torusguard 1.3.3 → 1.3.5

package/skills/torusguard-exploit-check/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-exploit-check
 description: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.
-version: 0.9.2
+version: 1.3.5
 workflow: .torusguard/workflows/exploit-check.md
-tools: Read, Grep, Glob, Bash, Write
+tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/safety_gate.py
   - .torusguard/scripts/finding_scorer.py
 ---
@@ -48,6 +49,10 @@ Before dispatching any exploitability probe:
 
 ---
 
+## Living Report Ground Truth
+- Always inspect `security_report.md` at workspace root before acting.
+- Update finding statuses after completion to eliminate hallucination.
+
 ## Safety Constraints
 - Zero destructive payloads (`DROP`, `DELETE`, `UPDATE`).
 - No denial-of-service or continuous fuzzing loops.

package/skills/torusguard-full/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-full
 description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
-version: 0.9.2
+version: 1.3.5
 workflow: .torusguard/workflows/audit.md
-tools: Read, Grep, Glob, Bash, Edit, Write
+tools: Read, Grep, Glob, Bash, Edit, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/stack_detect.py
   - .torusguard/scripts/safety_gate.py
   - .torusguard/scripts/finding_scorer.py
@@ -53,6 +54,10 @@ Evaluates Evidence (35 pts), Reproduction (25 pts), Corroboration (15 pts), Envi
 
 ---
 
+## Living Report Ground Truth
+- Always inspect `security_report.md` at workspace root before acting.
+- Update finding statuses after completion to eliminate hallucination.
+
 ## Safety & Governance
 - Human Gate mandatory before code modifications in Phase 5.
 - Enforce Ponytail line bounds ($\le 35$ additions, $\le 25$ deletions).

package/skills/torusguard-harden/SKILL.md

@@ -1,67 +1,98 @@
 ---
 name: torusguard-harden
-description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions).
-version: 1.0.0
+description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions) via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/harden.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
-  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/harden_runner.py
   - .torusguard/scripts/diff_guard.py
+  - .torusguard/scripts/term_ui.py
 ---
 
 # TorusGuard Harden — Governed Remediation & Bundle Packaging
 
 ## Objective
-Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs into auditable 4-artifact remediation bundles ready for review.
+Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs into auditable remediation bundles ready for review.
 
 ---
 
-## The Ponytail Protocol
-- **Limits:** Additions $\le 35$, Deletions $\le 25$ lines per bundle.
-- **Invariants:** Zero full-file rewrites; preserve public APIs and tests.
-- **Overflow:** Partition into sequential sub-bundles.
+## Two Execution Modes
 
----
+### Mode A: Automated CLI Execution (Recommended First Step)
+Run the autonomous remediation engine via the terminal:
+```bash
+# Harden latest audit run
+npx torusguard harden
 
-## Bundle Directory Structure
-```
-.torusguard/runs/<run_id>/remediation/<finding_id>/
-├── patch.diff       # Standard unified diff with line numbers
-├── plan.md          # Rationale and root-cause breakdown
-├── verification.md  # Test instructions proving fix works
-└── rollback.md      # Command or steps to revert patch
-```
+# Harden specific project directory
+npx torusguard harden ./my-project
 
----
+# Harden specific run ID
+npx torusguard harden --run run-20260910-121618-audit
 
-## Execution Steps
+# Machine-readable JSON output
+npx torusguard harden --json
+```
+**Under the Hood:** Executes `python .torusguard/scripts/harden_runner.py`.
+- Discovers findings in `.torusguard/runs/<run_id>/findings.json`.
+- Matches findings against canonical AST patch templates (`TG-SEC-*`, `TG-INPUT-*`, `TG-DB-*`, `TG-PLATFORM-*`, `TG-AUTH-*`, `TG-DIFF-*`).
+- Validates that every candidate patch strictly satisfies Ponytail bounds ($\le 35$ additions, $\le 25$ deletions).
+- Packages candidate bundles into `.torusguard/runs/<run_id>/bundles/<bundle_id>/` containing `patch.diff`, `minimal_patch_plan.md`, and `metadata.json`.
+- Emits run-level summary `remediation.md`.
+- Renders pixel-perfect 75-column terminal cards.
 
-1. **Evaluate Findings:** First, review the active run's `findings.md`. If the user has already run the CLI `npx torusguard harden` and it formulated `0` patches (or skipped complex findings), it is **YOUR RESPONSIBILITY** as the AI Agent to manually remediate the remaining findings.
-2. **Read AST Context:** View target file surrounding lines (±15) using `view_file` to deeply understand the vulnerability.
-3. **Formulate Minimal Fix:** Actively rewrite the code to fix the vulnerability (e.g. parameterize SQL, add tenant filters, use safe DOM APIs). Do NOT wait for the CLI to do it. You must generate the fix. Consult `.torusguard/memory/context.json` for verified idioms.
-4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$ via `diff_guard.py`. If it's too complex, partition into sequential sub-bundles.
-5. **Package Bundle Manually:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`) into `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
-6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
+### Mode B: In-Session AI Chat Agent Remediation
+When findings require complex architectural changes, or when the automated CLI cannot formulate a template match:
+1. **Locate Target Finding:** Inspect `.torusguard/runs/<run_id>/findings.md` or `findings.json`.
+2. **Inspect AST Context:** Read surrounding lines ($\pm 15$) of the vulnerable sink using `view_file`.
+3. **Formulate Minimal Fix:** Craft a surgical code modification:
+   - Parameterize SQL queries (replace concatenation with `?` or `$1` or `%s`).
+   - Add tenant isolation (`where: { tenantId }`, `organization_id=...`).
+   - Replace unsafe HTML injection (`dangerouslySetInnerHTML`, `.innerHTML = ...`) with safe text rendering (`textContent`, React elements).
+   - Sanitize path traversal using `path.basename()` or `os.path.basename()`.
+   - Constrain wildcard CORS headers to verified origin environment variables.
+   - Restore TLS verification flags (`verify=True`, `rejectUnauthorized: true`).
+4. **Validate Ponytail Bounds:** Count additions ($\le 35$) and deletions ($\le 25$). Never perform full-file rewrites.
+5. **Package Bundle Artifacts:** Write bundle under `.torusguard/runs/<run_id>/bundles/<bundle_id>/`:
+   - `patch.diff`: Standard unified diff.
+   - `minimal_patch_plan.md`: Context, rationale, and diff preview.
+   - `metadata.json`: Bundle metadata.
+6. **Report to Operator:** Present proposed diff card and recommend running `/torusguard apply` or `npx torusguard apply`.
 
 ---
 
-## Safety Constraints
-- Dry-run only; do NOT apply modifications directly to source code during harden. Only write to the `patch.diff` artifact.
-- Keep surrounding formatting and comments intact.
-- Never touch files outside the targeted vulnerable sink.
+## Remediation Bundle Structure
+```
+.torusguard/runs/<run_id>/
+├── remediation.md                         # Run-level catalog of formulated candidate patches
+└── bundles/
+    └── bnd-<rule_id>-<line>-<hash>/
+        ├── patch.diff                    # Unified diff preview
+        ├── minimal_patch_plan.md         # Detailed explanation, rationale, and churn stats
+        └── metadata.json                 # Machine-readable bundle metadata
+```
 
 ---
 
-## Output Format
-```markdown
-🛠️ [TorusGuard] Remediation Bundle Packaged (AI Assisted)
-- Finding Target: <Finding ID> | File: <Path>
-- Line Churn: +<Additions> / -<Deletions> (Ponytail: PASS)
-- Sensitive Path: <Yes/No>
-- Bundle Path: `.torusguard/runs/<run_id>/remediation/<finding_id>/`
+## Non-Negotiable Invariants
+- **Ponytail Limit:** Strict upper bound of $\le 35$ additions and $\le 25$ deletions per bundle.
+- **Dry-Run Rule:** Never modify target source code during `harden`. All edits must be reviewed before application in Phase 5 (`apply`).
+- **No Unrelated Churn:** Do not reformat unrelated code, reorder imports, or change styles.
+- **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `[AllowAnonymous]`, or `csrf().disable()`.
 
-> [!NOTE]
-> This patch was formulated manually by the TorusGuard AI Agent because it required architectural changes beyond the CLI's automated templates.
+---
 
-Next: Run `/torusguard apply` to review diff and apply with rollback backup.
+## Output Card Format
+```markdown
+### 🛠️ TorusGuard Remediation Bundle Formulated
+- **Target Finding:** `[TG-SEC-001]` at `server/index.js:9`
+- **Ponytail Churn:** +1 / -1 (Compliant <= 35 add, <= 25 del)
+- **Strategy:** Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+- **Bundle Directory:** `.torusguard/runs/<run_id>/bundles/bnd-tg-sec-001-9-a8310c/`
+- **Next Step:** Run `npx torusguard apply` or `/torusguard apply` to review and apply
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-init/SKILL.md

@@ -1,53 +1,68 @@
 ---
 name: torusguard-init
-description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline.
-version: 0.9.2
+description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/init.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/stack_detect.py
+  - .torusguard/scripts/term_ui.py
 ---
 
 # TorusGuard Init — Project Stack Discovery & Rule Activation
 
 ## Objective
-Auto-detect repository technology stack via indicators or `stack_detect.py`, activate framework-tailored `TG-*` security rules into `.torusguard/rules/active/`, and provision `torusguard.json` and `SECURITY.md`.
+Auto-detect repository technology stack across 16+ languages and frameworks, provision the `.torusguard/` workspace structure, activate tailored `TG-*` security rules into `.torusguard/rules/active/`, and generate `SECURITY.md` baseline policies.
 
 ---
 
-## Pre-Flight Check
-1. Verify `.torusguard/` layout (`config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`).
-2. If missing, unpack via `python skills/torusguard/bootstrap.py --target .`.
-3. Check existing `.torusguard/config/torusguard.json` before overwriting.
+## Two Execution Modes
 
----
+### Mode A: Automated CLI Execution
+Run the workspace initializer from your terminal:
+```bash
+# Initialize current repository
+npx torusguard init
 
-## Execution Steps
+# Initialize specific directory
+npx torusguard init ./my-app
 
-1. **Stack Detection:** Run `python .torusguard/scripts/stack_detect.py .` to detect:
-   - Python: Django (`manage.py`), FastAPI (`fastapi`), Flask (`flask`), SQLAlchemy.
-   - Node: Next.js (`"next"`), Express (`"express"`), React/Vite (`"vite"`).
-   - BaaS: Supabase (`@supabase/supabase-js`), Firebase (`firebase-admin`).
-2. **Handle CLI Failures:** If `stack_detect.py` crashes or is unable to determine the stack, YOU must manually analyze the directory structure and determine the stack.
-3. **Emit Stack Record:** Log detected language, framework, ORM, and client SDKs.
-4. **Activate Tailored Rules:** Copy matching `TG-*` rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
-5. **Provision Policy:** Create `SECURITY.md` if absent, configuring responsible disclosure contacts.
-6. **Write Configuration:** Persist detected stack and active rules count to `.torusguard/config/torusguard.json`.
+# Force re-initialization (overwriting existing configuration)
+npx torusguard init --force
 
----
+# Explicitly specify stack (e.g. react, nextjs, django, fastapi, express)
+npx torusguard init --stack express
+```
+**Under the Hood:**
+- Runs `stack_detect.py` to inspect package files (`package.json`, `pyproject.toml`, `requirements.txt`, `go.mod`, `Cargo.toml`, `Gemfile`, `composer.json`, `*.csproj`).
+- Detects backend frameworks, frontend libraries, ORMs (Prisma, Mongoose, SQLAlchemy, Django ORM), and authentication systems.
+- Scaffolds `.torusguard/` directory tree: `config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`, `memory/`, `snapshots/`.
+- Copies tailored rule definitions into `.torusguard/rules/active/`.
+- Provisions `SECURITY.md` with standard responsible disclosure contacts.
+- Writes `.torusguard/config/torusguard.json`.
+- Displays 75-column terminal cards.
 
-## Safety Constraints
-- Never overwrite custom rules in `.torusguard/rules/active/` without prompt.
-- Retain existing `SECURITY.md` if already established by repository owners.
-- Strictly read-only detection against source files.
+### Mode B: In-Session AI Chat Agent Initialization
+When initializing a workspace directly in AI chat:
+1. **Detect Stack:** Inspect root files (`package.json`, `requirements.txt`, etc.) to determine languages and frameworks.
+2. **Bootstrap Structure:** Ensure `.torusguard/` structure exists. If missing, run `python skills/torusguard/bootstrap.py --target .`.
+3. **Activate Rules:** Populate `.torusguard/rules/active/` with applicable rule files from `rules/`.
+4. **Provision Policy:** Create `SECURITY.md` if not already present.
+5. **Write Configuration:** Persist settings into `.torusguard/config/torusguard.json`.
+6. **Prompt Audit:** Advise the user to run `npx torusguard audit` or `/torusguard audit`.
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-🛡️ [TorusGuard] Workspace Initialized (AI Assisted)
-- Primary Stack: <Detected Stack> | Components: <Backend/Frontend/DB>
-- Active Rules: <Count> rules enabled in `.torusguard/rules/active/`
-- Configuration: `.torusguard/config/torusguard.json` written
-Next: Run `/torusguard audit` to execute static security scan.
+### 🛡️ TorusGuard Workspace Initialized Successfully
+- **Primary Stack:** Node.js / React / Express
+- **Active Rules:** 74 canonical security rules enabled in `.torusguard/rules/active/`
+- **Configuration:** Written to `.torusguard/config/torusguard.json`
+- **Security Policy:** Baseline `SECURITY.md` generated
+- **Next Step:** Run `npx torusguard audit` or `/torusguard audit` to scan for flaws
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-recheck/SKILL.md

@@ -1,54 +1,81 @@
 ---
 name: torusguard-recheck
-description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
-version: 1.0.0
+description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/recheck.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/finding_scorer.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/recheck_runner.py
+  - .torusguard/scripts/audit_runner.py
+  - .torusguard/scripts/memory_engine.py
+  - .torusguard/scripts/term_ui.py
 ---
 
-# TorusGuard Recheck — Targeted Differential Audit & Regression Verification
+# TorusGuard Recheck — Targeted Differential Audit & Fix Closure
 
 ## Objective
-Re-scan only files modified by remediation patches, confirming that targeted vulnerability sinks have been neutralized and verifying that no new security regressions were introduced.
+Execute differential security re-scans strictly scoped to modified files and adjacent boundaries, verifying that targeted vulnerability patterns have been eliminated and asserting zero security regressions.
 
 ---
 
-## Execution Steps
+## Two Execution Modes
 
-1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
-2. **Handle CLI Failures:** If `npx torusguard recheck` crashes or reports a false negative, YOU must act as the manual arbiter.
-3. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against modified files. If doing this manually, use `view_file` to read the patched file and cross-reference with the active rules.
-4. **Evaluate Finding Status:** Transition finding state according to transition rules below.
-5. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
-6. **Update State & Memory:** Record status in `findings.json` and sync verified results to memory engine.
-7. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
+### Mode A: Automated CLI Execution
+Run the differential recheck engine from the terminal:
+```bash
+# Recheck the latest applied run
+npx torusguard recheck
 
----
+# Recheck a specific project directory
+npx torusguard recheck ./my-project
+
+# Recheck a specific run ID
+npx torusguard recheck --run run-20260910-121618-audit
 
-## State Transition Rules
-- **`Fixed`:** Targeted vulnerable AST pattern is absent and no new issues appear on modified lines.
-- **`Partially Fixed`:** Vulnerability surface was reduced but sanitization remains incomplete.
-- **`Not Fixed`:** Vulnerable AST sink remains present in patched file.
-- **`Regression`:** Patch introduced a new security rule violation on modified lines.
+# Machine-readable JSON output
+npx torusguard recheck --json
+```
+**Under the Hood:** Executes `python .torusguard/scripts/recheck_runner.py`.
+- Evaluates applied candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
+- Executes single-file targeted differential AST scans via `audit_runner.scan_file()`.
+- Calculates formal status transitions:
+  - `✔ [Confirmed Fixed]`: Vulnerable pattern absent, zero regressions.
+  - `✖ [Regressed]`: New security finding introduced by patch.
+  - `⚠ [Unresolved]`: Vulnerable sink still present.
+- Emits run-level transition artifact: `.torusguard/runs/<run_id>/recheck.md`.
+- Synchronizes verification telemetry to `.torusguard/memory/events.json`.
+- Displays 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Differential Scan
+When evaluating patches directly in AI chat:
+1. **Identify Modified Files:** Read `diff_summary.md` or git status for files modified in the active run.
+2. **Re-Scan Sinks:** View the target file and verify that the specific rule violation (e.g. `TG-INPUT-003`, `TG-PLATFORM-001`) is no longer triggered.
+3. **Assert Zero Regressions:** Verify that no new vulnerabilities (like raw concatenation or unvalidated input) were introduced by the fix.
+4. **Update Status:** Log outcome in `.torusguard/runs/<run_id>/recheck.md`.
+5. **Memory Telemetry:** Record verification event with `memory_engine.record_event("fix_verified", ...)`.
 
 ---
 
-## Safety Constraints
-- Restrict AST scan strictly to modified files and direct callers.
-- If regression is detected, halt and recommend immediate rollback via `.bak` snapshot. If CLI rollback fails, you MUST manually revert the file using your write tools.
-- Read-only differential analysis.
+## Recheck Status Transitions
+| Outcome | Visual Indicator | Meaning | Required Action |
+| :--- | :--- | :--- | :--- |
+| **Confirmed Fixed** | `✔ [Confirmed Fixed]` | Sink eliminated, zero regressions | Proceed to Posture Report |
+| **Unresolved** | `⚠ [Unresolved]` | Flaw still present in file | Re-harden with alternative pattern |
+| **Regressed** | `✖ [Regressed]` | New security flaw introduced | Instant `npx torusguard rollback` |
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-✅ [TorusGuard] Differential Recheck Completed (AI Assisted)
-- Modified Files Scanned: <Count>
-- Target Finding: <Finding ID> ──► FIXED
-- Regressions Detected: 0
-- Report: `.torusguard/runs/<run_id>/recheck-report.md`
-Next: Run `/torusguard report` to export final SARIF and release summary.
+### ✅ TorusGuard Differential Recheck Completed
+- **Run ID:** `run-20260910-121618-audit`
+- **Confirmed Fixed:** 2 vulnerabilities verified closed
+- **Regressions:** 0 detected
+- **Unresolved:** 0
+- **Artifact:** `.torusguard/runs/<run_id>/recheck.md`
+- **Next Step:** Run `npx torusguard report --html` for visual dashboard
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-report/SKILL.md

@@ -1,55 +1,76 @@
 ---
 name: torusguard-report
-description: Generate unified security posture reports and export OASIS SARIF v2.1.0 logs for CI/CD integration.
-version: 0.9.2
+description: Generate executive posture reports, export OASIS SARIF v2.1.0 logs, and render dark-mode HTML dashboards via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/report.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/html_reporter.py
   - .torusguard/scripts/sarif_exporter.py
   - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
 ---
 
-# TorusGuard Report — Unified Security Posture Report & SARIF Export
+# TorusGuard Report — Posture Reporting & SARIF / HTML Export
 
 ## Objective
-Aggregate findings, verification traces, and recheck results into a signed executive security summary and export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines.
+Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports.
 
 ---
 
-## Execution Steps
+## Two Execution Modes
 
-1. **Aggregate Run Data:** Read findings, verified evidence, and recheck records from active run.
-2. **Handle CLI Failures:** If `npx torusguard report --html` or SARIF export crashes, YOU must manually gather the metrics and format the report.
-3. **Export OASIS SARIF v2.1.0:**
-   ```bash
-   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
-   ```
-4. **Compile Executive Markdown/HTML Report:** Generate `report.md` or `.html` with posture score, open/closed finding tables, and risk breakdown. Make sure the polyglot stack detected during audit is explicitly summarized.
-5. **Update Run Manifest:** Finalize `manifest.json` status counts.
-6. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
+### Mode A: Automated CLI Execution
+Run the report engine from your terminal:
+```bash
+# Generate visual dark-mode HTML dashboard
+npx torusguard report --html
 
----
+# Export OASIS SARIF v2.1.0 for GitHub Code Scanning / CI
+npx torusguard report --sarif
+
+# Generate both HTML and SARIF for latest run
+npx torusguard report --html --sarif
+
+# Generate report for a specific project directory
+npx torusguard report ./examples/vulnerable-react-express --html
 
-## SARIF v2.1.0 Output Specification
-- **Version:** `$schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`, `version: 2.1.0`.
-- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 0.9.2`, full rules catalog in `driver.rules`.
-- **Category Hygiene:** Set `automationDetails.id: "torusguard/static"` to avoid collisions in multi-analysis CI.
-- **Fingerprinting:** Populate `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
+# Target a specific run ID
+npx torusguard report --run run-20260910-121618-audit --html
+```
+**Under the Hood:**
+- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, and cluster summaries at `.torusguard/runs/<run_id>/report.html`.
+- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/<run_id>/results.sarif`.
+- Finalizes `manifest.json` metrics and updates historical posture scoring.
+- Displays 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Reporting
+When generating security posture summaries in AI chat:
+1. **Aggregate Run Data:** Inspect `findings.json`, `remediation.md`, and `recheck.md` from the active run.
+2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2).
+3. **Format Executive Card:** Present finding counts, closed vulnerabilities, remaining risks, and compliance posture.
+4. **Export Artifacts:** Verify that `report.html` and `results.sarif` are serialized to disk.
 
 ---
 
-## Safety Constraints
-- Redact all tokens, passwords, and API keys before saving report.
-- Strictly read-only reporting; no source code modifications.
-- Ensure SARIF passes JSON schema validation.
+## SARIF v2.1.0 Specification
+- **Schema:** `https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.5`, full rules catalog in `driver.rules`.
+- **Automation Details:** `automationDetails.id: "torusguard/static"` to avoid collisions in multi-scanner CI/CD pipelines.
+- **Fingerprints:** `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-📊 [TorusGuard] Security Posture Report Emitted (AI Assisted)
-- Run ID: <Run ID> | Posture Score: <Score>/100
-- Findings: <Total> (<Fixed> Fixed · <Open> Open)
-- SARIF Export: `.torusguard/runs/<run_id>/results.sarif`
-- Executive Report: `.torusguard/runs/<run_id>/report.md`
+### 📊 TorusGuard Security Posture Report Emitted
+- **Run ID:** `run-20260910-121618-audit`
+- **Posture Score:** 85 / 100 (HIGH SECURITY)
+- **Findings Summary:** 3 Evaluated · 2 Confirmed Fixed · 1 Unresolved
+- **HTML Dashboard:** `.torusguard/runs/<run_id>/report.html` (View in browser)
+- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif` (Ready for CI)
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-status/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: torusguard-status
-description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
-version: 0.9.2
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
+version: 1.3.5
 workflow: .torusguard/workflows/status.md
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, run_command, Write
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
 ---
 
 # TorusGuard Status — Workspace Security Posture & Diagnostic Overview
@@ -15,29 +17,46 @@ Provide an instant diagnostic summary of the repository's security state, active
 
 ---
 
-## Execution Steps
+## Two Execution Modes
 
-1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
-2. **Handle CLI Failures:** If `npx torusguard status` throws an error, YOU must manually parse the local files (e.g. `torusguard.json`, `scope.json`) to deduce the status instead of just returning the CLI error.
-3. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-4. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
-5. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
-6. **Render Diagnostic Overview:** Output formatted status card.
+### Mode A: Automated CLI Execution
+Run the diagnostic overview from your terminal:
+```bash
+# Display 75-column status cards
+npx torusguard status
 
----
+# Check status of specific project directory
+npx torusguard status ./examples/vulnerable-react-express
 
-## Safety Constraints
-- Read-only execution; zero file modifications.
-- Handle uninitialized workspaces gracefully with advice to run `/torusguard init` (or manual AI initialization).
+# Output machine-readable JSON
+npx torusguard status --json
+```
+**Under the Hood:**
+- Evaluates `.torusguard/config/torusguard.json` for initialized status and detected stack.
+- Enumerates active rules in `.torusguard/rules/active/` (or canonical 74 rules).
+- Scans `.torusguard/runs/` for run history, finding counts, and verified fixes.
+- Inspects `.torusguard/config/scope.json` for authorized runtime validation targets.
+- Displays mathematically aligned 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Status Check
+When checking workspace status in AI chat:
+1. **Verify Workspace Setup:** Check if `.torusguard/` exists on disk.
+2. **Inspect Active Config:** Read `.torusguard/config/torusguard.json` for detected stack, framework, and rules.
+3. **Inspect Latest Run:** Find the latest run directory under `.torusguard/runs/` and read `manifest.json`.
+4. **Inspect Memory Engine:** Check `.torusguard/memory/patterns.json` for captured Golden Fix Recipes.
+5. **Render Diagnostic Card:** Present an overview of posture, stack, and recommended next steps.
 
 ---
 
-## Output Format
+## Output Card Format
 ```markdown
-🛡️ [TorusGuard] Workspace Status Overview (AI Assisted)
-- Version: v0.9.2 | Stack: <Detected Framework>
-- Active Rules: <Count> rules active in `.torusguard/rules/active/`
-- Historical Runs: <Count> runs recorded
-- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
-- Posture: <SECURE / ACTION REQUIRED>
+### 🛡️ TorusGuard Workspace Status Overview
+- **Version:** v1.3.3 | **Stack:** Node.js / React / Express
+- **Active Rules:** 74 canonical security rules enabled
+- **Historical Runs:** 3 runs recorded
+- **Golden Recipes:** 4 distilled into persistent memory
+- **Overall Posture:** SECURE (All targeted vulnerabilities verified closed)
 ```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-verify/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 0.9.2
+version: 1.3.5
 workflow: .torusguard/workflows/verify.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/finding_scorer.py
 ---
 
@@ -39,6 +40,10 @@ A finding is verified as sufficient when:
 
 ---
 
+## Living Report Ground Truth
+- Always inspect `security_report.md` at workspace root before acting.
+- Update finding statuses after completion to eliminate hallucination.
+
 ## Safety Constraints
 - Read-only analysis; no files are modified.
 - Never guess line numbers; always verify via active disk read.