torusguard 1.3.0 → 1.3.2

package/.torusguard/snapshots/run-20260908-115240-audit/tests/test_v0_6_0_governed_remediation.py.bak

@@ -0,0 +1,353 @@
+"""
+TorusGuard v0.6.0 Governed Remediation Test Suite
+Tests:
+1. Run Folder System & Manifest Generation
+2. Stable Finding Identity Across Line Shifts
+3. Root-Cause Clustering across Django, FastAPI, Flask, SQLAlchemy
+4. Structured Remediation Bundle Generation
+5. Minimal Patch Governance (Line churn, file count, high-risk escalation)
+6. Targeted Recheck Status Transitions (Confirmed Fixed, Partially Fixed, Regressed, Needs Manual Review)
+7. SARIF v2.1.0 JSON Structured Export
+8. End-to-End v0.6.0 Governed Remediation Workflow Execution
+"""
+
+import unittest
+import tempfile
+import shutil
+import json
+import sys
+from pathlib import Path
+
+# Add project root to sys.path
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from core.identity import IdentityEngine, FindingFingerprint
+from core.clustering import ClusteringEngine, RootCauseCluster
+from core.bundle import BundleManager, RemediationBundle
+from core.governance import PatchGovernor, PatchPolicyDecision
+from core.rechecker import TargetedRechecker, TargetedRecheckResult, RecheckOutcome
+from core.run_manager import RunManager
+from core.sarif import SarifExporter
+from core.v6_workflow import V6Workflow
+
+
+class TestTorusGuardV060(unittest.TestCase):
+
+    def setUp(self):
+        self.test_dir = Path(tempfile.mkdtemp(prefix="torusguard-v0-6-test-"))
+
+    def tearDown(self):
+        shutil.rmtree(self.test_dir, ignore_errors=True)
+
+    def test_run_folder_creation_and_manifest(self):
+        """Verify RunManager initializes isolated run folder with all standard artifacts."""
+        run_mgr = RunManager(
+            base_dir=self.test_dir,
+            target_name="django-core",
+            command="audit",
+            run_id="run-20260831-test-01"
+        )
+        self.assertTrue(run_mgr.run_path.exists())
+        self.assertTrue(run_mgr.logs_dir.exists())
+        self.assertTrue(run_mgr.patches_dir.exists())
+        self.assertTrue(run_mgr.bundles_dir.exists())
+
+        # Write manifest and verify
+        run_mgr.write_manifest(
+            status_counts={
+                "total_findings": 2,
+                "confirmed": 1,
+                "high_confidence": 1,
+                "needs_review": 0,
+                "remediated": 0,
+                "verified_fixed": 0,
+                "regressed": 0,
+            }
+        )
+        self.assertTrue(run_mgr.manifest_file.exists())
+        with open(run_mgr.manifest_file, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        self.assertEqual(data["version"], "v0.6.3")
+        self.assertEqual(data["run_id"], "run-20260831-test-01")
+        self.assertEqual(data["status_counts"]["total_findings"], 2)
+
+    def test_stable_finding_identity_across_line_shifts(self):
+        """Verify Finding Fingerprint remains stable when comments or surrounding lines shift."""
+        code_v1 = """
+        def get_invoice(request, invoice_id):
+            # Fetch invoice directly without tenant filter
+            invoice = Invoice.objects.get(id=invoice_id)
+            return JsonResponse({"id": invoice.id})
+        """
+        code_v2_shifted = """
+        # Added extra docstring at the top of file
+        # Lines shifted down by 10 lines
+        def get_invoice(request, invoice_id):
+            invoice = Invoice.objects.get(id=invoice_id)
+            return JsonResponse({"id": invoice.id})
+        """
+
+        fp1 = IdentityEngine.generate_identity(
+            rule_id="TG-DB-004",
+            file_path="invoices/views.py",
+            code_snippet=code_v1,
+            sink_signature="Invoice.objects.get",
+            framework_marker="django",
+        )
+        fp2 = IdentityEngine.generate_identity(
+            rule_id="TG-DB-004",
+            file_path="invoices/views.py",
+            code_snippet=code_v2_shifted,
+            sink_signature="Invoice.objects.get",
+            framework_marker="django",
+        )
+
+        self.assertEqual(fp1.fingerprint_id, fp2.fingerprint_id)
+        self.assertEqual(fp1.region_hash, fp2.region_hash)
+        self.assertTrue(fp1.fingerprint_id.startswith("TG-DB-"))
+
+    def test_root_cause_clustering(self):
+        """Verify grouping of disparate findings into systemic root-cause clusters."""
+        findings = [
+            {
+                "finding_id": "fnd-01",
+                "rule_id": "TG-DB-004",
+                "title": "Missing Tenant Filter",
+                "severity": "High",
+                "target": {"file_path": "backend/api/users.py", "line_start": 20, "line_end": 25},
+            },
+            {
+                "finding_id": "fnd-02",
+                "rule_id": "TG-DB-004",
+                "title": "Missing Tenant Filter on Invoices",
+                "severity": "Critical",
+                "target": {"file_path": "backend/api/invoices.py", "line_start": 45, "line_end": 50},
+            },
+            {
+                "finding_id": "fnd-03",
+                "rule_id": "TG-INPUT-006",
+                "title": "Unsafe Upload Path",
+                "severity": "High",
+                "target": {"file_path": "backend/services/uploader.py", "line_start": 12, "line_end": 18},
+            }
+        ]
+
+        clusters = ClusteringEngine.cluster_findings(findings)
+        self.assertEqual(len(clusters), 2)
+
+        cluster_map = {c.cluster_id: c for c in clusters}
+        self.assertIn("cluster-tenant-isolation", cluster_map)
+        self.assertIn("cluster-path-traversal", cluster_map)
+
+        tenant_cluster = cluster_map["cluster-tenant-isolation"]
+        self.assertEqual(len(tenant_cluster.finding_ids), 2)
+        self.assertEqual(len(tenant_cluster.affected_files), 2)
+        self.assertEqual(tenant_cluster.risk_severity, "Critical")
+
+    def test_remediation_bundle_generation(self):
+        """Verify structured remediation bundle creates all 5 expected artifacts."""
+        finding = {
+            "finding_id": "TG-AUTH-008-abc123",
+            "rule_id": "TG-AUTH-008",
+            "title": "Untrusted Role Header Injection",
+            "severity": "High",
+            "target": {"file_path": "middleware/auth.py"},
+            "what_is_wrong": "Role is read directly from unauthenticated header X-Role.",
+            "why_it_matters": "Allows unprivileged users to escalate to Admin role.",
+            "what_should_change": "Derive role from verified JWT session payload.",
+            "proposed_diff": "--- a/middleware/auth.py\n+++ b/middleware/auth.py\n@@ -1,2 +1,2 @@\n-role = req.headers.get('X-Role')\n+role = req.user.role\n",
+            "verification_steps": "Send X-Role header and assert 403 Forbidden.",
+        }
+
+        bundle = BundleManager.create_bundle(finding, cluster_id="cluster-header-trust")
+        bundle_dir = bundle.write_to_directory(self.test_dir)
+
+        self.assertTrue((bundle_dir / "finding.md").exists())
+        self.assertTrue((bundle_dir / "remediation.md").exists())
+        self.assertTrue((bundle_dir / "minimal_patch_plan.md").exists())
+        self.assertTrue((bundle_dir / "verify-after-change.md").exists())
+        self.assertTrue((bundle_dir / "metadata.json").exists())
+
+        with open(bundle_dir / "metadata.json", "r", encoding="utf-8") as f:
+            meta = json.load(f)
+        self.assertEqual(meta["bundle_id"], "bundle-TG-AUTH-008-abc123")
+        self.assertEqual(meta["cluster_id"], "cluster-header-trust")
+
+    def test_minimal_patch_governance(self):
+        """Verify governance policy checks on line churn, file limits, and high-risk escalation."""
+        governor = PatchGovernor(max_additions_per_file=15, max_deletions_per_file=10)
+
+        # 1. Clean minimal patch
+        clean_diff = """--- a/services/helper.py
++++ b/services/helper.py
+@@ -10,3 +10,3 @@
+-val = raw_input
++val = sanitize(raw_input)
+"""
+        decision_clean = governor.evaluate_diff(clean_diff, "services/helper.py")
+        self.assertTrue(decision_clean.allowed_auto_apply)
+        self.assertFalse(decision_clean.escalation_required)
+        self.assertEqual(decision_clean.line_additions, 1)
+
+        # 2. Oversized patch (exceeds line additions)
+        oversized_lines = ["--- a/services/helper.py", "+++ b/services/helper.py"]
+        for i in range(25):
+            oversized_lines.append(f"+line_{i} = True")
+        oversized_diff = "\n".join(oversized_lines)
+
+        decision_oversized = governor.evaluate_diff(oversized_diff, "services/helper.py")
+        self.assertFalse(decision_oversized.allowed_auto_apply)
+        self.assertTrue(any("exceed threshold" in r for r in decision_oversized.rejection_reasons))
+
+        # 3. High-risk context (touching auth file with non-trivial churn)
+        high_risk_lines = ["--- a/backend/auth/login.py", "+++ b/backend/auth/login.py"]
+        for i in range(12):
+            high_risk_lines.append(f"+auth_check_{i}()")
+        high_risk_diff = "\n".join(high_risk_lines)
+
+        decision_high_risk = governor.evaluate_diff(high_risk_diff, "backend/auth/login.py")
+        self.assertTrue(decision_high_risk.escalation_required)
+        self.assertFalse(decision_high_risk.allowed_auto_apply)
+
+    def test_targeted_recheck_outcomes(self):
+        """Verify recheck transitions: Confirmed Fixed, Regressed, Needs Manual Review."""
+        # 1. Confirmed Fixed
+        res_fixed = TargetedRechecker.verify_finding(
+            finding_id="fnd-01",
+            rule_id="TG-DB-004",
+            target_file="models/query.py",
+            original_code_snippet="return Model.objects.all()",
+            post_fix_code_snippet="return Model.objects.filter(tenant=request.tenant)",
+            is_safe_pattern_present=True,
+            is_unsafe_pattern_present=False,
+        )
+        self.assertEqual(res_fixed.outcome, RecheckOutcome.CONFIRMED_FIXED)
+        self.assertEqual(len(res_fixed.regressions_detected), 0)
+
+        # 2. Regressed (introduced new vulnerability)
+        res_regressed = TargetedRechecker.verify_finding(
+            finding_id="fnd-02",
+            rule_id="TG-INPUT-006",
+            target_file="views/upload.py",
+            original_code_snippet="file.save(filename)",
+            post_fix_code_snippet="os.system(f'cp {filename} /tmp')",
+            is_safe_pattern_present=False,
+            is_unsafe_pattern_present=True,
+            introduced_new_flaws=["TG-CMD-001: Command Injection in upload handler"],
+        )
+        self.assertEqual(res_regressed.outcome, RecheckOutcome.REGRESSED)
+        self.assertIn("Command Injection", res_regressed.regressions_detected[0])
+
+        # 3. Needs Manual Review
+        res_manual = TargetedRechecker.verify_finding(
+            finding_id="fnd-03",
+            rule_id="TG-WEBHOOK-001",
+            target_file="webhooks/receiver.py",
+            original_code_snippet="verify_sig()",
+            post_fix_code_snippet="verify_sig()",
+            requires_manual_context=True,
+        )
+        self.assertEqual(res_manual.outcome, RecheckOutcome.NEEDS_MANUAL_REVIEW)
+
+    def test_sarif_v210_export(self):
+        """Verify valid SARIF v2.1.0 output structure and stable fingerprints."""
+        findings = [
+            {
+                "finding_id": "TG-DB-123456",
+                "fingerprint_id": "TG-DB-123456",
+                "rule_id": "TG-DB-004",
+                "title": "Missing Tenant Query Isolation",
+                "severity": "High",
+                "confidence_score": 95,
+                "confidence_band": "Confirmed",
+                "cluster_id": "cluster-tenant-isolation",
+                "target": {"file_path": "backend/models.py", "line_start": 40, "line_end": 45},
+                "evidence": {"code_snippet": "return self.query()"},
+            }
+        ]
+
+        sarif_obj = SarifExporter.generate_sarif(findings, tool_version="6.0.0")
+        self.assertEqual(sarif_obj["version"], "2.1.0")
+        self.assertEqual(len(sarif_obj["runs"]), 1)
+
+        driver = sarif_obj["runs"][0]["tool"]["driver"]
+        self.assertEqual(driver["name"], "TorusGuard")
+        self.assertEqual(driver["semanticVersion"], "6.0.0")
+
+        result = sarif_obj["runs"][0]["results"][0]
+        self.assertEqual(result["ruleId"], "TG-DB-004")
+        self.assertEqual(result["level"], "error")
+        self.assertEqual(result["fingerprints"]["torusguard/v6/stable_identity"], "TG-DB-123456")
+
+    def test_end_to_end_v6_workflow(self):
+        """Verify full end-to-end v6 workflow: audit -> harden -> apply -> recheck."""
+        workflow = V6Workflow(
+            target_root=self.test_dir,
+            output_base=self.test_dir / "runs",
+        )
+
+        raw_findings = [
+            {
+                "rule_id": "TG-INPUT-006",
+                "title": "Unsafe File Path Traversal",
+                "severity": "High",
+                "confidence_score": 92,
+                "confidence_band": "Confirmed",
+                "target": {"file_path": "uploader.py", "line_start": 10, "line_end": 15},
+                "evidence": {"code_snippet": "open(os.path.join(DIR, filename), 'wb')"},
+                "what_is_wrong": "Filename from client is not sanitized with secure_filename().",
+                "what_should_change": "Sanitize with werkzeug secure_filename.",
+                "proposed_diff": "--- a/uploader.py\n+++ b/uploader.py\n@@ -1,2 +1,2 @@\n-path = os.path.join(DIR, filename)\n+path = os.path.join(DIR, secure_filename(filename))\n",
+                "verification_steps": "Send ../etc/passwd in filename parameter.",
+            }
+        ]
+
+        # 1. Audit Phase
+        run_mgr = workflow.execute_audit(
+            raw_findings=raw_findings,
+            target_name="flask-uploader",
+            run_id="run-e2e-01",
+            export_sarif=True,
+        )
+        self.assertTrue(run_mgr.manifest_file.exists())
+        self.assertTrue(run_mgr.summary_file.exists())
+        self.assertTrue(run_mgr.findings_file.exists())
+        self.assertTrue(run_mgr.sarif_file.exists())
+
+        # 2. Harden Phase
+        with open(run_mgr.manifest_file, "r", encoding="utf-8") as f:
+            manifest_data = json.load(f)
+        self.assertEqual(manifest_data["status_counts"]["total_findings"], 1)
+
+        bundles = workflow.execute_harden(run_mgr, raw_findings)
+        self.assertEqual(len(bundles), 1)
+        self.assertTrue(run_mgr.remediation_file.exists())
+
+        # 3. Apply Phase
+        decisions = workflow.execute_apply(run_mgr, bundles)
+        self.assertEqual(len(decisions), 1)
+        self.assertTrue(decisions[0][1].allowed_auto_apply)
+        self.assertTrue(run_mgr.apply_plan_file.exists())
+        self.assertTrue(run_mgr.diff_summary_file.exists())
+        self.assertTrue(run_mgr.changed_files_file.exists())
+
+        # 4. Recheck Phase
+        recheck_scenarios = [
+            {
+                "finding_id": bundles[0].finding_id,
+                "rule_id": "TG-INPUT-006",
+                "target_file": "uploader.py",
+                "orig_snippet": "path = os.path.join(DIR, filename)",
+                "post_snippet": "path = os.path.join(DIR, secure_filename(filename))",
+                "is_safe": True,
+                "is_unsafe": False,
+            }
+        ]
+        recheck_results = workflow.execute_recheck(run_mgr, recheck_scenarios)
+        self.assertEqual(len(recheck_results), 1)
+        self.assertEqual(recheck_results[0].outcome, RecheckOutcome.CONFIRMED_FIXED)
+        self.assertTrue(run_mgr.recheck_file.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/README.md

@@ -5,14 +5,14 @@
 
   **Autonomous Security Guardrails, Governed Remediation, and Authorized Runtime Validation for AI-Built Web Applications.**
 
-  [![npm version](https://img.shields.io/npm/v/torusguard.svg?style=flat-square&color=cb3837&logo=npm)](https://www.npmjs.com/package/torusguard)
-  [![GitHub Packages](https://img.shields.io/badge/GitHub%20Packages-v1.3.0-181717.svg?style=flat-square&logo=github)](https://github.com/githubmofo/TorusGuard/pkgs/npm/torusguard)
-  [![Release](https://img.shields.io/badge/Release-v1.3.0-blue.svg?style=flat-square)](https://github.com/githubmofo/TorusGuard/releases/latest)
+  [![npm version](https://img.shields.io/badge/npm-v1.3.2-cb3837.svg?style=flat-square&logo=npm)](https://www.npmjs.com/package/torusguard)
+  [![GitHub Packages](https://img.shields.io/badge/GitHub%20Packages-v1.3.2-181717.svg?style=flat-square&logo=github)](https://github.com/githubmofo/TorusGuard/pkgs/npm/torusguard)
+  [![Release](https://img.shields.io/badge/Release-v1.3.2-blue.svg?style=flat-square)](https://github.com/githubmofo/TorusGuard/releases/latest)
   [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg?style=flat-square)](LICENSE)
   [![Python 3.10+](https://img.shields.io/badge/Python-3.10%2B-blue.svg?style=flat-square&logo=python&logoColor=white)](https://python.org)
   [![Node.js 18+](https://img.shields.io/badge/Node.js-18%2B-339933.svg?style=flat-square&logo=node.js&logoColor=white)](https://nodejs.org)
   [![SARIF: v2.1.0](https://img.shields.io/badge/SARIF-v2.1.0%20OASIS-purple.svg?style=flat-square)](.torusguard/schemas/)
-  [![Integrity: SHA--256](https://img.shields.io/badge/Integrity-SHA--256%20(112%20Files)-teal.svg?style=flat-square)](.torusguard/.manifest.json)
+  [![Integrity: SHA--256](https://img.shields.io/badge/Integrity-SHA--256%20(216%20Files)-teal.svg?style=flat-square)](.torusguard/.manifest.json)
   [![OWASP: Top 10](https://img.shields.io/badge/OWASP-Top%2010%20Aligned-orange.svg?style=flat-square)](docs/architecture/SECURITY_ARCHITECTURE.md)
 </div>
 
@@ -100,20 +100,20 @@ flowchart TD
 
 ---
 
-### 2. The 7-Stage Finding Lifecycle
-Every finding follows a strict closed-loop state machine with an unskippable **Human Gate** and rollback backup before disk modifications:
+### 2. The 7-Stage Finding Lifecycle (Dual-Strategy Governance)
+Every finding follows a strict closed-loop state machine supported equally via **Terminal CLI** (`npx torusguard ...`) and **AI Chat Workflows** (`/torusguard-...`) with an unskippable **Human Gate** and automatic `.bak` snapshots before disk modification:
 
 ```mermaid
 flowchart LR
-    Detect["1. DETECT<br/>Static AST Signal"] --> Classify["2. CLASSIFY<br/>0–100 Confidence"]
-    Classify --> Verify["3. VERIFY<br/>Authorized Probe"]
-    Verify --> Remediate["4. REMEDIATE<br/>Ponytail Patch Plan"]
-    Remediate --> Gate{"👤 Human Gate<br/>Approved?"}
-    Gate -- Yes --> Apply["5. APPLY<br/>Backup &amp; Surgical Patch"]
+    Detect["1. DETECT<br/>Static AST Signal<br/><code>audit · /audit</code>"] --> Classify["2. CLASSIFY<br/>0–100 Confidence"]
+    Classify --> Verify["3. VERIFY<br/>Authorized Probe<br/><code>verify · /verify</code>"]
+    Verify --> Remediate["4. REMEDIATE<br/>Ponytail Patch Plan<br/><code>harden · /harden</code>"]
+    Remediate --> Gate{"👤 Human Gate<br/>Approved? [y/N]"}
+    Gate -- Yes --> Apply["5. APPLY<br/>Backup &amp; Surgical Patch<br/><code>apply · /apply</code>"]
     Gate -- No --> Reject["❌ Discarded"]
-    Apply --> Recheck["6. RE-CHECK<br/>Differential AST Audit"]
-    Recheck -- Fixed --> Archive["7. ARCHIVE<br/>Golden Recipe Distilled"]
-    Recheck -- Regressed --> Rollback["⏪ Instant Rollback<br/>(pre_apply/*.bak)"]
+    Apply --> Recheck["6. RE-CHECK<br/>Differential AST Audit<br/><code>recheck · /recheck</code>"]
+    Recheck -- Fixed --> Archive["7. ARCHIVE<br/>Golden Recipe Distilled<br/><code>recipes</code>"]
+    Recheck -- Regressed --> Rollback["⏪ Instant Rollback<br/><code>rollback (.bak)</code>"]
 ```
 
 ---
@@ -198,27 +198,44 @@ flowchart TD
 
 ---
 
-## 🚀 60-Second Quickstart
+## 🚀 60-Second Quickstart (Dual-Strategy: CLI & Chat)
 
-### Method A: Via Node.js / NPX (Zero Setup)
+TorusGuard works natively in both standard terminal environments (Cursor, VS Code, CI/CD runners) and AI chat workflows:
+
+### Method A: Via Node.js / NPX (Full 7-Stage Governance Lifecycle)
 ```bash
-# 1. Initialize TorusGuard in your workspace
+# 1. Initialize TorusGuard in your workspace (or /torusguard init)
 npx torusguard init
 
-# 2. Run static security audit
+# 2. Run static security audit (or /torusguard audit)
 npx torusguard audit
 
-# 3. Generate visual dark-mode HTML dashboard
+# 3. Formulate minimal Ponytail candidate patches (or /torusguard harden)
+npx torusguard harden
+
+# 4. Review interactive Human Gate & apply with pre-apply rollback snapshots (.bak) (or /torusguard apply)
+npx torusguard apply
+
+# 5. Targeted differential re-scan verifying fix closure (or /torusguard recheck)
+npx torusguard recheck
+
+# 6. Explore distilled Golden Fix Recipes
+npx torusguard recipes
+
+# 7. Generate visual dark-mode HTML posture report (or /torusguard report)
 npx torusguard report --html
 
-# 4. Install Git Pre-Commit Diff Guard Hook (blocks dangerous commits)
+# 8. (Optional) Revert to pre-apply snapshot at any time
+npx torusguard rollback
+
+# 9. Install Git Pre-Commit Diff Guard Hook (blocks dangerous commits)
 npx torusguard diff-guard --install-hook
 
-# 5. Synchronize prompt guardrails across AI editors (<= 300 tokens)
+# 10. Synchronize prompt guardrails across AI editors (<= 300 tokens)
 npx torusguard rules sync
 ```
 
-### Method B: Via Pure Python 3.10+ (Standard Library)
+### Method B: Via Pure Python 3.10+ (Zero-Dependency Standard Library)
 ```bash
 # 1. Initialize workspace
 python .torusguard/scripts/bootstrap.py --workspace .
@@ -226,10 +243,28 @@ python .torusguard/scripts/bootstrap.py --workspace .
 # 2. Run static audit
 python .torusguard/scripts/finding_scorer.py --dir .
 
-# 3. Install Pre-Commit Diff Guard
+# 3. Formulate candidate patch plans (Ponytail Protocol <= 35 add, <= 25 del)
+python .torusguard/scripts/harden_runner.py
+
+# 4. Interactive Human Gate patch applier with pre-apply byte snapshots
+python .torusguard/scripts/apply_runner.py
+
+# 5. Targeted differential recheck
+python .torusguard/scripts/recheck_runner.py
+
+# 6. Explore distilled Golden Fix Recipes
+python .torusguard/scripts/recipes_runner.py
+
+# 7. Generate single-file visual HTML posture report
+python .torusguard/scripts/html_reporter.py
+
+# 8. Rollback pre-apply snapshots
+python .torusguard/scripts/apply_runner.py --rollback
+
+# 9. Install Pre-Commit Diff Guard
 python .torusguard/scripts/diff_guard.py --install-hook
 
-# 4. Sync AI IDE rules
+# 10. Sync AI IDE rules
 python .torusguard/scripts/rules_sync.py --workspace . --format all
 ```
 
@@ -239,15 +274,17 @@ python .torusguard/scripts/rules_sync.py --workspace . --format all
 
 | Command | Subcommands & Flags | Description |
 |---|---|---|
-| `torusguard init` | `[--stack <name>] [--profile <type>]` | Scaffolds `.torusguard/` with active security rules and workflows. |
-| `torusguard audit` | `[--scope <path>] [--format md\|json]` | Audits source code against active rules and emits run folder. |
+| `torusguard init` | `[--stack <name>] [--profile <type>]` | Scaffolds `.torusguard/` with active security rules, schemas, and workflows. |
+| `torusguard audit` | `[--scope <path>] [--format md\|json]` | Audits source code against active rules, scores confidence, and emits run folder. |
 | `torusguard verify` | `[--id <finding_id>]` | Probes authorized endpoints with automated credential masking. |
-| `torusguard harden` | `[--id <finding_id>]` | Generates 4-artifact Ponytail patch plans ($\le 35$ additions, $\le 25$ deletions). |
-| `torusguard apply` | `[--id <finding_id>] [--dry-run]` | Saves pre-apply `.bak` snapshots and applies surgical patch to disk. |
-| `torusguard recheck`| `[--id <finding_id>]` | Differentially re-evaluates AST sinks over modified scopes. |
-| `torusguard report` | `[--sarif] [--html] [--out <path>]` | Exports OASIS SARIF v2.1.0 or single-file visual HTML posture report. |
+| `torusguard harden` | `[--scope <path>] [--format md\|json]` | Formulates surgical candidate patch bundles adhering to Ponytail bounds ($\le 35$ additions, $\le 25$ deletions). |
+| `torusguard apply` | `[--bundle <id>] [--yes \| -y]` | Interactive terminal Human Gate (`[y/N/all/quit]`) with syntax diffs, creates `.bak` snapshots, applies patches, and distills Golden Recipes. |
+| `torusguard rollback` | `[--run <run_id>]` | Restores all files from `.torusguard/snapshots/<run_id>/` back to disk instantly. |
+| `torusguard recheck`| `[--scope <path>]` | Differentially re-evaluates AST sinks over modified scopes (`Confirmed Fixed` vs `Regressed`). |
+| `torusguard recipes`| `[--rule <id>] [--json]` | Interactive explorer for distilled, verified Golden Fix Recipes stored in persistent memory. |
+| `torusguard report` | `[--sarif] [--html] [--out <path>]` | Exports OASIS SARIF v2.1.0 or single-file visual HTML posture dashboard. |
 | `torusguard status` | `[--json]` | Displays stack detection, active rule count, memory metrics, and run history. |
-| `torusguard diff-guard`| `[--install-hook] [--diff <file>]` | Scans git diff for bypasses (`TG-DIFF-001..004`) or installs pre-commit hook. |
+| `torusguard diff-guard`| `[--install-hook] [--uninstall-hook] [--diff <file>]` | Scans git diff for bypasses (`TG-DIFF-001..004`) or installs pre-commit hook. |
 | `torusguard rules sync`| `[--format all\|cursor\|claude\|agent\|windsurf]` | Compiles project rules into AI IDE configs within $\le 300$ prompt tokens. |
 | `torusguard memory` | `status \| context \| export \| learn` | Inspects adaptive memory, generates proximity cards, or exports team packs. |
 
@@ -280,8 +317,8 @@ AI coding models often destroy working applications by attempting full-file rewr
 
 - **Strict Churn Limits:** Every fix is capped at $\le 35$ additions and $\le 25$ deletions.
 - **Full-File Rewrite Ban:** Large destructive edits are rejected by the patch engine.
-- **Rollback Snapshot Guarantee:** Before any file is modified, a byte-for-byte snapshot is saved to `pre_apply/<file>.bak`.
-- **Instant Rollback:** Restoring an original file takes 1 command (`cp pre_apply/<file>.bak <file>`).
+- **Rollback Snapshot Guarantee:** Before any file is modified, a byte-for-byte snapshot is saved to `.torusguard/snapshots/<run_id>/<path>.bak`.
+- **Instant Rollback:** Restoring original files takes 1 command (`npx torusguard rollback`).
 
 ---