torusguard 1.3.4 → 1.3.6

package/.torusguard/scripts/term_ui.py

@@ -1,162 +1,162 @@
-#!/usr/bin/env python3
-"""
-TorusGuard Unified Terminal UI Engine (v1.3.3)
-Provides mathematically exact 75-column card formatting, ANSI-stripping,
-Unicode/emoji visual width calculation, and visual truncation with ellipsis.
-Pure Python 3.10+ standard library (zero external dependencies).
-"""
-
-import sys
-import os
-import re
-import unicodedata
-from typing import Optional
-
-# Ensure UTF-8 stdout/stderr on Windows consoles
-if sys.stdout and hasattr(sys.stdout, "reconfigure"):
-    try:
-        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
-    except Exception:
-        pass
-if sys.stderr and hasattr(sys.stderr, "reconfigure"):
-    try:
-        getattr(sys.stderr, "reconfigure")(encoding="utf-8", errors="replace")
-    except Exception:
-        pass
-
-# ─── ANSI Colors & Styles ─────────────────────────────────────────────────────
-BOLD = "\033[1m"
-DIM = "\033[2m"
-RESET = "\033[0m"
-CYAN = "\033[36m"
-GREEN = "\033[32m"
-YELLOW = "\033[33m"
-WHITE = "\033[97m"
-GRAY = "\033[90m"
-RED = "\033[31m"
-MAGENTA = "\033[35m"
-BG_GREEN = "\033[42m"
-BG_CYAN = "\033[46m"
-
-ANSI_REGEX = re.compile(r'\x1b\[[0-9;]*m|\033\[[0-9;]*m')
-
-def strip_ansi(text: str) -> str:
-    """Remove all ANSI color and style escape sequences."""
-    return ANSI_REGEX.sub('', text)
-
-def get_visual_width(text: str) -> int:
-    """
-    Calculate the printable display width of a string in terminal columns.
-    Accounts for ANSI escapes, Unicode variation selectors, emojis, and fullwidth chars.
-    """
-    clean = strip_ansi(text)
-    width = 0
-    for ch in clean:
-        cp = ord(ch)
-        # Variation selectors (VS1-16, VS17-256) occupy 0 terminal columns
-        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF):
-            continue
-        # Zero-width spaces, joiners, soft hyphens
-        if cp in (0x200B, 0x200C, 0x200D, 0x00AD):
-            continue
-        ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif cp >= 0x1F300: # Emojis and miscellaneous pictographs
-            width += 2
-        elif cp in (0x26A0, 0x2714, 0x2716, 0x2139): # ⚠, ✔, ✖, ℹ
-            width += 1
-        else:
-            width += 1
-    return width
-
-def truncate_visual(text: str, max_w: int = 67) -> str:
-    """Truncate text visually to max_w columns without breaking ANSI escape codes."""
-    if get_visual_width(text) <= max_w:
-        return text
-    out = []
-    curr_w = 0
-    in_ansi = False
-    ansi_buf = ''
-    for ch in text:
-        if ch in ('\033', '\x1b'):
-            in_ansi = True
-            ansi_buf = ch
-            continue
-        if in_ansi:
-            ansi_buf += ch
-            if ch == 'm':
-                in_ansi = False
-                out.append(ansi_buf)
-            continue
-        cp = ord(ch)
-        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
-            out.append(ch)
-            continue
-        ea = unicodedata.east_asian_width(ch)
-        cw = 2 if (ea in ('W', 'F') or cp >= 0x1F300) else 1
-        if curr_w + cw > max_w - 3:
-            out.append(RESET + '...')
-            curr_w += 3
-            break
-        out.append(ch)
-        curr_w += cw
-    out.append(RESET)
-    return ''.join(out)
-
-def format_box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
-    """
-    Pad content so the card line is strictly 75 visual columns total width.
-    Layout: '  ' (2) + border (1) + '  ' (2) + content/pad (width=67) + '  ' (2) + border (1) = 75 cols.
-    """
-    trunc = truncate_visual(content, width)
-    vis = get_visual_width(trunc)
-    pad = " " * max(0, width - vis)
-    return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
-
-def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
-    """Generate 75-column top border (single ┌ or double ╔) with optional title."""
-    left = "╔" if double else "┌"
-    right = "╗" if double else "┐"
-    h = "═" if double else "─"
-    if title:
-        vis = get_visual_width(title)
-        rem = max(0, 68 - vis)
-        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
-    return f"  {border_color}{left}{h * 71}{right}{RESET}"
-
-def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
-    """Generate 75-column bottom border (single └ or double ╚)."""
-    left = "╚" if double else "└"
-    right = "╝" if double else "┘"
-    h = "═" if double else "─"
-    return f"  {border_color}{left}{h * 71}{right}{RESET}"
-
-def card_divider(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
-    """Generate 75-column divider (single ├ or double ╠) with optional title."""
-    left = "╠" if double else "├"
-    right = "╣" if double else "┤"
-    h = "═" if double else "─"
-    if title:
-        vis = get_visual_width(title)
-        rem = max(0, 68 - vis)
-        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
-    return f"  {border_color}{left}{h * 71}{right}{RESET}"
-
-def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
-    """Generate standardized 75-column curved header box."""
-    top = f"  {border_color}╭{'─' * 71}╮{RESET}"
-    bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
-    empty = f"  {border_color}│{' ' * 71}│{RESET}"
-
-    # Calculate padding between title and version
-    title_vis = get_visual_width(title)
-    ver_vis = get_visual_width(version)
-    space_count = max(1, 67 - title_vis - ver_vis)
-    title_str = f"{BOLD}{WHITE}{title}{RESET}{' ' * space_count}{GRAY}{version}{RESET}"
-
-    lines = [top, empty, format_box_line(title_str, width=67, border_color=border_color)]
-    if subtitle:
-        lines.append(format_box_line(f"{DIM}{subtitle}{RESET}", width=67, border_color=border_color))
-    lines.extend([empty, bottom])
-    return "\n".join(lines)
+#!/usr/bin/env python3
+"""
+TorusGuard Unified Terminal UI Engine (v1.3.6)
+Provides mathematically exact 75-column card formatting, ANSI-stripping,
+Unicode/emoji visual width calculation, and visual truncation with ellipsis.
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import os
+import re
+import unicodedata
+from typing import Optional
+
+# Ensure UTF-8 stdout/stderr on Windows consoles
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+if sys.stderr and hasattr(sys.stderr, "reconfigure"):
+    try:
+        getattr(sys.stderr, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── ANSI Colors & Styles ─────────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+MAGENTA = "\033[35m"
+BG_GREEN = "\033[42m"
+BG_CYAN = "\033[46m"
+
+ANSI_REGEX = re.compile(r'\x1b\[[0-9;]*m|\033\[[0-9;]*m')
+
+def strip_ansi(text: str) -> str:
+    """Remove all ANSI color and style escape sequences."""
+    return ANSI_REGEX.sub('', text)
+
+def get_visual_width(text: str) -> int:
+    """
+    Calculate the printable display width of a string in terminal columns.
+    Accounts for ANSI escapes, Unicode variation selectors, emojis, and fullwidth chars.
+    """
+    clean = strip_ansi(text)
+    width = 0
+    for ch in clean:
+        cp = ord(ch)
+        # Variation selectors (VS1-16, VS17-256) occupy 0 terminal columns
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF):
+            continue
+        # Zero-width spaces, joiners, soft hyphens
+        if cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            continue
+        ea = unicodedata.east_asian_width(ch)
+        if ea in ('W', 'F'):
+            width += 2
+        elif cp >= 0x1F300: # Emojis and miscellaneous pictographs
+            width += 2
+        elif cp in (0x26A0, 0x2714, 0x2716, 0x2139): # ⚠, ✔, ✖, ℹ
+            width += 1
+        else:
+            width += 1
+    return width
+
+def truncate_visual(text: str, max_w: int = 67) -> str:
+    """Truncate text visually to max_w columns without breaking ANSI escape codes."""
+    if get_visual_width(text) <= max_w:
+        return text
+    out = []
+    curr_w = 0
+    in_ansi = False
+    ansi_buf = ''
+    for ch in text:
+        if ch in ('\033', '\x1b'):
+            in_ansi = True
+            ansi_buf = ch
+            continue
+        if in_ansi:
+            ansi_buf += ch
+            if ch == 'm':
+                in_ansi = False
+                out.append(ansi_buf)
+            continue
+        cp = ord(ch)
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            out.append(ch)
+            continue
+        ea = unicodedata.east_asian_width(ch)
+        cw = 2 if (ea in ('W', 'F') or cp >= 0x1F300) else 1
+        if curr_w + cw > max_w - 3:
+            out.append(RESET + '...')
+            curr_w += 3
+            break
+        out.append(ch)
+        curr_w += cw
+    out.append(RESET)
+    return ''.join(out)
+
+def format_box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    """
+    Pad content so the card line is strictly 75 visual columns total width.
+    Layout: '  ' (2) + border (1) + '  ' (2) + content/pad (width=67) + '  ' (2) + border (1) = 75 cols.
+    """
+    trunc = truncate_visual(content, width)
+    vis = get_visual_width(trunc)
+    pad = " " * max(0, width - vis)
+    return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
+
+def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column top border (single ┌ or double ╔) with optional title."""
+    left = "╔" if double else "┌"
+    right = "╗" if double else "┐"
+    h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column bottom border (single └ or double ╚)."""
+    left = "╚" if double else "└"
+    right = "╝" if double else "┘"
+    h = "═" if double else "─"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_divider(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column divider (single ├ or double ╠) with optional title."""
+    left = "╠" if double else "├"
+    right = "╣" if double else "┤"
+    h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
+    """Generate standardized 75-column curved header box."""
+    top = f"  {border_color}╭{'─' * 71}╮{RESET}"
+    bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
+    empty = f"  {border_color}│{' ' * 71}│{RESET}"
+
+    # Calculate padding between title and version
+    title_vis = get_visual_width(title)
+    ver_vis = get_visual_width(version)
+    space_count = max(1, 67 - title_vis - ver_vis)
+    title_str = f"{BOLD}{WHITE}{title}{RESET}{' ' * space_count}{GRAY}{version}{RESET}"
+
+    lines = [top, empty, format_box_line(title_str, width=67, border_color=border_color)]
+    if subtitle:
+        lines.append(format_box_line(f"{DIM}{subtitle}{RESET}", width=67, border_color=border_color))
+    lines.extend([empty, bottom])
+    return "\n".join(lines)

package/.torusguard/skills/torusguard/SKILL.md

@@ -1,72 +1,75 @@
----
-name: torusguard
-description: Universal autonomous security engine: 71 canonical rules across 11 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
-version: 1.3.4
----
-
-# TorusGuard Master Security Engine & Command Router
-
-**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
-
----
-
-## Command Catalog: Terminal CLI & AI Chat Parity
-
-TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
-
-| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
-| :--- | :--- | :--- | :--- | :--- |
-| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
-| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
-| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
-| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
-| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
-| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
-| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
-| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
-| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
-| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
-| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
-| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
-| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
-| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
-| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
-
----
-
-## Non-Negotiable Invariants
-
-1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
-2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
-3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
-4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
-5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
-6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
-
----
-
-## Workspace Layout Structure
-```
-.torusguard/
-├── config/
-│   ├── torusguard.json          # Detected stack, settings, and rule counts
-│   └── scope.json               # Authorized runtime validation targets & TTL
-├── memory/
-│   ├── context.json             # Aggregated security memory context
-│   ├── patterns.json            # Distilled Golden Fix Recipes
-│   └── events.json              # Historical audit, apply, and recheck events
-├── rules/
-│   └── active/                  # Active TG-* rule definitions
-├── runs/
-│   └── run-YYYYMMDD-HHMMSS-audit/
-│       ├── findings.json        # Machine-readable AST findings
-│       ├── findings.md          # Actionable markdown finding cards
-│       ├── remediation.md       # Formulated candidate patch catalog
-│       ├── diff_summary.md      # Summary of applied diffs
-│       ├── recheck.md           # Differential recheck status transitions
-│       ├── report.html          # Single-file visual dark-mode HTML report
-│       ├── results.sarif        # OASIS SARIF v2.1.0 log
-│       └── bundles/             # Formulated Ponytail remediation bundles
-└── snapshots/
-    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
-```
+---
+name: torusguard
+description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
+version: 1.3.6
+---
+
+# TorusGuard Master Security Engine & Command Router
+
+**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
+
+---
+
+## Command Catalog: Terminal CLI & AI Chat Parity
+
+TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
+
+| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
+| :--- | :--- | :--- | :--- | :--- |
+| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
+| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
+| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
+| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
+| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
+| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
+| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
+| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
+| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
+| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
+| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
+| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
+| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
+| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
+| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
+
+---
+
+## Non-Negotiable Invariants
+
+1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
+2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
+3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
+4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
+5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
+6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
+
+---
+
+## Workspace Layout Structure
+```
+.torusguard/
+├── config/
+│   ├── torusguard.json          # Detected stack, settings, and rule counts
+│   └── scope.json               # Authorized runtime validation targets & TTL
+├── memory/
+│   ├── context.json             # Aggregated security memory context
+│   ├── patterns.json            # Distilled Golden Fix Recipes
+│   └── events.json              # Historical audit, apply, and recheck events
+├── rules/
+│   └── active/                  # Active TG-* rule definitions
+├── runs/
+│   └── run-YYYYMMDD-HHMMSS-audit/
+│       ├── findings.json        # Machine-readable AST findings
+│       ├── findings.md          # Actionable markdown finding cards
+│       ├── remediation.md       # Formulated candidate patch catalog
+│       ├── diff_summary.md      # Summary of applied diffs
+│       ├── recheck.md           # Differential recheck status transitions
+│       ├── report.html          # Single-file visual dark-mode HTML report
+│       ├── results.sarif        # OASIS SARIF v2.1.0 log
+│       └── bundles/             # Formulated Ponytail remediation bundles
+└── snapshots/
+    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
+```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.