npm - torusguard - Versions diffs - 1.3.6 → 2.0.0-alpha - Mend

torusguard 1.3.6 → 2.0.0-alpha

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (110) hide show

package/.torusguard/runs/report-latest.html CHANGED Viewed

@@ -133,6 +133,117 @@
     .sev-card:hover { transform: translateY(-2px); border-color: var(--accent-blue); }
     .sev-card .sev-count { font-size: 34px; font-weight: 800; }
     .sev-card .sev-label { font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; color: var(--text-muted); margin-top: 4px; }
+    .sev-sub-badge {
+      font-size: 11px;
+      font-weight: 600;
+      margin-top: 6px;
+      padding: 2px 8px;
+      border-radius: 12px;
+      background: rgba(88, 166, 255, 0.1);
+      border: 1px solid rgba(88, 166, 255, 0.25);
+      color: var(--accent-blue);
+      display: inline-block;
+    }
+    .sev-sub-badge.badge-sub-clean {
+      background: rgba(63, 185, 80, 0.15);
+      border-color: rgba(63, 185, 80, 0.4);
+      color: var(--accent-green);
+    }
+    .sev-sub-badge.badge-sub-warn {
+      background: rgba(210, 153, 34, 0.15);
+      border-color: rgba(210, 153, 34, 0.4);
+      color: var(--accent-yellow);
+    }
+    /* Governed Remediation Ledger */
+    .remediation-ledger-card {
+      margin-bottom: 24px;
+      background: var(--bg-surface);
+      border: 1px solid var(--border-subtle);
+      border-radius: 8px;
+      padding: 18px;
+      box-shadow: 0 4px 20px rgba(0, 0, 0, 0.15);
+      border-top: 3px solid var(--accent-green);
+    }
+    .remediation-header {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin-bottom: 14px;
+    }
+    .remediation-title-group {
+      display: flex;
+      align-items: center;
+      gap: 10px;
+    }
+    .rem-progress-bar-bg {
+      width: 100%;
+      height: 8px;
+      background: var(--bg-card);
+      border-radius: 4px;
+      overflow: hidden;
+      margin-bottom: 16px;
+    }
+    .rem-progress-bar-fill {
+      height: 100%;
+      background: linear-gradient(90deg, #2ea043, #3fb950);
+      border-radius: 4px;
+      transition: width 0.8s ease;
+    }
+    .rem-stat-chips-grid {
+      display: grid;
+      grid-template-columns: repeat(4, 1fr);
+      gap: 12px;
+    }
+    @media (max-width: 900px) { .rem-stat-chips-grid { grid-template-columns: 1fr 1fr; } }
+    @media (max-width: 550px) { .rem-stat-chips-grid { grid-template-columns: 1fr; } }
+    .rem-chip {
+      background: var(--bg-card);
+      border: 1px solid var(--border-subtle);
+      border-radius: 6px;
+      padding: 12px;
+      display: flex;
+      flex-direction: column;
+      gap: 6px;
+    }
+    .rem-chip-top {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+    }
+    .rem-chip-sev { font-size: 10px; font-weight: 700; padding: 2px 6px; border-radius: 4px; }
+    .rem-chip-status { font-size: 11px; font-weight: 600; }
+    .rem-chip-main {
+      display: flex;
+      align-items: baseline;
+      gap: 6px;
+    }
+    .rem-chip-num { font-size: 22px; font-weight: 800; color: var(--text-main); }
+    .rem-chip-lbl { font-size: 11px; color: var(--text-muted); }
+    .rem-chip-bar {
+      width: 100%;
+      height: 4px;
+      background: rgba(255, 255, 255, 0.05);
+      border-radius: 2px;
+      overflow: hidden;
+      margin-top: 2px;
+    }
+    .rem-chip-bar-fill { height: 100%; border-radius: 2px; }
+    .rem-chip-total {
+      border-color: rgba(63, 185, 80, 0.35);
+      background: rgba(63, 185, 80, 0.05);
+    }
+    .heatmap-badge-clean {
+      font-size: 10px;
+      font-weight: 700;
+      color: var(--accent-green);
+      background: rgba(63, 185, 80, 0.12);
+      border: 1px solid rgba(63, 185, 80, 0.3);
+      border-radius: 4px;
+      padding: 1px 6px;
+    }
     /* What-If Posture Simulator Card */
     .simulator-card {
@@ -402,6 +513,46 @@
       justify-content: space-between;
     }
+    /* Clean Baseline Card & Findings Archive */
+    .clean-baseline-card {
+      background: var(--bg-surface);
+      border: 1px solid var(--border-subtle);
+      border-left: 4px solid var(--accent-green);
+      border-radius: 8px;
+      padding: 16px 20px;
+      margin-bottom: 24px;
+      transition: border-color 0.2s;
+    }
+    .clean-baseline-header {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      flex-wrap: wrap;
+      gap: 14px;
+    }
+    .btn-archive-toggle {
+      background: var(--bg-card);
+      border: 1px solid var(--border-subtle);
+      color: var(--text-main);
+      padding: 6px 14px;
+      border-radius: 6px;
+      font-size: 12px;
+      font-weight: 600;
+      cursor: pointer;
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      transition: all 0.2s ease;
+    }
+    .btn-archive-toggle:hover {
+      background: #30363d;
+      border-color: var(--accent-blue);
+      color: var(--accent-blue);
+    }
+    body.light-theme .btn-archive-toggle:hover {
+      background: #e1e4e8;
+    }
     /* Table & Drawers */
     .table-container {
       background: var(--bg-surface);
@@ -512,11 +663,18 @@
     }
     /* OWASP Grid */
+    .owasp-card-wrapper {
+      padding: 10px 14px;
+      display: flex;
+      flex-direction: column;
+      justify-content: flex-start;
+      gap: 6px;
+    }
     .grid-owasp {
       display: grid;
       grid-template-columns: repeat(4, 1fr);
-      gap: 12px;
-      margin-bottom: 24px;
+      gap: 8px;
+      margin-bottom: 0;
     }
     @media (max-width: 950px) { .grid-owasp { grid-template-columns: repeat(2, 1fr); } }
     @media (max-width: 550px) { .grid-owasp { grid-template-columns: 1fr; } }
@@ -524,37 +682,44 @@
       background: var(--bg-surface);
       border: 1px solid var(--border-subtle);
       border-radius: 6px;
-      padding: 12px;
+      padding: 8px 10px;
     }
-    .owasp-top { display: flex; justify-content: space-between; align-items: center; margin-bottom: 8px; }
+    .owasp-top { display: flex; justify-content: space-between; align-items: center; margin-bottom: 6px; }
     .owasp-title { font-size: 11px; font-weight: 600; color: var(--text-main); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-    .owasp-badge { font-size: 10px; font-weight: 700; border: 1px solid; border-radius: 8px; padding: 1px 6px; }
-    .owasp-bar-bg { width: 100%; height: 6px; background: var(--bg-card); border-radius: 3px; overflow: hidden; }
+    .owasp-badge { font-size: 9.5px; font-weight: 700; border: 1px solid; border-radius: 8px; padding: 1px 5px; white-space: nowrap; }
+    .owasp-bar-bg { width: 100%; height: 5px; background: var(--bg-card); border-radius: 3px; overflow: hidden; }
     .owasp-bar { height: 100%; border-radius: 3px; }
     /* Compliance Framework Grid */
+    .comp-card-wrapper {
+      padding: 10px 14px;
+      display: flex;
+      flex-direction: column;
+      justify-content: flex-start;
+      gap: 6px;
+    }
     .grid-compliance {
       display: grid;
       grid-template-columns: repeat(3, 1fr);
-      gap: 14px;
-      margin-bottom: 24px;
+      gap: 8px;
+      margin-bottom: 0;
     }
     @media (max-width: 900px) { .grid-compliance { grid-template-columns: 1fr; } }
-    .comp-card { padding: 14px; }
+    .comp-card { padding: 8px 10px; }
     .comp-card-header {
       display: flex;
       justify-content: space-between;
-      align-items: flex-start;
-      margin-bottom: 12px;
+      align-items: center;
+      margin-bottom: 6px;
       border-bottom: 1px solid var(--border-subtle);
-      padding-bottom: 10px;
+      padding-bottom: 4px;
     }
-    .comp-title { font-size: 13px; font-weight: 700; color: var(--text-main); }
-    .comp-sub { font-size: 11px; color: var(--text-muted); margin-top: 2px; }
-    .comp-ctrl-list { display: flex; flex-direction: column; gap: 8px; }
-    .comp-ctrl-row { display: flex; justify-content: space-between; align-items: center; font-size: 11px; }
-    .comp-ctrl-code { font-weight: 600; color: var(--text-main); }
-    .comp-ctrl-fams { color: var(--text-muted); font-size: 10px; }
+    .comp-title { font-size: 12px; font-weight: 700; color: var(--text-main); }
+    .comp-sub { font-size: 9.5px; color: var(--text-muted); margin-top: 1px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; max-width: 120px; }
+    .comp-ctrl-list { display: flex; flex-direction: column; gap: 4px; }
+    .comp-ctrl-row { display: flex; justify-content: space-between; align-items: center; font-size: 10.5px; padding: 1px 0; }
+    .comp-ctrl-code { font-weight: 600; color: var(--text-main); font-size: 10px; }
+    .comp-ctrl-fams { color: var(--text-muted); font-size: 9px; line-height: 1.1; }
     /* Dual Grids */
     .grid-bottom {
@@ -565,24 +730,251 @@
     }
     @media (max-width: 850px) { .grid-bottom { grid-template-columns: 1fr; } }
+    .clusters-card {
+      padding: 10px 14px;
+      display: flex;
+      flex-direction: column;
+      justify-content: flex-start;
+      gap: 6px;
+    }
+    .clusters-compact-list {
+      display: grid;
+      grid-template-columns: repeat(2, 1fr);
+      gap: 6px;
+      max-height: 140px;
+      overflow-y: auto;
+    }
+    .clusters-compact-list .empty-state {
+      grid-column: 1 / -1;
+    }
+    @media (max-width: 600px) { .clusters-compact-list { grid-template-columns: 1fr; } }
     .cluster-item {
       background: var(--bg-card);
       border: 1px solid var(--border-subtle);
-      border-radius: 6px;
-      padding: 10px 12px;
-      margin-bottom: 8px;
+      border-radius: 5px;
+      padding: 5px 8px;
+      margin-bottom: 0;
+    }
+    .cluster-header { display: flex; justify-content: space-between; align-items: center; font-size: 11px; gap: 4px; }
+    .cluster-header strong { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; max-width: 130px; }
+    .cluster-sub { font-size: 9.5px; color: var(--text-muted); margin-top: 2px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+    /* Compact Single-Page Layout */
+    .header-compact {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      padding-bottom: 8px;
+      border-bottom: 1px solid var(--border-subtle);
+      margin-bottom: 4px;
+    }
+    .row-top {
+      display: grid;
+      grid-template-columns: 150px 1fr;
+      gap: 12px;
+      align-items: stretch;
+    }
+    @media (max-width: 800px) { .row-top { grid-template-columns: 1fr; } }
+    .gauge-card-compact {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      padding: 10px;
+      background: var(--bg-surface);
+      border: 1px solid var(--border-subtle);
+      border-radius: 8px;
+      text-align: center;
+    }
+    .row-middle {
+      display: grid;
+      grid-template-columns: 1.15fr 0.85fr;
+      gap: 12px;
+      align-items: start;
+    }
+    @media (max-width: 880px) { .row-middle { grid-template-columns: 1fr; } }
+    .row-bottom {
+      display: grid;
+      grid-template-columns: 1fr 1fr;
+      gap: 12px;
+      align-items: start;
+    }
+    @media (max-width: 880px) { .row-bottom { grid-template-columns: 1fr; } }
+    .footer-compact {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      border-top: 1px solid var(--border-subtle);
+      padding-top: 8px;
+      margin-top: 4px;
+      font-size: 11px;
+      color: var(--text-muted);
+      flex-wrap: wrap;
+      gap: 8px;
+    }
+    .footer-actions {
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      flex-wrap: wrap;
+    }
+    .footer-meta {
+      display: flex;
+      align-items: center;
+      gap: 12px;
+    }
+    .footer-links a {
+      color: var(--accent-blue);
+      text-decoration: none;
+    }
+    .footer-links a:hover {
+      text-decoration: underline;
     }
-    .cluster-header { display: flex; justify-content: space-between; align-items: center; font-size: 13px; }
-    .cluster-sub { font-size: 11px; color: var(--text-muted); margin-top: 4px; }
-    /* Heatmap */
-    .heatmap-row { display: flex; align-items: center; gap: 10px; margin-bottom: 8px; cursor: pointer; padding: 4px 6px; border-radius: 4px; }
-    .heatmap-row:hover { background: rgba(255, 255, 255, 0.03); }
-    body.light-theme .heatmap-row:hover { background: rgba(0, 0, 0, 0.03); }
-    .heatmap-label { font-size: 12px; font-family: monospace; color: var(--text-main); min-width: 110px; text-align: right; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-    .heatmap-bar-bg { flex: 1; height: 16px; background: var(--bg-card); border-radius: 4px; overflow: hidden; }
-    .heatmap-bar { height: 100%; border-radius: 4px; }
-    .heatmap-count { font-size: 12px; font-weight: 600; color: var(--text-muted); min-width: 25px; }
+    /* 2D Directory Attack Surface Heatmap Matrix */
+    .heatmap-card {
+      background: var(--bg-surface);
+      border: 1px solid var(--border-subtle);
+      border-radius: 8px;
+      padding: 10px 14px;
+      display: flex;
+      flex-direction: column;
+      justify-content: flex-start;
+      gap: 6px;
+    }
+    .card-compact-header {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      margin-bottom: 6px;
+      flex-wrap: wrap;
+      gap: 6px;
+    }
+    .heatmap-legend {
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      font-size: 10px;
+      color: var(--text-muted);
+    }
+    .heat-leg-item {
+      display: inline-flex;
+      align-items: center;
+      gap: 3px;
+    }
+    .heat-leg-dot {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      width: 14px;
+      height: 14px;
+      border-radius: 3px;
+      font-size: 9px;
+      font-weight: 700;
+    }
+    .heatmap-table-wrap {
+      overflow-x: auto;
+    }
+    .heatmap-table {
+      width: 100%;
+      border-collapse: separate;
+      border-spacing: 4px;
+      font-size: 11px;
+    }
+    .heatmap-table th {
+      color: var(--text-muted);
+      font-weight: 600;
+      padding: 2px 4px;
+      text-align: center;
+      font-size: 10px;
+      text-transform: uppercase;
+      letter-spacing: 0.5px;
+    }
+    .heatmap-row {
+      cursor: pointer;
+      transition: background 0.15s ease;
+    }
+    .heatmap-row:hover {
+      background: rgba(255, 255, 255, 0.04);
+    }
+    body.light-theme .heatmap-row:hover {
+      background: rgba(0, 0, 0, 0.04);
+    }
+    .heatmap-label-cell {
+      padding: 4px 6px;
+      font-family: monospace;
+      font-size: 11px;
+      color: var(--text-main);
+      white-space: nowrap;
+      font-weight: 600;
+    }
+    .heat-cell {
+      text-align: center;
+      padding: 4px 6px;
+      border-radius: 4px;
+      font-weight: 700;
+      font-size: 11px;
+      transition: transform 0.1s ease, filter 0.1s ease;
+      cursor: pointer;
+    }
+    .heat-cell:hover {
+      transform: scale(1.08);
+      filter: brightness(1.2);
+    }
+    .heat-cell-safe {
+      background: rgba(46, 160, 67, 0.22);
+      border: 1px solid rgba(63, 185, 80, 0.45);
+      color: #7ee787;
+    }
+    body.light-theme .heat-cell-safe {
+      background: rgba(46, 160, 67, 0.15);
+      border-color: rgba(46, 160, 67, 0.4);
+      color: #1a7f37;
+    }
+    .heat-cell-warn {
+      background: rgba(210, 153, 34, 0.22);
+      border: 1px solid rgba(210, 153, 34, 0.5);
+      color: #e3b341;
+    }
+    body.light-theme .heat-cell-warn {
+      background: rgba(210, 153, 34, 0.15);
+      border-color: rgba(210, 153, 34, 0.4);
+      color: #9a6700;
+    }
+    .heat-cell-crit {
+      background: rgba(248, 81, 73, 0.25);
+      border: 1px solid rgba(248, 81, 73, 0.55);
+      color: #ffa198;
+    }
+    body.light-theme .heat-cell-crit {
+      background: rgba(248, 81, 73, 0.15);
+      border-color: rgba(248, 81, 73, 0.4);
+      color: #cf222e;
+    }
+    .heat-cell-idle {
+      background: var(--bg-card);
+      border: 1px solid var(--border-subtle);
+      color: var(--text-muted);
+      opacity: 0.6;
+    }
+    /* Modal Large for Details Overlays */
+    .modal-lg {
+      max-width: 1040px;
+      width: 95%;
+      max-height: 88vh;
+      display: flex;
+      flex-direction: column;
+      padding: 18px 22px;
+    }
+    .modal-lg .modal-body {
+      overflow-y: auto;
+      flex: 1;
+      padding-right: 6px;
+    }
+    /* Existing Heatmap Row fallback */
+    .heatmap-row { display: table-row; }
     /* Golden Recipes & Diff Engine */
     .recipe-card {
@@ -693,29 +1085,32 @@
 </head>
 <body>
   <div class="container">
-    <header>
+    <header class="header-compact">
       <div class="logo-group">
-        <h1><span class="shield-icon">&#128737;</span> TorusGuard Security Report</h1>
+        <h1 style="font-size: 16px; margin: 0; display: flex; align-items: center; gap: 8px;">
+          <span class="shield-icon">&#128737;</span> TorusGuard Security Posture
+        </h1>
         <div class="project-meta">
           <strong>TorusGuard</strong> &middot;
           TypeScript &middot;
-          2026-09-18 16:20:01 IST
+          <span class="badge badge-subtle">v1.3.6</span>
+          <span class="badge badge-success">&#9679; 100% HARDENED</span>
         </div>
       </div>
       <div class="header-actions">
-        <button class="btn" id="themeToggleBtn" onclick="toggleTheme()">☀️ Light Mode</button>
-        <button class="btn" onclick="downloadSarif()">&#128229; Export SARIF</button>
-        <button class="btn" onclick="downloadCsv()">&#128202; Export CSV</button>
-        <button class="btn" onclick="window.print()">&#128438; Print / PDF</button>
+        <button class="btn btn-sm" id="themeToggleBtn" onclick="toggleTheme()">☀️ Light Mode</button>
+        <button class="btn btn-sm" onclick="downloadSarif()">&#128229; SARIF</button>
+        <button class="btn btn-sm" onclick="downloadCsv()">&#128202; CSV</button>
+        <button class="btn btn-sm" onclick="window.print()">&#128438; Print</button>
         <div class="status-badge status-clean">🟢 HARDENED & SECURE</div>
       </div>
     </header>
-    <!-- KPI Cards -->
-    <div class="grid-kpi">
-      <div class="card gauge-card">
+    <!-- Row 1: Dynamic Circular Gauge & Governed Remediation Velocity Ledger -->
+    <div class="row-top">
+      <div class="card gauge-card-compact">
         <div style="position: relative; display: flex; align-items: center; justify-content: center;">
-          <svg class="gauge-svg" viewBox="0 0 100 100">
+          <svg class="gauge-svg" style="width: 76px; height: 76px;" viewBox="0 0 100 100">
             <defs>
               <linearGradient id="gaugeGradient" x1="0%" y1="0%" x2="100%" y2="100%">
                 <stop offset="0%" stop-color="#3fb950" />
@@ -728,82 +1123,3008 @@
             <circle class="gauge-bg" cx="50" cy="50" r="40" />
             <circle class="gauge-fill" id="gaugeCircleFill" cx="50" cy="50" r="40" stroke="url(#gaugeGradient)" filter="url(#gaugeGlow)" />
           </svg>
-          <div class="gauge-value" id="postureScoreText">0</div>
+          <div class="gauge-value" id="postureScoreText" style="font-size: 20px;">0</div>
         </div>
-        <div class="stat-label" style="font-size: 12px; color: var(--text-muted); text-transform: uppercase; margin-top: 10px;">Posture Score</div>
+        <div class="stat-label" style="font-size: 11px; color: var(--text-muted); text-transform: uppercase; margin-top: 4px; font-weight: 700;">Posture Score</div>
       </div>
-      <div class="card sev-card" onclick="filterBySeverity('critical')">
-        <div class="sev-count" style="color: var(--accent-red);">0</div>
-        <div class="sev-label">Critical Exposure</div>
+    <!-- Governed Remediation & Problem-Solved Velocity Ledger -->
+    <div class="card remediation-ledger-card">
+      <div class="remediation-header">
+        <div class="remediation-title-group">
+          <span style="font-size: 22px;">⚡</span>
+          <div>
+            <div style="font-size: 15px; font-weight: 700; color: var(--text-main);">
+              Governed Remediation &amp; Problem-Solved Velocity
+            </div>
+            <div style="font-size: 12px; color: var(--text-muted); margin-top: 2px;">
+              Historical closure ledger of vulnerabilities discovered, formulated into Ponytail patches, and verified fixed.
+            </div>
+          </div>
+        </div>
+        <div class="remediation-overall-badge">
+          <span class="badge badge-success" style="font-size: 12px; padding: 4px 10px;">
+            &#10004; 68 of 68 Fixed (100% Defended)
+          </span>
+        </div>
+      </div>
+      <div class="rem-progress-bar-bg">
+        <div class="rem-progress-bar-fill" style="width: 100%;"></div>
       </div>
-      <div class="card sev-card" onclick="filterBySeverity('high')">
-        <div class="sev-count" style="color: var(--accent-orange);">0</div>
-        <div class="sev-label">High Exposure</div>
+      <div class="rem-stat-chips-grid">
+        <div class="rem-chip">
+          <div class="rem-chip-top">
+            <span class="rem-chip-sev badge badge-critical">Critical</span>
+            <span class="rem-chip-status" style="color: var(--accent-green);">
+              🟢 100% Defended
+            </span>
+          </div>
+          <div class="rem-chip-main">
+            <span class="rem-chip-num">0</span>
+            <span class="rem-chip-lbl">Solved / 0 Discovered</span>
+          </div>
+          <div class="sev-sub-badge badge-sub-clean">0 Discovered</div>
+          <div class="rem-chip-bar"><div class="rem-chip-bar-fill" style="width: 100%; background: var(--accent-green);"></div></div>
+        </div>
+        <div class="rem-chip">
+          <div class="rem-chip-top">
+            <span class="rem-chip-sev badge badge-high">High</span>
+            <span class="rem-chip-status" style="color: var(--accent-green);">
+              🟢 100% Defended
+            </span>
+          </div>
+          <div class="rem-chip-main">
+            <span class="rem-chip-num">28</span>
+            <span class="rem-chip-lbl">Solved / 28 Discovered</span>
+          </div>
+          <div class="sev-sub-badge badge-sub-clean">🟢 28 Remediated (100% Defended)</div>
+          <div class="rem-chip-bar"><div class="rem-chip-bar-fill" style="width: 100%; background: var(--accent-green);"></div></div>
+        </div>
+        <div class="rem-chip">
+          <div class="rem-chip-top">
+            <span class="rem-chip-sev badge badge-medium">Medium / Low</span>
+            <span class="rem-chip-status" style="color: var(--accent-green);">
+              🟢 100% Defended
+            </span>
+          </div>
+          <div class="rem-chip-main">
+            <span class="rem-chip-num">40</span>
+            <span class="rem-chip-lbl">Solved / 40 Discovered</span>
+          </div>
+          <div class="sev-sub-badge badge-sub-clean">🟢 40 Remediated (100% Defended)</div>
+          <div class="rem-chip-bar"><div class="rem-chip-bar-fill" style="width: 100%; background: var(--accent-green);"></div></div>
+        </div>
+        <div class="rem-chip rem-chip-total">
+          <div class="rem-chip-top">
+            <span class="rem-chip-sev badge badge-success">Guards Defended</span>
+            <span class="rem-chip-status" style="color: var(--accent-green);">
+              🟢 100% Hardened
+            </span>
+          </div>
+          <div class="rem-chip-main">
+            <span class="rem-chip-num">68</span>
+            <span class="rem-chip-lbl">Total Flaws Neutralized</span>
+          </div>
+          <div class="rem-chip-bar"><div class="rem-chip-bar-fill" style="width: 100%; background: var(--accent-green);"></div></div>
+        </div>
       </div>
+    </div>
+    </div>
-      <div class="card sev-card" onclick="filterBySeverity('medium')">
-        <div class="sev-count" style="color: var(--accent-yellow);">0</div>
-        <div class="sev-label">Medium / Low</div>
+    <!-- Row 2: 2D Directory Attack Surface Heatmap & Architectural Clusters -->
+    <div class="row-middle">
+      <div class="card heatmap-card">
+        <div class="card-compact-header">
+          <div class="section-title" style="margin-bottom: 0;">&#128293; Directory Attack Surface Heatmap</div>
+          <div class="heatmap-legend">
+            <span class="heat-leg-item"><span class="heat-leg-dot heat-cell-safe">✔</span> Defended</span>
+            <span class="heat-leg-item"><span class="heat-leg-dot heat-cell-warn">🟡</span> Warning</span>
+            <span class="heat-leg-item"><span class="heat-leg-dot heat-cell-crit">🔴</span> High Risk</span>
+            <span class="heat-leg-item"><span class="heat-leg-dot heat-cell-idle">—</span> Clean</span>
+          </div>
+        </div>
+        <div class="heatmap-table-wrap">
+          <table class="heatmap-table">
+            <thead>
+              <tr>
+                <th style="text-align: left; width: 90px;">Module</th>
+                <th>AUTH</th>
+                <th>DB</th>
+                <th>INPUT</th>
+                <th>NET</th>
+                <th>PLAT</th>
+                <th>SEC</th>
+                <th style="text-align: right; width: 85px;">Posture</th>
+              </tr>
+            </thead>
+            <tbody>
+            <tr class="heatmap-row" onclick="filterByDirectory('harness/')" title="Click to filter findings in harness/">
+              <td class="heatmap-label-cell"><code>harness/</code></td>
+              <td class="heat-cell heat-cell-safe" title="harness/ • Identity &amp; Auth: 9 Invariants Hardened" onclick="filterByDirectory('harness/'); event.stopPropagation();">✔ 9</td><td class="heat-cell heat-cell-safe" title="harness/ • Database &amp; Isolation: 12 Invariants Hardened" onclick="filterByDirectory('harness/'); event.stopPropagation();">✔ 12</td><td class="heat-cell heat-cell-safe" title="harness/ • Input &amp; LLM Defense: 10 Invariants Hardened" onclick="filterByDirectory('harness/'); event.stopPropagation();">✔ 10</td><td class="heat-cell heat-cell-safe" title="harness/ • Network &amp; SSRF: 1 Invariants Hardened" onclick="filterByDirectory('harness/'); event.stopPropagation();">✔ 1</td><td class="heat-cell heat-cell-safe" title="harness/ • Platform &amp; Supply: 23 Invariants Hardened" onclick="filterByDirectory('harness/'); event.stopPropagation();">✔ 23</td><td class="heat-cell heat-cell-safe" title="harness/ • Secrets &amp; Keys: 11 Invariants Hardened" onclick="filterByDirectory('harness/'); event.stopPropagation();">✔ 11</td>
+              <td style="text-align: right;"><span class="heatmap-badge-clean">🟢 66 Defended</span></td>
+            </tr>
+            <tr class="heatmap-row" onclick="filterByDirectory('tests/')" title="Click to filter findings in tests/">
+              <td class="heatmap-label-cell"><code>tests/</code></td>
+              <td class="heat-cell heat-cell-idle" title="tests/ • Identity &amp; Auth: Clean / Zero Flaws" onclick="filterByDirectory('tests/'); event.stopPropagation();">—</td><td class="heat-cell heat-cell-safe" title="tests/ • Database &amp; Isolation: 2 Invariants Hardened" onclick="filterByDirectory('tests/'); event.stopPropagation();">✔ 2</td><td class="heat-cell heat-cell-idle" title="tests/ • Input &amp; LLM Defense: Clean / Zero Flaws" onclick="filterByDirectory('tests/'); event.stopPropagation();">—</td><td class="heat-cell heat-cell-idle" title="tests/ • Network &amp; SSRF: Clean / Zero Flaws" onclick="filterByDirectory('tests/'); event.stopPropagation();">—</td><td class="heat-cell heat-cell-idle" title="tests/ • Platform &amp; Supply: Clean / Zero Flaws" onclick="filterByDirectory('tests/'); event.stopPropagation();">—</td><td class="heat-cell heat-cell-idle" title="tests/ • Secrets &amp; Keys: Clean / Zero Flaws" onclick="filterByDirectory('tests/'); event.stopPropagation();">—</td>
+              <td style="text-align: right;"><span class="heatmap-badge-clean">🟢 2 Defended</span></td>
+            </tr>
+            </tbody>
+          </table>
+        </div>
       </div>
-      <div class="card sev-card" onclick="toggleDefendedSection()">
-        <div class="sev-count" style="color: var(--accent-green);">74<span style="font-size: 16px; color: var(--text-muted);">/74</span></div>
-        <div class="sev-label">Guards Defended</div>
+      <div class="card clusters-card">
+        <div class="section-title" style="margin-bottom: 8px;">&#128736; Root-Cause Architectural Clusters</div>
+        <div class="clusters-compact-list">
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Transport Security</strong>
+                <span class="badge badge-success">&#10004; 13 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 3 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Tenant Isolation</strong>
+                <span class="badge badge-success">&#10004; 12 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 6 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Credentials Exposure</strong>
+                <span class="badge badge-success">&#10004; 11 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 5 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Injection</strong>
+                <span class="badge badge-success">&#10004; 10 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 6 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Auth Bypass</strong>
+                <span class="badge badge-success">&#10004; 9 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 2 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Platform</strong>
+                <span class="badge badge-success">&#10004; 6 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 2 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Client Leak</strong>
+                <span class="badge badge-success">&#10004; 3 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 2 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+            <div class="cluster-item">
+              <div class="cluster-header">
+                <strong>Cluster Supply Chain</strong>
+                <span class="badge badge-success">&#10004; 3 Dismantled</span>
+              </div>
+              <div class="cluster-sub">Blast Radius: 2 file(s) &middot; <span style="color: var(--accent-green); font-weight: 600;">🟢 Neutralized &amp; Defended</span></div>
+            </div>
+        </div>
       </div>
     </div>
-    <!-- What-If Posture Score Simulator -->
-    <div class="card simulator-card simulator-clean">
-      <div>
-        <div style="display: flex; align-items: center; gap: 8px;">
-          <strong style="font-size: 13px;">⚡ Interactive "What-If" Posture Score Simulator</strong>
-          <span class="badge badge-primary">Dynamic Recalculation</span>
+    <!-- Row 3: OWASP Top 10 & Enterprise Compliance -->
+    <div class="row-bottom">
+      <div class="card owasp-card-wrapper">
+        <div class="section-title" style="margin-bottom: 8px;">&#128737; OWASP Top 10 (2021/2026) Compliance Matrix</div>
+        <div class="grid-owasp">
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A01: Broken Access Control</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A02: Cryptographic Failures</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A03: Injection Defense</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A05: Security Configuration</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A06: Supply Chain Health</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A07: Identity & Auth</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A08: Software Integrity</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        <div class="owasp-card">
+          <div class="owasp-top">
+            <span class="owasp-title">A10: SSRF Defense</span>
+            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
+          </div>
+          <div class="owasp-bar-bg">
+            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
+          </div>
+        </div>
+        </div>
+      </div>
+      <div class="card comp-card-wrapper">
+        <div class="section-title" style="margin-bottom: 8px;">&#127963; Enterprise Compliance Framework Mapping (SOC 2 &middot; ISO 27001 &middot; HIPAA)</div>
+        <div class="grid-compliance" id="gridCompliance">
+        <div class="card comp-card">
+          <div class="comp-card-header">
+            <div>
+              <div class="comp-title">SOC 2 Type II</div>
+              <div class="comp-sub">AICPA Trust Services Criteria (Security & Boundary)</div>
+            </div>
+            <span class="badge badge-success">100% Met</span>
+          </div>
+          <div class="comp-ctrl-list">
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">CC6.1 Logical Access</div>
+                <div class="comp-ctrl-fams">TG-AUTH, TG-CLIENT</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">CC6.6 Network Boundary</div>
+                <div class="comp-ctrl-fams">TG-SSRF, TG-RATE, TG-WS</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">CC6.7 Transmission Security</div>
+                <div class="comp-ctrl-fams">TG-PLATFORM, TG-SEC</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">CC7.1 Vulnerability & Churn</div>
+                <div class="comp-ctrl-fams">TG-DIFF, TG-SUPPLY</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+          </div>
+        </div>
+        <div class="card comp-card">
+          <div class="comp-card-header">
+            <div>
+              <div class="comp-title">ISO/IEC 27001:2022</div>
+              <div class="comp-sub">Annex A Controls for Technological & Application Security</div>
+            </div>
+            <span class="badge badge-success">100% Met</span>
+          </div>
+          <div class="comp-ctrl-list">
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">A.8.20 Network Security</div>
+                <div class="comp-ctrl-fams">TG-SSRF, TG-WEBHOOK, TG-RATE</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">A.8.24 Cryptography Usage</div>
+                <div class="comp-ctrl-fams">TG-SEC, TG-AUTH</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">A.8.28 Secure Coding</div>
+                <div class="comp-ctrl-fams">TG-INPUT, TG-DB, TG-GQL, TG-AGENT</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+          </div>
+        </div>
+        <div class="card comp-card">
+          <div class="comp-card-header">
+            <div>
+              <div class="comp-title">HIPAA Security Rule</div>
+              <div class="comp-sub">45 CFR Part 164 Technical Safeguards for ePHI</div>
+            </div>
+            <span class="badge badge-success">100% Met</span>
+          </div>
+          <div class="comp-ctrl-list">
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">§ 164.312(a)(1) Access Control</div>
+                <div class="comp-ctrl-fams">TG-AUTH, TG-DB (Tenant Isolation)</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">§ 164.312(c)(1) ePHI Integrity</div>
+                <div class="comp-ctrl-fams">TG-WEBHOOK, TG-BIZ, TG-DIFF</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+            <div class="comp-ctrl-row">
+              <div>
+                <div class="comp-ctrl-code">§ 164.312(e)(1) Transmission Security</div>
+                <div class="comp-ctrl-fams">TG-PLATFORM, TG-SEC, TG-CLIENT</div>
+              </div>
+              <div><span class="badge badge-success">&#10004; Passing</span></div>
+            </div>
+          </div>
+        </div>
+        </div>
+      </div>
+    </div>
+    <!-- Executive Action Footer Bar (Zero Scroll Navigation) -->
+    <footer class="footer-compact">
+      <div class="footer-actions">
+        <button class="btn btn-sm" onclick="openFindingsModal()">&#128269; View Findings &amp; Evidence (68)</button>
+        <button class="btn btn-sm" onclick="openInvariantsModal()">&#128737; 74 Invariants Catalog</button>
+        <button class="btn btn-sm" onclick="openRecipesModal()">&#10024; Golden Fix Recipes (15)</button>
+        <button class="btn btn-sm" onclick="openAdvisoryModal()">&#128161; Defenses Advisory</button>
+      </div>
+      <div class="footer-meta">
+        <span>TorusGuard v1.3.6 &middot; 100% Local-First &middot; Zero Cloud Telemetry</span>
+      </div>
+    </footer>
+  </div>
+  <!-- Deep Inspection Modals -->
+  <!-- 1. Findings & Evidence Modal -->
+  <div id="findingsModal" class="modal-backdrop" style="display: none;" onclick="closeModal('findingsModal', event)">
+    <div class="modal-card modal-lg" onclick="event.stopPropagation()">
+      <div class="modal-header">
+        <div>
+          <h3 style="font-size: 16px; margin: 0; color: var(--text-main);">&#128269; Governed Security Findings &amp; Evidence Archive</h3>
+          <div style="font-size: 12px; color: var(--text-muted); margin-top: 2px;">
+            68 findings discovered across repository AST inspection.
+          </div>
+        </div>
+        <button class="modal-close-btn" onclick="closeModal('findingsModal', event)">&times;</button>
+      </div>
+      <div class="modal-body" style="padding-top: 10px;">
+        <!-- Interactive What-If Posture Score Simulator -->
+        <div class="card simulator-card simulator-clean" style="margin-bottom: 14px;">
+          <div>
+            <div style="display: flex; align-items: center; gap: 8px;">
+              <strong style="font-size: 13px;">⚡ Interactive "What-If" Posture Score Simulator</strong>
+              <span class="badge badge-primary">Dynamic Recalculation</span>
+            </div>
+            <div style="font-size: 12px; color: var(--text-muted); margin-top: 4px;">
+              All 74 security invariants are currently defended. Simulator is ready for live remediation modeling during audit cycles.
+            </div>
+          </div>
+          <div class="sim-stats">
+            <div>Current: <strong id="simCurrentVal">100</strong>/100</div>
+            <div>&rarr;</div>
+            <div>Projected: <strong id="simProjectedVal" style="color: var(--accent-blue);">100</strong>/100 <span id="simDeltaBadge" class="badge badge-success">+0 pts</span></div>
+          </div>
+          <div class="sim-actions">
+            <button class="btn btn-sm" onclick="simulateFixAll('Critical')">&#9889; Simulate Criticals</button>
+            <button class="btn btn-sm" onclick="simulateFixAll('all')">&#9889; Simulate All Fixes</button>
+            <button class="btn btn-sm" onclick="resetSimulatedFixes()">Reset Simulator</button>
+          </div>
+        </div>
+    <!-- Clean & Hardened Baseline Summary (Zero Active Vulnerabilities) -->
+    <div class="clean-baseline-card">
+      <div class="clean-baseline-header">
+        <div style="display: flex; align-items: center; gap: 12px;">
+          <span style="font-size: 26px;">🛡️</span>
+          <div>
+            <div style="font-size: 15px; font-weight: 700; color: var(--accent-green); letter-spacing: -0.01em;">
+              Clean &amp; Hardened Baseline &middot; 0 Active Vulnerabilities
+            </div>
+            <div style="font-size: 12px; color: var(--text-muted); margin-top: 2px;">
+              All 68 identified issues have been governed, hardened, and verified across all architectural layers.
+            </div>
+          </div>
+        </div>
+        <button class="btn-archive-toggle" id="btnArchiveToggle" onclick="toggleFindingsArchive()">
+          <span id="archiveToggleIcon">&#9654;</span> View Findings Archive (68)
+        </button>
+      </div>
+      <div id="findingsArchiveBody" style="display: block; margin-top: 16px; border-top: 1px solid var(--border-subtle); padding-top: 16px;">
+        <div class="filter-bar">
+          <div class="filter-pills">
+            <span class="pill-group-label">Severity:</span>
+            <span class="pill active" data-sev-filter="all" onclick="filterBySeverity('all')">All</span>
+            <span class="pill" data-sev-filter="critical" onclick="filterBySeverity('critical')">&#128308; Critical (0)</span>
+            <span class="pill" data-sev-filter="high" onclick="filterBySeverity('high')">&#128992; High (0)</span>
+            <span class="pill" data-sev-filter="medium" onclick="filterBySeverity('medium')">&#128993; Med/Low (0)</span>
+            <span class="pill-group-label" style="margin-left: 8px;">Status:</span>
+            <span class="pill active" data-status-filter="all" onclick="filterByStatus('all')">All (68)</span>
+            <span class="pill" data-status-filter="open" onclick="filterByStatus('open')">&#9888; Open (0)</span>
+            <span class="pill" data-status-filter="resolved" onclick="filterByStatus('resolved')">&#10004; Resolved (68)</span>
+            <span class="dir-filter-chip" id="dirFilterChip" onclick="clearDirectoryFilter()">
+              Folder: <strong id="dirFilterName"></strong> &times;
+            </span>
+            <button class="btn-reset-filters" id="btnResetFilters" onclick="resetAllFilters()">&times; Reset Filters</button>
+          </div>
+          <div class="search-wrapper">
+            <input type="text" id="searchInput" class="search-input" placeholder="Search rules, titles, files..." oninput="searchFindings()">
+            <button class="search-clear-btn" id="searchClearBtn" onclick="clearSearch()">&times;</button>
+          </div>
         </div>
-        <div style="font-size: 12px; color: var(--text-muted); margin-top: 4px;">
-          All 74 security invariants are currently defended. Simulator is ready for live remediation modeling during audit cycles.
+        <div class="filter-stats-bar">
+          <div>Showing <span id="visibleCount" style="font-weight: 700; color: var(--text-main);">50</span> of <span id="totalCount" style="font-weight: 700; color: var(--text-main);">68</span> cataloged findings</div>
+          <div id="activeFilterSummary" style="font-size: 11px; color: var(--accent-blue);"></div>
+        </div>
+        <div class="table-container">
+          <table>
+            <thead>
+              <tr>
+                <th style="width: 70px; text-align: center;">Simulate</th>
+                <th style="width: 110px;">Severity</th>
+                <th style="width: 130px;">Rule ID</th>
+                <th>Finding Title</th>
+                <th style="width: 250px;">File &amp; Location</th>
+                <th style="width: 90px;">Confidence</th>
+                <th style="width: 30px;"></th>
+              </tr>
+            </thead>
+            <tbody id="findingsTableBody">
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-input-002 raw sql concatenation harness/runner.py high resolved" data-path="harness/runner.py" data-drawer-id="drawer-0" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-002</code></td>
+              <td class="finding-title">Raw SQL Concatenation</td>
+              <td><code>harness/runner.py:258</code></td>
+              <td><span class="conf-score">84%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-0" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-002-f8cd11b9</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:258</code> &middot;
+                      <strong>Confidence:</strong> 84/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Python f-string interpolation in raw SQL query</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-002</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-002', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/runner.py high resolved" data-path="harness/runner.py" data-drawer-id="drawer-1" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/runner.py:211</code></td>
+              <td><span class="conf-score">81%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-1" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-593d6437</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:211</code> &middot;
+                      <strong>Confidence:</strong> 81/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/validate_qa_v0_6_0.py high resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-2" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/validate_qa_v0_6_0.py:64</code></td>
+              <td><span class="conf-score">77%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-2" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-c616aefd</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:64</code> &middot;
+                      <strong>Confidence:</strong> 77/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/validate_qa_v0_6_0.py high resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-3" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/validate_qa_v0_6_0.py:90</code></td>
+              <td><span class="conf-score">77%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-3" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-d5b3684f</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:90</code> &middot;
+                      <strong>Confidence:</strong> 77/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/validate_v0_6_2_modern_stacks.py high resolved" data-path="harness/validate_v0_6_2_modern_stacks.py" data-drawer-id="drawer-4" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/validate_v0_6_2_modern_stacks.py:341</code></td>
+              <td><span class="conf-score">77%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-4" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-54f1a02a</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_2_modern_stacks.py:341</code> &middot;
+                      <strong>Confidence:</strong> 77/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/validate_v0_6_2_modern_stacks.py high resolved" data-path="harness/validate_v0_6_2_modern_stacks.py" data-drawer-id="drawer-5" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/validate_v0_6_2_modern_stacks.py:356</code></td>
+              <td><span class="conf-score">77%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-5" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-676f776e</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_2_modern_stacks.py:356</code> &middot;
+                      <strong>Confidence:</strong> 77/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/validate_v0_6_2_modern_stacks.py high resolved" data-path="harness/validate_v0_6_2_modern_stacks.py" data-drawer-id="drawer-6" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/validate_v0_6_2_modern_stacks.py:362</code></td>
+              <td><span class="conf-score">77%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-6" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-58f70e46</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_2_modern_stacks.py:362</code> &middot;
+                      <strong>Confidence:</strong> 77/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/runner.py high resolved" data-path="harness/runner.py" data-drawer-id="drawer-7" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/runner.py:505</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-7" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-e8cc000a</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:505</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/runner.py high resolved" data-path="harness/runner.py" data-drawer-id="drawer-8" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/runner.py:506</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-8" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-89b581f9</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:506</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-input-002 raw sql concatenation harness/validate_v1_1_0_advanced_memory.py high resolved" data-path="harness/validate_v1_1_0_advanced_memory.py" data-drawer-id="drawer-9" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-002</code></td>
+              <td class="finding-title">Raw SQL Concatenation</td>
+              <td><code>harness/validate_v1_1_0_advanced_memory.py:109</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-9" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-002-266bcaa1</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_1_0_advanced_memory.py:109</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Python f-string interpolation in raw SQL query</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-002</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-002', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/master_validation.py high resolved" data-path="harness/master_validation.py" data-drawer-id="drawer-10" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/master_validation.py:257</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-10" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-7c852ff3</code> &middot;
+                      <strong>File:</strong> <code>harness/master_validation.py:257</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/master_validation.py high resolved" data-path="harness/master_validation.py" data-drawer-id="drawer-11" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/master_validation.py:460</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-11" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-02761dbb</code> &middot;
+                      <strong>File:</strong> <code>harness/master_validation.py:460</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/validate_e2e.py high resolved" data-path="harness/validate_e2e.py" data-drawer-id="drawer-12" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/validate_e2e.py:355</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-12" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-3a2b5eca</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_e2e.py:355</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-db-002 privileged database credential in browser context harness/validate_v0_7_0_runtime.py high resolved" data-path="harness/validate_v0_7_0_runtime.py" data-drawer-id="drawer-13" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-002</code></td>
+              <td class="finding-title">Privileged Database Credential in Browser Context</td>
+              <td><code>harness/validate_v0_7_0_runtime.py:129</code></td>
+              <td><span class="conf-score">71%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-13" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-002-14cf4139</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_7_0_runtime.py:129</code> &middot;
+                      <strong>Confidence:</strong> 71/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Service role key or raw database connection string reference in frontend code</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-002</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-002', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/evaluate_portfolio_polyglot.py high resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-14" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:74</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-14" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-04571685</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:74</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled TLS certificate verification (verify=False)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/validate_v0_6_3_hardening.py high resolved" data-path="harness/validate_v0_6_3_hardening.py" data-drawer-id="drawer-15" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/validate_v0_6_3_hardening.py:119</code></td>
+              <td><span class="conf-score">67%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-15" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-e33fd263</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_3_hardening.py:119</code> &middot;
+                      <strong>Confidence:</strong> 67/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/validate_v0_6_3_hardening.py high resolved" data-path="harness/validate_v0_6_3_hardening.py" data-drawer-id="drawer-16" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/validate_v0_6_3_hardening.py:127</code></td>
+              <td><span class="conf-score">67%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-16" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-ff3f7499</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_3_hardening.py:127</code> &middot;
+                      <strong>Confidence:</strong> 67/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/validate_v0_6_3_hardening.py high resolved" data-path="harness/validate_v0_6_3_hardening.py" data-drawer-id="drawer-17" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/validate_v0_6_3_hardening.py:135</code></td>
+              <td><span class="conf-score">67%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-17" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-a7c00c05</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_3_hardening.py:135</code> &middot;
+                      <strong>Confidence:</strong> 67/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/evaluate_portfolio_polyglot.py high resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-18" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:107</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-18" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-33adb2d9</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:107</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Session cookie secure flag disabled in Django settings</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/evaluate_portfolio_polyglot.py high resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-19" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:239</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-19" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-4a33f7e7</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:239</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Attribute disabling ASP.NET authentication</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-platform-003 production stack trace exposure harness/runner.py high resolved" data-path="harness/runner.py" data-drawer-id="drawer-20" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-PLATFORM-003</code></td>
+              <td class="finding-title">Production Stack Trace Exposure</td>
+              <td><code>harness/runner.py:392</code></td>
+              <td><span class="conf-score">56%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-20" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-PLATFORM-003-69f083d6</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:392</code> &middot;
+                      <strong>Confidence:</strong> 56/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django DEBUG mode enabled in configuration</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-PLATFORM-003</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-PLATFORM-003', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-input-005 unsafe template rendering &amp;amp; disabled autoescaping harness/validate_qa_v0_6_0.py high resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-21" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-005</code></td>
+              <td class="finding-title">Unsafe Template Rendering &amp; Disabled Autoescaping</td>
+              <td><code>harness/validate_qa_v0_6_0.py:177</code></td>
+              <td><span class="conf-score">52%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-21" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-005-7f81ea7f</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:177</code> &middot;
+                      <strong>Confidence:</strong> 52/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Flask render_template_string rendering untrusted input</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-005</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-005', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-input-005 unsafe template rendering &amp;amp; disabled autoescaping harness/validate_qa_v0_6_0.py high resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-22" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-005</code></td>
+              <td class="finding-title">Unsafe Template Rendering &amp; Disabled Autoescaping</td>
+              <td><code>harness/validate_qa_v0_6_0.py:193</code></td>
+              <td><span class="conf-score">52%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-22" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-005-e0ffb03b</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:193</code> &middot;
+                      <strong>Confidence:</strong> 52/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Flask render_template_string rendering untrusted input</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-005</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-005', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-input-005 unsafe template rendering &amp;amp; disabled autoescaping harness/validate_e2e.py high resolved" data-path="harness/validate_e2e.py" data-drawer-id="drawer-23" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-005</code></td>
+              <td class="finding-title">Unsafe Template Rendering &amp; Disabled Autoescaping</td>
+              <td><code>harness/validate_e2e.py:457</code></td>
+              <td><span class="conf-score">49%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-23" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-005-d7ef73f1</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_e2e.py:457</code> &middot;
+                      <strong>Confidence:</strong> 49/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Flask render_template_string rendering untrusted input</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-005</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-005', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-supply-004 unpinned ci action harness/validate_v0_6_2_modern_stacks.py high resolved" data-path="harness/validate_v0_6_2_modern_stacks.py" data-drawer-id="drawer-24" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SUPPLY-004</code></td>
+              <td class="finding-title">Unpinned CI Action</td>
+              <td><code>harness/validate_v0_6_2_modern_stacks.py:383</code></td>
+              <td><span class="conf-score">47%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-24" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SUPPLY-004-e52415c0</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_2_modern_stacks.py:383</code> &middot;
+                      <strong>Confidence:</strong> 47/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">GitHub Action referenced by mutable tag instead of immutable commit SHA</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SUPPLY-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SUPPLY-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-supply-004 unpinned ci action harness/validate_v0_6_2_modern_stacks.py high resolved" data-path="harness/validate_v0_6_2_modern_stacks.py" data-drawer-id="drawer-25" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SUPPLY-004</code></td>
+              <td class="finding-title">Unpinned CI Action</td>
+              <td><code>harness/validate_v0_6_2_modern_stacks.py:404</code></td>
+              <td><span class="conf-score">47%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-25" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SUPPLY-004-b9d15743</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_2_modern_stacks.py:404</code> &middot;
+                      <strong>Confidence:</strong> 47/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">GitHub Action referenced by mutable tag instead of immutable commit SHA</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SUPPLY-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SUPPLY-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-input-005 unsafe template rendering &amp;amp; disabled autoescaping harness/engine/fixture_manager.py high resolved" data-path="harness/engine/fixture_manager.py" data-drawer-id="drawer-26" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-005</code></td>
+              <td class="finding-title">Unsafe Template Rendering &amp; Disabled Autoescaping</td>
+              <td><code>harness/engine/fixture_manager.py:176</code></td>
+              <td><span class="conf-score">46%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-26" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-005-95cb57ba</code> &middot;
+                      <strong>File:</strong> <code>harness/engine/fixture_manager.py:176</code> &middot;
+                      <strong>Confidence:</strong> 46/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Flask render_template_string rendering untrusted input</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-005</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-005', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="high" data-status="resolved" data-search="tg-supply-004 unpinned ci action harness/validate_v0_6_3_hardening.py high resolved" data-path="harness/validate_v0_6_3_hardening.py" data-drawer-id="drawer-27" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-high">High</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SUPPLY-004</code></td>
+              <td class="finding-title">Unpinned CI Action</td>
+              <td><code>harness/validate_v0_6_3_hardening.py:251</code></td>
+              <td><span class="conf-score">44%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-27" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SUPPLY-004-9240a873</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_3_hardening.py:251</code> &middot;
+                      <strong>Confidence:</strong> 44/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">GitHub Action referenced by mutable tag instead of immutable commit SHA</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SUPPLY-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SUPPLY-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/runner.py medium resolved" data-path="harness/runner.py" data-drawer-id="drawer-28" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/runner.py:392</code></td>
+              <td><span class="conf-score">81%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-28" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-88c9bb29</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:392</code> &middot;
+                      <strong>Confidence:</strong> 81/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-sec-001 hardcoded secret or api key in tracked source harness/runner.py medium resolved" data-path="harness/runner.py" data-drawer-id="drawer-29" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-SEC-001</code></td>
+              <td class="finding-title">Hardcoded Secret or API Key in Tracked Source</td>
+              <td><code>harness/runner.py:221</code></td>
+              <td><span class="conf-score">81%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-29" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-SEC-001-e0a84cf3</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:221</code> &middot;
+                      <strong>Confidence:</strong> 81/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Hardcoded credential or API secret string</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-SEC-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-SEC-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-002 privileged database credential in browser context harness/validate_v0_9_2_diff_and_monorepo.py medium resolved" data-path="harness/validate_v0_9_2_diff_and_monorepo.py" data-drawer-id="drawer-30" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-002</code></td>
+              <td class="finding-title">Privileged Database Credential in Browser Context</td>
+              <td><code>harness/validate_v0_9_2_diff_and_monorepo.py:134</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-30" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-002-08d11e50</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_9_2_diff_and_monorepo.py:134</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Service role key or raw database connection string reference in frontend code</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-002</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-002', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-input-002 raw sql concatenation harness/validate_v1_1_0_advanced_memory.py medium resolved" data-path="harness/validate_v1_1_0_advanced_memory.py" data-drawer-id="drawer-31" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-002</code></td>
+              <td class="finding-title">Raw SQL Concatenation</td>
+              <td><code>harness/validate_v1_1_0_advanced_memory.py:107</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-31" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-002-8f877a5f</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_1_0_advanced_memory.py:107</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Python f-string interpolation in raw SQL query</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-002</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-002', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-input-002 raw sql concatenation harness/engine/fixture_manager.py medium resolved" data-path="harness/engine/fixture_manager.py" data-drawer-id="drawer-32" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-002</code></td>
+              <td class="finding-title">Raw SQL Concatenation</td>
+              <td><code>harness/engine/fixture_manager.py:128</code></td>
+              <td><span class="conf-score">74%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-32" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-002-02f8e274</code> &middot;
+                      <strong>File:</strong> <code>harness/engine/fixture_manager.py:128</code> &middot;
+                      <strong>Confidence:</strong> 74/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Python f-string interpolation in raw SQL query</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-002</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-002', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-002 privileged database credential in browser context harness/validate_v0_7_0_runtime.py medium resolved" data-path="harness/validate_v0_7_0_runtime.py" data-drawer-id="drawer-33" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-002</code></td>
+              <td class="finding-title">Privileged Database Credential in Browser Context</td>
+              <td><code>harness/validate_v0_7_0_runtime.py:423</code></td>
+              <td><span class="conf-score">71%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-33" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-002-b53ad22c</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_7_0_runtime.py:423</code> &middot;
+                      <strong>Confidence:</strong> 71/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Service role key or raw database connection string reference in frontend code</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-002</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-002', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-34" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:151</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-34" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-8b55ac4b</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:151</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled Go TLS certificate verification (InsecureSkipVerify: true)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-35" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:162</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-35" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-cf8d252d</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:162</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled Go TLS certificate verification (InsecureSkipVerify: true)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-36" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:173</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-36" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-3543946e</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:173</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled Go TLS certificate verification (InsecureSkipVerify: true)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-37" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:349</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-37" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-efffaad0</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:349</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled Go TLS certificate verification (InsecureSkipVerify: true)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-38" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:129</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-38" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-91bd06b8</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:129</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled Node.js TLS rejectUnauthorized</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-39" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:261</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-39" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-cb245735</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:261</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled PHP curl SSL verification</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/validate_v0_9_2_diff_and_monorepo.py medium resolved" data-path="harness/validate_v0_9_2_diff_and_monorepo.py" data-drawer-id="drawer-40" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/validate_v0_9_2_diff_and_monorepo.py:60</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-40" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-6667680a</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_9_2_diff_and_monorepo.py:60</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled TLS certificate verification (verify=False)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/validate_v0_9_2_diff_and_monorepo.py medium resolved" data-path="harness/validate_v0_9_2_diff_and_monorepo.py" data-drawer-id="drawer-41" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/validate_v0_9_2_diff_and_monorepo.py:67</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-41" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-00b3b8ca</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_9_2_diff_and_monorepo.py:67</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled TLS certificate verification (verify=False)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-42" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:16</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-42" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-f209dec6</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:16</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled Go TLS certificate verification (InsecureSkipVerify: true)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-43" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:182</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-43" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-d9adecdb</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:182</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled Go TLS certificate verification (InsecureSkipVerify: true)</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-44" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:19</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-44" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-ddbf5cf0</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:19</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled PHP curl SSL verification</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-001 accidental security check bypass in patch additions harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-45" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-001</code></td>
+              <td class="finding-title">Accidental Security Check Bypass in Patch Additions</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:215</code></td>
+              <td><span class="conf-score">69%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-45" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-001-2b3eb6b7</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:215</code> &middot;
+                      <strong>Confidence:</strong> 69/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Disabled PHP curl SSL verification</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/validate_v0_6_3_hardening.py medium resolved" data-path="harness/validate_v0_6_3_hardening.py" data-drawer-id="drawer-46" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/validate_v0_6_3_hardening.py:171</code></td>
+              <td><span class="conf-score">67%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-46" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-8b6c1463</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_3_hardening.py:171</code> &middot;
+                      <strong>Confidence:</strong> 67/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-47" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:96</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-47" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-56b1c90f</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:96</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Decorator disabling route-level authentication or CSRF protection</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/evaluate_portfolio_polyglot.py medium resolved" data-path="harness/evaluate_portfolio_polyglot.py" data-drawer-id="drawer-48" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/evaluate_portfolio_polyglot.py:876</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-48" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-95eb27cd</code> &middot;
+                      <strong>File:</strong> <code>harness/evaluate_portfolio_polyglot.py:876</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Attribute disabling ASP.NET authentication</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-49" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:18</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-49" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-e838c41c</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:18</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Attribute disabling ASP.NET authentication</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-50" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:204</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-50" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-5c78d750</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:204</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Attribute disabling ASP.NET authentication</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-51" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:208</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-51" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-0d028be7</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:208</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Attribute disabling ASP.NET authentication</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-52" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:209</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-52" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-3ae1d9c1</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:209</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Attribute disabling ASP.NET authentication</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-auth-004 insecure session cookie configuration harness/validate_v1_3_0_polyglot.py medium resolved" data-path="harness/validate_v1_3_0_polyglot.py" data-drawer-id="drawer-53" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-AUTH-004</code></td>
+              <td class="finding-title">Insecure Session Cookie Configuration</td>
+              <td><code>harness/validate_v1_3_0_polyglot.py:193</code></td>
+              <td><span class="conf-score">66%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-53" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-AUTH-004-ea07db54</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_3_0_polyglot.py:193</code> &middot;
+                      <strong>Confidence:</strong> 66/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Spring Security CSRF protection explicitly disabled</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-AUTH-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-AUTH-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-rate-001 unlimited authentication endpoint harness/runner.py medium resolved" data-path="harness/runner.py" data-drawer-id="drawer-54" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-RATE-001</code></td>
+              <td class="finding-title">Unlimited Authentication Endpoint</td>
+              <td><code>harness/runner.py:575</code></td>
+              <td><span class="conf-score">65%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-54" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-RATE-001-758a7750</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:575</code> &middot;
+                      <strong>Confidence:</strong> 65/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Authentication POST endpoint defined without rate-limiting middleware</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-RATE-001</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-RATE-001', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/validate_v0_6_1_scale.py medium resolved" data-path="harness/validate_v0_6_1_scale.py" data-drawer-id="drawer-55" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/validate_v0_6_1_scale.py:115</code></td>
+              <td><span class="conf-score">64%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-55" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-9a2f13c7</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_1_scale.py:115</code> &middot;
+                      <strong>Confidence:</strong> 64/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/validate_v0_6_1_scale.py medium resolved" data-path="harness/validate_v0_6_1_scale.py" data-drawer-id="drawer-56" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/validate_v0_6_1_scale.py:193</code></td>
+              <td><span class="conf-score">64%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-56" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-a932f5b8</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_1_scale.py:193</code> &middot;
+                      <strong>Confidence:</strong> 64/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models harness/validate_v1_0_0_memory.py medium resolved" data-path="harness/validate_v1_0_0_memory.py" data-drawer-id="drawer-57" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>harness/validate_v1_0_0_memory.py:265</code></td>
+              <td><span class="conf-score">64%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-57" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-14a2d74f</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v1_0_0_memory.py:265</code> &middot;
+                      <strong>Confidence:</strong> 64/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-platform-003 production stack trace exposure harness/runner.py medium resolved" data-path="harness/runner.py" data-drawer-id="drawer-58" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-PLATFORM-003</code></td>
+              <td class="finding-title">Production Stack Trace Exposure</td>
+              <td><code>harness/runner.py:405</code></td>
+              <td><span class="conf-score">56%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-58" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-PLATFORM-003-6f253f06</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:405</code> &middot;
+                      <strong>Confidence:</strong> 56/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django DEBUG mode enabled in configuration</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-PLATFORM-003</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-PLATFORM-003', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-platform-003 production stack trace exposure harness/runner.py medium resolved" data-path="harness/runner.py" data-drawer-id="drawer-59" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-PLATFORM-003</code></td>
+              <td class="finding-title">Production Stack Trace Exposure</td>
+              <td><code>harness/runner.py:416</code></td>
+              <td><span class="conf-score">56%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-59" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-PLATFORM-003-fbe8ec66</code> &middot;
+                      <strong>File:</strong> <code>harness/runner.py:416</code> &middot;
+                      <strong>Confidence:</strong> 56/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django DEBUG mode enabled in configuration</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-PLATFORM-003</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-PLATFORM-003', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-diff-003 unintentional removal of tenant filter in patch deletions harness/validate_v0_6_2_modern_stacks.py medium resolved" data-path="harness/validate_v0_6_2_modern_stacks.py" data-drawer-id="drawer-60" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DIFF-003</code></td>
+              <td class="finding-title">Unintentional Removal of Tenant Filter in Patch Deletions</td>
+              <td><code>harness/validate_v0_6_2_modern_stacks.py:262</code></td>
+              <td><span class="conf-score">54%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-60" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DIFF-003-3d00a189</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_v0_6_2_modern_stacks.py:262</code> &middot;
+                      <strong>Confidence:</strong> 54/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Removal of tenant isolation boundary in patch deletion</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DIFF-003</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DIFF-003', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-input-005 unsafe template rendering &amp;amp; disabled autoescaping harness/validate_qa_v0_6_0.py medium resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-61" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-005</code></td>
+              <td class="finding-title">Unsafe Template Rendering &amp; Disabled Autoescaping</td>
+              <td><code>harness/validate_qa_v0_6_0.py:190</code></td>
+              <td><span class="conf-score">52%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-61" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-005-d5aaebe0</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:190</code> &middot;
+                      <strong>Confidence:</strong> 52/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Flask render_template_string rendering untrusted input</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-005</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-005', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-platform-003 production stack trace exposure harness/validate_qa_v0_6_0.py medium resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-62" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-PLATFORM-003</code></td>
+              <td class="finding-title">Production Stack Trace Exposure</td>
+              <td><code>harness/validate_qa_v0_6_0.py:64</code></td>
+              <td><span class="conf-score">52%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-62" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-PLATFORM-003-153d982f</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:64</code> &middot;
+                      <strong>Confidence:</strong> 52/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django DEBUG mode enabled in configuration</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-PLATFORM-003</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-PLATFORM-003', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-platform-003 production stack trace exposure harness/validate_qa_v0_6_0.py medium resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-63" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-PLATFORM-003</code></td>
+              <td class="finding-title">Production Stack Trace Exposure</td>
+              <td><code>harness/validate_qa_v0_6_0.py:77</code></td>
+              <td><span class="conf-score">52%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-63" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-PLATFORM-003-21644311</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:77</code> &middot;
+                      <strong>Confidence:</strong> 52/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django DEBUG mode enabled in configuration</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-PLATFORM-003</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-PLATFORM-003', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-platform-003 production stack trace exposure harness/validate_qa_v0_6_0.py medium resolved" data-path="harness/validate_qa_v0_6_0.py" data-drawer-id="drawer-64" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-PLATFORM-003</code></td>
+              <td class="finding-title">Production Stack Trace Exposure</td>
+              <td><code>harness/validate_qa_v0_6_0.py:80</code></td>
+              <td><span class="conf-score">52%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-64" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-PLATFORM-003-21b8a588</code> &middot;
+                      <strong>File:</strong> <code>harness/validate_qa_v0_6_0.py:80</code> &middot;
+                      <strong>Confidence:</strong> 52/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django DEBUG mode enabled in configuration</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-PLATFORM-003</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-PLATFORM-003', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-input-005 unsafe template rendering &amp;amp; disabled autoescaping harness/master_validation.py medium resolved" data-path="harness/master_validation.py" data-drawer-id="drawer-65" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-INPUT-005</code></td>
+              <td class="finding-title">Unsafe Template Rendering &amp; Disabled Autoescaping</td>
+              <td><code>harness/master_validation.py:314</code></td>
+              <td><span class="conf-score">49%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-65" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-INPUT-005-0d595acd</code> &middot;
+                      <strong>File:</strong> <code>harness/master_validation.py:314</code> &middot;
+                      <strong>Confidence:</strong> 49/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Flask render_template_string rendering untrusted input</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-INPUT-005</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-INPUT-005', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models tests/test_v0_6_0_governed_remediation.py medium resolved" data-path="tests/test_v0_6_0_governed_remediation.py" data-drawer-id="drawer-66" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>tests/test_v0_6_0_governed_remediation.py:86</code></td>
+              <td><span class="conf-score">24%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-66" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-fe2c60e3</code> &middot;
+                      <strong>File:</strong> <code>tests/test_v0_6_0_governed_remediation.py:86</code> &middot;
+                      <strong>Confidence:</strong> 24/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <tr class="finding-row" data-severity="medium" data-status="resolved" data-search="tg-db-004 missing tenant query isolation in multi-tenant models tests/test_v0_6_0_governed_remediation.py medium resolved" data-path="tests/test_v0_6_0_governed_remediation.py" data-drawer-id="drawer-67" onclick="toggleDrawer(this)">
+              <td style="text-align: center;" onclick="event.stopPropagation()">
+                <span style="color: var(--accent-green); font-size: 14px;" title="Already resolved and defended">&#10004;</span>
+              </td>
+              <td><span class="badge badge-medium">Medium</span> <span class="badge badge-success">&#10004; Resolved</span></td>
+              <td><code class="rule-id">TG-DB-004</code></td>
+              <td class="finding-title">Missing Tenant Query Isolation in Multi-Tenant Models</td>
+              <td><code>tests/test_v0_6_0_governed_remediation.py:79</code></td>
+              <td><span class="conf-score">24%</span></td>
+              <td style="text-align: right;"><span class="drawer-chevron">&#9656;</span></td>
+            </tr>
+            <tr id="drawer-67" class="drawer-row" style="display: none;">
+              <td colspan="7">
+                <div class="drawer-content">
+                  <div class="drawer-header">
+                    <div>
+                      <strong>Finding ID:</strong> <code>TG-DB-004-6a739666</code> &middot;
+                      <strong>File:</strong> <code>tests/test_v0_6_0_governed_remediation.py:79</code> &middot;
+                      <strong>Confidence:</strong> 24/100 &middot;
+                      <span class="badge badge-success">&#10004; Resolved &amp; Defended</span>
+                    </div>
+                  </div>
+                  <div class="drawer-notice-resolved" style="background: rgba(63, 185, 80, 0.1); border: 1px solid rgba(63, 185, 80, 0.3); border-radius: 6px; padding: 10px 14px; margin: 10px 0; font-size: 12px;">
+                    <strong>&#10004; Remediated &amp; Hardened:</strong> This security violation has been successfully patched and verified under the Ponytail Protocol (&le; 35 additions, &le; 25 deletions).
+                  </div>
+                  <div class="drawer-desc">Django ORM .get(id=...) query lacking explicit tenant scope filter</div>
+                  <div class="drawer-actions">
+                    <div class="cmd-box">
+                      <code>npx torusguard recheck --rule TG-DB-004</code>
+                      <button class="btn-copy" onclick="copyText('npx torusguard recheck --rule TG-DB-004', this); event.stopPropagation();">&#128203; Copy Recheck Command</button>
+                    </div>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            </tbody>
+          </table>
         </div>
       </div>
-      <div class="sim-stats">
-        <div>Current: <strong id="simCurrentVal">100</strong>/100</div>
-        <div>&rarr;</div>
-        <div>Projected: <strong id="simProjectedVal" style="color: var(--accent-blue);">100</strong>/100 <span id="simDeltaBadge" class="badge badge-success">+0 pts</span></div>
-      </div>
-      <div class="sim-actions">
-        <button class="btn btn-sm" onclick="simulateFixAll('Critical')">&#9889; Simulate Criticals</button>
-        <button class="btn btn-sm" onclick="simulateFixAll('all')">&#9889; Simulate All Fixes</button>
-        <button class="btn btn-sm" onclick="resetSimulatedFixes()">Reset Simulator</button>
+    </div>
       </div>
     </div>
+  </div>
-    <!-- Active Defenses & Protected Invariants (5-Layer Architectural Invariant Matrix) -->
-    <div class="defended-section" id="defendedSection">
-      <div class="defended-header" onclick="toggleDefendedVisibility()">
-        <div class="section-title" style="margin-bottom: 0;">
-          &#128737; Active Defenses &amp; Protected Invariants (74 Passing)
-        </div>
-        <span id="defendedToggleIcon" style="color: var(--text-muted); font-size: 12px;">&#9660; Collapse Matrix</span>
-      </div>
-      <div id="defendedMatrixBody">
-        <div class="coverage-bar-container">
-          <div class="coverage-stats">
-            <span><strong>74 of 74 Invariants Enforced</strong> (100% Defense Coverage)</span>
-            <span class="badge badge-success">100% Enforced</span>
+  <!-- 2. Active Defenses & 74 Invariants Catalog Modal -->
+  <div id="invariantsCatalogModal" class="modal-backdrop" style="display: none;" onclick="closeModal('invariantsCatalogModal', event)">
+    <div class="modal-card modal-lg" onclick="event.stopPropagation()">
+      <div class="modal-header">
+        <div>
+          <div style="display: flex; align-items: center; gap: 8px;">
+            <span class="badge badge-success">&#10004; 100% ENFORCED</span>
+            <h3 style="font-size: 16px; margin: 0; color: var(--text-main);">&#128737; Active Defenses &amp; Protected Invariants (74 Passing)</h3>
           </div>
-          <div class="coverage-progress-bg">
-            <div class="coverage-progress-fill" style="width: 100%;"></div>
+          <div style="font-size: 12px; color: var(--text-muted); margin-top: 4px;">
+            All 74 architectural security rules enforced across 5 defensive layers. Zero security bypasses detected.
           </div>
         </div>
-        <div class="inv-search-bar">
-          <div class="search-wrapper" style="width: 100%;">
-            <input type="text" id="invSearchInput" class="search-input" style="width: 100%;" placeholder="Search 74 invariants by ID, title, layer, or keyword..." oninput="filterInvariants()">
-            <button class="search-clear-btn" id="invSearchClearBtn" onclick="clearInvSearch()">&times;</button>
+        <button class="modal-close-btn" onclick="closeModal('invariantsCatalogModal', event)">&times;</button>
+      </div>
+      <div class="modal-body" style="padding-top: 10px;">
+        <div class="defended-section" id="defendedSection">
+          <div class="coverage-bar-container" style="margin-bottom: 12px;">
+            <div class="coverage-stats">
+              <span><strong>74 of 74 Invariants Enforced</strong> (100% Defense Coverage)</span>
+              <span class="badge badge-success">100% Enforced</span>
+            </div>
+            <div class="coverage-progress-bg">
+              <div class="coverage-progress-fill" style="width: 100%;"></div>
+            </div>
           </div>
-          <div id="invMatchCount" style="font-size: 11px; color: var(--accent-blue); white-space: nowrap;"></div>
-        </div>
-        <div class="layers-container" id="layersList">
+          <div class="inv-search-bar" style="margin-bottom: 12px;">
+            <div class="search-wrapper" style="width: 100%;">
+              <input type="text" id="invSearchInput" class="search-input" style="width: 100%;" placeholder="Search 74 invariants by ID, title, layer, or keyword..." oninput="filterInvariants()">
+              <button class="search-clear-btn" id="invSearchClearBtn" onclick="clearInvSearch()">&times;</button>
+            </div>
+            <div id="invMatchCount" style="font-size: 11px; color: var(--accent-blue); white-space: nowrap;"></div>
+          </div>
+          <div class="layers-container" id="layersList">
         <div class="layer-card" data-layer-id="layer-app">
           <div class="layer-header">
             <div class="layer-title-group">
@@ -1249,268 +4570,25 @@
             </div>
           </div>
         </div>
-        </div>
-      </div>
-    </div>
-    <!-- Filter & Search Bar for Findings -->
-    <div class="filter-bar">
-      <div class="filter-pills">
-        <span class="pill-group-label">Severity:</span>
-        <span class="pill active" data-sev-filter="all" onclick="filterBySeverity('all')">All</span>
-        <span class="pill" data-sev-filter="critical" onclick="filterBySeverity('critical')">&#128308; Critical (0)</span>
-        <span class="pill" data-sev-filter="high" onclick="filterBySeverity('high')">&#128992; High (0)</span>
-        <span class="pill" data-sev-filter="medium" onclick="filterBySeverity('medium')">&#128993; Med/Low (0)</span>
-        <span class="pill-group-label" style="margin-left: 8px;">Status:</span>
-        <span class="pill active" data-status-filter="all" onclick="filterByStatus('all')">All</span>
-        <span class="pill" data-status-filter="open" onclick="filterByStatus('open')">&#9888; Open (0)</span>
-        <span class="pill" data-status-filter="resolved" onclick="filterByStatus('resolved')">&#10004; Resolved (0)</span>
-        <span class="dir-filter-chip" id="dirFilterChip" onclick="clearDirectoryFilter()">
-          Folder: <strong id="dirFilterName"></strong> &times;
-        </span>
-        <button class="btn-reset-filters" id="btnResetFilters" onclick="resetAllFilters()">&times; Reset Filters</button>
-      </div>
-      <div class="search-wrapper">
-        <input type="text" id="searchInput" class="search-input" placeholder="Search rules, titles, files..." oninput="searchFindings()">
-        <button class="search-clear-btn" id="searchClearBtn" onclick="clearSearch()">&times;</button>
-      </div>
-    </div>
-    <div class="filter-stats-bar">
-      <div>Showing <span id="visibleCount" style="font-weight: 700; color: var(--text-main);">0</span> of <span id="totalCount" style="font-weight: 700; color: var(--text-main);">0</span> cataloged findings</div>
-      <div id="activeFilterSummary" style="font-size: 11px; color: var(--accent-blue);"></div>
-    </div>
-    <!-- Findings Table -->
-    <div class="table-container">
-      <table>
-        <thead>
-          <tr>
-            <th style="width: 70px; text-align: center;">Simulate</th>
-            <th style="width: 110px;">Severity</th>
-            <th style="width: 130px;">Rule ID</th>
-            <th>Finding Title</th>
-            <th style="width: 250px;">File &amp; Location</th>
-            <th style="width: 90px;">Confidence</th>
-            <th style="width: 30px;"></th>
-          </tr>
-        </thead>
-        <tbody id="findingsTableBody">
-          <tr><td colspan="7" class="empty-cell">&#10004; Zero security invariant violations detected. Posture is 100% clean and defended.</td></tr>
-        </tbody>
-      </table>
-    </div>
-    <!-- OWASP Top 10 Compliance Radar -->
-    <div class="section-title">&#128737; OWASP Top 10 (2021/2026) Compliance Matrix</div>
-    <div class="grid-owasp">
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A01: Broken Access Control</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
-          </div>
-        </div>
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A02: Cryptographic Failures</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
-          </div>
-        </div>
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A03: Injection Defense</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
-          </div>
-        </div>
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A05: Security Configuration</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
-          </div>
-        </div>
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A06: Supply Chain Health</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
-          </div>
-        </div>
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A07: Identity & Auth</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
-          </div>
-        </div>
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A08: Software Integrity</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
-          </div>
-        </div>
-        <div class="owasp-card">
-          <div class="owasp-top">
-            <span class="owasp-title">A10: SSRF Defense</span>
-            <span class="owasp-badge" style="color: var(--accent-green); border-color: var(--accent-green);">100% Compliant</span>
-          </div>
-          <div class="owasp-bar-bg">
-            <div class="owasp-bar" style="width: 100%; background: var(--accent-green);"></div>
           </div>
         </div>
+      </div>
     </div>
+  </div>
-    <!-- Enterprise Compliance Framework Mapping -->
-    <div class="section-title">&#127963; Enterprise Compliance Framework Mapping (SOC 2 &middot; ISO 27001 &middot; HIPAA)</div>
-    <div class="grid-compliance">
-        <div class="card comp-card">
-          <div class="comp-card-header">
-            <div>
-              <div class="comp-title">SOC 2 Type II</div>
-              <div class="comp-sub">AICPA Trust Services Criteria (Security & Boundary)</div>
-            </div>
-            <span class="badge badge-success">100% Met</span>
-          </div>
-          <div class="comp-ctrl-list">
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">CC6.1 Logical Access</div>
-                <div class="comp-ctrl-fams">TG-AUTH, TG-CLIENT</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">CC6.6 Network Boundary</div>
-                <div class="comp-ctrl-fams">TG-SSRF, TG-RATE, TG-WS</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">CC6.7 Transmission Security</div>
-                <div class="comp-ctrl-fams">TG-PLATFORM, TG-SEC</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">CC7.1 Vulnerability & Churn</div>
-                <div class="comp-ctrl-fams">TG-DIFF, TG-SUPPLY</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-          </div>
-        </div>
-        <div class="card comp-card">
-          <div class="comp-card-header">
-            <div>
-              <div class="comp-title">ISO/IEC 27001:2022</div>
-              <div class="comp-sub">Annex A Controls for Technological & Application Security</div>
-            </div>
-            <span class="badge badge-success">100% Met</span>
-          </div>
-          <div class="comp-ctrl-list">
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">A.8.20 Network Security</div>
-                <div class="comp-ctrl-fams">TG-SSRF, TG-WEBHOOK, TG-RATE</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">A.8.24 Cryptography Usage</div>
-                <div class="comp-ctrl-fams">TG-SEC, TG-AUTH</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">A.8.28 Secure Coding</div>
-                <div class="comp-ctrl-fams">TG-INPUT, TG-DB, TG-GQL, TG-AGENT</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-          </div>
-        </div>
-        <div class="card comp-card">
-          <div class="comp-card-header">
-            <div>
-              <div class="comp-title">HIPAA Security Rule</div>
-              <div class="comp-sub">45 CFR Part 164 Technical Safeguards for ePHI</div>
-            </div>
-            <span class="badge badge-success">100% Met</span>
-          </div>
-          <div class="comp-ctrl-list">
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">§ 164.312(a)(1) Access Control</div>
-                <div class="comp-ctrl-fams">TG-AUTH, TG-DB (Tenant Isolation)</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">§ 164.312(c)(1) ePHI Integrity</div>
-                <div class="comp-ctrl-fams">TG-WEBHOOK, TG-BIZ, TG-DIFF</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
-            <div class="comp-ctrl-row">
-              <div>
-                <div class="comp-ctrl-code">§ 164.312(e)(1) Transmission Security</div>
-                <div class="comp-ctrl-fams">TG-PLATFORM, TG-SEC, TG-CLIENT</div>
-              </div>
-              <div><span class="badge badge-success">&#10004; Passing</span></div>
-            </div>
+  <!-- 3. Golden Fix Recipes Modal -->
+  <div id="recipesModal" class="modal-backdrop" style="display: none;" onclick="closeModal('recipesModal', event)">
+    <div class="modal-card modal-lg" id="recipesCard" onclick="event.stopPropagation()">
+      <div class="modal-header">
+        <div>
+          <h3 style="font-size: 16px; margin: 0; color: var(--text-main);">&#10024; Golden Fix Recipes (15)</h3>
+          <div style="font-size: 12px; color: var(--text-muted); margin-top: 4px;">
+            Verified remediation patterns distilled from applied patches conforming to Ponytail line churn budget.
           </div>
         </div>
-    </div>
-    <!-- Middle Grid: Heatmap + Clusters -->
-    <div class="grid-bottom">
-      <div class="card">
-        <div class="section-title">&#128293; Directory Attack Surface Heatmap</div>
-        <div style="font-size: 12px; color: var(--text-muted); margin-bottom: 12px;">Click a folder to filter findings for that directory:</div>
-        <div class="empty-state">&#10004; Zero directory surface exposure detected across repository modules.</div>
+        <button class="modal-close-btn" onclick="closeModal('recipesModal', event)">&times;</button>
       </div>
-      <div class="card">
-        <div class="section-title">&#128736; Root-Cause Architectural Clusters</div>
-        <div class="empty-state">&#10004; No architectural vulnerability clusters identified. Systemic invariants enforced.</div>
-      </div>
-    </div>
-    <!-- Bottom Grid: Golden Recipes + Next Best Defenses -->
-    <div class="grid-bottom">
-      <div class="card">
-        <div class="section-title">&#10024; Golden Fix Recipes (15)</div>
-        <div style="font-size: 12px; color: var(--text-muted); margin-bottom: 10px;">Verified remediation patterns distilled from applied patches:</div>
+      <div class="modal-body" style="padding-top: 10px;">
         <div class="filter-pills" style="margin-bottom: 12px;">
           <span class="pill active" data-recipe-cat-filter="all" onclick="filterRecipeCategory('all')">All (15)</span><span class="pill" data-recipe-cat-filter="client" onclick="filterRecipeCategory('client')">Client (1)</span><span class="pill" data-recipe-cat-filter="database" onclick="filterRecipeCategory('database')">Database (1)</span><span class="pill" data-recipe-cat-filter="input" onclick="filterRecipeCategory('input')">Input (2)</span><span class="pill" data-recipe-cat-filter="platform" onclick="filterRecipeCategory('platform')">Platform (3)</span><span class="pill" data-recipe-cat-filter="rate-limiting" onclick="filterRecipeCategory('rate-limiting')">Rate Limiting (2)</span><span class="pill" data-recipe-cat-filter="ssrf" onclick="filterRecipeCategory('ssrf')">SSRF (1)</span><span class="pill" data-recipe-cat-filter="secrets" onclick="filterRecipeCategory('secrets')">Secrets (5)</span>
         </div>
@@ -2189,10 +5267,22 @@
         </div>
         </div>
       </div>
+    </div>
+  </div>
-      <div class="card">
-        <div class="section-title">&#128161; Next Best Defenses Advisory</div>
-        <div style="font-size: 12px; color: var(--text-muted); margin-bottom: 12px;">Stack-tailored recommendations to achieve hardened posture:</div>
+  <!-- 4. Next Best Defenses Advisory Modal -->
+  <div id="advisoryModal" class="modal-backdrop" style="display: none;" onclick="closeModal('advisoryModal', event)">
+    <div class="modal-card modal-lg" onclick="event.stopPropagation()">
+      <div class="modal-header">
+        <div>
+          <h3 style="font-size: 16px; margin: 0; color: var(--text-main);">&#128161; Prescriptive Next Best Defenses Advisory</h3>
+          <div style="font-size: 12px; color: var(--text-muted); margin-top: 4px;">
+            Stack-tailored recommendations to achieve hardened posture.
+          </div>
+        </div>
+        <button class="modal-close-btn" onclick="closeModal('advisoryModal', event)">&times;</button>
+      </div>
+      <div class="modal-body" style="padding-top: 10px;">
         <div class="advisory-item">
           <div class="advisory-top">
@@ -2281,13 +5371,9 @@
         </div>
       </div>
     </div>
-    <footer>
-      TorusGuard v1.3.6 &middot; Autonomous Security Engine for AI-Built Applications &middot; 100% Local-First &middot; Zero Cloud Telemetry
-    </footer>
   </div>
-  <!-- Invariant Inspection Modal -->
+  <!-- 5. Invariant Guarantee Inspection Modal -->
   <div id="invariantModal" class="modal-backdrop" style="display: none;" onclick="closeInvariantModal(event)">
     <div class="modal-card" onclick="event.stopPropagation()">
       <div class="modal-header">
@@ -2330,7 +5416,7 @@
   </div>
   <script>
-    const RAW_FINDINGS = [];
+    const RAW_FINDINGS = [{"finding_id": "TG-AUTH-004-33adb2d9", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "High", "status": "resolved", "confidence_score": 66, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 107, "cluster": "cluster-auth-bypass", "description": "Session cookie secure flag disabled in Django settings", "is_canary": false}, {"finding_id": "TG-AUTH-004-4a33f7e7", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "High", "status": "resolved", "confidence_score": 66, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 239, "cluster": "cluster-auth-bypass", "description": "Attribute disabling ASP.NET authentication", "is_canary": false}, {"finding_id": "TG-DB-002-14cf4139", "rule_id": "TG-DB-002", "title": "Privileged Database Credential in Browser Context", "severity": "High", "status": "resolved", "confidence_score": 71, "file_path": "harness/validate_v0_7_0_runtime.py", "line_number": 129, "cluster": "cluster-client-leak", "description": "Service role key or raw database connection string reference in frontend code", "is_canary": false}, {"finding_id": "TG-DB-004-e8cc000a", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "High", "status": "resolved", "confidence_score": 74, "file_path": "harness/runner.py", "line_number": 505, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-89b581f9", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "High", "status": "resolved", "confidence_score": 74, "file_path": "harness/runner.py", "line_number": 506, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-e33fd263", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "High", "status": "resolved", "confidence_score": 67, "file_path": "harness/validate_v0_6_3_hardening.py", "line_number": 119, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-ff3f7499", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "High", "status": "resolved", "confidence_score": 67, "file_path": "harness/validate_v0_6_3_hardening.py", "line_number": 127, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-a7c00c05", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "High", "status": "resolved", "confidence_score": 67, "file_path": "harness/validate_v0_6_3_hardening.py", "line_number": 135, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DIFF-001-04571685", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "High", "status": "resolved", "confidence_score": 69, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 74, "cluster": "cluster-transport-security", "description": "Disabled TLS certificate verification (verify=False)", "is_canary": false}, {"finding_id": "TG-INPUT-002-266bcaa1", "rule_id": "TG-INPUT-002", "title": "Raw SQL Concatenation", "severity": "High", "status": "resolved", "confidence_score": 74, "file_path": "harness/validate_v1_1_0_advanced_memory.py", "line_number": 109, "cluster": "cluster-injection", "description": "Python f-string interpolation in raw SQL query", "is_canary": false}, {"finding_id": "TG-INPUT-002-f8cd11b9", "rule_id": "TG-INPUT-002", "title": "Raw SQL Concatenation", "severity": "High", "status": "resolved", "confidence_score": 84, "file_path": "harness/runner.py", "line_number": 258, "cluster": "cluster-injection", "description": "Python f-string interpolation in raw SQL query", "is_canary": false}, {"finding_id": "TG-INPUT-005-d7ef73f1", "rule_id": "TG-INPUT-005", "title": "Unsafe Template Rendering & Disabled Autoescaping", "severity": "High", "status": "resolved", "confidence_score": 49, "file_path": "harness/validate_e2e.py", "line_number": 457, "cluster": "cluster-injection", "description": "Flask render_template_string rendering untrusted input", "is_canary": false}, {"finding_id": "TG-INPUT-005-95cb57ba", "rule_id": "TG-INPUT-005", "title": "Unsafe Template Rendering & Disabled Autoescaping", "severity": "High", "status": "resolved", "confidence_score": 46, "file_path": "harness/engine/fixture_manager.py", "line_number": 176, "cluster": "cluster-injection", "description": "Flask render_template_string rendering untrusted input", "is_canary": false}, {"finding_id": "TG-INPUT-005-7f81ea7f", "rule_id": "TG-INPUT-005", "title": "Unsafe Template Rendering & Disabled Autoescaping", "severity": "High", "status": "resolved", "confidence_score": 52, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 177, "cluster": "cluster-injection", "description": "Flask render_template_string rendering untrusted input", "is_canary": false}, {"finding_id": "TG-INPUT-005-e0ffb03b", "rule_id": "TG-INPUT-005", "title": "Unsafe Template Rendering & Disabled Autoescaping", "severity": "High", "status": "resolved", "confidence_score": 52, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 193, "cluster": "cluster-injection", "description": "Flask render_template_string rendering untrusted input", "is_canary": false}, {"finding_id": "TG-PLATFORM-003-69f083d6", "rule_id": "TG-PLATFORM-003", "title": "Production Stack Trace Exposure", "severity": "High", "status": "resolved", "confidence_score": 56, "file_path": "harness/runner.py", "line_number": 392, "cluster": "cluster-platform", "description": "Django DEBUG mode enabled in configuration", "is_canary": false}, {"finding_id": "TG-SEC-001-c616aefd", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 77, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 64, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-d5b3684f", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 77, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 90, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-54f1a02a", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 77, "file_path": "harness/validate_v0_6_2_modern_stacks.py", "line_number": 341, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-676f776e", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 77, "file_path": "harness/validate_v0_6_2_modern_stacks.py", "line_number": 356, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-58f70e46", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 77, "file_path": "harness/validate_v0_6_2_modern_stacks.py", "line_number": 362, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-7c852ff3", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 74, "file_path": "harness/master_validation.py", "line_number": 257, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-02761dbb", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 74, "file_path": "harness/master_validation.py", "line_number": 460, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-3a2b5eca", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 74, "file_path": "harness/validate_e2e.py", "line_number": 355, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-593d6437", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "High", "status": "resolved", "confidence_score": 81, "file_path": "harness/runner.py", "line_number": 211, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SUPPLY-004-e52415c0", "rule_id": "TG-SUPPLY-004", "title": "Unpinned CI Action", "severity": "High", "status": "resolved", "confidence_score": 47, "file_path": "harness/validate_v0_6_2_modern_stacks.py", "line_number": 383, "cluster": "cluster-supply-chain", "description": "GitHub Action referenced by mutable tag instead of immutable commit SHA", "is_canary": false}, {"finding_id": "TG-SUPPLY-004-b9d15743", "rule_id": "TG-SUPPLY-004", "title": "Unpinned CI Action", "severity": "High", "status": "resolved", "confidence_score": 47, "file_path": "harness/validate_v0_6_2_modern_stacks.py", "line_number": 404, "cluster": "cluster-supply-chain", "description": "GitHub Action referenced by mutable tag instead of immutable commit SHA", "is_canary": false}, {"finding_id": "TG-SUPPLY-004-9240a873", "rule_id": "TG-SUPPLY-004", "title": "Unpinned CI Action", "severity": "High", "status": "resolved", "confidence_score": 44, "file_path": "harness/validate_v0_6_3_hardening.py", "line_number": 251, "cluster": "cluster-supply-chain", "description": "GitHub Action referenced by mutable tag instead of immutable commit SHA", "is_canary": false}, {"finding_id": "TG-AUTH-004-56b1c90f", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "Medium", "status": "resolved", "confidence_score": 66, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 96, "cluster": "cluster-auth-bypass", "description": "Decorator disabling route-level authentication or CSRF protection", "is_canary": false}, {"finding_id": "TG-AUTH-004-95eb27cd", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "Medium", "status": "resolved", "confidence_score": 66, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 876, "cluster": "cluster-auth-bypass", "description": "Attribute disabling ASP.NET authentication", "is_canary": false}, {"finding_id": "TG-AUTH-004-e838c41c", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "Medium", "status": "resolved", "confidence_score": 66, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 18, "cluster": "cluster-auth-bypass", "description": "Attribute disabling ASP.NET authentication", "is_canary": false}, {"finding_id": "TG-AUTH-004-5c78d750", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "Medium", "status": "resolved", "confidence_score": 66, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 204, "cluster": "cluster-auth-bypass", "description": "Attribute disabling ASP.NET authentication", "is_canary": false}, {"finding_id": "TG-AUTH-004-0d028be7", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "Medium", "status": "resolved", "confidence_score": 66, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 208, "cluster": "cluster-auth-bypass", "description": "Attribute disabling ASP.NET authentication", "is_canary": false}, {"finding_id": "TG-AUTH-004-3ae1d9c1", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "Medium", "status": "resolved", "confidence_score": 66, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 209, "cluster": "cluster-auth-bypass", "description": "Attribute disabling ASP.NET authentication", "is_canary": false}, {"finding_id": "TG-AUTH-004-ea07db54", "rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "Medium", "status": "resolved", "confidence_score": 66, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 193, "cluster": "cluster-auth-bypass", "description": "Spring Security CSRF protection explicitly disabled", "is_canary": false}, {"finding_id": "TG-DB-002-08d11e50", "rule_id": "TG-DB-002", "title": "Privileged Database Credential in Browser Context", "severity": "Medium", "status": "resolved", "confidence_score": 74, "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py", "line_number": 134, "cluster": "cluster-client-leak", "description": "Service role key or raw database connection string reference in frontend code", "is_canary": false}, {"finding_id": "TG-DB-002-b53ad22c", "rule_id": "TG-DB-002", "title": "Privileged Database Credential in Browser Context", "severity": "Medium", "status": "resolved", "confidence_score": 71, "file_path": "harness/validate_v0_7_0_runtime.py", "line_number": 423, "cluster": "cluster-client-leak", "description": "Service role key or raw database connection string reference in frontend code", "is_canary": false}, {"finding_id": "TG-DB-004-fe2c60e3", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "Medium", "status": "resolved", "confidence_score": 24, "file_path": "tests/test_v0_6_0_governed_remediation.py", "line_number": 86, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-8b6c1463", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "Medium", "status": "resolved", "confidence_score": 67, "file_path": "harness/validate_v0_6_3_hardening.py", "line_number": 171, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-9a2f13c7", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "Medium", "status": "resolved", "confidence_score": 64, "file_path": "harness/validate_v0_6_1_scale.py", "line_number": 115, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-a932f5b8", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "Medium", "status": "resolved", "confidence_score": 64, "file_path": "harness/validate_v0_6_1_scale.py", "line_number": 193, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-14a2d74f", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "Medium", "status": "resolved", "confidence_score": 64, "file_path": "harness/validate_v1_0_0_memory.py", "line_number": 265, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DB-004-6a739666", "rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "Medium", "status": "resolved", "confidence_score": 24, "file_path": "tests/test_v0_6_0_governed_remediation.py", "line_number": 79, "cluster": "cluster-tenant-isolation", "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter", "is_canary": false}, {"finding_id": "TG-DIFF-001-8b55ac4b", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 151, "cluster": "cluster-transport-security", "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)", "is_canary": false}, {"finding_id": "TG-DIFF-001-cf8d252d", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 162, "cluster": "cluster-transport-security", "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)", "is_canary": false}, {"finding_id": "TG-DIFF-001-3543946e", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 173, "cluster": "cluster-transport-security", "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)", "is_canary": false}, {"finding_id": "TG-DIFF-001-efffaad0", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 349, "cluster": "cluster-transport-security", "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)", "is_canary": false}, {"finding_id": "TG-DIFF-001-91bd06b8", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 129, "cluster": "cluster-transport-security", "description": "Disabled Node.js TLS rejectUnauthorized", "is_canary": false}, {"finding_id": "TG-DIFF-001-cb245735", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/evaluate_portfolio_polyglot.py", "line_number": 261, "cluster": "cluster-transport-security", "description": "Disabled PHP curl SSL verification", "is_canary": false}, {"finding_id": "TG-DIFF-001-6667680a", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py", "line_number": 60, "cluster": "cluster-transport-security", "description": "Disabled TLS certificate verification (verify=False)", "is_canary": false}, {"finding_id": "TG-DIFF-001-00b3b8ca", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py", "line_number": 67, "cluster": "cluster-transport-security", "description": "Disabled TLS certificate verification (verify=False)", "is_canary": false}, {"finding_id": "TG-DIFF-001-f209dec6", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 16, "cluster": "cluster-transport-security", "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)", "is_canary": false}, {"finding_id": "TG-DIFF-001-d9adecdb", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 182, "cluster": "cluster-transport-security", "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)", "is_canary": false}, {"finding_id": "TG-DIFF-001-ddbf5cf0", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 19, "cluster": "cluster-transport-security", "description": "Disabled PHP curl SSL verification", "is_canary": false}, {"finding_id": "TG-DIFF-001-2b3eb6b7", "rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Medium", "status": "resolved", "confidence_score": 69, "file_path": "harness/validate_v1_3_0_polyglot.py", "line_number": 215, "cluster": "cluster-transport-security", "description": "Disabled PHP curl SSL verification", "is_canary": false}, {"finding_id": "TG-DIFF-003-3d00a189", "rule_id": "TG-DIFF-003", "title": "Unintentional Removal of Tenant Filter in Patch Deletions", "severity": "Medium", "status": "resolved", "confidence_score": 54, "file_path": "harness/validate_v0_6_2_modern_stacks.py", "line_number": 262, "cluster": "cluster-tenant-isolation", "description": "Removal of tenant isolation boundary in patch deletion", "is_canary": false}, {"finding_id": "TG-INPUT-002-8f877a5f", "rule_id": "TG-INPUT-002", "title": "Raw SQL Concatenation", "severity": "Medium", "status": "resolved", "confidence_score": 74, "file_path": "harness/validate_v1_1_0_advanced_memory.py", "line_number": 107, "cluster": "cluster-injection", "description": "Python f-string interpolation in raw SQL query", "is_canary": false}, {"finding_id": "TG-INPUT-002-02f8e274", "rule_id": "TG-INPUT-002", "title": "Raw SQL Concatenation", "severity": "Medium", "status": "resolved", "confidence_score": 74, "file_path": "harness/engine/fixture_manager.py", "line_number": 128, "cluster": "cluster-injection", "description": "Python f-string interpolation in raw SQL query", "is_canary": false}, {"finding_id": "TG-INPUT-005-d5aaebe0", "rule_id": "TG-INPUT-005", "title": "Unsafe Template Rendering & Disabled Autoescaping", "severity": "Medium", "status": "resolved", "confidence_score": 52, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 190, "cluster": "cluster-injection", "description": "Flask render_template_string rendering untrusted input", "is_canary": false}, {"finding_id": "TG-INPUT-005-0d595acd", "rule_id": "TG-INPUT-005", "title": "Unsafe Template Rendering & Disabled Autoescaping", "severity": "Medium", "status": "resolved", "confidence_score": 49, "file_path": "harness/master_validation.py", "line_number": 314, "cluster": "cluster-injection", "description": "Flask render_template_string rendering untrusted input", "is_canary": false}, {"finding_id": "TG-PLATFORM-003-6f253f06", "rule_id": "TG-PLATFORM-003", "title": "Production Stack Trace Exposure", "severity": "Medium", "status": "resolved", "confidence_score": 56, "file_path": "harness/runner.py", "line_number": 405, "cluster": "cluster-platform", "description": "Django DEBUG mode enabled in configuration", "is_canary": false}, {"finding_id": "TG-PLATFORM-003-fbe8ec66", "rule_id": "TG-PLATFORM-003", "title": "Production Stack Trace Exposure", "severity": "Medium", "status": "resolved", "confidence_score": 56, "file_path": "harness/runner.py", "line_number": 416, "cluster": "cluster-platform", "description": "Django DEBUG mode enabled in configuration", "is_canary": false}, {"finding_id": "TG-PLATFORM-003-153d982f", "rule_id": "TG-PLATFORM-003", "title": "Production Stack Trace Exposure", "severity": "Medium", "status": "resolved", "confidence_score": 52, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 64, "cluster": "cluster-platform", "description": "Django DEBUG mode enabled in configuration", "is_canary": false}, {"finding_id": "TG-PLATFORM-003-21644311", "rule_id": "TG-PLATFORM-003", "title": "Production Stack Trace Exposure", "severity": "Medium", "status": "resolved", "confidence_score": 52, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 77, "cluster": "cluster-platform", "description": "Django DEBUG mode enabled in configuration", "is_canary": false}, {"finding_id": "TG-PLATFORM-003-21b8a588", "rule_id": "TG-PLATFORM-003", "title": "Production Stack Trace Exposure", "severity": "Medium", "status": "resolved", "confidence_score": 52, "file_path": "harness/validate_qa_v0_6_0.py", "line_number": 80, "cluster": "cluster-platform", "description": "Django DEBUG mode enabled in configuration", "is_canary": false}, {"finding_id": "TG-RATE-001-758a7750", "rule_id": "TG-RATE-001", "title": "Unlimited Authentication Endpoint", "severity": "Medium", "status": "resolved", "confidence_score": 65, "file_path": "harness/runner.py", "line_number": 575, "cluster": "cluster-rate-limiting", "description": "Authentication POST endpoint defined without rate-limiting middleware", "is_canary": false}, {"finding_id": "TG-SEC-001-88c9bb29", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "Medium", "status": "resolved", "confidence_score": 81, "file_path": "harness/runner.py", "line_number": 392, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}, {"finding_id": "TG-SEC-001-e0a84cf3", "rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "Medium", "status": "resolved", "confidence_score": 81, "file_path": "harness/runner.py", "line_number": 221, "cluster": "cluster-credentials-exposure", "description": "Hardcoded credential or API secret string", "is_canary": false}];
     const SARIF_RULES = [{"id": "TG-SEC-001", "shortDescription": {"text": "Hardcoded Secret or API Key in Tracked Source"}}, {"id": "TG-SEC-002", "shortDescription": {"text": "Public Client Environment Variable Secret Exposure"}}, {"id": "TG-SEC-003", "shortDescription": {"text": "Tracked Environment File"}}, {"id": "TG-SEC-004", "shortDescription": {"text": "Sensitive Information in Logs"}}, {"id": "TG-SEC-005", "shortDescription": {"text": "Secret in Git History or Query URL"}}, {"id": "TG-SEC-006", "shortDescription": {"text": "Secret in Build Artifact or Container Layer"}}, {"id": "TG-SEC-007", "shortDescription": {"text": "Secret in Test or Example Fixture Without Mock Marker"}}, {"id": "TG-AUTH-001", "shortDescription": {"text": "Weak Password Storage or Deprecated Hashing"}}, {"id": "TG-AUTH-002", "shortDescription": {"text": "Client-Only Authorization Enforcement"}}, {"id": "TG-AUTH-003", "shortDescription": {"text": "Missing Object-Level Authorization (IDOR)"}}, {"id": "TG-AUTH-004", "shortDescription": {"text": "Insecure Session Cookie Configuration"}}, {"id": "TG-AUTH-005", "shortDescription": {"text": "Unsafe Password Reset Token Generation"}}, {"id": "TG-AUTH-006", "shortDescription": {"text": "Mass Assignment & Privilege Escalation via Payloads"}}, {"id": "TG-AUTH-007", "shortDescription": {"text": "Missing Object-Level and Property-Level Authorization (IDOR)"}}, {"id": "TG-AUTH-008", "shortDescription": {"text": "Untrusted Role or Tenant Header Injection"}}, {"id": "TG-DB-001", "shortDescription": {"text": "Frontend Database Query Logic"}}, {"id": "TG-DB-002", "shortDescription": {"text": "Privileged Database Credential in Browser Context"}}, {"id": "TG-DB-003", "shortDescription": {"text": "Frontend Use of Admin or Server-Only Database SDKs"}}, {"id": "TG-DB-004", "shortDescription": {"text": "Missing Tenant Query Isolation in Multi-Tenant Models"}}, {"id": "TG-INPUT-001", "shortDescription": {"text": "Missing Server-Side Request Validation"}}, {"id": "TG-INPUT-002", "shortDescription": {"text": "Raw SQL Concatenation"}}, {"id": "TG-INPUT-003", "shortDescription": {"text": "Unsafe Dynamic Code or HTML Execution"}}, {"id": "TG-INPUT-004", "shortDescription": {"text": "Command Injection via Shell Execution"}}, {"id": "TG-INPUT-005", "shortDescription": {"text": "Unsafe Template Rendering & Disabled Autoescaping"}}, {"id": "TG-INPUT-006", "shortDescription": {"text": "Path Traversal and Unsafe Upload Storage"}}, {"id": "TG-RATE-001", "shortDescription": {"text": "Unlimited Authentication Endpoint"}}, {"id": "TG-RATE-002", "shortDescription": {"text": "Unlimited Public Write Endpoint"}}, {"id": "TG-RATE-003", "shortDescription": {"text": "Unbounded Resource Consumption"}}, {"id": "TG-AGENT-001", "shortDescription": {"text": "Prompt Injection in System Context Files"}}, {"id": "TG-AGENT-002", "shortDescription": {"text": "Unsafe Tool Dispatch & Shell Execution without Sandboxing"}}, {"id": "TG-AGENT-003", "shortDescription": {"text": "Overly Broad MCP Tool Scoping & Credential Access"}}, {"id": "TG-AGENT-004", "shortDescription": {"text": "Persistent Memory & Cross-Session Information Leakage"}}, {"id": "TG-SSRF-001", "shortDescription": {"text": "User-Controlled Server-Side URL Fetch"}}, {"id": "TG-SSRF-002", "shortDescription": {"text": "Missing Internal Network Protection"}}, {"id": "TG-SSRF-003", "shortDescription": {"text": "Unsafe Redirect Following"}}, {"id": "TG-SSRF-004", "shortDescription": {"text": "Unbounded Outbound Request Without Timeout"}}, {"id": "TG-WEBHOOK-001", "shortDescription": {"text": "Missing Webhook Signature Verification"}}, {"id": "TG-WEBHOOK-002", "shortDescription": {"text": "Replayable Webhook Without Timestamp Validation"}}, {"id": "TG-WEBHOOK-003", "shortDescription": {"text": "Missing Webhook Idempotency"}}, {"id": "TG-WEBHOOK-004", "shortDescription": {"text": "Unvalidated Webhook Event Type"}}, {"id": "TG-WS-001", "shortDescription": {"text": "Unauthenticated WebSocket Handshake"}}, {"id": "TG-WS-002", "shortDescription": {"text": "Missing Channel-Level Authorization"}}, {"id": "TG-WS-003", "shortDescription": {"text": "Unvalidated WebSocket Message"}}, {"id": "TG-WS-004", "shortDescription": {"text": "Unbounded WebSocket Connections"}}, {"id": "TG-CSRF-001", "shortDescription": {"text": "Missing CSRF Protection"}}, {"id": "TG-CSRF-002", "shortDescription": {"text": "Unsafe Credentialed Cross-Origin Request"}}, {"id": "TG-GQL-001", "shortDescription": {"text": "Missing Query Depth or Complexity Limits"}}, {"id": "TG-GQL-002", "shortDescription": {"text": "Resolver Missing Authorization"}}, {"id": "TG-GQL-003", "shortDescription": {"text": "Unbounded GraphQL Pagination or Batching"}}, {"id": "TG-GQL-004", "shortDescription": {"text": "Unnecessary Production Introspection"}}, {"id": "TG-SUPPLY-001", "shortDescription": {"text": "Missing or Ignored Dependency Lockfile"}}, {"id": "TG-SUPPLY-002", "shortDescription": {"text": "Vulnerable Dependency Review Missing"}}, {"id": "TG-SUPPLY-003", "shortDescription": {"text": "Unsafe CI/CD Secret Exposure"}}, {"id": "TG-SUPPLY-004", "shortDescription": {"text": "Unpinned CI Action"}}, {"id": "TG-SUPPLY-005", "shortDescription": {"text": "Unsafe Dependency Install Script"}}, {"id": "TG-SUPPLY-006", "shortDescription": {"text": "Container Build Secret Persistence"}}, {"id": "TG-BIZ-001", "shortDescription": {"text": "Client-Controlled Sensitive Business Value"}}, {"id": "TG-BIZ-002", "shortDescription": {"text": "Replayable One-Time Operation"}}, {"id": "TG-BIZ-003", "shortDescription": {"text": "Missing Workflow-State Validation"}}, {"id": "TG-BIZ-004", "shortDescription": {"text": "Unrestricted Sensitive Business Flow"}}, {"id": "TG-CACHE-001", "shortDescription": {"text": "Sensitive Response Publicly Cacheable"}}, {"id": "TG-CACHE-002", "shortDescription": {"text": "Missing User Cache Isolation"}}, {"id": "TG-CACHE-003", "shortDescription": {"text": "Sensitive Data in URL"}}, {"id": "TG-CLIENT-001", "shortDescription": {"text": "Public Production Source Maps"}}, {"id": "TG-CLIENT-002", "shortDescription": {"text": "Sensitive Client Bundle Content"}}, {"id": "TG-PLATFORM-001", "shortDescription": {"text": "Wildcard CORS With Credentials"}}, {"id": "TG-PLATFORM-002", "shortDescription": {"text": "Missing Security Headers"}}, {"id": "TG-PLATFORM-003", "shortDescription": {"text": "Production Stack Trace Exposure"}}, {"id": "TG-PLATFORM-004", "shortDescription": {"text": "Missing Request Size Limits"}}, {"id": "TG-DIFF-001", "shortDescription": {"text": "Accidental Security Check Bypass in Patch Additions"}}, {"id": "TG-DIFF-002", "shortDescription": {"text": "Secret and Token Ingestion in Patch Additions"}}, {"id": "TG-DIFF-003", "shortDescription": {"text": "Unintentional Removal of Tenant Filter in Patch Deletions"}}, {"id": "TG-EDGE-001", "shortDescription": {"text": "Serverless & Edge Global State Memory Leakage"}}, {"id": "TG-EDGE-003", "shortDescription": {"text": "AWS Lambda Ephemeral Execution & Cold Start Security"}}];
     const INVARIANT_CATALOG = {"TG-SEC-001": {"rule_id": "TG-SEC-001", "title": "Hardcoded Secret or API Key in Tracked Source", "severity": "Critical", "category": "secrets", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero hardcoded API keys, private certificates, AWS/GCP/Stripe tokens, or JWT secrets in tracked source code. Mandatory externalized environment configuration.", "owasp": "OWASP A02:2021 - Cryptographic Failures", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-SEC-002": {"rule_id": "TG-SEC-002", "title": "Public Client Environment Variable Secret Exposure", "severity": "Critical", "category": "secrets", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero hardcoded API keys, private certificates, AWS/GCP/Stripe tokens, or JWT secrets in tracked source code. Mandatory externalized environment configuration.", "owasp": "OWASP A02:2021 - Cryptographic Failures", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-SEC-003": {"rule_id": "TG-SEC-003", "title": "Tracked Environment File", "severity": "High", "category": "secrets", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero hardcoded API keys, private certificates, AWS/GCP/Stripe tokens, or JWT secrets in tracked source code. Mandatory externalized environment configuration.", "owasp": "OWASP A02:2021 - Cryptographic Failures", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-SEC-004": {"rule_id": "TG-SEC-004", "title": "Sensitive Information in Logs", "severity": "Medium", "category": "secrets", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero hardcoded API keys, private certificates, AWS/GCP/Stripe tokens, or JWT secrets in tracked source code. Mandatory externalized environment configuration.", "owasp": "OWASP A02:2021 - Cryptographic Failures", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-SEC-005": {"rule_id": "TG-SEC-005", "title": "Secret in Git History or Query URL", "severity": "Critical", "category": "secrets", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero hardcoded API keys, private certificates, AWS/GCP/Stripe tokens, or JWT secrets in tracked source code. Mandatory externalized environment configuration.", "owasp": "OWASP A02:2021 - Cryptographic Failures", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-SEC-006": {"rule_id": "TG-SEC-006", "title": "Secret in Build Artifact or Container Layer", "severity": "Critical", "category": "secrets", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero hardcoded API keys, private certificates, AWS/GCP/Stripe tokens, or JWT secrets in tracked source code. Mandatory externalized environment configuration.", "owasp": "OWASP A02:2021 - Cryptographic Failures", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-SEC-007": {"rule_id": "TG-SEC-007", "title": "Secret in Test or Example Fixture Without Mock Marker", "severity": "Critical", "category": "secrets", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero hardcoded API keys, private certificates, AWS/GCP/Stripe tokens, or JWT secrets in tracked source code. Mandatory externalized environment configuration.", "owasp": "OWASP A02:2021 - Cryptographic Failures", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-AUTH-001": {"rule_id": "TG-AUTH-001", "title": "Weak Password Storage or Deprecated Hashing", "severity": "Critical", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-AUTH-002": {"rule_id": "TG-AUTH-002", "title": "Client-Only Authorization Enforcement", "severity": "High", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-AUTH-003": {"rule_id": "TG-AUTH-003", "title": "Missing Object-Level Authorization (IDOR)", "severity": "High", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-AUTH-004": {"rule_id": "TG-AUTH-004", "title": "Insecure Session Cookie Configuration", "severity": "High", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-AUTH-005": {"rule_id": "TG-AUTH-005", "title": "Unsafe Password Reset Token Generation", "severity": "High", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-AUTH-006": {"rule_id": "TG-AUTH-006", "title": "Mass Assignment & Privilege Escalation via Payloads", "severity": "Critical", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-AUTH-007": {"rule_id": "TG-AUTH-007", "title": "Missing Object-Level and Property-Level Authorization (IDOR)", "severity": "Critical", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-AUTH-008": {"rule_id": "TG-AUTH-008", "title": "Untrusted Role or Tenant Header Injection", "severity": "Critical", "category": "auth", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Timing-safe secret compares, strong argon2id/bcrypt password hashing, explicit JWT algorithm pinning, and secure cookie session attributes.", "owasp": "OWASP A07:2021 - Identification & Authentication Failures", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(a)(1)"}, "TG-DB-001": {"rule_id": "TG-DB-001", "title": "Frontend Database Query Logic", "severity": "High", "category": "database", "cluster": "cluster-client-leak", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Zero unparameterized SQL concatenation. Enforces prepared statements with bound parameters and mandatory tenant partition scoping.", "owasp": "OWASP A03:2021 - Injection / A01: Broken Access Control", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.28 / HIPAA \u00a7 164.312(a)(1)"}, "TG-DB-002": {"rule_id": "TG-DB-002", "title": "Privileged Database Credential in Browser Context", "severity": "Critical", "category": "database", "cluster": "cluster-client-leak", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Zero unparameterized SQL concatenation. Enforces prepared statements with bound parameters and mandatory tenant partition scoping.", "owasp": "OWASP A03:2021 - Injection / A01: Broken Access Control", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.28 / HIPAA \u00a7 164.312(a)(1)"}, "TG-DB-003": {"rule_id": "TG-DB-003", "title": "Frontend Use of Admin or Server-Only Database SDKs", "severity": "Critical", "category": "database", "cluster": "cluster-client-leak", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Zero unparameterized SQL concatenation. Enforces prepared statements with bound parameters and mandatory tenant partition scoping.", "owasp": "OWASP A03:2021 - Injection / A01: Broken Access Control", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.28 / HIPAA \u00a7 164.312(a)(1)"}, "TG-DB-004": {"rule_id": "TG-DB-004", "title": "Missing Tenant Query Isolation in Multi-Tenant Models", "severity": "Critical", "category": "database", "cluster": "cluster-tenant-isolation", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Zero unparameterized SQL concatenation. Enforces prepared statements with bound parameters and mandatory tenant partition scoping.", "owasp": "OWASP A03:2021 - Injection / A01: Broken Access Control", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.28 / HIPAA \u00a7 164.312(a)(1)"}, "TG-INPUT-001": {"rule_id": "TG-INPUT-001", "title": "Missing Server-Side Request Validation", "severity": "High", "category": "injection", "cluster": "cluster-injection", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Strict path normalization, command argument escaping, and safe DOM assignment. Prevents path traversal, OS command injection, and Reflected/DOM XSS.", "owasp": "OWASP A03:2021 - Injection", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-INPUT-002": {"rule_id": "TG-INPUT-002", "title": "Raw SQL Concatenation", "severity": "Critical", "category": "injection", "cluster": "cluster-injection", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Strict path normalization, command argument escaping, and safe DOM assignment. Prevents path traversal, OS command injection, and Reflected/DOM XSS.", "owasp": "OWASP A03:2021 - Injection", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-INPUT-003": {"rule_id": "TG-INPUT-003", "title": "Unsafe Dynamic Code or HTML Execution", "severity": "High", "category": "injection", "cluster": "cluster-injection", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Strict path normalization, command argument escaping, and safe DOM assignment. Prevents path traversal, OS command injection, and Reflected/DOM XSS.", "owasp": "OWASP A03:2021 - Injection", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-INPUT-004": {"rule_id": "TG-INPUT-004", "title": "Command Injection via Shell Execution", "severity": "High", "category": "injection", "cluster": "cluster-injection", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Strict path normalization, command argument escaping, and safe DOM assignment. Prevents path traversal, OS command injection, and Reflected/DOM XSS.", "owasp": "OWASP A03:2021 - Injection", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-INPUT-005": {"rule_id": "TG-INPUT-005", "title": "Unsafe Template Rendering & Disabled Autoescaping", "severity": "High", "category": "injection", "cluster": "cluster-injection", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Strict path normalization, command argument escaping, and safe DOM assignment. Prevents path traversal, OS command injection, and Reflected/DOM XSS.", "owasp": "OWASP A03:2021 - Injection", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-INPUT-006": {"rule_id": "TG-INPUT-006", "title": "Path Traversal and Unsafe Upload Storage", "severity": "Critical", "category": "filesystem", "cluster": "cluster-injection", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Strict path normalization, command argument escaping, and safe DOM assignment. Prevents path traversal, OS command injection, and Reflected/DOM XSS.", "owasp": "OWASP A03:2021 - Injection", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-RATE-001": {"rule_id": "TG-RATE-001", "title": "Unlimited Authentication Endpoint", "severity": "High", "category": "rate", "cluster": "cluster-rate-limiting", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Sliding-window IP rate limiting on auth and write endpoints, bounded JSON payload parsers (<= 1MB), and slowloris connection timeouts.", "owasp": "OWASP A04:2021 - Insecure Design / A07: Auth Failures", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-RATE-002": {"rule_id": "TG-RATE-002", "title": "Unlimited Public Write Endpoint", "severity": "Medium", "category": "rate", "cluster": "cluster-rate-limiting", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Sliding-window IP rate limiting on auth and write endpoints, bounded JSON payload parsers (<= 1MB), and slowloris connection timeouts.", "owasp": "OWASP A04:2021 - Insecure Design / A07: Auth Failures", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-RATE-003": {"rule_id": "TG-RATE-003", "title": "Unbounded Resource Consumption", "severity": "High", "category": "rate", "cluster": "cluster-rate-limiting", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Sliding-window IP rate limiting on auth and write endpoints, bounded JSON payload parsers (<= 1MB), and slowloris connection timeouts.", "owasp": "OWASP A04:2021 - Insecure Design / A07: Auth Failures", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-AGENT-001": {"rule_id": "TG-AGENT-001", "title": "Prompt Injection in System Context Files", "severity": "Critical", "category": "agent", "cluster": "cluster-agent-security", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Structural user prompt isolation, inert delimiters, and tool call schema validation. Prevents direct and indirect prompt injection attacks.", "owasp": "OWASP LLM01: Prompt Injection", "compliance": "ISO 27001 A.8.28 (Secure Coding)"}, "TG-AGENT-002": {"rule_id": "TG-AGENT-002", "title": "Unsafe Tool Dispatch & Shell Execution without Sandboxing", "severity": "Critical", "category": "agent", "cluster": "cluster-agent-security", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Structural user prompt isolation, inert delimiters, and tool call schema validation. Prevents direct and indirect prompt injection attacks.", "owasp": "OWASP LLM01: Prompt Injection", "compliance": "ISO 27001 A.8.28 (Secure Coding)"}, "TG-AGENT-003": {"rule_id": "TG-AGENT-003", "title": "Overly Broad MCP Tool Scoping & Credential Access", "severity": "High", "category": "agent", "cluster": "cluster-agent-security", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Structural user prompt isolation, inert delimiters, and tool call schema validation. Prevents direct and indirect prompt injection attacks.", "owasp": "OWASP LLM01: Prompt Injection", "compliance": "ISO 27001 A.8.28 (Secure Coding)"}, "TG-AGENT-004": {"rule_id": "TG-AGENT-004", "title": "Persistent Memory & Cross-Session Information Leakage", "severity": "High", "category": "agent", "cluster": "cluster-agent-security", "layer_id": "layer-app", "layer_name": "Application & LLM Defense", "guarantee": "Structural user prompt isolation, inert delimiters, and tool call schema validation. Prevents direct and indirect prompt injection attacks.", "owasp": "OWASP LLM01: Prompt Injection", "compliance": "ISO 27001 A.8.28 (Secure Coding)"}, "TG-SSRF-001": {"rule_id": "TG-SSRF-001", "title": "User-Controlled Server-Side URL Fetch", "severity": "Critical", "category": "ssrf", "cluster": "cluster-ssrf", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Outbound URL hostname whitelisting, RFC1918 private IP range blocking (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1) and cloud metadata blocking (169.254.169.254).", "owasp": "OWASP A10:2021 - Server-Side Request Forgery (SSRF)", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-SSRF-002": {"rule_id": "TG-SSRF-002", "title": "Missing Internal Network Protection", "severity": "Critical", "category": "ssrf", "cluster": "cluster-ssrf", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Outbound URL hostname whitelisting, RFC1918 private IP range blocking (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1) and cloud metadata blocking (169.254.169.254).", "owasp": "OWASP A10:2021 - Server-Side Request Forgery (SSRF)", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-SSRF-003": {"rule_id": "TG-SSRF-003", "title": "Unsafe Redirect Following", "severity": "Critical", "category": "ssrf", "cluster": "cluster-ssrf", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Outbound URL hostname whitelisting, RFC1918 private IP range blocking (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1) and cloud metadata blocking (169.254.169.254).", "owasp": "OWASP A10:2021 - Server-Side Request Forgery (SSRF)", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-SSRF-004": {"rule_id": "TG-SSRF-004", "title": "Unbounded Outbound Request Without Timeout", "severity": "Critical", "category": "ssrf", "cluster": "cluster-ssrf", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Outbound URL hostname whitelisting, RFC1918 private IP range blocking (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1) and cloud metadata blocking (169.254.169.254).", "owasp": "OWASP A10:2021 - Server-Side Request Forgery (SSRF)", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-WEBHOOK-001": {"rule_id": "TG-WEBHOOK-001", "title": "Missing Webhook Signature Verification", "severity": "Critical", "category": "webhook", "cluster": "cluster-webhook", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Mandatory cryptographic HMAC-SHA256 signature verification over raw request buffers and replay attack protection with <= 300s timestamp limits.", "owasp": "OWASP A08:2021 - Software and Data Integrity Failures", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(c)(1)"}, "TG-WEBHOOK-002": {"rule_id": "TG-WEBHOOK-002", "title": "Replayable Webhook Without Timestamp Validation", "severity": "Critical", "category": "webhook", "cluster": "cluster-webhook", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Mandatory cryptographic HMAC-SHA256 signature verification over raw request buffers and replay attack protection with <= 300s timestamp limits.", "owasp": "OWASP A08:2021 - Software and Data Integrity Failures", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(c)(1)"}, "TG-WEBHOOK-003": {"rule_id": "TG-WEBHOOK-003", "title": "Missing Webhook Idempotency", "severity": "Critical", "category": "webhook", "cluster": "cluster-webhook", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Mandatory cryptographic HMAC-SHA256 signature verification over raw request buffers and replay attack protection with <= 300s timestamp limits.", "owasp": "OWASP A08:2021 - Software and Data Integrity Failures", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(c)(1)"}, "TG-WEBHOOK-004": {"rule_id": "TG-WEBHOOK-004", "title": "Unvalidated Webhook Event Type", "severity": "Critical", "category": "webhook", "cluster": "cluster-webhook", "layer_id": "layer-net", "layer_name": "Network, SSRF & Webhooks", "guarantee": "Mandatory cryptographic HMAC-SHA256 signature verification over raw request buffers and replay attack protection with <= 300s timestamp limits.", "owasp": "OWASP A08:2021 - Software and Data Integrity Failures", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(c)(1)"}, "TG-WS-001": {"rule_id": "TG-WS-001", "title": "Unauthenticated WebSocket Handshake", "severity": "High", "category": "ws", "cluster": "cluster-websocket", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Handshake origin validation, connection ticket verification, and inbound frame size bounds to eliminate CSWSH and socket exhaustion.", "owasp": "OWASP A01:2021 - Broken Access Control / A05: Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-WS-002": {"rule_id": "TG-WS-002", "title": "Missing Channel-Level Authorization", "severity": "Critical", "category": "ws", "cluster": "cluster-websocket", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Handshake origin validation, connection ticket verification, and inbound frame size bounds to eliminate CSWSH and socket exhaustion.", "owasp": "OWASP A01:2021 - Broken Access Control / A05: Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-WS-003": {"rule_id": "TG-WS-003", "title": "Unvalidated WebSocket Message", "severity": "Critical", "category": "ws", "cluster": "cluster-websocket", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Handshake origin validation, connection ticket verification, and inbound frame size bounds to eliminate CSWSH and socket exhaustion.", "owasp": "OWASP A01:2021 - Broken Access Control / A05: Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-WS-004": {"rule_id": "TG-WS-004", "title": "Unbounded WebSocket Connections", "severity": "Critical", "category": "ws", "cluster": "cluster-websocket", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Handshake origin validation, connection ticket verification, and inbound frame size bounds to eliminate CSWSH and socket exhaustion.", "owasp": "OWASP A01:2021 - Broken Access Control / A05: Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-CSRF-001": {"rule_id": "TG-CSRF-001", "title": "Missing CSRF Protection", "severity": "Critical", "category": "csrf", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Cryptographic anti-CSRF token verification on state-changing requests and SameSite=Lax/Strict cookie isolation.", "owasp": "OWASP A01:2021 - Broken Access Control", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.28"}, "TG-CSRF-002": {"rule_id": "TG-CSRF-002", "title": "Unsafe Credentialed Cross-Origin Request", "severity": "Critical", "category": "csrf", "cluster": "cluster-auth-bypass", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Cryptographic anti-CSRF token verification on state-changing requests and SameSite=Lax/Strict cookie isolation.", "owasp": "OWASP A01:2021 - Broken Access Control", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.28"}, "TG-GQL-001": {"rule_id": "TG-GQL-001", "title": "Missing Query Depth or Complexity Limits", "severity": "High", "category": "gql", "cluster": "cluster-graphql", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Query depth limiting (max depth <= 7), circular reference blocking, field complexity cost analysis, and production schema introspection suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-GQL-002": {"rule_id": "TG-GQL-002", "title": "Resolver Missing Authorization", "severity": "Critical", "category": "gql", "cluster": "cluster-graphql", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Query depth limiting (max depth <= 7), circular reference blocking, field complexity cost analysis, and production schema introspection suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-GQL-003": {"rule_id": "TG-GQL-003", "title": "Unbounded GraphQL Pagination or Batching", "severity": "Critical", "category": "gql", "cluster": "cluster-graphql", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Query depth limiting (max depth <= 7), circular reference blocking, field complexity cost analysis, and production schema introspection suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-GQL-004": {"rule_id": "TG-GQL-004", "title": "Unnecessary Production Introspection", "severity": "Critical", "category": "gql", "cluster": "cluster-graphql", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Query depth limiting (max depth <= 7), circular reference blocking, field complexity cost analysis, and production schema introspection suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.28"}, "TG-SUPPLY-001": {"rule_id": "TG-SUPPLY-001", "title": "Missing or Ignored Dependency Lockfile", "severity": "Critical", "category": "supply", "cluster": "cluster-supply-chain", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Lockfile cryptographic integrity checks, known high/critical CVE build gates, verified registry origins, and build script execution bounds.", "owasp": "OWASP A06:2021 - Vulnerable and Outdated Components", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28"}, "TG-SUPPLY-002": {"rule_id": "TG-SUPPLY-002", "title": "Vulnerable Dependency Review Missing", "severity": "Critical", "category": "supply", "cluster": "cluster-supply-chain", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Lockfile cryptographic integrity checks, known high/critical CVE build gates, verified registry origins, and build script execution bounds.", "owasp": "OWASP A06:2021 - Vulnerable and Outdated Components", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28"}, "TG-SUPPLY-003": {"rule_id": "TG-SUPPLY-003", "title": "Unsafe CI/CD Secret Exposure", "severity": "Critical", "category": "supply", "cluster": "cluster-supply-chain", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Lockfile cryptographic integrity checks, known high/critical CVE build gates, verified registry origins, and build script execution bounds.", "owasp": "OWASP A06:2021 - Vulnerable and Outdated Components", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28"}, "TG-SUPPLY-004": {"rule_id": "TG-SUPPLY-004", "title": "Unpinned CI Action", "severity": "Critical", "category": "supply", "cluster": "cluster-supply-chain", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Lockfile cryptographic integrity checks, known high/critical CVE build gates, verified registry origins, and build script execution bounds.", "owasp": "OWASP A06:2021 - Vulnerable and Outdated Components", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28"}, "TG-SUPPLY-005": {"rule_id": "TG-SUPPLY-005", "title": "Unsafe Dependency Install Script", "severity": "Critical", "category": "supply", "cluster": "cluster-supply-chain", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Lockfile cryptographic integrity checks, known high/critical CVE build gates, verified registry origins, and build script execution bounds.", "owasp": "OWASP A06:2021 - Vulnerable and Outdated Components", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28"}, "TG-SUPPLY-006": {"rule_id": "TG-SUPPLY-006", "title": "Container Build Secret Persistence", "severity": "High", "category": "supply", "cluster": "cluster-supply-chain", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Lockfile cryptographic integrity checks, known high/critical CVE build gates, verified registry origins, and build script execution bounds.", "owasp": "OWASP A06:2021 - Vulnerable and Outdated Components", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28"}, "TG-BIZ-001": {"rule_id": "TG-BIZ-001", "title": "Client-Controlled Sensitive Business Value", "severity": "Critical", "category": "biz", "cluster": "cluster-biz-logic", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Strict positive financial amount constraints, atomic database transaction locks, and coupon stacking bounds to prevent race conditions.", "owasp": "OWASP A04:2021 - Insecure Design", "compliance": "HIPAA \u00a7 164.312(c)(1) Data Integrity / SOC 2 CC7.1"}, "TG-BIZ-002": {"rule_id": "TG-BIZ-002", "title": "Replayable One-Time Operation", "severity": "Critical", "category": "biz", "cluster": "cluster-biz-logic", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Strict positive financial amount constraints, atomic database transaction locks, and coupon stacking bounds to prevent race conditions.", "owasp": "OWASP A04:2021 - Insecure Design", "compliance": "HIPAA \u00a7 164.312(c)(1) Data Integrity / SOC 2 CC7.1"}, "TG-BIZ-003": {"rule_id": "TG-BIZ-003", "title": "Missing Workflow-State Validation", "severity": "Critical", "category": "biz", "cluster": "cluster-biz-logic", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Strict positive financial amount constraints, atomic database transaction locks, and coupon stacking bounds to prevent race conditions.", "owasp": "OWASP A04:2021 - Insecure Design", "compliance": "HIPAA \u00a7 164.312(c)(1) Data Integrity / SOC 2 CC7.1"}, "TG-BIZ-004": {"rule_id": "TG-BIZ-004", "title": "Unrestricted Sensitive Business Flow", "severity": "Critical", "category": "biz", "cluster": "cluster-biz-logic", "layer_id": "layer-auth", "layer_name": "Identity, Auth & Real-Time", "guarantee": "Strict positive financial amount constraints, atomic database transaction locks, and coupon stacking bounds to prevent race conditions.", "owasp": "OWASP A04:2021 - Insecure Design", "compliance": "HIPAA \u00a7 164.312(c)(1) Data Integrity / SOC 2 CC7.1"}, "TG-CACHE-001": {"rule_id": "TG-CACHE-001", "title": "Sensitive Response Publicly Cacheable", "severity": "Critical", "category": "cache", "cluster": "cluster-cache", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Mandatory Cache-Control: no-store on authenticated sensitive responses and unkeyed HTTP header sanitization to prevent web cache poisoning.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.20"}, "TG-CACHE-002": {"rule_id": "TG-CACHE-002", "title": "Missing User Cache Isolation", "severity": "Critical", "category": "cache", "cluster": "cluster-cache", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Mandatory Cache-Control: no-store on authenticated sensitive responses and unkeyed HTTP header sanitization to prevent web cache poisoning.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.20"}, "TG-CACHE-003": {"rule_id": "TG-CACHE-003", "title": "Sensitive Data in URL", "severity": "Critical", "category": "cache", "cluster": "cluster-cache", "layer_id": "layer-db", "layer_name": "Database, GraphQL & Cache", "guarantee": "Mandatory Cache-Control: no-store on authenticated sensitive responses and unkeyed HTTP header sanitization to prevent web cache poisoning.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.20"}, "TG-CLIENT-001": {"rule_id": "TG-CLIENT-001", "title": "Public Production Source Maps", "severity": "Medium", "category": "client", "cluster": "cluster-client-leak", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero server role keys, database master credentials, or private API secrets leaked into frontend bundles or public environment variables.", "owasp": "OWASP A01:2021 - Broken Access Control / A05: Misconfiguration", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-CLIENT-002": {"rule_id": "TG-CLIENT-002", "title": "Sensitive Client Bundle Content", "severity": "High", "category": "client", "cluster": "cluster-client-leak", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Zero server role keys, database master credentials, or private API secrets leaked into frontend bundles or public environment variables.", "owasp": "OWASP A01:2021 - Broken Access Control / A05: Misconfiguration", "compliance": "SOC 2 CC6.1 / ISO 27001 A.8.24 / HIPAA \u00a7 164.312(e)(1)"}, "TG-PLATFORM-001": {"rule_id": "TG-PLATFORM-001", "title": "Wildcard CORS With Credentials", "severity": "High", "category": "platform", "cluster": "cluster-auth-bypass", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Mandatory production security headers (CSP, HSTS max-age>=31536000, X-Content-Type-Options: nosniff, X-Frame-Options: DENY) and debug mode suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(e)(1)"}, "TG-PLATFORM-002": {"rule_id": "TG-PLATFORM-002", "title": "Missing Security Headers", "severity": "Medium", "category": "platform", "cluster": "cluster-platform", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Mandatory production security headers (CSP, HSTS max-age>=31536000, X-Content-Type-Options: nosniff, X-Frame-Options: DENY) and debug mode suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(e)(1)"}, "TG-PLATFORM-003": {"rule_id": "TG-PLATFORM-003", "title": "Production Stack Trace Exposure", "severity": "Medium", "category": "platform", "cluster": "cluster-platform", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Mandatory production security headers (CSP, HSTS max-age>=31536000, X-Content-Type-Options: nosniff, X-Frame-Options: DENY) and debug mode suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(e)(1)"}, "TG-PLATFORM-004": {"rule_id": "TG-PLATFORM-004", "title": "Missing Request Size Limits", "severity": "Medium", "category": "platform", "cluster": "cluster-platform", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Mandatory production security headers (CSP, HSTS max-age>=31536000, X-Content-Type-Options: nosniff, X-Frame-Options: DENY) and debug mode suppression.", "owasp": "OWASP A05:2021 - Security Misconfiguration", "compliance": "SOC 2 CC6.7 / ISO 27001 A.8.20 / HIPAA \u00a7 164.312(e)(1)"}, "TG-DIFF-001": {"rule_id": "TG-DIFF-001", "title": "Accidental Security Check Bypass in Patch Additions", "severity": "Critical", "category": "transport", "cluster": "cluster-transport-security", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Strict Ponytail Protocol enforcement (<= 35 additions, <= 25 deletions per patch) and zero security suppression pragmas (nosec pragmas, InsecureSkipVerify).", "owasp": "OWASP A08:2021 - Software Integrity", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28 / HIPAA \u00a7 164.312(c)(1)"}, "TG-DIFF-002": {"rule_id": "TG-DIFF-002", "title": "Secret and Token Ingestion in Patch Additions", "severity": "Critical", "category": "diff", "cluster": "cluster-credentials-exposure", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Strict Ponytail Protocol enforcement (<= 35 additions, <= 25 deletions per patch) and zero security suppression pragmas (nosec pragmas, InsecureSkipVerify).", "owasp": "OWASP A08:2021 - Software Integrity", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28 / HIPAA \u00a7 164.312(c)(1)"}, "TG-DIFF-003": {"rule_id": "TG-DIFF-003", "title": "Unintentional Removal of Tenant Filter in Patch Deletions", "severity": "High", "category": "diff", "cluster": "cluster-tenant-isolation", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Strict Ponytail Protocol enforcement (<= 35 additions, <= 25 deletions per patch) and zero security suppression pragmas (nosec pragmas, InsecureSkipVerify).", "owasp": "OWASP A08:2021 - Software Integrity", "compliance": "SOC 2 CC7.1 / ISO 27001 A.8.28 / HIPAA \u00a7 164.312(c)(1)"}, "TG-EDGE-001": {"rule_id": "TG-EDGE-001", "title": "Serverless & Edge Global State Memory Leakage", "severity": "High", "category": "edge", "cluster": "cluster-edge", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Subrequest fan-out limits (<= 50 per invocation), serverless wall-clock execution timeouts (<= 30s), and memory bounds for edge functions.", "owasp": "OWASP A04:2021 - Insecure Design", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}, "TG-EDGE-003": {"rule_id": "TG-EDGE-003", "title": "AWS Lambda Ephemeral Execution & Cold Start Security", "severity": "High", "category": "edge", "cluster": "cluster-edge", "layer_id": "layer-platform", "layer_name": "Platform, Supply Chain & Secrets", "guarantee": "Subrequest fan-out limits (<= 50 per invocation), serverless wall-clock execution timeouts (<= 30s), and memory bounds for edge functions.", "owasp": "OWASP A04:2021 - Insecure Design", "compliance": "SOC 2 CC6.6 / ISO 27001 A.8.20"}};
     const VIOLATED_RULE_IDS = [];
@@ -2341,6 +5427,38 @@
     let currentRecipeCategory = 'all';
     let BASE_POSTURE_SCORE = 100;
+    // ── Modal Dialog Engine ──
+    function openModal(id) {
+      const m = document.getElementById(id);
+      if (m) {
+        m.style.display = 'flex';
+        document.body.style.overflow = 'hidden';
+      }
+    }
+    function closeModal(id, event) {
+      if (event && event.target && event.target !== event.currentTarget && !event.target.classList.contains('modal-close-btn')) {
+        return;
+      }
+      const m = document.getElementById(id);
+      if (m) {
+        m.style.display = 'none';
+        document.body.style.overflow = '';
+      }
+    }
+    function openFindingsModal() { openModal('findingsModal'); }
+    function openInvariantsModal() { openModal('invariantsCatalogModal'); }
+    function openRecipesModal() { openModal('recipesModal'); }
+    function openAdvisoryModal() { openModal('advisoryModal'); }
+    document.addEventListener('keydown', function(e) {
+      if (e.key === 'Escape') {
+        document.querySelectorAll('.modal-backdrop').forEach(m => {
+          m.style.display = 'none';
+        });
+        document.body.style.overflow = '';
+      }
+    });
     // ── Theme Switcher ──
     function initTheme() {
       const saved = localStorage.getItem('tg_theme');
@@ -2379,6 +5497,8 @@
       let remCrit = 0, remHigh = 0, remMed = 0, remLow = 0;
       RAW_FINDINGS.forEach(f => {
         if (f.is_canary) return;
+        const st = (f.status || 'open').toLowerCase();
+        if (st === 'resolved' || st === 'fixed' || st === 'confirmed_fixed') return;
         if (fixedIds.has(f.finding_id)) return; // Simulated as fixed
         const s = f.severity;
         if (s === 'Critical') remCrit++;
@@ -2537,6 +5657,7 @@
     // ── Findings Filtering & Drawer Lifecycle ──
     function filterBySeverity(sev) {
+      openFindingsModal();
       currentSeverity = sev;
       document.querySelectorAll('[data-sev-filter]').forEach(p => {
         if (p.getAttribute('data-sev-filter') === sev) p.classList.add('active');
@@ -2559,6 +5680,7 @@
     }
     function filterByDirectory(dir) {
+      openFindingsModal();
       currentDirectory = dir.replace(/\/$/, '');
       const chip = document.getElementById('dirFilterChip');
       const chipName = document.getElementById('dirFilterName');
@@ -2609,16 +5731,59 @@
       if (!body) return;
       if (body.style.display === 'none') {
         body.style.display = 'block';
-        icon.innerHTML = '&#9660; Collapse Matrix';
+        if (icon) icon.innerHTML = '&#9660; Collapse Details';
+      } else {
+        body.style.display = 'none';
+        if (icon) icon.innerHTML = '&#9654; Expand 74 Invariant Details';
+      }
+    }
+    function toggleFindingsArchive() {
+      const body = document.getElementById('findingsArchiveBody');
+      const icon = document.getElementById('archiveToggleIcon');
+      const btn = document.getElementById('btnArchiveToggle');
+      if (!body) return;
+      if (body.style.display === 'none') {
+        body.style.display = 'block';
+        if (icon) icon.innerHTML = '&#9660;';
+        if (btn) btn.classList.add('active');
+        searchFindings();
+      } else {
+        body.style.display = 'none';
+        if (icon) icon.innerHTML = '&#9654;';
+        if (btn) btn.classList.remove('active');
+      }
+    }
+    function toggleRecipesSection() {
+      const body = document.getElementById('recipesCardBody');
+      const icon = document.getElementById('recipesToggleIcon');
+      const btn = document.getElementById('btnRecipesToggle');
+      if (!body) return;
+      if (body.style.display === 'none') {
+        body.style.display = 'block';
+        if (btn) btn.innerHTML = '<span id="recipesToggleIcon">&#9660;</span> Collapse';
       } else {
         body.style.display = 'none';
-        icon.innerHTML = '&#9654; Expand Matrix';
+        if (btn) btn.innerHTML = '<span id="recipesToggleIcon">&#9654;</span> Expand (15)';
+      }
+    }
+    function toggleComplianceSection() {
+      const grid = document.getElementById('gridCompliance');
+      const icon = document.getElementById('compToggleIcon');
+      if (!grid) return;
+      if (grid.style.display === 'none') {
+        grid.style.display = 'grid';
+        if (icon) icon.innerHTML = '&#9660; Collapse';
+      } else {
+        grid.style.display = 'none';
+        if (icon) icon.innerHTML = '&#9654; Expand Frameworks';
       }
     }
     function toggleDefendedSection() {
-      const sec = document.getElementById('defendedSection');
-      if (sec) sec.scrollIntoView({ behavior: 'smooth' });
+      openInvariantsModal();
     }
     function searchFindings() {