torusguard 1.3.5 → 1.3.6

package/README.md

@@ -9,10 +9,10 @@
     <strong>Zero Telemetry · Zero External Python Dependencies · Pure Standard-Library Architecture · 100% Local-First</strong>
   </p>
 
-  [![npm version](https://img.shields.io/badge/npm-v1.3.5-cb3837.svg?style=flat-square&logo=npm)](https://www.npmjs.com/package/torusguard)
-  [![GitHub Packages](https://img.shields.io/badge/GitHub%20Packages-v1.3.5-181717.svg?style=flat-square&logo=github)](https://github.com/githubmofo/TorusGuard/pkgs/npm/torusguard)
-  [![Release](https://img.shields.io/badge/Release-v1.3.5-blue.svg?style=flat-square)](https://github.com/githubmofo/TorusGuard/releases/latest)
-  [![Tests](https://img.shields.io/badge/Tests-81%2F81%20Passing-brightgreen.svg?style=flat-square)](harness/runner.py)
+  [![npm version](https://img.shields.io/badge/npm-v1.3.6-cb3837.svg?style=flat-square&logo=npm)](https://www.npmjs.com/package/torusguard)
+  [![GitHub Packages](https://img.shields.io/badge/GitHub%20Packages-v1.3.6-181717.svg?style=flat-square&logo=github)](https://github.com/githubmofo/TorusGuard/pkgs/npm/torusguard)
+  [![Release](https://img.shields.io/badge/Release-v1.3.6-blue.svg?style=flat-square)](https://github.com/githubmofo/TorusGuard/releases/latest)
+  [![Tests](https://img.shields.io/badge/Tests-120%2F120%20Passing-brightgreen.svg?style=flat-square)](harness/runner.py)
   [![Security Health](https://img.shields.io/badge/Health%20Score-100%2F100%20Hardened-brightgreen.svg?style=flat-square)](security_report.md)
   [![Rules Catalog](https://img.shields.io/badge/Rules%20Catalog-74%20Rules%20%7C%2018%20Families-indigo.svg?style=flat-square)](rules/)
   [![Terminal Standard](https://img.shields.io/badge/Terminal-75--col%20Standard-informational.svg?style=flat-square)](.torusguard/scripts/term_ui.py)
@@ -72,7 +72,7 @@ flowchart LR
 10. [Visual HTML Dashboard & SARIF v2.1.0 Export](#-visual-html-dashboard--sarif-v210-export)
 11. [AI Editor Guardrails Auto-Sync](#-ai-editor-guardrails-auto-sync)
 12. [Monorepo Fleet Support & Git Pre-Commit Diff Guard](#-monorepo-fleet-support--git-pre-commit-diff-guard)
-13. [Verification & Test Harness (81/81 Passing Harness Explained)](#-verification--test-harness)
+13. [Verification & Test Harness (120/120 Passing Harness Explained)](#-verification--test-harness)
 14. [Security Policy & Responsible Disclosure](#-security-policy--responsible-disclosure)
 15. [License](#-license)
 
@@ -136,7 +136,7 @@ flowchart TD
 
 ## ⚔️ Why TorusGuard?
 
-| Security Dimension | Traditional SAST (SonarQube, Snyk) | Raw AI Coding Agents | TorusGuard v1.3.5 Engine |
+| Security Dimension | Traditional SAST (SonarQube, Snyk) | Raw AI Coding Agents | TorusGuard v1.3.6 Engine |
 |:---|:---:|:---:|:---:|
 | **Target Architecture** | Human-written legacy codebases | High-churn AI code generation | **AI-built full-stack applications** |
 | **Remediation Model** | PDF reports & Jira tickets | Destructive full-file rewrites | **Ponytail Protocol** ($\le 35$ add, $\le 25$ del) |
@@ -426,7 +426,13 @@ TorusGuard automatically discovers and profiles multi-package workspaces:
 ## 🧪 Verification & Test Harness
 
 ### What Happens When You Run `npm test`?
-TorusGuard enforces a strict **100% pass requirement across 81 test suites** before every release.
+TorusGuard enforces a strict **100% pass requirement across 120 test suites** before every release.
+The test harness runs with **zero third-party dependencies** via standard Python 3:
+
+```bash
+npm test
+# Equivalent to: python harness/runner.py
+```
 
 When a developer runs:
 ```bash
@@ -447,7 +453,7 @@ npm test
 
 # Expected Output:
 # ================================================================================
-# SUMMARY: 81 Passed | 0 Failed
+# SUMMARY: 120 Passed | 0 Failed
 # ================================================================================
 ```
 

package/bin/torusguard.js

@@ -151,7 +151,7 @@ function cardDivider(title = '', borderColor = CYAN, double = false) {
   return `  ${borderColor}${left}${h.repeat(71)}${right}${RESET}`;
 }
 
-function cardHeader(title, subtitle = '', version = 'v1.3.5', borderColor = CYAN) {
+function cardHeader(title, subtitle = '', version = 'v1.3.6', borderColor = CYAN) {
   const top = `  ${borderColor}╭${'─'.repeat(71)}╮${RESET}`;
   const bottom = `  ${borderColor}╰${'─'.repeat(71)}╯${RESET}`;
   const empty = `  ${borderColor}│${' '.repeat(71)}│${RESET}`;
@@ -169,7 +169,7 @@ function cardHeader(title, subtitle = '', version = 'v1.3.5', borderColor = CYAN
 
 function printHelp() {
   console.log();
-  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', 'v1.3.5'));
+  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', 'v1.3.6'));
   console.log(`\n  ${BOLD}Usage:${RESET}  ${GREEN}npx torusguard${RESET} ${WHITE}[command]${RESET} ${GRAY}[options]${RESET}\n`);
 
   console.log(cardBorderTop('Commands'));
@@ -189,6 +189,7 @@ function printHelp() {
   console.log(cardDivider('AI & Memory Subcommands'));
   console.log(formatBoxLine(`${WHITE}rules sync${RESET}       ${DIM}[--format all|cursor|claude|agent|windsurf]${RESET}`));
   console.log(formatBoxLine(`${WHITE}report --html${RESET}    ${DIM}[--out <path>] Self-contained visual HTML dashboard${RESET}`));
+  console.log(formatBoxLine(`${WHITE}report --sarif${RESET}   ${DIM}[--out <path>] OASIS SARIF v2.1.0 GitHub Scanning log${RESET}`));
   console.log(formatBoxLine(`${WHITE}memory context${RESET}   ${DIM}[--role auditor|remediator|reviewer] [--file <f>]${RESET}`));
   console.log(formatBoxLine(`${WHITE}memory hook${RESET}      ${DIM}[install|uninstall] Git pre-commit regression hook${RESET}`));
   console.log(formatBoxLine(`${WHITE}memory learn${RESET}     ${DIM}[--commits <range>] Ingest security commit fixes${RESET}`));
@@ -250,7 +251,7 @@ if (command === 'status') {
       }
 
       console.log();
-      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', 'v1.3.5'));
+      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', 'v1.3.6'));
       console.log(`\n  ${BOLD}▸ Workspace:${RESET}        ${GREEN}${cwd}${RESET}`);
       console.log(`  ${BOLD}▸ Governance:${RESET}       ${GREEN}Full Local Governance (.torusguard/)${RESET}`);
       console.log(`  ${BOLD}▸ Living Report:${RESET}    ${CYAN}security_report.md${RESET}\n`);
@@ -450,34 +451,69 @@ if (command === 'audit') {
 
 // Subcommand: report
 if (command === 'report') {
-  if (args.includes('--html') || args[1] === 'html') {
-    const htmlScript = path.join(cwd, '.torusguard', 'scripts', 'html_reporter.py');
+  const wantHtml = args.includes('--html') || args[1] === 'html' || args.includes('--out');
+  const wantSarif = args.includes('--sarif') || (!wantHtml && args[1] !== 'html');
+
+  // Resolve target directory (supports --target and --root)
+  const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : args.indexOf('--target');
+  let targetRoot = cwd;
+  if (rootIdx !== -1 && args[rootIdx + 1]) {
+    targetRoot = path.resolve(cwd, args[rootIdx + 1]);
+  }
+
+  let exitCode = 0;
+
+  // 1. If SARIF export is requested
+  if (wantSarif) {
+    const sarifScript = path.join(targetRoot, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const fallbackSarifScript = path.join(rootDir, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const actualSarifScript = fs.existsSync(fallbackSarifScript) ? fallbackSarifScript : sarifScript;
+
+    const sarifArgs = [actualSarifScript, '--root', targetRoot];
+    const sarifOutIdx = args.indexOf('--sarif-out');
+    if (sarifOutIdx !== -1 && args[sarifOutIdx + 1]) {
+      sarifArgs.push('--output', args[sarifOutIdx + 1]);
+    } else if (!wantHtml) {
+      const outIdx = args.indexOf('--out');
+      if (outIdx !== -1 && args[outIdx + 1]) {
+        sarifArgs.push('--output', args[outIdx + 1]);
+      }
+    }
+    const runIdIdx = args.indexOf('--run');
+    if (runIdIdx !== -1 && args[runIdIdx + 1]) {
+      sarifArgs.push('--run-id', args[runIdIdx + 1]);
+    }
+
+    const proc = spawnSync(pythonCmd, sarifArgs, { stdio: 'inherit', cwd: targetRoot });
+    if (proc.status !== 0 && proc.status !== null) {
+      exitCode = proc.status;
+    }
+  }
+
+  // 2. If Visual HTML dashboard is requested
+  if (wantHtml) {
+    const htmlScript = path.join(targetRoot, '.torusguard', 'scripts', 'html_reporter.py');
     const fallbackHtmlScript = path.join(rootDir, '.torusguard', 'scripts', 'html_reporter.py');
     const actualHtmlScript = fs.existsSync(fallbackHtmlScript) ? fallbackHtmlScript : htmlScript;
 
-    let pyArgs = [actualHtmlScript];
+    let pyArgs = [actualHtmlScript, '--root', targetRoot];
     const outIdx = args.indexOf('--out');
     if (outIdx !== -1 && args[outIdx + 1]) {
-      pyArgs.push('--out', args[outIdx + 1]);
-    }
-    const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : args.indexOf('--target');
-    if (rootIdx !== -1 && args[rootIdx + 1]) {
-      pyArgs.push('--root', args[rootIdx + 1]);
+      pyArgs.push('--out', path.resolve(cwd, args[outIdx + 1]));
+    } else {
+      pyArgs.push('--out', path.join(targetRoot, 'report.html'));
     }
     if (args.includes('--json')) {
       pyArgs.push('--json');
     }
 
-    const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
-    process.exit(proc.status !== null ? proc.status : 0);
-  } else {
-    const sarifScript = path.join(cwd, '.torusguard', 'scripts', 'sarif_exporter.py');
-    const fallbackSarifScript = path.join(rootDir, '.torusguard', 'scripts', 'sarif_exporter.py');
-    const actualSarifScript = fs.existsSync(fallbackSarifScript) ? fallbackSarifScript : sarifScript;
-
-    const proc = spawnSync(pythonCmd, [actualSarifScript, ...args.slice(1)], { stdio: 'inherit', cwd });
-    process.exit(proc.status !== null ? proc.status : 0);
+    const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd: targetRoot });
+    if (proc.status !== 0 && proc.status !== null) {
+      exitCode = proc.status;
+    }
   }
+
+  process.exit(exitCode);
 }
 
 // Subcommand: harden

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {

package/skills/torusguard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard
 description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, living security_report.md ground-truth ledger, SARIF v2.1.0 exports, and persistent security memory context.
-version: 1.3.5
+version: 1.3.6
 ---
 
 # TorusGuard Master Security Engine & Command Router

package/skills/torusguard/bootstrap.py

@@ -348,13 +348,18 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
             "cards": []
         }, indent=2), encoding="utf-8")
 
-    # Ensure target project root .gitignore excludes .torusguard/memory/
+    # Ensure target project root .gitignore excludes .torusguard/memory/ and report.html
     root_gitignore = target_root / ".gitignore"
     if root_gitignore.exists():
         try:
             gi_content = root_gitignore.read_text(encoding="utf-8")
+            to_add = []
             if ".torusguard/memory" not in gi_content:
-                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard security memory (local only)\n.torusguard/memory/\n", encoding="utf-8")
+                to_add.append(".torusguard/memory/")
+            if "report.html" not in gi_content:
+                to_add.append("report.html")
+            if to_add:
+                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard local artifacts\n" + "\n".join(to_add) + "\n", encoding="utf-8")
         except Exception:
             pass
 

package/skills/torusguard/payload/.manifest.json

@@ -142,25 +142,25 @@
   "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
-  "scripts/apply_runner.py": "3863c894d0a57f4a71206dca802b26755f361958f085b4636f112350bde221a2",
-  "scripts/audit_runner.py": "bdf4784ebec526a6f980879ce80aa7693ad2a8268fd4fa0334130ac3c1a7b22a",
+  "scripts/apply_runner.py": "f9c5374ea213b77069293e45ed3d878d7f3f0e31497c55bc97885efc14bfa57c",
+  "scripts/audit_runner.py": "98a3975ff79f8ffb0343d5606dd84a603fd35d741e2def6d70f83bc1ee8f01ff",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
   "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
-  "scripts/harden_runner.py": "c7a8074eaa9f6ebe61a17c553fd07bb543efcb1d5b4e01f24fd856367c048a70",
-  "scripts/html_reporter.py": "30982f279b501834009159d7142624c973f36f2517b884a0ce4868d7ca42d1f3",
+  "scripts/harden_runner.py": "f6f6922f2ade98b40f3de3e211459c62483e8aa274cbe4515dbd0d308956e6b4",
+  "scripts/html_reporter.py": "e9901a1dbeddd7b1dccd04afc9005d64954ccc1f14ba6ec4bdb4aa0ea8c2c66c",
   "scripts/manifest_builder.py": "c0137927789a9e40a08243e630ac3c6990beb1b87807934e98906c8ad0b99a97",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
-  "scripts/recheck_runner.py": "0c51d91b37bd3babf228b4b12b0e9d65953c8eae2e2e46596a1d42af8d057f71",
-  "scripts/recipes_runner.py": "cd9ffba5fed53057aac56241dcbfda1e68248f323e51bbde3fe711634b099600",
-  "scripts/report_sync.py": "278666954207a9eef1d479872546b99c16a8ded46bd3238ac9a09e2856b69813",
+  "scripts/recheck_runner.py": "dd6f35c98f6fd3d41d641bca419bb90739551c4900724a65447882b6d7dd4f54",
+  "scripts/recipes_runner.py": "6e057860e7d0e3b612a5b444b577255c9b7009b5dce0352098ab7d6c8c6659e7",
+  "scripts/report_sync.py": "c5f37c69e2e074c8ffd5953811907cf7c95e4c56f406ea16f3b5b9d878cfb774",
   "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
   "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
-  "scripts/sarif_exporter.py": "f060cfaf91dfb6b8e9c4036e354704204dfa8054720501f0ce2fadae0fb89540",
-  "scripts/stack_detect.py": "3f755d9353d5a8fd33a25486d6af0101a1d1b0c2f70f5a28bb2af2fe6050adc2",
-  "scripts/term_ui.py": "4870714add208f3da53c76a1250b1ceb8c104c0b708384e73427210dd0b50e6a",
-  "skills/torusguard/SKILL.md": "3e63aaa90f5453ba2b7ea79ed6afbd64985fb083d198a34d552857abb2f183f4",
+  "scripts/sarif_exporter.py": "86700765212adb3ab590ca72614bf3ad4ce7ce60e3193f7f3bd1a04d34d10f6e",
+  "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
+  "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
+  "skills/torusguard/SKILL.md": "4d5b8e43fa3c09e5e1079cbc3e2184654219a2c47b2272db394da749969318f8",
   "skills/torusguard/bootstrap.py": "3d946f388cb4befa739c9d3b1404255d9a8ea5770ebbb79e5a1b9839589e9bc7",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
@@ -190,32 +190,32 @@
   "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
   "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
   "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
-  "skills/torusguard-apply/SKILL.md": "453e1099ce3ae2184ae7bba34156cdafc6437976283e3839bef1c014bbc4bd9a",
-  "skills/torusguard-audit/SKILL.md": "b8e2d0058bce604a00fee93055112b3872290373e8b90d95b3414ce2c33bf9d9",
-  "skills/torusguard-authorize/SKILL.md": "67051f2db03f1957a63c10e6d39c963561c9c93f2c0c2e3289e936fe85b70da5",
-  "skills/torusguard-exploit-check/SKILL.md": "7b040abfc10e6aedd56a432247b5c36c4872966b2bf363e56c5ae393db825e23",
-  "skills/torusguard-full/SKILL.md": "f225de0e29d46f96fc0735e310394313dfecc987be430af14504498fc90847de",
-  "skills/torusguard-harden/SKILL.md": "11039ce21f6990d7b15c176e0aefb5ee6d7631ab083391e3442c1020d5cae956",
-  "skills/torusguard-init/SKILL.md": "89518de3585f4016b1e2ff6400979dcd7362c4b4f93fbdabd72e3ff4a59ba4d5",
-  "skills/torusguard-recheck/SKILL.md": "d839251dbe5571769da0d4ae3ff2ef18533ee96f87bf460b44bb51279866be22",
-  "skills/torusguard-report/SKILL.md": "f361f2e61141a4d0cea891da827146c3fce42b8b55c81d60d0ac999312e4d6cd",
-  "skills/torusguard-status/SKILL.md": "e14ab6276207bf4921749ec38a4c4b0bf482e84010a4e1b7c2b6f8ce7804f047",
-  "skills/torusguard-verify/SKILL.md": "f9aff4ca514e72883ac630245b6f3b62e035a9e54bdbe69ae8edb59bd9153691",
-  "skills/torusguard-web-validate/SKILL.md": "006d638d9d6f7ee5f9eb880704955f01eff1c3b9bb3baa8ac900fd807f6f589a",
+  "skills/torusguard-apply/SKILL.md": "4cdd01d8159fc5f7519a806526a119e6d67e41b8af195de018b05d6af09acb12",
+  "skills/torusguard-audit/SKILL.md": "0065336b125cfa8ec766dcec585bce4bbac66b3b063c174b7183dffef18e090d",
+  "skills/torusguard-authorize/SKILL.md": "8694e6cef71cbeb6605fed33dd1f24b74352541069e54de7c3f48c9676e9aa3a",
+  "skills/torusguard-exploit-check/SKILL.md": "87e0e01f28f3efea8dbe81790abaceb845a1290c75a6a16bbd256251cd0539a9",
+  "skills/torusguard-full/SKILL.md": "35f8b38b08fef5a09504312ef3e54921b1f8f31f197bbe2af1474bcce2e83e1c",
+  "skills/torusguard-harden/SKILL.md": "4332761e5454a504176eebbba2d4c585bcf066c8046c014cebc0f5771379c089",
+  "skills/torusguard-init/SKILL.md": "03e599a5dad4262396e6b1a75859f76739b0b1480d8cc64544296106da903dfc",
+  "skills/torusguard-recheck/SKILL.md": "72a0a79b29dcc7f7ae054f00c53e005bc92778f2c6bf3ad828f6391e859d9c1c",
+  "skills/torusguard-report/SKILL.md": "6dc62fb2c9e2986827a802b7cabf41ce41d00a47573524a4bf1642a8d8e2249e",
+  "skills/torusguard-status/SKILL.md": "2ad72e5d317e1d6fe0606f6926b1721dc01ba98b5daa2bfaa90bdd953a67bdf7",
+  "skills/torusguard-verify/SKILL.md": "810c31ba9adc1b410b22eb8503f266be2d51e260a9c6828fd2938e2774e5baa7",
+  "skills/torusguard-web-validate/SKILL.md": "3e02d9734402e8fbc86a0b5c2fdac945ef4fc9d60ba1b992197b1373427ad16e",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "fde7e879db5879bc6c8e67b5bd40473065688bba91149a01f66ad4739f4c8443",
-  "workflows/audit.md": "b02a7d2536c81b35ab4519b7f9eda3396d08f09da581ef299dc8fed83b4c082d",
-  "workflows/authorize.md": "71b14c2ffa24b1ad511d019a7da86854bf1bf94c282f563e05e9ad3b8493e8ca",
-  "workflows/exploit-check.md": "01c0a51e4b12a9dbb1d4f2b28d0bb495d92f95b786f5f1df59467b8fc6c61855",
-  "workflows/harden.md": "e68a78c47a2c4ec1d65adb08104d2fa16eb0c4530cf9b78400fd147f2076fb95",
-  "workflows/init.md": "f71438745a7e8d59dcf2e1089f7c5ccf2340e7909e56e1257b24c8ca79353162",
-  "workflows/memory.md": "faf93f39917fb6d0da23f9794e8337e643fd0a240cc46ca702fef84e02f5b867",
-  "workflows/recheck.md": "426a719a9c4233a653daa8fe0265370492f3a17a422517f7930549c991d25c93",
-  "workflows/report.md": "2aad2cbf2ffc781355e1186bb28a29b3da5efbacc57c8f44c9976aa635f0b120",
-  "workflows/status.md": "f3445bbf90402df819472180d5ae251a17b4f491ea3402d74f134bf55c2bf570",
-  "workflows/verify.md": "48f37892d329287059492ffaebf7022253fd5515a0a1a3253799e5cea765a21a",
-  "workflows/web-validate.md": "4d81294432e4d06e6c21db9a517b7cf1052744df3d821ed947a7751acb4fe39f"
+  "workflows/apply.md": "8dd37fecc44e2820e82c29e2c6b2970936734ed5102d36950889a9eb8b19dbab",
+  "workflows/audit.md": "7e78ebb885176d65e86ed45a90a4326b942d484c2b5c8bff1d7bda141790de2f",
+  "workflows/authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
+  "workflows/exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
+  "workflows/harden.md": "24c62ea0233bf5cb21308497869790fa6f24b6cbb563fd2ebf858ff02b09bba9",
+  "workflows/init.md": "9a9aeaff6bd2217323ad72fb4043f46057deaa45eb3380f679d9aef3d36bfc8b",
+  "workflows/memory.md": "8ad2ec154176e2540c2859a28eff9f7c2dbca0217aa29d0f4aa88b87c43f8bef",
+  "workflows/recheck.md": "42eecc3ba194564d48a6a88d8003e86cafe003503e887dc565314d4aa558e8fd",
+  "workflows/report.md": "b98652ee0552b7bb73eeb78dc80d2b0a108cc505523cbd1b3ada6064409e4629",
+  "workflows/status.md": "dfbc2b75ba45ff70b60522addca4032a667241364b0907cd77a43bf9271dfa56",
+  "workflows/verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
+  "workflows/web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371"
 }

package/skills/torusguard/payload/scripts/apply_runner.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-TorusGuard Governed Patch Application & Snapshot Engine (v1.3.5)
+TorusGuard Governed Patch Application & Snapshot Engine (v1.3.6)
 Interactive Human Gate authorization, pre-apply .bak rollback snapshots,
 atomic patch application, and Golden Fix Recipe distillation into persistent memory.
 Strict 75-column terminal UI formatting.
@@ -58,7 +58,7 @@ def box_line(content: str, width: int = 67, border: str = "│", border_color: s
         return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
     return f"  {border_color}{border}{RESET}  {content}"
 
-def box_header(title: str, subtitle: str = "", version: str = "v1.3.5", border_color: str = CYAN) -> str:
+def box_header(title: str, subtitle: str = "", version: str = "v1.3.6", border_color: str = CYAN) -> str:
     if term_ui:
         return term_ui.card_header(title, subtitle, version, border_color)
     return f"=== {title} ({version}) ==="
@@ -108,8 +108,14 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
         shutil.copy2(bak_file, dest_file)
         restored_files.append(orig_rel)
 
+    try:
+        import report_sync
+        report_sync.record_rollback_results(target_root, restored_files, snapshot_dir.name)
+    except Exception:
+        pass
+
     print()
-    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.3.5"))
+    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.3.6"))
     print()
 
     print(border_top("Rollback Snapshot Restored"))
@@ -138,7 +144,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
     if not bundle_meta_files:
         print()
-        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.5"))
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.6"))
         print()
         print(f"  {YELLOW}ℹ Zero candidate remediation bundles found in run: {run_folder.name}{RESET}")
         print(f"  {GRAY}The findings in this run require manual review or AI-assisted remediation.{RESET}\n")
@@ -163,7 +169,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
 
     # Header Card
     print()
-    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.5"))
+    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.6"))
     print()
 
     print(border_top("Candidate Bundles Ready for Application"))