torusguard 1.3.6 → 2.0.0-alpha

package/skills/torusguard/payload/scripts/safety_gate.py

@@ -1,64 +1,64 @@
-#!/usr/bin/env python3
-"""
-TorusGuard Runtime Safety Gate Evaluator
-Evaluates prospective HTTP/browser validation probes against non-destruction policies.
-"""
-
-import sys
-import json
-import argparse
-from typing import Dict, Any, Tuple
-
-def evaluate_safety_gate(method: str, path: str, body: str = "") -> Tuple[str, str]:
-    """
-    Returns (decision, rationale)
-    Decisions:
-    - Auto-Allowed
-    - Approval Required
-    - Manual Only (Blocked)
-    """
-    method_upper = method.upper()
-
-    # Block destructive verbs
-    if method_upper in ("DELETE", "DROP"):
-        return "Manual Only", f"Method '{method_upper}' is destructive and strictly blocked from automated runtime validation."
-
-    # Block sensitive administrative paths
-    destructive_keywords = ["/admin/delete", "/shutdown", "/drop-database", "/purge", "/reset-system"]
-    for kw in destructive_keywords:
-        if kw in path.lower():
-            return "Manual Only", f"Path '{path}' targets destructive administrative endpoint '{kw}'."
-
-    # Safe read methods
-    if method_upper in ("GET", "HEAD", "OPTIONS"):
-        return "Auto-Allowed", f"Read-only method '{method_upper}' with non-destructive path."
-
-    # State-changing methods (POST, PUT, PATCH)
-    if method_upper in ("POST", "PUT", "PATCH"):
-        # Check if safe canary marker exists
-        if "tg-canary" in body.lower() or "torusguard" in body.lower():
-            return "Approval Required", f"State-changing method '{method_upper}' contains benign TorusGuard test marker; requires user approval."
-        else:
-            return "Approval Required", f"State-changing method '{method_upper}' requires operator approval before execution."
-
-    return "Approval Required", f"Unknown probe profile for {method_upper} {path}."
-
-
-def main():
-    parser = argparse.ArgumentParser(description="TorusGuard Safety Gate Evaluator")
-    parser.add_argument("--method", "-m", default="GET", help="HTTP Method")
-    parser.add_argument("--path", "-p", default="/api/test", help="Endpoint path")
-    parser.add_argument("--body", "-b", default="", help="Request payload body")
-    parser.add_argument("--json", action="store_true", help="Output JSON")
-    args = parser.parse_args()
-
-    decision, rationale = evaluate_safety_gate(args.method, args.path, args.body)
-
-    if args.json:
-        print(json.dumps({"decision": decision, "rationale": rationale}, indent=2))
-    else:
-        print(f"Safety Decision: {decision}")
-        print(f"Rationale: {rationale}")
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+TorusGuard Runtime Safety Gate Evaluator
+Evaluates prospective HTTP/browser validation probes against non-destruction policies.
+"""
+
+import sys
+import json
+import argparse
+from typing import Dict, Any, Tuple
+
+def evaluate_safety_gate(method: str, path: str, body: str = "") -> Tuple[str, str]:
+    """
+    Returns (decision, rationale)
+    Decisions:
+    - Auto-Allowed
+    - Approval Required
+    - Manual Only (Blocked)
+    """
+    method_upper = method.upper()
+
+    # Block destructive verbs
+    if method_upper in ("DELETE", "DROP"):
+        return "Manual Only", f"Method '{method_upper}' is destructive and strictly blocked from automated runtime validation."
+
+    # Block sensitive administrative paths
+    destructive_keywords = ["/admin/delete", "/shutdown", "/drop-database", "/purge", "/reset-system"]
+    for kw in destructive_keywords:
+        if kw in path.lower():
+            return "Manual Only", f"Path '{path}' targets destructive administrative endpoint '{kw}'."
+
+    # Safe read methods
+    if method_upper in ("GET", "HEAD", "OPTIONS"):
+        return "Auto-Allowed", f"Read-only method '{method_upper}' with non-destructive path."
+
+    # State-changing methods (POST, PUT, PATCH)
+    if method_upper in ("POST", "PUT", "PATCH"):
+        # Check if safe canary marker exists
+        if "tg-canary" in body.lower() or "torusguard" in body.lower():
+            return "Approval Required", f"State-changing method '{method_upper}' contains benign TorusGuard test marker; requires user approval."
+        else:
+            return "Approval Required", f"State-changing method '{method_upper}' requires operator approval before execution."
+
+    return "Approval Required", f"Unknown probe profile for {method_upper} {path}."
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Safety Gate Evaluator")
+    parser.add_argument("--method", "-m", default="GET", help="HTTP Method")
+    parser.add_argument("--path", "-p", default="/api/test", help="Endpoint path")
+    parser.add_argument("--body", "-b", default="", help="Request payload body")
+    parser.add_argument("--json", action="store_true", help="Output JSON")
+    args = parser.parse_args()
+
+    decision, rationale = evaluate_safety_gate(args.method, args.path, args.body)
+
+    if args.json:
+        print(json.dumps({"decision": decision, "rationale": rationale}, indent=2))
+    else:
+        print(f"Safety Decision: {decision}")
+        print(f"Rationale: {rationale}")
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/scripts/status_runner.py

@@ -0,0 +1,267 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Diagnostic Status Engine (v1.4.0)
+Displays workspace security posture, detected stack, active rules, historical runs,
+golden recipes, and runtime scope validity in mathematically aligned 75-column cards.
+Adheres to Python Pro & Python Patterns standards.
+"""
+
+from __future__ import annotations
+
+import sys
+import json
+import argparse
+from pathlib import Path
+from dataclasses import dataclass, asdict
+from typing import Any
+
+# Import term_ui for 75-column card formatting
+try:
+    from term_ui import (
+        BOLD, DIM, RESET, CYAN, GREEN, YELLOW, WHITE, GRAY, RED,
+        card_header, card_border_top, card_border_bottom, card_divider, format_box_line
+    )
+except ImportError:
+    scripts_dir = Path(__file__).resolve().parent
+    if str(scripts_dir) not in sys.path:
+        sys.path.insert(0, str(scripts_dir))
+    from term_ui import (
+        BOLD, DIM, RESET, CYAN, GREEN, YELLOW, WHITE, GRAY, RED,
+        card_header, card_border_top, card_border_bottom, card_divider, format_box_line
+    )
+
+
+@dataclass
+class WorkspaceStatus:
+    version: str
+    target_path: str
+    is_initialized: bool
+    stack_detected: str
+    active_rules_count: int
+    total_runs_count: int
+    latest_run_id: str | None
+    latest_run_time: str | None
+    latest_findings: int
+    golden_recipes_count: int
+    scope_status: str
+    health_score: int
+    posture_status: str
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+def collect_status(target_dir: Path) -> WorkspaceStatus:
+    """Inspect workspace configuration and filesystem records to construct status snapshot."""
+    target_dir = target_dir.resolve()
+    tg_dir = target_dir / ".torusguard"
+    is_init = tg_dir.is_dir()
+
+    # 1. Read config
+    version = "1.4.0"
+    stack_name = "Undetected"
+    cfg_file = tg_dir / "config" / "torusguard.json"
+    if cfg_file.is_file():
+        try:
+            with open(cfg_file, "r", encoding="utf-8") as f:
+                cfg = json.load(f)
+            version = cfg.get("version", version)
+            stack_name = cfg.get("stack", stack_name)
+        except (json.JSONDecodeError, OSError):
+            pass
+
+    if stack_name in ("Undetected", "Unknown", "None", ""):
+        try:
+            from stack_detect import detect_stack
+            p = detect_stack(target_dir)
+            parts = []
+            if p.get("language") and p["language"] != "Unknown":
+                parts.append(p["language"])
+            if p.get("framework") and p["framework"] != "None":
+                parts.append(p["framework"])
+            if parts:
+                stack_name = " / ".join(parts)
+        except Exception:
+            pass
+
+    # 2. Count active rules
+    active_rules_count = 0
+    active_rules_dir = tg_dir / "rules" / "active"
+    if active_rules_dir.is_dir():
+        active_rules_count = sum(1 for f in active_rules_dir.glob("*.md"))
+    if active_rules_count == 0:
+        rules_root = tg_dir / "rules"
+        if rules_root.is_dir():
+            active_rules_count = sum(1 for f in rules_root.rglob("TG-*.md"))
+    if active_rules_count == 0:
+        active_rules_count = 74  # Canonical rule catalog default
+
+    # 3. Read run history
+    total_runs = 0
+    latest_run_id: str | None = None
+    latest_run_time: str | None = None
+    latest_findings = 0
+    runs_dir = tg_dir / "runs"
+    if runs_dir.is_dir():
+        run_folders = [d for d in runs_dir.iterdir() if d.is_dir() and d.name.startswith("run-")]
+        run_folders.sort(key=lambda d: d.name, reverse=True)
+        total_runs = len(run_folders)
+        if run_folders:
+            latest = run_folders[0]
+            latest_run_id = latest.name
+            manifest_file = latest / "manifest.json"
+            if manifest_file.is_file():
+                try:
+                    with open(manifest_file, "r", encoding="utf-8") as f:
+                        m = json.load(f)
+                    latest_run_time = m.get("created_at", latest.name)
+                    latest_findings = m.get("findings_count", 0)
+                except (json.JSONDecodeError, OSError):
+                    pass
+
+    # 4. Golden recipes in persistent memory
+    golden_recipes_count = 0
+    patterns_file = tg_dir / "memory" / "patterns.json"
+    if patterns_file.is_file():
+        try:
+            with open(patterns_file, "r", encoding="utf-8") as f:
+                p_data = json.load(f)
+            if isinstance(p_data, list):
+                golden_recipes_count = sum(
+                    1 for p in p_data
+                    if isinstance(p, dict) and (
+                        p.get("pattern_type") == "golden_fix_recipe" or "recipe_data" in p or "recipe_id" in p
+                    )
+                )
+            elif isinstance(p_data, dict):
+                golden_recipes_count = len(p_data.get("golden_recipes", []))
+        except (json.JSONDecodeError, OSError):
+            pass
+
+    # 5. Scope authorization
+    scope_status = "Unconfigured"
+    scope_file = tg_dir / "config" / "scope.json"
+    if scope_file.is_file():
+        try:
+            with open(scope_file, "r", encoding="utf-8") as f:
+                s_data = json.load(f)
+            expires_at = s_data.get("expires_at")
+            if expires_at:
+                scope_status = "Authorized (TTL Active)"
+            else:
+                scope_status = "Authorized (Static)"
+        except (json.JSONDecodeError, OSError):
+            scope_status = "Error reading scope"
+
+    # 6. Posture health from security_report.md
+    health_score = 100
+    posture = "CLEAN & SECURE"
+    report_file = target_dir / "security_report.md"
+    if report_file.is_file():
+        try:
+            content = report_file.read_text(encoding="utf-8")
+            import re
+            m = re.search(r"Posture Score:\s*`(\d+)/100`", content)
+            if m:
+                health_score = int(m.group(1))
+            m_stat = re.search(r"Posture Status:\s*`([^`]+)`", content)
+            if m_stat:
+                posture = m_stat.group(1)
+        except OSError:
+            pass
+
+    if health_score < 70:
+        posture = "ACTION NEEDED"
+    elif health_score < 90:
+        posture = "ELEVATED RISK"
+    elif health_score == 100:
+        posture = "CLEAN & SECURE"
+
+    return WorkspaceStatus(
+        version=version,
+        target_path=str(target_dir),
+        is_initialized=is_init,
+        stack_detected=stack_name,
+        active_rules_count=active_rules_count,
+        total_runs_count=total_runs,
+        latest_run_id=latest_run_id,
+        latest_run_time=latest_run_time,
+        latest_findings=latest_findings,
+        golden_recipes_count=golden_recipes_count,
+        scope_status=scope_status,
+        health_score=health_score,
+        posture_status=posture,
+    )
+
+
+def print_status_card(status: WorkspaceStatus) -> None:
+    """Render standardized 75-column diagnostic status cards."""
+    print()
+    print(card_header(
+        "🛡️  T O R U S G U A R D   S T A T U S",
+        "Workspace Diagnostic Overview & Posture Snapshot",
+        f"v{status.version}"
+    ))
+    print()
+
+    # Card 1: Workspace & Stack
+    print(card_border_top("Workspace Environment", CYAN))
+    init_str = f"{GREEN}Initialized (.torusguard/ active){RESET}" if status.is_initialized else f"{RED}Uninitialized (Run: npx torusguard init){RESET}"
+    print(format_box_line(f"Workspace:    {WHITE}{status.target_path}{RESET}", 67))
+    print(format_box_line(f"Status:       {init_str}", 67))
+    print(format_box_line(f"Stack:        {BOLD}{WHITE}{status.stack_detected}{RESET}", 67))
+    print(format_box_line(f"Active Rules: {GREEN}{status.active_rules_count}{RESET} canonical rules enabled across 18 families", 67))
+    print(card_border_bottom(CYAN))
+    print()
+
+    # Card 2: Run History & Memory
+    print(card_border_top("Run History & Memory Engine", YELLOW))
+    print(format_box_line(f"Total Runs:     {WHITE}{status.total_runs_count}{RESET} historical audit runs", 67, border_color=YELLOW))
+    if status.latest_run_id:
+        print(format_box_line(f"Latest Run:     {CYAN}{status.latest_run_id}{RESET}", 67, border_color=YELLOW))
+        print(format_box_line(f"Run Timestamp:  {DIM}{status.latest_run_time or 'N/A'}{RESET}", 67, border_color=YELLOW))
+        print(format_box_line(f"Run Findings:   {WHITE}{status.latest_findings}{RESET} vulnerabilities discovered", 67, border_color=YELLOW))
+    else:
+        print(format_box_line(f"Latest Run:     {DIM}No runs recorded yet (Run: npx torusguard audit){RESET}", 67, border_color=YELLOW))
+    print(format_box_line(f"Golden Recipes: {GREEN}{status.golden_recipes_count}{RESET} verified fix patterns distilled in memory", 67, border_color=YELLOW))
+    print(format_box_line(f"Runtime Scope:  {WHITE}{status.scope_status}{RESET}", 67, border_color=YELLOW))
+    print(card_border_bottom(YELLOW))
+    print()
+
+    # Card 3: Security Posture
+    posture_color = GREEN if status.health_score >= 90 else (YELLOW if status.health_score >= 70 else RED)
+    print(card_border_top("Security Health Posture", posture_color, double=True))
+    print(format_box_line(f"Health Score:   {posture_color}{BOLD}{status.health_score}/100{RESET}", 67, border="║", border_color=posture_color))
+    print(format_box_line(f"Posture State:  {posture_color}{BOLD}{status.posture_status}{RESET}", 67, border="║", border_color=posture_color))
+    print(format_box_line(f"Living Ledger:  {CYAN}security_report.md (Synchronized){RESET}", 67, border="║", border_color=posture_color))
+    print(card_border_bottom(posture_color, double=True))
+    print()
+
+    # Quick Next Actions
+    print(card_border_top("Available Lifecycle Actions", GRAY))
+    print(format_box_line(f"Audit Codebase:   {GREEN}npx torusguard audit{RESET}", 67, border_color=GRAY))
+    print(format_box_line(f"Harden Patches:   {GREEN}npx torusguard harden{RESET}", 67, border_color=GRAY))
+    print(format_box_line(f"View Recipes:     {GREEN}npx torusguard recipes{RESET}", 67, border_color=GRAY))
+    print(format_box_line(f"HTML Dashboard:   {GREEN}npx torusguard report --html{RESET}", 67, border_color=GRAY))
+    print(card_border_bottom(GRAY))
+    print()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="TorusGuard Workspace Diagnostic Status Engine")
+    parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
+    parser.add_argument("--json", action="store_true", help="Output raw JSON snapshot")
+    args = parser.parse_args()
+
+    target = Path(args.target or args.path).resolve()
+    status = collect_status(target)
+
+    if args.json:
+        print(json.dumps(status.to_dict(), indent=2))
+    else:
+        print_status_card(status)
+
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/skills/torusguard/references/csharp-security.md

@@ -1,41 +1,41 @@
-# TorusGuard Skill Reference: C# & ASP.NET Core Security
-
-> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Authentication & Authorization
-* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
-* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
-
-### 2. Entity Framework Core & SQL Injection
-* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
-* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
-* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
-
-### 3. Anti-Forgery & TLS
-* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
-* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```csharp
-// Safe Entity Framework Parameterized Query
-var user = await context.Users
-    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
-    .FirstOrDefaultAsync();
-
-// Safe Global Query Filter in DbContext
-modelBuilder.Entity<Invoice>()
-    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
-
-// Safe Controller Security
-[Authorize]
-[ApiController]
-[Route("api/[controller]")]
-public class InvoicesController : ControllerBase { ... }
-```
+# TorusGuard Skill Reference: C# & ASP.NET Core Security
+
+> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Authentication & Authorization
+* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
+* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
+
+### 2. Entity Framework Core & SQL Injection
+* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
+* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
+* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
+
+### 3. Anti-Forgery & TLS
+* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
+* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```csharp
+// Safe Entity Framework Parameterized Query
+var user = await context.Users
+    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
+    .FirstOrDefaultAsync();
+
+// Safe Global Query Filter in DbContext
+modelBuilder.Entity<Invoice>()
+    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
+
+// Safe Controller Security
+[Authorize]
+[ApiController]
+[Route("api/[controller]")]
+public class InvoicesController : ControllerBase { ... }
+```

package/skills/torusguard/payload/skills/torusguard/references/go-security.md

@@ -1,41 +1,41 @@
-# TorusGuard Skill Reference: Go Security
-
-> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Database & SQL Injection
-* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
-* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
-
-### 2. TLS & Network Security
-* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
-* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
-
-### 3. Concurrency & Goroutine Safety
-* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
-* Use mutexes or channels to prevent data races on shared state.
-
-### 4. Input Validation & Path Traversal
-* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```go
-// Safe Parameterized Query
-row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
-
-// Safe GORM Scoping
-var invoice Invoice
-result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
-
-// Safe TLS Client
-tlsConfig := &tls.Config{
-    MinVersion: tls.VersionTLS13,
-}
-client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
-```
+# TorusGuard Skill Reference: Go Security
+
+> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Database & SQL Injection
+* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
+* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
+
+### 2. TLS & Network Security
+* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
+* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
+
+### 3. Concurrency & Goroutine Safety
+* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
+* Use mutexes or channels to prevent data races on shared state.
+
+### 4. Input Validation & Path Traversal
+* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```go
+// Safe Parameterized Query
+row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
+
+// Safe GORM Scoping
+var invoice Invoice
+result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
+
+// Safe TLS Client
+tlsConfig := &tls.Config{
+    MinVersion: tls.VersionTLS13,
+}
+client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
+```

package/skills/torusguard/payload/skills/torusguard/references/java-security.md

@@ -1,40 +1,40 @@
-# TorusGuard Skill Reference: Java & Spring Security
-
-> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Spring Security & CSRF
-* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
-* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
-
-### 2. JPA & Hibernate SQL Injection
-* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
-* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
-
-### 3. Insecure Deserialization & XML
-* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
-* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```java
-// Safe JPA Query
-@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
-Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
-
-// Safe Spring Security Configuration
-@Bean
-public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-    http
-        .authorizeHttpRequests(auth -> auth
-            .requestMatchers("/public/**").permitAll()
-            .anyRequest().authenticated()
-        );
-    return http.build();
-}
-```
+# TorusGuard Skill Reference: Java & Spring Security
+
+> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Spring Security & CSRF
+* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
+* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
+
+### 2. JPA & Hibernate SQL Injection
+* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
+* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
+
+### 3. Insecure Deserialization & XML
+* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
+* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```java
+// Safe JPA Query
+@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
+Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
+
+// Safe Spring Security Configuration
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        .authorizeHttpRequests(auth -> auth
+            .requestMatchers("/public/**").permitAll()
+            .anyRequest().authenticated()
+        );
+    return http.build();
+}
+```