torusguard 1.3.4 → 1.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {

package/skills/torusguard/SKILL.md

@@ -1,72 +1,73 @@
----
-name: torusguard
-description: Universal autonomous security engine: 71 canonical rules across 11 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
-version: 1.3.4
----
-
-# TorusGuard Master Security Engine & Command Router
-
-**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
-
----
-
-## Command Catalog: Terminal CLI & AI Chat Parity
-
-TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
-
-| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
-| :--- | :--- | :--- | :--- | :--- |
-| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
-| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
-| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
-| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
-| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
-| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
-| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
-| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
-| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
-| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
-| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
-| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
-| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
-| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
-| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
-
----
-
-## Non-Negotiable Invariants
-
-1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
-2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
-3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
-4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
-5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
-6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
-
----
-
-## Workspace Layout Structure
-```
-.torusguard/
-├── config/
-│   ├── torusguard.json          # Detected stack, settings, and rule counts
-│   └── scope.json               # Authorized runtime validation targets & TTL
-├── memory/
-│   ├── context.json             # Aggregated security memory context
-│   ├── patterns.json            # Distilled Golden Fix Recipes
-│   └── events.json              # Historical audit, apply, and recheck events
-├── rules/
-│   └── active/                  # Active TG-* rule definitions
-├── runs/
-│   └── run-YYYYMMDD-HHMMSS-audit/
-│       ├── findings.json        # Machine-readable AST findings
-│       ├── findings.md          # Actionable markdown finding cards
-│       ├── remediation.md       # Formulated candidate patch catalog
-│       ├── diff_summary.md      # Summary of applied diffs
-│       ├── recheck.md           # Differential recheck status transitions
-│       ├── report.html          # Single-file visual dark-mode HTML report
-│       ├── results.sarif        # OASIS SARIF v2.1.0 log
-│       └── bundles/             # Formulated Ponytail remediation bundles
-└── snapshots/
-    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
-```
+---
+name: torusguard
+description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, living security_report.md ground-truth ledger, SARIF v2.1.0 exports, and persistent security memory context.
+version: 1.3.5
+---
+
+# TorusGuard Master Security Engine & Command Router
+
+**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
+
+---
+
+## Command Catalog: Terminal CLI & AI Chat Parity
+
+TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
+
+| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
+| :--- | :--- | :--- | :--- | :--- |
+| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
+| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
+| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
+| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
+| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
+| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
+| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
+| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
+| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
+| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
+| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
+| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
+| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
+| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
+| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
+
+---
+
+## Non-Negotiable Invariants
+
+1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
+2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
+3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
+4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
+5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
+6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
+7. **Living Security Report Ground Truth:** All finding discoveries, patch formulations, applications, and recheck verifications must synchronize with `security_report.md` at the workspace root to maintain verifiable finding state and eliminate hallucination.
+
+---
+
+## Workspace Layout Structure
+```
+.torusguard/
+├── config/
+│   ├── torusguard.json          # Detected stack, settings, and rule counts
+│   └── scope.json               # Authorized runtime validation targets & TTL
+├── memory/
+│   ├── context.json             # Aggregated security memory context
+│   ├── patterns.json            # Distilled Golden Fix Recipes
+│   └── events.json              # Historical audit, apply, and recheck events
+├── rules/
+│   └── active/                  # Active TG-* rule definitions
+├── runs/
+│   └── run-YYYYMMDD-HHMMSS-audit/
+│       ├── findings.json        # Machine-readable AST findings
+│       ├── findings.md          # Actionable markdown finding cards
+│       ├── remediation.md       # Formulated candidate patch catalog
+│       ├── diff_summary.md      # Summary of applied diffs
+│       ├── recheck.md           # Differential recheck status transitions
+│       ├── report.html          # Single-file visual dark-mode HTML report
+│       ├── results.sarif        # OASIS SARIF v2.1.0 log
+│       └── bundles/             # Formulated Ponytail remediation bundles
+└── snapshots/
+    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
+```

package/skills/torusguard/payload/.manifest.json

@@ -1,6 +1,7 @@
 {
   "ARCHITECTURE.md": "cdc690a856e82574a6574ab6b1ad8a2d8b3b8264c36931c6212321066eed82e4",
   "TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
+  "rules_catalog.json": "e0b32c1bdde0f19fa390aba26a02b7e5ba1b59b251f9fffd501815b48f2d9af9",
   "agents/auditor.md": "4ba2c92982823d0886c7ae369126cd5ddd322085a85d3b7e7fa23154f8753314",
   "agents/profiler.md": "0ee9ebbddf4ebd557d454dda8472fffea471e263abeccf40298163084b7ce9a9",
   "agents/remediator.md": "f708a0e315760e8d519bd640d22bdf6b7ec61ed7de3da69bd038bd60dc3d5b47",
@@ -92,43 +93,43 @@
   "rules/authorization/TG-AUTH-006-mass-assignment.md": "9544e6df5d7420eb4dce4fbddd63f21103d82d91fedaedcfe041943b18452472",
   "rules/authorization/TG-AUTH-007-missing-property-level-authorization.md": "5a1afe03c03d8d3fe7ce952ead8ab011c1c209d029361ce183bf8091216914d0",
   "rules/authorization/TG-AUTH-008-untrusted-role-header-injection.md": "74cac648fd6c6b49523be499ecf878240b9ea58d1086c1b84c17532d4ba4ee49",
-  "rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md": "4e837ee5cb053db5ead273bb2e5d934f870ece007c41913362e3138f17b6bcf8",
-  "rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md": "906133df5a576d77515e20a2523f58452dbd22fccdfc4193ebb487298d42b0eb",
-  "rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md": "86f180dc7ed54665aef7b9077ad991bbb969e01371972dfa89c0f5353571d20c",
-  "rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md": "946950e4779b04cd57fd046a162d61bc33b302ccd29db97361d3e3a70b34a177",
-  "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "8f0789c6851dc560e15f26f1f7d26d3670e7212fa7f5bc7e1c09bd09ef1b8edf",
-  "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "cf29c883b880e4afdeebb0d74fd9b1622c6a395fd8486e142f175b90ee948874",
-  "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "c15a8eebfe32716ede037dc594dd01800e341f4b6f3b056d6f76a9a9af57ffb9",
-  "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "322f2f1bd964426823f1adb7dc20085d1d95aeef557b8d9f74e24d457dd885f6",
-  "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "43ee1934cc01ed2378b73e587efac8e357b4089dfbef23a57ba9ebe633816157",
+  "rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md": "e86c4f9c9d791f8eeea2464fdaf280bfb6a03bd3704e4a5c04725206ed117fd3",
+  "rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md": "fc30c85ba39ff14f701958c50aba5fc8fe381944dd8a0beecbb1692797fc7fb7",
+  "rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md": "120d8cb59423b01b887a2f6d96f52a485fe9463ee48d77f7d05d9cd7ec4d69b4",
+  "rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md": "ccd82baec26c015079d78c9c70fc5cca35dcbc6dc973a860b23d7392708e6e79",
+  "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "e84d9d314b1616bdda54345fdf0203732e68e375dc7e144d9e2aa7619f9cafb8",
+  "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "4e305be49dd14a34d29c9283b535a72ad6cd84c5bd52afb3f006403f2e5a6850",
+  "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "235f3eed546b58aa8f04e155aeaef4e0206dd696517a7854983ab9ce8fe61030",
+  "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "42fcf19ae244a36b3b64d03200b6d4c1acf1b265fdb2fe6a85de8dd69b3837fe",
+  "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "c01a55e31e4aaaea8c9f630b514c1ad242b513ab99111534939584ae4fe1a58c",
   "rules/custom/README.md": "f2128661ad3bc4085a69ddfbabbb2211930215fc42a25e2ab2d3e7a4b749a639",
   "rules/edge/TG-EDGE-001-serverless-global-state-leak.md": "82fe764a67228c71359b340a983cb37dc8bf4521d030846e0cea433de43c52d3",
   "rules/edge/TG-EDGE-003-aws-lambda-ephemeral-cold-start.md": "2659db7d38b6689d1d3a99ad5f2504ea264b3d3a601ab38186737b12d4d42c17",
   "rules/graphql/TG-GQL-001-missing-query-depth-or-complexity-limits.md": "bfee2cb26c71871cc4b93e224dc56c18de0d0ea692a431f7b27a51e7e408873f",
-  "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "81859a712d482ded016507c7a67e16358a6a29a3c9a9dc04495c907e155a0589",
-  "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "b6c3b95ed97b704d4fc43155f1cd3cd844d69f0040cdcad9e1051dbd055f3ca9",
-  "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "034fb574fe79346f1c859ff143e4ab70110fff2950a3900fac324f490a837888",
-  "rules/secrets/TG-SEC-005-secret-in-git-history.md": "22ba761d8375aa249bd6a8284de1dce9c7aeda0f26b8fa20d660eb46d09ec711",
-  "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "7130799c3218ae953a1673bdbb6b7afddfcbf6d0a95500ea558334915b9a0199",
-  "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "558092260732217666d3fcbce6cce57856f082e5fcc77eb34d19cb29e666ac2c",
+  "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "e6429fdcf130478446a2711eac83bd64cc502aad8baa35c04de26958d23e5b0f",
+  "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "c2e2beb37c4d86f4ba564e1a1fd9587626df3793b9c5dc9e13d0cf0ce3bfe09a",
+  "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "54311588945abc1d79e99a0001390821ccb4434772297b2395e7081d276d6602",
+  "rules/secrets/TG-SEC-005-secret-in-git-history.md": "089dbe9653b2a4df652ba049b40147434d6abc70c239ac7db81bdcb9d6579387",
+  "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "ed20b1c9044149df5257ad8140bd787db7f77063b890dad9ba32efaf4d554fe5",
+  "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "b3d4b9f1d0fd9656aa9a586e133209904c1f3b75a2b7e7c1ecb825a125663e6d",
   "rules/ssrf/TG-SSRF-001-user-controlled-server-side-url-fetch.md": "d6a9bee4b60c1f2a02f83dfc59c71e4aefb2284431cead83703d2882ba8813e1",
-  "rules/ssrf/TG-SSRF-002-missing-internal-network-protection.md": "a421a1f85e6dffe11cfa570deb976213bf044f69ec5061dae1a7f3e6b0893759",
-  "rules/ssrf/TG-SSRF-003-unsafe-redirect-following.md": "b6c43733600a6b1849cae64f16ca4eb2d16bd440a6a8c890ff8ad25e38fec292",
-  "rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md": "be3fd4f403605cf75d8f27448f2b305fd7ff327e6626091c13af14434971589c",
-  "rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md": "f19b10647789c7fa57eccbb5b220f925195cee391f2f1253258322f113855f23",
+  "rules/ssrf/TG-SSRF-002-missing-internal-network-protection.md": "6cc87c5be9de739f291d724cec9e2897b7c4abb48bf938cafe824ec29634c878",
+  "rules/ssrf/TG-SSRF-003-unsafe-redirect-following.md": "1f0e92b6783f1ab10310f98bea64df6fec82bd61b311828787e273e2db9878fa",
+  "rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md": "24fbbb0b5d57a1399397e25849bb25b307f9f03c66c34d67bffe9bdc675c4aeb",
+  "rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md": "30ceac40228e8777491d3f5613f7660e75f186a07256be7af1c6bc1576f17f3d",
   "rules/supply-chain/TG-SUPPLY-002-vulnerable-dependency-review-missing.md": "f80f2717fdba26e1520bb40276edb6d88835eb8c307e170ff8ab9572187f338f",
-  "rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md": "73eadb6a87ae7f7a66f04be03622720ce6ec9389fdce1b1844047088daf8a389",
-  "rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md": "492d50e5bddcf3cfb82f1e44baefe4afd1311728cd77aa7bb89f721808ddb4ba",
-  "rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md": "5960008c0182c2e809089975ecec6ac4f2caa393953abe4d223cce4b2274a8b8",
+  "rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md": "43add6a6a01e8a1f206d67678906bb21349889453b148247694dfd53e8aa6b93",
+  "rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md": "d8f4ea71de97a6455c84734c94805d520a6666fa0460a3dd63780c7fd4618052",
+  "rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md": "20657c6ad29b1ad046fbab5523fbf809f37598898415b2dfbf76f55826578305",
   "rules/supply-chain/TG-SUPPLY-006-container-build-secret-persistence.md": "eaadfc37364f150aa08212afd9a629bb084bdd705c6663534b6ea6c74f383053",
-  "rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md": "3d2f4de4683ac18f4fdfea3e191fe7bdb305c845c76343ab05205d9f3ea3ee73",
-  "rules/webhook/TG-WEBHOOK-002-replayable-webhook.md": "e5f26c0874b5d0974b8aa55c664281a6643b08f87ad1c28cfcaebbb58172956c",
-  "rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md": "bc5cc14d0112260b60120c2d5b0d670477884a0cddbe608408318f006534028d",
-  "rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md": "5a5d0eacbaa803e499b05cb59506eaaa8a7b311666c6db4ce1490ae227132102",
+  "rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md": "4d4e516a0765c4b9d26c675374ea5fe73319a3883555dc368ef2633d67499e6a",
+  "rules/webhook/TG-WEBHOOK-002-replayable-webhook.md": "9d0dad0f993bfc4b3aaf035bb5b1fb362c3e6556168ef63e2b7053f288dbf8a6",
+  "rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md": "6a9b2346379ee37b73079a8ed67c9cbae8ba2b1f8c6b862eeb76a9d1a8d465c9",
+  "rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md": "676dc47739de188ef44315be88745dd23c0b72fbed90b461b7865aadba1ff8dd",
   "rules/websocket/TG-WS-001-unauthenticated-websocket-handshake.md": "b700f08ae47d12f9ed014905c04a4542fcb1bdc34064fb8eb01168f92f5752ae",
-  "rules/websocket/TG-WS-002-missing-channel-level-authorization.md": "32bb0234600ee1712bdbe9190fcf2b5f2ca43987e266fd130e4bd4444bed9712",
-  "rules/websocket/TG-WS-003-unvalidated-websocket-message.md": "b801bd9131b63df2e36132a47a15d1f38c6786bdb696fad5c70059d8d419153c",
-  "rules/websocket/TG-WS-004-unbounded-websocket-connections.md": "5ffa620c039192ade9e44dba83ebba2325f71676767950ea53c620ccfc86a1ad",
+  "rules/websocket/TG-WS-002-missing-channel-level-authorization.md": "7a6a4be54c8fad3575bfa1bef02960285ec304f0021bdb22c586e238ad026c0d",
+  "rules/websocket/TG-WS-003-unvalidated-websocket-message.md": "f593e1f7fa3678150f1fcfa368c6f3b741cd236de19f15cb340bb906e12ba9ce",
+  "rules/websocket/TG-WS-004-unbounded-websocket-connections.md": "e700a0fddd7febf8c520bf0e5c5d4c3a2fb1d29d46dabaeb7bf982b95404e0c1",
   "schemas/authorization.schema.json": "84885c9edc930a22c777d8685219f1f25b5320c0c6062722e3ba09f1fe417ad4",
   "schemas/confidence.schema.json": "09c5098f55f3936e9231ba417ace4fa7aa9ebc49233b4bfa88a4103ef6f1202c",
   "schemas/evidence.schema.json": "7dff029c34965e9aeee932028d11bf30d4f3ff76f8137af382bf3d3dc2c0df10",
@@ -141,23 +142,25 @@
   "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
-  "scripts/apply_runner.py": "2218a02538e821d88bb95211ae907705bea9b0533e43504912d5e3655f69de0c",
-  "scripts/audit_runner.py": "71553ca6c2d57df6f7323d41abc0216ecedb821fcf0eb5fd502290bd6dec6ae4",
+  "scripts/apply_runner.py": "3863c894d0a57f4a71206dca802b26755f361958f085b4636f112350bde221a2",
+  "scripts/audit_runner.py": "bdf4784ebec526a6f980879ce80aa7693ad2a8268fd4fa0334130ac3c1a7b22a",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
-  "scripts/finding_scorer.py": "885c7cbb7a8def2ceda0266e5a7f893938e41debc7501f7400a17a606b22dc23",
-  "scripts/harden_runner.py": "cf813ec241db73de94fe76d4929dcfc6dd7826e50c84986c50fa28175717ed93",
-  "scripts/html_reporter.py": "f2bc401e9dfebda2c0e078897247210b2c8b83cba24add00e618821f9cae9eda",
+  "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
+  "scripts/harden_runner.py": "c7a8074eaa9f6ebe61a17c553fd07bb543efcb1d5b4e01f24fd856367c048a70",
+  "scripts/html_reporter.py": "30982f279b501834009159d7142624c973f36f2517b884a0ce4868d7ca42d1f3",
   "scripts/manifest_builder.py": "c0137927789a9e40a08243e630ac3c6990beb1b87807934e98906c8ad0b99a97",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
-  "scripts/recheck_runner.py": "bb381717a93db07fc899c98e43b1587d1d2ce6ebb1c1bd8e37d460eac7f4ab19",
-  "scripts/recipes_runner.py": "7f6dc401c4b39b2e804b4db457caed04a11022b43c90651408fd26675bef1b3b",
+  "scripts/recheck_runner.py": "0c51d91b37bd3babf228b4b12b0e9d65953c8eae2e2e46596a1d42af8d057f71",
+  "scripts/recipes_runner.py": "cd9ffba5fed53057aac56241dcbfda1e68248f323e51bbde3fe711634b099600",
+  "scripts/report_sync.py": "278666954207a9eef1d479872546b99c16a8ded46bd3238ac9a09e2856b69813",
   "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
   "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
-  "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
-  "scripts/stack_detect.py": "7848006e3cd6e828f7dbe189a8c9728abd58e021ff02efbc4230ef8ca3444596",
-  "skills/torusguard/SKILL.md": "4b5cb127bea1f7e78e3452637c3e13117f8ece46de65ec791f2de3ef750e5bd5",
+  "scripts/sarif_exporter.py": "f060cfaf91dfb6b8e9c4036e354704204dfa8054720501f0ce2fadae0fb89540",
+  "scripts/stack_detect.py": "3f755d9353d5a8fd33a25486d6af0101a1d1b0c2f70f5a28bb2af2fe6050adc2",
+  "scripts/term_ui.py": "4870714add208f3da53c76a1250b1ceb8c104c0b708384e73427210dd0b50e6a",
+  "skills/torusguard/SKILL.md": "3e63aaa90f5453ba2b7ea79ed6afbd64985fb083d198a34d552857abb2f183f4",
   "skills/torusguard/bootstrap.py": "3d946f388cb4befa739c9d3b1404255d9a8ea5770ebbb79e5a1b9839589e9bc7",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
@@ -187,32 +190,32 @@
   "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
   "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
   "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
-  "skills/torusguard-apply/SKILL.md": "09ddf90b436eae0fd54264dbf3c34f564a4481ec4806e2dcf311bfee5ce44d6b",
-  "skills/torusguard-audit/SKILL.md": "f879e280d357ea7f124c647ce39af2b24b79db608c9edd018f26e5312625a8b5",
-  "skills/torusguard-authorize/SKILL.md": "689729cfebbf6880869ef4ab1b43657f35c873a782f87a03f26727550f7964d4",
-  "skills/torusguard-exploit-check/SKILL.md": "c674040a917d95190e198b5fe386a0f08b00424e2037b814a133fa8bf1449f73",
-  "skills/torusguard-full/SKILL.md": "f7da4dbd708b31710bddeb5a1f30e1273b134fee1daae89399a17b596ff0128b",
-  "skills/torusguard-harden/SKILL.md": "326fa84bda4832f96b19d73824c3472dfe185247ed3e3db9715dd943d46d9874",
-  "skills/torusguard-init/SKILL.md": "534a1a4aff2510dbf7924fe74d7d338ed352f757a23b1c5427b9f758019cd911",
-  "skills/torusguard-recheck/SKILL.md": "457b2a1cce064a738fbe43f0dba6b4393f1630a82f60698ea5ebe655ec017e50",
-  "skills/torusguard-report/SKILL.md": "f6f6de3a8b56c4538d02307c5afaf99c508561140cccfe8ea16c2ae87768b64d",
-  "skills/torusguard-status/SKILL.md": "23afc632b70b80304952e2559a109d5877f97a048039a818a65b378dc604e19e",
-  "skills/torusguard-verify/SKILL.md": "842ca8ca3ad194886605a7fafb98d4309cba695b86a627b24206b5b139eef5c6",
-  "skills/torusguard-web-validate/SKILL.md": "b3cd9952601cfe89dbe98765bd61be22b434e5aaf5700751348591919e595ad4",
+  "skills/torusguard-apply/SKILL.md": "453e1099ce3ae2184ae7bba34156cdafc6437976283e3839bef1c014bbc4bd9a",
+  "skills/torusguard-audit/SKILL.md": "b8e2d0058bce604a00fee93055112b3872290373e8b90d95b3414ce2c33bf9d9",
+  "skills/torusguard-authorize/SKILL.md": "67051f2db03f1957a63c10e6d39c963561c9c93f2c0c2e3289e936fe85b70da5",
+  "skills/torusguard-exploit-check/SKILL.md": "7b040abfc10e6aedd56a432247b5c36c4872966b2bf363e56c5ae393db825e23",
+  "skills/torusguard-full/SKILL.md": "f225de0e29d46f96fc0735e310394313dfecc987be430af14504498fc90847de",
+  "skills/torusguard-harden/SKILL.md": "11039ce21f6990d7b15c176e0aefb5ee6d7631ab083391e3442c1020d5cae956",
+  "skills/torusguard-init/SKILL.md": "89518de3585f4016b1e2ff6400979dcd7362c4b4f93fbdabd72e3ff4a59ba4d5",
+  "skills/torusguard-recheck/SKILL.md": "d839251dbe5571769da0d4ae3ff2ef18533ee96f87bf460b44bb51279866be22",
+  "skills/torusguard-report/SKILL.md": "f361f2e61141a4d0cea891da827146c3fce42b8b55c81d60d0ac999312e4d6cd",
+  "skills/torusguard-status/SKILL.md": "e14ab6276207bf4921749ec38a4c4b0bf482e84010a4e1b7c2b6f8ce7804f047",
+  "skills/torusguard-verify/SKILL.md": "f9aff4ca514e72883ac630245b6f3b62e035a9e54bdbe69ae8edb59bd9153691",
+  "skills/torusguard-web-validate/SKILL.md": "006d638d9d6f7ee5f9eb880704955f01eff1c3b9bb3baa8ac900fd807f6f589a",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "dc66ef6c59ecf1996d45921ac83ba5dd2503a9f3624c8e6f24568745a072b871",
-  "workflows/audit.md": "969df4767b311f6468fb10ad4c98c302feb7112bafa86c14c59c8b9f5d481c89",
-  "workflows/authorize.md": "1ac2e3adb367a04bd20b2b6a062f6a65703e4aa6a815fe0affc0697faa433588",
-  "workflows/exploit-check.md": "67073930ea86219a4efd54dac4206dfc37775a660ff1b6960ed2bfea0528b4a0",
-  "workflows/harden.md": "56d7f8098f19c34bc581a49b5e4bacc42858606ebf1cc35c848bdfaca8744409",
-  "workflows/init.md": "d1e6ae9a98c30b2c3b46081c8195f524bcd8d3bc9004562d230b56c704fec02b",
-  "workflows/memory.md": "c034f9266380db3c05e9ffed943c2bb4ba73c060507e3508e47b543a035a5873",
-  "workflows/recheck.md": "106442712bfb87c6c1c9bc0ed660c6c291d4d6a0a6b860f4f93397440dba08d5",
-  "workflows/report.md": "35c7cc44d94ee49d8fea6b75ae7ea524790fd0e6208b5f27b84bc4fdab469b0c",
-  "workflows/status.md": "a14a92b8b4c30fdf9e9c073c51de4d0057f43519df03e9661117e62e65ac1d08",
-  "workflows/verify.md": "f96e8db92f067395d82f7ef8fd32c7c00e6c41ea1731347aadba2fbaed118cdf",
-  "workflows/web-validate.md": "5ef05154671582d95b2d05358f0a4f7ea52fe6ff3d3f238b732b3490925bc7f7"
+  "workflows/apply.md": "fde7e879db5879bc6c8e67b5bd40473065688bba91149a01f66ad4739f4c8443",
+  "workflows/audit.md": "b02a7d2536c81b35ab4519b7f9eda3396d08f09da581ef299dc8fed83b4c082d",
+  "workflows/authorize.md": "71b14c2ffa24b1ad511d019a7da86854bf1bf94c282f563e05e9ad3b8493e8ca",
+  "workflows/exploit-check.md": "01c0a51e4b12a9dbb1d4f2b28d0bb495d92f95b786f5f1df59467b8fc6c61855",
+  "workflows/harden.md": "e68a78c47a2c4ec1d65adb08104d2fa16eb0c4530cf9b78400fd147f2076fb95",
+  "workflows/init.md": "f71438745a7e8d59dcf2e1089f7c5ccf2340e7909e56e1257b24c8ca79353162",
+  "workflows/memory.md": "faf93f39917fb6d0da23f9794e8337e643fd0a240cc46ca702fef84e02f5b867",
+  "workflows/recheck.md": "426a719a9c4233a653daa8fe0265370492f3a17a422517f7930549c991d25c93",
+  "workflows/report.md": "2aad2cbf2ffc781355e1186bb28a29b3da5efbacc57c8f44c9976aa635f0b120",
+  "workflows/status.md": "f3445bbf90402df819472180d5ae251a17b4f491ea3402d74f134bf55c2bf570",
+  "workflows/verify.md": "48f37892d329287059492ffaebf7022253fd5515a0a1a3253799e5cea765a21a",
+  "workflows/web-validate.md": "4d81294432e4d06e6c21db9a517b7cf1052744df3d821ed947a7751acb4fe39f"
 }

package/skills/torusguard/payload/rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md

@@ -1,37 +1,53 @@
 # TG-BIZ-001: Client-Controlled Sensitive Business Value
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. Relying on client-submitted values for critical financial, authorization, or pricing attributes allows malicious users to manipulate monetary amounts, discounts, or permissions.
 
 ## Applies To
-- Relevant endpoints and services
+- E-Commerce Checkout, Payment Handlers, Subscription APIs
+- Node.js (Express, NestJS, Next.js), Python (FastAPI, Django, Flask), Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When client requests directly dictate sensitive pricing or balance fields (such as `amount`, `unit_price`, `discount_percent`, or `credit_balance`), attackers can tamper with request payloads to purchase items at arbitrary prices ($0.01) or grant themselves unearned credits.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Destructuring sensitive price or discount attributes directly from `req.body` or `request.data` into payment gateways or order creation queries.
+- Absence of server-side database lookup for product prices prior to charge generation.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Directly trusting price and amount from client payload
+app.post('/api/checkout', async (req, res) => {
+  const { productId, price, quantity } = req.body;
+  const total = price * quantity; // Attacker sends price: 0.01
+  await paymentGateway.charge({ amount: total });
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Fetching canonical price from authoritative server database
+app.post('/api/checkout', async (req, res) => {
+  const { productId, quantity } = req.body;
+  const product = await db.product.findUnique({ where: { id: productId } });
+  if (!product) return res.status(404).json({ error: 'Product not found' });
+  const total = product.price * quantity;
+  await paymentGateway.charge({ amount: total });
+});
 ```
 
+## Ponytail Remediation Budget
+- Additions: <= 12 lines
+- Deletions: <= 4 lines
+
 ## Remediation
-1. Step one
-2. Step two
+1. Remove sensitive pricing and discount parameters from incoming client request schemas.
+2. Query the authoritative server database or catalog for the verified unit price.
+3. Calculate subtotal, taxes, and final charge amounts exclusively on the trusted server.
 
 ## Verification
-- Test case 1
-- Test case 2
-
-## False Positives and Exceptions
-An exception requires documented review.
+- Submit a checkout payload with `price: 0.01` and verify the server rejects or ignores the parameter and bills the canonical catalog price.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-INPUT-001`: Missing Request Body Validation Schema
+- `TG-BIZ-004`: Unrestricted Sensitive Business Workflow

package/skills/torusguard/payload/rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md

@@ -1,37 +1,54 @@
 # TG-BIZ-002: Replayable One-Time Operation
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Lack of idempotent tokens, nonces, or single-use consumption flags allows attackers or network retries to execute financial charges, coupon redemptions, or password resets multiple times.
 
 ## Applies To
-- Relevant endpoints and services
+- Coupon Redemptions, Financial Transfers, Voucher APIs, Password Reset Consumptions
+- Node.js, Python, Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Transient network glitches, automated retry loops, or intentional race condition attacks (TOCTOU) can submit duplicate requests. Without single-use atomic locking, a user can redeem a $50 gift card 10 times concurrently.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- State-changing transaction handlers lacking idempotency keys, single-use nonce validation, or atomic database lock transactions (`SELECT ... FOR UPDATE`).
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```python
+# UNSAFE: Checking balance and deducting without atomic idempotency lock
+@app.post("/api/redeem-coupon")
+def redeem_coupon(code: str, user_id: str):
+    coupon = db.query(Coupon).filter_by(code=code, used=False).first()
+    if coupon:
+        apply_credit(user_id, coupon.amount)
+        coupon.used = True
+        db.commit()
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```python
+# SAFE: Atomic database update with idempotency check
+@app.post("/api/redeem-coupon")
+def redeem_coupon(code: str, user_id: str, idempotency_key: str):
+    with db.begin():
+        rows = db.query(Coupon).filter_by(code=code, used=False).update({"used": True})
+        if rows == 0:
+            raise HTTPException(status_code=400, detail="Coupon already redeemed")
+        apply_credit(user_id, coupon.amount)
 ```
 
+## Ponytail Remediation Budget
+- Additions: <= 14 lines
+- Deletions: <= 5 lines
+
 ## Remediation
-1. Step one
-2. Step two
+1. Require an `Idempotency-Key` header on all sensitive mutations.
+2. Execute state-changing consumption operations inside atomic database transactions with row-level locks.
+3. Mark vouchers or tokens as `consumed` in the same atomic operation before dispatching external side-effects.
 
 ## Verification
-- Test case 1
-- Test case 2
-
-## False Positives and Exceptions
-An exception requires documented review.
+- Send 5 concurrent identical redemption requests with the same coupon code; assert exactly 1 succeeds (200 OK) and 4 fail (400/409 Conflict).
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-WEBHOOK-003`: Missing Webhook Idempotency
+- `TG-BIZ-003`: Missing Workflow State Validation

package/skills/torusguard/payload/rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md

@@ -1,37 +1,53 @@
-# TG-BIZ-003: Missing Workflow-State Validation
+# TG-BIZ-003: Missing Workflow State Validation
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Skipping validation of intermediate business lifecycle states allows users to bypass mandatory verification, payment, or approval steps.
 
 ## Applies To
-- Relevant endpoints and services
+- Order Processing, Multi-Step Onboarding, Approval Pipelines, KYC Verification
+- Node.js, Python, Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When endpoints assume prerequisite stages were completed without strictly querying the current entity state, malicious actors can invoke late-stage endpoints directly (e.g. calling `/api/orders/{id}/fulfill` on an order whose state is `PENDING_PAYMENT`).
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- State transitions (`status = 'SHIPPED'`, `status = 'APPROVED'`) executed without asserting that current status matches required prior state (`where: { status: 'PAID' }`).
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Transitioning order to fulfilled without checking current status
+app.post('/api/orders/:id/fulfill', async (req, res) => {
+  await db.order.update({
+    where: { id: req.params.id },
+    data: { status: 'FULFILLED' }
+  });
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Atomic conditional transition verifying prerequisite state
+app.post('/api/orders/:id/fulfill', async (req, res) => {
+  const result = await db.order.updateMany({
+    where: { id: req.params.id, status: 'PAID' },
+    data: { status: 'FULFILLED' }
+  });
+  if (result.count === 0) return res.status(400).json({ error: 'Order not ready for fulfillment' });
+});
 ```
 
+## Ponytail Remediation Budget
+- Additions: <= 10 lines
+- Deletions: <= 4 lines
+
 ## Remediation
-1. Step one
-2. Step two
+1. Define a strict state machine with allowable transitions.
+2. Enforce atomic conditional updates asserting the expected source state.
+3. Return 400 or 409 errors when an invalid transition is attempted.
 
 ## Verification
-- Test case 1
-- Test case 2
-
-## False Positives and Exceptions
-An exception requires documented review.
+- Attempt to fulfill an unpaid order; confirm 400 rejection.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-BIZ-001`: Client-Controlled Sensitive Business Value
+- `TG-AUTH-003`: Missing Object-Level Authorization