torusguard 1.3.4 → 1.3.5

package/.torusguard/workflows/apply.md

@@ -1,12 +1,14 @@
 ---
 description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 0.9.2
+version: 1.3.5
 agent: remediator
 lifecycle-phase: Phase 5 (Patch Application)
 required-skills:
   - torusguard-apply
 scripts-binding:
+  - .torusguard/scripts/apply_runner.py
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/run_manager.py
   - .torusguard/scripts/diff_guard.py
 ---
@@ -26,7 +28,7 @@ Governed patch application with pre-apply rollback snapshots and Human Gate auth
 
 Inspect bundle validity and file safety before modifying disk code:
 1. **Bundle Verification:** Assert `patch.diff` exists in active run's remediation folder.
-2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.bak` or `pre_apply/`) prior to editing.
+2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.bak` or `.torusguard/snapshots/<run_id>/`) prior to editing.
 3. **Uncommitted Changes:** Check git status; ensure target file has clean baseline.
 4. **Ponytail Check:** Re-verify that patch additions $\le 35$ and deletions $\le 25$.
 5. **Human Gate:** Confirm operator approval before committing edits to disk.
@@ -47,11 +49,16 @@ Inspect bundle validity and file safety before modifying disk code:
 
 ---
 
+## Living Report Invariant
+- Applied patches create pre-apply `.bak` snapshots in `.torusguard/snapshots/<run_id>/`.
+- Finding statuses transition in `security_report.md` to `APPLIED 🔵`.
+- Instant rollback available via `npx torusguard rollback`.
+
 ## Execution Steps
 
 1. **Load Remediation Bundle:** Read `patch.diff` and metadata from active run directory.
 2. **Audit Patch Invariants:** Run `python .torusguard/scripts/diff_guard.py <patch.diff>`.
-3. **Create Rollback Backup:** Copy target file to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
+3. **Create Rollback Backup:** Copy target file to `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<filename>.bak`.
 4. **Apply Minimal Diff:** Execute precise surgical edit using `replace_file_content` or `patch`.
 5. **Assert Syntax & Integrity:** Check that modified file compiles cleanly without syntax errors.
 6. **Log Application Ledger:** Record timestamp, original SHA-256, and patched SHA-256 in `apply-log.json`.
@@ -81,7 +88,7 @@ Inspect bundle validity and file safety before modifying disk code:
 ### 🚀 TorusGuard Patch Application
 - **Finding Addressed:** `TG-XXX-HASH`
 - **File Patched:** `src/path/to/file.py`
-- **Rollback Backup:** `.torusguard/runs/<run_id>/pre_apply/<file>.bak`
+- **Rollback Backup:** `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<file>.bak`
 - **Churn Applied:** +[Additions] / -[Deletions] lines
 - **Syntax Check:** PASSED (clean compile)
 - **Status:** APPLIED — run `/torusguard recheck` to verify fix

package/.torusguard/workflows/audit.md

@@ -1,12 +1,14 @@
 ---
 description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: auditor
 lifecycle-phase: Phase 2 (Static Audit & Clustering)
 required-skills:
   - torusguard-audit
 scripts-binding:
+  - .torusguard/scripts/audit_runner.py
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/run_manager.py
   - .torusguard/scripts/finding_scorer.py
 ---
@@ -45,6 +47,10 @@ Inspect workspace prerequisites before launching static audit:
 
 ---
 
+## Living Report Invariant
+- Audit discoveries automatically synchronize to `security_report.md` at workspace root.
+- Findings transition into `OPEN 🔴` status with stable invariant fingerprints.
+
 ## Execution Steps
 
 1. **Allocate Run Folder:** Run `python .torusguard/scripts/run_manager.py create audit`.

package/.torusguard/workflows/authorize.md

@@ -1,12 +1,13 @@
 ---
 description: Legal scope definition, target ownership proof verification, and safety boundary enforcement for runtime validation.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: reviewer
 lifecycle-phase: Phase 1 (Authorization Gate)
 required-skills:
   - torusguard-authorize
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/safety_gate.py
 ---
 

package/.torusguard/workflows/exploit-check.md

@@ -1,12 +1,13 @@
 ---
 description: Safe, bounded, single-step exploitability confirmation across 5 standard verification statuses.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: validator
 lifecycle-phase: Phase 3c (Exploitability Check)
 required-skills:
   - torusguard-exploit-check
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/safety_gate.py
   - .torusguard/scripts/finding_scorer.py
 ---

package/.torusguard/workflows/harden.md

@@ -1,12 +1,14 @@
 ---
 description: Governed remediation formulation under strict Ponytail Protocol bounds (<= 35 additions, <= 25 deletions) and bundle packaging.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: remediator
 lifecycle-phase: Phase 4 (Remediation Formulation)
 required-skills:
   - torusguard-harden
 scripts-binding:
+  - .torusguard/scripts/harden_runner.py
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/run_manager.py
   - .torusguard/scripts/diff_guard.py
 ---
@@ -46,6 +48,10 @@ Inspect finding targets and patch constraints before generating diffs:
 
 ---
 
+## Living Report Invariant
+- Candidate patches transition findings in `security_report.md` into `CANDIDATE 🟡` status.
+- Every patch strictly conforms to Ponytail bounds (<= 35 additions, <= 25 deletions).
+
 ## Execution Steps
 
 1. **Select Target Finding:** Choose verified flaw from active run directory.

package/.torusguard/workflows/init.md

@@ -1,12 +1,13 @@
 ---
 description: Baseline project discovery, workspace scaffolding, stack detection, and framework-tailored security rule activation.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: profiler
 lifecycle-phase: Phase 0 (Baseline Setup)
 required-skills:
   - torusguard-init
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/stack_detect.py
 ---
 
@@ -44,6 +45,10 @@ Inspect workspace state before running initialization:
 
 ---
 
+## Living Report Invariant
+- Provisions baseline `security_report.md` single-source-of-truth ledger.
+- Activates tailored rules across 18 families based on detected stack.
+
 ## Execution Steps
 
 1. **Scaffold Directory Topology:** Verify `.torusguard/` structure (`config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`).

package/.torusguard/workflows/memory.md

@@ -1,12 +1,13 @@
 ---
 description: TorusGuard Adaptive Security Memory Engine — view memory stats, export/import intelligence, apply TTL decay, and manage false positives.
 tools: Read, Grep, Glob, Bash
-version: 1.0.0
+version: 1.3.5
 agent: reviewer
 lifecycle-phase: Intelligence / Memory
 required-skills:
   - torusguard
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/memory_engine.py
 ---
 

package/.torusguard/workflows/recheck.md

@@ -1,12 +1,14 @@
 ---
 description: Targeted differential AST re-scan, fix closure verification, and regression state machine transitions.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: reviewer
 lifecycle-phase: Phase 6 (Targeted Recheck & Verification)
 required-skills:
   - torusguard-recheck
 scripts-binding:
+  - .torusguard/scripts/recheck_runner.py
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/run_manager.py
   - .torusguard/scripts/finding_scorer.py
 ---
@@ -46,6 +48,10 @@ Inspect applied patch history and target file scope before re-checking:
 
 ---
 
+## Living Report Invariant
+- Verified fix closures transition findings in `security_report.md` to `RESOLVED 🟢`.
+- Regressions transition findings to `REGRESSED ❌`.
+
 ## Execution Steps
 
 1. **Identify Modified Files:** Extract list of altered files from latest apply step.

package/.torusguard/workflows/report.md

@@ -1,12 +1,14 @@
 ---
 description: Executive posture reporting, cluster analysis, signed compliance audit, and OASIS SARIF v2.1.0 structured export.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: reviewer
 lifecycle-phase: Phase 7 (Reporting & SARIF Export)
 required-skills:
   - torusguard-report
 scripts-binding:
+  - .torusguard/scripts/html_reporter.py
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/sarif_exporter.py
   - .torusguard/scripts/run_manager.py
 ---
@@ -45,6 +47,10 @@ Inspect run records and reporting parameters before generating release artifacts
 
 ---
 
+## Living Report Invariant
+- Executive posture reports incorporate health scoring and metrics from `security_report.md`.
+- Emits visual dark-mode HTML (`--html`) and OASIS SARIF v2.1.0 (`--sarif`).
+
 ## Execution Steps
 
 1. **Aggregate Lifecycle Data:** Load all finding cards, verification traces, and recheck logs.

package/.torusguard/workflows/status.md

@@ -1,12 +1,13 @@
 ---
 description: Read-only diagnostic overview of workspace security posture, active configuration, rules catalog, and run history.
 tools: Read, Grep, Glob, Bash
-version: 0.9.2
+version: 1.3.5
 agent: reviewer
 lifecycle-phase: System / Diagnostics
 required-skills:
   - torusguard-status
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/run_manager.py
 ---
 
@@ -44,6 +45,10 @@ Inspect workspace state and configuration records prior to status display:
 
 ---
 
+## Living Report Invariant
+- Reads current health score and status breakdown directly from `security_report.md`.
+- Displays 18 rule families and 74 rules in standardized 75-column terminal cards.
+
 ## Execution Steps
 
 1. **Read Configuration:** Load `.torusguard/config/torusguard.json`; extract stack, version, and enabled rule count.

package/.torusguard/workflows/verify.md

@@ -1,12 +1,13 @@
 ---
 description: Evidence sufficiency verification, live disk line match audit, and finding score refinement.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: validator
 lifecycle-phase: Phase 3a (Evidence Verification)
 required-skills:
   - torusguard-verify
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/finding_scorer.py
 ---
 
@@ -44,6 +45,10 @@ Inspect finding records and evidence integrity before verification:
 
 ---
 
+## Living Report Invariant
+- Confirmed evidence sufficiency transitions findings in `security_report.md` to `VERIFIED 🟠`.
+- False positives transition to `FALSE POSITIVE ⚪`.
+
 ## Execution Steps
 
 1. **Locate Target Findings:** Load active findings from latest run directory.

package/.torusguard/workflows/web-validate.md

@@ -1,12 +1,13 @@
 ---
 description: Authorized HTTP probing, token redaction, transparent audit header injection, and replay trace capture.
 tools: Read, Grep, Glob, Bash, Write
-version: 0.9.2
+version: 1.3.5
 agent: validator
 lifecycle-phase: Phase 3b (Runtime Web Validation)
 required-skills:
   - torusguard-web-validate
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/safety_gate.py
 ---