torusguard 2.0.0-alpha → 2.1.0

package/skills/torusguard/payload/skills/torusguard-web-validate/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 1.3.6
+version: 2.0.0
 workflow: .torusguard/workflows/web-validate.md
 tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:
+  - internal/scanner/scanner.go
   - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/safety_gate.py
 ---
@@ -16,16 +17,27 @@ Safely probe live web applications within authorized scope, injecting transparen
 
 ---
 
+## Tri-Mode Parity
+
+| Mode | Command / Tool | Governed Behavior |
+| :--- | :--- | :--- |
+| **Mode A: CLI Terminal** | `torusguard web-validate` | Dispatches bounded HTTP probes with transparent audit headers and redaction. |
+| **Mode B: AI Chat Slash** | `/torusguard web-validate` | Interactive verification of endpoints, security headers, and cookie flags. |
+| **Mode C: Native MCP Tool**| — | Safe runtime execution guarded by scope.json boundaries. |
+
+---
+
 ## Authorization Gate Check
 Before dispatching any HTTP request:
 1. Verify `.torusguard/config/scope.json` exists and contains target URL.
 2. Confirm current timestamp is prior to `expires_at` TTL.
 3. Assert target is local or non-production staging.
+4. **SSRF Boundary Enforcement:** Resolve target IP and assert it does not target cloud metadata endpoints (`169.254.169.254`) or unintended internal subnets (`127.0.0.1` unless explicitly authorized as local dev).
 
 ---
 
 ## Safety Gate
-All requests pass through `.torusguard/scripts/safety_gate.py`:
+All requests pass through safety boundary checks:
 - `Auto-Allowed`: Read-only `GET`, `HEAD`, `OPTIONS` on non-sensitive paths.
 - `Approval Required`: Requests touching auth, sessions, or parameters.
 - `Manual Only`: Any destructive method (`DELETE`, `DROP`) is strictly blocked.
@@ -34,13 +46,15 @@ All requests pass through `.torusguard/scripts/safety_gate.py`:
 
 ## Execution Steps
 
-1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
-2. **Handle Automation Failure:** If automated web validation scripts fail, YOU must manually construct the HTTP requests (using `curl` or `fetch`) and inspect the responses.
+1. **Gate Check:** Validate scope in `scope.json`.
+2. **Execute Probe:**
+   ```bash
+   torusguard web-validate --target http://localhost:3000
+   ```
 3. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
-4. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
-5. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
-6. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
-7. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
+4. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
+5. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+6. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
 
 ---
 
@@ -68,3 +82,34 @@ All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk s
 - Replay Trace: `.torusguard/runs/<run_id>/requests.json`
 Next: Run `/torusguard exploit-check` to confirm exploitability of candidate flaws.
 ```
+
+---
+
+## 🚨 LLM Trap Table
+
+| Pattern | What AI Does Wrong | What Is Actually Correct |
+| :--- | :--- | :--- |
+| **Scope Bypass Probing** | Sends HTTP requests to arbitrary endpoints without validating `.torusguard/config/scope.json`. | Check `scope.json` and verify TTL before every outbound probe. |
+| **Token Exposure in Traces** | Writes unredacted `Authorization: Bearer <secret>` or session cookies to `requests.json`. | Redact all credentials to `[REDACTED]` before saving traces to disk. |
+| **SSRF Blindness** | Follows redirects or probes endpoints pointing to AWS/GCP metadata (`169.254.169.254`). | Block private IP ranges and metadata addresses under invariant 9. |
+| **Unbounded Flooding** | Launches high-concurrency request loops or stress tests against local dev server. | Enforce rate limiting and cap session probes to maximum 50 requests. |
+
+---
+
+## ✅ Pre-Flight Self-Audit
+
+Before dispatching web probes:
+- [ ] Is the target URL verified inside `scope.json` and within valid TTL?
+- [ ] Are transparent audit headers (`X-TorusGuard-AuthID`) attached?
+- [ ] Are destructive operations (`DELETE`, drops) blocked?
+- [ ] Are sensitive tokens and cookies redacted from trace logs?
+
+---
+
+## 🔁 VBC Protocol (Verify → Build → Confirm)
+
+```
+VERIFY:  Check scope.json validity, TTL, and SSRF boundaries for the target URL.
+BUILD:   Construct bounded HTTP request with X-TorusGuard-AuthID audit header.
+CONFIRM: Redact sensitive tokens and save sanitized trace into requests.json.
+```

package/skills/torusguard/payload/workflows/ai-guard.md

@@ -0,0 +1,31 @@
+# /torusguard-ai-guard — AI Application & RAG Pipeline Guard
+
+$ARGUMENTS
+
+---
+
+## Objective
+Detect and remediate prompt injection, unsandboxed autonomous tool executions, and cross-tenant vector contamination across AI agent and RAG architectures.
+
+---
+
+## Tri-Mode Parity
+- **Mode A (Terminal CLI):** `torusguard ai-guard [target]`
+- **Mode B (AI Chat Slash Command):** `/torusguard ai-guard [target]`
+- **Mode C (Native MCP Tool):** `torusguard_ai_guard`
+
+---
+
+## Execution Steps
+
+1. **Discover LLM & Agent Call Sites:** Locate AI framework usage (OpenAI, Anthropic, LangChain, LlamaIndex, Vercel AI SDK).
+2. **Audit Prompt Templates:**
+   - Detect raw user string concatenation into system instructions (`TG-AGENT-001`).
+   - Flag raw document chunk ingestion in RAG without inert delimiters (`TG-RAG-002`).
+3. **Audit Tool Registry & Dispatchers:**
+   - Check for unsandboxed shell, file, or database tool calls lacking Human Gates (`TG-AGENT-002`).
+   - Enforce Zod/Pydantic schema validation on all tool argument payloads (`TG-AGENT-003`).
+4. **Audit Vector Store Queries:**
+   - Assert all similarity searches (`pgvector`, `pinecone`, `qdrant`, `chroma`) include tenant/user metadata filters (`TG-RAG-001`).
+   - Flag ingestion of unvalidated external document payloads (`TG-RAG-003`).
+5. **Formulate Patches & Synchronize:** Propose surgical fixes and record findings in `security_report.md`.

package/skills/torusguard/payload/workflows/apply.md

@@ -1,16 +1,14 @@
 ---
 description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
-tools: Read, Grep, Glob, Bash, Edit, Write
-version: 1.4.0
+tools: Read, Grep, Glob, Bash, Edit, Write, run_command
+version: 2.0.0
 agent: remediator
 lifecycle-phase: Phase 5 (Patch Application)
 required-skills:
   - torusguard-apply
 scripts-binding:
-  - .torusguard/scripts/apply_runner.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/diff_guard.py
+  - internal/apply/apply.go
+  - cmd/torusguard/main.go
 ---
 
 # /torusguard apply — Governed Patch Application & Rollback Snapshot
@@ -20,91 +18,62 @@ $ARGUMENTS
 ---
 
 ## Objective
-Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
+Safely apply approved remediation bundles to disk source files, creating an automated byte-for-byte pre-apply backup snapshot (`.bak`) in `.torusguard/snapshots/<run_id>/`, asserting syntax validity, and distilling passing patterns into Golden Fix Recipes.
 
-Supported CLI flags:
-- `npx torusguard apply [--target <dir>]` : Apply candidate patches with confirmation prompt
-- `npx torusguard apply --diff` : Preview unified diffs without modifying files on disk
-- `npx torusguard apply --selective` : Interactively review and approve patches one by one
-- `npx torusguard apply --verify` : Trigger immediate differential AST recheck post-apply
-- `npx torusguard apply --list-snapshots` : List available historical pre-apply backup snapshots
-- `npx torusguard apply --yes` / `-y` : Non-interactive auto-approval mode
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard apply candidate.patch [--yes]` | Shell execution of patch applier with snapshot creation. |
+| **Mode B: AI Chat Slash** | `/torusguard apply` | Guided conversational application with explicit Human Gate approval. |
+| **Mode C: Native MCP Tool** | Autonomous Agent Flow | Formulates patch with `torusguard_harden`, awaits Human Gate, invokes CLI. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect bundle validity and file safety before modifying disk code:
-1. **Bundle Verification:** Assert `patch.diff` exists in active run's remediation folder.
-2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.bak` or `.torusguard/snapshots/<run_id>/`) prior to editing.
+1. **Bundle Verification:** Assert `candidate.patch` or semantic `patch.json` exists.
+2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.torusguard/snapshots/<run_id>/<rel_path>.bak`) prior to editing.
 3. **Uncommitted Changes:** Check git status; ensure target file has clean baseline.
 4. **Ponytail Check:** Re-verify that patch additions $\le 35$ and deletions $\le 25$.
 5. **Human Gate:** Confirm operator approval before committing edits to disk.
-6. **Workspace Cleanliness:** Verify git working tree has no uncommitted merge conflicts.
-7. **Execution Privilege:** Verify write access to targeted file locations.
-
----
-
-## When to Use /torusguard apply
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Applying an approved remediation patch to disk | Run `/torusguard apply` |
-| Generating patch diff without modifying disk | Run `/torusguard harden` |
-| Verifying that patch eliminated flaw without regression | Run `/torusguard recheck` |
-| Reverting an applied patch | Restore from `.bak` snapshot |
-| Checking workspace status | Run `/torusguard status` |
 
 ---
 
 ## Living Report Invariant
 - Applied patches create pre-apply `.bak` snapshots in `.torusguard/snapshots/<run_id>/`.
 - Finding statuses transition in `security_report.md` to `APPLIED 🔵`.
-- Instant rollback available via `npx torusguard rollback`.
-
-## Execution Steps
-
-1. **Load Remediation Bundle:** Read `patch.diff` and metadata from active run directory.
-2. **Audit Patch Invariants:** Run `python .torusguard/scripts/diff_guard.py <patch.diff>`.
-3. **Create Rollback Backup:** Copy target file to `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<filename>.bak`.
-4. **Apply Minimal Diff:** Execute precise surgical edit using `replace_file_content` or `patch`.
-5. **Assert Syntax & Integrity:** Check that modified file compiles cleanly without syntax errors.
-6. **Log Application Ledger:** Record timestamp, original SHA-256, and patched SHA-256 in `apply-log.json`.
+- Instant rollback available via `torusguard rollback`.
 
 ---
 
-## Failure Recovery
-
-- **Syntax Error After Patch:** Instantly revert target file from `.bak` backup snapshot.
-- **Merge / Context Conflict:** Re-run `/torusguard harden` to regenerate diff against latest disk lines.
-- **Missing Backup File:** Do not apply patch if backup copy cannot be written.
-- **Halt Trigger:** Abort if git working tree is dirty on conflicting lines.
-
----
-
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never apply code changes without creating an exact pre-apply rollback backup first.
-- ❌ Never touch files not explicitly listed in the approved `patch.diff`.
-- ✅ Always verify syntax compilation immediately after modifying source files.
+1. **Load Remediation Bundle:** Read `candidate.patch` or `patch.json`.
+2. **Obtain Human Gate:** Confirm user approval to modify target source file.
+3. **Create Rollback Backup:** Capture `.bak` in `.torusguard/snapshots/<run_id>/`.
+4. **Apply Surgical Edit:** Run `torusguard apply <patch> --yes` or apply semantic reflection.
+5. **Assert Syntax & Integrity:** Check that modified file compiles cleanly (`go test ./...`, syntax lint).
+6. **Recommend Recheck:** Run `torusguard recheck` or `/torusguard recheck`.
 
 ---
 
 ## Output Card Format
 
 ```markdown
-### 🚀 TorusGuard Patch Application
-- **Finding Addressed:** `TG-XXX-HASH`
-- **File Patched:** `src/path/to/file.py`
-- **Rollback Backup:** `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<file>.bak`
-- **Churn Applied:** +[Additions] / -[Deletions] lines
-- **Syntax Check:** PASSED (clean compile)
-- **Status:** APPLIED — run `/torusguard recheck` to verify fix
+### 🚀 TorusGuard Patch Applied Successfully
+- **Target File:** `src/path/to/file`
+- **Backup Snapshot:** `.torusguard/snapshots/<run_id>/<file>.bak`
+- **Rollback Command:** `torusguard rollback`
+- **Next Step:** Run `/torusguard recheck` to verify closure
 ```
 
 ---
 
 ## Next Steps
 
-1. Run `/torusguard recheck` to perform differential audit on the modified file.
-2. Run test suites to verify that business logic and regressions remain intact.
+1. Run `/torusguard recheck` or `torusguard recheck` to verify closure and zero regressions.
+2. If unexpected behavior occurs, run `torusguard rollback`.

package/skills/torusguard/payload/workflows/audit.md

@@ -1,16 +1,15 @@
 ---
 description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.4.0
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: auditor
 lifecycle-phase: Phase 2 (Static Audit & Clustering)
 required-skills:
   - torusguard-audit
 scripts-binding:
-  - .torusguard/scripts/audit_runner.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/finding_scorer.py
+  - internal/scanner/scanner.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard audit — Static Security Code Scan & Clustering
@@ -20,36 +19,27 @@ $ARGUMENTS
 ---
 
 ## Objective
-Static security AST scanning, stable fingerprinting, root-cause clustering, throughput telemetry, and 0-100 scoring.
+Execute static AST analysis across polyglot project files, evaluate code against 74 canonical security rules across 18 families, assign stable line-shift invariant fingerprints, cluster architectural root causes, synchronize findings with `security_report.md`, and score findings with auditable 0–100 confidence ratings.
 
-Supported CLI flags:
-- `npx torusguard audit [--target <dir>]` : Specify project root directory
-- `npx torusguard audit --watch` / `-w` : Continuous watch mode, re-scanning on file change
-- `npx torusguard audit --sarif` : Automatically export OASIS SARIF v2.1.0 log
-- `npx torusguard audit --severity <critical|high|medium|low>` : Floor filter for findings
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard audit [--include-tests] [--json]` | Shell execution of compiled Go binary. |
+| **Mode B: AI Chat Slash** | `/torusguard audit` | Conversational guided audit with bounded context inspection. |
+| **Mode C: Native MCP Tool** | `torusguard_audit` | Autonomous agent tool invocation via stdio JSON-RPC. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect workspace prerequisites before launching static audit:
-1. **Init State (`torusguard.json`):** Assert repository is initialized.
+1. **Init State (`torusguard.json`):** Assert repository is initialized or run `torusguard init`.
 2. **Active Rules (`rules/active/`):** Confirm rule definitions exist.
 3. **Exclusions:** Assert `node_modules/`, `.venv/`, `dist/`, `.git/` are skipped.
-4. **Run Folder:** Allocate isolated folder in `.torusguard/runs/`.
-5. **Syntax Check:** Check for syntax errors before parsing ASTs.
-
----
-
-## When to Use /torusguard audit
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| First-time scan of repository or new branch | Run `/torusguard audit` |
-| Pre-commit review and PR security checks | Run `/torusguard audit` |
-| Uninitialized project | Run `/torusguard init` first |
-| Live endpoint or runtime probing | Run `/torusguard web-validate` |
-| Differential check after patch | Run `/torusguard recheck` |
+4. **Syntax Check:** Check for syntax errors before parsing ASTs.
 
 ---
 
@@ -57,31 +47,18 @@ Inspect workspace prerequisites before launching static audit:
 - Audit discoveries automatically synchronize to `security_report.md` at workspace root.
 - Findings transition into `OPEN 🔴` status with stable invariant fingerprints.
 
-## Execution Steps
-
-1. **Allocate Run Folder:** Run `python .torusguard/scripts/run_manager.py create audit`.
-2. **Scan Codebase ASTs:** Match active rules against source trees.
-3. **Compute Stable Fingerprints:** Hash AST context to produce stable IDs.
-4. **Cluster Root Causes:** Group findings sharing identical sinks.
-5. **Score Confidence (0–100):** Run `python .torusguard/scripts/finding_scorer.py --run <run_dir>`.
-6. **Emit Artifacts:** Write `findings.md`, `findings.json`, and `summary.md`.
-
 ---
 
-## Failure Recovery
-
-- **Zero Rules Active:** Re-run `/torusguard init` to activate rules.
-- **AST Parse Error:** Log syntax error on malformed file, skip, and continue.
-- **Scorer Failure:** Ensure Python 3.10+; verify finding JSON structure.
-- **Halt Trigger:** Abort if run folder cannot be allocated or disk write fails.
-
----
-
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never invent finding IDs without AST line hashing.
-- ❌ Never flag test fixtures as critical security flaws.
-- ✅ Always calculate scores using `.torusguard/scripts/finding_scorer.py`.
+1. **Launch Audit Scan:**
+   - **Mode A (CLI):** Run `torusguard audit` in terminal.
+   - **Mode B (Chat):** Parse AST sinks using `grep_search` and bounded `ExtractContext`.
+   - **Mode C (MCP):** Call `torusguard_audit` with `{"target": "."}`.
+2. **Scan Codebase ASTs:** Match 74 canonical rules across 18 families against source trees.
+3. **Compute Stable Fingerprints:** Hash AST context to produce stable line-shift invariant IDs.
+4. **Cluster Root Causes:** Group findings sharing identical sinks or causal architecture.
+5. **Synchronize Ground Truth:** Update `security_report.md` at workspace root.
 
 ---
 
@@ -89,12 +66,11 @@ Inspect workspace prerequisites before launching static audit:
 
 ```markdown
 ### 🔎 TorusGuard Static Audit Results
-- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
 - **Files Scanned:** [Count] source files
 - **Total Findings:** [Count] ([Critical] Critical, [High] High)
 - **Root Cause Clusters:** [Count] architectural issues
 - **Confidence:** [Score]/100
-- **Artifact:** `.torusguard/runs/<run_id>/findings.md`
+- **Living Report:** `security_report.md`
 ```
 
 ---

package/skills/torusguard/payload/workflows/authorize.md

@@ -1,14 +1,14 @@
 ---
 description: Legal scope definition, target ownership proof verification, and safety boundary enforcement for runtime validation.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: Phase 1 (Authorization Gate)
 required-skills:
   - torusguard-authorize
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/safety_gate.py
+  - internal/validate/validate.go
+  - cmd/torusguard/main.go
 ---
 
 # /torusguard authorize — Legal Scope & Safety Gate
@@ -18,7 +18,17 @@ $ARGUMENTS
 ---
 
 ## Objective
-Legal scope definition, target ownership proof verification, and safety boundary enforcement.
+Legal scope definition, target ownership proof verification, and safety boundary enforcement for runtime validation.
+
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard authorize` | Interactive boundary setup and cryptographic token generation. |
+| **Mode B: AI Chat Slash** | `/torusguard authorize` | Conversational parameter collection and scope validation. |
+| **Mode C: Native MCP Tool** | Safety Gate Guard | Administrative gatekeeper ensuring strict safety boundaries before probes. |
 
 ---
 
@@ -27,52 +37,20 @@ Legal scope definition, target ownership proof verification, and safety boundary
 Inspect authorization parameters and environment safety before executing:
 1. **Config Record (`.torusguard/config/torusguard.json`):** Assert repository is initialized.
 2. **Current Scope (`.torusguard/config/scope.json`):** Inspect active allowed targets, paths, and TTL expiry.
-3. **Environment Classification:** Assert target is local or staging (`localhost`, `127.0.0.1`, `*.local`, `*.staging.*`). Production targets require explicit approval.
+3. **Environment Classification:** Assert target is local or staging (`localhost`, `127.0.0.1`, `*.staging.*`).
 4. **Destructive Guard:** Ensure state-changing operations (`DELETE`, bulk drops) remain blocked by default.
-5. **Ownership Proof:** Verify target ownership token or local process binding.
-6. **TTL Window:** Ensure authorization window does not exceed 24 hours.
-
----
-
-## When to Use /torusguard authorize
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Preparing for live HTTP probes or API validation | Run `/torusguard authorize` |
-| Updating allowed hosts, path prefixes, or rate limits | Run `/torusguard authorize` |
-| Static-only security audit | Skip authorize; run `/torusguard audit` |
-| Checking active legal scope status | Run `/torusguard status` |
-| Expired authorization window | Re-run `/torusguard authorize` |
+5. **TTL Window:** Ensure authorization window does not exceed 24 hours.
 
 ---
 
 ## Execution Steps
 
-1. **Capture Scope Parameters:** Collect target URL, allowed paths, forbidden prefixes, and max request budget.
-2. **Validate Host Ownership:** Verify target is local or matches authorized test domains.
-3. **Invoke Safety Gate:**
-   ```bash
-   python .torusguard/scripts/safety_gate.py check --url <target_url>
-   ```
-4. **Write Scope File (`.torusguard/config/scope.json`):** Save authorized targets, valid TTL timestamp, and request rate caps.
-5. **Confirm Scope Binding:** Verify `.torusguard/config/scope.json` parses as valid JSON against schema.
-
----
-
-## Failure Recovery
-
-- **Unreachable Host:** Verify local server is running on the specified port.
-- **Production Target Warning:** If target resolves to an external production host, halt and request operator override.
-- **Malformed JSON:** Re-initialize `scope.json` from `.torusguard/schemas/auth-boundary.schema.json`.
-- **Halt Trigger:** Abort immediately if user provides wildcard target (`*`) or third-party domain.
-
----
-
-## Hallucination Guard
-
-- ❌ Never proceed with runtime probing without an explicit, valid `.torusguard/config/scope.json`.
-- ❌ Never authorize destructive HTTP methods (`DELETE`, `DROP`) under default non-destructive policy.
-- ✅ Always validate targets through `.torusguard/scripts/safety_gate.py`.
+1. **Trigger Authorization:**
+   - **Mode A (CLI):** Run `torusguard authorize`.
+   - **Mode B (Chat):** Collect target host URL and allowed prefixes.
+2. **Generate Token:** Persist cryptographic authorization token into `.torusguard/auth.json`.
+3. **Write Scope Record:** Persist authorized targets and expiration TTL into `.torusguard/config/scope.json`.
+4. **Confirm Readiness:** Prepare environment for `/torusguard web-validate`.
 
 ---
 
@@ -81,9 +59,8 @@ Inspect authorization parameters and environment safety before executing:
 ```markdown
 ### 🔒 TorusGuard Authorization Gate
 - **Target URL:** [Target Host or URL]
-- **Environment:** [Localhost / Staging / Container]
-- **Allowed Paths:** [Path prefixes or all authorized]
-- **Rate Limit:** [Max requests / concurrency limit]
+- **Environment:** [Localhost / Staging]
+- **Session TTL:** 24 Hours
 - **Scope File:** `.torusguard/config/scope.json`
 - **Status:** AUTHORIZED — ready for `/torusguard web-validate`
 ```
@@ -92,5 +69,5 @@ Inspect authorization parameters and environment safety before executing:
 
 ## Next Steps
 
-1. Run `/torusguard audit` to scan codebase for AST security vulnerabilities.
-2. Run `/torusguard web-validate` to begin safe, authorized endpoint validation.
+1. Run `/torusguard web-validate` to begin safe, authorized endpoint validation.
+2. Run `/torusguard audit` to scan codebase for AST vulnerabilities.

package/skills/torusguard/payload/workflows/container.md

@@ -0,0 +1,29 @@
+# /torusguard-container — Container & Docker Security Audit
+
+$ARGUMENTS
+
+---
+
+## Objective
+Detect and remediate container privilege escalation, root execution, docker socket exposure, and build-time secret injection across `Dockerfile`, `Containerfile`, and `docker-compose.yml` configurations.
+
+---
+
+## Tri-Mode Parity
+- **Mode A (Terminal CLI):** `torusguard container [target]`
+- **Mode B (AI Chat Slash Command):** `/torusguard container [target]`
+- **Mode C (Native MCP Tool):** `torusguard_container`
+
+---
+
+## Execution Steps
+
+1. **Discover Container Configurations:** Discover all Dockerfiles and compose YAML files in the workspace.
+2. **Execute Static Heuristic Audit:** Run `ScanContainerFiles` or `torusguard_container` against discovered files.
+3. **Assert Security Invariants:**
+   - Enforce non-root user declarations (`TG-CONT-001`).
+   - Block Docker daemon socket mounts (`/var/run/docker.sock`) (`TG-CONT-002`).
+   - Disallow `privileged: true` and unconfined seccomp profiles (`TG-CONT-003`).
+   - Ban build-time secrets in `ARG` or `ENV` directives (`TG-CONT-004`).
+4. **Formulate Surgical Patches:** Propose minimal diffs adding non-root users (`USER appuser`) and secret mounts within Ponytail bounds (≤35 additions, ≤25 deletions).
+5. **Synchronize Report:** Log all container findings in `security_report.md`.