torusguard 1.3.6 → 1.4.0

package/skills/torusguard/payload/workflows/torusguard-verify.md

@@ -0,0 +1,100 @@
+---
+description: Evidence sufficiency verification, live disk line match audit, and finding score refinement.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.3.6
+agent: validator
+lifecycle-phase: Phase 3a (Evidence Verification)
+required-skills:
+  - torusguard-verify
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# /torusguard verify — Evidence Verification & Score Refinement
+
+$ARGUMENTS
+
+---
+
+## Objective
+Evidence sufficiency verification, live disk line match audit, and finding score refinement.
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect finding records and evidence integrity before verification:
+1. **Latest Run Records (`.torusguard/runs/`):** Locate most recent audit run directory.
+2. **Finding Files:** Confirm `findings.md` or `findings.json` exists in the target run folder.
+3. **Live File Drift:** Assert cited source files have not been edited or relocated on disk.
+4. **Scoring Model Calibration:** Ensure `finding_scorer.py` evaluates all 5 rubric dimensions.
+5. **Role Boundary:** Enforce validator role; do not apply code modifications during verification.
+
+---
+
+## When to Use /torusguard verify
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Auditing whether static findings are valid code flaws | Run `/torusguard verify` |
+| Upgrading Medium confidence finding to Confirmed | Run `/torusguard verify` |
+| No audit run executed yet | Run `/torusguard audit` first |
+| Running live network requests against endpoints | Run `/torusguard web-validate` |
+| Generating patch after verification | Run `/torusguard harden` |
+
+---
+
+## Living Report Invariant
+- Confirmed evidence sufficiency transitions findings in `security_report.md` to `VERIFIED 🟠`.
+- False positives transition to `FALSE POSITIVE ⚪`.
+
+## Execution Steps
+
+1. **Locate Target Findings:** Load active findings from latest run directory.
+2. **Live Disk Line Match:** Read current code at cited line ranges; verify AST snippet matches.
+3. **Audit Evidence Sufficiency:** Assess whether taint path is unbroken and caller context is exposed.
+4. **Refine Confidence Scores:**
+   ```bash
+   python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
+   ```
+5. **Classify Status:** Assign verified state (`Confirmed`, `Plausible`, or `False Positive / Disputed`).
+6. **Emit Verification Ledger:** Write `verified-evidence.md` into the active run folder.
+
+---
+
+## Failure Recovery
+
+- **Missing Run Folder:** Run `/torusguard audit` first to produce a valid run baseline.
+- **Line Drift Detected:** Flag line mismatch; scan nearby lines (±25) for relocated AST sink.
+- **Malformed Finding JSON:** Repair JSON structure using finding schema before scoring.
+- **Halt Trigger:** Abort if cited files are completely deleted from disk.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never confirm a finding if the cited sink has already been sanitized by middleware.
+- ❌ Never bump confidence score without documenting unbroken taint source-to-sink flow.
+- ✅ Always anchor line matches to live disk reads using `view_file`.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🧪 TorusGuard Evidence Verification
+- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
+- **Findings Evaluated:** [Count] findings
+- **Confirmed Real:** [Count] verified flaws
+- **Downgraded / False Positives:** [Count] filtered out
+- **Refined Mean Score:** [Score]/100
+- **Ledger:** `.torusguard/runs/<run_id>/verified-evidence.md`
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard web-validate` if live endpoint probing is required.
+2. Run `/torusguard harden` to build surgical patch bundles for verified flaws.

package/skills/torusguard/payload/workflows/torusguard-web-validate.md

@@ -0,0 +1,96 @@
+---
+description: Authorized HTTP probing, token redaction, transparent audit header injection, and replay trace capture.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.3.6
+agent: validator
+lifecycle-phase: Phase 3b (Runtime Web Validation)
+required-skills:
+  - torusguard-web-validate
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/safety_gate.py
+---
+
+# /torusguard web-validate — Bounded HTTP Probing & Session Capture
+
+$ARGUMENTS
+
+---
+
+## Objective
+Authorized HTTP probing, token redaction, transparent audit header injection, and replay capture.
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect authorization parameters and safety limits before sending HTTP requests:
+1. **Active Scope (`.torusguard/config/scope.json`):** Assert target host and path are authorized with valid TTL.
+2. **Safety Gate Classification:** Test proposed endpoint against `.torusguard/scripts/safety_gate.py`.
+3. **Sensitive Route Guard:** Ensure destructive endpoints (`DELETE`, account drops) are never called automatically.
+4. **Token Redaction Pipeline:** Ensure bearer tokens and session cookies are masked (`Bearer [REDACTED]`).
+5. **Request Budget:** Enforce maximum cap of 50 requests per validation session.
+
+---
+
+## When to Use /torusguard web-validate
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Testing live route accessibility and security headers | Run `/torusguard web-validate` |
+| Verifying cookie security flags (`HttpOnly`, `Secure`, `SameSite`) | Run `/torusguard web-validate` |
+| Checking CORS headers and authentication barriers | Run `/torusguard web-validate` |
+| Pure static source code analysis | Run `/torusguard audit` |
+| Confirming exploitable attack vectors | Run `/torusguard exploit-check` |
+
+---
+
+## Execution Steps
+
+1. **Verify Legal Scope:** Check target URL against `.torusguard/config/scope.json`.
+2. **Invoke Safety Gate:**
+   ```bash
+   python .torusguard/scripts/safety_gate.py check --url <target_url> --method GET
+   ```
+3. **Dispatch Non-Destructive Probe:** Send bounded HTTP request with audit header `X-TorusGuard-AuthID`.
+4. **Redact Sensitive Headers:** Sanitize auth tokens and credentials in request and response objects.
+5. **Write Replay Artifacts:**
+   Record sanitized trace in `.torusguard/runs/<run_id>/requests.json` and emit `web-validation.md`.
+
+---
+
+## Failure Recovery
+
+- **Target Offline:** Verify local dev server is active and accessible on designated host port.
+- **Safety Gate Rejection (Manual Only):** Halt probe immediately; report endpoint requires human manual test.
+- **Rate Limit / 429:** Back off exponentially (1s, 2s, 4s); stop session if 429 persists.
+- **Halt Trigger:** Abort if target domain deviates from authorized allowlist in `scope.json`.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never dispatch HTTP requests outside domains explicitly listed in `.torusguard/config/scope.json`.
+- ❌ Never write raw Authorization headers or plaintext secrets to disk.
+- ✅ Always include transparent audit headers (`X-TorusGuard-AuthID`).
+
+---
+
+## Output Card Format
+
+```markdown
+### 🌐 TorusGuard Web Validation
+- **Target Host:** [Host URL]
+- **Endpoints Probed:** [Count] routes tested
+- **Security Headers:** [CSP / HSTS / CORS status]
+- **Cookie Security:** [HttpOnly / Secure / SameSite status]
+- **Replay Trace:** `.torusguard/runs/<run_id>/replay.json`
+- **Status:** COMPLETED — non-destructive probe finished
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard exploit-check` to confirm if reachable flaws constitute verified exploits.
+2. Run `/torusguard harden` to build surgical remediation diffs.

package/skills/torusguard/payload/workflows/torusguard.md

@@ -0,0 +1,19 @@
+---
+description: TorusGuard Autonomous Security Command Engine — run static security audits, authorized runtime web validation, governed remediation, and SARIF exports.
+version: 1.3.6
+tools: Read, Grep, Glob, Bash, Edit, Write
+agent: auditor
+---
+
+# /torusguard — Autonomous Application Security Guardrails
+
+$ARGUMENTS
+
+## Objective
+Execute TorusGuard security workflows across polyglot codebases (Python, TypeScript, Go, Rust, Java, C#, PHP, and 16+ ecosystems) using either AI chat slash commands or dedicated terminal CLI commands.
+
+## Execution
+Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-validate`, `exploit-check`, `harden`, `apply`, `rollback`, `recheck`, `recipes`, `report`, `status`, `init`):
+1. **If action is omitted or 'status':** View `.torusguard/workflows/status.md` and report posture (or run `npx torusguard status`).
+2. **If action is specified:** Load the dedicated workflow from `.torusguard/workflows/<action>.md` and matching skill from `skills/torusguard-<action>/SKILL.md` (or run equivalent CLI command: `npx torusguard <action>`).
+3. Follow the phase execution steps defined in the workflow.