torusguard 1.4.0 → 2.1.0

package/skills/torusguard/payload/workflows/ocr-scan.md

@@ -0,0 +1,25 @@
+# /torusguard-ocr-scan — Multi-Modal OCR Secret Scanning
+
+$ARGUMENTS
+
+---
+
+## Objective
+Detect optical leaks of private API keys, AWS credentials, database URIs, GitHub personal access tokens, and private certificates embedded inside visual artifacts (`.png`, `.jpg`, `.jpeg`, `.webp`, `.bmp`, `.tiff`) up to 10MB using Tesseract OCR and deterministic regex signatures.
+
+---
+
+## Tri-Mode Parity
+- **Mode A (Terminal CLI):** `torusguard ocr-scan <target>`
+- **Mode B (AI Chat Slash Command):** `/torusguard ocr-scan <target>`
+- **Mode C (Native MCP Tool):** `torusguard_ocr_scan`
+
+---
+
+## Execution Steps
+
+1. **Verify Target:** Check target image or directory exists on disk.
+2. **Inspect File Size:** Reject images exceeding 10MB (`DefaultMaxImageSize`) to preserve DoS resilience.
+3. **Execute OCR Extraction:** Run Tesseract optical text analysis via Go scanner or MCP tool.
+4. **Pattern Match Secrets:** Evaluate optical text against `TG-SEC-001` through `TG-SEC-007` signatures.
+5. **Redact & Report:** Emit sanitized finding cards and synchronize into `security_report.md`.

package/skills/torusguard/payload/workflows/recheck.md

@@ -1,16 +1,15 @@
 ---
 description: Targeted differential AST re-scan, fix closure verification, and regression state machine transitions.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: Phase 6 (Targeted Recheck & Verification)
 required-skills:
   - torusguard-recheck
 scripts-binding:
-  - .torusguard/scripts/recheck_runner.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/finding_scorer.py
+  - internal/recheck/recheck.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard recheck — Targeted Differential Recheck & Regression Audit
@@ -20,31 +19,28 @@ $ARGUMENTS
 ---
 
 ## Objective
-Targeted differential AST re-scan, fix closure verification, and regression state transitions.
+Targeted differential AST re-scan, fix closure verification, and regression state machine transitions across modified files.
+
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard recheck` | Terminal execution of differential AST scanner. |
+| **Mode B: AI Chat Slash** | `/torusguard recheck` | Conversational differential review and regression verification. |
+| **Mode C: Native MCP Tool** | `torusguard_recheck` | Agent tool call with `{"target": "."}` returning diff assertions. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect applied patch history and target file scope before re-checking:
-1. **Applied Patch Record:** Verify `apply-log.json` or modified file list exists in the active run.
+1. **Applied Patch Record:** Inspect git status or diff for modified files.
 2. **Scope Limitation:** Restrict differential scan strictly to modified files to conserve token budget.
-3. **Rollback Availability:** Confirm `.bak` snapshot exists in `pre_apply/` in case regression is detected.
+3. **Rollback Availability:** Confirm `.bak` snapshot exists in `.torusguard/snapshots/` in case regression is detected.
 4. **4-State Transition Engine:** Prepare to transition findings to `Fixed`, `Partially Fixed`, `Not Fixed`, or `Regression`.
 5. **Fresh Syntax Validation:** Ensure no compiler or syntax errors exist before re-evaluating rules.
-6. **AST Consistency:** Ensure imported dependencies on modified lines resolve correctly.
-
----
-
-## When to Use /torusguard recheck
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Immediately after applying a remediation patch | Run `/torusguard recheck` |
-| Verifying that a specific finding is eliminated | Run `/torusguard recheck` |
-| Checking whether a patch introduced new security flaws | Run `/torusguard recheck` |
-| Whole repository baseline audit | Run `/torusguard audit` |
-| Generating final signed release report | Run `/torusguard report` |
 
 ---
 
@@ -52,32 +48,19 @@ Inspect applied patch history and target file scope before re-checking:
 - Verified fix closures transition findings in `security_report.md` to `RESOLVED 🟢`.
 - Regressions transition findings to `REGRESSED ❌`.
 
-## Execution Steps
-
-1. **Identify Modified Files:** Extract list of altered files from latest apply step.
-2. **Execute Differential AST Scan:** Re-run active security rules exclusively against modified files.
-3. **Evaluate Finding Status:**
-   - If original vulnerable AST pattern is absent and no new sink appears: transition to `Fixed`.
-   - If new security rule triggers on altered lines: classify as `Regression`.
-4. **Update Finding State:** Record verified resolution status into `findings.json`.
-5. **Emit Recheck Report:** Write `recheck-report.md` into the active run folder.
-
----
-
-## Failure Recovery
-
-- **Finding Still Present (`Not Fixed`):** Review patch diff; the remediation did not neutralize the AST sink.
-- **New Vulnerability Detected (`Regression`):** Alert operator; prompt to revert from `.bak` snapshot.
-- **File Not Found:** Verify file path matches git repository layout.
-- **Halt Trigger:** Abort if diff shows changes outside approved patch scope.
-
 ---
 
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never mark a finding as `Fixed` without re-scanning the actual AST of the patched file.
-- ❌ Never ignore new warnings introduced in modified lines.
-- ✅ Always provide before/after line comparisons confirming sink removal.
+1. **Trigger Recheck:**
+   - **Mode A (CLI):** Run `torusguard recheck`.
+   - **Mode B (Chat):** Review modified files and re-scan AST sinks.
+   - **Mode C (MCP):** Call `torusguard_recheck`.
+2. **Evaluate Finding Status:**
+   - If original vulnerable pattern is absent and no new sink appears: transition to `✔ [Confirmed Fixed]`.
+   - If new security rule triggers on altered lines: classify as `✖ [Regressed]`.
+3. **Update Finding State:** Update `security_report.md`.
+4. **Recommend Posture Report:** Advise running `torusguard report --html`.
 
 ---
 
@@ -89,7 +72,6 @@ Inspect applied patch history and target file scope before re-checking:
 - **Target Finding:** `TG-XXX-HASH`
 - **Result:** [FIXED / REGRESSION / PARTIAL]
 - **Regressions Introduced:** 0
-- **Report:** `.torusguard/runs/<run_id>/recheck-report.md`
 - **Status:** VERIFIED — ready for `/torusguard report`
 ```
 

package/skills/torusguard/payload/workflows/redos.md

@@ -0,0 +1,27 @@
+# /torusguard-redos — Regular Expression Complexity Scanner
+
+$ARGUMENTS
+
+---
+
+## Objective
+Detect and remediate catastrophic exponential ($O(2^n)$) and polynomial backtracking regular expressions in web applications to prevent availability and thread starvation DoS attacks.
+
+---
+
+## Tri-Mode Parity
+- **Mode A (Terminal CLI):** `torusguard redos [target]`
+- **Mode B (AI Chat Slash Command):** `/torusguard redos [target]`
+- **Mode C (Native MCP Tool):** `torusguard_redos`
+
+---
+
+## Execution Steps
+
+1. **Locate Regex Definitions:** Walk source tree to find regex literals and constructor calls (`RegExp`, `re.compile`, `regexp.MustCompile`).
+2. **Analyze Backtracking Complexity:**
+   - Detect nested quantifiers (`(x+)+`, `(x*)*`) causing $O(2^n)$ exponential blowup (`TG-REDOS-001`).
+   - Detect overlapping alternations with outer repetition causing polynomial blowup (`TG-REDOS-002`).
+3. **Audit Input Length Guardrails:** Check if untrusted inputs evaluated against regexes are bounded in character length.
+4. **Formulate Safe Remediation:** Refactor vulnerable regexes into linear deterministic expressions, anchor tokens, or parser logic.
+5. **Synchronize Report:** Log all ReDoS findings in `security_report.md`.

package/skills/torusguard/payload/workflows/report.md

@@ -1,105 +1,82 @@
 ---
-description: Executive posture reporting, interactive HTML dashboard generation, directory attack surface heatmap, and OASIS SARIF v2.1.0 structured export.
-tools: Read, Grep, Glob, Bash, Write
-version: 2.2.0
+description: Executive posture reporting, cluster analysis, signed compliance audit, and OASIS SARIF v2.1.0 structured export.
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: Phase 7 (Reporting & SARIF Export)
 required-skills:
   - torusguard-report
 scripts-binding:
-  - .torusguard/scripts/html_reporter.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/sarif_exporter.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/term_ui.py
+  - internal/report/html.go
+  - internal/report/sarif.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
-# /torusguard report — Unified Security Posture Report & SARIF / HTML Export
+# /torusguard report — Unified Security Posture Report & SARIF Export
 
 $ARGUMENTS
 
 ---
 
 ## Objective
-Generate an executive security posture report, interactive dark-mode HTML dashboard (`report.html`), and schema-compliant OASIS SARIF v2.1.0 log (`results.sarif`) with zero network dependencies.
+Executive posture reporting, cluster analysis, signed compliance audit, and OASIS SARIF v2.1.0 export.
 
 ---
 
-## Dual Mode Execution Syntax
+## Tri-Mode Execution
 
-| Target Artifact | Mode A: Terminal CLI | Mode B: AI Chat Slash Command | Output Location |
-| :--- | :--- | :--- | :--- |
-| **Interactive HTML Dashboard** | `npx torusguard report --html` | `/torusguard report --html` or `/torusguard-report` | `report.html` (workspace root) + `.torusguard/runs/report-latest.html` |
-| **OASIS SARIF v2.1.0 Log** | `npx torusguard report --sarif` | `/torusguard report --sarif` | `.torusguard/runs/results-latest.sarif` |
-| **Combined (Both)** | `npx torusguard report --html --sarif` | `/torusguard report --html --sarif` | Both `report.html` and `results-latest.sarif` in a single pass |
-| **Custom Path** | `npx torusguard report --html --out <path>` | `/torusguard report --out <path>` | Specified path + latest run mirror |
-| **Monorepo Subproject** | `npx torusguard report --target <dir> --html` | `/torusguard report --target <dir>` | `<dir>/report.html` |
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard report --html [--sarif]` | Shell compilation of HTML dashboard and SARIF log. |
+| **Mode B: AI Chat Slash** | `/torusguard report` | Executive summary generation and posture calculation. |
+| **Mode C: Native MCP Tool** | `torusguard://security_report` | Agent reads resource payload directly from living report. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect run records and reporting parameters before generating release artifacts:
-1. **Active Run Records:** Ensure target run folder or `.torusguard/runs/` contains valid run records.
-2. **Dual-Ledger Ground Truth:** Confirm that `security_report.md` at workspace root is in lockstep with findings.
-3. **SARIF v2.1.0 Schema:** Validate output structure against official OASIS SARIF standard (`sarif-schema-2.1.0.json`).
-4. **Multi-Analysis Category:** Tag static findings under category `torusguard/static` to prevent CI collisions.
-5. **Zero External CDN:** Ensure all icons, gauges, and scripts in `report.html` are 100% self-contained and offline-ready.
-6. **Secret Masking:** Ensure zero unredacted authorization tokens or API keys appear in report text.
+1. **Living Report State:** Ensure `security_report.md` exists and reflects latest findings.
+2. **SARIF v2.1.0 Schema:** Validate output structure against official OASIS SARIF standard.
+3. **Multi-Analysis Category:** Tag static findings under category `torusguard/static` to prevent CI collision.
+4. **Secret Masking:** Ensure zero unredacted authorization tokens or API keys appear in report.
+5. **Zero-CDN Guarantee:** Ensure HTML report contains zero external CDN script dependencies.
 
 ---
 
-## Interactive Dashboard Features (v2.2.0)
-
-When viewing `report.html` in any browser:
-1. **Safe Defenses vs Harmed Exposure:** Complete Defended Invariants inventory across all 74 rules in 18 architectural families. Clean codebases earn 100/100 (74 Defended, 0 Harmed).
-2. **Directory Attack Surface Heatmap:** Visual directory tree of exposure risk. Clicking any directory card filters the findings table to that specific folder.
-3. **Golden Recipe Explorer:** Distilled, verified fix patterns with before/after code templates and one-click clipboard copying.
-4. **Prescriptive Next Best Defenses:** Stack-aware security recommendations with copyable `npx torusguard harden` commands.
-5. **Client-Side Exporters:** Zero-network buttons to download OASIS SARIF v2.1.0 and CSV records directly from browser memory.
-6. **Multi-Agent AI Prompt Presets:** One-click prompts tailored for Cursor (`.cursorrules`), Claude Code (`CLAUDE.md`), Antigravity, and GitHub Copilot.
-7. **Print & PDF Styling:** Built-in high-contrast `@media print` layout for boardroom and compliance distribution.
+## Living Report Invariant
+- Executive posture reports incorporate health scoring and metrics from `security_report.md`.
+- Emits visual dark-mode HTML (`--html`) and OASIS SARIF v2.1.0 (`--sarif`).
 
 ---
 
 ## Execution Steps
 
-1. **Detect Mode & Arguments:**
-   - Parse `--html`, `--sarif`, `--out`, `--target`, and `--run` from `$ARGUMENTS`.
-   - If no format flag is specified in chat, default to generating the visual HTML dashboard (`report.html`).
-2. **Execute Reporter Scripts:**
-   - **For SARIF:**
-     ```bash
-     python .torusguard/scripts/sarif_exporter.py [--output <path>] [--root <target>]
-     ```
-   - **For HTML:**
-     ```bash
-     python .torusguard/scripts/html_reporter.py [--out <path>] [--root <target>]
-     ```
-3. **Synchronize Dual Ledger:**
-   - Verify `security_report.md` matches `report.html` findings and posture score.
-4. **Emit 75-Column Visual Summary Card:**
-   - Present markdown output card with direct clickable links to both `report.html` and `security_report.md`.
+1. **Trigger Report Generation:**
+   - **Mode A (CLI):** Run `torusguard report --html --sarif`.
+   - **Mode B (Chat):** Calculate posture score from `security_report.md` and present summary card.
+   - **Mode C (MCP):** Query resource `torusguard://security_report`.
+2. **Compile Visual HTML:** Generate zero-dependency dark-mode HTML dashboard at `report.html`.
+3. **Export SARIF v2.1.0:** Produce schema-compliant SARIF log for CI/CD pipelines.
+4. **Sign Off Ledger:** Confirm artifacts are persisted to disk.
 
 ---
 
 ## Output Card Format
 
 ```markdown
-### 🛡️ TorusGuard Security Posture Report Emitted
-- **Posture Score:** [Score]/100 ([Status Label])
-- **Invariants Defended:** [N] Defended · [M] Harmed (74 Rules)
-- **Living Ledger:** [security_report.md](file:///path/to/security_report.md)
-- **HTML Dashboard:** [report.html](file:///path/to/report.html)
-- **SARIF v2.1.0 Export:** [results-latest.sarif](file:///path/to/results-latest.sarif)
-- **Status:** COMPLETE — dual-ledger synchronized
+### 📊 TorusGuard Security Posture Report
+- **Posture Score:** 100/100 (OPTIMAL DEFENSE)
+- **Total Invariants:** 74 Defended across 18 families
+- **HTML Dashboard:** `report.html`
+- **SARIF v2.1.0 Export:** `results.sarif`
+- **Living Ledger:** `security_report.md`
 ```
 
 ---
 
-## Failure Recovery
+## Next Steps
 
-- **Missing Run Folder:** Auto-discover the latest timestamped run in `.torusguard/runs/`.
-- **Windows File Lock:** `html_reporter.py` uses atomic temporary write swapping with exponential retry.
-- **Missing SARIF Input:** Auto-discovers findings from the latest audit run in `.torusguard/runs/`.
-- **Clean Workspace:** Emits 100/100 posture score with all 74 defended invariants listed.
+1. Upload `results.sarif` to GitHub Code Scanning via `.github/workflows/`.
+2. Open `report.html` in browser for visual audit presentation.

package/skills/torusguard/payload/workflows/status.md

@@ -1,14 +1,15 @@
 ---
 description: Read-only diagnostic overview of workspace security posture, active configuration, rules catalog, and run history.
-tools: Read, Grep, Glob, Bash
-version: 1.4.0
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: System / Diagnostics
 required-skills:
   - torusguard-status
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
+  - internal/workspace/workspace.go
 ---
 
 # /torusguard status — Workspace Security Posture & Diagnostic Overview
@@ -18,33 +19,27 @@ $ARGUMENTS
 ---
 
 ## Objective
-Read-only diagnostic overview of workspace security posture, active configuration, and run history.
-
-Supported CLI flags:
-- `npx torusguard status [--target <dir>]` : Diagnostic check on specified project directory
+Read-only diagnostic overview of workspace security posture, active configuration, and run history across 74 canonical security rules and 18 families.
 
 ---
 
-## Mandatory Pre-Flight Context Inspection
+## Tri-Mode Execution
 
-Inspect workspace state and configuration records prior to status display:
-1. **Config State (`.torusguard/config/torusguard.json`):** Confirm workspace initialization and read detected stack.
-2. **Active Rules Directory (`.torusguard/rules/active/`):** Count active rule files.
-3. **Run Folder Ledger (`.torusguard/runs/`):** Check run history and locate latest `manifest.json`.
-4. **Scope Record (`.torusguard/config/scope.json`):** Check whether runtime authorization TTL is active or expired.
-5. **Read-Only Invariant:** Ensure command performs zero file modifications or disk mutations.
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard status [--json]` | Terminal execution of 75-column diagnostic cards. |
+| **Mode B: AI Chat Slash** | `/torusguard status` | Conversational diagnostic inspection of active config and ledger. |
+| **Mode C: Native MCP Tool** | `torusguard_status` | Agent tool call with `{"target": "."}` returning posture JSON/string. |
 
 ---
 
-## When to Use /torusguard status
+## Mandatory Pre-Flight Context Inspection
 
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Checking workspace configuration and active security posture | Run `/torusguard status` |
-| Reviewing recent audit runs and finding counts | Run `/torusguard status` |
-| Checking active legal scope authorization TTL | Run `/torusguard status` |
-| Initializing workspace for the first time | Run `/torusguard init` |
-| Executing full security scan | Run `/torusguard audit` |
+Inspect workspace state and configuration records prior to status display:
+1. **Config State (`.torusguard/config/torusguard.json`):** Confirm workspace initialization and read detected stack.
+2. **Active Rules Directory (`.torusguard/rules/active/`):** Count active rule files (74 canonical rules).
+3. **Living Report (`security_report.md`):** Read current open vs resolved findings.
+4. **Read-Only Invariant:** Ensure command performs zero file modifications or disk mutations.
 
 ---
 
@@ -52,33 +47,16 @@ Inspect workspace state and configuration records prior to status display:
 - Reads current health score and status breakdown directly from `security_report.md`.
 - Displays 18 rule families and 74 rules in standardized 75-column terminal cards.
 
-## Execution Steps
-
-1. **Read Configuration:** Load `.torusguard/config/torusguard.json`; extract stack, version, and enabled rule count.
-2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-3. **Inspect Run History:**
-   ```bash
-   python .torusguard/scripts/run_manager.py list
-   ```
-4. **Evaluate Scope Expiry:** Parse `.torusguard/config/scope.json`; report if TTL is valid or expired.
-5. **Print Status Overview:** Render complete workspace diagnostic overview card.
-
 ---
 
-## Failure Recovery
-
-- **Uninitialized Workspace:** If config is missing, prompt user to execute `/torusguard init`.
-- **Zero Runs Found:** Display clean status card noting no historical audit runs exist yet.
-- **Corrupt Config File:** Report parsing error and recommend re-running `/torusguard init`.
-- **Halt Trigger:** Abort command if read access to `.torusguard/` is denied.
-
----
-
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never display fabricated finding counts not substantiated by run manifests.
-- ❌ Never execute modifying shell commands or edit source code during status inspection.
-- ✅ Always report factual file counts from `.torusguard/rules/active/` and `.torusguard/runs/`.
+1. **Trigger Status Check:**
+   - **Mode A (CLI):** Run `torusguard status`.
+   - **Mode B (Chat):** Read `torusguard.json` and `security_report.md`.
+   - **Mode C (MCP):** Call `torusguard_status`.
+2. **Evaluate Posture:** Report detected stack, active invariants, and living findings ledger.
+3. **Recommend Next Actions:** Direct user to audit or remediation as needed.
 
 ---
 
@@ -86,13 +64,11 @@ Inspect workspace state and configuration records prior to status display:
 
 ```markdown
 ### 🛡️ TorusGuard Workspace Status
-- **Version:** v0.9.2
-- **Framework Detected:** [Stack or None]
-- **Active Rules:** [Count] rules active in `.torusguard/rules/active/`
-- **Total Runs:** [Count] historical runs recorded
-- **Latest Run:** `run-YYYYMMDD-HHMMSS` ([Findings Count] findings)
-- **Scope Status:** [Authorized (TTL Active) / Expired / Unconfigured]
-- **Health Posture:** [GOOD / ACTION NEEDED]
+- **Version:** v2.0.0
+- **Framework Detected:** [Stack]
+- **Active Rules:** 74 canonical rules active across 18 families
+- **Living Report:** `security_report.md`
+- **Health Posture:** [OPTIMAL DEFENSE / ACTION NEEDED]
 ```
 
 ---
@@ -100,4 +76,4 @@ Inspect workspace state and configuration records prior to status display:
 ## Next Steps
 
 1. Run `/torusguard audit` to scan codebase for security vulnerabilities.
-2. Run `/torusguard authorize` to configure or refresh live target scope.
+2. Run `/torusguard report --html` to view interactive dashboard.

package/skills/torusguard/payload/workflows/verify.md

@@ -1,14 +1,15 @@
 ---
 description: Evidence sufficiency verification, live disk line match audit, and finding score refinement.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: validator
 lifecycle-phase: Phase 3a (Evidence Verification)
 required-skills:
   - torusguard-verify
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/finding_scorer.py
+  - internal/validate/validate.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard verify — Evidence Verification & Score Refinement
@@ -22,26 +23,22 @@ Evidence sufficiency verification, live disk line match audit, and finding score
 
 ---
 
-## Mandatory Pre-Flight Context Inspection
+## Tri-Mode Execution
 
-Inspect finding records and evidence integrity before verification:
-1. **Latest Run Records (`.torusguard/runs/`):** Locate most recent audit run directory.
-2. **Finding Files:** Confirm `findings.md` or `findings.json` exists in the target run folder.
-3. **Live File Drift:** Assert cited source files have not been edited or relocated on disk.
-4. **Scoring Model Calibration:** Ensure `finding_scorer.py` evaluates all 5 rubric dimensions.
-5. **Role Boundary:** Enforce validator role; do not apply code modifications during verification.
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard verify` | Terminal audit of living security report and evidence presence. |
+| **Mode B: AI Chat Slash** | `/torusguard verify` | Live code line inspection, taint flow audit, and false-positive filtering. |
+| **Mode C: Native MCP Tool** | `torusguard_verify` | Agent tool call with `{"target": "."}` returning line audit proofs. |
 
 ---
 
-## When to Use /torusguard verify
+## Mandatory Pre-Flight Context Inspection
 
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Auditing whether static findings are valid code flaws | Run `/torusguard verify` |
-| Upgrading Medium confidence finding to Confirmed | Run `/torusguard verify` |
-| No audit run executed yet | Run `/torusguard audit` first |
-| Running live network requests against endpoints | Run `/torusguard web-validate` |
-| Generating patch after verification | Run `/torusguard harden` |
+Inspect finding records and evidence integrity before verification:
+1. **Living Report (`security_report.md`):** Confirm report exists at workspace root.
+2. **Live File Drift:** Assert cited source files have not been edited or relocated on disk.
+3. **Role Boundary:** Enforce validator role; do not apply code modifications during verification.
 
 ---
 
@@ -49,34 +46,18 @@ Inspect finding records and evidence integrity before verification:
 - Confirmed evidence sufficiency transitions findings in `security_report.md` to `VERIFIED 🟠`.
 - False positives transition to `FALSE POSITIVE ⚪`.
 
+---
+
 ## Execution Steps
 
-1. **Locate Target Findings:** Load active findings from latest run directory.
+1. **Trigger Verification:**
+   - **Mode A (CLI):** Run `torusguard verify`.
+   - **Mode B (Chat):** Read cited lines via `view_file` and verify source-to-sink flow.
+   - **Mode C (MCP):** Call `torusguard_verify`.
 2. **Live Disk Line Match:** Read current code at cited line ranges; verify AST snippet matches.
 3. **Audit Evidence Sufficiency:** Assess whether taint path is unbroken and caller context is exposed.
-4. **Refine Confidence Scores:**
-   ```bash
-   python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
-   ```
-5. **Classify Status:** Assign verified state (`Confirmed`, `Plausible`, or `False Positive / Disputed`).
-6. **Emit Verification Ledger:** Write `verified-evidence.md` into the active run folder.
-
----
-
-## Failure Recovery
-
-- **Missing Run Folder:** Run `/torusguard audit` first to produce a valid run baseline.
-- **Line Drift Detected:** Flag line mismatch; scan nearby lines (±25) for relocated AST sink.
-- **Malformed Finding JSON:** Repair JSON structure using finding schema before scoring.
-- **Halt Trigger:** Abort if cited files are completely deleted from disk.
-
----
-
-## Hallucination Guard
-
-- ❌ Never confirm a finding if the cited sink has already been sanitized by middleware.
-- ❌ Never bump confidence score without documenting unbroken taint source-to-sink flow.
-- ✅ Always anchor line matches to live disk reads using `view_file`.
+4. **Classify Status:** Assign verified state (`Confirmed`, `Plausible`, or `False Positive`).
+5. **Update Living Ledger:** Update statuses in `security_report.md`.
 
 ---
 
@@ -84,17 +65,16 @@ Inspect finding records and evidence integrity before verification:
 
 ```markdown
 ### 🧪 TorusGuard Evidence Verification
-- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
+- **Report File:** `security_report.md`
 - **Findings Evaluated:** [Count] findings
 - **Confirmed Real:** [Count] verified flaws
-- **Downgraded / False Positives:** [Count] filtered out
-- **Refined Mean Score:** [Score]/100
-- **Ledger:** `.torusguard/runs/<run_id>/verified-evidence.md`
+- **False Positives Filtered:** [Count]
+- **Status:** Evidence verified on disk
 ```
 
 ---
 
 ## Next Steps
 
-1. Run `/torusguard web-validate` if live endpoint probing is required.
-2. Run `/torusguard harden` to build surgical patch bundles for verified flaws.
+1. Run `/torusguard harden` to build surgical patch bundles for verified flaws.
+2. Run `/torusguard web-validate` if live endpoint probing is required.