torusguard 1.3.3 → 1.3.4

package/.torusguard/scripts/recipes_runner.py

@@ -1,8 +1,9 @@
 #!/usr/bin/env python3
 """
-TorusGuard Golden Fix Recipe Explorer (v1.3.0)
+TorusGuard Golden Fix Recipe Explorer (v1.3.3)
 Inspect, list, and export reusable, verified AST remediation code snippets
 distilled from passing security patches and persistent memory patterns.
+Standardized 75-column terminal UI formatting.
 
 Pure Python 3.10+ standard library (zero external dependencies).
 """
@@ -10,11 +11,19 @@ Pure Python 3.10+ standard library (zero external dependencies).
 import sys
 import json
 import argparse
-import unicodedata
-import re
 from pathlib import Path
 from typing import Dict, List, Any, Optional
 
+# Ensure scripts dir is in sys.path for term_ui import
+scripts_dir = Path(__file__).resolve().parent
+if str(scripts_dir) not in sys.path:
+    sys.path.insert(0, str(scripts_dir))
+
+try:
+    import term_ui
+except ImportError:
+    term_ui = None
+
 # Windows console UTF-8 support
 if sys.stdout and hasattr(sys.stdout, "reconfigure"):
     try:
@@ -22,7 +31,7 @@ if sys.stdout and hasattr(sys.stdout, "reconfigure"):
     except Exception:
         pass
 
-# ─── ANSI Colors & Formatter ───────────────────────────────────────────────────
+# ─── Formatting Helpers ────────────────────────────────────────────────────────
 BOLD = "\033[1m"
 DIM = "\033[2m"
 RESET = "\033[0m"
@@ -33,25 +42,25 @@ WHITE = "\033[97m"
 GRAY = "\033[90m"
 RED = "\033[31m"
 
-ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
+def box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
+    return f"  {border_color}{border}{RESET}  {content}"
+
+def box_header(title: str, subtitle: str = "", version: str = "v1.3.3", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.card_header(title, subtitle, version, border_color)
+    return f"=== {title} ({version}) ==="
 
-def get_visual_width(text: str) -> int:
-    clean = ANSI_REGEX.sub('', text)
-    width = 0
-    for ch in clean:
-        ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif ord(ch) >= 0x1F300:
-            width += 2
-        else:
-            width += 1
-    return width
+def border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_top(title, border_color=border_color, double=double)
+    return "┌" + "─" * 71 + "┐"
 
-def format_box_line(content: str, width: int = 71, border: str = "│", border_color: str = CYAN) -> str:
-    vis = get_visual_width(content)
-    pad = " " * max(0, width - vis)
-    return f"  {border_color}{border}{RESET}  {content}{pad}{border_color}{border}{RESET}"
+def border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_bottom(border_color=border_color, double=double)
+    return "└" + "─" * 71 + "┘"
 
 
 def list_recipes(target_root: Path, detail_id: Optional[str] = None, json_output: bool = False) -> None:
@@ -70,19 +79,16 @@ def list_recipes(target_root: Path, detail_id: Optional[str] = None, json_output
         return
 
     # Header Card
-    print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(format_box_line(f"{BOLD}🛡️  TORUSGUARD GOLDEN FIX RECIPES                   v1.3.0{RESET}", border_color=CYAN))
-    print(format_box_line(f"{DIM}Distilled Ponytail Fixes (<= 35 add, <= 25 del) in Persistent Memory{RESET}", border_color=CYAN))
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
+    print()
+    print(box_header("🛡️  TORUSGUARD GOLDEN FIX RECIPES", "Distilled Ponytail Fixes (<= 35 add, <= 25 del) in Persistent Memory", "v1.3.3"))
+    print()
 
     if not recipes:
         print(f"  {YELLOW}ℹ No golden fix recipes captured yet.{RESET}")
         print(f"  Run {CYAN}npx torusguard harden{RESET} followed by {CYAN}npx torusguard apply{RESET} to distill verified recipes.\n")
         return
 
-    print(f"  {CYAN}┌─ Active Distilled Recipes ({len(recipes)}) ─────────────────────────────────────┐{RESET}")
+    print(border_top(f"Active Distilled Recipes ({len(recipes)})"))
     for idx, r in enumerate(recipes, 1):
         rule_id = r.get("rule_id", "TG-SEC")
         rec_id = r.get("recipe_id", f"recipe-{idx}")
@@ -93,9 +99,10 @@ def list_recipes(target_root: Path, detail_id: Optional[str] = None, json_output
         adds = metrics.get("additions", 0)
         dels = metrics.get("deletions", 0)
 
-        print(format_box_line(f"{GREEN}[{rule_id}]{RESET} {WHITE}{rec_id}{RESET} (Verified {verified}x · +{adds}/-{dels} Ponytail)"))
-        print(format_box_line(f"  └─ {DIM}{desc}{RESET}"))
-    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+        print(box_line(f"{GREEN}[{rule_id}]{RESET} {WHITE}{rec_id}{RESET} (Verified {verified}x · +{adds}/-{dels} Ponytail)"))
+        print(box_line(f"  └─ {DIM}{desc}{RESET}"))
+    print(border_bottom())
+    print()
 
     if detail_id:
         target_rec = next((r for r in recipes if r.get("recipe_id") == detail_id), None)

package/.torusguard/scripts/term_ui.py

@@ -0,0 +1,162 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Unified Terminal UI Engine (v1.3.3)
+Provides mathematically exact 75-column card formatting, ANSI-stripping,
+Unicode/emoji visual width calculation, and visual truncation with ellipsis.
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import os
+import re
+import unicodedata
+from typing import Optional
+
+# Ensure UTF-8 stdout/stderr on Windows consoles
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+if sys.stderr and hasattr(sys.stderr, "reconfigure"):
+    try:
+        getattr(sys.stderr, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── ANSI Colors & Styles ─────────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+MAGENTA = "\033[35m"
+BG_GREEN = "\033[42m"
+BG_CYAN = "\033[46m"
+
+ANSI_REGEX = re.compile(r'\x1b\[[0-9;]*m|\033\[[0-9;]*m')
+
+def strip_ansi(text: str) -> str:
+    """Remove all ANSI color and style escape sequences."""
+    return ANSI_REGEX.sub('', text)
+
+def get_visual_width(text: str) -> int:
+    """
+    Calculate the printable display width of a string in terminal columns.
+    Accounts for ANSI escapes, Unicode variation selectors, emojis, and fullwidth chars.
+    """
+    clean = strip_ansi(text)
+    width = 0
+    for ch in clean:
+        cp = ord(ch)
+        # Variation selectors (VS1-16, VS17-256) occupy 0 terminal columns
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF):
+            continue
+        # Zero-width spaces, joiners, soft hyphens
+        if cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            continue
+        ea = unicodedata.east_asian_width(ch)
+        if ea in ('W', 'F'):
+            width += 2
+        elif cp >= 0x1F300: # Emojis and miscellaneous pictographs
+            width += 2
+        elif cp in (0x26A0, 0x2714, 0x2716, 0x2139): # ⚠, ✔, ✖, ℹ
+            width += 1
+        else:
+            width += 1
+    return width
+
+def truncate_visual(text: str, max_w: int = 67) -> str:
+    """Truncate text visually to max_w columns without breaking ANSI escape codes."""
+    if get_visual_width(text) <= max_w:
+        return text
+    out = []
+    curr_w = 0
+    in_ansi = False
+    ansi_buf = ''
+    for ch in text:
+        if ch in ('\033', '\x1b'):
+            in_ansi = True
+            ansi_buf = ch
+            continue
+        if in_ansi:
+            ansi_buf += ch
+            if ch == 'm':
+                in_ansi = False
+                out.append(ansi_buf)
+            continue
+        cp = ord(ch)
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            out.append(ch)
+            continue
+        ea = unicodedata.east_asian_width(ch)
+        cw = 2 if (ea in ('W', 'F') or cp >= 0x1F300) else 1
+        if curr_w + cw > max_w - 3:
+            out.append(RESET + '...')
+            curr_w += 3
+            break
+        out.append(ch)
+        curr_w += cw
+    out.append(RESET)
+    return ''.join(out)
+
+def format_box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    """
+    Pad content so the card line is strictly 75 visual columns total width.
+    Layout: '  ' (2) + border (1) + '  ' (2) + content/pad (width=67) + '  ' (2) + border (1) = 75 cols.
+    """
+    trunc = truncate_visual(content, width)
+    vis = get_visual_width(trunc)
+    pad = " " * max(0, width - vis)
+    return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
+
+def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column top border (single ┌ or double ╔) with optional title."""
+    left = "╔" if double else "┌"
+    right = "╗" if double else "┐"
+    h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column bottom border (single └ or double ╚)."""
+    left = "╚" if double else "└"
+    right = "╝" if double else "┘"
+    h = "═" if double else "─"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_divider(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column divider (single ├ or double ╠) with optional title."""
+    left = "╠" if double else "├"
+    right = "╣" if double else "┤"
+    h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
+    """Generate standardized 75-column curved header box."""
+    top = f"  {border_color}╭{'─' * 71}╮{RESET}"
+    bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
+    empty = f"  {border_color}│{' ' * 71}│{RESET}"
+
+    # Calculate padding between title and version
+    title_vis = get_visual_width(title)
+    ver_vis = get_visual_width(version)
+    space_count = max(1, 67 - title_vis - ver_vis)
+    title_str = f"{BOLD}{WHITE}{title}{RESET}{' ' * space_count}{GRAY}{version}{RESET}"
+
+    lines = [top, empty, format_box_line(title_str, width=67, border_color=border_color)]
+    if subtitle:
+        lines.append(format_box_line(f"{DIM}{subtitle}{RESET}", width=67, border_color=border_color))
+    lines.extend([empty, bottom])
+    return "\n".join(lines)

package/.torusguard/skills/torusguard/SKILL.md

@@ -1,42 +1,72 @@
 ---
 name: torusguard
-description: "Universal autonomous security engine: 71 rules across 11 families, polyglot stack detection across 16+ languages, governed remediation (Ponytail Protocol <=35 add, <=25 del), SARIF v2.1.0 exports, single-file HTML dashboards, and persistent security memory context for modern web applications."
-version: 1.3.2
+description: Universal autonomous security engine: 71 canonical rules across 11 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
+version: 1.3.4
 ---
 
-# TorusGuard Master Security Router
+# TorusGuard Master Security Engine & Command Router
 
-**Principle:** If the browser or client receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
+**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
 
 ---
 
-## ⚡ Workspace Bootstrap Check
-1. **If `.torusguard/` exists on disk:** Full autonomous governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
-2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor, Claude Code, Windsurf). Apply universal security invariants:
-   - Server-side auth & tenant scoping (`.filter(tenant=...)`, `.Where("tenant_id = ?")`, `where: { tenantId: ... }`).
-   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys, Stripe secret keys).
-   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions, zero full-file rewrites).
-   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` workspace tracking, persistent memory, and individual slash commands.
+## Command Catalog: Terminal CLI & AI Chat Parity
+
+TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
+
+| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
+| :--- | :--- | :--- | :--- | :--- |
+| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
+| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
+| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
+| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
+| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
+| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
+| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
+| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
+| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
+| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
+| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
+| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
+| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
+| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
+| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
+
+---
+
+## Non-Negotiable Invariants
+
+1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
+2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
+3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
+4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
+5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
+6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
 
 ---
 
-## Specialist Skill Routing (Lazy Loading)
-Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
-
-| Command | Specialist Skill | Agent | Purpose |
-| :--- | :--- | :--- | :--- |
-| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` | Workspace discovery, stack detection & scaffolding |
-| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` | Legal scope definition & safety boundaries |
-| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` | Static AST security audit & root-cause clustering |
-| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` | Evidence sufficiency & line match audit |
-| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` | Authorized non-destructive HTTP probing |
-| `/torusguard exploit-check`| `skills/torusguard-exploit-check/SKILL.md`| `validator` | Bounded single-step exploitability confirmation |
-| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator`| Governed remediation under Ponytail Protocol |
-| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator`| Governed patch application with rollback snapshots |
-| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` | Differential AST re-scan & closure verification |
-| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` | Executive posture reporting, SARIF & visual HTML export |
-| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` | Diagnostic overview of posture, stack & rules |
-| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` | Persistent memory inspection, decay & context cards |
-| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* | End-to-end 7-stage closed-loop execution |
-
-*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*
+## Workspace Layout Structure
+```
+.torusguard/
+├── config/
+│   ├── torusguard.json          # Detected stack, settings, and rule counts
+│   └── scope.json               # Authorized runtime validation targets & TTL
+├── memory/
+│   ├── context.json             # Aggregated security memory context
+│   ├── patterns.json            # Distilled Golden Fix Recipes
+│   └── events.json              # Historical audit, apply, and recheck events
+├── rules/
+│   └── active/                  # Active TG-* rule definitions
+├── runs/
+│   └── run-YYYYMMDD-HHMMSS-audit/
+│       ├── findings.json        # Machine-readable AST findings
+│       ├── findings.md          # Actionable markdown finding cards
+│       ├── remediation.md       # Formulated candidate patch catalog
+│       ├── diff_summary.md      # Summary of applied diffs
+│       ├── recheck.md           # Differential recheck status transitions
+│       ├── report.html          # Single-file visual dark-mode HTML report
+│       ├── results.sarif        # OASIS SARIF v2.1.0 log
+│       └── bundles/             # Formulated Ponytail remediation bundles
+└── snapshots/
+    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
+```

package/.torusguard/skills/torusguard-apply/SKILL.md

@@ -1,46 +1,80 @@
----
-name: torusguard-apply
-description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation.
-version: 0.9.2
-workflow: .torusguard/workflows/apply.md
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/diff_guard.py
----
-
-# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
-
-## Objective
-Safely apply approved remediation bundles to disk source files, capturing a byte-for-byte pre-apply backup snapshot and asserting syntax validity post-patch.
-
----
-
-## Execution Steps
-
-1. **Load Bundle:** Read `patch.diff` and metadata from `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
-2. **Pre-Apply Snapshot:** Save exact backup to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
-3. **Obtain Human Gate:** Confirm user approval for proposed diff.
-4. **Apply Patch:** Execute surgical modification using `replace_file_content` or `patch`.
-5. **Assert Integrity:** Verify modified file compiles cleanly without syntax errors.
-6. **Record Ledger:** Log timestamp, file path, and post-patch SHA-256 in `apply-log.json`.
-
----
-
-## Governance & Safety Rules
-- Hard limit: additions $\le 35$, deletions $\le 25$ lines.
-- Always create a rollback snapshot before modifying disk code.
-- If compile or syntax error occurs, instantly restore from `.bak`.
-- Require explicit operator confirmation before writing changes.
-
----
-
-## Output Format
-```markdown
-🚀 [TorusGuard] Patch Applied Successfully
-- Finding Target: <Finding ID> | File: <Path>
-- Churn: +<Additions> / -<Deletions>
-- Rollback Backup: `.torusguard/runs/<run_id>/pre_apply/<file>.bak`
-- Compile Check: PASSED
-Next: Run `/torusguard recheck` to verify vulnerability is closed.
-```
+---
+name: torusguard-apply
+description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation via CLI or AI Agent.
+version: 1.3.4
+workflow: .torusguard/workflows/apply.md
+tools: Read, Grep, Glob, Write, replace_file_content, run_command
+scripts-binding:
+  - .torusguard/scripts/apply_runner.py
+  - .torusguard/scripts/term_ui.py
+  - .torusguard/scripts/memory_engine.py
+---
+
+# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
+
+## Objective
+Safely apply approved remediation bundles to disk source files, creating an automated byte-for-byte pre-apply backup snapshot (`.bak`) in `.torusguard/snapshots/<run_id>/`, asserting syntax validity, and distilling passing patterns into Golden Fix Recipes.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution (Interactive or Non-Interactive)
+Run the governed patch applier from your terminal:
+```bash
+# Interactive Human Gate review (prompts for each patch: [y]es / [n]o / [a]ll / [q]uit)
+npx torusguard apply
+
+# Non-interactive automated application
+npx torusguard apply --yes
+
+# Apply patches from a specific run ID
+npx torusguard apply --run run-20260910-121618-audit --yes
+
+# Emergency rollback from pre-apply snapshot
+npx torusguard rollback
+# or
+npx torusguard apply --rollback
+```
+**Under the Hood:** Executes `python .torusguard/scripts/apply_runner.py`.
+1. Reads candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
+2. Creates `.bak` snapshot in `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
+3. Performs line-aware replacement without corrupting concurrent modifications.
+4. Distills the applied fix into a **Golden Fix Recipe** registered in `.torusguard/memory/patterns.json`.
+5. Emits `diff_summary.md` and `apply_plan.md` in the run directory.
+6. Displays pixel-perfect 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Application
+When applying patches directly within an AI chat session:
+1. **Human Gate Confirmation:** Present the unified diff to the operator and request explicit approval before editing code.
+2. **Pre-Apply Snapshot:** Ensure target file backup is created at `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
+3. **Execute Surgical Edit:** Use `replace_file_content` to apply only the approved lines. Strictly adhere to the formulated Ponytail diff.
+4. **Syntax & Integrity Check:** Verify that the patched file is syntactically valid (e.g. `node --check <file>` or `python -m py_compile <file>`). If syntax fails, immediately restore from `.bak`.
+5. **Memory Registration:** Update persistent memory events in `.torusguard/memory/events.json` with event `fix_applied`.
+6. **Recommend Recheck:** Advise running `/torusguard recheck` or `npx torusguard recheck` to verify closure.
+
+---
+
+## Rollback Guarantee
+If an applied patch introduces unexpected runtime behavior or breaks tests:
+```bash
+# Instant one-command rollback of the latest applied run:
+npx torusguard rollback
+
+# Or rollback a specific run:
+npx torusguard rollback --run run-20260910-121618-audit
+```
+All affected files are restored byte-for-byte from `.torusguard/snapshots/<run_id>/`.
+
+---
+
+## Output Card Format
+```markdown
+### 🚀 TorusGuard Patch Applied Successfully
+- **Target File:** `server/index.js:9`
+- **Rule ID:** `TG-SEC-001` (Hardcoded JWT secret)
+- **Ponytail Churn:** +1 / -1
+- **Rollback Snapshot:** `.torusguard/snapshots/<run_id>/server/index.js.bak`
+- **Golden Recipe:** Distilled into persistent memory
+- **Next Step:** Run `npx torusguard recheck` or `/torusguard recheck` to verify closure
+```