torusguard 1.4.0 → 2.1.0

package/skills/torusguard/payload/templates/audit-report.template.md

@@ -1,54 +1,54 @@
-# TorusGuard Security Audit & Runtime Verification Report
-
-> **TorusGuard Version:** `{{torusguard_version}}`  
-> **Target:** `{{target_name}}`  
-> **Run ID:** `{{run_id}}`  
-> **Timestamp:** `{{timestamp}}`  
-
----
-
-## Detected Stack
-- **Language:** {{stack_language}}
-- **Framework:** {{stack_framework}}
-- **Data Layer:** {{stack_data_layer}}
-- **Dependency Files:** {{stack_dependency_files}}
-- **Detection Confidence:** {{stack_confidence}}
-
----
-
-## Executive Posture
-**Posture:** {{posture_indicator}}  
-**Average Confidence Score:** `{{avg_confidence_score}}/100`
-
-### Finding Summary
-| Severity | Count | Confirmed | Needs Review | Remediated |
-| :--- | :---: | :---: | :---: | :---: |
-| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
-| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
-| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
-| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
-
----
-
-## Root-Cause Clusters
-{{cluster_summary_table}}
-
----
-
-## Detailed Findings
-{{finding_cards_section}}
-
----
-
-## Governance & Safety Audit Statement
-This execution complied with TorusGuard v0.8.0 governance rules:
-- **Authorization Gate:** {{authorization_status}}
-- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
-- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
-
----
-
-## Prioritized Next Steps
-1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
-2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
-3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.
+# TorusGuard Security Audit & Runtime Verification Report
+
+> **TorusGuard Version:** `{{torusguard_version}}`  
+> **Target:** `{{target_name}}`  
+> **Run ID:** `{{run_id}}`  
+> **Timestamp:** `{{timestamp}}`  
+
+---
+
+## Detected Stack
+- **Language:** {{stack_language}}
+- **Framework:** {{stack_framework}}
+- **Data Layer:** {{stack_data_layer}}
+- **Dependency Files:** {{stack_dependency_files}}
+- **Detection Confidence:** {{stack_confidence}}
+
+---
+
+## Executive Posture
+**Posture:** {{posture_indicator}}  
+**Average Confidence Score:** `{{avg_confidence_score}}/100`
+
+### Finding Summary
+| Severity | Count | Confirmed | Needs Review | Remediated |
+| :--- | :---: | :---: | :---: | :---: |
+| 🔴 **Critical** | {{critical_count}} | {{critical_confirmed}} | {{critical_review}} | {{critical_fixed}} |
+| 🟠 **High** | {{high_count}} | {{high_confirmed}} | {{high_review}} | {{high_fixed}} |
+| 🟡 **Medium** | {{medium_count}} | {{medium_confirmed}} | {{medium_review}} | {{medium_fixed}} |
+| 🔵 **Low** | {{low_count}} | {{low_confirmed}} | {{low_review}} | {{low_fixed}} |
+
+---
+
+## Root-Cause Clusters
+{{cluster_summary_table}}
+
+---
+
+## Detailed Findings
+{{finding_cards_section}}
+
+---
+
+## Governance & Safety Audit Statement
+This execution complied with TorusGuard v0.8.0 governance rules:
+- **Authorization Gate:** {{authorization_status}}
+- **Patch Governance (Ponytail):** Additions $\le 35$, Deletions $\le 25$.
+- **Token Redaction:** All captured authorization headers, bearer tokens, and passwords were redacted.
+
+---
+
+## Prioritized Next Steps
+1. **Remediate Confirmed Sinks:** Run `/torusguard harden` to package remediation bundles.
+2. **Apply Governed Fixes:** Run `/torusguard apply <bundle_id>` to apply targeted fixes.
+3. **Verify Fixes:** Run `/torusguard recheck` to ensure no regressions exist.

package/skills/torusguard/payload/templates/authorization.template.md

@@ -1,34 +1,34 @@
-# TorusGuard Target Authorization Record
-
-**Authorization ID:** `{{authorization_id}}`  
-**Generated At:** `{{timestamp}}`  
-**Valid Until:** `{{valid_until}}`  
-
----
-
-## 1. Target Identification
-- **Project / Application:** `{{target_name}}`
-- **Target URL / Hosts:** `{{target_hosts}}`
-- **Scope Type:** `{{scope_type}}`
-
----
-
-## 2. Permitted Boundaries
-- **Allowed Path Prefixes:**
-{{allowed_path_prefixes_list}}
-
-- **Explicitly Forbidden / Excluded Paths:**
-{{forbidden_paths_list}}
-
-- **Max Navigation Depth:** `{{max_depth}}`
-- **Max Request Budget:** `{{max_requests}}`
-- **Allow State-Changing Methods:** `{{allow_state_changing_methods}}`
-
----
-
-## 3. Owner Confirmation & Legal Statement
-> [!IMPORTANT]
-> The target application owner has confirmed that this testing environment is authorized for non-destructive, bounded runtime security validation.
-
-- **Authorized By:** `{{authorized_by}}`
-- **Confirmation Status:** `Owner Confirmed`
+# TorusGuard Target Authorization Record
+
+**Authorization ID:** `{{authorization_id}}`  
+**Generated At:** `{{timestamp}}`  
+**Valid Until:** `{{valid_until}}`  
+
+---
+
+## 1. Target Identification
+- **Project / Application:** `{{target_name}}`
+- **Target URL / Hosts:** `{{target_hosts}}`
+- **Scope Type:** `{{scope_type}}`
+
+---
+
+## 2. Permitted Boundaries
+- **Allowed Path Prefixes:**
+{{allowed_path_prefixes_list}}
+
+- **Explicitly Forbidden / Excluded Paths:**
+{{forbidden_paths_list}}
+
+- **Max Navigation Depth:** `{{max_depth}}`
+- **Max Request Budget:** `{{max_requests}}`
+- **Allow State-Changing Methods:** `{{allow_state_changing_methods}}`
+
+---
+
+## 3. Owner Confirmation & Legal Statement
+> [!IMPORTANT]
+> The target application owner has confirmed that this testing environment is authorized for non-destructive, bounded runtime security validation.
+
+- **Authorized By:** `{{authorized_by}}`
+- **Confirmation Status:** `Owner Confirmed`

package/skills/torusguard/payload/templates/finding-card.template.md

@@ -1,32 +1,32 @@
-### [{{rule_id}}] {{finding_title}}
-
-**Severity:** `{{severity_badge}}` | **Auditable Confidence:** `{{confidence_score}}/100 {{confidence_band_badge}}`  
-**Finding ID:** `{{finding_id}}` | **Fingerprint:** `{{fingerprint_hash}}`  
-**Target Location:** `{{file_path}}:{{line_number}}` (`{{code_symbol}}`)  
-**Lifecycle Status:** `{{lifecycle_status}}` | **Exploitability:** `{{exploitability_status}}`  
-
----
-
-#### 1. Provenance Chain
-- **Detection Rule:** `{{rule_id}}` (CWE-{{cwe_id}})
-- **Triggering Input:** `{{triggering_source}}`
-- **Sink Path:** `{{sink_expression}}`
-
-#### 2. Raw Verified Evidence
-```{{code_language}}
-{{raw_evidence_snippet}}
-```
-> **Evidence Checksum (SHA-256):** `{{evidence_sha256}}`
-
-#### 3. Objective Facts vs AI Interpretation
-- **Verified Facts:** {{raw_facts_summary}}
-- **AI Risk Analysis:** {{ai_interpretation}}
-
-#### 4. Remediation Diff (Minimal Churn)
-```diff
-{{remediation_diff_preview}}
-```
-
-#### 5. Retest & Verification
-- **Verification Method:** {{verification_method}}
-- **Current Retest Status:** `{{retest_status}}`
+### [{{rule_id}}] {{finding_title}}
+
+**Severity:** `{{severity_badge}}` | **Auditable Confidence:** `{{confidence_score}}/100 {{confidence_band_badge}}`  
+**Finding ID:** `{{finding_id}}` | **Fingerprint:** `{{fingerprint_hash}}`  
+**Target Location:** `{{file_path}}:{{line_number}}` (`{{code_symbol}}`)  
+**Lifecycle Status:** `{{lifecycle_status}}` | **Exploitability:** `{{exploitability_status}}`  
+
+---
+
+#### 1. Provenance Chain
+- **Detection Rule:** `{{rule_id}}` (CWE-{{cwe_id}})
+- **Triggering Input:** `{{triggering_source}}`
+- **Sink Path:** `{{sink_expression}}`
+
+#### 2. Raw Verified Evidence
+```{{code_language}}
+{{raw_evidence_snippet}}
+```
+> **Evidence Checksum (SHA-256):** `{{evidence_sha256}}`
+
+#### 3. Objective Facts vs AI Interpretation
+- **Verified Facts:** {{raw_facts_summary}}
+- **AI Risk Analysis:** {{ai_interpretation}}
+
+#### 4. Remediation Diff (Minimal Churn)
+```diff
+{{remediation_diff_preview}}
+```
+
+#### 5. Retest & Verification
+- **Verification Method:** {{verification_method}}
+- **Current Retest Status:** `{{retest_status}}`

package/skills/torusguard/payload/templates/remediation-bundle.template.md

@@ -1,35 +1,35 @@
-# Remediation Bundle: `{{bundle_id}}`
-
-**Cluster ID:** `{{cluster_id}}`  
-**Target Rule:** `{{rule_id}}` (`{{rule_title}}`)  
-**Affected Files:** `{{affected_files}}`  
-
----
-
-## 1. Problem Statement & Risk
-{{problem_statement}}
-
-**Adversarial Abuse & Practical Impact:**  
-{{risk_explanation}}
-
----
-
-## 2. Governed Minimal Patch Plan
-- **Max Additions Boundary:** $\le 35$ lines (Proposed: `+{{additions_count}}`)
-- **Max Deletions Boundary:** $\le 25$ lines (Proposed: `-{{deletions_count}}`)
-- **Governance Review Level:** `{{governance_review_level}}`
-
-### Framework-Native Diff
-```diff
-{{candidate_patch_diff}}
-```
-
----
-
-## 3. Verification & Retest Method
-{{verification_method}}
-
----
-
-## 4. Residual Risk & Edge Cases
-{{residual_risk_notes}}
+# Remediation Bundle: `{{bundle_id}}`
+
+**Cluster ID:** `{{cluster_id}}`  
+**Target Rule:** `{{rule_id}}` (`{{rule_title}}`)  
+**Affected Files:** `{{affected_files}}`  
+
+---
+
+## 1. Problem Statement & Risk
+{{problem_statement}}
+
+**Adversarial Abuse & Practical Impact:**  
+{{risk_explanation}}
+
+---
+
+## 2. Governed Minimal Patch Plan
+- **Max Additions Boundary:** $\le 35$ lines (Proposed: `+{{additions_count}}`)
+- **Max Deletions Boundary:** $\le 25$ lines (Proposed: `-{{deletions_count}}`)
+- **Governance Review Level:** `{{governance_review_level}}`
+
+### Framework-Native Diff
+```diff
+{{candidate_patch_diff}}
+```
+
+---
+
+## 3. Verification & Retest Method
+{{verification_method}}
+
+---
+
+## 4. Residual Risk & Edge Cases
+{{residual_risk_notes}}

package/skills/torusguard/payload/workflows/ai-guard.md

@@ -0,0 +1,31 @@
+# /torusguard-ai-guard — AI Application & RAG Pipeline Guard
+
+$ARGUMENTS
+
+---
+
+## Objective
+Detect and remediate prompt injection, unsandboxed autonomous tool executions, and cross-tenant vector contamination across AI agent and RAG architectures.
+
+---
+
+## Tri-Mode Parity
+- **Mode A (Terminal CLI):** `torusguard ai-guard [target]`
+- **Mode B (AI Chat Slash Command):** `/torusguard ai-guard [target]`
+- **Mode C (Native MCP Tool):** `torusguard_ai_guard`
+
+---
+
+## Execution Steps
+
+1. **Discover LLM & Agent Call Sites:** Locate AI framework usage (OpenAI, Anthropic, LangChain, LlamaIndex, Vercel AI SDK).
+2. **Audit Prompt Templates:**
+   - Detect raw user string concatenation into system instructions (`TG-AGENT-001`).
+   - Flag raw document chunk ingestion in RAG without inert delimiters (`TG-RAG-002`).
+3. **Audit Tool Registry & Dispatchers:**
+   - Check for unsandboxed shell, file, or database tool calls lacking Human Gates (`TG-AGENT-002`).
+   - Enforce Zod/Pydantic schema validation on all tool argument payloads (`TG-AGENT-003`).
+4. **Audit Vector Store Queries:**
+   - Assert all similarity searches (`pgvector`, `pinecone`, `qdrant`, `chroma`) include tenant/user metadata filters (`TG-RAG-001`).
+   - Flag ingestion of unvalidated external document payloads (`TG-RAG-003`).
+5. **Formulate Patches & Synchronize:** Propose surgical fixes and record findings in `security_report.md`.

package/skills/torusguard/payload/workflows/apply.md

@@ -1,16 +1,14 @@
 ---
 description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
-tools: Read, Grep, Glob, Bash, Edit, Write
-version: 1.4.0
+tools: Read, Grep, Glob, Bash, Edit, Write, run_command
+version: 2.0.0
 agent: remediator
 lifecycle-phase: Phase 5 (Patch Application)
 required-skills:
   - torusguard-apply
 scripts-binding:
-  - .torusguard/scripts/apply_runner.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/diff_guard.py
+  - internal/apply/apply.go
+  - cmd/torusguard/main.go
 ---
 
 # /torusguard apply — Governed Patch Application & Rollback Snapshot
@@ -20,91 +18,62 @@ $ARGUMENTS
 ---
 
 ## Objective
-Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
+Safely apply approved remediation bundles to disk source files, creating an automated byte-for-byte pre-apply backup snapshot (`.bak`) in `.torusguard/snapshots/<run_id>/`, asserting syntax validity, and distilling passing patterns into Golden Fix Recipes.
 
-Supported CLI flags:
-- `npx torusguard apply [--target <dir>]` : Apply candidate patches with confirmation prompt
-- `npx torusguard apply --diff` : Preview unified diffs without modifying files on disk
-- `npx torusguard apply --selective` : Interactively review and approve patches one by one
-- `npx torusguard apply --verify` : Trigger immediate differential AST recheck post-apply
-- `npx torusguard apply --list-snapshots` : List available historical pre-apply backup snapshots
-- `npx torusguard apply --yes` / `-y` : Non-interactive auto-approval mode
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard apply candidate.patch [--yes]` | Shell execution of patch applier with snapshot creation. |
+| **Mode B: AI Chat Slash** | `/torusguard apply` | Guided conversational application with explicit Human Gate approval. |
+| **Mode C: Native MCP Tool** | Autonomous Agent Flow | Formulates patch with `torusguard_harden`, awaits Human Gate, invokes CLI. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect bundle validity and file safety before modifying disk code:
-1. **Bundle Verification:** Assert `patch.diff` exists in active run's remediation folder.
-2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.bak` or `.torusguard/snapshots/<run_id>/`) prior to editing.
+1. **Bundle Verification:** Assert `candidate.patch` or semantic `patch.json` exists.
+2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.torusguard/snapshots/<run_id>/<rel_path>.bak`) prior to editing.
 3. **Uncommitted Changes:** Check git status; ensure target file has clean baseline.
 4. **Ponytail Check:** Re-verify that patch additions $\le 35$ and deletions $\le 25$.
 5. **Human Gate:** Confirm operator approval before committing edits to disk.
-6. **Workspace Cleanliness:** Verify git working tree has no uncommitted merge conflicts.
-7. **Execution Privilege:** Verify write access to targeted file locations.
-
----
-
-## When to Use /torusguard apply
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Applying an approved remediation patch to disk | Run `/torusguard apply` |
-| Generating patch diff without modifying disk | Run `/torusguard harden` |
-| Verifying that patch eliminated flaw without regression | Run `/torusguard recheck` |
-| Reverting an applied patch | Restore from `.bak` snapshot |
-| Checking workspace status | Run `/torusguard status` |
 
 ---
 
 ## Living Report Invariant
 - Applied patches create pre-apply `.bak` snapshots in `.torusguard/snapshots/<run_id>/`.
 - Finding statuses transition in `security_report.md` to `APPLIED 🔵`.
-- Instant rollback available via `npx torusguard rollback`.
-
-## Execution Steps
-
-1. **Load Remediation Bundle:** Read `patch.diff` and metadata from active run directory.
-2. **Audit Patch Invariants:** Run `python .torusguard/scripts/diff_guard.py <patch.diff>`.
-3. **Create Rollback Backup:** Copy target file to `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<filename>.bak`.
-4. **Apply Minimal Diff:** Execute precise surgical edit using `replace_file_content` or `patch`.
-5. **Assert Syntax & Integrity:** Check that modified file compiles cleanly without syntax errors.
-6. **Log Application Ledger:** Record timestamp, original SHA-256, and patched SHA-256 in `apply-log.json`.
+- Instant rollback available via `torusguard rollback`.
 
 ---
 
-## Failure Recovery
-
-- **Syntax Error After Patch:** Instantly revert target file from `.bak` backup snapshot.
-- **Merge / Context Conflict:** Re-run `/torusguard harden` to regenerate diff against latest disk lines.
-- **Missing Backup File:** Do not apply patch if backup copy cannot be written.
-- **Halt Trigger:** Abort if git working tree is dirty on conflicting lines.
-
----
-
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never apply code changes without creating an exact pre-apply rollback backup first.
-- ❌ Never touch files not explicitly listed in the approved `patch.diff`.
-- ✅ Always verify syntax compilation immediately after modifying source files.
+1. **Load Remediation Bundle:** Read `candidate.patch` or `patch.json`.
+2. **Obtain Human Gate:** Confirm user approval to modify target source file.
+3. **Create Rollback Backup:** Capture `.bak` in `.torusguard/snapshots/<run_id>/`.
+4. **Apply Surgical Edit:** Run `torusguard apply <patch> --yes` or apply semantic reflection.
+5. **Assert Syntax & Integrity:** Check that modified file compiles cleanly (`go test ./...`, syntax lint).
+6. **Recommend Recheck:** Run `torusguard recheck` or `/torusguard recheck`.
 
 ---
 
 ## Output Card Format
 
 ```markdown
-### 🚀 TorusGuard Patch Application
-- **Finding Addressed:** `TG-XXX-HASH`
-- **File Patched:** `src/path/to/file.py`
-- **Rollback Backup:** `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<file>.bak`
-- **Churn Applied:** +[Additions] / -[Deletions] lines
-- **Syntax Check:** PASSED (clean compile)
-- **Status:** APPLIED — run `/torusguard recheck` to verify fix
+### 🚀 TorusGuard Patch Applied Successfully
+- **Target File:** `src/path/to/file`
+- **Backup Snapshot:** `.torusguard/snapshots/<run_id>/<file>.bak`
+- **Rollback Command:** `torusguard rollback`
+- **Next Step:** Run `/torusguard recheck` to verify closure
 ```
 
 ---
 
 ## Next Steps
 
-1. Run `/torusguard recheck` to perform differential audit on the modified file.
-2. Run test suites to verify that business logic and regressions remain intact.
+1. Run `/torusguard recheck` or `torusguard recheck` to verify closure and zero regressions.
+2. If unexpected behavior occurs, run `torusguard rollback`.

package/skills/torusguard/payload/workflows/audit.md

@@ -1,16 +1,15 @@
 ---
 description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.4.0
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: auditor
 lifecycle-phase: Phase 2 (Static Audit & Clustering)
 required-skills:
   - torusguard-audit
 scripts-binding:
-  - .torusguard/scripts/audit_runner.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/finding_scorer.py
+  - internal/scanner/scanner.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard audit — Static Security Code Scan & Clustering
@@ -20,36 +19,27 @@ $ARGUMENTS
 ---
 
 ## Objective
-Static security AST scanning, stable fingerprinting, root-cause clustering, throughput telemetry, and 0-100 scoring.
+Execute static AST analysis across polyglot project files, evaluate code against 74 canonical security rules across 18 families, assign stable line-shift invariant fingerprints, cluster architectural root causes, synchronize findings with `security_report.md`, and score findings with auditable 0–100 confidence ratings.
 
-Supported CLI flags:
-- `npx torusguard audit [--target <dir>]` : Specify project root directory
-- `npx torusguard audit --watch` / `-w` : Continuous watch mode, re-scanning on file change
-- `npx torusguard audit --sarif` : Automatically export OASIS SARIF v2.1.0 log
-- `npx torusguard audit --severity <critical|high|medium|low>` : Floor filter for findings
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard audit [--include-tests] [--json]` | Shell execution of compiled Go binary. |
+| **Mode B: AI Chat Slash** | `/torusguard audit` | Conversational guided audit with bounded context inspection. |
+| **Mode C: Native MCP Tool** | `torusguard_audit` | Autonomous agent tool invocation via stdio JSON-RPC. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect workspace prerequisites before launching static audit:
-1. **Init State (`torusguard.json`):** Assert repository is initialized.
+1. **Init State (`torusguard.json`):** Assert repository is initialized or run `torusguard init`.
 2. **Active Rules (`rules/active/`):** Confirm rule definitions exist.
 3. **Exclusions:** Assert `node_modules/`, `.venv/`, `dist/`, `.git/` are skipped.
-4. **Run Folder:** Allocate isolated folder in `.torusguard/runs/`.
-5. **Syntax Check:** Check for syntax errors before parsing ASTs.
-
----
-
-## When to Use /torusguard audit
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| First-time scan of repository or new branch | Run `/torusguard audit` |
-| Pre-commit review and PR security checks | Run `/torusguard audit` |
-| Uninitialized project | Run `/torusguard init` first |
-| Live endpoint or runtime probing | Run `/torusguard web-validate` |
-| Differential check after patch | Run `/torusguard recheck` |
+4. **Syntax Check:** Check for syntax errors before parsing ASTs.
 
 ---
 
@@ -57,31 +47,18 @@ Inspect workspace prerequisites before launching static audit:
 - Audit discoveries automatically synchronize to `security_report.md` at workspace root.
 - Findings transition into `OPEN 🔴` status with stable invariant fingerprints.
 
-## Execution Steps
-
-1. **Allocate Run Folder:** Run `python .torusguard/scripts/run_manager.py create audit`.
-2. **Scan Codebase ASTs:** Match active rules against source trees.
-3. **Compute Stable Fingerprints:** Hash AST context to produce stable IDs.
-4. **Cluster Root Causes:** Group findings sharing identical sinks.
-5. **Score Confidence (0–100):** Run `python .torusguard/scripts/finding_scorer.py --run <run_dir>`.
-6. **Emit Artifacts:** Write `findings.md`, `findings.json`, and `summary.md`.
-
 ---
 
-## Failure Recovery
-
-- **Zero Rules Active:** Re-run `/torusguard init` to activate rules.
-- **AST Parse Error:** Log syntax error on malformed file, skip, and continue.
-- **Scorer Failure:** Ensure Python 3.10+; verify finding JSON structure.
-- **Halt Trigger:** Abort if run folder cannot be allocated or disk write fails.
-
----
-
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never invent finding IDs without AST line hashing.
-- ❌ Never flag test fixtures as critical security flaws.
-- ✅ Always calculate scores using `.torusguard/scripts/finding_scorer.py`.
+1. **Launch Audit Scan:**
+   - **Mode A (CLI):** Run `torusguard audit` in terminal.
+   - **Mode B (Chat):** Parse AST sinks using `grep_search` and bounded `ExtractContext`.
+   - **Mode C (MCP):** Call `torusguard_audit` with `{"target": "."}`.
+2. **Scan Codebase ASTs:** Match 74 canonical rules across 18 families against source trees.
+3. **Compute Stable Fingerprints:** Hash AST context to produce stable line-shift invariant IDs.
+4. **Cluster Root Causes:** Group findings sharing identical sinks or causal architecture.
+5. **Synchronize Ground Truth:** Update `security_report.md` at workspace root.
 
 ---
 
@@ -89,12 +66,11 @@ Inspect workspace prerequisites before launching static audit:
 
 ```markdown
 ### 🔎 TorusGuard Static Audit Results
-- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
 - **Files Scanned:** [Count] source files
 - **Total Findings:** [Count] ([Critical] Critical, [High] High)
 - **Root Cause Clusters:** [Count] architectural issues
 - **Confidence:** [Score]/100
-- **Artifact:** `.torusguard/runs/<run_id>/findings.md`
+- **Living Report:** `security_report.md`
 ```
 
 ---