torusguard 1.3.5 → 1.3.6

package/skills/torusguard-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-report
 description: Generate executive posture reports, export OASIS SARIF v2.1.0 logs, and render dark-mode HTML dashboards via CLI or AI Agent.
-version: 1.3.5
+version: 2.2.0
 workflow: .torusguard/workflows/report.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
@@ -15,61 +15,78 @@ scripts-binding:
 # TorusGuard Report — Posture Reporting & SARIF / HTML Export
 
 ## Objective
-Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports.
+Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports with full dual-mode parity.
 
 ---
 
-## Two Execution Modes
+## Execution Steps
 
 ### Mode A: Automated CLI Execution
 Run the report engine from your terminal:
 ```bash
-# Generate visual dark-mode HTML dashboard
+# Generate visual dark-mode HTML dashboard (defaults to report.html at project root)
 npx torusguard report --html
 
 # Export OASIS SARIF v2.1.0 for GitHub Code Scanning / CI
 npx torusguard report --sarif
 
-# Generate both HTML and SARIF for latest run
+# Generate both HTML and SARIF in a single pass
 npx torusguard report --html --sarif
 
-# Generate report for a specific project directory
-npx torusguard report ./examples/vulnerable-react-express --html
+# Custom HTML output location
+npx torusguard report --html --out ./docs/security-audit.html
 
-# Target a specific run ID
-npx torusguard report --run run-20260910-121618-audit --html
+# Target a specific subproject / monorepo package
+npx torusguard report --target ./apps/api --html
 ```
+
 **Under the Hood:**
-- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, and cluster summaries at `.torusguard/runs/<run_id>/report.html`.
-- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/<run_id>/results.sarif`.
+- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, directory attack surface heatmap, and golden recipe explorer at `report.html` (workspace root) and mirrors to `.torusguard/runs/report-latest.html`.
+- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/results-latest.sarif`.
 - Finalizes `manifest.json` metrics and updates historical posture scoring.
-- Displays 75-column terminal cards.
+- Displays standardized 75-column terminal cards adhering to visual width invariants.
 
 ### Mode B: In-Session AI Chat Agent Reporting
 When generating security posture summaries in AI chat:
 1. **Aggregate Run Data:** Inspect `findings.json`, `remediation.md`, and `recheck.md` from the active run.
-2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2).
+2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2). Clean repositories earn 100/100 across 74 defended invariants.
 3. **Format Executive Card:** Present finding counts, closed vulnerabilities, remaining risks, and compliance posture.
-4. **Export Artifacts:** Verify that `report.html` and `results.sarif` are serialized to disk.
+4. **Export Artifacts:** Verify that `report.html` and `results-latest.sarif` are serialized to disk.
+5. **Keep Living Ledger in Lockstep:** Ensure `security_report.md` reflects all findings and verified closures.
+
+---
+
+## Zero-CDN & Offline Guarantee
+- Zero external `<script>` or `<link>` tags. All styles, fonts, SVG icons, and scripts are embedded directly inside `report.html`.
+- Full offline inspection: can be opened directly via `file:///` without an active internet connection.
+- In-browser artifact downloads (SARIF v2.1.0 and CSV) use native `URL.createObjectURL(new Blob(...))` with zero network calls.
 
 ---
 
-## SARIF v2.1.0 Specification
+## SARIF v2.1.0 Output Specification
 - **Schema:** `https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`
-- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.5`, full rules catalog in `driver.rules`.
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.6`, full rules catalog in `driver.rules`.
 - **Automation Details:** `automationDetails.id: "torusguard/static"` to avoid collisions in multi-scanner CI/CD pipelines.
 - **Fingerprints:** `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
 
 ---
 
-## Output Card Format
+## Safety Constraints
+- Never display raw secrets, tokens, or credentials in terminal outputs or emitted reports.
+- Enforce read-only state for `report` actions — never modify source code during report generation.
+- Ensure atomic writes with fallback retry to prevent corrupt reports during concurrent browser viewing.
+- Respect monorepo target boundaries when `--target` is specified.
+
+---
+
+## Output Format
 ```markdown
-### 📊 TorusGuard Security Posture Report Emitted
-- **Run ID:** `run-20260910-121618-audit`
-- **Posture Score:** 85 / 100 (HIGH SECURITY)
-- **Findings Summary:** 3 Evaluated · 2 Confirmed Fixed · 1 Unresolved
-- **HTML Dashboard:** `.torusguard/runs/<run_id>/report.html` (View in browser)
-- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif` (Ready for CI)
+### 🛡️ TorusGuard Security Posture Report Emitted
+- **Posture Score:** 100 / 100 (OPTIMAL DEFENSE)
+- **Invariants Defended:** 74 Defended · 0 Harmed (74 Rules)
+- **HTML Dashboard:** `report.html` (View in browser)
+- **SARIF v2.1.0 Export:** `.torusguard/runs/results-latest.sarif` (Ready for CI)
+- **Living Ledger:** `security_report.md` (Synchronized in lockstep)
 ```
 
 ## Living Report Ground Truth

package/skills/torusguard-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-status
 description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/status.md
 tools: Read, Grep, Glob, run_command, Write
 scripts-binding:

package/skills/torusguard-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/verify.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard-web-validate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/web-validate.md
 tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding: