5 +117,5 @@
+         snippet_v1 = """def process_invoice(req, inv_id):
+     # Retrieve invoice
+-    inv = Invoice.objects.get(id=inv_id)
++    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)
+     return inv
+ """
+
+```

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-119-61557c/patch.diff

@@ -0,0 +1,9 @@
+--- a/harness/validate_v0_6_3_hardening.py
++++ b/harness/validate_v0_6_3_hardening.py
+@@ -117,5 +117,5 @@
+         snippet_v1 = """def process_invoice(req, inv_id):
+     # Retrieve invoice
+-    inv = Invoice.objects.get(id=inv_id)
++    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)
+     return inv
+ """

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-265-996ca3/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-265-996ca3",
+  "finding_id": "TG-DB-004-14a2d74f",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/validate_v1_0_0_memory.py",
+  "line_number": 265,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/validate_v1_0_0_memory.py\n+++ b/harness/validate_v1_0_0_memory.py\n@@ -263,5 +263,5 @@\n -    return Bill.objects.filter(id=id, tenant=tenant)\n +def get_bill(id):\n-+    return Bill.objects.get(id=id)\n++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)\n \"\"\"\n         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "#!/usr/bin/env python3\n\"\"\"\nTorusGuard v1.0.0 Adaptive Security Memory Engine Test Suite\nValidates:\n1. Memory directory scaffolding & privacy isolation (.gitignore)\n2. Event recording across all 6 event types\n3. Pattern distillation (amplification & categorization)\n4. Pre-computed context window computation (JSON cards & token budget <= 2000)\n5. False positive suppression\n6. Memory decay (TTL enforcement)\n7. Export and Import roundtrip\n8. Memory compaction (events archive)\n9. Privacy verification (npm tarball & git status)\n10. Memory-augmented confidence scoring\n11. Content-aware diff regression detection (TG-DIFF-004)\n\"\"\"\n\nimport os\nimport sys\nimport json\nimport shutil\nimport tempfile\nimport datetime\nfrom pathlib import Path\n\n# Ensure UTF-8 stdout/stderr on Windows consoles\nif sys.stdout and hasattr(sys.stdout, \"reconfigure\"):\n    try:\n        sys.stdout.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n    except Exception:\n        pass\nif sys.stderr and hasattr(sys.stderr, \"reconfigure\"):\n    try:\n        sys.stderr.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n    except Exception:\n        pass\n\nROOT_DIR = Path(__file__).resolve().parent.parent\nSCRIPTS_DIR = ROOT_DIR / \".torusguard\" / \"scripts\"\nsys.path.insert(0, str(SCRIPTS_DIR))\n\nimport memory_engine  # type: ignore\nimport finding_scorer  # type: ignore\nimport diff_guard  # type: ignore\n\n\ndef test_v1_0_0_memory_engine():\n    print(\"=\" * 80)\n    print(\"TORUSGUARD v1.0.0 ADAPTIVE SECURITY MEMORY ENGINE TEST SUITE\")\n    print(\"=\" * 80)\n\n    with tempfile.TemporaryDirectory() as tmp_dir:\n        test_root = Path(tmp_dir).resolve()\n        tg_dir = test_root / \".torusguard\"\n        tg_dir.mkdir(parents=True, exist_ok=True)\n\n        # ---------------------------------------------------------------------\n        # 1. Test Scaffolding & Memory Directory Structure\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 1. Testing Memory Scaffolding & Structure ---\")\n        paths = memory_engine.ensure_memory_structure(root_dir=test_root)\n        assert paths[\"memory\"].is_dir(), \"Memory directory not created\"\n        assert paths[\"events\"].is_dir(), \"Events directory not created\"\n        assert paths[\"gitignore\"].is_file(), \"Missing memory/.gitignore\"\n        assert paths[\"gitignore\"].read_text(encoding=\"utf-8\").strip() == \"*\", \"memory/.gitignore must contain *\"\n        assert paths[\"patterns\"].is_file(), \"Missing patterns.json\"\n        assert paths[\"context\"].is_file(), \"Missing context.json\"\n        assert paths[\"profile\"].is_file(), \"Missing profile.json\"\n        assert paths[\"decay\"].is_file(), \"Missing decay.json\"\n        assert (paths[\"events\"] / \".gitkeep\").is_file(), \"Missing events/.gitkeep\"\n        print(\"  [PASS] Memory directory structure, files, and isolation .gitignore created cleanly\")\n\n        # ---------------------------------------------------------------------\n        # 2. Test Event Recording Across All 6 Types\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 2. Testing Event Recording (All 6 Event Types) ---\")\n        event_types = [\n            (\"audit_finding\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/views.py\", \"line_number\": 42, \"severity\": \"high\", \"confidence_score\": 85, \"code_hash\": \"abc123hash\"}),\n            (\"fix_applied\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/views.py\", \"line_number\": 42, \"fix_strategy\": \"tenant_filter_added\"}),\n            (\"fix_verified\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/views.py\", \"verification_result\": \"fixed\"}),\n            (\"false_positive\", {\"rule_id\": \"TG-INPUT-002\", \"file_path\": \"tests/mock.py\", \"suppression_reason\": \"Test fixture intentional sink\"}),\n            (\"pattern_learned\", {\"rule_id\": \"TG-SEC-001\", \"metadata\": {\"note\": \"Learned from manual review\"}}),\n            (\"stack_changed\", {\"metadata\": {\"old\": \"Flask\", \"new\": \"FastAPI\"}})\n        ]\n\n        recorded_events = []\n        for etype, edata in event_types:\n            evt = memory_engine.record_event(etype, edata, root_dir=test_root)\n            assert evt.get(\"event_type\") == etype, f\"Recorded wrong type: {etype}\"\n            assert evt.get(\"event_id\", \"\").startswith(\"evt-\"), \"Missing or invalid event_id\"\n            assert evt.get(\"timestamp\"), \"Missing timestamp\"\n            assert evt.get(\"version\") in (\"1.0.0\", memory_engine.VERSION), \"Version mismatch in event\"\n            recorded_events.append(evt)\n\n        all_events = memory_engine.load_all_events(root_dir=test_root)\n        assert len(all_events) == 6, f\"Expected 6 events, found {len(all_events)}\"\n        print(f\"  [PASS] All 6 event types successfully logged and validated ({len(all_events)} events)\")\n\n        # ---------------------------------------------------------------------\n        # 3. Test Pattern Distillation & Confidence Amplification\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 3. Testing Pattern Distillation & Confidence Amplification ---\")\n        # Add repeated fixes across multiple files to test amplification\n        memory_engine.record_event(\"audit_finding\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/models.py\", \"severity\": \"high\"}, root_dir=test_root)\n        memory_engine.record_event(\"fix_applied\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/models.py\", \"fix_strategy\": \"tenant_filter_added\"}, root_dir=test_root)\n        memory_engine.record_event(\"fix_verified\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/models.py\", \"verification_result\": \"fixed\"}, root_dir=test_root)\n\n        patterns = memory_engine.distill_patterns(root_dir=test_root)\n        assert len(patterns) >= 2, f\"Expected at least 2 patterns, found {len(patterns)}\"\n\n        # Find recurring fix pattern for TG-DB-004\n        db_pats = [p for p in patterns if p.get(\"rule_id\") == \"TG-DB-004\"]\n        assert len(db_pats) >= 1, \"TG-DB-004 pattern not distilled\"\n        tg_pat = db_pats[0]\n        assert tg_pat.get(\"occurrences\", 0) >= 2, \"Expected multiple occurrences\"\n        assert len(tg_pat.get(\"affected_files\", [])) >= 2, \"Expected multi-file tracking\"\n        assert tg_pat.get(\"confidence\", 0) >= 70, f\"Confidence not amplified: {tg_pat.get('confidence')}\"\n        print(f\"  [PASS] Distilled {len(patterns)} patterns with multi-file confidence amplification (Score: {tg_pat.get('confidence')})\")\n\n        # ---------------------------------------------------------------------\n        # 4. Test Pre-Computed Context Window (JSON Cards & Budget Enforcement)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 4. Testing Context Window Generation & Token Budget ---\")\n        ctx = memory_engine.compute_context_window(max_tokens=2000, root_dir=test_root)\n        assert ctx.get(\"version\") in (\"1.0.0\", memory_engine.VERSION), \"Context version mismatch\"\n        assert ctx.get(\"token_estimate\", 0) <= 2000, \"Context exceeds 2000 token budget\"\n        assert len(ctx.get(\"cards\", [])) >= 2, \"Context missing intelligence cards\"\n\n        # Check card format: card_id, card_type, priority, title, summary, card_data\n        for c in ctx[\"cards\"]:\n            assert \"card_id\" in c and \"card_type\" in c and \"priority\" in c\n            assert \"title\" in c and \"summary\" in c and \"card_data\" in c\n            assert c[\"card_type\"] in (\"profile\", \"pattern\", \"regression_watch\", \"false_positive\", \"false_positive_suppression\", \"fix_idiom\", \"common_vulnerability\", \"golden_recipe\")\n\n        print(f\"  [PASS] Generated {len(ctx['cards'])} structured JSON cards within budget ({ctx['token_estimate']}/2000 tokens)\")\n\n        # ---------------------------------------------------------------------\n        # 5. Test False Positive Suppression\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 5. Testing False Positive Suppression ---\")\n        fp_evt = memory_engine.record_false_positive(\"TG-SEC-999\", file_path=\"config/test.py\", reason=\"Mock test token\", root_dir=test_root)\n        assert fp_evt.get(\"rule_id\") == \"TG-SEC-999\"\n\n        fp_pats = [p for p in memory_engine.distill_patterns(root_dir=test_root) if p.get(\"rule_id\") == \"TG-SEC-999\"]\n        assert len(fp_pats) == 1, \"False positive pattern not found\"\n        assert fp_pats[0][\"pattern_type\"] == \"false_positive_class\"\n        print(\"  [PASS] False positive suppression successfully cataloged into pattern store\")\n\n        # ---------------------------------------------------------------------\n        # 6. Test Memory Decay (TTL Expiration)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 6. Testing Memory Decay (TTL Enforcement) ---\")\n        # Artificially age a pattern's last_seen and decay_checkpoint by 100 days\n        pats = json.loads(paths[\"patterns\"].read_text(encoding=\"utf-8\"))\n        old_dt = (datetime.datetime.utcnow() - datetime.timedelta(days=100)).isoformat() + \"Z\"\n        for p in pats:\n            if p.get(\"rule_id\") == \"TG-DB-004\":\n                p[\"last_seen\"] = old_dt\n                p[\"decay_checkpoint\"] = old_dt\n                p[\"confidence\"] = 80\n        paths[\"patterns\"].write_text(json.dumps(pats, indent=2), encoding=\"utf-8\")\n\n        decayed = memory_engine.decay_stale_entries(ttl_days=90, root_dir=test_root)\n        assert decayed >= 1, f\"Expected decay of aged pattern, decayed: {decayed}\"\n\n        pats_after = json.loads(paths[\"patterns\"].read_text(encoding=\"utf-8\"))\n        db_after = [p for p in pats_after if p.get(\"rule_id\") == \"TG-DB-004\"][0]\n        assert db_after[\"confidence\"] < 80, f\"Confidence did not decay: {db_after['confidence']}\"\n        print(f\"  [PASS] Memory decay correctly reduced confidence of 100-day-old pattern ({80} -> {db_after['confidence']})\")\n\n        # ---------------------------------------------------------------------\n        # 7. Test Export and Import Roundtrip\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 7. Testing Export and Import Roundtrip ---\")\n        export_file = test_root / \"export_test.json\"\n        exp_res = memory_engine.export_memory(str(export_file), root_dir=test_root)\n        assert export_file.is_file(), \"Export file not created\"\n        assert exp_res[\"exported_events_count\"] > 0, \"No events exported\"\n\n        with open(export_file, \"r\", encoding=\"utf-8\") as f:\n            exp_data = json.load(f)\n        assert exp_data.get(\"format\") == \"torusguard-memory-bundle\"\n        assert len(exp_data.get(\"events\", [])) > 0\n\n        # Import into fresh workspace\n        fresh_root = Path(tempfile.mkdtemp()).resolve()\n        try:\n            imp_res = memory_engine.import_memory(str(export_file), root_dir=fresh_root)\n            assert imp_res[\"imported_events_count\"] == exp_res[\"exported_events_count\"]\n            fresh_pats = memory_engine.distill_patterns(root_dir=fresh_root)\n            assert len(fresh_pats) > 0, \"No patterns distilled after import\"\n            print(f\"  [PASS] Export/Import roundtrip verified: {imp_res['imported_events_count']} events transferred cleanly\")\n        finally:\n            shutil.rmtree(fresh_root, ignore_errors=True)\n\n        # ---------------------------------------------------------------------\n        # 8. Test Memory Compaction\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 8. Testing Memory Compaction ---\")\n        # Artificially age several loose event files by 40 days\n        old_ts = (datetime.datetime.utcnow() - datetime.timedelta(days=40)).isoformat() + \"Z\"\n        for evt_f in paths[\"events\"].glob(\"*.json\"):\n            if evt_f.name == \"compacted_archive.json\":\n                continue\n            try:\n                data = json.loads(evt_f.read_text(encoding=\"utf-8\"))\n                data[\"timestamp\"] = old_ts\n                evt_f.write_text(json.dumps(data, indent=2), encoding=\"utf-8\")\n            except Exception:\n                pass\n\n        compacted = memory_engine.compact_events(older_than_days=30, root_dir=test_root)\n        assert compacted > 0, \"No events compacted\"\n        assert paths[\"compacted\"].is_file(), \"Missing compacted_archive.json\"\n        print(f\"  [PASS] Compacted {compacted} aged event files into single archive\")\n\n        # ---------------------------------------------------------------------\n        # 9. Test Memory-Augmented Finding Scorer\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 9. Testing Memory-Augmented Finding Scorer ---\")\n        # Case A: False positive rule should receive negative boost (-30)\n        score_fp, band_fp, factors_fp = finding_scorer.compute_confidence_score(\n            evidence_quality=35,\n            reproduction_success=0,\n            independent_confirmations=15,\n            environmental_clarity=15,\n            rule_id=\"TG-SEC-999\",\n            root_dir=test_root\n        )\n        assert factors_fp[\"memory_boost\"] <= -20, f\"False positive was not suppressed: {factors_fp}\"\n        assert score_fp < 50, f\"Suppressed rule score too high: {score_fp}\"\n\n        # Case B: Recurring pattern receives positive boost\n        score_rec, band_rec, factors_rec = finding_scorer.compute_confidence_score(\n            evidence_quality=35,\n            reproduction_success=25,\n            independent_confirmations=15,\n            environmental_clarity=15,\n            rule_id=\"TG-DB-004\",\n            file_path=\"src/views.py\",\n            root_dir=test_root\n        )\n        assert factors_rec[\"memory_boost\"] >= 10, f\"Recurring pattern boost not applied: {factors_rec}\"\n        print(f\"  [PASS] Finding scorer correctly applies memory boost: Suppressed={factors_fp['memory_boost']}pts, Recurring=+{factors_rec['memory_boost']}pts\")\n\n        # ---------------------------------------------------------------------\n        # 10. Test Diff Guard Regression Detection (TG-DIFF-004)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 10. Testing Diff Guard Regression Detection ---\")\n        # Add regression watch pattern to memory\n        memory_engine.record_event(\"fix_verified\", {\n            \"rule_id\": \"TG-DB-004\",\n            \"file_path\": \"src/billing.py\",\n            \"verification_result\": \"regressed\"\n        }, root_dir=test_root)\n        memory_engine.distill_patterns(root_dir=test_root)\n\n        # Diff modifying src/billing.py\n        regression_diff = \"\"\"--- a/src/billing.py\n+++ b/src/billing.py\n@@ -12,2 +12,2 @@\n-def get_bill(id, tenant):\n-    return Bill.objects.filter(id=id, tenant=tenant)\n+def get_bill(id):\n+    return Bill.objects.get(organization_id=request.user.organization_id, id=id)\n\"\"\"\n        res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)\n        assert res_reg[\"status\"] == \"BLOCKED\", f\"Expected diff to be blocked by regression check: {res_reg}\"\n        rule_ids = [v[\"rule_id\"] for v in res_reg[\"violations\"]]\n        assert \"TG-DIFF-004\" in rule_ids, f\"Expected TG-DIFF-004 violation, got: {rule_ids}\"\n        print(f\"  [PASS] Diff Guard caught TG-DIFF-004 regression on file tracked in memory\")\n\n        # ---------------------------------------------------------------------\n        # 11. Test Privacy Invariants (.gitignore and NPM pack isolation)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 11. Testing Privacy & NPM Pack Isolation ---\")\n        root_gi = (ROOT_DIR / \".gitignore\").read_text(encoding=\"utf-8\")\n        assert \".torusguard/memory/\" in root_gi, \"Root .gitignore missing .torusguard/memory/\"\n\n        # Check npm pack does not include memory\n        import subprocess\n        npm_bin = \"npm.cmd\" if sys.platform == \"win32\" else \"npm\"\n        pack_res = subprocess.run([npm_bin, \"pack\", \"--dry-run\"], cwd=str(ROOT_DIR), capture_output=True, text=True, encoding=\"utf-8\", errors=\"replace\")\n        assert pack_res.returncode == 0, f\"npm pack failed: {pack_res.stderr}\"\n        assert \".torusguard/memory\" not in pack_res.stdout and \".torusguard/memory\" not in pack_res.stderr, \"Memory leaked into npm package!\"\n        print(\"  [PASS] Memory directory completely excluded from git and npm release package\")\n\n    print(\"\\n\" + \"=\" * 80)\n    print(\">>> ALL 11 TORUSGUARD v1.0.0 MEMORY ENGINE CHECKS PASSED (100%) <<<\")\n    print(\"=\" * 80 + \"\\n\")\n\n\nif __name__ == \"__main__\":\n    try:\n        test_v1_0_0_memory_engine()\n        sys.exit(0)\n    except AssertionError as e:\n        print(f\"\\n[FAIL] {e}\")\n        sys.exit(1)\n    except Exception as e:\n        print(f\"\\n[ERROR] Unexpected error: {e}\")\n        sys.exit(2)"
+}

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-265-996ca3/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-265-996ca3
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `harness/validate_v1_0_0_memory.py:265`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/harness/validate_v1_0_0_memory.py
++++ b/harness/validate_v1_0_0_memory.py
+@@ -263,5 +263,5 @@
+ -    return Bill.objects.filter(id=id, tenant=tenant)
+ +def get_bill(id):
+-+    return Bill.objects.get(id=id)
+++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)
+ """
+         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+
+```

package/.torusguard/runs/run-20260908-115240-audit/bundles/bnd-tg-db-004-265-996ca3/patch.diff

@@ -0,0 +1,9 @@
+--- a/harness/validate_v1_0_0_memory.py
++++ b/harness/validate_v1_0_0_memory.py
+@@ -263,5 +263,5 @@
+ -    return Bill.objects.filter(id=id, tenant=tenant)
+ +def get_bill(id):
+-+    return Bill.objects.get(id=id)
+++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)
+ """
+         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)