torusguard 1.3.4 → 1.3.6

package/skills/torusguard-recheck/SKILL.md

@@ -1,77 +1,81 @@
----
-name: torusguard-recheck
-description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions via CLI or AI Agent.
-version: 1.3.4
-workflow: .torusguard/workflows/recheck.md
-tools: Read, Grep, Glob, Write, run_command
-scripts-binding:
-  - .torusguard/scripts/recheck_runner.py
-  - .torusguard/scripts/audit_runner.py
-  - .torusguard/scripts/memory_engine.py
-  - .torusguard/scripts/term_ui.py
----
-
-# TorusGuard Recheck — Targeted Differential Audit & Fix Closure
-
-## Objective
-Execute differential security re-scans strictly scoped to modified files and adjacent boundaries, verifying that targeted vulnerability patterns have been eliminated and asserting zero security regressions.
-
----
-
-## Two Execution Modes
-
-### Mode A: Automated CLI Execution
-Run the differential recheck engine from the terminal:
-```bash
-# Recheck the latest applied run
-npx torusguard recheck
-
-# Recheck a specific project directory
-npx torusguard recheck ./my-project
-
-# Recheck a specific run ID
-npx torusguard recheck --run run-20260910-121618-audit
-
-# Machine-readable JSON output
-npx torusguard recheck --json
-```
-**Under the Hood:** Executes `python .torusguard/scripts/recheck_runner.py`.
-- Evaluates applied candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
-- Executes single-file targeted differential AST scans via `audit_runner.scan_file()`.
-- Calculates formal status transitions:
-  - `✔ [Confirmed Fixed]`: Vulnerable pattern absent, zero regressions.
-  - `✖ [Regressed]`: New security finding introduced by patch.
-  - `⚠ [Unresolved]`: Vulnerable sink still present.
-- Emits run-level transition artifact: `.torusguard/runs/<run_id>/recheck.md`.
-- Synchronizes verification telemetry to `.torusguard/memory/events.json`.
-- Displays 75-column terminal cards.
-
-### Mode B: In-Session AI Chat Agent Differential Scan
-When evaluating patches directly in AI chat:
-1. **Identify Modified Files:** Read `diff_summary.md` or git status for files modified in the active run.
-2. **Re-Scan Sinks:** View the target file and verify that the specific rule violation (e.g. `TG-INPUT-003`, `TG-PLATFORM-001`) is no longer triggered.
-3. **Assert Zero Regressions:** Verify that no new vulnerabilities (like raw concatenation or unvalidated input) were introduced by the fix.
-4. **Update Status:** Log outcome in `.torusguard/runs/<run_id>/recheck.md`.
-5. **Memory Telemetry:** Record verification event with `memory_engine.record_event("fix_verified", ...)`.
-
----
-
-## Recheck Status Transitions
-| Outcome | Visual Indicator | Meaning | Required Action |
-| :--- | :--- | :--- | :--- |
-| **Confirmed Fixed** | `✔ [Confirmed Fixed]` | Sink eliminated, zero regressions | Proceed to Posture Report |
-| **Unresolved** | `⚠ [Unresolved]` | Flaw still present in file | Re-harden with alternative pattern |
-| **Regressed** | `✖ [Regressed]` | New security flaw introduced | Instant `npx torusguard rollback` |
-
----
-
-## Output Card Format
-```markdown
-### ✅ TorusGuard Differential Recheck Completed
-- **Run ID:** `run-20260910-121618-audit`
-- **Confirmed Fixed:** 2 vulnerabilities verified closed
-- **Regressions:** 0 detected
-- **Unresolved:** 0
-- **Artifact:** `.torusguard/runs/<run_id>/recheck.md`
-- **Next Step:** Run `npx torusguard report --html` for visual dashboard
-```
+---
+name: torusguard-recheck
+description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions via CLI or AI Agent.
+version: 1.3.6
+workflow: .torusguard/workflows/recheck.md
+tools: Read, Grep, Glob, Write, run_command
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/recheck_runner.py
+  - .torusguard/scripts/audit_runner.py
+  - .torusguard/scripts/memory_engine.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# TorusGuard Recheck — Targeted Differential Audit & Fix Closure
+
+## Objective
+Execute differential security re-scans strictly scoped to modified files and adjacent boundaries, verifying that targeted vulnerability patterns have been eliminated and asserting zero security regressions.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution
+Run the differential recheck engine from the terminal:
+```bash
+# Recheck the latest applied run
+npx torusguard recheck
+
+# Recheck a specific project directory
+npx torusguard recheck ./my-project
+
+# Recheck a specific run ID
+npx torusguard recheck --run run-20260910-121618-audit
+
+# Machine-readable JSON output
+npx torusguard recheck --json
+```
+**Under the Hood:** Executes `python .torusguard/scripts/recheck_runner.py`.
+- Evaluates applied candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
+- Executes single-file targeted differential AST scans via `audit_runner.scan_file()`.
+- Calculates formal status transitions:
+  - `✔ [Confirmed Fixed]`: Vulnerable pattern absent, zero regressions.
+  - `✖ [Regressed]`: New security finding introduced by patch.
+  - `⚠ [Unresolved]`: Vulnerable sink still present.
+- Emits run-level transition artifact: `.torusguard/runs/<run_id>/recheck.md`.
+- Synchronizes verification telemetry to `.torusguard/memory/events.json`.
+- Displays 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Differential Scan
+When evaluating patches directly in AI chat:
+1. **Identify Modified Files:** Read `diff_summary.md` or git status for files modified in the active run.
+2. **Re-Scan Sinks:** View the target file and verify that the specific rule violation (e.g. `TG-INPUT-003`, `TG-PLATFORM-001`) is no longer triggered.
+3. **Assert Zero Regressions:** Verify that no new vulnerabilities (like raw concatenation or unvalidated input) were introduced by the fix.
+4. **Update Status:** Log outcome in `.torusguard/runs/<run_id>/recheck.md`.
+5. **Memory Telemetry:** Record verification event with `memory_engine.record_event("fix_verified", ...)`.
+
+---
+
+## Recheck Status Transitions
+| Outcome | Visual Indicator | Meaning | Required Action |
+| :--- | :--- | :--- | :--- |
+| **Confirmed Fixed** | `✔ [Confirmed Fixed]` | Sink eliminated, zero regressions | Proceed to Posture Report |
+| **Unresolved** | `⚠ [Unresolved]` | Flaw still present in file | Re-harden with alternative pattern |
+| **Regressed** | `✖ [Regressed]` | New security flaw introduced | Instant `npx torusguard rollback` |
+
+---
+
+## Output Card Format
+```markdown
+### ✅ TorusGuard Differential Recheck Completed
+- **Run ID:** `run-20260910-121618-audit`
+- **Confirmed Fixed:** 2 vulnerabilities verified closed
+- **Regressions:** 0 detected
+- **Unresolved:** 0
+- **Artifact:** `.torusguard/runs/<run_id>/recheck.md`
+- **Next Step:** Run `npx torusguard report --html` for visual dashboard
+```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-report/SKILL.md

@@ -1,72 +1,93 @@
----
-name: torusguard-report
-description: Generate executive posture reports, export OASIS SARIF v2.1.0 logs, and render dark-mode HTML dashboards via CLI or AI Agent.
-version: 1.3.4
-workflow: .torusguard/workflows/report.md
-tools: Read, Grep, Glob, Write, run_command
-scripts-binding:
-  - .torusguard/scripts/html_reporter.py
-  - .torusguard/scripts/sarif_exporter.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/term_ui.py
----
-
-# TorusGuard Report — Posture Reporting & SARIF / HTML Export
-
-## Objective
-Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports.
-
----
-
-## Two Execution Modes
-
-### Mode A: Automated CLI Execution
-Run the report engine from your terminal:
-```bash
-# Generate visual dark-mode HTML dashboard
-npx torusguard report --html
-
-# Export OASIS SARIF v2.1.0 for GitHub Code Scanning / CI
-npx torusguard report --sarif
-
-# Generate both HTML and SARIF for latest run
-npx torusguard report --html --sarif
-
-# Generate report for a specific project directory
-npx torusguard report ./examples/vulnerable-react-express --html
-
-# Target a specific run ID
-npx torusguard report --run run-20260910-121618-audit --html
-```
-**Under the Hood:**
-- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, and cluster summaries at `.torusguard/runs/<run_id>/report.html`.
-- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/<run_id>/results.sarif`.
-- Finalizes `manifest.json` metrics and updates historical posture scoring.
-- Displays 75-column terminal cards.
-
-### Mode B: In-Session AI Chat Agent Reporting
-When generating security posture summaries in AI chat:
-1. **Aggregate Run Data:** Inspect `findings.json`, `remediation.md`, and `recheck.md` from the active run.
-2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2).
-3. **Format Executive Card:** Present finding counts, closed vulnerabilities, remaining risks, and compliance posture.
-4. **Export Artifacts:** Verify that `report.html` and `results.sarif` are serialized to disk.
-
----
-
-## SARIF v2.1.0 Specification
-- **Schema:** `https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`
-- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.3`, full rules catalog in `driver.rules`.
-- **Automation Details:** `automationDetails.id: "torusguard/static"` to avoid collisions in multi-scanner CI/CD pipelines.
-- **Fingerprints:** `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
-
----
-
-## Output Card Format
-```markdown
-### 📊 TorusGuard Security Posture Report Emitted
-- **Run ID:** `run-20260910-121618-audit`
-- **Posture Score:** 85 / 100 (HIGH SECURITY)
-- **Findings Summary:** 3 Evaluated · 2 Confirmed Fixed · 1 Unresolved
-- **HTML Dashboard:** `.torusguard/runs/<run_id>/report.html` (View in browser)
-- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif` (Ready for CI)
-```
+---
+name: torusguard-report
+description: Generate executive posture reports, export OASIS SARIF v2.1.0 logs, and render dark-mode HTML dashboards via CLI or AI Agent.
+version: 2.2.0
+workflow: .torusguard/workflows/report.md
+tools: Read, Grep, Glob, Write, run_command
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/html_reporter.py
+  - .torusguard/scripts/sarif_exporter.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# TorusGuard Report — Posture Reporting & SARIF / HTML Export
+
+## Objective
+Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports with full dual-mode parity.
+
+---
+
+## Execution Steps
+
+### Mode A: Automated CLI Execution
+Run the report engine from your terminal:
+```bash
+# Generate visual dark-mode HTML dashboard (defaults to report.html at project root)
+npx torusguard report --html
+
+# Export OASIS SARIF v2.1.0 for GitHub Code Scanning / CI
+npx torusguard report --sarif
+
+# Generate both HTML and SARIF in a single pass
+npx torusguard report --html --sarif
+
+# Custom HTML output location
+npx torusguard report --html --out ./docs/security-audit.html
+
+# Target a specific subproject / monorepo package
+npx torusguard report --target ./apps/api --html
+```
+
+**Under the Hood:**
+- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, directory attack surface heatmap, and golden recipe explorer at `report.html` (workspace root) and mirrors to `.torusguard/runs/report-latest.html`.
+- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/results-latest.sarif`.
+- Finalizes `manifest.json` metrics and updates historical posture scoring.
+- Displays standardized 75-column terminal cards adhering to visual width invariants.
+
+### Mode B: In-Session AI Chat Agent Reporting
+When generating security posture summaries in AI chat:
+1. **Aggregate Run Data:** Inspect `findings.json`, `remediation.md`, and `recheck.md` from the active run.
+2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2). Clean repositories earn 100/100 across 74 defended invariants.
+3. **Format Executive Card:** Present finding counts, closed vulnerabilities, remaining risks, and compliance posture.
+4. **Export Artifacts:** Verify that `report.html` and `results-latest.sarif` are serialized to disk.
+5. **Keep Living Ledger in Lockstep:** Ensure `security_report.md` reflects all findings and verified closures.
+
+---
+
+## Zero-CDN & Offline Guarantee
+- Zero external `<script>` or `<link>` tags. All styles, fonts, SVG icons, and scripts are embedded directly inside `report.html`.
+- Full offline inspection: can be opened directly via `file:///` without an active internet connection.
+- In-browser artifact downloads (SARIF v2.1.0 and CSV) use native `URL.createObjectURL(new Blob(...))` with zero network calls.
+
+---
+
+## SARIF v2.1.0 Output Specification
+- **Schema:** `https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.6`, full rules catalog in `driver.rules`.
+- **Automation Details:** `automationDetails.id: "torusguard/static"` to avoid collisions in multi-scanner CI/CD pipelines.
+- **Fingerprints:** `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
+
+---
+
+## Safety Constraints
+- Never display raw secrets, tokens, or credentials in terminal outputs or emitted reports.
+- Enforce read-only state for `report` actions — never modify source code during report generation.
+- Ensure atomic writes with fallback retry to prevent corrupt reports during concurrent browser viewing.
+- Respect monorepo target boundaries when `--target` is specified.
+
+---
+
+## Output Format
+```markdown
+### 🛡️ TorusGuard Security Posture Report Emitted
+- **Posture Score:** 100 / 100 (OPTIMAL DEFENSE)
+- **Invariants Defended:** 74 Defended · 0 Harmed (74 Rules)
+- **HTML Dashboard:** `report.html` (View in browser)
+- **SARIF v2.1.0 Export:** `.torusguard/runs/results-latest.sarif` (Ready for CI)
+- **Living Ledger:** `security_report.md` (Synchronized in lockstep)
+```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-status/SKILL.md

@@ -1,58 +1,62 @@
----
-name: torusguard-status
-description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
-version: 1.3.4
-workflow: .torusguard/workflows/status.md
-tools: Read, Grep, Glob, run_command
-scripts-binding:
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/term_ui.py
----
-
-# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
-
-## Objective
-Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
-
----
-
-## Two Execution Modes
-
-### Mode A: Automated CLI Execution
-Run the diagnostic overview from your terminal:
-```bash
-# Display 75-column status cards
-npx torusguard status
-
-# Check status of specific project directory
-npx torusguard status ./examples/vulnerable-react-express
-
-# Output machine-readable JSON
-npx torusguard status --json
-```
-**Under the Hood:**
-- Evaluates `.torusguard/config/torusguard.json` for initialized status and detected stack.
-- Enumerates active rules in `.torusguard/rules/active/` (or canonical 71 rules).
-- Scans `.torusguard/runs/` for run history, finding counts, and verified fixes.
-- Inspects `.torusguard/config/scope.json` for authorized runtime validation targets.
-- Displays mathematically aligned 75-column terminal cards.
-
-### Mode B: In-Session AI Chat Agent Status Check
-When checking workspace status in AI chat:
-1. **Verify Workspace Setup:** Check if `.torusguard/` exists on disk.
-2. **Inspect Active Config:** Read `.torusguard/config/torusguard.json` for detected stack, framework, and rules.
-3. **Inspect Latest Run:** Find the latest run directory under `.torusguard/runs/` and read `manifest.json`.
-4. **Inspect Memory Engine:** Check `.torusguard/memory/patterns.json` for captured Golden Fix Recipes.
-5. **Render Diagnostic Card:** Present an overview of posture, stack, and recommended next steps.
-
----
-
-## Output Card Format
-```markdown
-### 🛡️ TorusGuard Workspace Status Overview
-- **Version:** v1.3.3 | **Stack:** Node.js / React / Express
-- **Active Rules:** 71 canonical security rules enabled
-- **Historical Runs:** 3 runs recorded
-- **Golden Recipes:** 4 distilled into persistent memory
-- **Overall Posture:** SECURE (All targeted vulnerabilities verified closed)
-```
+---
+name: torusguard-status
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
+version: 1.3.6
+workflow: .torusguard/workflows/status.md
+tools: Read, Grep, Glob, run_command, Write
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
+
+## Objective
+Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution
+Run the diagnostic overview from your terminal:
+```bash
+# Display 75-column status cards
+npx torusguard status
+
+# Check status of specific project directory
+npx torusguard status ./examples/vulnerable-react-express
+
+# Output machine-readable JSON
+npx torusguard status --json
+```
+**Under the Hood:**
+- Evaluates `.torusguard/config/torusguard.json` for initialized status and detected stack.
+- Enumerates active rules in `.torusguard/rules/active/` (or canonical 74 rules).
+- Scans `.torusguard/runs/` for run history, finding counts, and verified fixes.
+- Inspects `.torusguard/config/scope.json` for authorized runtime validation targets.
+- Displays mathematically aligned 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Status Check
+When checking workspace status in AI chat:
+1. **Verify Workspace Setup:** Check if `.torusguard/` exists on disk.
+2. **Inspect Active Config:** Read `.torusguard/config/torusguard.json` for detected stack, framework, and rules.
+3. **Inspect Latest Run:** Find the latest run directory under `.torusguard/runs/` and read `manifest.json`.
+4. **Inspect Memory Engine:** Check `.torusguard/memory/patterns.json` for captured Golden Fix Recipes.
+5. **Render Diagnostic Card:** Present an overview of posture, stack, and recommended next steps.
+
+---
+
+## Output Card Format
+```markdown
+### 🛡️ TorusGuard Workspace Status Overview
+- **Version:** v1.3.3 | **Stack:** Node.js / React / Express
+- **Active Rules:** 74 canonical security rules enabled
+- **Historical Runs:** 3 runs recorded
+- **Golden Recipes:** 4 distilled into persistent memory
+- **Overall Posture:** SECURE (All targeted vulnerabilities verified closed)
+```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/skills/torusguard-verify/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 1.3.4
+version: 1.3.6
 workflow: .torusguard/workflows/verify.md
-tools: Read, Grep, Glob, Write
+tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/finding_scorer.py
 ---
 
@@ -39,6 +40,10 @@ A finding is verified as sufficient when:
 
 ---
 
+## Living Report Ground Truth
+- Always inspect `security_report.md` at workspace root before acting.
+- Update finding statuses after completion to eliminate hallucination.
+
 ## Safety Constraints
 - Read-only analysis; no files are modified.
 - Never guess line numbers; always verify via active disk read.

package/skills/torusguard-web-validate/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 1.3.4
+version: 1.3.6
 workflow: .torusguard/workflows/web-validate.md
-tools: Read, Grep, Glob, Bash, Write
+tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:
+  - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/safety_gate.py
 ---
 
@@ -48,6 +49,10 @@ All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk s
 
 ---
 
+## Living Report Ground Truth
+- Always inspect `security_report.md` at workspace root before acting.
+- Update finding statuses after completion to eliminate hallucination.
+
 ## Safety Constraints
 - Max 50 requests per validation session.
 - Never test unauthorized domains or third-party APIs.