torusguard 1.3.5 → 1.3.6

package/.torusguard/scripts/sarif_exporter.py

@@ -9,6 +9,7 @@ import sys
 import json
 import hashlib
 import argparse
+from pathlib import Path
 from typing import List, Dict, Any
 
 def generate_sarif(findings: List[Dict[str, Any]], run_id: str = "default", category: str = "torusguard/static") -> Dict[str, Any]:
@@ -76,7 +77,7 @@ def generate_sarif(findings: List[Dict[str, Any]], run_id: str = "default", cate
                 "tool": {
                     "driver": {
                         "name": "TorusGuard",
-                        "semanticVersion": "1.3.5",
+                        "semanticVersion": "1.3.6",
                         "informationUri": "https://github.com/githubmofo/TorusGuard",
                         "rules": list(rules_map.values())
                     }
@@ -95,22 +96,61 @@ def main():
     parser = argparse.ArgumentParser(description="TorusGuard SARIF v2.1.0 Exporter")
     parser.add_argument("--input", "-i", help="Path to findings JSON file")
     parser.add_argument("--output", "-o", help="Output path for sarif.json")
-    parser.add_argument("--run-id", default="run-default", help="Unique execution Run ID")
+    parser.add_argument("--root", "-r", help="Project root override")
+    parser.add_argument("--run-id", default=None, help="Unique execution Run ID")
+    parser.add_argument("--stdout", action="store_true", help="Print SARIF JSON to stdout")
     args = parser.parse_args()
 
+    root = Path(args.root).resolve() if args.root else Path.cwd().resolve()
     findings = []
+    run_id = args.run_id or "run-default"
+
     if args.input:
-        with open(args.input, "r", encoding="utf-8") as f:
-            findings = json.load(f)
+        in_path = Path(args.input)
+        if not in_path.is_absolute():
+            in_path = (root / in_path).resolve()
+        if in_path.is_file():
+            with open(in_path, "r", encoding="utf-8") as f:
+                findings = json.load(f)
+    else:
+        # Auto-discover latest audit run findings
+        runs_dir = root / ".torusguard" / "runs"
+        if runs_dir.is_dir():
+            run_folders = sorted(
+                [d for d in runs_dir.iterdir() if d.is_dir() and (d / "findings.json").is_file()],
+                key=lambda p: p.stat().st_mtime,
+                reverse=True
+            )
+            if run_folders:
+                latest_run = run_folders[0]
+                run_id = args.run_id or latest_run.name
+                findings_file = latest_run / "findings.json"
+                try:
+                    with open(findings_file, "r", encoding="utf-8") as f:
+                        findings = json.load(f)
+                except Exception:
+                    findings = []
 
-    sarif = generate_sarif(findings, run_id=args.run_id)
+    sarif = generate_sarif(findings, run_id=run_id)
 
     if args.output:
-        with open(args.output, "w", encoding="utf-8") as f:
+        out_path = Path(args.output)
+        if not out_path.is_absolute():
+            out_path = (root / out_path).resolve()
+        out_path.parent.mkdir(parents=True, exist_ok=True)
+        with open(out_path, "w", encoding="utf-8") as f:
             json.dump(sarif, f, indent=2)
-        print(f"SARIF log written to: {args.output}")
-    else:
+        print(f"[SUCCESS] SARIF log written to: {out_path}")
+    elif args.stdout:
         print(json.dumps(sarif, indent=2))
+    else:
+        # Default to writing in .torusguard/runs/results-latest.sarif
+        default_sarif = root / ".torusguard" / "runs" / "results-latest.sarif"
+        default_sarif.parent.mkdir(parents=True, exist_ok=True)
+        with open(default_sarif, "w", encoding="utf-8") as f:
+            json.dump(sarif, f, indent=2)
+        print(f"[SUCCESS] SARIF log written to: {default_sarif}")
+
 
 if __name__ == "__main__":
     main()

package/.torusguard/scripts/stack_detect.py

@@ -221,6 +221,24 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
                         "indicator": "Flask application instantiation"
                     })
                     profile["recommended_references"].append("flask-security.md")
+                elif "tornado" in content or "tornado.web" in content:
+                    add_to_list(profile, "languages_found", "Python")
+                    profile["ecosystem_family"] = "python"
+                    add_to_list(profile, "frameworks_found", "Tornado")
+                    profile["confidence"] = "Confirmed"
+                    profile["detection_evidence"].append({
+                        "file": str(py_file.relative_to(project_root)),
+                        "indicator": "Tornado application"
+                    })
+                elif "starlette" in content:
+                    add_to_list(profile, "languages_found", "Python")
+                    profile["ecosystem_family"] = "python"
+                    add_to_list(profile, "frameworks_found", "Starlette")
+                    profile["confidence"] = "Confirmed"
+                    profile["detection_evidence"].append({
+                        "file": str(py_file.relative_to(project_root)),
+                        "indicator": "Starlette application"
+                    })
 
                 if "sqlalchemy" in content:
                     add_to_list(profile, "data_layers_found", "SQLAlchemy")
@@ -286,11 +304,27 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
                 profile["confidence"] = "Confirmed"
                 profile["detection_evidence"].append({"file": "package.json", "indicator": "express dependency"})
                 profile["recommended_references"].append("express-security.md")
+            elif "fastify" in deps:
+                add_to_list(profile, "frameworks_found", "Fastify")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "fastify dependency"})
+            elif "koa" in deps:
+                add_to_list(profile, "frameworks_found", "Koa")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "koa dependency"})
+            elif "@remix-run/react" in deps or "@remix-run/node" in deps:
+                add_to_list(profile, "frameworks_found", "Remix")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "Remix dependency"})
             elif "react" in deps:
                 add_to_list(profile, "frameworks_found", "React / Vite")
                 profile["confidence"] = "Confirmed"
                 profile["detection_evidence"].append({"file": "package.json", "indicator": "react dependency"})
                 profile["recommended_references"].append("react-vite-security.md")
+            elif "vite" in deps:
+                add_to_list(profile, "frameworks_found", "Vite")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "vite dependency"})
 
             # ORM / Data layer detection
             if "@prisma/client" in deps or "prisma" in deps:
@@ -433,6 +467,8 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
 
         if "Microsoft.NET.Sdk.Web" in csproj_content or "Microsoft.AspNetCore" in csproj_content or "Swashbuckle" in csproj_content:
             add_to_list(profile, "frameworks_found", "ASP.NET Core")
+        if list(project_root.glob("**/*.razor")) or "Microsoft.AspNetCore.Components" in csproj_content or "blazor" in csproj_content.lower():
+            add_to_list(profile, "frameworks_found", "Blazor")
         if "Microsoft.EntityFrameworkCore" in csproj_content:
             add_to_list(profile, "data_layers_found", "Entity Framework Core")
         elif "Dapper" in csproj_content:
@@ -442,11 +478,17 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
     # G. PHP Ecosystem
     # -------------------------------------------------------------------------
     composer_json = project_root / "composer.json"
-    if composer_json.is_file():
+    is_wordpress = (project_root / "wp-config.php").is_file() or (project_root / "wp-load.php").is_file() or (project_root / "wp-content").is_dir()
+    if composer_json.is_file() or is_wordpress:
         add_to_list(profile, "languages_found", "PHP")
         profile["ecosystem_family"] = "php"
         profile["confidence"] = "Confirmed"
-        profile["detection_evidence"].append({"file": "composer.json", "indicator": "PHP Composer manifest"})
+        if is_wordpress:
+            add_to_list(profile, "frameworks_found", "WordPress")
+            add_to_list(profile, "data_layers_found", "MySQL / wpdb")
+            profile["detection_evidence"].append({"file": "wp-config.php" if (project_root / "wp-config.php").is_file() else "wp-content", "indicator": "WordPress installation"})
+        if composer_json.is_file():
+            profile["detection_evidence"].append({"file": "composer.json", "indicator": "PHP Composer manifest"})
         profile["recommended_rules"].extend(["TG-SEC-*", "TG-INPUT-001", "TG-INPUT-002", "TG-PLATFORM-*"])
         profile["recommended_references"].append("polyglot-security-matrix.md")
 

package/.torusguard/scripts/term_ui.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-TorusGuard Unified Terminal UI Engine (v1.3.5)
+TorusGuard Unified Terminal UI Engine (v1.3.6)
 Provides mathematically exact 75-column card formatting, ANSI-stripping,
 Unicode/emoji visual width calculation, and visual truncation with ellipsis.
 Pure Python 3.10+ standard library (zero external dependencies).

package/.torusguard/skills/torusguard/SKILL.md

@@ -1,72 +1,75 @@
----
-name: torusguard
-description: Universal autonomous security engine: 71 canonical rules across 11 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
-version: 1.3.4
----
-
-# TorusGuard Master Security Engine & Command Router
-
-**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
-
----
-
-## Command Catalog: Terminal CLI & AI Chat Parity
-
-TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
-
-| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
-| :--- | :--- | :--- | :--- | :--- |
-| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
-| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
-| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
-| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
-| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
-| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
-| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
-| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
-| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
-| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
-| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
-| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
-| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
-| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
-| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
-
----
-
-## Non-Negotiable Invariants
-
-1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
-2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
-3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
-4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
-5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
-6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
-
----
-
-## Workspace Layout Structure
-```
-.torusguard/
-├── config/
-│   ├── torusguard.json          # Detected stack, settings, and rule counts
-│   └── scope.json               # Authorized runtime validation targets & TTL
-├── memory/
-│   ├── context.json             # Aggregated security memory context
-│   ├── patterns.json            # Distilled Golden Fix Recipes
-│   └── events.json              # Historical audit, apply, and recheck events
-├── rules/
-│   └── active/                  # Active TG-* rule definitions
-├── runs/
-│   └── run-YYYYMMDD-HHMMSS-audit/
-│       ├── findings.json        # Machine-readable AST findings
-│       ├── findings.md          # Actionable markdown finding cards
-│       ├── remediation.md       # Formulated candidate patch catalog
-│       ├── diff_summary.md      # Summary of applied diffs
-│       ├── recheck.md           # Differential recheck status transitions
-│       ├── report.html          # Single-file visual dark-mode HTML report
-│       ├── results.sarif        # OASIS SARIF v2.1.0 log
-│       └── bundles/             # Formulated Ponytail remediation bundles
-└── snapshots/
-    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
-```
+---
+name: torusguard
+description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
+version: 1.3.6
+---
+
+# TorusGuard Master Security Engine & Command Router
+
+**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
+
+---
+
+## Command Catalog: Terminal CLI & AI Chat Parity
+
+TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
+
+| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
+| :--- | :--- | :--- | :--- | :--- |
+| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
+| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
+| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
+| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
+| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
+| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
+| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
+| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
+| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
+| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
+| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
+| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
+| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
+| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
+| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
+
+---
+
+## Non-Negotiable Invariants
+
+1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
+2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
+3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
+4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
+5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
+6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
+
+---
+
+## Workspace Layout Structure
+```
+.torusguard/
+├── config/
+│   ├── torusguard.json          # Detected stack, settings, and rule counts
+│   └── scope.json               # Authorized runtime validation targets & TTL
+├── memory/
+│   ├── context.json             # Aggregated security memory context
+│   ├── patterns.json            # Distilled Golden Fix Recipes
+│   └── events.json              # Historical audit, apply, and recheck events
+├── rules/
+│   └── active/                  # Active TG-* rule definitions
+├── runs/
+│   └── run-YYYYMMDD-HHMMSS-audit/
+│       ├── findings.json        # Machine-readable AST findings
+│       ├── findings.md          # Actionable markdown finding cards
+│       ├── remediation.md       # Formulated candidate patch catalog
+│       ├── diff_summary.md      # Summary of applied diffs
+│       ├── recheck.md           # Differential recheck status transitions
+│       ├── report.html          # Single-file visual dark-mode HTML report
+│       ├── results.sarif        # OASIS SARIF v2.1.0 log
+│       └── bundles/             # Formulated Ponytail remediation bundles
+└── snapshots/
+    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
+```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.

package/.torusguard/skills/torusguard-apply/SKILL.md

@@ -1,80 +1,84 @@
----
-name: torusguard-apply
-description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation via CLI or AI Agent.
-version: 1.3.4
-workflow: .torusguard/workflows/apply.md
-tools: Read, Grep, Glob, Write, replace_file_content, run_command
-scripts-binding:
-  - .torusguard/scripts/apply_runner.py
-  - .torusguard/scripts/term_ui.py
-  - .torusguard/scripts/memory_engine.py
----
-
-# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
-
-## Objective
-Safely apply approved remediation bundles to disk source files, creating an automated byte-for-byte pre-apply backup snapshot (`.bak`) in `.torusguard/snapshots/<run_id>/`, asserting syntax validity, and distilling passing patterns into Golden Fix Recipes.
-
----
-
-## Two Execution Modes
-
-### Mode A: Automated CLI Execution (Interactive or Non-Interactive)
-Run the governed patch applier from your terminal:
-```bash
-# Interactive Human Gate review (prompts for each patch: [y]es / [n]o / [a]ll / [q]uit)
-npx torusguard apply
-
-# Non-interactive automated application
-npx torusguard apply --yes
-
-# Apply patches from a specific run ID
-npx torusguard apply --run run-20260910-121618-audit --yes
-
-# Emergency rollback from pre-apply snapshot
-npx torusguard rollback
-# or
-npx torusguard apply --rollback
-```
-**Under the Hood:** Executes `python .torusguard/scripts/apply_runner.py`.
-1. Reads candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
-2. Creates `.bak` snapshot in `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
-3. Performs line-aware replacement without corrupting concurrent modifications.
-4. Distills the applied fix into a **Golden Fix Recipe** registered in `.torusguard/memory/patterns.json`.
-5. Emits `diff_summary.md` and `apply_plan.md` in the run directory.
-6. Displays pixel-perfect 75-column terminal cards.
-
-### Mode B: In-Session AI Chat Agent Application
-When applying patches directly within an AI chat session:
-1. **Human Gate Confirmation:** Present the unified diff to the operator and request explicit approval before editing code.
-2. **Pre-Apply Snapshot:** Ensure target file backup is created at `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
-3. **Execute Surgical Edit:** Use `replace_file_content` to apply only the approved lines. Strictly adhere to the formulated Ponytail diff.
-4. **Syntax & Integrity Check:** Verify that the patched file is syntactically valid (e.g. `node --check <file>` or `python -m py_compile <file>`). If syntax fails, immediately restore from `.bak`.
-5. **Memory Registration:** Update persistent memory events in `.torusguard/memory/events.json` with event `fix_applied`.
-6. **Recommend Recheck:** Advise running `/torusguard recheck` or `npx torusguard recheck` to verify closure.
-
----
-
-## Rollback Guarantee
-If an applied patch introduces unexpected runtime behavior or breaks tests:
-```bash
-# Instant one-command rollback of the latest applied run:
-npx torusguard rollback
-
-# Or rollback a specific run:
-npx torusguard rollback --run run-20260910-121618-audit
-```
-All affected files are restored byte-for-byte from `.torusguard/snapshots/<run_id>/`.
-
----
-
-## Output Card Format
-```markdown
-### 🚀 TorusGuard Patch Applied Successfully
-- **Target File:** `server/index.js:9`
-- **Rule ID:** `TG-SEC-001` (Hardcoded JWT secret)
-- **Ponytail Churn:** +1 / -1
-- **Rollback Snapshot:** `.torusguard/snapshots/<run_id>/server/index.js.bak`
-- **Golden Recipe:** Distilled into persistent memory
-- **Next Step:** Run `npx torusguard recheck` or `/torusguard recheck` to verify closure
-```
+---
+name: torusguard-apply
+description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation via CLI or AI Agent.
+version: 1.3.6
+workflow: .torusguard/workflows/apply.md
+tools: Read, Grep, Glob, Write, replace_file_content, run_command
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/apply_runner.py
+  - .torusguard/scripts/term_ui.py
+  - .torusguard/scripts/memory_engine.py
+---
+
+# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
+
+## Objective
+Safely apply approved remediation bundles to disk source files, creating an automated byte-for-byte pre-apply backup snapshot (`.bak`) in `.torusguard/snapshots/<run_id>/`, asserting syntax validity, and distilling passing patterns into Golden Fix Recipes.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution (Interactive or Non-Interactive)
+Run the governed patch applier from your terminal:
+```bash
+# Interactive Human Gate review (prompts for each patch: [y]es / [n]o / [a]ll / [q]uit)
+npx torusguard apply
+
+# Non-interactive automated application
+npx torusguard apply --yes
+
+# Apply patches from a specific run ID
+npx torusguard apply --run run-20260910-121618-audit --yes
+
+# Emergency rollback from pre-apply snapshot
+npx torusguard rollback
+# or
+npx torusguard apply --rollback
+```
+**Under the Hood:** Executes `python .torusguard/scripts/apply_runner.py`.
+1. Reads candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
+2. Creates `.bak` snapshot in `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
+3. Performs line-aware replacement without corrupting concurrent modifications.
+4. Distills the applied fix into a **Golden Fix Recipe** registered in `.torusguard/memory/patterns.json`.
+5. Emits `diff_summary.md` and `apply_plan.md` in the run directory.
+6. Displays pixel-perfect 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Application
+When applying patches directly within an AI chat session:
+1. **Human Gate Confirmation:** Present the unified diff to the operator and request explicit approval before editing code.
+2. **Pre-Apply Snapshot:** Ensure target file backup is created at `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
+3. **Execute Surgical Edit:** Use `replace_file_content` to apply only the approved lines. Strictly adhere to the formulated Ponytail diff.
+4. **Syntax & Integrity Check:** Verify that the patched file is syntactically valid (e.g. `node --check <file>` or `python -m py_compile <file>`). If syntax fails, immediately restore from `.bak`.
+5. **Memory Registration:** Update persistent memory events in `.torusguard/memory/events.json` with event `fix_applied`.
+6. **Recommend Recheck:** Advise running `/torusguard recheck` or `npx torusguard recheck` to verify closure.
+
+---
+
+## Rollback Guarantee
+If an applied patch introduces unexpected runtime behavior or breaks tests:
+```bash
+# Instant one-command rollback of the latest applied run:
+npx torusguard rollback
+
+# Or rollback a specific run:
+npx torusguard rollback --run run-20260910-121618-audit
+```
+All affected files are restored byte-for-byte from `.torusguard/snapshots/<run_id>/`.
+
+---
+
+## Output Card Format
+```markdown
+### 🚀 TorusGuard Patch Applied Successfully
+- **Target File:** `server/index.js:9`
+- **Rule ID:** `TG-SEC-001` (Hardcoded JWT secret)
+- **Ponytail Churn:** +1 / -1
+- **Rollback Snapshot:** `.torusguard/snapshots/<run_id>/server/index.js.bak`
+- **Golden Recipe:** Distilled into persistent memory
+- **Next Step:** Run `npx torusguard recheck` or `/torusguard recheck` to verify closure
+```
+
+## Living Report Ground Truth
+- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.