torusguard 1.3.5 → 1.4.0

package/.torusguard/runs/run-20260918-105723-audit/findings.json

@@ -0,0 +1,2382 @@
+[
+  {
+    "finding_id": "TG-INPUT-002-f8cd11b9",
+    "rule_id": "TG-INPUT-002",
+    "title": "Raw SQL Concatenation",
+    "description": "Python f-string interpolation in raw SQL query",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/runner.py",
+    "line_number": 258,
+    "matched_text": "raw(f'SELECT * FROM users WHERE name = {",
+    "snippet": "            framework_pattern=FrameworkPattern(\n                framework=\"Django\",\n                unsafe_snippet=\"User.objects.raw(f'SELECT * FROM users WHERE name = {name}')\",\n                safe_snippet=\"User.objects.raw('SELECT * FROM users WHERE name = %s', [name])\",\n            ),",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.85,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 258,
+      "end_line": 258
+    },
+    "confidence_score": 74,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 29,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 74,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-593d6437",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/runner.py",
+    "line_number": 211,
+    "matched_text": "SECRET_KEY = 'super_secret_jwt_key'",
+    "snippet": "            type=EvidenceType.SOURCE,\n            location=\"server/auth.py:42\",\n            raw_snippet=\"SECRET_KEY = 'super_secret_jwt_key'\",\n            rationale=\"Hardcoded secret credential.\",\n            confidence_level=ConfidenceBand.CONFIRMED,",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 211,
+      "end_line": 211
+    },
+    "confidence_score": 71,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 71,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-e0a84cf3",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/runner.py",
+    "line_number": 221,
+    "matched_text": "API_KEY = 'sk_live_998877665544332211'",
+    "snippet": "    def test_sensitive_data_masking(self):\n        print(\"\\n6. Testing Sensitive Secret & Token Masking...\")\n        sample_secret = \"API_KEY = 'sk_live_998877665544332211'\"\n        masked = mask_sensitive_data(sample_secret)\n        self.log_test(\"Stripe Secret Key Redaction\", \"sk_live_***REDACTED***\" in masked and \"998877665544332211\" not in masked)",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 221,
+      "end_line": 221
+    },
+    "confidence_score": 71,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 71,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-88c9bb29",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/runner.py",
+    "line_number": 392,
+    "matched_text": "SECRET_KEY = 'sk_live_secret_key_12345'",
+    "snippet": "            type=EvidenceType.SOURCE,\n            location=\"settings.py:10\",\n            raw_snippet=\"DEBUG = True\\nSECRET_KEY = 'sk_live_secret_key_12345'\",\n            rationale=\"Production debug mode exposure and hardcoded secret.\",\n            confidence_level=ConfidenceBand.CONFIRMED,",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 392,
+      "end_line": 392
+    },
+    "confidence_score": 71,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 71,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-08d11e50",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Credential in Browser Context",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+    "line_number": 134,
+    "matched_text": "SUPABASE_SERVICE_ROLE_KEY",
+    "snippet": "    assert nextjs_file.is_file(), \"Missing actions.ts in vulnerable_nextjs\"\n    nx_code = nextjs_file.read_text(encoding=\"utf-8\")\n    assert \"TG-CLIENT-001\" in nx_code and \"SUPABASE_SERVICE_ROLE_KEY\" in nx_code\n    assert \"TG-AUTH-003\" in nx_code and \"use server\" in nx_code\n    print(\"  [PASS] vulnerable_nextjs fixture contains TG-CLIENT-001 and TG-AUTH-003 sinks\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+      "start_line": 134,
+      "end_line": 134
+    },
+    "confidence_score": 69,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 69,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-c616aefd",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 64,
+    "matched_text": "SECRET_KEY = \"sk_live_1234567890\"",
+    "snippet": "            \"tiny-repo\": {\n                \"vulnerable\": {\n                    \"app.py\": 'DEBUG = True\\nSECRET_KEY = \"sk_live_1234567890\"\\n\\ndef index():\\n    return \"Welcome\"\\n'\n                },\n                \"hardened\": {",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 64,
+      "end_line": 64
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-d5b3684f",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 90,
+    "matched_text": "SECRET_KEY = \"sk_live_1234567890\"",
+    "snippet": "                        \"confidence_band\": \"Confirmed\",\n                        \"target\": {\"file_path\": \"app.py\", \"line_start\": 2, \"line_end\": 2},\n                        \"evidence\": {\"code_snippet\": 'SECRET_KEY = \"sk_live_1234567890\"'},\n                        \"what_is_wrong\": \"Hardcoded secret exposed in source code.\",\n                        \"what_should_change\": \"Load SECRET_KEY from environment variables.\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 90,
+      "end_line": 90
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-54f1a02a",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+    "line_number": 341,
+    "matched_text": "PASSWORD=\"secret_in_docker\"",
+    "snippet": "COPY . .\n# Running as root user & hardcoding secrets\nENV DATABASE_PASSWORD=\"secret_in_docker\"\nCMD [\"python\", \"main.py\"]\n\"\"\", encoding=\"utf-8\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+      "start_line": 341,
+      "end_line": 341
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-676f776e",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+    "line_number": 356,
+    "matched_text": "PASSWORD=\"secret_in_docker\"",
+    "snippet": "            \"confidence_band\": \"Confirmed\",\n            \"target\": {\"file_path\": \"Dockerfile\", \"line_start\": 5, \"line_end\": 5},\n            \"evidence\": {\"code_snippet\": 'ENV DATABASE_PASSWORD=\"secret_in_docker\"'},\n            \"what_is_wrong\": \"Secret baked into immutable container image layer.\",\n            \"what_should_change\": \"Inject secrets at runtime or use BuildKit --mount=type=secret.\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+      "start_line": 356,
+      "end_line": 356
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-58f70e46",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+    "line_number": 362,
+    "matched_text": "PASSWORD=\"secret_in_docker\"",
+    "snippet": "+++ b/Dockerfile\n@@ -5,1 +5,2 @@\n-ENV DATABASE_PASSWORD=\"secret_in_docker\"\n+USER appuser\n\"\"\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+      "start_line": 362,
+      "end_line": 362
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-14cf4139",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Credential in Browser Context",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "harness/validate_v0_7_0_runtime.py",
+    "line_number": 129,
+    "matched_text": "DATABASE_URL",
+    "snippet": "            self.send_header(\"Content-Type\", \"application/json\")\n            self.end_headers()\n            self.wfile.write(b'{\"DEBUG\": true, \"DATABASE_URL\": \"sqlite:////app/db.sqlite3\"}')\n\n        elif url_path == \"/api/files/download\":",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_7_0_runtime.py",
+      "start_line": 129,
+      "end_line": 129
+    },
+    "confidence_score": 66,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 66,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-b53ad22c",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Credential in Browser Context",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "harness/validate_v0_7_0_runtime.py",
+    "line_number": 423,
+    "matched_text": "DATABASE_URL",
+    "snippet": "\n        # 6. Exposed debug config -> Runtime Confirmed\n        r6 = ExploitChecker.check_debug_exposure(val, \"fnd-6\", \"c-4\", f\"{self.base_url}/debug/env\", \"DATABASE_URL\")\n        self.log_test(\"Phase 3\", \"Exposed Debug Configuration Confirmed\", r6.status == ExploitabilityStatus.RUNTIME_CONFIRMED.value)\n",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_7_0_runtime.py",
+      "start_line": 423,
+      "end_line": 423
+    },
+    "confidence_score": 66,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 66,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-002-02f8e274",
+    "rule_id": "TG-INPUT-002",
+    "title": "Raw SQL Concatenation",
+    "description": "Python f-string interpolation in raw SQL query",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/engine/fixture_manager.py",
+    "line_number": 128,
+    "matched_text": "execute(f'SELECT * FROM items WHERE name LIKE {",
+    "snippet": "                vulnerable_variant=FixtureVariant(\n                    relative_path=\"examples/python/sqlalchemy-vuln\",\n                    code_pattern=\"session.execute(f'SELECT * FROM items WHERE name LIKE {q}')\",\n                    expected_findings_count=4,\n                ),",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.85,
+    "target": {
+      "file_path": "harness/engine/fixture_manager.py",
+      "start_line": 128,
+      "end_line": 128
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 29,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-7c852ff3",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/master_validation.py",
+    "line_number": 257,
+    "matched_text": "PASSWORD = 'super_secret_database_password_123'",
+    "snippet": "        self.log(\"Redaction\", \"JWT Token Redaction\", \"Bearer ***REDACTED_JWT***\" in masked_jwt and \"doNotLeakSignature\" not in masked_jwt)\n\n        masked_pwd = mask_sensitive_data(\"DB_PASSWORD = 'super_secret_database_password_123'\")\n        self.log(\"Redaction\", \"Password Variable Redaction\", \"***REDACTED***\" in masked_pwd and \"super_secret_database_password_123\" not in masked_pwd)\n",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/master_validation.py",
+      "start_line": 257,
+      "end_line": 257
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-02761dbb",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/master_validation.py",
+    "line_number": 460,
+    "matched_text": "API_KEY = 'sk_live_998877665544332211'",
+    "snippet": "\n    def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:\n        raw_code = \"STRIPE_API_KEY = 'sk_live_998877665544332211'\\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'\" if secret_test else f\"# Logic for {rule_id}\\nrole = request.headers.get('X-User-Role')\"\n\n        ev = Evidence(",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/master_validation.py",
+      "start_line": 460,
+      "end_line": 460
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-e8cc000a",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/runner.py",
+    "line_number": 505,
+    "matched_text": ".objects.get(id=id)",
+    "snippet": "\n            # 2. Stable Finding Identity\n            code_a = \"def view():\\n    return Item.objects.get(id=id)\"\n            code_b = \"# Shifted comment\\ndef view():\\n    return Item.objects.get(id=id)\"\n            fp1 = IdentityEngine.generate_identity(\"TG-DB-004\", \"views.py\", code_a, sink_signature=\"Item.objects.get\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 505,
+      "end_line": 505
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-89b581f9",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/runner.py",
+    "line_number": 506,
+    "matched_text": ".objects.get(id=id)",
+    "snippet": "            # 2. Stable Finding Identity\n            code_a = \"def view():\\n    return Item.objects.get(id=id)\"\n            code_b = \"# Shifted comment\\ndef view():\\n    return Item.objects.get(id=id)\"\n            fp1 = IdentityEngine.generate_identity(\"TG-DB-004\", \"views.py\", code_a, sink_signature=\"Item.objects.get\")\n            fp2 = IdentityEngine.generate_identity(\"TG-DB-004\", \"views.py\", code_b, sink_signature=\"Item.objects.get\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 506,
+      "end_line": 506
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-3a2b5eca",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Low",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_e2e.py",
+    "line_number": 355,
+    "matched_text": "API_KEY = 'sk_live_998877665544332211'",
+    "snippet": "\n    def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:\n        raw_code = \"API_KEY = 'sk_live_998877665544332211'\\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'\" if secret_test else f\"# Unsafe logic for {rule_id}\\nrole = request.headers.get('X-User-Role')\"\n        \n        ev = Evidence(",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_e2e.py",
+      "start_line": 355,
+      "end_line": 355
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 20,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-002-8f877a5f",
+    "rule_id": "TG-INPUT-002",
+    "title": "Raw SQL Concatenation",
+    "description": "Python f-string interpolation in raw SQL query",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/validate_v1_1_0_advanced_memory.py",
+    "line_number": 107,
+    "matched_text": "execute(f'SELECT * FROM users WHERE id = {",
+    "snippet": "        memory_engine.ensure_memory_structure(root_dir=test_root)\n\n        valid_before = \"cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\"\n        valid_after = \"cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))\"\n        valid_diff = \"- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.85,
+    "target": {
+      "file_path": "harness/validate_v1_1_0_advanced_memory.py",
+      "start_line": 107,
+      "end_line": 107
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 29,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-002-266bcaa1",
+    "rule_id": "TG-INPUT-002",
+    "title": "Raw SQL Concatenation",
+    "description": "Python f-string interpolation in raw SQL query",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/validate_v1_1_0_advanced_memory.py",
+    "line_number": 109,
+    "matched_text": "execute(f'SELECT * FROM users WHERE id = {",
+    "snippet": "        valid_before = \"cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\"\n        valid_after = \"cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))\"\n        valid_diff = \"- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))\"\n\n        recipe = memory_engine.record_golden_recipe(",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.85,
+    "target": {
+      "file_path": "harness/validate_v1_1_0_advanced_memory.py",
+      "start_line": 109,
+      "end_line": 109
+    },
+    "confidence_score": 64,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 29,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 64,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-003-69f083d6",
+    "rule_id": "TG-PLATFORM-003",
+    "title": "Production Stack Trace Exposure",
+    "description": "Django DEBUG mode enabled in configuration",
+    "severity": "Low",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "harness/runner.py",
+    "line_number": 392,
+    "matched_text": "DEBUG = True",
+    "snippet": "            type=EvidenceType.SOURCE,\n            location=\"settings.py:10\",\n            raw_snippet=\"DEBUG = True\\nSECRET_KEY = 'sk_live_secret_key_12345'\",\n            rationale=\"Production debug mode exposure and hardcoded secret.\",\n            confidence_level=ConfidenceBand.CONFIRMED,",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 392,
+      "end_line": 392
+    },
+    "confidence_score": 61,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 61,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-003-6f253f06",
+    "rule_id": "TG-PLATFORM-003",
+    "title": "Production Stack Trace Exposure",
+    "description": "Django DEBUG mode enabled in configuration",
+    "severity": "Low",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "harness/runner.py",
+    "line_number": 405,
+    "matched_text": "DEBUG = True",
+    "snippet": "        prov = ProvenanceChain(\n            discovery_module=\"rules/TG-PLATFORM-003-production-stack-trace-exposure.md\",\n            triggering_input=\"DEBUG = True assignment in settings.py\",\n            evidence_collected=[\"settings.py:10\"],\n            decision_path=[\"Loaded Django settings\", \"Found DEBUG enabled\"],",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 405,
+      "end_line": 405
+    },
+    "confidence_score": 61,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 61,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-003-fbe8ec66",
+    "rule_id": "TG-PLATFORM-003",
+    "title": "Production Stack Trace Exposure",
+    "description": "Django DEBUG mode enabled in configuration",
+    "severity": "Low",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "harness/runner.py",
+    "line_number": 416,
+    "matched_text": "DEBUG = True",
+    "snippet": "            framework_pattern=FrameworkPattern(\n                framework=\"Django\",\n                unsafe_snippet=\"DEBUG = True\",\n                safe_snippet=\"DEBUG = False\",\n            ),",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 416,
+      "end_line": 416
+    },
+    "confidence_score": 61,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 61,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-RATE-001-758a7750",
+    "rule_id": "TG-RATE-001",
+    "title": "Unlimited Authentication Endpoint",
+    "description": "Authentication POST endpoint defined without rate-limiting middleware",
+    "severity": "Low",
+    "category": "rate",
+    "cluster": "cluster-rate-limiting",
+    "file_path": "harness/runner.py",
+    "line_number": 575,
+    "matched_text": "app.post('/login', async (",
+    "snippet": "                \"line_number\": 25,\n                \"description\": \"Unprotected auth route lacking rate limiting.\",\n                \"snippet\": \"app.post('/login', async (req, res) => {})\",\n                \"confidence_score\": 85,\n                \"confidence_band\": \"High Confidence\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.45,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 575,
+      "end_line": 575
+    },
+    "confidence_score": 60,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 15,
+      "reproduction_success": 0,
+      "independent_confirmations": 15,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 60,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-04571685",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 74,
+    "matched_text": "verify=False",
+    "snippet": "        \"expected_orm\": \"SQLAlchemy\",\n        \"ecosystem\": \"Python\",\n        \"test_bypass\": (\"python\", \"verify=False\", \"auth_bypass\"),\n        \"test_tenant\": (\"python\", \"tenant_id\"),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 74,
+      "end_line": 74
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-8b55ac4b",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 151,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "        \"expected_orm\": \"GORM\",\n        \"ecosystem\": \"Go\",\n        \"test_bypass\": (\"go\", \"InsecureSkipVerify: true\", \"tls_bypass\"),\n        \"test_tenant\": (\"go\", '.Where(\"tenant_id = ?\", tenantID)'),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 151,
+      "end_line": 151
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-cf8d252d",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 162,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "        \"expected_orm\": \"SQLx\",\n        \"ecosystem\": \"Go\",\n        \"test_bypass\": (\"go\", \"tls.Config{InsecureSkipVerify: true}\", \"tls_bypass\"),\n        \"test_tenant\": (\"go\", '.Where(\"org_id = ?\", orgID)'),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 162,
+      "end_line": 162
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-3543946e",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 173,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "        \"expected_orm\": None,\n        \"ecosystem\": \"Go\",\n        \"test_bypass\": (\"go\", \"InsecureSkipVerify: true\", \"tls_bypass\"),\n        \"test_tenant\": (\"go\", '.Where(\"tenant_id = ?\", tid)'),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 173,
+      "end_line": 173
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-efffaad0",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 349,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "        \"expected_orm\": None,\n        \"ecosystem\": \"Polyglot Fleet\",\n        \"test_bypass\": (\"go\", \"InsecureSkipVerify: true\", \"tls_bypass\"),\n        \"test_tenant\": (\"go\", '.Where(\"tenant_id = ?\", tid)'),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 349,
+      "end_line": 349
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-91bd06b8",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Node.js TLS rejectUnauthorized",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 129,
+    "matched_text": "rejectUnauthorized: false",
+    "snippet": "        \"expected_orm\": \"Mongoose\",\n        \"ecosystem\": \"JavaScript\",\n        \"test_bypass\": (\"javascript\", \"rejectUnauthorized: false\", \"tls_bypass\"),\n        \"test_tenant\": (\"javascript\", \"author: req.user.id\"),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 129,
+      "end_line": 129
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-cb245735",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 261,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "        \"expected_orm\": \"Eloquent\",\n        \"ecosystem\": \"PHP\",\n        \"test_bypass\": (\"php\", \"CURLOPT_SSL_VERIFYPEER => false\", \"tls_bypass\"),\n        \"test_tenant\": (\"php\", 'where(\"tenant_id\", $tenantId)'),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 261,
+      "end_line": 261
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-6667680a",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+    "line_number": 60,
+    "matched_text": "verify = False",
+    "snippet": " def authenticate_user(token):\n+    # TODO: bypass auth check for debugging\n+    verify = False\n     return True\n\"\"\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+      "start_line": 60,
+      "end_line": 60
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-00b3b8ca",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+    "line_number": 67,
+    "matched_text": "verify=False",
+    "snippet": "    rule_ids = [v[\"rule_id\"] for v in res_bypass[\"violations\"]]\n    assert \"TG-DIFF-001\" in rule_ids, \"TG-DIFF-001 bypass not caught\"\n    print(f\"  [PASS] TG-DIFF-001: Caught bypass comments and verify=False ({res_bypass['total_violations']} violations)\")\n\n    mock_key = \"sk\" + \"_live_\" + \"99887766554433221100aabbccdd\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+      "start_line": 67,
+      "end_line": 67
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-f209dec6",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 16,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "   - File extension census fallback (no manifest)\n2. Polyglot Diff Guard bypass detection across:\n   - Go (InsecureSkipVerify: true)\n   - Java (csrf().disable())\n   - C# ([AllowAnonymous])",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 16,
+      "end_line": 16
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-d9adecdb",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 182,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "+++ b/client.go\n@@ -10,3 +10,4 @@\n+\ttr := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}\n\"\"\"\n        viol_go = diff_guard.check_diff_content(diff_go, \"client.go\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 182,
+      "end_line": 182
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-ddbf5cf0",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 19,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "   - Java (csrf().disable())\n   - C# ([AllowAnonymous])\n   - PHP (CURLOPT_SSL_VERIFYPEER => false)\n   - Rust (unsafe { ... })\n3. Polyglot Tenant Scoping Patterns across GORM, LINQ, and Prisma",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 19,
+      "end_line": 19
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-2b3eb6b7",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Low",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 215,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER, false",
+    "snippet": "+++ b/api.php\n@@ -5,3 +5,4 @@\n+    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);\n\"\"\"\n        viol_php = diff_guard.check_diff_content(diff_php, \"api.php\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.9,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 215,
+      "end_line": 215
+    },
+    "confidence_score": 59,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 31,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 59,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-005-7f81ea7f",
+    "rule_id": "TG-INPUT-005",
+    "title": "Unsafe Template Rendering & Disabled Autoescaping",
+    "description": "Flask render_template_string rendering untrusted input",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 177,
+    "matched_text": "render_template_string(",
+    "snippet": "            \"flask-app\": {\n                \"vulnerable\": {\n                    \"app.py\": 'from flask import Flask, request, render_template_string\\nimport os\\n\\napp = Flask(__name__)\\n\\n@app.route(\"/greet\")\\ndef greet():\\n    name = request.args.get(\"name\", \"Guest\")\\n    # SSTI: Unescaped string formatting in template\\n    return render_template_string(f\"Hello {name}\")\\n\\n@app.route(\"/upload\", methods=[\"POST\"])\\ndef upload():\\n    f = request.files[\"file\"]\\n    # Path Traversal in filename\\n    f.save(os.path.join(\"/var/uploads\", f.filename))\\n    return \"Saved\"\\n'\n                },\n                \"hardened\": {",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 177,
+      "end_line": 177
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-005-d5aaebe0",
+    "rule_id": "TG-INPUT-005",
+    "title": "Unsafe Template Rendering & Disabled Autoescaping",
+    "description": "Flask render_template_string rendering untrusted input",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 190,
+    "matched_text": "render_template_string(",
+    "snippet": "                        \"confidence_band\": \"Confirmed\",\n                        \"target\": {\"file_path\": \"app.py\", \"line_start\": 10, \"line_end\": 10},\n                        \"evidence\": {\"code_snippet\": 'return render_template_string(f\"Hello {name}\")'},\n                        \"what_is_wrong\": \"User input formatted directly into template string.\",\n                        \"what_should_change\": \"Render static template file with contextual autoescaping.\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 190,
+      "end_line": 190
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-005-e0ffb03b",
+    "rule_id": "TG-INPUT-005",
+    "title": "Unsafe Template Rendering & Disabled Autoescaping",
+    "description": "Flask render_template_string rendering untrusted input",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 193,
+    "matched_text": "render_template_string(",
+    "snippet": "                        \"what_is_wrong\": \"User input formatted directly into template string.\",\n                        \"what_should_change\": \"Render static template file with contextual autoescaping.\",\n                        \"proposed_diff\": \"--- a/app.py\\n+++ b/app.py\\n@@ -10,1 +10,1 @@\\n-return render_template_string(f\\\"Hello {name}\\\")\\n+return render_template(\\\"greet.html\\\", name=name)\\n\",\n                        \"verification_steps\": \"Send name={{7*7}} and verify output contains literal {{7*7}} instead of 49.\",\n                    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 193,
+      "end_line": 193
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-003-153d982f",
+    "rule_id": "TG-PLATFORM-003",
+    "title": "Production Stack Trace Exposure",
+    "description": "Django DEBUG mode enabled in configuration",
+    "severity": "Low",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 64,
+    "matched_text": "DEBUG = True",
+    "snippet": "            \"tiny-repo\": {\n                \"vulnerable\": {\n                    \"app.py\": 'DEBUG = True\\nSECRET_KEY = \"sk_live_1234567890\"\\n\\ndef index():\\n    return \"Welcome\"\\n'\n                },\n                \"hardened\": {",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 64,
+      "end_line": 64
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-003-21644311",
+    "rule_id": "TG-PLATFORM-003",
+    "title": "Production Stack Trace Exposure",
+    "description": "Django DEBUG mode enabled in configuration",
+    "severity": "Low",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 77,
+    "matched_text": "DEBUG = True",
+    "snippet": "                        \"confidence_band\": \"Confirmed\",\n                        \"target\": {\"file_path\": \"app.py\", \"line_start\": 1, \"line_end\": 1},\n                        \"evidence\": {\"code_snippet\": \"DEBUG = True\"},\n                        \"what_is_wrong\": \"DEBUG is statically enabled.\",\n                        \"what_should_change\": \"Load DEBUG from environment variables.\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 77,
+      "end_line": 77
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-003-21b8a588",
+    "rule_id": "TG-PLATFORM-003",
+    "title": "Production Stack Trace Exposure",
+    "description": "Django DEBUG mode enabled in configuration",
+    "severity": "Low",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 80,
+    "matched_text": "DEBUG = True",
+    "snippet": "                        \"what_is_wrong\": \"DEBUG is statically enabled.\",\n                        \"what_should_change\": \"Load DEBUG from environment variables.\",\n                        \"proposed_diff\": \"--- a/app.py\\n+++ b/app.py\\n@@ -1,1 +1,2 @@\\n-DEBUG = True\\n+import os\\n+DEBUG = os.getenv('DEBUG', 'False').lower() == 'true'\\n\",\n                        \"verification_steps\": \"Check DEBUG setting resolution in production.\",\n                    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 80,
+      "end_line": 80
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-e33fd263",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_3_hardening.py",
+    "line_number": 119,
+    "matched_text": ".objects.get(id=inv_id)",
+    "snippet": "        snippet_v1 = \"\"\"def process_invoice(req, inv_id):\n    # Retrieve invoice\n    inv = Invoice.objects.get(id=inv_id)\n    return inv\n\"\"\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/validate_v0_6_3_hardening.py",
+      "start_line": 119,
+      "end_line": 119
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-ff3f7499",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_3_hardening.py",
+    "line_number": 127,
+    "matched_text": ".objects.get(id=inv_id)",
+    "snippet": "        snippet_v2 = \"\"\"def process_invoice(req, inv_id):\n    # Retrieve invoice\n    inv = Invoice.objects.get(id=inv_id)\n    return inv\n\"\"\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/validate_v0_6_3_hardening.py",
+      "start_line": 127,
+      "end_line": 127
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-a7c00c05",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_3_hardening.py",
+    "line_number": 135,
+    "matched_text": ".objects.get(id=inv_id)",
+    "snippet": "        snippet_v3 = \"\"\"def process_invoice(req, inv_id):\n    # Different comment text here\n    inv = Invoice.objects.get(id=inv_id)   \n    return inv\n\"\"\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/validate_v0_6_3_hardening.py",
+      "start_line": 135,
+      "end_line": 135
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-8b6c1463",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_3_hardening.py",
+    "line_number": 171,
+    "matched_text": ".objects.get(id=inv_id)",
+    "snippet": "                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": \"apps/billing/views.py\", \"line_start\": 12, \"line_end\": 14},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n                \"cluster_id\": \"cluster-tenant-isolation\",\n                \"recheck_status\": \"Confirmed Fixed\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/validate_v0_6_3_hardening.py",
+      "start_line": 171,
+      "end_line": 171
+    },
+    "confidence_score": 57,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 57,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-33adb2d9",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Session cookie secure flag disabled in Django settings",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 107,
+    "matched_text": "SESSION_COOKIE_SECURE = False",
+    "snippet": "        \"expected_orm\": \"SQLAlchemy\",\n        \"ecosystem\": \"Python\",\n        \"test_bypass\": (\"python\", \"SESSION_COOKIE_SECURE = False\", \"auth_bypass\"),\n        \"test_tenant\": (\"python\", \"tenant_id\"),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 107,
+      "end_line": 107
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-56b1c90f",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Decorator disabling route-level authentication or CSRF protection",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 96,
+    "matched_text": "@csrf_exempt",
+    "snippet": "        \"expected_orm\": \"Django ORM\",\n        \"ecosystem\": \"Python\",\n        \"test_bypass\": (\"python\", \"@csrf_exempt\", \"auth_bypass\"),\n        \"test_tenant\": (\"python\", \"tenant\"),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 96,
+      "end_line": 96
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-4a33f7e7",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 239,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "        \"expected_orm\": \"Entity Framework Core\",\n        \"ecosystem\": \"C#\",\n        \"test_bypass\": (\"csharp\", \"[AllowAnonymous]\", \"auth_bypass\"),\n        \"test_tenant\": (\"csharp\", \".Where(x => x.TenantId == tenantId)\"),\n    },",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 239,
+      "end_line": 239
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-95eb27cd",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 876,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "| **4. 5-Factor Confidence Scorer** | 100% | Applied objective $0\u2013100$ scoring with memory modifiers and false positive deductions. |\n| **5. Adaptive Security Memory Engine** | 100% | Isolated memory workspace successfully recorded events and verified context cards $\\le 2,000$ tokens. |\n| **6. Polyglot Diff Guard** | 100% | Intercepted Go `InsecureSkipVerify`, Java `csrf().disable()`, C# `[AllowAnonymous]`, PHP `CURLOPT_SSL_VERIFYPEER`, Rust `unsafe {`, and tenant stripping. |\n| **7. Governed Remediation (Ponytail)** | 100% | Enforced patch churn limits ($\\le 35$ additions, $\\le 25$ deletions) and pre-apply snapshot generation. |\n| **8. Visual HTML Dashboard** | 100% | Generated self-contained, air-gapped dark-mode visual report with SVG circular gauge. |",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 876,
+      "end_line": 876
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-e838c41c",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 18,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "   - Go (InsecureSkipVerify: true)\n   - Java (csrf().disable())\n   - C# ([AllowAnonymous])\n   - PHP (CURLOPT_SSL_VERIFYPEER => false)\n   - Rust (unsafe { ... })",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 18,
+      "end_line": 18
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-5c78d750",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 204,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "+++ b/UsersController.cs\n@@ -15,3 +15,4 @@\n+    [AllowAnonymous]\n+    public IActionResult GetFinancialData() {\n\"\"\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 204,
+      "end_line": 204
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-0d028be7",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 208,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "\"\"\"\n        viol_cs = diff_guard.check_diff_content(diff_cs, \"UsersController.cs\")\n        assert len(viol_cs) >= 1, \"Failed to catch C# [AllowAnonymous]\"\n        print(\"  [PASS] Caught C# ASP.NET [AllowAnonymous] bypass\")\n",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 208,
+      "end_line": 208
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-3ae1d9c1",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 209,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "        viol_cs = diff_guard.check_diff_content(diff_cs, \"UsersController.cs\")\n        assert len(viol_cs) >= 1, \"Failed to catch C# [AllowAnonymous]\"\n        print(\"  [PASS] Caught C# ASP.NET [AllowAnonymous] bypass\")\n\n        # PHP CURLOPT_SSL_VERIFYPEER bypass",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 209,
+      "end_line": 209
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-ea07db54",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Spring Security CSRF protection explicitly disabled",
+    "severity": "Low",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 193,
+    "matched_text": ".csrf().disable()",
+    "snippet": "+++ b/SecurityConfig.java\n@@ -20,3 +20,4 @@\n+    http.csrf().disable();\n\"\"\"\n        viol_java = diff_guard.check_diff_content(diff_java, \"SecurityConfig.java\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 193,
+      "end_line": 193
+    },
+    "confidence_score": 56,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 56,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-005-0d595acd",
+    "rule_id": "TG-INPUT-005",
+    "title": "Unsafe Template Rendering & Disabled Autoescaping",
+    "description": "Flask render_template_string rendering untrusted input",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/master_validation.py",
+    "line_number": 314,
+    "matched_text": "render_template_string(",
+    "snippet": "                \"severity\": SeverityLevel.HIGH,\n                \"path\": \"rules/TG-INPUT-005-unsafe-template-rendering-and-escaping.md\",\n                \"vuln_sample\": \"return render_template_string(f'<h1>Hello {name}</h1>')\",\n                \"hard_sample\": \"return render_template('hello.html', name=name)\",\n                \"remediation\": \"Pass inputs as context variables in autoescaped template files or use Django's format_html() to safely construct HTML wrappers.\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/master_validation.py",
+      "start_line": 314,
+      "end_line": 314
+    },
+    "confidence_score": 54,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 54,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-005-d7ef73f1",
+    "rule_id": "TG-INPUT-005",
+    "title": "Unsafe Template Rendering & Disabled Autoescaping",
+    "description": "Flask render_template_string rendering untrusted input",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/validate_e2e.py",
+    "line_number": 457,
+    "matched_text": "render_template_string(",
+    "snippet": "            \"\",\n            \"- **`TG-AUTH-008` (Untrusted Role/Tenant Header Injection):** Verified detection on client headers (`X-User-Role`, `X-Tenant-ID`) and verified FastAPI/DRF JWT token extraction remediations.\",\n            \"- **`TG-INPUT-005` (Unsafe Template Rendering & Disabled Autoescaping):** Verified detection on `mark_safe()`, `| safe`, and `render_template_string()`; verified Jinja2 context variable autoescaping and `format_html()` remediations.\",\n            \"- **`TG-INPUT-006` (Path Traversal & Unsafe Upload Storage):** Verified detection on `os.path.join(UPLOAD_DIR, filename)`; verified `secure_filename()` + UUID storage remediations.\",\n            \"- **`TG-DB-004` (Missing Tenant Query Isolation):** Verified detection on unscoped primary key queries; verified SQLAlchemy composite tenant filters and DRF ViewSet `get_queryset()` tenant isolation.\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/validate_e2e.py",
+      "start_line": 457,
+      "end_line": 457
+    },
+    "confidence_score": 54,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 54,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-9a2f13c7",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_1_scale.py",
+    "line_number": 115,
+    "matched_text": ".objects.get(id=inv_id)",
+    "snippet": "                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n            },\n            # FastAPI Microservice",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/validate_v0_6_1_scale.py",
+      "start_line": 115,
+      "end_line": 115
+    },
+    "confidence_score": 54,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 54,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-a932f5b8",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_1_scale.py",
+    "line_number": 193,
+    "matched_text": ".objects.get(id=id)",
+    "snippet": "                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"services/api/module_{i % 15}/views.py\", \"line_start\": 10 + i, \"line_end\": 12 + i},\n                \"evidence\": {\"code_snippet\": f\"Model_{i}.objects.get(id=id)\"},\n            })\n",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/validate_v0_6_1_scale.py",
+      "start_line": 193,
+      "end_line": 193
+    },
+    "confidence_score": 54,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 54,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-14a2d74f",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v1_0_0_memory.py",
+    "line_number": 265,
+    "matched_text": ".objects.get(id=id)",
+    "snippet": "-    return Bill.objects.filter(id=id, tenant=tenant)\n+def get_bill(id):\n+    return Bill.objects.get(id=id)\n\"\"\"\n        res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "harness/validate_v1_0_0_memory.py",
+      "start_line": 265,
+      "end_line": 265
+    },
+    "confidence_score": 54,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 54,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SUPPLY-004-e52415c0",
+    "rule_id": "TG-SUPPLY-004",
+    "title": "Unpinned CI Action",
+    "description": "GitHub Action referenced by mutable tag instead of immutable commit SHA",
+    "severity": "Low",
+    "category": "supply",
+    "cluster": "cluster-supply-chain",
+    "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+    "line_number": 383,
+    "matched_text": "uses: actions/checkout@v2",
+    "snippet": "    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v2\n      - run: make test\n\"\"\", encoding=\"utf-8\")",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.6,
+    "target": {
+      "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+      "start_line": 383,
+      "end_line": 383
+    },
+    "confidence_score": 52,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 21,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 52,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SUPPLY-004-b9d15743",
+    "rule_id": "TG-SUPPLY-004",
+    "title": "Unpinned CI Action",
+    "description": "GitHub Action referenced by mutable tag instead of immutable commit SHA",
+    "severity": "Low",
+    "category": "supply",
+    "cluster": "cluster-supply-chain",
+    "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+    "line_number": 404,
+    "matched_text": "uses: actions/checkout@v2",
+    "snippet": "+++ b/.github/workflows/ci.yml\n@@ -6,1 +6,1 @@\n-      - uses: actions/checkout@v2\n+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6\n\"\"\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.6,
+    "target": {
+      "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+      "start_line": 404,
+      "end_line": 404
+    },
+    "confidence_score": 52,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 21,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 52,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-005-95cb57ba",
+    "rule_id": "TG-INPUT-005",
+    "title": "Unsafe Template Rendering & Disabled Autoescaping",
+    "description": "Flask render_template_string rendering untrusted input",
+    "severity": "Low",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/engine/fixture_manager.py",
+    "line_number": 176,
+    "matched_text": "render_template_string(",
+    "snippet": "                vulnerable_variant=FixtureVariant(\n                    relative_path=\"examples/python/flask-vuln\",\n                    code_pattern=\"render_template_string(f'<h1>Hello {name}</h1>')\",\n                    expected_findings_count=1,\n                ),",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.75,
+    "target": {
+      "file_path": "harness/engine/fixture_manager.py",
+      "start_line": 176,
+      "end_line": 176
+    },
+    "confidence_score": 51,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 26,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 51,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SUPPLY-004-9240a873",
+    "rule_id": "TG-SUPPLY-004",
+    "title": "Unpinned CI Action",
+    "description": "GitHub Action referenced by mutable tag instead of immutable commit SHA",
+    "severity": "Low",
+    "category": "supply",
+    "cluster": "cluster-supply-chain",
+    "file_path": "harness/validate_v0_6_3_hardening.py",
+    "line_number": 251,
+    "matched_text": "uses: actions/checkout@v2",
+    "snippet": "+++ b/.github/workflows/deploy.yml\n@@ -5,1 +5,2 @@\n-      - uses: actions/checkout@v2\n+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29\n+        with: { persist-credentials: false }",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.6,
+    "target": {
+      "file_path": "harness/validate_v0_6_3_hardening.py",
+      "start_line": 251,
+      "end_line": 251
+    },
+    "confidence_score": 49,
+    "confidence_band": "Needs Review",
+    "confidence_factors": {
+      "evidence_quality": 21,
+      "reproduction_success": 0,
+      "independent_confirmations": 8,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 49,
+      "classification_band": "Needs Review"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-003-3d00a189",
+    "rule_id": "TG-DIFF-003",
+    "title": "Unintentional Removal of Tenant Filter in Patch Deletions",
+    "description": "Removal of tenant isolation boundary in patch deletion",
+    "severity": "Low",
+    "category": "diff",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+    "line_number": 262,
+    "matched_text": "-    stmt = select(Account).where(Account.id == account_id",
+    "snippet": "+++ b/queries.py\n@@ -7,1 +7,1 @@\n-    stmt = select(Account).where(Account.id == account_id)\n+    stmt = select(Account).where(Account.id == account_id, Account.tenant_id == tenant_id)\n\"\"\",",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.8,
+    "target": {
+      "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+      "start_line": 262,
+      "end_line": 262
+    },
+    "confidence_score": 44,
+    "confidence_band": "Needs Review",
+    "confidence_factors": {
+      "evidence_quality": 28,
+      "reproduction_success": 0,
+      "independent_confirmations": 11,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 0,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 44,
+      "classification_band": "Needs Review"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-6a739666",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "tests/test_v0_6_0_governed_remediation.py",
+    "line_number": 79,
+    "matched_text": ".objects.get(id=invoice_id)",
+    "snippet": "        def get_invoice(request, invoice_id):\n            # Fetch invoice directly without tenant filter\n            invoice = Invoice.objects.get(id=invoice_id)\n            return JsonResponse({\"id\": invoice.id})\n        \"\"\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "tests/test_v0_6_0_governed_remediation.py",
+      "start_line": 79,
+      "end_line": 79
+    },
+    "confidence_score": 24,
+    "confidence_band": "Needs Review",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": true,
+      "test_deduction": -30,
+      "total_score": 24,
+      "classification_band": "Needs Review"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-fe2c60e3",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Tenant Query Isolation in Multi-Tenant Models",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "tests/test_v0_6_0_governed_remediation.py",
+    "line_number": 86,
+    "matched_text": ".objects.get(id=invoice_id)",
+    "snippet": "        # Lines shifted down by 10 lines\n        def get_invoice(request, invoice_id):\n            invoice = Invoice.objects.get(id=invoice_id)\n            return JsonResponse({\"id\": invoice.id})\n        \"\"\"",
+    "is_test": true,
+    "is_canary": true,
+    "rule_precision": 0.55,
+    "target": {
+      "file_path": "tests/test_v0_6_0_governed_remediation.py",
+      "start_line": 86,
+      "end_line": 86
+    },
+    "confidence_score": 24,
+    "confidence_band": "Needs Review",
+    "confidence_factors": {
+      "evidence_quality": 19,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 5,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": true,
+      "test_deduction": -30,
+      "total_score": 24,
+      "classification_band": "Needs Review"
+    }
+  }
+]