torusguard 1.3.6 → 2.0.0-alpha

package/skills/torusguard/payload/skills/torusguard/references/polyglot-security-matrix.md

@@ -1,25 +1,25 @@
-# TorusGuard Universal Polyglot Security Matrix
-
-> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
-
----
-
-## 🛡️ Cross-Language Invariant Mappings
-
-| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
-|---|---|---|---|---|---|---|
-| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
-| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
-| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
-| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
-| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
-| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
-| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
-
----
-
-## 🚀 Polyglot Hardening Rules of Thumb
-
-1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
-2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
-3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.
+# TorusGuard Universal Polyglot Security Matrix
+
+> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
+
+---
+
+## 🛡️ Cross-Language Invariant Mappings
+
+| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
+|---|---|---|---|---|---|---|
+| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
+| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
+| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
+| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
+| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
+| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
+| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
+
+---
+
+## 🚀 Polyglot Hardening Rules of Thumb
+
+1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
+2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
+3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.

package/skills/torusguard/payload/skills/torusguard/references/rust-security.md

@@ -1,40 +1,40 @@
-# TorusGuard Skill Reference: Rust Security
-
-> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Memory Safety & Unsafe Blocks
-* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
-* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
-
-### 2. Database & SQL Queries
-* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
-* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
-
-### 3. Outbound Requests & TLS
-* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
-* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```rust
-// Safe sqlx Parameterized Query
-let user = sqlx::query_as!(
-    User,
-    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
-    user_id,
-    current_tenant_id
-)
-.fetch_one(&pool)
-.await?;
-
-// Safe reqwest Client (Strict TLS)
-let client = reqwest::Client::builder()
-    .timeout(std::time::Duration::from_secs(10))
-    .build()?;
-```
+# TorusGuard Skill Reference: Rust Security
+
+> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Memory Safety & Unsafe Blocks
+* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
+* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
+
+### 2. Database & SQL Queries
+* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
+* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
+
+### 3. Outbound Requests & TLS
+* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
+* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```rust
+// Safe sqlx Parameterized Query
+let user = sqlx::query_as!(
+    User,
+    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
+    user_id,
+    current_tenant_id
+)
+.fetch_one(&pool)
+.await?;
+
+// Safe reqwest Client (Strict TLS)
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(10))
+    .build()?;
+```

package/skills/torusguard/payload/templates/audit-report.template.md

@@ -1,54 +1,54 @@
-# TorusGuard Security Audit & Runtime Verification Report
-
-> **TorusGuard Version:** `{{torusguard_version}}`  
-> **Target:** `{{target_name}}`  
-> **Run ID:** `{{run_id}}`  
-> **Timestamp:** `{{timestamp}}`  
-
----
-
-## Detected Stack
-- **Language:** {{stack_language}}
-- **Framework:** {{stack_framework}}
-- **Data Layer:** {{stack_data_layer}}
-- **Dependency Files:** {{stack_dependency_files}}
-- **Detection Confidence:** {{stack_confidence}}
-
----
-
-## Executive Posture
-**Posture:** {{posture_indicator}}  
-**Average Confidence Score:** `{{avg_confidence_score}}/100`
-
-### Finding Summary
-| Severity | Count | Confirmed | Needs Review | Remediated |
-| :--- | :---: | :---: | :---: | :---: |
-| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
-| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
-| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
-| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
-
----
-
-## Root-Cause Clusters
-{{cluster_summary_table}}
-
----
-
-## Detailed Findings
-{{finding_cards_section}}
-
----
-
-## Governance & Safety Audit Statement
-This execution complied with TorusGuard v0.8.0 governance rules:
-- **Authorization Gate:** {{authorization_status}}
-- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
-- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
-
----
-
-## Prioritized Next Steps
-1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
-2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
-3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.
+# TorusGuard Security Audit & Runtime Verification Report
+
+> **TorusGuard Version:** `{{torusguard_version}}`  
+> **Target:** `{{target_name}}`  
+> **Run ID:** `{{run_id}}`  
+> **Timestamp:** `{{timestamp}}`  
+
+---
+
+## Detected Stack
+- **Language:** {{stack_language}}
+- **Framework:** {{stack_framework}}
+- **Data Layer:** {{stack_data_layer}}
+- **Dependency Files:** {{stack_dependency_files}}
+- **Detection Confidence:** {{stack_confidence}}
+
+---
+
+## Executive Posture
+**Posture:** {{posture_indicator}}  
+**Average Confidence Score:** `{{avg_confidence_score}}/100`
+
+### Finding Summary
+| Severity | Count | Confirmed | Needs Review | Remediated |
+| :--- | :---: | :---: | :---: | :---: |
+| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
+| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
+| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
+| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
+
+---
+
+## Root-Cause Clusters
+{{cluster_summary_table}}
+
+---
+
+## Detailed Findings
+{{finding_cards_section}}
+
+---
+
+## Governance & Safety Audit Statement
+This execution complied with TorusGuard v0.8.0 governance rules:
+- **Authorization Gate:** {{authorization_status}}
+- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
+- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
+
+---
+
+## Prioritized Next Steps
+1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
+2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
+3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.

package/skills/torusguard/payload/templates/authorization.template.md

@@ -1,34 +1,34 @@
-# TorusGuard Target Authorization Record
-
-**Authorization ID:** `{{authorization_id}}`  
-**Generated At:** `{{timestamp}}`  
-**Valid Until:** `{{valid_until}}`  
-
----
-
-## 1. Target Identification
-- **Project / Application:** `{{target_name}}`
-- **Target URL / Hosts:** `{{target_hosts}}`
-- **Scope Type:** `{{scope_type}}`
-
----
-
-## 2. Permitted Boundaries
-- **Allowed Path Prefixes:**
-{{allowed_path_prefixes_list}}
-
-- **Explicitly Forbidden / Excluded Paths:**
-{{forbidden_paths_list}}
-
-- **Max Navigation Depth:** `{{max_depth}}`
-- **Max Request Budget:** `{{max_requests}}`
-- **Allow State-Changing Methods:** `{{allow_state_changing_methods}}`
-
----
-
-## 3. Owner Confirmation & Legal Statement
-> [!IMPORTANT]
-> The target application owner has confirmed that this testing environment is authorized for non-destructive, bounded runtime security validation.
-
-- **Authorized By:** `{{authorized_by}}`
-- **Confirmation Status:** `Owner Confirmed`
+# TorusGuard Target Authorization Record
+
+**Authorization ID:** `{{authorization_id}}`  
+**Generated At:** `{{timestamp}}`  
+**Valid Until:** `{{valid_until}}`  
+
+---
+
+## 1. Target Identification
+- **Project / Application:** `{{target_name}}`
+- **Target URL / Hosts:** `{{target_hosts}}`
+- **Scope Type:** `{{scope_type}}`
+
+---
+
+## 2. Permitted Boundaries
+- **Allowed Path Prefixes:**
+{{allowed_path_prefixes_list}}
+
+- **Explicitly Forbidden / Excluded Paths:**
+{{forbidden_paths_list}}
+
+- **Max Navigation Depth:** `{{max_depth}}`
+- **Max Request Budget:** `{{max_requests}}`
+- **Allow State-Changing Methods:** `{{allow_state_changing_methods}}`
+
+---
+
+## 3. Owner Confirmation & Legal Statement
+> [!IMPORTANT]
+> The target application owner has confirmed that this testing environment is authorized for non-destructive, bounded runtime security validation.
+
+- **Authorized By:** `{{authorized_by}}`
+- **Confirmation Status:** `Owner Confirmed`

package/skills/torusguard/payload/templates/finding-card.template.md

@@ -1,32 +1,32 @@
-### [{{rule_id}}] {{finding_title}}
-
-**Severity:** `{{severity_badge}}` | **Auditable Confidence:** `{{confidence_score}}/100 {{confidence_band_badge}}`  
-**Finding ID:** `{{finding_id}}` | **Fingerprint:** `{{fingerprint_hash}}`  
-**Target Location:** `{{file_path}}:{{line_number}}` (`{{code_symbol}}`)  
-**Lifecycle Status:** `{{lifecycle_status}}` | **Exploitability:** `{{exploitability_status}}`  
-
----
-
-#### 1. Provenance Chain
-- **Detection Rule:** `{{rule_id}}` (CWE-{{cwe_id}})
-- **Triggering Input:** `{{triggering_source}}`
-- **Sink Path:** `{{sink_expression}}`
-
-#### 2. Raw Verified Evidence
-```{{code_language}}
-{{raw_evidence_snippet}}
-```
-> **Evidence Checksum (SHA-256):** `{{evidence_sha256}}`
-
-#### 3. Objective Facts vs AI Interpretation
-- **Verified Facts:** {{raw_facts_summary}}
-- **AI Risk Analysis:** {{ai_interpretation}}
-
-#### 4. Remediation Diff (Minimal Churn)
-```diff
-{{remediation_diff_preview}}
-```
-
-#### 5. Retest & Verification
-- **Verification Method:** {{verification_method}}
-- **Current Retest Status:** `{{retest_status}}`
+### [{{rule_id}}] {{finding_title}}
+
+**Severity:** `{{severity_badge}}` | **Auditable Confidence:** `{{confidence_score}}/100 {{confidence_band_badge}}`  
+**Finding ID:** `{{finding_id}}` | **Fingerprint:** `{{fingerprint_hash}}`  
+**Target Location:** `{{file_path}}:{{line_number}}` (`{{code_symbol}}`)  
+**Lifecycle Status:** `{{lifecycle_status}}` | **Exploitability:** `{{exploitability_status}}`  
+
+---
+
+#### 1. Provenance Chain
+- **Detection Rule:** `{{rule_id}}` (CWE-{{cwe_id}})
+- **Triggering Input:** `{{triggering_source}}`
+- **Sink Path:** `{{sink_expression}}`
+
+#### 2. Raw Verified Evidence
+```{{code_language}}
+{{raw_evidence_snippet}}
+```
+> **Evidence Checksum (SHA-256):** `{{evidence_sha256}}`
+
+#### 3. Objective Facts vs AI Interpretation
+- **Verified Facts:** {{raw_facts_summary}}
+- **AI Risk Analysis:** {{ai_interpretation}}
+
+#### 4. Remediation Diff (Minimal Churn)
+```diff
+{{remediation_diff_preview}}
+```
+
+#### 5. Retest & Verification
+- **Verification Method:** {{verification_method}}
+- **Current Retest Status:** `{{retest_status}}`

package/skills/torusguard/payload/templates/remediation-bundle.template.md

@@ -1,35 +1,35 @@
-# Remediation Bundle: `{{bundle_id}}`
-
-**Cluster ID:** `{{cluster_id}}`  
-**Target Rule:** `{{rule_id}}` (`{{rule_title}}`)  
-**Affected Files:** `{{affected_files}}`  
-
----
-
-## 1. Problem Statement & Risk
-{{problem_statement}}
-
-**Adversarial Abuse & Practical Impact:**  
-{{risk_explanation}}
-
----
-
-## 2. Governed Minimal Patch Plan
-- **Max Additions Boundary:** $\le 35$ lines (Proposed: `+{{additions_count}}`)
-- **Max Deletions Boundary:** $\le 25$ lines (Proposed: `-{{deletions_count}}`)
-- **Governance Review Level:** `{{governance_review_level}}`
-
-### Framework-Native Diff
-```diff
-{{candidate_patch_diff}}
-```
-
----
-
-## 3. Verification & Retest Method
-{{verification_method}}
-
----
-
-## 4. Residual Risk & Edge Cases
-{{residual_risk_notes}}
+# Remediation Bundle: `{{bundle_id}}`
+
+**Cluster ID:** `{{cluster_id}}`  
+**Target Rule:** `{{rule_id}}` (`{{rule_title}}`)  
+**Affected Files:** `{{affected_files}}`  
+
+---
+
+## 1. Problem Statement & Risk
+{{problem_statement}}
+
+**Adversarial Abuse & Practical Impact:**  
+{{risk_explanation}}
+
+---
+
+## 2. Governed Minimal Patch Plan
+- **Max Additions Boundary:** $\le 35$ lines (Proposed: `+{{additions_count}}`)
+- **Max Deletions Boundary:** $\le 25$ lines (Proposed: `-{{deletions_count}}`)
+- **Governance Review Level:** `{{governance_review_level}}`
+
+### Framework-Native Diff
+```diff
+{{candidate_patch_diff}}
+```
+
+---
+
+## 3. Verification & Retest Method
+{{verification_method}}
+
+---
+
+## 4. Residual Risk & Edge Cases
+{{residual_risk_notes}}

package/skills/torusguard/payload/workflows/apply.md

@@ -1,7 +1,7 @@
 ---
 description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 1.3.6
+version: 1.4.0
 agent: remediator
 lifecycle-phase: Phase 5 (Patch Application)
 required-skills:
@@ -22,6 +22,14 @@ $ARGUMENTS
 ## Objective
 Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
 
+Supported CLI flags:
+- `npx torusguard apply [--target <dir>]` : Apply candidate patches with confirmation prompt
+- `npx torusguard apply --diff` : Preview unified diffs without modifying files on disk
+- `npx torusguard apply --selective` : Interactively review and approve patches one by one
+- `npx torusguard apply --verify` : Trigger immediate differential AST recheck post-apply
+- `npx torusguard apply --list-snapshots` : List available historical pre-apply backup snapshots
+- `npx torusguard apply --yes` / `-y` : Non-interactive auto-approval mode
+
 ---
 
 ## Mandatory Pre-Flight Context Inspection

package/skills/torusguard/payload/workflows/audit.md

@@ -1,7 +1,7 @@
 ---
 description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+version: 1.4.0
 agent: auditor
 lifecycle-phase: Phase 2 (Static Audit & Clustering)
 required-skills:
@@ -20,7 +20,13 @@ $ARGUMENTS
 ---
 
 ## Objective
-Static security AST scanning, stable fingerprinting, root-cause clustering, and 0-100 scoring.
+Static security AST scanning, stable fingerprinting, root-cause clustering, throughput telemetry, and 0-100 scoring.
+
+Supported CLI flags:
+- `npx torusguard audit [--target <dir>]` : Specify project root directory
+- `npx torusguard audit --watch` / `-w` : Continuous watch mode, re-scanning on file change
+- `npx torusguard audit --sarif` : Automatically export OASIS SARIF v2.1.0 log
+- `npx torusguard audit --severity <critical|high|medium|low>` : Floor filter for findings
 
 ---
 

package/skills/torusguard/payload/workflows/harden.md

@@ -1,7 +1,7 @@
 ---
 description: Governed remediation formulation under strict Ponytail Protocol bounds (<= 35 additions, <= 25 deletions) and bundle packaging.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+version: 1.4.0
 agent: remediator
 lifecycle-phase: Phase 4 (Remediation Formulation)
 required-skills:
@@ -22,6 +22,11 @@ $ARGUMENTS
 ## Objective
 Governed remediation formulation under strict Ponytail Protocol bounds (<=35 add, <=25 del).
 
+Supported CLI flags:
+- `npx torusguard harden [--target <dir>]` : Specify project root directory
+- `npx torusguard harden --dry-run` : Preview candidate patches without modifying disk files
+- `npx torusguard harden --severity <critical|high|medium|low>` : Filter findings by minimum severity floor
+
 ---
 
 ## Mandatory Pre-Flight Context Inspection

package/skills/torusguard/payload/workflows/init.md

@@ -1,7 +1,7 @@
 ---
 description: Baseline project discovery, workspace scaffolding, stack detection, and framework-tailored security rule activation.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+version: 1.4.0
 agent: profiler
 lifecycle-phase: Phase 0 (Baseline Setup)
 required-skills:
@@ -20,6 +20,12 @@ $ARGUMENTS
 ## Objective
 Baseline project discovery, workspace scaffolding, stack detection, and security rule activation.
 
+Supported CLI flags:
+- `npx torusguard init [--target <dir>]` : Scaffold workspace into specified root directory
+- `npx torusguard init --template <golang|nextjs|fastapi|express|django|react>` : Guide stack configuration explicitly
+- `npx torusguard init --audit` : Run immediate baseline audit post-initialization
+- `npx torusguard init --force` : Force overwrite existing workspace and re-scaffold baseline
+
 ---
 
 ## Mandatory Pre-Flight Context Inspection

package/skills/torusguard/payload/workflows/recipes.md

@@ -0,0 +1,55 @@
+---
+description: Explore, search, export, and project distilled Golden Fix Recipes in persistent security memory.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.4.0
+agent: remediator
+lifecycle-phase: Phase 6 (Memory & Recipes)
+required-skills:
+  - torusguard-recipes
+scripts-binding:
+  - .torusguard/scripts/recipes_runner.py
+  - .torusguard/scripts/memory_engine.py
+---
+
+# /torusguard recipes — Golden Fix Recipe Explorer & Memory Distillation
+
+$ARGUMENTS
+
+---
+
+## Objective
+Inspect, search, export, and project reusable, verified Ponytail remediation code snippets distilled from passing security patches and persistent memory patterns.
+
+---
+
+## Command Flags & Arguments
+
+| Mode | Command Syntax | Description |
+| :--- | :--- | :--- |
+| **List Recipes** | `npx torusguard recipes` | List all distilled golden fix recipes with verification counts and churn |
+| **Search Filter** | `npx torusguard recipes --search <query>` | Filter recipes by keyword, rule family (e.g. `TG-SEC`), or language |
+| **Inspect Detail** | `npx torusguard recipes --detail <id>` | View complete unified diff snippet for a specific recipe |
+| **Export Catalog** | `npx torusguard recipes --export <file>` | Export recipes to `.json` or `.md` catalog format |
+| **Apply Preview** | `npx torusguard recipes --apply <id>` | Project recipe diff onto codebase for manual review |
+| **Target Directory** | `npx torusguard recipes --target <dir>` | Specify custom project root directory |
+
+---
+
+## Execution Steps
+
+1. **Query Memory Patterns:** Read `.torusguard/memory/patterns.json` for verified `golden_fix_recipe` entries.
+2. **Apply Filter / Search:** Match `--search` query against rule IDs, titles, diffs, and target file types.
+3. **Render 75-Column Cards:** Format recipe cards showing verified counts, rule family, and Ponytail additions/deletions.
+4. **Export / Apply:** If requested, write export file or render projected patch snippet.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🛡️ TorusGuard Golden Fix Recipes
+- **Total Distilled:** [Count] verified recipes
+- **Filter:** [Query or None]
+- **Ponytail Bounds:** All recipes strictly <= 35 additions, <= 25 deletions
+- **Storage:** `.torusguard/memory/patterns.json`
+```