torusguard 1.3.3 → 1.3.5

package/skills/torusguard/payload/skills/torusguard-full/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-full
 description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
-version: 0.9.2
+version: 1.3.5
 workflow: .torusguard/workflows/audit.md
-tools: Read, Grep, Glob, Bash, Edit, Write
+tools: Read, Grep, Glob, Bash, Edit, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/stack_detect.py
   - .torusguard/scripts/safety_gate.py
   - .torusguard/scripts/finding_scorer.py
@@ -53,6 +54,10 @@ Evaluates Evidence (35 pts), Reproduction (25 pts), Corroboration (15 pts), Envi
 
 ---
 
+## Living Report Ground Truth
+- Always inspect `security_report.md` at workspace root before acting.
+- Update finding statuses after completion to eliminate hallucination.
+
 ## Safety & Governance
 - Human Gate mandatory before code modifications in Phase 5.
 - Enforce Ponytail line bounds ($\le 35$ additions, $\le 25$ deletions).

package/skills/torusguard/payload/skills/torusguard-harden/SKILL.md

@@ -1,63 +1,98 @@
 ---
 name: torusguard-harden
-description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions).
-version: 1.0.0
+description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions) via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/harden.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
-  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/harden_runner.py
   - .torusguard/scripts/diff_guard.py
+  - .torusguard/scripts/term_ui.py
 ---
 
 # TorusGuard Harden — Governed Remediation & Bundle Packaging
 
 ## Objective
-Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs into auditable 4-artifact remediation bundles ready for review.
+Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs into auditable remediation bundles ready for review.
 
 ---
 
-## The Ponytail Protocol
-- **Limits:** Additions $\le 35$, Deletions $\le 25$ lines per bundle.
-- **Invariants:** Zero full-file rewrites; preserve public APIs and tests.
-- **Overflow:** Partition into sequential sub-bundles.
+## Two Execution Modes
 
----
+### Mode A: Automated CLI Execution (Recommended First Step)
+Run the autonomous remediation engine via the terminal:
+```bash
+# Harden latest audit run
+npx torusguard harden
 
-## Bundle Directory Structure
-```
-.torusguard/runs/<run_id>/remediation/<finding_id>/
-├── patch.diff       # Standard unified diff with line numbers
-├── plan.md          # Rationale and root-cause breakdown
-├── verification.md  # Test instructions proving fix works
-└── rollback.md      # Command or steps to revert patch
+# Harden specific project directory
+npx torusguard harden ./my-project
+
+# Harden specific run ID
+npx torusguard harden --run run-20260910-121618-audit
+
+# Machine-readable JSON output
+npx torusguard harden --json
 ```
+**Under the Hood:** Executes `python .torusguard/scripts/harden_runner.py`.
+- Discovers findings in `.torusguard/runs/<run_id>/findings.json`.
+- Matches findings against canonical AST patch templates (`TG-SEC-*`, `TG-INPUT-*`, `TG-DB-*`, `TG-PLATFORM-*`, `TG-AUTH-*`, `TG-DIFF-*`).
+- Validates that every candidate patch strictly satisfies Ponytail bounds ($\le 35$ additions, $\le 25$ deletions).
+- Packages candidate bundles into `.torusguard/runs/<run_id>/bundles/<bundle_id>/` containing `patch.diff`, `minimal_patch_plan.md`, and `metadata.json`.
+- Emits run-level summary `remediation.md`.
+- Renders pixel-perfect 75-column terminal cards.
 
----
+### Mode B: In-Session AI Chat Agent Remediation
+When findings require complex architectural changes, or when the automated CLI cannot formulate a template match:
+1. **Locate Target Finding:** Inspect `.torusguard/runs/<run_id>/findings.md` or `findings.json`.
+2. **Inspect AST Context:** Read surrounding lines ($\pm 15$) of the vulnerable sink using `view_file`.
+3. **Formulate Minimal Fix:** Craft a surgical code modification:
+   - Parameterize SQL queries (replace concatenation with `?` or `$1` or `%s`).
+   - Add tenant isolation (`where: { tenantId }`, `organization_id=...`).
+   - Replace unsafe HTML injection (`dangerouslySetInnerHTML`, `.innerHTML = ...`) with safe text rendering (`textContent`, React elements).
+   - Sanitize path traversal using `path.basename()` or `os.path.basename()`.
+   - Constrain wildcard CORS headers to verified origin environment variables.
+   - Restore TLS verification flags (`verify=True`, `rejectUnauthorized: true`).
+4. **Validate Ponytail Bounds:** Count additions ($\le 35$) and deletions ($\le 25$). Never perform full-file rewrites.
+5. **Package Bundle Artifacts:** Write bundle under `.torusguard/runs/<run_id>/bundles/<bundle_id>/`:
+   - `patch.diff`: Standard unified diff.
+   - `minimal_patch_plan.md`: Context, rationale, and diff preview.
+   - `metadata.json`: Bundle metadata.
+6. **Report to Operator:** Present proposed diff card and recommend running `/torusguard apply` or `npx torusguard apply`.
 
-## Execution Steps
+---
 
-1. **Select Finding:** Choose prioritized verified flaw from active run's `findings.md`.
-2. **Read AST Context:** View target file surrounding lines (±15) using `view_file`.
-3. **Formulate Minimal Fix:** Consult `.torusguard/memory/context.json` for verified idioms; parameterize SQL, add tenant filters.
-4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$ via `diff_guard.py`.
-5. **Package Bundle:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`).
-6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
+## Remediation Bundle Structure
+```
+.torusguard/runs/<run_id>/
+├── remediation.md                         # Run-level catalog of formulated candidate patches
+└── bundles/
+    └── bnd-<rule_id>-<line>-<hash>/
+        ├── patch.diff                    # Unified diff preview
+        ├── minimal_patch_plan.md         # Detailed explanation, rationale, and churn stats
+        └── metadata.json                 # Machine-readable bundle metadata
+```
 
 ---
 
-## Safety Constraints
-- Dry-run only; do NOT apply modifications to source code during harden.
-- Keep surrounding formatting and comments intact.
-- Never touch files outside the targeted vulnerable sink.
+## Non-Negotiable Invariants
+- **Ponytail Limit:** Strict upper bound of $\le 35$ additions and $\le 25$ deletions per bundle.
+- **Dry-Run Rule:** Never modify target source code during `harden`. All edits must be reviewed before application in Phase 5 (`apply`).
+- **No Unrelated Churn:** Do not reformat unrelated code, reorder imports, or change styles.
+- **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `[AllowAnonymous]`, or `csrf().disable()`.
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-🛠️ [TorusGuard] Remediation Bundle Packaged
-- Finding Target: <Finding ID> | File: <Path>
-- Line Churn: +<Additions> / -<Deletions> (Ponytail: PASS)
-- Sensitive Path: <Yes/No>
-- Bundle Path: `.torusguard/runs/<run_id>/remediation/<finding_id>/`
-Next: Run `/torusguard apply` to review diff and apply with rollback backup.
+### 🛠️ TorusGuard Remediation Bundle Formulated
+- **Target Finding:** `[TG-SEC-001]` at `server/index.js:9`
+- **Ponytail Churn:** +1 / -1 (Compliant <= 35 add, <= 25 del)
+- **Strategy:** Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+- **Bundle Directory:** `.torusguard/runs/<run_id>/bundles/bnd-tg-sec-001-9-a8310c/`
+- **Next Step:** Run `npx torusguard apply` or `/torusguard apply` to review and apply
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard/payload/skills/torusguard-init/SKILL.md

@@ -1,52 +1,68 @@
 ---
 name: torusguard-init
-description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline.
-version: 0.9.2
+description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/init.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/stack_detect.py
+  - .torusguard/scripts/term_ui.py
 ---
 
 # TorusGuard Init — Project Stack Discovery & Rule Activation
 
 ## Objective
-Auto-detect repository technology stack via indicators or `stack_detect.py`, activate framework-tailored `TG-*` security rules into `.torusguard/rules/active/`, and provision `torusguard.json` and `SECURITY.md`.
+Auto-detect repository technology stack across 16+ languages and frameworks, provision the `.torusguard/` workspace structure, activate tailored `TG-*` security rules into `.torusguard/rules/active/`, and generate `SECURITY.md` baseline policies.
 
 ---
 
-## Pre-Flight Check
-1. Verify `.torusguard/` layout (`config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`).
-2. If missing, unpack via `python skills/torusguard/bootstrap.py --target .`.
-3. Check existing `.torusguard/config/torusguard.json` before overwriting.
+## Two Execution Modes
 
----
+### Mode A: Automated CLI Execution
+Run the workspace initializer from your terminal:
+```bash
+# Initialize current repository
+npx torusguard init
 
-## Execution Steps
+# Initialize specific directory
+npx torusguard init ./my-app
 
-1. **Stack Detection:** Run `python .torusguard/scripts/stack_detect.py .` to detect:
-   - Python: Django (`manage.py`), FastAPI (`fastapi`), Flask (`flask`), SQLAlchemy.
-   - Node: Next.js (`"next"`), Express (`"express"`), React/Vite (`"vite"`).
-   - BaaS: Supabase (`@supabase/supabase-js`), Firebase (`firebase-admin`).
-2. **Emit Stack Record:** Log detected language, framework, ORM, and client SDKs.
-3. **Activate Tailored Rules:** Copy matching `TG-*` rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
-4. **Provision Policy:** Create `SECURITY.md` if absent, configuring responsible disclosure contacts.
-5. **Write Configuration:** Persist detected stack and active rules count to `.torusguard/config/torusguard.json`.
+# Force re-initialization (overwriting existing configuration)
+npx torusguard init --force
 
----
+# Explicitly specify stack (e.g. react, nextjs, django, fastapi, express)
+npx torusguard init --stack express
+```
+**Under the Hood:**
+- Runs `stack_detect.py` to inspect package files (`package.json`, `pyproject.toml`, `requirements.txt`, `go.mod`, `Cargo.toml`, `Gemfile`, `composer.json`, `*.csproj`).
+- Detects backend frameworks, frontend libraries, ORMs (Prisma, Mongoose, SQLAlchemy, Django ORM), and authentication systems.
+- Scaffolds `.torusguard/` directory tree: `config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`, `memory/`, `snapshots/`.
+- Copies tailored rule definitions into `.torusguard/rules/active/`.
+- Provisions `SECURITY.md` with standard responsible disclosure contacts.
+- Writes `.torusguard/config/torusguard.json`.
+- Displays 75-column terminal cards.
 
-## Safety Constraints
-- Never overwrite custom rules in `.torusguard/rules/active/` without prompt.
-- Retain existing `SECURITY.md` if already established by repository owners.
-- Strictly read-only detection against source files.
+### Mode B: In-Session AI Chat Agent Initialization
+When initializing a workspace directly in AI chat:
+1. **Detect Stack:** Inspect root files (`package.json`, `requirements.txt`, etc.) to determine languages and frameworks.
+2. **Bootstrap Structure:** Ensure `.torusguard/` structure exists. If missing, run `python skills/torusguard/bootstrap.py --target .`.
+3. **Activate Rules:** Populate `.torusguard/rules/active/` with applicable rule files from `rules/`.
+4. **Provision Policy:** Create `SECURITY.md` if not already present.
+5. **Write Configuration:** Persist settings into `.torusguard/config/torusguard.json`.
+6. **Prompt Audit:** Advise the user to run `npx torusguard audit` or `/torusguard audit`.
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-🛡️ [TorusGuard] Workspace Initialized
-- Primary Stack: <Detected Stack> | Components: <Backend/Frontend/DB>
-- Active Rules: <Count> rules enabled in `.torusguard/rules/active/`
-- Configuration: `.torusguard/config/torusguard.json` written
-Next: Run `/torusguard audit` to execute static security scan.
+### 🛡️ TorusGuard Workspace Initialized Successfully
+- **Primary Stack:** Node.js / React / Express
+- **Active Rules:** 74 canonical security rules enabled in `.torusguard/rules/active/`
+- **Configuration:** Written to `.torusguard/config/torusguard.json`
+- **Security Policy:** Baseline `SECURITY.md` generated
+- **Next Step:** Run `npx torusguard audit` or `/torusguard audit` to scan for flaws
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard/payload/skills/torusguard-recheck/SKILL.md

@@ -1,53 +1,81 @@
 ---
 name: torusguard-recheck
-description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
-version: 1.0.0
+description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/recheck.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/finding_scorer.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/recheck_runner.py
+  - .torusguard/scripts/audit_runner.py
+  - .torusguard/scripts/memory_engine.py
+  - .torusguard/scripts/term_ui.py
 ---
 
-# TorusGuard Recheck — Targeted Differential Audit & Regression Verification
+# TorusGuard Recheck — Targeted Differential Audit & Fix Closure
 
 ## Objective
-Re-scan only files modified by remediation patches, confirming that targeted vulnerability sinks have been neutralized and verifying that no new security regressions were introduced.
+Execute differential security re-scans strictly scoped to modified files and adjacent boundaries, verifying that targeted vulnerability patterns have been eliminated and asserting zero security regressions.
 
 ---
 
-## Execution Steps
+## Two Execution Modes
 
-1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
-2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against modified files.
-3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
-4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
-5. **Update State & Memory:** Record status in `findings.json` and sync verified results to memory engine.
-6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
+### Mode A: Automated CLI Execution
+Run the differential recheck engine from the terminal:
+```bash
+# Recheck the latest applied run
+npx torusguard recheck
 
----
+# Recheck a specific project directory
+npx torusguard recheck ./my-project
+
+# Recheck a specific run ID
+npx torusguard recheck --run run-20260910-121618-audit
 
-## State Transition Rules
-- **`Fixed`:** Targeted vulnerable AST pattern is absent and no new issues appear on modified lines.
-- **`Partially Fixed`:** Vulnerability surface was reduced but sanitization remains incomplete.
-- **`Not Fixed`:** Vulnerable AST sink remains present in patched file.
-- **`Regression`:** Patch introduced a new security rule violation on modified lines.
+# Machine-readable JSON output
+npx torusguard recheck --json
+```
+**Under the Hood:** Executes `python .torusguard/scripts/recheck_runner.py`.
+- Evaluates applied candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
+- Executes single-file targeted differential AST scans via `audit_runner.scan_file()`.
+- Calculates formal status transitions:
+  - `✔ [Confirmed Fixed]`: Vulnerable pattern absent, zero regressions.
+  - `✖ [Regressed]`: New security finding introduced by patch.
+  - `⚠ [Unresolved]`: Vulnerable sink still present.
+- Emits run-level transition artifact: `.torusguard/runs/<run_id>/recheck.md`.
+- Synchronizes verification telemetry to `.torusguard/memory/events.json`.
+- Displays 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Differential Scan
+When evaluating patches directly in AI chat:
+1. **Identify Modified Files:** Read `diff_summary.md` or git status for files modified in the active run.
+2. **Re-Scan Sinks:** View the target file and verify that the specific rule violation (e.g. `TG-INPUT-003`, `TG-PLATFORM-001`) is no longer triggered.
+3. **Assert Zero Regressions:** Verify that no new vulnerabilities (like raw concatenation or unvalidated input) were introduced by the fix.
+4. **Update Status:** Log outcome in `.torusguard/runs/<run_id>/recheck.md`.
+5. **Memory Telemetry:** Record verification event with `memory_engine.record_event("fix_verified", ...)`.
 
 ---
 
-## Safety Constraints
-- Restrict AST scan strictly to modified files and direct callers.
-- If regression is detected, halt and recommend immediate rollback via `.bak` snapshot.
-- Read-only differential analysis.
+## Recheck Status Transitions
+| Outcome | Visual Indicator | Meaning | Required Action |
+| :--- | :--- | :--- | :--- |
+| **Confirmed Fixed** | `✔ [Confirmed Fixed]` | Sink eliminated, zero regressions | Proceed to Posture Report |
+| **Unresolved** | `⚠ [Unresolved]` | Flaw still present in file | Re-harden with alternative pattern |
+| **Regressed** | `✖ [Regressed]` | New security flaw introduced | Instant `npx torusguard rollback` |
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-✅ [TorusGuard] Differential Recheck Completed
-- Modified Files Scanned: <Count>
-- Target Finding: <Finding ID> ──► FIXED
-- Regressions Detected: 0
-- Report: `.torusguard/runs/<run_id>/recheck-report.md`
-Next: Run `/torusguard report` to export final SARIF and release summary.
+### ✅ TorusGuard Differential Recheck Completed
+- **Run ID:** `run-20260910-121618-audit`
+- **Confirmed Fixed:** 2 vulnerabilities verified closed
+- **Regressions:** 0 detected
+- **Unresolved:** 0
+- **Artifact:** `.torusguard/runs/<run_id>/recheck.md`
+- **Next Step:** Run `npx torusguard report --html` for visual dashboard
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard/payload/skills/torusguard-report/SKILL.md

@@ -1,54 +1,76 @@
 ---
 name: torusguard-report
-description: Generate unified security posture reports and export OASIS SARIF v2.1.0 logs for CI/CD integration.
-version: 0.9.2
+description: Generate executive posture reports, export OASIS SARIF v2.1.0 logs, and render dark-mode HTML dashboards via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/report.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/html_reporter.py
   - .torusguard/scripts/sarif_exporter.py
   - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
 ---
 
-# TorusGuard Report — Unified Security Posture Report & SARIF Export
+# TorusGuard Report — Posture Reporting & SARIF / HTML Export
 
 ## Objective
-Aggregate findings, verification traces, and recheck results into a signed executive security summary and export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines.
+Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports.
 
 ---
 
-## Execution Steps
+## Two Execution Modes
 
-1. **Aggregate Run Data:** Read findings, verified evidence, and recheck records from active run.
-2. **Export OASIS SARIF v2.1.0:**
-   ```bash
-   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
-   ```
-3. **Compile Executive Markdown Report:** Generate `report.md` with posture score, open/closed finding tables, and risk breakdown.
-4. **Update Run Manifest:** Finalize `manifest.json` status counts.
-5. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
+### Mode A: Automated CLI Execution
+Run the report engine from your terminal:
+```bash
+# Generate visual dark-mode HTML dashboard
+npx torusguard report --html
 
----
+# Export OASIS SARIF v2.1.0 for GitHub Code Scanning / CI
+npx torusguard report --sarif
+
+# Generate both HTML and SARIF for latest run
+npx torusguard report --html --sarif
+
+# Generate report for a specific project directory
+npx torusguard report ./examples/vulnerable-react-express --html
 
-## SARIF v2.1.0 Output Specification
-- **Version:** `$schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`, `version: 2.1.0`.
-- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 0.9.2`, full rules catalog in `driver.rules`.
-- **Category Hygiene:** Set `automationDetails.id: "torusguard/static"` to avoid collisions in multi-analysis CI.
-- **Fingerprinting:** Populate `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
+# Target a specific run ID
+npx torusguard report --run run-20260910-121618-audit --html
+```
+**Under the Hood:**
+- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, and cluster summaries at `.torusguard/runs/<run_id>/report.html`.
+- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/<run_id>/results.sarif`.
+- Finalizes `manifest.json` metrics and updates historical posture scoring.
+- Displays 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Reporting
+When generating security posture summaries in AI chat:
+1. **Aggregate Run Data:** Inspect `findings.json`, `remediation.md`, and `recheck.md` from the active run.
+2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2).
+3. **Format Executive Card:** Present finding counts, closed vulnerabilities, remaining risks, and compliance posture.
+4. **Export Artifacts:** Verify that `report.html` and `results.sarif` are serialized to disk.
 
 ---
 
-## Safety Constraints
-- Redact all tokens, passwords, and API keys before saving report.
-- Strictly read-only reporting; no source code modifications.
-- Ensure SARIF passes JSON schema validation.
+## SARIF v2.1.0 Specification
+- **Schema:** `https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.5`, full rules catalog in `driver.rules`.
+- **Automation Details:** `automationDetails.id: "torusguard/static"` to avoid collisions in multi-scanner CI/CD pipelines.
+- **Fingerprints:** `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-📊 [TorusGuard] Security Posture Report Emitted
-- Run ID: <Run ID> | Posture Score: <Score>/100
-- Findings: <Total> (<Fixed> Fixed · <Open> Open)
-- SARIF Export: `.torusguard/runs/<run_id>/results.sarif`
-- Executive Report: `.torusguard/runs/<run_id>/report.md`
+### 📊 TorusGuard Security Posture Report Emitted
+- **Run ID:** `run-20260910-121618-audit`
+- **Posture Score:** 85 / 100 (HIGH SECURITY)
+- **Findings Summary:** 3 Evaluated · 2 Confirmed Fixed · 1 Unresolved
+- **HTML Dashboard:** `.torusguard/runs/<run_id>/report.html` (View in browser)
+- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif` (Ready for CI)
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard/payload/skills/torusguard-status/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: torusguard-status
-description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
-version: 0.9.2
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/status.md
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, run_command, Write
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
 ---
 
 # TorusGuard Status — Workspace Security Posture & Diagnostic Overview
@@ -15,28 +17,46 @@ Provide an instant diagnostic summary of the repository's security state, active
 
 ---
 
-## Execution Steps
+## Two Execution Modes
 
-1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
-2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-3. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
-4. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
-5. **Render Diagnostic Overview:** Output formatted status card.
+### Mode A: Automated CLI Execution
+Run the diagnostic overview from your terminal:
+```bash
+# Display 75-column status cards
+npx torusguard status
 
----
+# Check status of specific project directory
+npx torusguard status ./examples/vulnerable-react-express
 
-## Safety Constraints
-- Read-only execution; zero file modifications.
-- Handle uninitialized workspaces gracefully with advice to run `/torusguard init`.
+# Output machine-readable JSON
+npx torusguard status --json
+```
+**Under the Hood:**
+- Evaluates `.torusguard/config/torusguard.json` for initialized status and detected stack.
+- Enumerates active rules in `.torusguard/rules/active/` (or canonical 74 rules).
+- Scans `.torusguard/runs/` for run history, finding counts, and verified fixes.
+- Inspects `.torusguard/config/scope.json` for authorized runtime validation targets.
+- Displays mathematically aligned 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Status Check
+When checking workspace status in AI chat:
+1. **Verify Workspace Setup:** Check if `.torusguard/` exists on disk.
+2. **Inspect Active Config:** Read `.torusguard/config/torusguard.json` for detected stack, framework, and rules.
+3. **Inspect Latest Run:** Find the latest run directory under `.torusguard/runs/` and read `manifest.json`.
+4. **Inspect Memory Engine:** Check `.torusguard/memory/patterns.json` for captured Golden Fix Recipes.
+5. **Render Diagnostic Card:** Present an overview of posture, stack, and recommended next steps.
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-🛡️ [TorusGuard] Workspace Status Overview
-- Version: v0.9.2 | Stack: <Detected Framework>
-- Active Rules: <Count> rules active in `.torusguard/rules/active/`
-- Historical Runs: <Count> runs recorded
-- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
-- Posture: <SECURE / ACTION REQUIRED>
+### 🛡️ TorusGuard Workspace Status Overview
+- **Version:** v1.3.3 | **Stack:** Node.js / React / Express
+- **Active Rules:** 74 canonical security rules enabled
+- **Historical Runs:** 3 runs recorded
+- **Golden Recipes:** 4 distilled into persistent memory
+- **Overall Posture:** SECURE (All targeted vulnerabilities verified closed)
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard/payload/skills/torusguard-verify/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 0.9.2
+version: 1.3.5
 workflow: .torusguard/workflows/verify.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/finding_scorer.py
 ---
 
@@ -18,14 +19,15 @@ Audit the evidence sufficiency of candidate findings by reading current disk lin
 ## Execution Steps
 
 1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.
-2. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
-3. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
-4. **Calibrate Confidence Score:**
+2. **Handle CLI Failures:** If `python .torusguard/scripts/finding_scorer.py` or the verify workflow fails, YOU must manually read the code and calibrate the score based on the evidence parameters.
+3. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
+4. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
+5. **Calibrate Confidence Score:**
    ```bash
    python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
    ```
-5. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
-6. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
+6. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
+7. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
 
 ---
 
@@ -38,6 +40,10 @@ A finding is verified as sufficient when:
 
 ---
 
+## Living Report Ground Truth
+- Always inspect `security_report.md` at workspace root before acting.
+- Update finding statuses after completion to eliminate hallucination.
+
 ## Safety Constraints
 - Read-only analysis; no files are modified.
 - Never guess line numbers; always verify via active disk read.
@@ -47,7 +53,7 @@ A finding is verified as sufficient when:
 
 ## Output Format
 ```markdown
-🧪 [TorusGuard] Finding Verification Complete
+🧪 [TorusGuard] Finding Verification Complete (AI Assisted)
 - Findings Audited: <Count> | Confirmed Real: <Count>
 - False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
 - Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`