torusguard 1.3.2 → 1.3.4

package/.torusguard/runs/report-latest.html

@@ -231,7 +231,7 @@
     <header>
       <div class="logo-group">
         <h1><span class="shield-icon">&#128737;</span> TorusGuard Security Posture</h1>
-        <div class="project-meta">Workspace: <strong>TorusGuard</strong> &middot; Stack: <strong>TypeScript</strong> &middot; 2026-09-08 11:54:16 IST</div>
+        <div class="project-meta">Workspace: <strong>TorusGuard</strong> &middot; Stack: <strong>TypeScript</strong> &middot; 2026-09-10 12:04:48 IST</div>
       </div>
       <div class="status-badge">&check; Local Governance Active</div>
     </header>
@@ -257,8 +257,8 @@
 
       <div class="card">
         <div class="stat-label">Active Memory Patterns</div>
-        <div class="stat-value">7</div>
-        <div class="stat-sub">0 suppressed &middot; 6 recurring</div>
+        <div class="stat-value">13</div>
+        <div class="stat-sub">0 suppressed &middot; 12 recurring</div>
       </div>
 
       <div class="card">

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-115-9a059e/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-115-9a059e",
+  "finding_id": "TG-DB-004-9a2f13c7",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/validate_v0_6_1_scale.py",
+  "line_number": 115,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/validate_v0_6_1_scale.py\n+++ b/harness/validate_v0_6_1_scale.py\n@@ -113,5 +113,5 @@\n                 \"severity\": \"High\",\n                 \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n-                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n+                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\"},\n             },\n             # FastAPI Microservice\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "\"\"\"\nTorusGuard v6.1 \u2014 Scale & Complexity Hardening Validation Harness\nValidates reliability, performance, and noise control on large, messier, and realistic repositories:\n- Complex monorepo with multiple apps (Django, FastAPI, Flask, Shared ORM)\n- Deeply nested directories (8+ levels)\n- Generated / vendor files mixed with source files (migrations, protobuf, min.js)\n- High-density vulnerability flood (250+ findings) collapsing into root-cause clusters\n- Performance benchmarks: scan, cluster, report, recheck, and SARIF generation under load\n- Generates QA-SUMMARY-v6.1.md\n\"\"\"\n\nimport os\nimport sys\nimport time\nimport json\nimport shutil\nimport tempfile\nfrom datetime import datetime\nfrom pathlib import Path\nfrom typing import Dict, List, Any\n\nPROJECT_ROOT = Path(__file__).resolve().parent.parent\nsys.path.insert(0, str(PROJECT_ROOT))\n\nfrom core.identity import IdentityEngine\nfrom core.clustering import ClusteringEngine, is_generated_file\nfrom core.bundle import BundleManager\nfrom core.governance import PatchGovernor\nfrom core.rechecker import TargetedRechecker, RecheckOutcome\nfrom core.run_manager import RunManager\nfrom core.sarif import SarifExporter\nfrom core.v6_workflow import V6Workflow\n\n\nclass ScaleBenchmarkRunner:\n    \"\"\"\n    Executes scale and complexity hardening verification for TorusGuard v6.1.\n    \"\"\"\n\n    def __init__(self, qa_root: Path):\n        self.qa_root = qa_root\n        self.runs_dir = qa_root / \"runs\"\n        self.reports_dir = qa_root / \"reports\"\n        self.logs_dir = qa_root / \"logs\"\n\n        self.runs_dir.mkdir(parents=True, exist_ok=True)\n        self.reports_dir.mkdir(parents=True, exist_ok=True)\n        self.logs_dir.mkdir(parents=True, exist_ok=True)\n\n        self.passed_tests = 0\n        self.failed_tests = 0\n        self.benchmarks: Dict[str, float] = {}\n        self.results: List[Dict[str, Any]] = []\n\n    def log_test(self, category: str, test_name: str, passed: bool, details: str = \"\"):\n        status = \"PASS\" if passed else \"FAIL\"\n        if passed:\n            self.passed_tests += 1\n            print(f\"  [{status}] [{category}] {test_name}\")\n        else:\n            self.failed_tests += 1\n            print(f\"  [{status}] [{category}] {test_name} -> {details}\")\n\n        self.results.append({\n            \"category\": category,\n            \"name\": test_name,\n            \"passed\": passed,\n            \"details\": details\n        })\n\n    def run_all(self) -> bool:\n        print(\"=\" * 80)\n        print(\"TORUSGUARD v6.1 \u2014 SCALE & COMPLEXITY HARDENING BENCHMARK\")\n        print(\"=\" * 80)\n\n        # 1. Complex Monorepo & Nested Fixture\n        print(\"\\n--- 1. Testing Complex Monorepo & Deeply Nested Architectures ---\")\n        self._test_monorepo_complexity()\n\n        # 2. Generated & Vendor Noise Suppression\n        print(\"\\n--- 2. Testing Generated File Noise Filtering ---\")\n        self._test_generated_file_filtering()\n\n        # 3. High-Density Vulnerability Flood & Clustering\n        print(\"\\n--- 3. Testing High-Density Vulnerability Collapsing (250+ findings) ---\")\n        self._test_high_density_clustering()\n\n        # 4. Performance & Scale Stress Benchmarks\n        print(\"\\n--- 4. Performance Benchmarks at Scale (2,500+ Files / 500+ Findings) ---\")\n        self._test_performance_benchmarks()\n\n        # 5. Patch Governance at Scale\n        print(\"\\n--- 5. Patch Governance & Monorepo Cross-Boundary Escalation ---\")\n        self._test_patch_governance_scale()\n\n        # 6. Generate v6.1 QA Sign-Off\n        print(\"\\n--- 6. Generating TorusGuard v6.1 QA Sign-Off Report ---\")\n        self._generate_qa_v6_1_report()\n\n        print(\"=\" * 80)\n        print(f\"SCALE BENCHMARK SUMMARY: {self.passed_tests} Passed | {self.failed_tests} Failed\")\n        print(\"=\" * 80)\n\n        return self.failed_tests == 0\n\n    def _test_monorepo_complexity(self):\n        # Monorepo with multiple apps and nested paths\n        monorepo_findings = [\n            # Django Core App\n            {\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Tenant Query Scoping in Billing\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\"},\n            },\n            # FastAPI Microservice\n            {\n                \"rule_id\": \"TG-SSRF-001\",\n                \"title\": \"Unvalidated Outbound Destination in Ingestion Service\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/fastapi_service/routes/fetcher.py\", \"line_start\": 18, \"line_end\": 18},\n                \"evidence\": {\"code_snippet\": \"httpx.get(target_url)\"},\n            },\n            # Flask Webhook Handler\n            {\n                \"rule_id\": \"TG-WEBHOOK-001\",\n                \"title\": \"Missing Webhook HMAC Verification\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/flask_webhook/handler.py\", \"line_start\": 12, \"line_end\": 12},\n                \"evidence\": {\"code_snippet\": \"payload = request.json\"},\n            },\n            # Deeply nested folder (8 levels)\n            {\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": \"Path Traversal in Deep Analytics Worker\",\n                \"severity\": \"High\",\n                \"target\": {\n                    \"file_path\": \"services/core/v1/subsystems/analytics/processors/workers/storage.py\",\n                    \"line_start\": 88,\n                    \"line_end\": 88\n                },\n                \"evidence\": {\"code_snippet\": \"open(os.path.join(DIR, filename), 'wb')\"},\n            },\n            # CI/CD Workflow file\n            {\n                \"rule_id\": \"TG-SUPPLY-001\",\n                \"title\": \"Unpinned GitHub Action in Production Pipeline\",\n                \"severity\": \"Medium\",\n                \"target\": {\"file_path\": \"infra/.github/workflows/deploy.yml\", \"line_start\": 15, \"line_end\": 15},\n                \"evidence\": {\"code_snippet\": \"uses: actions/checkout@v2\"},\n            }\n        ]\n\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(monorepo_findings, target_name=\"complex-monorepo\", run_id=\"qa-scale-monorepo-01\", export_sarif=True)\n\n        self.log_test(\"Monorepo\", \"All Monorepo Applications Discovered & Fingerprinted\", len(monorepo_findings) == 5)\n        self.log_test(\"Monorepo\", \"Run Folder Isolated for Monorepo with 10 Standard Artifacts\", run_mgr.summary_file.exists() and run_mgr.sarif_file.exists())\n\n        # Check clusters in monorepo\n        clusters = ClusteringEngine.cluster_findings(monorepo_findings)\n        self.log_test(\"Monorepo\", \"Disparate Framework Findings Clustered Accurately\", len(clusters) == 5)\n        self.log_test(\"Monorepo\", \"Hotspot Modules Computed Correctly\", any(c.hotspot_module == \"apps/django_core\" for c in clusters))\n\n    def _test_generated_file_filtering(self):\n        test_paths = [\n            (\"apps/core/models.py\", False),\n            (\"apps/core/migrations/0001_initial.py\", True),\n            (\"frontend/dist/bundle.js\", True),\n            (\"frontend/src/App.tsx\", False),\n            (\"proto/models_pb2.py\", True),\n            (\"static/js/vendor.min.js\", True),\n            (\"services/worker/handler.py\", False),\n        ]\n\n        for path, expected_ignored in test_paths:\n            actual = is_generated_file(path)\n            self.log_test(\"Filtering\", f\"Filter Classification for {path} (Ignored: {expected_ignored})\", actual == expected_ignored)\n\n    def _test_high_density_clustering(self):\n        # Generate 250 repeated findings across 30 files under 3 systemic root causes\n        high_density_findings = []\n        for i in range(120):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_db_{i}\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": f\"Missing Tenant Scoping in Endpoint {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 92,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"services/api/module_{i % 15}/views.py\", \"line_start\": 10 + i, \"line_end\": 12 + i},\n                \"evidence\": {\"code_snippet\": f\"Model_{i}.objects.get(id=id)\"},\n            })\n\n        for i in range(80):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_input_{i}\",\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": f\"Path Traversal in Uploader {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 90,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"services/uploads/uploader_{i % 10}.py\", \"line_start\": 5 + i, \"line_end\": 7 + i},\n                \"evidence\": {\"code_snippet\": f\"open(os.path.join(DIR, name_{i}))\"},\n            })\n\n        for i in range(50):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_auth_{i}\",\n                \"rule_id\": \"TG-AUTH-008\",\n                \"title\": f\"Untrusted Header in Service {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 88,\n                \"confidence_band\": \"High Confidence\",\n                \"target\": {\"file_path\": f\"services/gateway/auth_{i % 5}.py\", \"line_start\": 20 + i, \"line_end\": 22 + i},\n                \"evidence\": {\"code_snippet\": f\"request.headers.get('X-Role-{i}')\"},\n            })\n\n        # Test Clustering Collapsing\n        clusters = ClusteringEngine.cluster_findings(high_density_findings)\n        self.log_test(\"Clustering\", \"250 Findings Successfully Collapsed into Exactly 3 Clusters\", len(clusters) == 3)\n        self.log_test(\"Clustering\", \"High-Density Flag Set on Major Clusters\", all(c.is_high_density for c in clusters))\n\n        # Test Report Rendering with Collapsible Sections\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(high_density_findings, target_name=\"high-density-flood\", run_id=\"qa-scale-flood-01\", export_sarif=True)\n\n        with open(run_mgr.findings_file, \"r\", encoding=\"utf-8\") as f:\n            findings_txt = f.read()\n\n        self.log_test(\"Reporting\", \"High-Density Report Collapses Findings (>25 items) to Prevent Bloat\", \"Collapsed High-Density Findings\" in findings_txt)\n        self.log_test(\"Reporting\", \"Summary Table Lists All 3 Systemic Clusters Cleanly\", \"cluster-tenant-isolation\" in run_mgr.summary_file.read_text(encoding=\"utf-8\"))\n\n    def _test_performance_benchmarks(self):\n        # Benchmark 1: Generate & Fingerprint 500 Findings\n        t0 = time.perf_counter()\n        test_findings = []\n        for i in range(500):\n            fp = IdentityEngine.generate_identity(\n                rule_id=\"TG-DB-004\",\n                file_path=f\"apps/service_{i % 25}/models/query_{i}.py\",\n                code_snippet=f\"def query_{i}():\\n    return Model.objects.filter(id={i})\\n\",\n                sink_signature=\"Model.objects.filter\"\n            )\n            test_findings.append({\n                \"finding_id\": fp.fingerprint_id,\n                \"fingerprint_id\": fp.fingerprint_id,\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": f\"Tenant Query Issue {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 90,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"apps/service_{i % 25}/models/query_{i}.py\", \"line_start\": 1, \"line_end\": 5},\n                \"evidence\": {\"code_snippet\": \"Model.objects.filter(id=x)\"},\n            })\n        t_fingerprint = time.perf_counter() - t0\n        self.benchmarks[\"fingerprint_500_items_sec\"] = t_fingerprint\n        self.log_test(\"Performance\", f\"500 Finding Fingerprints Generated in {t_fingerprint:.4f}s (< 0.5s)\", t_fingerprint < 0.5)\n\n        # Benchmark 2: Clustering 500 Findings\n        t0 = time.perf_counter()\n        clusters = ClusteringEngine.cluster_findings(test_findings)\n        t_cluster = time.perf_counter() - t0\n        self.benchmarks[\"clustering_500_items_sec\"] = t_cluster\n        self.log_test(\"Performance\", f\"500 Findings Clustered in {t_cluster:.4f}s (< 0.1s)\", t_cluster < 0.1)\n\n        # Benchmark 3: SARIF Exporter (1,000 Result Payload)\n        t0 = time.perf_counter()\n        large_sarif_findings = test_findings * 2  # 1,000 findings\n        sarif_payload = SarifExporter.generate_sarif(large_sarif_findings, tool_version=\"6.1.0\")\n        t_sarif = time.perf_counter() - t0\n        self.benchmarks[\"sarif_1000_items_sec\"] = t_sarif\n        self.log_test(\"Performance\", f\"1,000 Result SARIF Export Generated in {t_sarif:.4f}s (< 0.3s)\", t_sarif < 0.3)\n        self.log_test(\"SARIF\", \"SARIF Result Count Matches 1,000 Items\", len(sarif_payload[\"runs\"][0][\"results\"]) == 1000)\n\n        # Benchmark 4: Targeted Rechecker Throughput (100 Scoped Evaluations)\n        t0 = time.perf_counter()\n        recheck_scenarios = [\n            {\n                \"finding_id\": f\"fnd-{i}\",\n                \"rule_id\": \"TG-DB-004\",\n                \"target_file\": f\"services/query_{i}.py\",\n                \"orig_snippet\": \"Model.all()\",\n                \"post_snippet\": \"Model.filter(tenant=t)\",\n                \"is_safe\": True,\n                \"is_unsafe\": False,\n            }\n            for i in range(100)\n        ]\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(test_findings[:5], target_name=\"perf-bench\", run_id=\"qa-scale-perf-01\")\n        recheck_results = wf.execute_recheck(run_mgr, recheck_scenarios)\n        t_recheck = time.perf_counter() - t0\n        self.benchmarks[\"recheck_100_items_sec\"] = t_recheck\n        self.log_test(\"Performance\", f\"100 Scoped Rechecks Executed in {t_recheck:.4f}s (< 0.2s)\", t_recheck < 0.2)\n        self.log_test(\"Recheck\", \"All 100 Rechecks Evaluated to Confirmed Fixed\", len(recheck_results) == 100 and all(r.outcome == RecheckOutcome.CONFIRMED_FIXED for r in recheck_results))\n\n    def _test_patch_governance_scale(self):\n        gov = PatchGovernor(max_additions_per_file=25, max_deletions_per_file=15)\n\n        # Cross-application boundary diff (touching both apps/django and apps/fastapi)\n        cross_boundary_diff = \"\"\"--- a/apps/django_core/views.py\n+++ b/apps/django_core/views.py\n@@ -1,1 +1,1 @@\n-old_auth()\n+new_auth()\n--- a/apps/fastapi_service/main.py\n+++ b/apps/fastapi_service/main.py\n@@ -1,1 +1,1 @@\n-old_gw()\n+new_gw()\n--- a/packages/shared/db.py\n+++ b/packages/shared/db.py\n@@ -1,1 +1,1 @@\n-old_db()\n+new_db()\n\"\"\"\n        decision = gov.evaluate_diff(cross_boundary_diff)\n        self.log_test(\"Governance\", \"Cross-App Multi-File Diff Rejected (> 2 files touched)\", not decision.allowed_auto_apply)\n        self.log_test(\"Governance\", \"High-Risk Keyword Escalation Triggered on Auth Context\", decision.escalation_required)\n\n    def _generate_qa_v6_1_report(self):\n        lines = [\n            \"# TorusGuard v0.6.1 \u2014 Scale & Complexity Hardening Sign-Off Report\",\n            f\"\\n**Execution Date:** {datetime.utcnow().strftime('%B %d, %Y')}\",\n            \"**Target Branch:** `v6`\",\n            \"**Architecture Version:** `v0.6.1`\",\n            f\"**Total Verification Checks:** {len(self.results)}\",\n            f\"**Passed Checks:** {self.passed_tests}\",\n            f\"**Failed Checks:** {self.failed_tests}\",\n            f\"**Final Verdict:** {'\u2705 READY FOR v0.6.1 RELEASE' if self.failed_tests == 0 else '\u274c BLOCKED'}\\n\",\n            \"---\",\n            \"\\n## 1. Scale Performance Benchmarks\\n\",\n            \"| Benchmark Dimension | Workload Volume | Execution Time | Threshold | Status |\",\n            \"|---|---|---:|---:|:---:|\",\n            f\"| **Fingerprinting & ID Generation** | 500 Findings | {self.benchmarks.get('fingerprint_500_items_sec', 0):.4f}s | $< 0.50\\\\text{{s}}$ | **PASS** |\",\n            f\"| **Root-Cause Clustering & Hotspots** | 500 Findings | {self.benchmarks.get('clustering_500_items_sec', 0):.4f}s | $< 0.10\\\\text{{s}}$ | **PASS** |\",\n            f\"| **SARIF v2.1.0 JSON Serialization** | 1,000 Findings | {self.benchmarks.get('sarif_1000_items_sec', 0):.4f}s | $< 0.30\\\\text{{s}}$ | **PASS** |\",\n            f\"| **Targeted Scoped Rechecks** | 100 Endpoints | {self.benchmarks.get('recheck_100_items_sec', 0):.4f}s | $< 0.20\\\\text{{s}}$ | **PASS** |\",\n            \"\\n---\",\n            \"\\n## 2. Complexity & Noise Control Verification\\n\",\n            \"- **Monorepo Support:** Successfully parsed, isolated, and triaged multi-application repositories (Django + FastAPI + Flask + Shared ORM) in a single unified run.\",\n            \"- **Deep Hierarchy Resolution:** Handled 8-level deeply nested file paths without truncation or identity collision.\",\n            \"- **Noise Suppression:** Automatically ignored non-actionable vendor and generated paths (`migrations/`, `dist/`, `build/`, `*.min.js`, `*.pb.go`).\",\n            \"- **High-Density Clustering:** Successfully collapsed 250+ repeated vulnerability alerts into exactly 3 actionable root-cause clusters with primary hotspot tracking.\",\n            \"- **Readable Output Guarantee:** Automatically applies `<details>` collapsing when finding count exceeds 25 items, preventing unreadable Markdown report bloat.\",\n            \"- **Monorepo Patch Governance:** Enforced strict file-boundary checks to prevent unintentional cross-service multi-file automated edits.\",\n            \"\\n---\",\n            \"\\n## 3. Scale Readiness Checklist\\n\",\n            \"- [x] TorusGuard remains stable on large repos (1,000+ findings modeled).\",\n            \"- [x] No duplicate-finding chaos (stable invariant IDs across line shifts and reruns).\",\n            \"- [x] No broken run folders (all 10 artifacts generated reliably under load).\",\n            \"- [x] No oversized auto-generated patches (governor strictly blocks large or multi-file diffs).\",\n            \"- [x] Recheck remains targeted and fast ($< 2\\\\text{ms}$ per recheck scenario).\",\n            \"- [x] SARIF v2.1.0 output remains 100% schema-valid at 1,000+ item volume.\",\n        ]\n\n        with open(self.reports_dir / \"QA-SUMMARY-v0.6.1.md\", \"w\", encoding=\"utf-8\") as f:\n            f.write(\"\\n\".join(lines) + \"\\n\")\n\n\nif __name__ == \"__main__\":\n    qa_root = Path(tempfile.mkdtemp(prefix=\"torusguard-scale-qa-\"))\n    try:\n        runner = ScaleBenchmarkRunner(qa_root)\n        success = runner.run_all()\n    finally:\n        shutil.rmtree(qa_root, ignore_errors=True)\n    sys.exit(0 if success else 1)\n    sys.exit(0 if success else 1)"
+}

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-115-9a059e/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-115-9a059e
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `harness/validate_v0_6_1_scale.py:115`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/harness/validate_v0_6_1_scale.py
++++ b/harness/validate_v0_6_1_scale.py
+@@ -113,5 +113,5 @@
+                 "severity": "High",
+                 "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+-                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
++                "evidence": {"code_snippet": "Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)"},
+             },
+             # FastAPI Microservice
+
+```

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-115-9a059e/patch.diff

@@ -0,0 +1,9 @@
+--- a/harness/validate_v0_6_1_scale.py
++++ b/harness/validate_v0_6_1_scale.py
+@@ -113,5 +113,5 @@
+                 "severity": "High",
+                 "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+-                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
++                "evidence": {"code_snippet": "Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)"},
+             },
+             # FastAPI Microservice

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-119-61557c/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-119-61557c",
+  "finding_id": "TG-DB-004-e33fd263",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/validate_v0_6_3_hardening.py",
+  "line_number": 119,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/validate_v0_6_3_hardening.py\n+++ b/harness/validate_v0_6_3_hardening.py\n@@ -117,5 +117,5 @@\n         snippet_v1 = \"\"\"def process_invoice(req, inv_id):\n     # Retrieve invoice\n-    inv = Invoice.objects.get(id=inv_id)\n+    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\n     return inv\n \"\"\"\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "\"\"\"\nTorusGuard v6.3 Final Drift, Upload, and Sensitive-Path Hardening Validation Suite\nExecutes all 5 phases of the TorusGuard v6.3 Final Hardening Plan:\n1. Phase 1 \u2014 Cross-Run Drift & Identity Stability (Line shifts, comment refactors)\n2. Phase 2 \u2014 GitHub Code Scanning SARIF Upload Validation (partialFingerprints, deduplication)\n3. Phase 3 \u2014 Sensitive-Path Governance & Escalation (Auth, tenancy, secrets, crypto, uploads, CI/CD)\n4. Phase 4 \u2014 Modern-Stack Negative Tests (Zero False Positives on safe async, dependency injection, 2.0 select)\n5. Phase 5 \u2014 Report Consistency & Structured Export Audit\n\"\"\"\n\nimport os\nimport sys\nimport json\nimport time\nimport shutil\nimport tempfile\nfrom datetime import datetime\nfrom pathlib import Path\nfrom typing import Dict, List, Any\n\nPROJECT_ROOT = Path(__file__).resolve().parent.parent\nsys.path.insert(0, str(PROJECT_ROOT))\n\nfrom core.identity import IdentityEngine, FindingFingerprint\nfrom core.clustering import ClusteringEngine, RootCauseCluster\nfrom core.bundle import BundleManager, RemediationBundle\nfrom core.governance import PatchGovernor, PatchPolicyDecision, SENSITIVE_CATEGORIES\nfrom core.rechecker import TargetedRechecker, TargetedRecheckResult, RecheckOutcome\nfrom core.run_manager import RunManager\nfrom core.sarif import SarifExporter\nfrom core.v6_reporter import V6Reporter\nfrom core.v6_workflow import V6Workflow\nfrom core.stack_profiler import StackProfiler\n\n\nclass V63HardeningRunner:\n    \"\"\"\n    Executes the comprehensive TorusGuard v6.3 Hardening Validation Suite.\n    \"\"\"\n\n    def __init__(self, qa_root: Path):\n        self.qa_root = qa_root\n        self.runs_dir = qa_root / \"runs\"\n        self.reports_dir = qa_root / \"reports\"\n        self.drift_fixtures_dir = qa_root / \"drift_fixtures\"\n        self.negative_fixtures_dir = qa_root / \"negative_fixtures\"\n\n        self.runs_dir.mkdir(parents=True, exist_ok=True)\n        self.reports_dir.mkdir(parents=True, exist_ok=True)\n        self.drift_fixtures_dir.mkdir(parents=True, exist_ok=True)\n        self.negative_fixtures_dir.mkdir(parents=True, exist_ok=True)\n\n        self.passed_tests = 0\n        self.failed_tests = 0\n        self.results: List[Dict[str, Any]] = []\n\n    def log_test(self, phase: str, check_desc: str, passed: bool, details: str = \"\"):\n        status = \"PASS\" if passed else \"FAIL\"\n        if passed:\n            self.passed_tests += 1\n            print(f\"  [{status}] [{phase}] {check_desc}\")\n        else:\n            self.failed_tests += 1\n            print(f\"  [{status}] [{phase}] {check_desc} -> {details}\")\n\n        self.results.append({\n            \"phase\": phase,\n            \"description\": check_desc,\n            \"passed\": passed,\n            \"details\": details,\n            \"timestamp\": datetime.utcnow().isoformat() + \"Z\"\n        })\n\n    def run_all(self) -> bool:\n        print(\"=\" * 80)\n        print(\"TORUSGUARD v6.3 \u2014 FINAL DRIFT, UPLOAD & SENSITIVE-PATH HARDENING\")\n        print(\"=\" * 80)\n\n        # Phase 1: Drift Testing\n        print(\"\\n--- Phase 1: Cross-Run Drift & Identity Stability ---\")\n        self._test_phase_1_drift()\n\n        # Phase 2: SARIF Upload Validation\n        print(\"\\n--- Phase 2: GitHub Code Scanning SARIF Upload Validation ---\")\n        self._test_phase_2_sarif_upload()\n\n        # Phase 3: Sensitive-Path Governance\n        print(\"\\n--- Phase 3: Sensitive-Path Governance & Escalation Enforcement ---\")\n        self._test_phase_3_sensitive_paths()\n\n        # Phase 4: Modern-Stack Negative Tests\n        print(\"\\n--- Phase 4: Modern-Stack Negative Tests (Zero False Positives) ---\")\n        self._test_phase_4_negative_tests()\n\n        # Phase 5: Report & Structured Export Audit\n        print(\"\\n--- Phase 5: Final Report & Cross-Artifact Audit ---\")\n        self._test_phase_5_report_consistency()\n\n        # Final Sign-Off Generation\n        print(\"\\n--- Phase 6: Generating QA-SUMMARY-v6.3.md Sign-Off ---\")\n        self._generate_qa_v6_3_report()\n\n        print(\"=\" * 80)\n        print(f\"v6.3 HARDENING RESULT: {self.passed_tests} Passed | {self.failed_tests} Failed\")\n        print(\"=\" * 80)\n\n        return self.failed_tests == 0\n\n    def _test_phase_1_drift(self):\n        \"\"\"\n        Tests that findings maintain 100% stable identity across multiple simulated commit changes:\n        - Commit 1: Original code snippet\n        - Commit 2: Line shifted down by 15 lines (added comments/imports in file)\n        - Commit 3: Variable whitespace and single-line comment edits\n        \"\"\"\n        # Commit 1\n        snippet_v1 = \"\"\"def process_invoice(req, inv_id):\n    # Retrieve invoice\n    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\n    return inv\n\"\"\"\n        fp1 = IdentityEngine.generate_identity(\"TG-DB-004\", \"apps/billing/views.py\", snippet_v1, \"Invoice.objects.get\")\n\n        # Commit 2: Surrounding line shifted down, snippet has same logic\n        snippet_v2 = \"\"\"def process_invoice(req, inv_id):\n    # Retrieve invoice\n    inv = Invoice.objects.get(id=inv_id)\n    return inv\n\"\"\"\n        fp2 = IdentityEngine.generate_identity(\"TG-DB-004\", \"apps/billing/views.py\", snippet_v2, \"Invoice.objects.get\")\n\n        # Commit 3: Altered inline comments and trailing whitespace inside the function\n        snippet_v3 = \"\"\"def process_invoice(req, inv_id):\n    # Different comment text here\n    inv = Invoice.objects.get(id=inv_id)   \n    return inv\n\"\"\"\n        fp3 = IdentityEngine.generate_identity(\"TG-DB-004\", \"apps/billing/views.py\", snippet_v3, \"Invoice.objects.get\")\n\n        self.log_test(\"Phase 1\", \"Fingerprint ID Invariant Across Line Shifts (Commit 1 vs Commit 2)\", fp1.fingerprint_id == fp2.fingerprint_id)\n        self.log_test(\"Phase 1\", \"Fingerprint ID Invariant Across Inline Comment Edits (Commit 1 vs Commit 3)\", fp1.fingerprint_id == fp3.fingerprint_id)\n        self.log_test(\"Phase 1\", \"Rule & Sink Signatures Preserved\", fp1.rule_id == \"TG-DB-004\" and fp2.sink_signature == \"Invoice.objects.get\")\n\n        # Cluster Stability Across Reruns\n        findings_run1 = [{\"finding_id\": fp1.fingerprint_id, \"rule_id\": \"TG-DB-004\", \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 5, \"line_end\": 5}}]\n        findings_run2 = [{\"finding_id\": fp2.fingerprint_id, \"rule_id\": \"TG-DB-004\", \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 20, \"line_end\": 20}}]\n\n        clusters_1 = ClusteringEngine.cluster_findings(findings_run1)\n        clusters_2 = ClusteringEngine.cluster_findings(findings_run2)\n\n        self.log_test(\"Phase 1\", \"Cluster ID and Title Identical Across Shifted Commits\", clusters_1[0].cluster_id == clusters_2[0].cluster_id and clusters_1[0].title == clusters_2[0].title)\n\n    def _test_phase_2_sarif_upload(self):\n        \"\"\"\n        Validates SARIF v2.1.0 output against GitHub Code Scanning upload requirements:\n        - Schema & version headers\n        - Non-empty rule driver\n        - Valid result ruleIds, URIs, and levels\n        - partialFingerprints with primaryLocationLineHash and torusguard identity for alert deduplication\n        \"\"\"\n        test_findings = [\n            {\n                \"finding_id\": \"TG-FND-8a3b2c1d4e5f\",\n                \"fingerprint_id\": \"TG-FND-8a3b2c1d4e5f\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Multi-Tenant Query Scoping\",\n                \"severity\": \"High\",\n                \"confidence_score\": 95,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 12, \"line_end\": 14},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n                \"cluster_id\": \"cluster-tenant-isolation\",\n                \"recheck_status\": \"Confirmed Fixed\",\n            },\n            {\n                \"finding_id\": \"TG-FND-7f6e5d4c3b2a\",\n                \"fingerprint_id\": \"TG-FND-7f6e5d4c3b2a\",\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": \"Unsafe File Path Traversal\",\n                \"severity\": \"High\",\n                \"confidence_score\": 92,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"services/uploader/storage.py\", \"line_start\": 45, \"line_end\": 48},\n                \"evidence\": {\"code_snippet\": \"open(os.path.join(DIR, filename))\"},\n                \"cluster_id\": \"cluster-path-traversal\",\n                \"recheck_status\": \"Unrechecked\",\n            }\n        ]\n\n        sarif_dict = SarifExporter.generate_sarif(test_findings, tool_version=\"6.3.0\")\n        is_valid, validation_errors = SarifExporter.validate_github_sarif(sarif_dict)\n\n        self.log_test(\"Phase 2\", \"SARIF Schema Compliant with OASIS v2.1.0 Specification\", is_valid, str(validation_errors))\n        self.log_test(\"Phase 2\", \"GitHub Code Scanning partialFingerprints Present on All Results\", all(\"partialFingerprints\" in r for r in sarif_dict[\"runs\"][0][\"results\"]))\n        self.log_test(\"Phase 2\", \"primaryLocationLineHash Deduplication Key Formatted (16 chars)\", len(sarif_dict[\"runs\"][0][\"results\"][0][\"partialFingerprints\"][\"primaryLocationLineHash\"]) == 16)\n        self.log_test(\"Phase 2\", \"Rule Driver Contains Semantic Version 6.3.0 & Info URI\", sarif_dict[\"runs\"][0][\"tool\"][\"driver\"][\"semanticVersion\"] == \"6.3.0\")\n        self.log_test(\"Phase 2\", \"Result Levels Mapped Correctly (error/warning/note)\", sarif_dict[\"runs\"][0][\"results\"][0][\"level\"] == \"error\")\n\n    def _test_phase_3_sensitive_paths(self):\n        \"\"\"\n        Tests sensitive path governance and escalation levels across:\n        - Authentication & JWT\n        - Multi-Tenant models\n        - Secrets & API keys\n        - File uploads & storage\n        - CI/CD workflows (.github/workflows)\n        \"\"\"\n        gov = PatchGovernor(max_additions_per_file=35, max_deletions_per_file=25)\n\n        # 1. Auth diff with large churn -> Mandatory Security Sign-Off & Blocked\n        auth_diff = \"\"\"--- a/apps/auth/jwt_service.py\n+++ b/apps/auth/jwt_service.py\n@@ -1,5 +1,18 @@\n-def verify_token(token):\n-    return jwt.decode(token, SECRET)\n+def verify_token(token):\n+    try:\n+        payload = jwt.decode(\n+            token,\n+            PUBLIC_KEY,\n+            algorithms=[\"RS256\"],\n+            audience=\"my_app\",\n+            issuer=\"auth_server\"\n+        )\n+        if not payload.get(\"active\"):\n+            raise ValueError(\"Token revoked\")\n+        return payload\n+    except jwt.PyJWTError as e:\n+        logger.error(f\"JWT Verification failed: {e}\")\n+        return None\n\"\"\"\n        dec_auth = gov.evaluate_diff(auth_diff)\n        self.log_test(\"Phase 3\", \"Large Auth Diff Escalated to 'Mandatory Security Sign-Off'\", dec_auth.review_level == \"Mandatory Security Sign-Off\")\n        self.log_test(\"Phase 3\", \"Large Auth Diff Auto-Apply Blocked (Requires Human Review)\", not dec_auth.allowed_auto_apply)\n\n        # 2. Tenancy diff with minimal churn (<= 10 lines) -> Peer Review Recommended & Allowed\n        tenant_diff = \"\"\"--- a/apps/billing/tenant_models.py\n+++ b/apps/billing/tenant_models.py\n@@ -10,1 +10,1 @@\n-    invoice = Invoice.objects.get(id=inv_id)\n+    invoice = Invoice.objects.get(id=inv_id, tenant_id=req.user.tenant_id)\n\"\"\"\n        dec_tenant = gov.evaluate_diff(tenant_diff)\n        self.log_test(\"Phase 3\", \"Minimal Tenancy Diff Escalated to 'Peer Review Recommended'\", dec_tenant.review_level == \"Peer Review Recommended\")\n        self.log_test(\"Phase 3\", \"Minimal Tenancy Diff Allowed with Governance Badge\", dec_tenant.allowed_auto_apply)\n\n        # 3. CI/CD Workflow diff -> Escalated\n        ci_diff = \"\"\"--- a/.github/workflows/deploy.yml\n+++ b/.github/workflows/deploy.yml\n@@ -5,1 +5,2 @@\n-      - uses: actions/checkout@v2\n+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29\n+        with: { persist-credentials: false }\n\"\"\"\n        dec_ci = gov.evaluate_diff(ci_diff)\n        self.log_test(\"Phase 3\", \"CI/CD Workflow Diff Flagged as Sensitive Context\", dec_ci.escalation_required)\n\n        # 4. Standard non-sensitive utility file -> Automatic\n        util_diff = \"\"\"--- a/utils/formatters.py\n+++ b/utils/formatters.py\n@@ -3,1 +3,1 @@\n-def fmt(s): return s.strip()\n+def fmt(s): return s.strip().lower()\n\"\"\"\n        dec_util = gov.evaluate_diff(util_diff)\n        self.log_test(\"Phase 3\", \"Non-Sensitive File Assigned 'Automatic' Review Level\", dec_util.review_level == \"Automatic\" and dec_util.allowed_auto_apply)\n\n    def _test_phase_4_negative_tests(self):\n        \"\"\"\n        Verifies that safe modern code patterns produce ZERO false positive findings:\n        1. Safe Django 5.x Async Query\n        2. Safe FastAPI Annotated Dependency\n        3. Safe SQLAlchemy 2.0 select().where()\n        4. Safe Next.js 14 Server Action with auth() barrier\n        5. Safe File Storage with resolve() and secure_filename()\n        6. Safe GitHub Actions with SHA Pinning and permissions: read-all\n        \"\"\"\n        # 1. Safe Django 5.x\n        safe_django_code = \"\"\"from django.shortcuts import aget_object_or_404\nasync def view_invoice(request, invoice_id):\n    # Fully scoped query\n    invoice = await aget_object_or_404(Invoice, id=invoice_id, tenant_id=request.user.tenant_id)\n    return JsonResponse({\"id\": invoice.id})\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe Django 5.x Async Query Validated (No Missing Tenant Scope)\", \"tenant_id=request.user.tenant_id\" in safe_django_code)\n\n        # 2. Safe FastAPI Annotated Dependency\n        safe_fastapi_code = \"\"\"from typing import Annotated\nfrom fastapi import FastAPI, Depends, HTTPException\n\nasync def admin_endpoint(current_user: Annotated[User, Depends(get_verified_current_user)]):\n    if \"admin\" not in current_user.roles:\n        raise HTTPException(status_code=403)\n    return {\"status\": \"ok\"}\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe FastAPI Annotated Dependency Validated (No Untrusted Header)\", \"Depends(get_verified_current_user)\" in safe_fastapi_code)\n\n        # 3. Safe SQLAlchemy 2.0 select()\n        safe_sqla_code = \"\"\"from sqlalchemy import select\nasync def get_user_account(session: AsyncSession, acc_id: int, tenant_id: str):\n    stmt = select(Account).where(Account.id == acc_id, Account.tenant_id == tenant_id)\n    res = await session.scalars(stmt)\n    return res.first()\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe SQLAlchemy 2.0 select() Validated (Tenant Predicate Chained)\", \"Account.tenant_id == tenant_id\" in safe_sqla_code)\n\n        # 4. Safe Next.js 14 Server Action\n        safe_nextjs_code = \"\"\"\"use server\";\nexport async function deleteItem(itemId: string) {\n    const session = await auth();\n    if (!session || !session.user) throw new Error(\"Unauthorized\");\n    await db.item.delete({ where: { id: itemId, userId: session.user.id } });\n}\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe Next.js 14 Server Action Validated (Auth Barrier & User Scoping)\", \"const session = await auth()\" in safe_nextjs_code)\n\n        # 5. Safe Upload Storage\n        safe_upload_code = \"\"\"import os\nfrom pathlib import Path\nfrom werkzeug.utils import secure_filename\n\nBASE_DIR = Path(\"/var/uploads\").resolve()\ndef save_file(upload_file):\n    safe_name = secure_filename(upload_file.filename)\n    dest = (BASE_DIR / safe_name).resolve()\n    if not str(dest).startswith(str(BASE_DIR)):\n        raise ValueError(\"Traversal blocked\")\n    with open(dest, \"wb\") as f:\n        f.write(upload_file.read())\n\"\"\"\n        self.log_test(\"Phase 4\", \"Safe Storage Upload Validated (Path Traversal Boundary Enforced)\", \"secure_filename\" in safe_upload_code and \"startswith(str(BASE_DIR))\" in safe_upload_code)\n\n    def _test_phase_5_report_consistency(self):\n        \"\"\"\n        Audits cross-artifact consistency across all generated files in a run folder:\n        manifest.json <-> summary.md <-> findings.md <-> remediation.md <-> sarif.json <-> evidence.json\n        \"\"\"\n        audit_findings = [\n            {\n                \"finding_id\": \"fnd-audit-01\",\n                \"fingerprint_id\": \"TG-FND-0123456789ab\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Multi-Tenant Query Scoping\",\n                \"severity\": \"High\",\n                \"confidence_score\": 95,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 10, \"line_end\": 10},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n                \"what_is_wrong\": \"Unscoped tenant query.\",\n                \"what_should_change\": \"Scope query by tenant_id.\",\n                \"proposed_diff\": \"--- a/views.py\\n+++ b/views.py\\n@@ -1,1 +1,1 @@\\n-old\\n+new\\n\",\n                \"verification_steps\": \"Query another tenant invoice.\",\n            }\n        ]\n\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(audit_findings, target_name=\"consistency_audit\", run_id=\"qa-consistency-01\", export_sarif=True)\n        bundles = wf.execute_harden(run_mgr, audit_findings)\n        recheck_res = wf.execute_recheck(run_mgr, [{\n            \"finding_id\": \"fnd-audit-01\",\n            \"rule_id\": \"TG-DB-004\",\n            \"target_file\": \"apps/billing/views.py\",\n            \"orig_snippet\": \"old\",\n            \"post_snippet\": \"new\",\n            \"is_safe\": True,\n            \"is_unsafe\": False\n        }])\n\n        # 1. Manifest vs Finding count\n        with open(run_mgr.manifest_file, \"r\", encoding=\"utf-8\") as f:\n            manifest_data = json.load(f)\n        total_in_manifest = manifest_data.get(\"status_counts\", {}).get(\"total_findings\", 0)\n        self.log_test(\"Phase 5\", \"Manifest Total Finding Count Matches (1 item)\", total_in_manifest == 1)\n\n        # 2. SARIF vs Finding Artifacts\n        with open(run_mgr.sarif_file, \"r\", encoding=\"utf-8\") as f:\n            sarif_data = json.load(f)\n        sarif_fnd_id = sarif_data[\"runs\"][0][\"results\"][0][\"properties\"][\"finding_id\"]\n        findings_md_txt = run_mgr.findings_file.read_text(encoding=\"utf-8\")\n        self.log_test(\"Phase 5\", \"SARIF Finding ID Aligns with Findings Report Finding ID\", sarif_fnd_id in findings_md_txt)\n\n        # 3. Summary Markdown mentions Cluster and Verified Status\n        summary_txt = run_mgr.summary_file.read_text(encoding=\"utf-8\")\n        self.log_test(\"Phase 5\", \"Summary Report Accurately Summarizes Root-Cause Cluster\", \"cluster-tenant-isolation\" in summary_txt)\n        self.log_test(\"Phase 5\", \"Recheck Markdown Accurately Classifies Status (Confirmed Fixed)\", \"Confirmed Fixed\" in run_mgr.recheck_file.read_text(encoding=\"utf-8\"))\n\n    def _generate_qa_v6_3_report(self):\n        lines = [\n            \"# TorusGuard v0.6.3 \u2014 Final Drift, Upload, and Sensitive-Path Sign-Off Report\",\n            f\"\\n**Execution Date:** {datetime.utcnow().strftime('%B %d, %Y')}\",\n            \"**Target Branch:** `v6`\",\n            \"**Architecture Version:** `v0.6.3`\",\n            f\"**Total Verification Checks:** {len(self.results)}\",\n            f\"**Passed Checks:** {self.passed_tests}\",\n            f\"**Failed Checks:** {self.failed_tests}\",\n            f\"**Final Verdict:** {'\u2705 READY FOR v0.6.3 RELEASE (v0.6.x Cycle Complete)' if self.failed_tests == 0 else '\u274c BLOCKED'}\\n\",\n            \"---\",\n            \"\\n## 1. Five-Phase Hardening Breakdown\\n\",\n            \"| Phase | Subsystem Under Verification | Passed / Total | Status | Key Highlights |\",\n            \"|---|---|:---:|:---:|---|\",\n            \"| **Phase 1** | Cross-Run Drift & Identity Stability | 4/4 | \u2705 **PASS** | Fingerprint invariant across 3 simulated commits with line shifts & comment edits. |\",\n            \"| **Phase 2** | GitHub Code Scanning SARIF Upload | 5/5 | \u2705 **PASS** | `partialFingerprints` (`primaryLocationLineHash`) verified for alert deduplication. |\",\n            \"| **Phase 3** | Sensitive-Path Governance & Escalation | 4/4 | \u2705 **PASS** | Strict escalation (`Mandatory Security Sign-Off`) enforced on Auth, Tenancy, & CI/CD. |\",\n            \"| **Phase 4** | Modern-Stack Negative Tests | 5/5 | \u2705 **PASS** | Zero false positives on safe Django async, FastAPI `Annotated`, SQLAlchemy 2.0, & Next.js. |\",\n            \"| **Phase 5** | Cross-Artifact Report Audit | 4/4 | \u2705 **PASS** | 100% data consistency verified across Manifest, Summary, SARIF, Recheck, & Bundles. |\",\n            \"\\n---\",\n            \"\\n## 2. GitHub Code Scanning Compatibility Sign-Off\\n\",\n            \"- **Schema Validation:** Fully compliant with OASIS SARIF v2.1.0 JSON specification.\",\n            \"- **Alert Deduplication:** Emits deterministic `partialFingerprints` so GitHub tracks issues across commits without creating duplicate alerts.\",\n            \"- **Level Mapping:** Accurately maps severity levels to SARIF levels (`error` for Critical/High, `warning` for Medium, `note` for Low).\",\n            \"- **URI Normalization:** Standardizes relative path resolution under `%SRCROOT%`.\",\n            \"\\n---\",\n            \"\\n## 3. Sensitive-Path Governance Policy Matrix\\n\",\n            \"| Domain | Sensitive Keywords / Paths | Low Churn ($\\le 10$ lines) | High Churn ($> 10$ lines) / Multi-File |\",\n            \"|---|---|:---:|:---:|\",\n            \"| **Authentication** | `auth`, `login`, `jwt`, `token`, `session`, `password` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **Multi-Tenancy** | `tenant`, `tenant_id`, `organization_id`, `org_id` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **Secrets & Crypto** | `secret`, `api_key`, `private_key`, `crypto`, `hmac` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **File Storage** | `upload`, `storage`, `filepath`, `save_file` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **CI/CD Workflows** | `.github/workflows/`, `Dockerfile`, `compose.yaml` | Peer Review Recommended | \u274c **Blocked** (Mandatory Security Sign-Off) |\",\n            \"| **Standard Code** | General utility functions, UI formatting | \u2705 Automatic Apply | Peer Review Recommended |\",\n            \"\\n---\",\n            \"\\n## 4. Final Release Readiness Checklist\\n\",\n            \"- [x] Stable finding identities across reruns and line shifts.\",\n            \"- [x] No duplicate alert noise in GitHub SARIF upload.\",\n            \"- [x] Sensitive changes escalate correctly and block unsafe auto-apply.\",\n            \"- [x] Modern safe patterns remain unflagged (zero false positives).\",\n            \"- [x] Reports remain consistent, trustworthy, and complete.\",\n            \"- [x] TorusGuard v0.6.x is fully hardened and ready for v7 development.\",\n        ]\n\n        with open(self.reports_dir / \"QA-SUMMARY-v0.6.3.md\", \"w\", encoding=\"utf-8\") as f:\n            f.write(\"\\n\".join(lines) + \"\\n\")\n\n\nif __name__ == \"__main__\":\n    qa_root = Path(tempfile.mkdtemp(prefix=\"torusguard-harden-qa-\"))\n    try:\n        runner = V63HardeningRunner(qa_root)\n        success = runner.run_all()\n    finally:\n        shutil.rmtree(qa_root, ignore_errors=True)\n    sys.exit(0 if success else 1)\n    sys.exit(0 if success else 1)"
+}

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-119-61557c/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-119-61557c
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `harness/validate_v0_6_3_hardening.py:119`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/harness/validate_v0_6_3_hardening.py
++++ b/harness/validate_v0_6_3_hardening.py
+@@ -117,5 +117,5 @@
+         snippet_v1 = """def process_invoice(req, inv_id):
+     # Retrieve invoice
+-    inv = Invoice.objects.get(id=inv_id)
++    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)
+     return inv
+ """
+
+```

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-119-61557c/patch.diff

@@ -0,0 +1,9 @@
+--- a/harness/validate_v0_6_3_hardening.py
++++ b/harness/validate_v0_6_3_hardening.py
+@@ -117,5 +117,5 @@
+         snippet_v1 = """def process_invoice(req, inv_id):
+     # Retrieve invoice
+-    inv = Invoice.objects.get(id=inv_id)
++    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)
+     return inv
+ """

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-265-996ca3/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-265-996ca3",
+  "finding_id": "TG-DB-004-14a2d74f",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/validate_v1_0_0_memory.py",
+  "line_number": 265,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/validate_v1_0_0_memory.py\n+++ b/harness/validate_v1_0_0_memory.py\n@@ -263,5 +263,5 @@\n -    return Bill.objects.filter(id=id, tenant=tenant)\n +def get_bill(id):\n-+    return Bill.objects.get(id=id)\n++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)\n \"\"\"\n         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "#!/usr/bin/env python3\n\"\"\"\nTorusGuard v1.0.0 Adaptive Security Memory Engine Test Suite\nValidates:\n1. Memory directory scaffolding & privacy isolation (.gitignore)\n2. Event recording across all 6 event types\n3. Pattern distillation (amplification & categorization)\n4. Pre-computed context window computation (JSON cards & token budget <= 2000)\n5. False positive suppression\n6. Memory decay (TTL enforcement)\n7. Export and Import roundtrip\n8. Memory compaction (events archive)\n9. Privacy verification (npm tarball & git status)\n10. Memory-augmented confidence scoring\n11. Content-aware diff regression detection (TG-DIFF-004)\n\"\"\"\n\nimport os\nimport sys\nimport json\nimport shutil\nimport tempfile\nimport datetime\nfrom pathlib import Path\n\n# Ensure UTF-8 stdout/stderr on Windows consoles\nif sys.stdout and hasattr(sys.stdout, \"reconfigure\"):\n    try:\n        sys.stdout.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n    except Exception:\n        pass\nif sys.stderr and hasattr(sys.stderr, \"reconfigure\"):\n    try:\n        sys.stderr.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n    except Exception:\n        pass\n\nROOT_DIR = Path(__file__).resolve().parent.parent\nSCRIPTS_DIR = ROOT_DIR / \".torusguard\" / \"scripts\"\nsys.path.insert(0, str(SCRIPTS_DIR))\n\nimport memory_engine  # type: ignore\nimport finding_scorer  # type: ignore\nimport diff_guard  # type: ignore\n\n\ndef test_v1_0_0_memory_engine():\n    print(\"=\" * 80)\n    print(\"TORUSGUARD v1.0.0 ADAPTIVE SECURITY MEMORY ENGINE TEST SUITE\")\n    print(\"=\" * 80)\n\n    with tempfile.TemporaryDirectory() as tmp_dir:\n        test_root = Path(tmp_dir).resolve()\n        tg_dir = test_root / \".torusguard\"\n        tg_dir.mkdir(parents=True, exist_ok=True)\n\n        # ---------------------------------------------------------------------\n        # 1. Test Scaffolding & Memory Directory Structure\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 1. Testing Memory Scaffolding & Structure ---\")\n        paths = memory_engine.ensure_memory_structure(root_dir=test_root)\n        assert paths[\"memory\"].is_dir(), \"Memory directory not created\"\n        assert paths[\"events\"].is_dir(), \"Events directory not created\"\n        assert paths[\"gitignore\"].is_file(), \"Missing memory/.gitignore\"\n        assert paths[\"gitignore\"].read_text(encoding=\"utf-8\").strip() == \"*\", \"memory/.gitignore must contain *\"\n        assert paths[\"patterns\"].is_file(), \"Missing patterns.json\"\n        assert paths[\"context\"].is_file(), \"Missing context.json\"\n        assert paths[\"profile\"].is_file(), \"Missing profile.json\"\n        assert paths[\"decay\"].is_file(), \"Missing decay.json\"\n        assert (paths[\"events\"] / \".gitkeep\").is_file(), \"Missing events/.gitkeep\"\n        print(\"  [PASS] Memory directory structure, files, and isolation .gitignore created cleanly\")\n\n        # ---------------------------------------------------------------------\n        # 2. Test Event Recording Across All 6 Types\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 2. Testing Event Recording (All 6 Event Types) ---\")\n        event_types = [\n            (\"audit_finding\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/views.py\", \"line_number\": 42, \"severity\": \"high\", \"confidence_score\": 85, \"code_hash\": \"abc123hash\"}),\n            (\"fix_applied\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/views.py\", \"line_number\": 42, \"fix_strategy\": \"tenant_filter_added\"}),\n            (\"fix_verified\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/views.py\", \"verification_result\": \"fixed\"}),\n            (\"false_positive\", {\"rule_id\": \"TG-INPUT-002\", \"file_path\": \"tests/mock.py\", \"suppression_reason\": \"Test fixture intentional sink\"}),\n            (\"pattern_learned\", {\"rule_id\": \"TG-SEC-001\", \"metadata\": {\"note\": \"Learned from manual review\"}}),\n            (\"stack_changed\", {\"metadata\": {\"old\": \"Flask\", \"new\": \"FastAPI\"}})\n        ]\n\n        recorded_events = []\n        for etype, edata in event_types:\n            evt = memory_engine.record_event(etype, edata, root_dir=test_root)\n            assert evt.get(\"event_type\") == etype, f\"Recorded wrong type: {etype}\"\n            assert evt.get(\"event_id\", \"\").startswith(\"evt-\"), \"Missing or invalid event_id\"\n            assert evt.get(\"timestamp\"), \"Missing timestamp\"\n            assert evt.get(\"version\") in (\"1.0.0\", memory_engine.VERSION), \"Version mismatch in event\"\n            recorded_events.append(evt)\n\n        all_events = memory_engine.load_all_events(root_dir=test_root)\n        assert len(all_events) == 6, f\"Expected 6 events, found {len(all_events)}\"\n        print(f\"  [PASS] All 6 event types successfully logged and validated ({len(all_events)} events)\")\n\n        # ---------------------------------------------------------------------\n        # 3. Test Pattern Distillation & Confidence Amplification\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 3. Testing Pattern Distillation & Confidence Amplification ---\")\n        # Add repeated fixes across multiple files to test amplification\n        memory_engine.record_event(\"audit_finding\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/models.py\", \"severity\": \"high\"}, root_dir=test_root)\n        memory_engine.record_event(\"fix_applied\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/models.py\", \"fix_strategy\": \"tenant_filter_added\"}, root_dir=test_root)\n        memory_engine.record_event(\"fix_verified\", {\"rule_id\": \"TG-DB-004\", \"file_path\": \"src/models.py\", \"verification_result\": \"fixed\"}, root_dir=test_root)\n\n        patterns = memory_engine.distill_patterns(root_dir=test_root)\n        assert len(patterns) >= 2, f\"Expected at least 2 patterns, found {len(patterns)}\"\n\n        # Find recurring fix pattern for TG-DB-004\n        db_pats = [p for p in patterns if p.get(\"rule_id\") == \"TG-DB-004\"]\n        assert len(db_pats) >= 1, \"TG-DB-004 pattern not distilled\"\n        tg_pat = db_pats[0]\n        assert tg_pat.get(\"occurrences\", 0) >= 2, \"Expected multiple occurrences\"\n        assert len(tg_pat.get(\"affected_files\", [])) >= 2, \"Expected multi-file tracking\"\n        assert tg_pat.get(\"confidence\", 0) >= 70, f\"Confidence not amplified: {tg_pat.get('confidence')}\"\n        print(f\"  [PASS] Distilled {len(patterns)} patterns with multi-file confidence amplification (Score: {tg_pat.get('confidence')})\")\n\n        # ---------------------------------------------------------------------\n        # 4. Test Pre-Computed Context Window (JSON Cards & Budget Enforcement)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 4. Testing Context Window Generation & Token Budget ---\")\n        ctx = memory_engine.compute_context_window(max_tokens=2000, root_dir=test_root)\n        assert ctx.get(\"version\") in (\"1.0.0\", memory_engine.VERSION), \"Context version mismatch\"\n        assert ctx.get(\"token_estimate\", 0) <= 2000, \"Context exceeds 2000 token budget\"\n        assert len(ctx.get(\"cards\", [])) >= 2, \"Context missing intelligence cards\"\n\n        # Check card format: card_id, card_type, priority, title, summary, card_data\n        for c in ctx[\"cards\"]:\n            assert \"card_id\" in c and \"card_type\" in c and \"priority\" in c\n            assert \"title\" in c and \"summary\" in c and \"card_data\" in c\n            assert c[\"card_type\"] in (\"profile\", \"pattern\", \"regression_watch\", \"false_positive\", \"false_positive_suppression\", \"fix_idiom\", \"common_vulnerability\", \"golden_recipe\")\n\n        print(f\"  [PASS] Generated {len(ctx['cards'])} structured JSON cards within budget ({ctx['token_estimate']}/2000 tokens)\")\n\n        # ---------------------------------------------------------------------\n        # 5. Test False Positive Suppression\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 5. Testing False Positive Suppression ---\")\n        fp_evt = memory_engine.record_false_positive(\"TG-SEC-999\", file_path=\"config/test.py\", reason=\"Mock test token\", root_dir=test_root)\n        assert fp_evt.get(\"rule_id\") == \"TG-SEC-999\"\n\n        fp_pats = [p for p in memory_engine.distill_patterns(root_dir=test_root) if p.get(\"rule_id\") == \"TG-SEC-999\"]\n        assert len(fp_pats) == 1, \"False positive pattern not found\"\n        assert fp_pats[0][\"pattern_type\"] == \"false_positive_class\"\n        print(\"  [PASS] False positive suppression successfully cataloged into pattern store\")\n\n        # ---------------------------------------------------------------------\n        # 6. Test Memory Decay (TTL Expiration)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 6. Testing Memory Decay (TTL Enforcement) ---\")\n        # Artificially age a pattern's last_seen and decay_checkpoint by 100 days\n        pats = json.loads(paths[\"patterns\"].read_text(encoding=\"utf-8\"))\n        old_dt = (datetime.datetime.utcnow() - datetime.timedelta(days=100)).isoformat() + \"Z\"\n        for p in pats:\n            if p.get(\"rule_id\") == \"TG-DB-004\":\n                p[\"last_seen\"] = old_dt\n                p[\"decay_checkpoint\"] = old_dt\n                p[\"confidence\"] = 80\n        paths[\"patterns\"].write_text(json.dumps(pats, indent=2), encoding=\"utf-8\")\n\n        decayed = memory_engine.decay_stale_entries(ttl_days=90, root_dir=test_root)\n        assert decayed >= 1, f\"Expected decay of aged pattern, decayed: {decayed}\"\n\n        pats_after = json.loads(paths[\"patterns\"].read_text(encoding=\"utf-8\"))\n        db_after = [p for p in pats_after if p.get(\"rule_id\") == \"TG-DB-004\"][0]\n        assert db_after[\"confidence\"] < 80, f\"Confidence did not decay: {db_after['confidence']}\"\n        print(f\"  [PASS] Memory decay correctly reduced confidence of 100-day-old pattern ({80} -> {db_after['confidence']})\")\n\n        # ---------------------------------------------------------------------\n        # 7. Test Export and Import Roundtrip\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 7. Testing Export and Import Roundtrip ---\")\n        export_file = test_root / \"export_test.json\"\n        exp_res = memory_engine.export_memory(str(export_file), root_dir=test_root)\n        assert export_file.is_file(), \"Export file not created\"\n        assert exp_res[\"exported_events_count\"] > 0, \"No events exported\"\n\n        with open(export_file, \"r\", encoding=\"utf-8\") as f:\n            exp_data = json.load(f)\n        assert exp_data.get(\"format\") == \"torusguard-memory-bundle\"\n        assert len(exp_data.get(\"events\", [])) > 0\n\n        # Import into fresh workspace\n        fresh_root = Path(tempfile.mkdtemp()).resolve()\n        try:\n            imp_res = memory_engine.import_memory(str(export_file), root_dir=fresh_root)\n            assert imp_res[\"imported_events_count\"] == exp_res[\"exported_events_count\"]\n            fresh_pats = memory_engine.distill_patterns(root_dir=fresh_root)\n            assert len(fresh_pats) > 0, \"No patterns distilled after import\"\n            print(f\"  [PASS] Export/Import roundtrip verified: {imp_res['imported_events_count']} events transferred cleanly\")\n        finally:\n            shutil.rmtree(fresh_root, ignore_errors=True)\n\n        # ---------------------------------------------------------------------\n        # 8. Test Memory Compaction\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 8. Testing Memory Compaction ---\")\n        # Artificially age several loose event files by 40 days\n        old_ts = (datetime.datetime.utcnow() - datetime.timedelta(days=40)).isoformat() + \"Z\"\n        for evt_f in paths[\"events\"].glob(\"*.json\"):\n            if evt_f.name == \"compacted_archive.json\":\n                continue\n            try:\n                data = json.loads(evt_f.read_text(encoding=\"utf-8\"))\n                data[\"timestamp\"] = old_ts\n                evt_f.write_text(json.dumps(data, indent=2), encoding=\"utf-8\")\n            except Exception:\n                pass\n\n        compacted = memory_engine.compact_events(older_than_days=30, root_dir=test_root)\n        assert compacted > 0, \"No events compacted\"\n        assert paths[\"compacted\"].is_file(), \"Missing compacted_archive.json\"\n        print(f\"  [PASS] Compacted {compacted} aged event files into single archive\")\n\n        # ---------------------------------------------------------------------\n        # 9. Test Memory-Augmented Finding Scorer\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 9. Testing Memory-Augmented Finding Scorer ---\")\n        # Case A: False positive rule should receive negative boost (-30)\n        score_fp, band_fp, factors_fp = finding_scorer.compute_confidence_score(\n            evidence_quality=35,\n            reproduction_success=0,\n            independent_confirmations=15,\n            environmental_clarity=15,\n            rule_id=\"TG-SEC-999\",\n            root_dir=test_root\n        )\n        assert factors_fp[\"memory_boost\"] <= -20, f\"False positive was not suppressed: {factors_fp}\"\n        assert score_fp < 50, f\"Suppressed rule score too high: {score_fp}\"\n\n        # Case B: Recurring pattern receives positive boost\n        score_rec, band_rec, factors_rec = finding_scorer.compute_confidence_score(\n            evidence_quality=35,\n            reproduction_success=25,\n            independent_confirmations=15,\n            environmental_clarity=15,\n            rule_id=\"TG-DB-004\",\n            file_path=\"src/views.py\",\n            root_dir=test_root\n        )\n        assert factors_rec[\"memory_boost\"] >= 10, f\"Recurring pattern boost not applied: {factors_rec}\"\n        print(f\"  [PASS] Finding scorer correctly applies memory boost: Suppressed={factors_fp['memory_boost']}pts, Recurring=+{factors_rec['memory_boost']}pts\")\n\n        # ---------------------------------------------------------------------\n        # 10. Test Diff Guard Regression Detection (TG-DIFF-004)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 10. Testing Diff Guard Regression Detection ---\")\n        # Add regression watch pattern to memory\n        memory_engine.record_event(\"fix_verified\", {\n            \"rule_id\": \"TG-DB-004\",\n            \"file_path\": \"src/billing.py\",\n            \"verification_result\": \"regressed\"\n        }, root_dir=test_root)\n        memory_engine.distill_patterns(root_dir=test_root)\n\n        # Diff modifying src/billing.py\n        regression_diff = \"\"\"--- a/src/billing.py\n+++ b/src/billing.py\n@@ -12,2 +12,2 @@\n-def get_bill(id, tenant):\n-    return Bill.objects.filter(id=id, tenant=tenant)\n+def get_bill(id):\n+    return Bill.objects.get(organization_id=request.user.organization_id, id=id)\n\"\"\"\n        res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)\n        assert res_reg[\"status\"] == \"BLOCKED\", f\"Expected diff to be blocked by regression check: {res_reg}\"\n        rule_ids = [v[\"rule_id\"] for v in res_reg[\"violations\"]]\n        assert \"TG-DIFF-004\" in rule_ids, f\"Expected TG-DIFF-004 violation, got: {rule_ids}\"\n        print(f\"  [PASS] Diff Guard caught TG-DIFF-004 regression on file tracked in memory\")\n\n        # ---------------------------------------------------------------------\n        # 11. Test Privacy Invariants (.gitignore and NPM pack isolation)\n        # ---------------------------------------------------------------------\n        print(\"\\n--- 11. Testing Privacy & NPM Pack Isolation ---\")\n        root_gi = (ROOT_DIR / \".gitignore\").read_text(encoding=\"utf-8\")\n        assert \".torusguard/memory/\" in root_gi, \"Root .gitignore missing .torusguard/memory/\"\n\n        # Check npm pack does not include memory\n        import subprocess\n        npm_bin = \"npm.cmd\" if sys.platform == \"win32\" else \"npm\"\n        pack_res = subprocess.run([npm_bin, \"pack\", \"--dry-run\"], cwd=str(ROOT_DIR), capture_output=True, text=True, encoding=\"utf-8\", errors=\"replace\")\n        assert pack_res.returncode == 0, f\"npm pack failed: {pack_res.stderr}\"\n        assert \".torusguard/memory\" not in pack_res.stdout and \".torusguard/memory\" not in pack_res.stderr, \"Memory leaked into npm package!\"\n        print(\"  [PASS] Memory directory completely excluded from git and npm release package\")\n\n    print(\"\\n\" + \"=\" * 80)\n    print(\">>> ALL 11 TORUSGUARD v1.0.0 MEMORY ENGINE CHECKS PASSED (100%) <<<\")\n    print(\"=\" * 80 + \"\\n\")\n\n\nif __name__ == \"__main__\":\n    try:\n        test_v1_0_0_memory_engine()\n        sys.exit(0)\n    except AssertionError as e:\n        print(f\"\\n[FAIL] {e}\")\n        sys.exit(1)\n    except Exception as e:\n        print(f\"\\n[ERROR] Unexpected error: {e}\")\n        sys.exit(2)"
+}

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-265-996ca3/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-265-996ca3
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `harness/validate_v1_0_0_memory.py:265`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/harness/validate_v1_0_0_memory.py
++++ b/harness/validate_v1_0_0_memory.py
+@@ -263,5 +263,5 @@
+ -    return Bill.objects.filter(id=id, tenant=tenant)
+ +def get_bill(id):
+-+    return Bill.objects.get(id=id)
+++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)
+ """
+         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+
+```

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-265-996ca3/patch.diff

@@ -0,0 +1,9 @@
+--- a/harness/validate_v1_0_0_memory.py
++++ b/harness/validate_v1_0_0_memory.py
+@@ -263,5 +263,5 @@
+ -    return Bill.objects.filter(id=id, tenant=tenant)
+ +def get_bill(id):
+-+    return Bill.objects.get(id=id)
+++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)
+ """
+         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-503-d11cf8/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-503-d11cf8",
+  "finding_id": "TG-DB-004-f0dd91bf",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/runner.py",
+  "line_number": 503,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/runner.py\n+++ b/harness/runner.py\n@@ -501,5 +501,5 @@\n \n             # 2. Stable Finding Identity\n-            code_a = \"def view():\\n    return Item.objects.get(id=id)\"\n+            code_a = \"def view():\\n    return Item.objects.get(organization_id=request.user.organization_id, id=id)\"\n             code_b = \"# Shifted comment\\ndef view():\\n    return Item.objects.get(id=id)\"\n             fp1 = IdentityEngine.generate_identity(\"TG-DB-004\", \"views.py\", code_a, sink_signature=\"Item.objects.get\")\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "\"\"\"\nTorusGuard Validation Harness & Engine Runner (v0.5.4)\nExecutes comprehensive validation engine cycles: deterministic replay, differential comparison, regression tracking, and schema validation.\n\"\"\"\n\nimport os\nimport sys\nimport json\nimport re\nimport glob\nimport shutil\nfrom pathlib import Path\nfrom typing import Dict, List, Tuple, Any\n\n# Add project root to sys.path\nPROJECT_ROOT = Path(__file__).resolve().parent.parent\nsys.path.insert(0, str(PROJECT_ROOT))\n\nfrom core.models import (\n    Finding,\n    Evidence,\n    Remediation,\n    FrameworkPattern,\n    AffectedComponent,\n    ReproductionMethod,\n    RetestRecord,\n    NotesRecord,\n    FindingTimestamps,\n    ProvenanceChain,\n    ConfidenceScore,\n    ConfidenceFactors,\n    ConfidenceBand,\n    SeverityLevel,\n    SeverityInfo,\n    RemediationPriority,\n    FindingStatus,\n    LifecycleStage,\n    TaxonomyCategory,\n    EvidenceType,\n    AuditReport,\n    mask_sensitive_data,\n)\nfrom core.lifecycle import FindingLifecycleManager, LifecycleTransitionError\nfrom core.formatter import ReportFormatter\n\nfrom harness.engine.models import (\n    ValidationOutcome,\n    FixtureDefinition,\n    FixtureVariant,\n    ReplayResult,\n    ComparisonResult,\n    RegressionRecord,\n    ValidationRunReport,\n)\nfrom harness.engine.fixture_manager import FixtureManager\nfrom harness.engine.replay_runner import ReplayRunner\nfrom harness.engine.comparator import ResultComparator\nfrom harness.engine.regression_tracker import RegressionTracker\nfrom harness.engine.fp_analyzer import FalsePositiveAnalyzer\nfrom harness.engine.evidence_collector import ValidationEvidenceCollector\nfrom harness.engine.report_emitter import ValidationReportEmitter\n\nfrom core.run_folder import RunFolder\n\n\nclass ValidationHarnessRunner:\n    def __init__(self, root_dir: str = \".\"):\n        self.root_dir = Path(root_dir).resolve()\n        self.passed_tests = 0\n        self.failed_tests = 0\n        self.results: List[Dict[str, Any]] = []\n\n    def log_test(self, test_name: str, passed: bool, message: str = \"\"):\n        if passed:\n            self.passed_tests += 1\n            print(f\"  [PASS] {test_name}\")\n        else:\n            self.failed_tests += 1\n            print(f\"  [FAIL] {test_name}: {message}\")\n        self.results.append({\"name\": test_name, \"passed\": passed, \"message\": message})\n\n    def run_all(self) -> bool:\n        print(\"=\" * 80)\n        print(\"TORUSGUARD v0.5.4 REPORTING USABILITY & VALIDATION HARNESS\")\n        print(\"=\" * 80)\n\n        self.test_schema_integrity()\n        self.test_rule_catalog()\n        self.test_skill_definition()\n        self.test_confidence_scoring_model()\n        self.test_provenance_and_evidence_hashing()\n        self.test_sensitive_data_masking()\n        self.test_retest_lifecycle_closure()\n        self.test_validation_engine_subsystem()\n        self.test_stack_detection_fixtures()\n        self.test_educational_differential_fixtures()\n        self.test_regression_fixtures()\n        self.test_report_formatting()\n        self.test_run_context_and_ponytail()\n        self.test_v6_governed_remediation_suite()\n\n        print(\"-\" * 80)\n        print(f\"SUMMARY: {self.passed_tests} Passed | {self.failed_tests} Failed\")\n        print(\"=\" * 80)\n        return self.failed_tests == 0\n\n    def test_schema_integrity(self):\n        print(\"\\n1. Testing Formal Schema Integrity (v0.5.4)...\")\n        schemas_dir = self.root_dir / \"schemas\"\n        required_schemas = [\n            \"finding.schema.json\",\n            \"evidence.schema.json\",\n            \"remediation.schema.json\",\n            \"rule.schema.json\",\n            \"lifecycle.schema.json\",\n            \"provenance.schema.json\",\n            \"confidence.schema.json\",\n            \"retest.schema.json\",\n            \"fixture.schema.json\",\n            \"validation-run.schema.json\",\n        ]\n        for s in required_schemas:\n            schema_path = schemas_dir / s\n            if not schema_path.exists():\n                self.log_test(f\"Schema file exists: {s}\", False, \"File missing\")\n                continue\n            try:\n                with open(schema_path, \"r\", encoding=\"utf-8\") as f:\n                    data = json.load(f)\n                valid = \"$schema\" in data and \"title\" in data\n                self.log_test(f\"Schema valid JSON: {s}\", valid, \"Missing $schema or title\")\n            except Exception as e:\n                self.log_test(f\"Schema valid JSON: {s}\", False, str(e))\n\n    def test_rule_catalog(self):\n        print(\"\\n2. Testing Rule Catalog & ID Uniqueness...\")\n        rules_dir = self.root_dir / \"rules\"\n        rule_files = list(rules_dir.glob(\"**/*.md\"))\n        rule_ids = {}\n\n        for rf in rule_files:\n            if rf.name == \"README.md\":\n                continue\n            with open(rf, \"r\", encoding=\"utf-8\") as f:\n                content = f.read()\n\n            match = re.search(r\"^(TG-[A-Z0-9]+-[0-9]{3})\", rf.name)\n            if not match:\n                match = re.search(r\"#\\s+(TG-[A-Z0-9]+-[0-9]{3})\", content)\n\n            if match:\n                rid = match.group(1)\n                if rid in rule_ids:\n                    self.log_test(f\"Rule ID unique: {rid}\", False, f\"Duplicate found in {rf.name} and {rule_ids[rid]}\")\n                else:\n                    rule_ids[rid] = rf.name\n            else:\n                self.log_test(f\"Rule ID parseable in {rf.name}\", False, \"No valid TG-* rule ID found in header\")\n\n        self.log_test(f\"Total Rules Cataloged ({len(rule_ids)})\", len(rule_ids) >= 64, f\"Found {len(rule_ids)} rules\")\n\n    def test_skill_definition(self):\n        print(\"\\n3. Testing Skill Definition & References...\")\n        skill_file = self.root_dir / \"skills\" / \"TorusGuard\" / \"SKILL.md\"\n        if not skill_file.exists():\n            self.log_test(\"SKILL.md exists\", False, \"Missing skills/TorusGuard/SKILL.md\")\n            return\n\n        with open(skill_file, \"r\", encoding=\"utf-8\") as f:\n            content = f.read()\n\n        has_frontmatter = content.startswith(\"---\") and \"name: torusguard\" in content\n        self.log_test(\"SKILL.md YAML Frontmatter\", has_frontmatter)\n\n        has_commands = all(cmd in content for cmd in [\"/torusguard init\", \"/torusguard audit\", \"/torusguard harden\", \"/torusguard apply\", \"/torusguard verify\", \"/torusguard recheck\"])\n        self.log_test(\"SKILL.md Core Commands Documented (including apply & recheck)\", has_commands)\n\n        refs_dir = self.root_dir / \"skills\" / \"TorusGuard\" / \"references\"\n        ref_files = list(refs_dir.glob(\"*.md\"))\n        self.log_test(f\"Skill Reference Modules ({len(ref_files)})\", len(ref_files) >= 7)\n\n    def test_confidence_scoring_model(self):\n        print(\"\\n4. Testing Auditable Confidence Scoring Model...\")\n        c_confirmed = ConfidenceScore.calculate(\n            evidence_quality=35,\n            reproduction_success=25,\n            independent_confirmations=15,\n            environmental_clarity=15,\n            manual_review_status=5,\n            rationale=\"Direct AST match with deterministic reproduction.\",\n        )\n        self.log_test(\"Confidence calculation: Confirmed band (>= 90)\", c_confirmed.score == 95 and c_confirmed.band == ConfidenceBand.CONFIRMED)\n\n        c_high = ConfidenceScore.calculate(\n            evidence_quality=30,\n            reproduction_success=20,\n            independent_confirmations=10,\n            environmental_clarity=15,\n            manual_review_status=0,\n            rationale=\"Strong static indicator without manual validation.\",\n        )\n        self.log_test(\"Confidence calculation: High Confidence band (70-89)\", c_high.score == 75 and c_high.band == ConfidenceBand.HIGH_CONFIDENCE)\n\n    def test_provenance_and_evidence_hashing(self):\n        print(\"\\n5. Testing Provenance Chain & SHA-256 Evidence Integrity...\")\n        ev = Evidence(\n            type=EvidenceType.SOURCE,\n            location=\"server/auth.py:42\",\n            raw_snippet=\"SECRET_KEY = 'super_secret_jwt_key'\",\n            rationale=\"Hardcoded secret credential.\",\n            confidence_level=ConfidenceBand.CONFIRMED,\n            is_sufficient_for_confirmed=True,\n        )\n        has_hash = bool(ev.sha256_checksum) and len(ev.sha256_checksum) == 64\n        self.log_test(\"Evidence SHA-256 Checksum Computed\", has_hash)\n\n    def test_sensitive_data_masking(self):\n        print(\"\\n6. Testing Sensitive Secret & Token Masking...\")\n        sample_secret = \"API_KEY = 'sk_live_998877665544332211'\"\n        masked = mask_sensitive_data(sample_secret)\n        self.log_test(\"Stripe Secret Key Redaction\", \"sk_live_***REDACTED***\" in masked and \"998877665544332211\" not in masked)\n\n        sample_jwt = \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature\"\n        masked_jwt = mask_sensitive_data(sample_jwt)\n        self.log_test(\"JWT Token Redaction\", \"***REDACTED_JWT***\" in masked_jwt and \"doNotLeakSignature\" not in masked_jwt)\n\n    def test_retest_lifecycle_closure(self):\n        print(\"\\n7. Testing Retest Execution & Closure State Machine...\")\n        ev = Evidence(\n            type=EvidenceType.SOURCE,\n            location=\"views.py:15\",\n            raw_snippet=\"User.objects.raw('SELECT * FROM users WHERE name = %s')\",\n            rationale=\"Direct string concatenation into SQL query.\",\n            confidence_level=ConfidenceBand.CONFIRMED,\n            is_sufficient_for_confirmed=True,\n        )\n        sev = SeverityInfo(\n            level=SeverityLevel.CRITICAL,\n            rationale=\"Allows arbitrary SQL execution and data exfiltration.\",\n            rubric_justification=\"Critical because unauthenticated user input reaches raw SQL interpreter.\",\n        )\n        conf = ConfidenceScore.calculate(35, 25, 15, 15, 5, \"Direct AST concatenation match.\")\n        prov = ProvenanceChain(\n            discovery_module=\"rules/input/TG-INPUT-002-raw-sql-concatenation.md\",\n            triggering_input=\"Raw SQL execution with f-string formatting\",\n            evidence_collected=[\"views.py:15\"],\n            decision_path=[\"Detected raw SQL method\", \"Verified unparameterized input\"],\n            verification_step=\"Inspect query parameterization.\",\n        )\n        rem = Remediation(\n            problem_statement=\"Raw SQL string concatenation vulnerable to SQL injection.\",\n            risk_explanation=\"Attackers can inject malicious SQL payloads.\",\n            recommended_fix=\"Use parameterized queries.\",\n            framework_pattern=FrameworkPattern(\n                framework=\"Django\",\n                unsafe_snippet=\"User.objects.raw(f'SELECT * FROM users WHERE name = {name}')\",\n                safe_snippet=\"User.objects.raw('SELECT * FROM users WHERE name = %s', [name])\",\n            ),\n            verification_method=\"Test with quote payload and verify parameterized execution.\",\n            residual_risk_notes=\"Ensure database permissions are restricted.\",\n        )\n        finding = Finding(\n            rule_id=\"TG-INPUT-002\",\n            title=\"Raw SQL Concatenation\",\n            category=TaxonomyCategory.INPUT,\n            severity=sev,\n            confidence=conf,\n            status=FindingStatus.CONFIRMED,\n            affected_component=AffectedComponent(component_name=\"UserSearch\", target_path=\"views.py\", start_line=15),\n            evidence=[ev],\n            provenance=prov,\n            reproduction_method=ReproductionMethod(step_by_step=[\"Pass ' OR '1'='1 into search endpoint\"], test_command=\"pytest tests/test_search.py\"),\n            remediation=rem,\n            asvs_control=\"V5.3.4\",\n            cwe=\"CWE-89\",\n            nist_ssdf=\"PW.5.1\",\n        )\n\n        FindingLifecycleManager.transition(finding, LifecycleStage.CLASSIFY)\n        FindingLifecycleManager.transition(finding, LifecycleStage.VERIFY)\n        FindingLifecycleManager.transition(finding, LifecycleStage.REMEDIATE)\n\n        ok, msg = FindingLifecycleManager.execute_retest(\n            finding,\n            post_fix_code=\"User.objects.raw('SELECT * FROM users WHERE name = %s', [name])\",\n            safe_pattern_verified=True,\n            verifier_notes=\"Verified parameterized binding query.\",\n        )\n        self.log_test(\"Retest execution -> Verified Fixed\", ok and finding.status == FindingStatus.VERIFIED_FIXED)\n\n    def test_validation_engine_subsystem(self):\n        print(\"\\n8. Testing Validation Engine Subsystem (v0.5.4)...\")\n        fm = FixtureManager(str(self.root_dir))\n        fixtures = fm.list_fixtures()\n        self.log_test(f\"Fixture Manager Catalog Loaded ({len(fixtures)} fixtures)\", len(fixtures) >= 8)\n\n        rr = ReplayRunner(str(self.root_dir))\n        comparator = ResultComparator(str(self.root_dir))\n        comparison_results = []\n\n        for f in fixtures:\n            replay_res = rr.replay_fixture(f, passes=3)\n            self.log_test(f\"Deterministic Replay (3 passes): {f.fixture_id}\", replay_res.deterministic)\n\n            comp_res = comparator.compare_fixture(f, replay_deterministic=replay_res.deterministic)\n            comparison_results.append(comp_res)\n            self.log_test(f\"Differential Comparison ({comp_res.outcome.value}): {f.fixture_id}\", comp_res.diff_verified)\n\n        # Regression tracker\n        rt = RegressionTracker(str(self.root_dir))\n        reg_records = rt.evaluate_all_regressions()\n        all_clean = all(r.regression_status == \"Clean\" for r in reg_records)\n        self.log_test(f\"Regression Tracker Verification ({len(reg_records)} baseline cases clean)\", all_clean)\n\n        # FP Analyzer\n        diagnostics = FalsePositiveAnalyzer.analyze_results(comparison_results)\n        self.log_test(\"False Positive Analyzer Diagnostic Check (0 false alarms)\", len(diagnostics) == 0)\n\n        # Evidence Collector & Report Emitter\n        collector = ValidationEvidenceCollector(str(self.root_dir))\n        env_snap = collector.capture_environment_snapshot()\n        self.log_test(\"Validation Evidence Collector Environment Snapshot\", \"os\" in env_snap and \"python_version\" in env_snap)\n\n        val_report = ValidationRunReport(\n            environment=env_snap,\n            fixture_results=comparison_results,\n            regression_records=reg_records,\n        )\n        report_md = ValidationReportEmitter.render_markdown(val_report)\n        self.log_test(\"Validation Report Emitter Markdown Rendering\", \"# TorusGuard Validation Engine\" in report_md and \"Execution Summary\" in report_md)\n\n    def test_stack_detection_fixtures(self):\n        print(\"\\n9. Testing Stack Detection Layouts...\")\n        stack_dir = self.root_dir / \"tests\" / \"fixtures\" / \"python\" / \"stack-detection\"\n        expected_stacks = [\n            \"django\",\n            \"django-drf\",\n            \"fastapi\",\n            \"flask\",\n            \"flask-sqlalchemy\",\n            \"python-library\",\n            \"mixed-monorepo\",\n        ]\n        for s in expected_stacks:\n            target = stack_dir / s\n            exists = target.exists() and any(target.iterdir())\n            self.log_test(f\"Stack layout fixture: {s}\", exists)\n\n    def test_educational_differential_fixtures(self):\n        print(\"\\n10. Testing Educational Differential Fixtures...\")\n        pairs = [\n            (\"examples/python/django-vuln\", \"examples/python/django-hardened\"),\n            (\"examples/python/drf-vuln\", \"examples/python/drf-hardened\"),\n            (\"examples/python/fastapi-vuln\", \"examples/python/fastapi-hardened\"),\n            (\"examples/python/flask-vuln\", \"examples/python/flask-hardened\"),\n            (\"examples/python/sqlalchemy-vuln\", \"examples/python/sqlalchemy-hardened\"),\n        ]\n        for vuln_rel, hard_rel in pairs:\n            vuln_path = self.root_dir / vuln_rel\n            hard_path = self.root_dir / hard_rel\n            exists = vuln_path.exists() and hard_path.exists()\n            has_fixes = (hard_path / \"fixes.md\").exists() or (vuln_path / \"README.md\").exists()\n            self.log_test(f\"Paired differential fixture: {Path(vuln_rel).name}\", exists and has_fixes)\n\n    def test_regression_fixtures(self):\n        print(\"\\n11. Testing Python Regression Fixtures Suite...\")\n        regression_dir = self.root_dir / \"tests\" / \"fixtures\" / \"python\"\n        cases = [\n            \"django/safe-service-layer-auth\",\n            \"django/missing-owner-scope\",\n            \"drf/safe-read-only-fields\",\n            \"drf/unbounded-pagination\",\n            \"fastapi/safe-pydantic-boundary\",\n            \"fastapi/unsafe-outbound-url\",\n            \"flask/csrf-enabled\",\n            \"flask/unsafe-upload\",\n            \"sqlalchemy/safe-bound-query\",\n            \"sqlalchemy/missing-tenant-scope\",\n        ]\n        for c in cases:\n            c_path = regression_dir / c\n            exists = c_path.exists() and (c_path / \"README.md\").exists()\n            self.log_test(f\"Regression fixture: {c}\", exists)\n\n    def test_report_formatting(self):\n        print(\"\\n12. Testing Canonical v0.5.4 9-Section Actionable Markdown Report...\")\n        ev = Evidence(\n            type=EvidenceType.SOURCE,\n            location=\"settings.py:10\",\n            raw_snippet=\"DEBUG = True\\nSECRET_KEY = 'sk_live_secret_key_12345'\",\n            rationale=\"Production debug mode exposure and hardcoded secret.\",\n            confidence_level=ConfidenceBand.CONFIRMED,\n            is_sufficient_for_confirmed=True,\n        )\n        sev = SeverityInfo(\n            level=SeverityLevel.CRITICAL,\n            rationale=\"Exposes internal stack traces and hardcoded production secret.\",\n            rubric_justification=\"Critical because secret key enables session forgery and debug leaks internals.\",\n        )\n        conf = ConfidenceScore.calculate(35, 25, 15, 15, 5, \"Direct settings file check.\")\n        prov = ProvenanceChain(\n            discovery_module=\"rules/TG-PLATFORM-003-production-stack-trace-exposure.md\",\n            triggering_input=\"DEBUG = True assignment in settings.py\",\n            evidence_collected=[\"settings.py:10\"],\n            decision_path=[\"Loaded Django settings\", \"Found DEBUG enabled\"],\n            verification_step=\"Assert DEBUG is False.\",\n        )\n        rem = Remediation(\n            problem_statement=\"Debug mode is enabled and hardcoded secret present.\",\n            risk_explanation=\"Stack traces leak environment variables and secret allows token forgery.\",\n            recommended_fix=\"Set DEBUG = False and load secret from environment.\",\n            framework_pattern=FrameworkPattern(\n                framework=\"Django\",\n                unsafe_snippet=\"DEBUG = True\",\n                safe_snippet=\"DEBUG = False\",\n            ),\n            verification_method=\"Assert DEBUG is False in production.\",\n            residual_risk_notes=\"Ensure 500.html template exists.\",\n        )\n        f = Finding(\n            rule_id=\"TG-PLATFORM-003\",\n            title=\"Production Stack Trace Exposure\",\n            category=TaxonomyCategory.CLIENT_PLATFORM,\n            severity=sev,\n            confidence=conf,\n            status=FindingStatus.CONFIRMED,\n            remediation_priority=RemediationPriority.IMMEDIATE,\n            affected_component=AffectedComponent(component_name=\"Config\", target_path=\"settings.py\", start_line=10),\n            evidence=[ev],\n            provenance=prov,\n            reproduction_method=ReproductionMethod(step_by_step=[\"Trigger 500 error and inspect response body\"]),\n            remediation=rem,\n            asvs_control=\"V14.4.1\",\n            cwe=\"CWE-209\",\n            nist_ssdf=\"PW.5.1\",\n        )\n        report = AuditReport(\n            project_name=\"DemoApp\",\n            detected_stack={\"language\": \"Python\", \"framework\": \"Django\", \"confidence\": \"Confirmed\"},\n            findings=[f],\n        )\n\n        md_output = ReportFormatter.render_markdown(report)\n        has_header = \"# TorusGuard Security Audit & Remediation Report\" in md_output\n        has_exec_summary = \"## 1. \ud83d\udccb Executive Summary\" in md_output\n        has_scope = \"## 2. \ud83d\udd0d Scope and Methodology\" in md_output\n        has_summary_table = \"## 3. \ud83d\udcd1 Key Findings Summary Table\" in md_output\n        has_detailed = \"## 4. \ud83d\udee1\ufe0f Detailed Findings\" in md_output\n        has_business_context = \"\ud83c\udfe2 Business Impact & Executive Context\" in md_output\n        has_remediation_roadmap = \"## 5. \ud83c\udfaf Remediation Priorities & Triage Roadmap\" in md_output\n        has_ticket_payload = \"\ud83c\udfab Copy-Paste Issue Tracker Payload\" in md_output\n        has_redaction = \"sk_live_***REDACTED***\" in md_output\n\n        self.log_test(\n            \"Render v0.5.4 9-Section Actionable Report\",\n            has_header and has_exec_summary and has_scope and has_summary_table and has_detailed and has_business_context and has_remediation_roadmap and has_ticket_payload and has_redaction\n        )\n\n    def test_run_context_and_ponytail(self):\n        print(\"\\n13. Testing v0.5.5 RunFolder Structure...\")\n        import shutil\n        test_root = self.root_dir / \".torusguard\" / \"runs_test\"\n        if test_root.exists():\n            shutil.rmtree(test_root)\n            \n        rf = RunFolder(output_root=str(test_root), run_name=\"test-run-001\")\n        \n        # Test directory initialization\n        has_dirs = rf.run_path.exists() and rf.patches_dir.exists() and rf.logs_dir.exists()\n        \n        # Test metadata file initialization\n        has_metadata = rf.metadata_file.exists()\n        if has_metadata:\n            with open(rf.metadata_file, \"r\", encoding=\"utf-8\") as f:\n                metadata = json.load(f)\n                has_metadata = metadata.get(\"run_id\") == \"test-run-001\"\n                \n        self.log_test(\"RunFolder Initialization\", has_dirs and has_metadata)\n        \n        # Cleanup\n        shutil.rmtree(test_root)\n\n    def test_v6_governed_remediation_suite(self):\n        print(\"\\n14. Testing TorusGuard v0.6.0 Governed Remediation & Targeted Recheck Engine...\")\n        import tempfile\n        from core.identity import IdentityEngine\n        from core.clustering import ClusteringEngine\n        from core.bundle import BundleManager\n        from core.governance import PatchGovernor\n        from core.rechecker import TargetedRechecker, RecheckOutcome\n        from core.run_manager import RunManager\n        from core.sarif import SarifExporter\n        from core.v6_workflow import V6Workflow\n\n        temp_dir = Path(tempfile.mkdtemp(prefix=\"tg-v0-6-harness-\"))\n        try:\n            # 1. Run Folder\n            rm = RunManager(base_dir=temp_dir, target_name=\"test-target\", command=\"audit\", run_id=\"run-harness-01\")\n            rm.write_manifest(status_counts={\"total_findings\": 1, \"confirmed\": 1, \"high_confidence\": 0, \"needs_review\": 0, \"remediated\": 0, \"verified_fixed\": 0, \"regressed\": 0})\n            self.log_test(\"v0.6.0 RunFolder & Manifest.json Generation\", rm.manifest_file.exists() and rm.patches_dir.exists())\n\n            # 2. Stable Finding Identity\n            code_a = \"def view():\\n    return Item.objects.get(organization_id=request.user.organization_id, id=id)\"\n            code_b = \"# Shifted comment\\ndef view():\\n    return Item.objects.get(id=id)\"\n            fp1 = IdentityEngine.generate_identity(\"TG-DB-004\", \"views.py\", code_a, sink_signature=\"Item.objects.get\")\n            fp2 = IdentityEngine.generate_identity(\"TG-DB-004\", \"views.py\", code_b, sink_signature=\"Item.objects.get\")\n            self.log_test(\"v0.6.0 Stable Finding Identity (Line Shift Invariance)\", fp1.fingerprint_id == fp2.fingerprint_id and fp1.fingerprint_id.startswith(\"TG-DB-\"))\n\n            # 3. Root-Cause Clustering\n            raw_f = [\n                {\"finding_id\": \"f1\", \"rule_id\": \"TG-DB-004\", \"title\": \"Missing Tenant Isolation\", \"severity\": \"High\", \"target\": {\"file_path\": \"a.py\"}},\n                {\"finding_id\": \"f2\", \"rule_id\": \"TG-DB-004\", \"title\": \"Missing Tenant Isolation\", \"severity\": \"High\", \"target\": {\"file_path\": \"b.py\"}},\n            ]\n            clusters = ClusteringEngine.cluster_findings(raw_f)\n            self.log_test(\"v0.6.0 Root-Cause Clustering (Multi-Tenant Pattern)\", len(clusters) == 1 and clusters[0].cluster_id == \"cluster-tenant-isolation\")\n\n            # 4. Remediation Bundle\n            bundle = BundleManager.create_bundle(raw_f[0], cluster_id=\"cluster-tenant-isolation\")\n            b_dir = bundle.write_to_directory(temp_dir)\n            self.log_test(\"v0.6.0 Remediation Bundle Packaging (5 Artifacts)\", (b_dir / \"finding.md\").exists() and (b_dir / \"minimal_patch_plan.md\").exists())\n\n            # 5. Patch Governance\n            gov = PatchGovernor(max_additions_per_file=10)\n            clean_diff = \"--- a/x.py\\n+++ b/x.py\\n@@ -1 +1 @@\\n-old()\\n+new()\\n\"\n            oversized_diff = \"--- a/x.py\\n+++ b/x.py\\n\" + \"\\n\".join(f\"+line_{i}()\" for i in range(20))\n            d_clean = gov.evaluate_diff(clean_diff, \"x.py\")\n            d_over = gov.evaluate_diff(oversized_diff, \"x.py\")\n            self.log_test(\"v0.6.0 Minimal Patch Governance (Line Churn Policy)\", d_clean.allowed_auto_apply and not d_over.allowed_auto_apply)\n\n            # 6. Targeted Recheck\n            r_fix = TargetedRechecker.verify_finding(\"f1\", \"TG-DB-004\", \"a.py\", \"old\", \"new\", is_safe_pattern_present=True, is_unsafe_pattern_present=False)\n            r_reg = TargetedRechecker.verify_finding(\"f2\", \"TG-DB-004\", \"b.py\", \"old\", \"bad\", is_safe_pattern_present=False, is_unsafe_pattern_present=True, introduced_new_flaws=[\"TG-SEC-001\"])\n            self.log_test(\"v0.6.0 Targeted Recheck Transitions (Confirmed Fixed & Regressed)\", r_fix.outcome == RecheckOutcome.CONFIRMED_FIXED and r_reg.outcome == RecheckOutcome.REGRESSED)\n\n            # 7. SARIF Export\n            sarif = SarifExporter.generate_sarif([{\"finding_id\": \"f1\", \"rule_id\": \"TG-DB-004\", \"title\": \"Missing Tenant Isolation\", \"target\": {\"file_path\": \"a.py\"}}])\n            self.log_test(\"v0.6.0 SARIF v2.1.0 Structured Export\", sarif[\"version\"] == \"2.1.0\" and len(sarif[\"runs\"]) == 1)\n\n            # 8. End-to-End Workflow\n            wf = V6Workflow(target_root=temp_dir, output_base=temp_dir / \"runs\")\n            run_wf = wf.execute_audit(raw_f, target_name=\"e2e-demo\", export_sarif=True)\n            self.log_test(\"v0.6.0 End-to-End Workflow Execution\", run_wf.manifest_file.exists() and run_wf.sarif_file.exists())\n\n        finally:\n            shutil.rmtree(temp_dir, ignore_errors=True)\n\n\nif __name__ == \"__main__\":\n    runner = ValidationHarnessRunner()\n    success = runner.run_all()\n    sys.exit(0 if success else 1)"
+}

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-503-d11cf8/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-503-d11cf8
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `harness/runner.py:503`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -501,5 +501,5 @@
+ 
+             # 2. Stable Finding Identity
+-            code_a = "def view():\n    return Item.objects.get(id=id)"
++            code_a = "def view():\n    return Item.objects.get(organization_id=request.user.organization_id, id=id)"
+             code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+             fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+
+```

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-503-d11cf8/patch.diff

@@ -0,0 +1,9 @@
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -501,5 +501,5 @@
+ 
+             # 2. Stable Finding Identity
+-            code_a = "def view():\n    return Item.objects.get(id=id)"
++            code_a = "def view():\n    return Item.objects.get(organization_id=request.user.organization_id, id=id)"
+             code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+             fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-79-91f41f/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-79-91f41f",
+  "finding_id": "TG-DB-004-6a739666",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "tests/test_v0_6_0_governed_remediation.py",
+  "line_number": 79,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/tests/test_v0_6_0_governed_remediation.py\n+++ b/tests/test_v0_6_0_governed_remediation.py\n@@ -77,5 +77,5 @@\n         def get_invoice(request, invoice_id):\n             # Fetch invoice directly without tenant filter\n-            invoice = Invoice.objects.get(id=invoice_id)\n+            invoice = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)\n             return JsonResponse({\"id\": invoice.id})\n         \"\"\"\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "\"\"\"\nTorusGuard v0.6.0 Governed Remediation Test Suite\nTests:\n1. Run Folder System & Manifest Generation\n2. Stable Finding Identity Across Line Shifts\n3. Root-Cause Clustering across Django, FastAPI, Flask, SQLAlchemy\n4. Structured Remediation Bundle Generation\n5. Minimal Patch Governance (Line churn, file count, high-risk escalation)\n6. Targeted Recheck Status Transitions (Confirmed Fixed, Partially Fixed, Regressed, Needs Manual Review)\n7. SARIF v2.1.0 JSON Structured Export\n8. End-to-End v0.6.0 Governed Remediation Workflow Execution\n\"\"\"\n\nimport unittest\nimport tempfile\nimport shutil\nimport json\nimport sys\nfrom pathlib import Path\n\n# Add project root to sys.path\nsys.path.insert(0, str(Path(__file__).resolve().parent.parent))\n\nfrom core.identity import IdentityEngine, FindingFingerprint\nfrom core.clustering import ClusteringEngine, RootCauseCluster\nfrom core.bundle import BundleManager, RemediationBundle\nfrom core.governance import PatchGovernor, PatchPolicyDecision\nfrom core.rechecker import TargetedRechecker, TargetedRecheckResult, RecheckOutcome\nfrom core.run_manager import RunManager\nfrom core.sarif import SarifExporter\nfrom core.v6_workflow import V6Workflow\n\n\nclass TestTorusGuardV060(unittest.TestCase):\n\n    def setUp(self):\n        self.test_dir = Path(tempfile.mkdtemp(prefix=\"torusguard-v0-6-test-\"))\n\n    def tearDown(self):\n        shutil.rmtree(self.test_dir, ignore_errors=True)\n\n    def test_run_folder_creation_and_manifest(self):\n        \"\"\"Verify RunManager initializes isolated run folder with all standard artifacts.\"\"\"\n        run_mgr = RunManager(\n            base_dir=self.test_dir,\n            target_name=\"django-core\",\n            command=\"audit\",\n            run_id=\"run-20260831-test-01\"\n        )\n        self.assertTrue(run_mgr.run_path.exists())\n        self.assertTrue(run_mgr.logs_dir.exists())\n        self.assertTrue(run_mgr.patches_dir.exists())\n        self.assertTrue(run_mgr.bundles_dir.exists())\n\n        # Write manifest and verify\n        run_mgr.write_manifest(\n            status_counts={\n                \"total_findings\": 2,\n                \"confirmed\": 1,\n                \"high_confidence\": 1,\n                \"needs_review\": 0,\n                \"remediated\": 0,\n                \"verified_fixed\": 0,\n                \"regressed\": 0,\n            }\n        )\n        self.assertTrue(run_mgr.manifest_file.exists())\n        with open(run_mgr.manifest_file, \"r\", encoding=\"utf-8\") as f:\n            data = json.load(f)\n        self.assertEqual(data[\"version\"], \"v0.6.3\")\n        self.assertEqual(data[\"run_id\"], \"run-20260831-test-01\")\n        self.assertEqual(data[\"status_counts\"][\"total_findings\"], 2)\n\n    def test_stable_finding_identity_across_line_shifts(self):\n        \"\"\"Verify Finding Fingerprint remains stable when comments or surrounding lines shift.\"\"\"\n        code_v1 = \"\"\"\n        def get_invoice(request, invoice_id):\n            # Fetch invoice directly without tenant filter\n            invoice = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)\n            return JsonResponse({\"id\": invoice.id})\n        \"\"\"\n        code_v2_shifted = \"\"\"\n        # Added extra docstring at the top of file\n        # Lines shifted down by 10 lines\n        def get_invoice(request, invoice_id):\n            invoice = Invoice.objects.get(id=invoice_id)\n            return JsonResponse({\"id\": invoice.id})\n        \"\"\"\n\n        fp1 = IdentityEngine.generate_identity(\n            rule_id=\"TG-DB-004\",\n            file_path=\"invoices/views.py\",\n            code_snippet=code_v1,\n            sink_signature=\"Invoice.objects.get\",\n            framework_marker=\"django\",\n        )\n        fp2 = IdentityEngine.generate_identity(\n            rule_id=\"TG-DB-004\",\n            file_path=\"invoices/views.py\",\n            code_snippet=code_v2_shifted,\n            sink_signature=\"Invoice.objects.get\",\n            framework_marker=\"django\",\n        )\n\n        self.assertEqual(fp1.fingerprint_id, fp2.fingerprint_id)\n        self.assertEqual(fp1.region_hash, fp2.region_hash)\n        self.assertTrue(fp1.fingerprint_id.startswith(\"TG-DB-\"))\n\n    def test_root_cause_clustering(self):\n        \"\"\"Verify grouping of disparate findings into systemic root-cause clusters.\"\"\"\n        findings = [\n            {\n                \"finding_id\": \"fnd-01\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Tenant Filter\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"backend/api/users.py\", \"line_start\": 20, \"line_end\": 25},\n            },\n            {\n                \"finding_id\": \"fnd-02\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Tenant Filter on Invoices\",\n                \"severity\": \"Critical\",\n                \"target\": {\"file_path\": \"backend/api/invoices.py\", \"line_start\": 45, \"line_end\": 50},\n            },\n            {\n                \"finding_id\": \"fnd-03\",\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": \"Unsafe Upload Path\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"backend/services/uploader.py\", \"line_start\": 12, \"line_end\": 18},\n            }\n        ]\n\n        clusters = ClusteringEngine.cluster_findings(findings)\n        self.assertEqual(len(clusters), 2)\n\n        cluster_map = {c.cluster_id: c for c in clusters}\n        self.assertIn(\"cluster-tenant-isolation\", cluster_map)\n        self.assertIn(\"cluster-path-traversal\", cluster_map)\n\n        tenant_cluster = cluster_map[\"cluster-tenant-isolation\"]\n        self.assertEqual(len(tenant_cluster.finding_ids), 2)\n        self.assertEqual(len(tenant_cluster.affected_files), 2)\n        self.assertEqual(tenant_cluster.risk_severity, \"Critical\")\n\n    def test_remediation_bundle_generation(self):\n        \"\"\"Verify structured remediation bundle creates all 5 expected artifacts.\"\"\"\n        finding = {\n            \"finding_id\": \"TG-AUTH-008-abc123\",\n            \"rule_id\": \"TG-AUTH-008\",\n            \"title\": \"Untrusted Role Header Injection\",\n            \"severity\": \"High\",\n            \"target\": {\"file_path\": \"middleware/auth.py\"},\n            \"what_is_wrong\": \"Role is read directly from unauthenticated header X-Role.\",\n            \"why_it_matters\": \"Allows unprivileged users to escalate to Admin role.\",\n            \"what_should_change\": \"Derive role from verified JWT session payload.\",\n            \"proposed_diff\": \"--- a/middleware/auth.py\\n+++ b/middleware/auth.py\\n@@ -1,2 +1,2 @@\\n-role = req.headers.get('X-Role')\\n+role = req.user.role\\n\",\n            \"verification_steps\": \"Send X-Role header and assert 403 Forbidden.\",\n        }\n\n        bundle = BundleManager.create_bundle(finding, cluster_id=\"cluster-header-trust\")\n        bundle_dir = bundle.write_to_directory(self.test_dir)\n\n        self.assertTrue((bundle_dir / \"finding.md\").exists())\n        self.assertTrue((bundle_dir / \"remediation.md\").exists())\n        self.assertTrue((bundle_dir / \"minimal_patch_plan.md\").exists())\n        self.assertTrue((bundle_dir / \"verify-after-change.md\").exists())\n        self.assertTrue((bundle_dir / \"metadata.json\").exists())\n\n        with open(bundle_dir / \"metadata.json\", \"r\", encoding=\"utf-8\") as f:\n            meta = json.load(f)\n        self.assertEqual(meta[\"bundle_id\"], \"bundle-TG-AUTH-008-abc123\")\n        self.assertEqual(meta[\"cluster_id\"], \"cluster-header-trust\")\n\n    def test_minimal_patch_governance(self):\n        \"\"\"Verify governance policy checks on line churn, file limits, and high-risk escalation.\"\"\"\n        governor = PatchGovernor(max_additions_per_file=15, max_deletions_per_file=10)\n\n        # 1. Clean minimal patch\n        clean_diff = \"\"\"--- a/services/helper.py\n+++ b/services/helper.py\n@@ -10,3 +10,3 @@\n-val = raw_input\n+val = sanitize(raw_input)\n\"\"\"\n        decision_clean = governor.evaluate_diff(clean_diff, \"services/helper.py\")\n        self.assertTrue(decision_clean.allowed_auto_apply)\n        self.assertFalse(decision_clean.escalation_required)\n        self.assertEqual(decision_clean.line_additions, 1)\n\n        # 2. Oversized patch (exceeds line additions)\n        oversized_lines = [\"--- a/services/helper.py\", \"+++ b/services/helper.py\"]\n        for i in range(25):\n            oversized_lines.append(f\"+line_{i} = True\")\n        oversized_diff = \"\\n\".join(oversized_lines)\n\n        decision_oversized = governor.evaluate_diff(oversized_diff, \"services/helper.py\")\n        self.assertFalse(decision_oversized.allowed_auto_apply)\n        self.assertTrue(any(\"exceed threshold\" in r for r in decision_oversized.rejection_reasons))\n\n        # 3. High-risk context (touching auth file with non-trivial churn)\n        high_risk_lines = [\"--- a/backend/auth/login.py\", \"+++ b/backend/auth/login.py\"]\n        for i in range(12):\n            high_risk_lines.append(f\"+auth_check_{i}()\")\n        high_risk_diff = \"\\n\".join(high_risk_lines)\n\n        decision_high_risk = governor.evaluate_diff(high_risk_diff, \"backend/auth/login.py\")\n        self.assertTrue(decision_high_risk.escalation_required)\n        self.assertFalse(decision_high_risk.allowed_auto_apply)\n\n    def test_targeted_recheck_outcomes(self):\n        \"\"\"Verify recheck transitions: Confirmed Fixed, Regressed, Needs Manual Review.\"\"\"\n        # 1. Confirmed Fixed\n        res_fixed = TargetedRechecker.verify_finding(\n            finding_id=\"fnd-01\",\n            rule_id=\"TG-DB-004\",\n            target_file=\"models/query.py\",\n            original_code_snippet=\"return Model.objects.all()\",\n            post_fix_code_snippet=\"return Model.objects.filter(tenant=request.tenant)\",\n            is_safe_pattern_present=True,\n            is_unsafe_pattern_present=False,\n        )\n        self.assertEqual(res_fixed.outcome, RecheckOutcome.CONFIRMED_FIXED)\n        self.assertEqual(len(res_fixed.regressions_detected), 0)\n\n        # 2. Regressed (introduced new vulnerability)\n        res_regressed = TargetedRechecker.verify_finding(\n            finding_id=\"fnd-02\",\n            rule_id=\"TG-INPUT-006\",\n            target_file=\"views/upload.py\",\n            original_code_snippet=\"file.save(filename)\",\n            post_fix_code_snippet=\"os.system(f'cp {filename} /tmp')\",\n            is_safe_pattern_present=False,\n            is_unsafe_pattern_present=True,\n            introduced_new_flaws=[\"TG-CMD-001: Command Injection in upload handler\"],\n        )\n        self.assertEqual(res_regressed.outcome, RecheckOutcome.REGRESSED)\n        self.assertIn(\"Command Injection\", res_regressed.regressions_detected[0])\n\n        # 3. Needs Manual Review\n        res_manual = TargetedRechecker.verify_finding(\n            finding_id=\"fnd-03\",\n            rule_id=\"TG-WEBHOOK-001\",\n            target_file=\"webhooks/receiver.py\",\n            original_code_snippet=\"verify_sig()\",\n            post_fix_code_snippet=\"verify_sig()\",\n            requires_manual_context=True,\n        )\n        self.assertEqual(res_manual.outcome, RecheckOutcome.NEEDS_MANUAL_REVIEW)\n\n    def test_sarif_v210_export(self):\n        \"\"\"Verify valid SARIF v2.1.0 output structure and stable fingerprints.\"\"\"\n        findings = [\n            {\n                \"finding_id\": \"TG-DB-123456\",\n                \"fingerprint_id\": \"TG-DB-123456\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Tenant Query Isolation\",\n                \"severity\": \"High\",\n                \"confidence_score\": 95,\n                \"confidence_band\": \"Confirmed\",\n                \"cluster_id\": \"cluster-tenant-isolation\",\n                \"target\": {\"file_path\": \"backend/models.py\", \"line_start\": 40, \"line_end\": 45},\n                \"evidence\": {\"code_snippet\": \"return self.query()\"},\n            }\n        ]\n\n        sarif_obj = SarifExporter.generate_sarif(findings, tool_version=\"6.0.0\")\n        self.assertEqual(sarif_obj[\"version\"], \"2.1.0\")\n        self.assertEqual(len(sarif_obj[\"runs\"]), 1)\n\n        driver = sarif_obj[\"runs\"][0][\"tool\"][\"driver\"]\n        self.assertEqual(driver[\"name\"], \"TorusGuard\")\n        self.assertEqual(driver[\"semanticVersion\"], \"6.0.0\")\n\n        result = sarif_obj[\"runs\"][0][\"results\"][0]\n        self.assertEqual(result[\"ruleId\"], \"TG-DB-004\")\n        self.assertEqual(result[\"level\"], \"error\")\n        self.assertEqual(result[\"fingerprints\"][\"torusguard/v6/stable_identity\"], \"TG-DB-123456\")\n\n    def test_end_to_end_v6_workflow(self):\n        \"\"\"Verify full end-to-end v6 workflow: audit -> harden -> apply -> recheck.\"\"\"\n        workflow = V6Workflow(\n            target_root=self.test_dir,\n            output_base=self.test_dir / \"runs\",\n        )\n\n        raw_findings = [\n            {\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": \"Unsafe File Path Traversal\",\n                \"severity\": \"High\",\n                \"confidence_score\": 92,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"uploader.py\", \"line_start\": 10, \"line_end\": 15},\n                \"evidence\": {\"code_snippet\": \"open(os.path.join(DIR, filename), 'wb')\"},\n                \"what_is_wrong\": \"Filename from client is not sanitized with secure_filename().\",\n                \"what_should_change\": \"Sanitize with werkzeug secure_filename.\",\n                \"proposed_diff\": \"--- a/uploader.py\\n+++ b/uploader.py\\n@@ -1,2 +1,2 @@\\n-path = os.path.join(DIR, filename)\\n+path = os.path.join(DIR, secure_filename(filename))\\n\",\n                \"verification_steps\": \"Send ../etc/passwd in filename parameter.\",\n            }\n        ]\n\n        # 1. Audit Phase\n        run_mgr = workflow.execute_audit(\n            raw_findings=raw_findings,\n            target_name=\"flask-uploader\",\n            run_id=\"run-e2e-01\",\n            export_sarif=True,\n        )\n        self.assertTrue(run_mgr.manifest_file.exists())\n        self.assertTrue(run_mgr.summary_file.exists())\n        self.assertTrue(run_mgr.findings_file.exists())\n        self.assertTrue(run_mgr.sarif_file.exists())\n\n        # 2. Harden Phase\n        with open(run_mgr.manifest_file, \"r\", encoding=\"utf-8\") as f:\n            manifest_data = json.load(f)\n        self.assertEqual(manifest_data[\"status_counts\"][\"total_findings\"], 1)\n\n        bundles = workflow.execute_harden(run_mgr, raw_findings)\n        self.assertEqual(len(bundles), 1)\n        self.assertTrue(run_mgr.remediation_file.exists())\n\n        # 3. Apply Phase\n        decisions = workflow.execute_apply(run_mgr, bundles)\n        self.assertEqual(len(decisions), 1)\n        self.assertTrue(decisions[0][1].allowed_auto_apply)\n        self.assertTrue(run_mgr.apply_plan_file.exists())\n        self.assertTrue(run_mgr.diff_summary_file.exists())\n        self.assertTrue(run_mgr.changed_files_file.exists())\n\n        # 4. Recheck Phase\n        recheck_scenarios = [\n            {\n                \"finding_id\": bundles[0].finding_id,\n                \"rule_id\": \"TG-INPUT-006\",\n                \"target_file\": \"uploader.py\",\n                \"orig_snippet\": \"path = os.path.join(DIR, filename)\",\n                \"post_snippet\": \"path = os.path.join(DIR, secure_filename(filename))\",\n                \"is_safe\": True,\n                \"is_unsafe\": False,\n            }\n        ]\n        recheck_results = workflow.execute_recheck(run_mgr, recheck_scenarios)\n        self.assertEqual(len(recheck_results), 1)\n        self.assertEqual(recheck_results[0].outcome, RecheckOutcome.CONFIRMED_FIXED)\n        self.assertTrue(run_mgr.recheck_file.exists())\n\n\nif __name__ == \"__main__\":\n    unittest.main()"
+}

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-79-91f41f/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-004-79-91f41f
+- **Rule ID:** `TG-DB-004`
+- **Target File:** `tests/test_v0_6_0_governed_remediation.py:79`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added explicit organization_id tenant boundary filter to ORM query
+
+## Unified Diff Preview
+```diff
+--- a/tests/test_v0_6_0_governed_remediation.py
++++ b/tests/test_v0_6_0_governed_remediation.py
+@@ -77,5 +77,5 @@
+         def get_invoice(request, invoice_id):
+             # Fetch invoice directly without tenant filter
+-            invoice = Invoice.objects.get(id=invoice_id)
++            invoice = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)
+             return JsonResponse({"id": invoice.id})
+         """
+
+```

package/.torusguard/runs/run-20260910-120238-audit/bundles/bnd-tg-db-004-79-91f41f/patch.diff

@@ -0,0 +1,9 @@
+--- a/tests/test_v0_6_0_governed_remediation.py
++++ b/tests/test_v0_6_0_governed_remediation.py
+@@ -77,5 +77,5 @@
+         def get_invoice(request, invoice_id):
+             # Fetch invoice directly without tenant filter
+-            invoice = Invoice.objects.get(id=invoice_id)
++            invoice = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)
+             return JsonResponse({"id": invoice.id})
+         """