torusguard 1.4.0 → 2.0.0-alpha

package/skills/torusguard/payload/scripts/safety_gate.py

@@ -1,64 +1,64 @@
-#!/usr/bin/env python3
-"""
-TorusGuard Runtime Safety Gate Evaluator
-Evaluates prospective HTTP/browser validation probes against non-destruction policies.
-"""
-
-import sys
-import json
-import argparse
-from typing import Dict, Any, Tuple
-
-def evaluate_safety_gate(method: str, path: str, body: str = "") -> Tuple[str, str]:
-    """
-    Returns (decision, rationale)
-    Decisions:
-    - Auto-Allowed
-    - Approval Required
-    - Manual Only (Blocked)
-    """
-    method_upper = method.upper()
-
-    # Block destructive verbs
-    if method_upper in ("DELETE", "DROP"):
-        return "Manual Only", f"Method '{method_upper}' is destructive and strictly blocked from automated runtime validation."
-
-    # Block sensitive administrative paths
-    destructive_keywords = ["/admin/delete", "/shutdown", "/drop-database", "/purge", "/reset-system"]
-    for kw in destructive_keywords:
-        if kw in path.lower():
-            return "Manual Only", f"Path '{path}' targets destructive administrative endpoint '{kw}'."
-
-    # Safe read methods
-    if method_upper in ("GET", "HEAD", "OPTIONS"):
-        return "Auto-Allowed", f"Read-only method '{method_upper}' with non-destructive path."
-
-    # State-changing methods (POST, PUT, PATCH)
-    if method_upper in ("POST", "PUT", "PATCH"):
-        # Check if safe canary marker exists
-        if "tg-canary" in body.lower() or "torusguard" in body.lower():
-            return "Approval Required", f"State-changing method '{method_upper}' contains benign TorusGuard test marker; requires user approval."
-        else:
-            return "Approval Required", f"State-changing method '{method_upper}' requires operator approval before execution."
-
-    return "Approval Required", f"Unknown probe profile for {method_upper} {path}."
-
-
-def main():
-    parser = argparse.ArgumentParser(description="TorusGuard Safety Gate Evaluator")
-    parser.add_argument("--method", "-m", default="GET", help="HTTP Method")
-    parser.add_argument("--path", "-p", default="/api/test", help="Endpoint path")
-    parser.add_argument("--body", "-b", default="", help="Request payload body")
-    parser.add_argument("--json", action="store_true", help="Output JSON")
-    args = parser.parse_args()
-
-    decision, rationale = evaluate_safety_gate(args.method, args.path, args.body)
-
-    if args.json:
-        print(json.dumps({"decision": decision, "rationale": rationale}, indent=2))
-    else:
-        print(f"Safety Decision: {decision}")
-        print(f"Rationale: {rationale}")
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+TorusGuard Runtime Safety Gate Evaluator
+Evaluates prospective HTTP/browser validation probes against non-destruction policies.
+"""
+
+import sys
+import json
+import argparse
+from typing import Dict, Any, Tuple
+
+def evaluate_safety_gate(method: str, path: str, body: str = "") -> Tuple[str, str]:
+    """
+    Returns (decision, rationale)
+    Decisions:
+    - Auto-Allowed
+    - Approval Required
+    - Manual Only (Blocked)
+    """
+    method_upper = method.upper()
+
+    # Block destructive verbs
+    if method_upper in ("DELETE", "DROP"):
+        return "Manual Only", f"Method '{method_upper}' is destructive and strictly blocked from automated runtime validation."
+
+    # Block sensitive administrative paths
+    destructive_keywords = ["/admin/delete", "/shutdown", "/drop-database", "/purge", "/reset-system"]
+    for kw in destructive_keywords:
+        if kw in path.lower():
+            return "Manual Only", f"Path '{path}' targets destructive administrative endpoint '{kw}'."
+
+    # Safe read methods
+    if method_upper in ("GET", "HEAD", "OPTIONS"):
+        return "Auto-Allowed", f"Read-only method '{method_upper}' with non-destructive path."
+
+    # State-changing methods (POST, PUT, PATCH)
+    if method_upper in ("POST", "PUT", "PATCH"):
+        # Check if safe canary marker exists
+        if "tg-canary" in body.lower() or "torusguard" in body.lower():
+            return "Approval Required", f"State-changing method '{method_upper}' contains benign TorusGuard test marker; requires user approval."
+        else:
+            return "Approval Required", f"State-changing method '{method_upper}' requires operator approval before execution."
+
+    return "Approval Required", f"Unknown probe profile for {method_upper} {path}."
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Safety Gate Evaluator")
+    parser.add_argument("--method", "-m", default="GET", help="HTTP Method")
+    parser.add_argument("--path", "-p", default="/api/test", help="Endpoint path")
+    parser.add_argument("--body", "-b", default="", help="Request payload body")
+    parser.add_argument("--json", action="store_true", help="Output JSON")
+    args = parser.parse_args()
+
+    decision, rationale = evaluate_safety_gate(args.method, args.path, args.body)
+
+    if args.json:
+        print(json.dumps({"decision": decision, "rationale": rationale}, indent=2))
+    else:
+        print(f"Safety Decision: {decision}")
+        print(f"Rationale: {rationale}")
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/skills/torusguard/references/csharp-security.md

@@ -1,41 +1,41 @@
-# TorusGuard Skill Reference: C# & ASP.NET Core Security
-
-> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Authentication & Authorization
-* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
-* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
-
-### 2. Entity Framework Core & SQL Injection
-* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
-* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
-* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
-
-### 3. Anti-Forgery & TLS
-* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
-* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```csharp
-// Safe Entity Framework Parameterized Query
-var user = await context.Users
-    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
-    .FirstOrDefaultAsync();
-
-// Safe Global Query Filter in DbContext
-modelBuilder.Entity<Invoice>()
-    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
-
-// Safe Controller Security
-[Authorize]
-[ApiController]
-[Route("api/[controller]")]
-public class InvoicesController : ControllerBase { ... }
-```
+# TorusGuard Skill Reference: C# & ASP.NET Core Security
+
+> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Authentication & Authorization
+* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
+* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
+
+### 2. Entity Framework Core & SQL Injection
+* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
+* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
+* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
+
+### 3. Anti-Forgery & TLS
+* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
+* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```csharp
+// Safe Entity Framework Parameterized Query
+var user = await context.Users
+    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
+    .FirstOrDefaultAsync();
+
+// Safe Global Query Filter in DbContext
+modelBuilder.Entity<Invoice>()
+    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
+
+// Safe Controller Security
+[Authorize]
+[ApiController]
+[Route("api/[controller]")]
+public class InvoicesController : ControllerBase { ... }
+```

package/skills/torusguard/payload/skills/torusguard/references/go-security.md

@@ -1,41 +1,41 @@
-# TorusGuard Skill Reference: Go Security
-
-> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Database & SQL Injection
-* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
-* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
-
-### 2. TLS & Network Security
-* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
-* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
-
-### 3. Concurrency & Goroutine Safety
-* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
-* Use mutexes or channels to prevent data races on shared state.
-
-### 4. Input Validation & Path Traversal
-* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```go
-// Safe Parameterized Query
-row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
-
-// Safe GORM Scoping
-var invoice Invoice
-result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
-
-// Safe TLS Client
-tlsConfig := &tls.Config{
-    MinVersion: tls.VersionTLS13,
-}
-client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
-```
+# TorusGuard Skill Reference: Go Security
+
+> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Database & SQL Injection
+* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
+* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
+
+### 2. TLS & Network Security
+* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
+* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
+
+### 3. Concurrency & Goroutine Safety
+* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
+* Use mutexes or channels to prevent data races on shared state.
+
+### 4. Input Validation & Path Traversal
+* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```go
+// Safe Parameterized Query
+row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
+
+// Safe GORM Scoping
+var invoice Invoice
+result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
+
+// Safe TLS Client
+tlsConfig := &tls.Config{
+    MinVersion: tls.VersionTLS13,
+}
+client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
+```

package/skills/torusguard/payload/skills/torusguard/references/java-security.md

@@ -1,40 +1,40 @@
-# TorusGuard Skill Reference: Java & Spring Security
-
-> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Spring Security & CSRF
-* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
-* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
-
-### 2. JPA & Hibernate SQL Injection
-* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
-* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
-
-### 3. Insecure Deserialization & XML
-* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
-* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```java
-// Safe JPA Query
-@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
-Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
-
-// Safe Spring Security Configuration
-@Bean
-public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-    http
-        .authorizeHttpRequests(auth -> auth
-            .requestMatchers("/public/**").permitAll()
-            .anyRequest().authenticated()
-        );
-    return http.build();
-}
-```
+# TorusGuard Skill Reference: Java & Spring Security
+
+> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Spring Security & CSRF
+* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
+* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
+
+### 2. JPA & Hibernate SQL Injection
+* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
+* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
+
+### 3. Insecure Deserialization & XML
+* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
+* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```java
+// Safe JPA Query
+@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
+Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
+
+// Safe Spring Security Configuration
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        .authorizeHttpRequests(auth -> auth
+            .requestMatchers("/public/**").permitAll()
+            .anyRequest().authenticated()
+        );
+    return http.build();
+}
+```

package/skills/torusguard/payload/skills/torusguard/references/polyglot-security-matrix.md

@@ -1,25 +1,25 @@
-# TorusGuard Universal Polyglot Security Matrix
-
-> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
-
----
-
-## 🛡️ Cross-Language Invariant Mappings
-
-| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
-|---|---|---|---|---|---|---|
-| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
-| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
-| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
-| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
-| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
-| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
-| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
-
----
-
-## 🚀 Polyglot Hardening Rules of Thumb
-
-1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
-2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
-3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.
+# TorusGuard Universal Polyglot Security Matrix
+
+> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
+
+---
+
+## 🛡️ Cross-Language Invariant Mappings
+
+| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
+|---|---|---|---|---|---|---|
+| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
+| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
+| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
+| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
+| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
+| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
+| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
+
+---
+
+## 🚀 Polyglot Hardening Rules of Thumb
+
+1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
+2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
+3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.

package/skills/torusguard/payload/skills/torusguard/references/rust-security.md

@@ -1,40 +1,40 @@
-# TorusGuard Skill Reference: Rust Security
-
-> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Memory Safety & Unsafe Blocks
-* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
-* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
-
-### 2. Database & SQL Queries
-* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
-* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
-
-### 3. Outbound Requests & TLS
-* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
-* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```rust
-// Safe sqlx Parameterized Query
-let user = sqlx::query_as!(
-    User,
-    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
-    user_id,
-    current_tenant_id
-)
-.fetch_one(&pool)
-.await?;
-
-// Safe reqwest Client (Strict TLS)
-let client = reqwest::Client::builder()
-    .timeout(std::time::Duration::from_secs(10))
-    .build()?;
-```
+# TorusGuard Skill Reference: Rust Security
+
+> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Memory Safety & Unsafe Blocks
+* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
+* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
+
+### 2. Database & SQL Queries
+* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
+* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
+
+### 3. Outbound Requests & TLS
+* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
+* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```rust
+// Safe sqlx Parameterized Query
+let user = sqlx::query_as!(
+    User,
+    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
+    user_id,
+    current_tenant_id
+)
+.fetch_one(&pool)
+.await?;
+
+// Safe reqwest Client (Strict TLS)
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(10))
+    .build()?;
+```

package/skills/torusguard/payload/templates/audit-report.template.md

@@ -1,54 +1,54 @@
-# TorusGuard Security Audit & Runtime Verification Report
-
-> **TorusGuard Version:** `{{torusguard_version}}`  
-> **Target:** `{{target_name}}`  
-> **Run ID:** `{{run_id}}`  
-> **Timestamp:** `{{timestamp}}`  
-
----
-
-## Detected Stack
-- **Language:** {{stack_language}}
-- **Framework:** {{stack_framework}}
-- **Data Layer:** {{stack_data_layer}}
-- **Dependency Files:** {{stack_dependency_files}}
-- **Detection Confidence:** {{stack_confidence}}
-
----
-
-## Executive Posture
-**Posture:** {{posture_indicator}}  
-**Average Confidence Score:** `{{avg_confidence_score}}/100`
-
-### Finding Summary
-| Severity | Count | Confirmed | Needs Review | Remediated |
-| :--- | :---: | :---: | :---: | :---: |
-| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
-| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
-| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
-| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
-
----
-
-## Root-Cause Clusters
-{{cluster_summary_table}}
-
----
-
-## Detailed Findings
-{{finding_cards_section}}
-
----
-
-## Governance & Safety Audit Statement
-This execution complied with TorusGuard v0.8.0 governance rules:
-- **Authorization Gate:** {{authorization_status}}
-- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
-- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
-
----
-
-## Prioritized Next Steps
-1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
-2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
-3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.
+# TorusGuard Security Audit & Runtime Verification Report
+
+> **TorusGuard Version:** `{{torusguard_version}}`  
+> **Target:** `{{target_name}}`  
+> **Run ID:** `{{run_id}}`  
+> **Timestamp:** `{{timestamp}}`  
+
+---
+
+## Detected Stack
+- **Language:** {{stack_language}}
+- **Framework:** {{stack_framework}}
+- **Data Layer:** {{stack_data_layer}}
+- **Dependency Files:** {{stack_dependency_files}}
+- **Detection Confidence:** {{stack_confidence}}
+
+---
+
+## Executive Posture
+**Posture:** {{posture_indicator}}  
+**Average Confidence Score:** `{{avg_confidence_score}}/100`
+
+### Finding Summary
+| Severity | Count | Confirmed | Needs Review | Remediated |
+| :--- | :---: | :---: | :---: | :---: |
+| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
+| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
+| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
+| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
+
+---
+
+## Root-Cause Clusters
+{{cluster_summary_table}}
+
+---
+
+## Detailed Findings
+{{finding_cards_section}}
+
+---
+
+## Governance & Safety Audit Statement
+This execution complied with TorusGuard v0.8.0 governance rules:
+- **Authorization Gate:** {{authorization_status}}
+- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
+- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
+
+---
+
+## Prioritized Next Steps
+1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
+2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
+3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.