torusguard 1.3.5 → 1.3.6

package/skills/torusguard/payload/scripts/sarif_exporter.py

@@ -9,6 +9,7 @@ import sys
 import json
 import hashlib
 import argparse
+from pathlib import Path
 from typing import List, Dict, Any
 
 def generate_sarif(findings: List[Dict[str, Any]], run_id: str = "default", category: str = "torusguard/static") -> Dict[str, Any]:
@@ -76,7 +77,7 @@ def generate_sarif(findings: List[Dict[str, Any]], run_id: str = "default", cate
                 "tool": {
                     "driver": {
                         "name": "TorusGuard",
-                        "semanticVersion": "1.3.5",
+                        "semanticVersion": "1.3.6",
                         "informationUri": "https://github.com/githubmofo/TorusGuard",
                         "rules": list(rules_map.values())
                     }
@@ -95,22 +96,61 @@ def main():
     parser = argparse.ArgumentParser(description="TorusGuard SARIF v2.1.0 Exporter")
     parser.add_argument("--input", "-i", help="Path to findings JSON file")
     parser.add_argument("--output", "-o", help="Output path for sarif.json")
-    parser.add_argument("--run-id", default="run-default", help="Unique execution Run ID")
+    parser.add_argument("--root", "-r", help="Project root override")
+    parser.add_argument("--run-id", default=None, help="Unique execution Run ID")
+    parser.add_argument("--stdout", action="store_true", help="Print SARIF JSON to stdout")
     args = parser.parse_args()
 
+    root = Path(args.root).resolve() if args.root else Path.cwd().resolve()
     findings = []
+    run_id = args.run_id or "run-default"
+
     if args.input:
-        with open(args.input, "r", encoding="utf-8") as f:
-            findings = json.load(f)
+        in_path = Path(args.input)
+        if not in_path.is_absolute():
+            in_path = (root / in_path).resolve()
+        if in_path.is_file():
+            with open(in_path, "r", encoding="utf-8") as f:
+                findings = json.load(f)
+    else:
+        # Auto-discover latest audit run findings
+        runs_dir = root / ".torusguard" / "runs"
+        if runs_dir.is_dir():
+            run_folders = sorted(
+                [d for d in runs_dir.iterdir() if d.is_dir() and (d / "findings.json").is_file()],
+                key=lambda p: p.stat().st_mtime,
+                reverse=True
+            )
+            if run_folders:
+                latest_run = run_folders[0]
+                run_id = args.run_id or latest_run.name
+                findings_file = latest_run / "findings.json"
+                try:
+                    with open(findings_file, "r", encoding="utf-8") as f:
+                        findings = json.load(f)
+                except Exception:
+                    findings = []
 
-    sarif = generate_sarif(findings, run_id=args.run_id)
+    sarif = generate_sarif(findings, run_id=run_id)
 
     if args.output:
-        with open(args.output, "w", encoding="utf-8") as f:
+        out_path = Path(args.output)
+        if not out_path.is_absolute():
+            out_path = (root / out_path).resolve()
+        out_path.parent.mkdir(parents=True, exist_ok=True)
+        with open(out_path, "w", encoding="utf-8") as f:
             json.dump(sarif, f, indent=2)
-        print(f"SARIF log written to: {args.output}")
-    else:
+        print(f"[SUCCESS] SARIF log written to: {out_path}")
+    elif args.stdout:
         print(json.dumps(sarif, indent=2))
+    else:
+        # Default to writing in .torusguard/runs/results-latest.sarif
+        default_sarif = root / ".torusguard" / "runs" / "results-latest.sarif"
+        default_sarif.parent.mkdir(parents=True, exist_ok=True)
+        with open(default_sarif, "w", encoding="utf-8") as f:
+            json.dump(sarif, f, indent=2)
+        print(f"[SUCCESS] SARIF log written to: {default_sarif}")
+
 
 if __name__ == "__main__":
     main()

package/skills/torusguard/payload/scripts/stack_detect.py

@@ -221,6 +221,24 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
                         "indicator": "Flask application instantiation"
                     })
                     profile["recommended_references"].append("flask-security.md")
+                elif "tornado" in content or "tornado.web" in content:
+                    add_to_list(profile, "languages_found", "Python")
+                    profile["ecosystem_family"] = "python"
+                    add_to_list(profile, "frameworks_found", "Tornado")
+                    profile["confidence"] = "Confirmed"
+                    profile["detection_evidence"].append({
+                        "file": str(py_file.relative_to(project_root)),
+                        "indicator": "Tornado application"
+                    })
+                elif "starlette" in content:
+                    add_to_list(profile, "languages_found", "Python")
+                    profile["ecosystem_family"] = "python"
+                    add_to_list(profile, "frameworks_found", "Starlette")
+                    profile["confidence"] = "Confirmed"
+                    profile["detection_evidence"].append({
+                        "file": str(py_file.relative_to(project_root)),
+                        "indicator": "Starlette application"
+                    })
 
                 if "sqlalchemy" in content:
                     add_to_list(profile, "data_layers_found", "SQLAlchemy")
@@ -286,11 +304,27 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
                 profile["confidence"] = "Confirmed"
                 profile["detection_evidence"].append({"file": "package.json", "indicator": "express dependency"})
                 profile["recommended_references"].append("express-security.md")
+            elif "fastify" in deps:
+                add_to_list(profile, "frameworks_found", "Fastify")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "fastify dependency"})
+            elif "koa" in deps:
+                add_to_list(profile, "frameworks_found", "Koa")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "koa dependency"})
+            elif "@remix-run/react" in deps or "@remix-run/node" in deps:
+                add_to_list(profile, "frameworks_found", "Remix")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "Remix dependency"})
             elif "react" in deps:
                 add_to_list(profile, "frameworks_found", "React / Vite")
                 profile["confidence"] = "Confirmed"
                 profile["detection_evidence"].append({"file": "package.json", "indicator": "react dependency"})
                 profile["recommended_references"].append("react-vite-security.md")
+            elif "vite" in deps:
+                add_to_list(profile, "frameworks_found", "Vite")
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "vite dependency"})
 
             # ORM / Data layer detection
             if "@prisma/client" in deps or "prisma" in deps:
@@ -433,6 +467,8 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
 
         if "Microsoft.NET.Sdk.Web" in csproj_content or "Microsoft.AspNetCore" in csproj_content or "Swashbuckle" in csproj_content:
             add_to_list(profile, "frameworks_found", "ASP.NET Core")
+        if list(project_root.glob("**/*.razor")) or "Microsoft.AspNetCore.Components" in csproj_content or "blazor" in csproj_content.lower():
+            add_to_list(profile, "frameworks_found", "Blazor")
         if "Microsoft.EntityFrameworkCore" in csproj_content:
             add_to_list(profile, "data_layers_found", "Entity Framework Core")
         elif "Dapper" in csproj_content:
@@ -442,11 +478,17 @@ def detect_stack(project_root: Path) -> dict[str, Any]:
     # G. PHP Ecosystem
     # -------------------------------------------------------------------------
     composer_json = project_root / "composer.json"
-    if composer_json.is_file():
+    is_wordpress = (project_root / "wp-config.php").is_file() or (project_root / "wp-load.php").is_file() or (project_root / "wp-content").is_dir()
+    if composer_json.is_file() or is_wordpress:
         add_to_list(profile, "languages_found", "PHP")
         profile["ecosystem_family"] = "php"
         profile["confidence"] = "Confirmed"
-        profile["detection_evidence"].append({"file": "composer.json", "indicator": "PHP Composer manifest"})
+        if is_wordpress:
+            add_to_list(profile, "frameworks_found", "WordPress")
+            add_to_list(profile, "data_layers_found", "MySQL / wpdb")
+            profile["detection_evidence"].append({"file": "wp-config.php" if (project_root / "wp-config.php").is_file() else "wp-content", "indicator": "WordPress installation"})
+        if composer_json.is_file():
+            profile["detection_evidence"].append({"file": "composer.json", "indicator": "PHP Composer manifest"})
         profile["recommended_rules"].extend(["TG-SEC-*", "TG-INPUT-001", "TG-INPUT-002", "TG-PLATFORM-*"])
         profile["recommended_references"].append("polyglot-security-matrix.md")
 

package/skills/torusguard/payload/scripts/term_ui.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-TorusGuard Unified Terminal UI Engine (v1.3.5)
+TorusGuard Unified Terminal UI Engine (v1.3.6)
 Provides mathematically exact 75-column card formatting, ANSI-stripping,
 Unicode/emoji visual width calculation, and visual truncation with ellipsis.
 Pure Python 3.10+ standard library (zero external dependencies).

package/skills/torusguard/payload/skills/torusguard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard
 description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
-version: 1.3.5
+version: 1.3.6
 ---
 
 # TorusGuard Master Security Engine & Command Router

package/skills/torusguard/payload/skills/torusguard-apply/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-apply
 description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/apply.md
 tools: Read, Grep, Glob, Write, replace_file_content, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-audit
 description: Static AST security scanning, line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-authorize/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-authorize
 description: Register and validate runtime target authorization boundaries — scope boundaries, ownership proofs, TTL expiration, and Safety Gate enforcement.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/authorize.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-exploit-check/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-exploit-check
 description: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/exploit-check.md
 tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-full/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-full
 description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Bash, Edit, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-harden/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-harden
 description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions) via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/harden.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-init/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-init
 description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/init.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-recheck/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-recheck
 description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/recheck.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-report
 description: Generate executive posture reports, export OASIS SARIF v2.1.0 logs, and render dark-mode HTML dashboards via CLI or AI Agent.
-version: 1.3.5
+version: 2.2.0
 workflow: .torusguard/workflows/report.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
@@ -15,61 +15,78 @@ scripts-binding:
 # TorusGuard Report — Posture Reporting & SARIF / HTML Export
 
 ## Objective
-Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports.
+Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports with full dual-mode parity.
 
 ---
 
-## Two Execution Modes
+## Execution Steps
 
 ### Mode A: Automated CLI Execution
 Run the report engine from your terminal:
 ```bash
-# Generate visual dark-mode HTML dashboard
+# Generate visual dark-mode HTML dashboard (defaults to report.html at project root)
 npx torusguard report --html
 
 # Export OASIS SARIF v2.1.0 for GitHub Code Scanning / CI
 npx torusguard report --sarif
 
-# Generate both HTML and SARIF for latest run
+# Generate both HTML and SARIF in a single pass
 npx torusguard report --html --sarif
 
-# Generate report for a specific project directory
-npx torusguard report ./examples/vulnerable-react-express --html
+# Custom HTML output location
+npx torusguard report --html --out ./docs/security-audit.html
 
-# Target a specific run ID
-npx torusguard report --run run-20260910-121618-audit --html
+# Target a specific subproject / monorepo package
+npx torusguard report --target ./apps/api --html
 ```
+
 **Under the Hood:**
-- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, and cluster summaries at `.torusguard/runs/<run_id>/report.html`.
-- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/<run_id>/results.sarif`.
+- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, directory attack surface heatmap, and golden recipe explorer at `report.html` (workspace root) and mirrors to `.torusguard/runs/report-latest.html`.
+- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/results-latest.sarif`.
 - Finalizes `manifest.json` metrics and updates historical posture scoring.
-- Displays 75-column terminal cards.
+- Displays standardized 75-column terminal cards adhering to visual width invariants.
 
 ### Mode B: In-Session AI Chat Agent Reporting
 When generating security posture summaries in AI chat:
 1. **Aggregate Run Data:** Inspect `findings.json`, `remediation.md`, and `recheck.md` from the active run.
-2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2).
+2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2). Clean repositories earn 100/100 across 74 defended invariants.
 3. **Format Executive Card:** Present finding counts, closed vulnerabilities, remaining risks, and compliance posture.
-4. **Export Artifacts:** Verify that `report.html` and `results.sarif` are serialized to disk.
+4. **Export Artifacts:** Verify that `report.html` and `results-latest.sarif` are serialized to disk.
+5. **Keep Living Ledger in Lockstep:** Ensure `security_report.md` reflects all findings and verified closures.
+
+---
+
+## Zero-CDN & Offline Guarantee
+- Zero external `<script>` or `<link>` tags. All styles, fonts, SVG icons, and scripts are embedded directly inside `report.html`.
+- Full offline inspection: can be opened directly via `file:///` without an active internet connection.
+- In-browser artifact downloads (SARIF v2.1.0 and CSV) use native `URL.createObjectURL(new Blob(...))` with zero network calls.
 
 ---
 
-## SARIF v2.1.0 Specification
+## SARIF v2.1.0 Output Specification
 - **Schema:** `https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`
-- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.5`, full rules catalog in `driver.rules`.
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.6`, full rules catalog in `driver.rules`.
 - **Automation Details:** `automationDetails.id: "torusguard/static"` to avoid collisions in multi-scanner CI/CD pipelines.
 - **Fingerprints:** `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
 
 ---
 
-## Output Card Format
+## Safety Constraints
+- Never display raw secrets, tokens, or credentials in terminal outputs or emitted reports.
+- Enforce read-only state for `report` actions — never modify source code during report generation.
+- Ensure atomic writes with fallback retry to prevent corrupt reports during concurrent browser viewing.
+- Respect monorepo target boundaries when `--target` is specified.
+
+---
+
+## Output Format
 ```markdown
-### 📊 TorusGuard Security Posture Report Emitted
-- **Run ID:** `run-20260910-121618-audit`
-- **Posture Score:** 85 / 100 (HIGH SECURITY)
-- **Findings Summary:** 3 Evaluated · 2 Confirmed Fixed · 1 Unresolved
-- **HTML Dashboard:** `.torusguard/runs/<run_id>/report.html` (View in browser)
-- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif` (Ready for CI)
+### 🛡️ TorusGuard Security Posture Report Emitted
+- **Posture Score:** 100 / 100 (OPTIMAL DEFENSE)
+- **Invariants Defended:** 74 Defended · 0 Harmed (74 Rules)
+- **HTML Dashboard:** `report.html` (View in browser)
+- **SARIF v2.1.0 Export:** `.torusguard/runs/results-latest.sarif` (Ready for CI)
+- **Living Ledger:** `security_report.md` (Synchronized in lockstep)
 ```
 
 ## Living Report Ground Truth

package/skills/torusguard/payload/skills/torusguard-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-status
 description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/status.md
 tools: Read, Grep, Glob, run_command, Write
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/verify.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-web-validate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/web-validate.md
 tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/workflows/apply.md

@@ -1,7 +1,7 @@
 ---
 description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 1.3.5
+version: 1.3.6
 agent: remediator
 lifecycle-phase: Phase 5 (Patch Application)
 required-skills:

package/skills/torusguard/payload/workflows/audit.md

@@ -1,7 +1,7 @@
 ---
 description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: auditor
 lifecycle-phase: Phase 2 (Static Audit & Clustering)
 required-skills:

package/skills/torusguard/payload/workflows/authorize.md

@@ -1,7 +1,7 @@
 ---
 description: Legal scope definition, target ownership proof verification, and safety boundary enforcement for runtime validation.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: Phase 1 (Authorization Gate)
 required-skills:

package/skills/torusguard/payload/workflows/exploit-check.md

@@ -1,7 +1,7 @@
 ---
 description: Safe, bounded, single-step exploitability confirmation across 5 standard verification statuses.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: validator
 lifecycle-phase: Phase 3c (Exploitability Check)
 required-skills:

package/skills/torusguard/payload/workflows/harden.md

@@ -1,7 +1,7 @@
 ---
 description: Governed remediation formulation under strict Ponytail Protocol bounds (<= 35 additions, <= 25 deletions) and bundle packaging.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: remediator
 lifecycle-phase: Phase 4 (Remediation Formulation)
 required-skills:

package/skills/torusguard/payload/workflows/init.md

@@ -1,7 +1,7 @@
 ---
 description: Baseline project discovery, workspace scaffolding, stack detection, and framework-tailored security rule activation.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: profiler
 lifecycle-phase: Phase 0 (Baseline Setup)
 required-skills:

package/skills/torusguard/payload/workflows/memory.md

@@ -1,7 +1,7 @@
 ---
 description: TorusGuard Adaptive Security Memory Engine — view memory stats, export/import intelligence, apply TTL decay, and manage false positives.
 tools: Read, Grep, Glob, Bash
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: Intelligence / Memory
 required-skills:

package/skills/torusguard/payload/workflows/recheck.md

@@ -1,7 +1,7 @@
 ---
 description: Targeted differential AST re-scan, fix closure verification, and regression state machine transitions.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: Phase 6 (Targeted Recheck & Verification)
 required-skills:

package/skills/torusguard/payload/workflows/report.md

@@ -1,7 +1,7 @@
 ---
 description: Executive posture reporting, cluster analysis, signed compliance audit, and OASIS SARIF v2.1.0 structured export.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: Phase 7 (Reporting & SARIF Export)
 required-skills:

package/skills/torusguard/payload/workflows/status.md

@@ -1,7 +1,7 @@
 ---
 description: Read-only diagnostic overview of workspace security posture, active configuration, rules catalog, and run history.
 tools: Read, Grep, Glob, Bash
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: System / Diagnostics
 required-skills:

package/skills/torusguard/payload/workflows/verify.md

@@ -1,7 +1,7 @@
 ---
 description: Evidence sufficiency verification, live disk line match audit, and finding score refinement.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: validator
 lifecycle-phase: Phase 3a (Evidence Verification)
 required-skills:

package/skills/torusguard/payload/workflows/web-validate.md

@@ -1,7 +1,7 @@
 ---
 description: Authorized HTTP probing, token redaction, transparent audit header injection, and replay trace capture.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: validator
 lifecycle-phase: Phase 3b (Runtime Web Validation)
 required-skills:

package/skills/torusguard-apply/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-apply
 description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/apply.md
 tools: Read, Grep, Glob, Write, replace_file_content, run_command
 scripts-binding:

package/skills/torusguard-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-audit
 description: Static AST security scanning, line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard-authorize/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-authorize
 description: Register and validate runtime target authorization boundaries — scope boundaries, ownership proofs, TTL expiration, and Safety Gate enforcement.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/authorize.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard-exploit-check/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-exploit-check
 description: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/exploit-check.md
 tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:

package/skills/torusguard-full/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-full
 description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Bash, Edit, Write, run_command
 scripts-binding:

package/skills/torusguard-harden/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-harden
 description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions) via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/harden.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard-init/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-init
 description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/init.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard-recheck/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-recheck
 description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/recheck.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding: