torusguard 1.3.6 → 2.0.0-alpha

package/skills/torusguard/payload/workflows/torusguard-harden.md

@@ -0,0 +1,104 @@
+---
+description: Governed remediation formulation under strict Ponytail Protocol bounds (<= 35 additions, <= 25 deletions) and bundle packaging.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.4.0
+agent: remediator
+lifecycle-phase: Phase 4 (Remediation Formulation)
+required-skills:
+  - torusguard-harden
+scripts-binding:
+  - .torusguard/scripts/harden_runner.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/diff_guard.py
+---
+
+# /torusguard harden — Governed Remediation & Bundle Packaging
+
+$ARGUMENTS
+
+---
+
+## Objective
+Governed remediation formulation under strict Ponytail Protocol bounds (<=35 add, <=25 del).
+
+Supported CLI flags:
+- `npx torusguard harden [--target <dir>]` : Specify project root directory
+- `npx torusguard harden --dry-run` : Preview candidate patches without modifying disk files
+- `npx torusguard harden --severity <critical|high|medium|low>` : Filter findings by minimum severity floor
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect finding targets and patch constraints before generating diffs:
+1. **Target Finding (`findings.md`):** Identify prioritized verified findings.
+2. **Ponytail Protocol:** Enforce hard limit ($\le 35$ additions, $\le 25$ deletions). Ban rewrites.
+3. **Sensitive Path Review:** Flag changes touching `auth/` or `settings.py` for human sign-off.
+4. **Behavior Preservation:** Ensure patch addresses flaw without breaking public APIs.
+5. **Dry-Run Rule:** Do NOT apply changes to disk during harden; emit bundle for review.
+6. **Backup Readiness:** Ensure rollback procedures are prepared before staging patch.
+
+---
+
+## When to Use /torusguard harden
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Formulating minimal patches for verified findings | Run `/torusguard harden` |
+| Packaging a 4-artifact remediation bundle for review | Run `/torusguard harden` |
+| Writing and applying changes to code files | Run `/torusguard apply` |
+| Differentially re-scanning code after patch application | Run `/torusguard recheck` |
+| Discovering new vulnerabilities | Run `/torusguard audit` |
+
+---
+
+## Living Report Invariant
+- Candidate patches transition findings in `security_report.md` into `CANDIDATE 🟡` status.
+- Every patch strictly conforms to Ponytail bounds (<= 35 additions, <= 25 deletions).
+
+## Execution Steps
+
+1. **Select Target Finding:** Choose verified flaw from active run directory.
+2. **Examine Live Code Context:** Read surrounding lines (±15) of vulnerable sink.
+3. **Draft Unified Diff:** Formulate minimal fix adhering to Ponytail Protocol limits.
+4. **Audit Patch Safety:** Run `python .torusguard/scripts/diff_guard.py <patch.diff>`.
+5. **Package 4-Artifact Bundle:** Write `patch.diff`, `plan.md`, `verification.md`, `rollback.md` to `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
+
+---
+
+## Failure Recovery
+
+- **Line Churn Exceeded (>35 add or >25 del):** Decompose patch into smaller sequential sub-fixes.
+- **Sensitive Path Conflict:** Mark bundle with `Requires Sensitive-Path Sign-Off` in `plan.md`.
+- **Finding Not Found:** Ensure finding ID exists in active `findings.md`.
+- **Halt Trigger:** Abort if target source file cannot be read from disk.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never generate full-file replacements or unconstrained cosmetic code refactoring.
+- ❌ Never modify imports, variables, or functions unrelated to the vulnerability.
+- ✅ Always calculate addition and deletion line counts before emitting `patch.diff`.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🛠️ TorusGuard Remediation Bundle
+- **Finding Target:** `TG-XXX-HASH` ([Vulnerability Name])
+- **File Affected:** `src/path/to/file.py`
+- **Line Churn:** +[Additions] / -[Deletions] (Ponytail: PASS)
+- **Sensitive Path:** [Yes (Sign-Off Needed) / No (Standard)]
+- **Bundle Path:** `.torusguard/runs/<run_id>/remediation/<finding_id>/`
+- **Status:** READY FOR REVIEW — run `/torusguard apply` to execute
+```
+
+---
+
+## Next Steps
+
+1. Review proposed diff in `.torusguard/runs/<run_id>/remediation/<finding_id>/patch.diff`.
+2. Run `/torusguard apply` to execute the governed patch with automatic rollback backup.

package/skills/torusguard/payload/workflows/torusguard-init.md

@@ -0,0 +1,106 @@
+---
+description: Baseline project discovery, workspace scaffolding, stack detection, and framework-tailored security rule activation.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.4.0
+agent: profiler
+lifecycle-phase: Phase 0 (Baseline Setup)
+required-skills:
+  - torusguard-init
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/stack_detect.py
+---
+
+# /torusguard init — Project Baseline & Workspace Initialization
+
+$ARGUMENTS
+
+---
+
+## Objective
+Baseline project discovery, workspace scaffolding, stack detection, and security rule activation.
+
+Supported CLI flags:
+- `npx torusguard init [--target <dir>]` : Scaffold workspace into specified root directory
+- `npx torusguard init --template <golang|nextjs|fastapi|express|django|react>` : Guide stack configuration explicitly
+- `npx torusguard init --audit` : Run immediate baseline audit post-initialization
+- `npx torusguard init --force` : Force overwrite existing workspace and re-scaffold baseline
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect workspace state before running initialization:
+1. **Config State (`.torusguard/config/torusguard.json`):** Check if workspace is already initialized. If active, prompt before re-writing.
+2. **Project Manifests:** Check root for `package.json`, `manage.py`, `requirements.txt`, `pyproject.toml`, `go.mod`, or `Cargo.toml`.
+3. **Disclosure Policy (`SECURITY.md`):** Check for existing responsible disclosure policy.
+4. **Bootstrapper:** If `.torusguard/` is absent, invoke `python skills/torusguard/bootstrap.py` to unpack offline assets.
+5. **Runtime Preconditions:** Ensure Python 3.10+ is available in the current execution shell.
+
+---
+
+## When to Use /torusguard init
+
+| Trigger Scenario | Recommended Command |
+| :--- | :--- |
+| First-time onboarding in any repository | Run `/torusguard init` |
+| Framework upgrade or major dependency changes | Run `/torusguard init` to refresh tailored rules |
+| Repository already configured | Run `/torusguard audit` |
+| Inspecting existing configuration | Run `/torusguard status` |
+| Testing legal boundaries | Run `/torusguard authorize` |
+
+---
+
+## Living Report Invariant
+- Provisions baseline `security_report.md` single-source-of-truth ledger.
+- Activates tailored rules across 18 families based on detected stack.
+
+## Execution Steps
+
+1. **Scaffold Directory Topology:** Verify `.torusguard/` structure (`config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`).
+2. **Execute Stack Detection:**
+   ```bash
+   python .torusguard/scripts/stack_detect.py .
+   ```
+3. **Activate Tailored Rules:** Symlink or copy matching security rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
+4. **Write Configuration (`.torusguard/config/torusguard.json`):**
+   Record detected stack, enabled rules count, timestamp, and runtime constraints.
+5. **Verify Initialization:** Assert `.torusguard/config/torusguard.json` and `.torusguard/config/scope.json` exist.
+
+---
+
+## Failure Recovery
+
+- **Script Exit 1 (Detection Failed):** Check Python version (`python --version` >= 3.10) and verify read access to root manifests.
+- **Permission Error:** Verify write permissions for `.torusguard/config/` and `.torusguard/rules/active/`.
+- **Missing Directories:** Re-run directory scaffolding if any subfolder creation fails.
+- **Halt Condition:** If root directory is empty, halt and prompt user to open the project root.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never invent framework dependencies not present in `package.json` or `requirements.txt`.
+- ❌ Never overwrite an existing `.torusguard/config/scope.json` containing authorized domains.
+- ✅ Always execute `.torusguard/scripts/stack_detect.py` to ground detected technologies.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🛡️ TorusGuard Workspace Initialization
+- **Primary Framework:** [Detected Stack or None]
+- **Components:** [Backend / Frontend / Database]
+- **Active Rules:** [Count] rules enabled in `.torusguard/rules/active/`
+- **Config:** `.torusguard/config/torusguard.json` generated
+- **Scope Template:** `.torusguard/config/scope.json` ready
+- **Status:** READY — run `/torusguard audit` to scan codebase
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard authorize` to define allowed target URLs and legal scan boundaries.
+2. Run `/torusguard audit` to execute the baseline static security audit.

package/skills/torusguard/payload/workflows/torusguard-recheck.md

@@ -0,0 +1,101 @@
+---
+description: Targeted differential AST re-scan, fix closure verification, and regression state machine transitions.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.3.6
+agent: reviewer
+lifecycle-phase: Phase 6 (Targeted Recheck & Verification)
+required-skills:
+  - torusguard-recheck
+scripts-binding:
+  - .torusguard/scripts/recheck_runner.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# /torusguard recheck — Targeted Differential Recheck & Regression Audit
+
+$ARGUMENTS
+
+---
+
+## Objective
+Targeted differential AST re-scan, fix closure verification, and regression state transitions.
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect applied patch history and target file scope before re-checking:
+1. **Applied Patch Record:** Verify `apply-log.json` or modified file list exists in the active run.
+2. **Scope Limitation:** Restrict differential scan strictly to modified files to conserve token budget.
+3. **Rollback Availability:** Confirm `.bak` snapshot exists in `pre_apply/` in case regression is detected.
+4. **4-State Transition Engine:** Prepare to transition findings to `Fixed`, `Partially Fixed`, `Not Fixed`, or `Regression`.
+5. **Fresh Syntax Validation:** Ensure no compiler or syntax errors exist before re-evaluating rules.
+6. **AST Consistency:** Ensure imported dependencies on modified lines resolve correctly.
+
+---
+
+## When to Use /torusguard recheck
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Immediately after applying a remediation patch | Run `/torusguard recheck` |
+| Verifying that a specific finding is eliminated | Run `/torusguard recheck` |
+| Checking whether a patch introduced new security flaws | Run `/torusguard recheck` |
+| Whole repository baseline audit | Run `/torusguard audit` |
+| Generating final signed release report | Run `/torusguard report` |
+
+---
+
+## Living Report Invariant
+- Verified fix closures transition findings in `security_report.md` to `RESOLVED 🟢`.
+- Regressions transition findings to `REGRESSED ❌`.
+
+## Execution Steps
+
+1. **Identify Modified Files:** Extract list of altered files from latest apply step.
+2. **Execute Differential AST Scan:** Re-run active security rules exclusively against modified files.
+3. **Evaluate Finding Status:**
+   - If original vulnerable AST pattern is absent and no new sink appears: transition to `Fixed`.
+   - If new security rule triggers on altered lines: classify as `Regression`.
+4. **Update Finding State:** Record verified resolution status into `findings.json`.
+5. **Emit Recheck Report:** Write `recheck-report.md` into the active run folder.
+
+---
+
+## Failure Recovery
+
+- **Finding Still Present (`Not Fixed`):** Review patch diff; the remediation did not neutralize the AST sink.
+- **New Vulnerability Detected (`Regression`):** Alert operator; prompt to revert from `.bak` snapshot.
+- **File Not Found:** Verify file path matches git repository layout.
+- **Halt Trigger:** Abort if diff shows changes outside approved patch scope.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never mark a finding as `Fixed` without re-scanning the actual AST of the patched file.
+- ❌ Never ignore new warnings introduced in modified lines.
+- ✅ Always provide before/after line comparisons confirming sink removal.
+
+---
+
+## Output Card Format
+
+```markdown
+### ✅ TorusGuard Differential Recheck
+- **Files Re-scanned:** [List of modified files]
+- **Target Finding:** `TG-XXX-HASH`
+- **Result:** [FIXED / REGRESSION / PARTIAL]
+- **Regressions Introduced:** 0
+- **Report:** `.torusguard/runs/<run_id>/recheck-report.md`
+- **Status:** VERIFIED — ready for `/torusguard report`
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard report` to generate executive summary and export OASIS SARIF v2.1.0 data.
+2. Commit the verified patch to version control.

package/skills/torusguard/payload/workflows/torusguard-recipes.md

@@ -0,0 +1,55 @@
+---
+description: Explore, search, export, and project distilled Golden Fix Recipes in persistent security memory.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.4.0
+agent: remediator
+lifecycle-phase: Phase 6 (Memory & Recipes)
+required-skills:
+  - torusguard-recipes
+scripts-binding:
+  - .torusguard/scripts/recipes_runner.py
+  - .torusguard/scripts/memory_engine.py
+---
+
+# /torusguard recipes — Golden Fix Recipe Explorer & Memory Distillation
+
+$ARGUMENTS
+
+---
+
+## Objective
+Inspect, search, export, and project reusable, verified Ponytail remediation code snippets distilled from passing security patches and persistent memory patterns.
+
+---
+
+## Command Flags & Arguments
+
+| Mode | Command Syntax | Description |
+| :--- | :--- | :--- |
+| **List Recipes** | `npx torusguard recipes` | List all distilled golden fix recipes with verification counts and churn |
+| **Search Filter** | `npx torusguard recipes --search <query>` | Filter recipes by keyword, rule family (e.g. `TG-SEC`), or language |
+| **Inspect Detail** | `npx torusguard recipes --detail <id>` | View complete unified diff snippet for a specific recipe |
+| **Export Catalog** | `npx torusguard recipes --export <file>` | Export recipes to `.json` or `.md` catalog format |
+| **Apply Preview** | `npx torusguard recipes --apply <id>` | Project recipe diff onto codebase for manual review |
+| **Target Directory** | `npx torusguard recipes --target <dir>` | Specify custom project root directory |
+
+---
+
+## Execution Steps
+
+1. **Query Memory Patterns:** Read `.torusguard/memory/patterns.json` for verified `golden_fix_recipe` entries.
+2. **Apply Filter / Search:** Match `--search` query against rule IDs, titles, diffs, and target file types.
+3. **Render 75-Column Cards:** Format recipe cards showing verified counts, rule family, and Ponytail additions/deletions.
+4. **Export / Apply:** If requested, write export file or render projected patch snippet.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🛡️ TorusGuard Golden Fix Recipes
+- **Total Distilled:** [Count] verified recipes
+- **Filter:** [Query or None]
+- **Ponytail Bounds:** All recipes strictly <= 35 additions, <= 25 deletions
+- **Storage:** `.torusguard/memory/patterns.json`
+```

package/skills/torusguard/payload/workflows/torusguard-report.md

@@ -0,0 +1,105 @@
+---
+description: Executive posture reporting, interactive HTML dashboard generation, directory attack surface heatmap, and OASIS SARIF v2.1.0 structured export.
+tools: Read, Grep, Glob, Bash, Write
+version: 2.2.0
+agent: reviewer
+lifecycle-phase: Phase 7 (Reporting & SARIF Export)
+required-skills:
+  - torusguard-report
+scripts-binding:
+  - .torusguard/scripts/html_reporter.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/sarif_exporter.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# /torusguard report — Unified Security Posture Report & SARIF / HTML Export
+
+$ARGUMENTS
+
+---
+
+## Objective
+Generate an executive security posture report, interactive dark-mode HTML dashboard (`report.html`), and schema-compliant OASIS SARIF v2.1.0 log (`results.sarif`) with zero network dependencies.
+
+---
+
+## Dual Mode Execution Syntax
+
+| Target Artifact | Mode A: Terminal CLI | Mode B: AI Chat Slash Command | Output Location |
+| :--- | :--- | :--- | :--- |
+| **Interactive HTML Dashboard** | `npx torusguard report --html` | `/torusguard report --html` or `/torusguard-report` | `report.html` (workspace root) + `.torusguard/runs/report-latest.html` |
+| **OASIS SARIF v2.1.0 Log** | `npx torusguard report --sarif` | `/torusguard report --sarif` | `.torusguard/runs/results-latest.sarif` |
+| **Combined (Both)** | `npx torusguard report --html --sarif` | `/torusguard report --html --sarif` | Both `report.html` and `results-latest.sarif` in a single pass |
+| **Custom Path** | `npx torusguard report --html --out <path>` | `/torusguard report --out <path>` | Specified path + latest run mirror |
+| **Monorepo Subproject** | `npx torusguard report --target <dir> --html` | `/torusguard report --target <dir>` | `<dir>/report.html` |
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect run records and reporting parameters before generating release artifacts:
+1. **Active Run Records:** Ensure target run folder or `.torusguard/runs/` contains valid run records.
+2. **Dual-Ledger Ground Truth:** Confirm that `security_report.md` at workspace root is in lockstep with findings.
+3. **SARIF v2.1.0 Schema:** Validate output structure against official OASIS SARIF standard (`sarif-schema-2.1.0.json`).
+4. **Multi-Analysis Category:** Tag static findings under category `torusguard/static` to prevent CI collisions.
+5. **Zero External CDN:** Ensure all icons, gauges, and scripts in `report.html` are 100% self-contained and offline-ready.
+6. **Secret Masking:** Ensure zero unredacted authorization tokens or API keys appear in report text.
+
+---
+
+## Interactive Dashboard Features (v2.2.0)
+
+When viewing `report.html` in any browser:
+1. **Safe Defenses vs Harmed Exposure:** Complete Defended Invariants inventory across all 74 rules in 18 architectural families. Clean codebases earn 100/100 (74 Defended, 0 Harmed).
+2. **Directory Attack Surface Heatmap:** Visual directory tree of exposure risk. Clicking any directory card filters the findings table to that specific folder.
+3. **Golden Recipe Explorer:** Distilled, verified fix patterns with before/after code templates and one-click clipboard copying.
+4. **Prescriptive Next Best Defenses:** Stack-aware security recommendations with copyable `npx torusguard harden` commands.
+5. **Client-Side Exporters:** Zero-network buttons to download OASIS SARIF v2.1.0 and CSV records directly from browser memory.
+6. **Multi-Agent AI Prompt Presets:** One-click prompts tailored for Cursor (`.cursorrules`), Claude Code (`CLAUDE.md`), Antigravity, and GitHub Copilot.
+7. **Print & PDF Styling:** Built-in high-contrast `@media print` layout for boardroom and compliance distribution.
+
+---
+
+## Execution Steps
+
+1. **Detect Mode & Arguments:**
+   - Parse `--html`, `--sarif`, `--out`, `--target`, and `--run` from `$ARGUMENTS`.
+   - If no format flag is specified in chat, default to generating the visual HTML dashboard (`report.html`).
+2. **Execute Reporter Scripts:**
+   - **For SARIF:**
+     ```bash
+     python .torusguard/scripts/sarif_exporter.py [--output <path>] [--root <target>]
+     ```
+   - **For HTML:**
+     ```bash
+     python .torusguard/scripts/html_reporter.py [--out <path>] [--root <target>]
+     ```
+3. **Synchronize Dual Ledger:**
+   - Verify `security_report.md` matches `report.html` findings and posture score.
+4. **Emit 75-Column Visual Summary Card:**
+   - Present markdown output card with direct clickable links to both `report.html` and `security_report.md`.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🛡️ TorusGuard Security Posture Report Emitted
+- **Posture Score:** [Score]/100 ([Status Label])
+- **Invariants Defended:** [N] Defended · [M] Harmed (74 Rules)
+- **Living Ledger:** [security_report.md](file:///path/to/security_report.md)
+- **HTML Dashboard:** [report.html](file:///path/to/report.html)
+- **SARIF v2.1.0 Export:** [results-latest.sarif](file:///path/to/results-latest.sarif)
+- **Status:** COMPLETE — dual-ledger synchronized
+```
+
+---
+
+## Failure Recovery
+
+- **Missing Run Folder:** Auto-discover the latest timestamped run in `.torusguard/runs/`.
+- **Windows File Lock:** `html_reporter.py` uses atomic temporary write swapping with exponential retry.
+- **Missing SARIF Input:** Auto-discovers findings from the latest audit run in `.torusguard/runs/`.
+- **Clean Workspace:** Emits 100/100 posture score with all 74 defended invariants listed.

package/skills/torusguard/payload/workflows/torusguard-status.md

@@ -0,0 +1,103 @@
+---
+description: Read-only diagnostic overview of workspace security posture, active configuration, rules catalog, and run history.
+tools: Read, Grep, Glob, Bash
+version: 1.4.0
+agent: reviewer
+lifecycle-phase: System / Diagnostics
+required-skills:
+  - torusguard-status
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/run_manager.py
+---
+
+# /torusguard status — Workspace Security Posture & Diagnostic Overview
+
+$ARGUMENTS
+
+---
+
+## Objective
+Read-only diagnostic overview of workspace security posture, active configuration, and run history.
+
+Supported CLI flags:
+- `npx torusguard status [--target <dir>]` : Diagnostic check on specified project directory
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect workspace state and configuration records prior to status display:
+1. **Config State (`.torusguard/config/torusguard.json`):** Confirm workspace initialization and read detected stack.
+2. **Active Rules Directory (`.torusguard/rules/active/`):** Count active rule files.
+3. **Run Folder Ledger (`.torusguard/runs/`):** Check run history and locate latest `manifest.json`.
+4. **Scope Record (`.torusguard/config/scope.json`):** Check whether runtime authorization TTL is active or expired.
+5. **Read-Only Invariant:** Ensure command performs zero file modifications or disk mutations.
+
+---
+
+## When to Use /torusguard status
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Checking workspace configuration and active security posture | Run `/torusguard status` |
+| Reviewing recent audit runs and finding counts | Run `/torusguard status` |
+| Checking active legal scope authorization TTL | Run `/torusguard status` |
+| Initializing workspace for the first time | Run `/torusguard init` |
+| Executing full security scan | Run `/torusguard audit` |
+
+---
+
+## Living Report Invariant
+- Reads current health score and status breakdown directly from `security_report.md`.
+- Displays 18 rule families and 74 rules in standardized 75-column terminal cards.
+
+## Execution Steps
+
+1. **Read Configuration:** Load `.torusguard/config/torusguard.json`; extract stack, version, and enabled rule count.
+2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
+3. **Inspect Run History:**
+   ```bash
+   python .torusguard/scripts/run_manager.py list
+   ```
+4. **Evaluate Scope Expiry:** Parse `.torusguard/config/scope.json`; report if TTL is valid or expired.
+5. **Print Status Overview:** Render complete workspace diagnostic overview card.
+
+---
+
+## Failure Recovery
+
+- **Uninitialized Workspace:** If config is missing, prompt user to execute `/torusguard init`.
+- **Zero Runs Found:** Display clean status card noting no historical audit runs exist yet.
+- **Corrupt Config File:** Report parsing error and recommend re-running `/torusguard init`.
+- **Halt Trigger:** Abort command if read access to `.torusguard/` is denied.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never display fabricated finding counts not substantiated by run manifests.
+- ❌ Never execute modifying shell commands or edit source code during status inspection.
+- ✅ Always report factual file counts from `.torusguard/rules/active/` and `.torusguard/runs/`.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🛡️ TorusGuard Workspace Status
+- **Version:** v0.9.2
+- **Framework Detected:** [Stack or None]
+- **Active Rules:** [Count] rules active in `.torusguard/rules/active/`
+- **Total Runs:** [Count] historical runs recorded
+- **Latest Run:** `run-YYYYMMDD-HHMMSS` ([Findings Count] findings)
+- **Scope Status:** [Authorized (TTL Active) / Expired / Unconfigured]
+- **Health Posture:** [GOOD / ACTION NEEDED]
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard audit` to scan codebase for security vulnerabilities.
+2. Run `/torusguard authorize` to configure or refresh live target scope.

package/skills/torusguard/payload/workflows/torusguard-verify.md

@@ -0,0 +1,100 @@
+---
+description: Evidence sufficiency verification, live disk line match audit, and finding score refinement.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.3.6
+agent: validator
+lifecycle-phase: Phase 3a (Evidence Verification)
+required-skills:
+  - torusguard-verify
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# /torusguard verify — Evidence Verification & Score Refinement
+
+$ARGUMENTS
+
+---
+
+## Objective
+Evidence sufficiency verification, live disk line match audit, and finding score refinement.
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect finding records and evidence integrity before verification:
+1. **Latest Run Records (`.torusguard/runs/`):** Locate most recent audit run directory.
+2. **Finding Files:** Confirm `findings.md` or `findings.json` exists in the target run folder.
+3. **Live File Drift:** Assert cited source files have not been edited or relocated on disk.
+4. **Scoring Model Calibration:** Ensure `finding_scorer.py` evaluates all 5 rubric dimensions.
+5. **Role Boundary:** Enforce validator role; do not apply code modifications during verification.
+
+---
+
+## When to Use /torusguard verify
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Auditing whether static findings are valid code flaws | Run `/torusguard verify` |
+| Upgrading Medium confidence finding to Confirmed | Run `/torusguard verify` |
+| No audit run executed yet | Run `/torusguard audit` first |
+| Running live network requests against endpoints | Run `/torusguard web-validate` |
+| Generating patch after verification | Run `/torusguard harden` |
+
+---
+
+## Living Report Invariant
+- Confirmed evidence sufficiency transitions findings in `security_report.md` to `VERIFIED 🟠`.
+- False positives transition to `FALSE POSITIVE ⚪`.
+
+## Execution Steps
+
+1. **Locate Target Findings:** Load active findings from latest run directory.
+2. **Live Disk Line Match:** Read current code at cited line ranges; verify AST snippet matches.
+3. **Audit Evidence Sufficiency:** Assess whether taint path is unbroken and caller context is exposed.
+4. **Refine Confidence Scores:**
+   ```bash
+   python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
+   ```
+5. **Classify Status:** Assign verified state (`Confirmed`, `Plausible`, or `False Positive / Disputed`).
+6. **Emit Verification Ledger:** Write `verified-evidence.md` into the active run folder.
+
+---
+
+## Failure Recovery
+
+- **Missing Run Folder:** Run `/torusguard audit` first to produce a valid run baseline.
+- **Line Drift Detected:** Flag line mismatch; scan nearby lines (±25) for relocated AST sink.
+- **Malformed Finding JSON:** Repair JSON structure using finding schema before scoring.
+- **Halt Trigger:** Abort if cited files are completely deleted from disk.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never confirm a finding if the cited sink has already been sanitized by middleware.
+- ❌ Never bump confidence score without documenting unbroken taint source-to-sink flow.
+- ✅ Always anchor line matches to live disk reads using `view_file`.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🧪 TorusGuard Evidence Verification
+- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
+- **Findings Evaluated:** [Count] findings
+- **Confirmed Real:** [Count] verified flaws
+- **Downgraded / False Positives:** [Count] filtered out
+- **Refined Mean Score:** [Score]/100
+- **Ledger:** `.torusguard/runs/<run_id>/verified-evidence.md`
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard web-validate` if live endpoint probing is required.
+2. Run `/torusguard harden` to build surgical patch bundles for verified flaws.