torusguard 2.0.0-alpha → 2.1.0

package/skills/torusguard-container/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: torusguard-container
+description: Audits Dockerfiles, Containerfiles, and Docker Compose configurations for root users, exposed docker sockets, privileged mode, and embedded secrets via CLI, Chat, or MCP.
+version: 2.0.0
+workflow: .torusguard/workflows/container.md
+tools: Read, Grep, Glob, Write, run_command
+scripts-binding:
+  - internal/scanner/container.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
+---
+
+# TorusGuard Container & Docker Security Audit
+
+## Objective
+Detect and remediate critical container runtime and build-time security vulnerabilities across `Dockerfile`, `Containerfile`, `docker-compose.yml`, and `compose.yaml` files. Enforces non-root execution, privilege containment, socket isolation, and BuildKit secret mounts.
+
+---
+
+## Tri-Mode Execution
+
+### Mode A: Automated CLI Execution
+Run container audits against current directory or specific target project:
+```bash
+# Scan container files in current directory
+torusguard container
+
+# Scan container files in specific workspace target
+torusguard container --target ./deployments/docker
+```
+
+### Mode B: In-Session AI Chat Slash Command
+Run `/torusguard container` in chat.
+The agent invokes the native Go scanner or MCP tool to inspect container definitions, audit user permissions, and report structural container misconfigurations.
+
+### Mode C: Native MCP Tool Call
+MCP-enabled coding agents (Antigravity, Cursor, Windsurf, Claude Code) call:
+```json
+{
+  "tool": "torusguard_container",
+  "arguments": {
+    "target": "."
+  }
+}
+```
+
+---
+
+## Supported Patterns & Invariants
+- **TG-CONT-001 (Root Execution Default):** Detects omission of explicit `USER <non-root>` instruction or explicit `USER root` declarations in production container stages.
+- **TG-CONT-002 (Docker Socket Exposure):** Detects dangerous mounting of the host daemon socket (`/var/run/docker.sock`), which grants unconfined root privileges over the host.
+- **TG-CONT-003 (Privileged Container Flag):** Detects `privileged: true`, `seccomp:unconfined`, or `SYS_ADMIN` capability grants that defeat Linux namespace and cgroup boundaries.
+- **TG-CONT-004 (Build-Time Secret Injection):** Flags embedding sensitive tokens, passwords, or keys via `ARG` or `ENV` directives in Dockerfiles rather than BuildKit secret mounts.
+
+---
+
+## 🏛️ OpenCodeReview Hybrid Architecture Integration
+- **Deterministic Dockerfile & Compose Parser:** Pattern extraction is executed by Go AST/regex parsers without external Docker daemon dependencies.
+- **Token Efficiency:** Only flagged container directives and minimal surrounding context are returned to the agent context.
+- **Ponytail Bounds:** Remediation patches must add dedicated non-root users (`USER appuser`) or switch secrets to `--mount=type=secret` without full container file rewrites (≤35 additions, ≤25 deletions).
+
+---
+
+## 🚨 LLM Trap Table
+
+| Pattern | What AI Does Wrong | What Is Actually Correct |
+| :--- | :--- | :--- |
+| **Default Root Execution** | Forgets that Docker executes as UID 0 (`root`) unless a non-root `USER` is declared. | Always declare `RUN adduser -D appuser && USER appuser` before the entrypoint. |
+| **Secrets in Build Arguments** | Recommends `ARG API_KEY` or `ENV DB_PASSWORD`, leaving keys baked into image layers. | Use Docker BuildKit secret mounts: `RUN --mount=type=secret,id=mysecret ...`. |
+| **Permissive Privileged Mode** | Adds `privileged: true` or `cap_add: [ALL]` to resolve permission or port binding errors. | Grant only specific minimal Linux capabilities (e.g. `NET_BIND_SERVICE`) or fix file ownership. |
+| **Docker Socket Mounting** | Mounts `/var/run/docker.sock` inside container to run Docker commands inside Docker. | Use Docker-in-Docker (dind) rootless or ephemeral CI runners with isolated daemons. |
+| **Full File Rewrites** | Rewrites entire multi-stage Dockerfile destroying cached layer order. | Formulate surgical diffs replacing or inserting only the missing `USER` or mount flag. |
+
+---
+
+## ✅ Pre-Flight Self-Audit
+
+Before concluding a container security review, verify:
+- [ ] Did I scan all Dockerfiles (`Dockerfile`, `Dockerfile.*`, `Containerfile`)?
+- [ ] Did I scan all compose files (`docker-compose.yml`, `compose.yaml`)?
+- [ ] Is there an unprivileged non-root user defined before `ENTRYPOINT` or `CMD`?
+- [ ] Are sensitive environment variables passed via runtime `.env` / secret managers instead of `ARG` / `ENV`?
+- [ ] Is `/var/run/docker.sock` completely absent from compose volumes?
+- [ ] Are all proposed fixes within Ponytail churn bounds (≤35 additions, ≤25 deletions)?
+
+---
+
+## 🔁 VBC Protocol (Verify → Build → Confirm)
+
+```
+VERIFY: Identify Dockerfiles and Compose files in the workspace.
+BUILD:  Execute torusguard container or torusguard_container to locate container privilege and secret flaws.
+CONFIRM: Formulate surgical remediation patch introducing non-root users and removing dangerous mounts, rechecking with torusguard recheck.
+```

package/skills/torusguard-exploit-check/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: torusguard-exploit-check
 description: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.
-version: 1.3.6
+version: 2.0.0
 workflow: .torusguard/workflows/exploit-check.md
 tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:
+  - internal/scanner/scanner.go
   - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/safety_gate.py
   - .torusguard/scripts/finding_scorer.py
@@ -17,11 +18,21 @@ Confirm whether candidate findings are practically exploitable using safe, singl
 
 ---
 
+## Tri-Mode Parity
+
+| Mode | Command / Tool | Governed Behavior |
+| :--- | :--- | :--- |
+| **Mode A: CLI Terminal** | `torusguard exploit-check` | Dispatches single-step sentinel canaries, confirms exploitability safely. |
+| **Mode B: AI Chat Slash** | `/torusguard exploit-check` | Evaluates reproduction traces and classifies findings into 5 statuses. |
+| **Mode C: Native MCP Tool**| — | Bounded execution guarded by safety gate and inert payloads. |
+
+---
+
 ## Authorization Gate Check
 Before dispatching any exploitability probe:
 1. Verify target route is explicitly authorized in `.torusguard/config/scope.json`.
 2. Verify authorization TTL has not expired.
-3. Assert probe passes `.torusguard/scripts/safety_gate.py`.
+3. Assert probe passes safety boundaries.
 
 ---
 
@@ -37,15 +48,17 @@ Before dispatching any exploitability probe:
 
 1. **Verify Scope:** Read `scope.json`; assert authorized endpoint.
 2. **Select Canary:** Choose matching non-destructive probe strategy.
-3. **Handle Automation Failure:** If automated exploit check scripts fail, YOU must manually construct the safe HTTP request (using `curl` or `fetch`) and inspect the response.
-4. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
-5. **Classify Status:** Transition finding into one of 5 canonical outcomes:
+3. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`:
+   ```bash
+   torusguard exploit-check --finding TG-SEC-001
+   ```
+4. **Classify Status:** Transition finding into one of 5 canonical outcomes:
    - `Confirmed`: Canary reflected or secondary tenant data leaked.
    - `Not Reproducible`: Endpoint responded with 401/403 or sanitized input.
    - `Needs Review`: Ambiguous status code or incomplete response.
    - `Blocked by Controls`: WAF or rate limiter stopped probe.
    - `Out of Scope`: Target endpoint is not authorized.
-6. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
+5. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
 
 ---
 
@@ -68,3 +81,34 @@ Before dispatching any exploitability probe:
 - Evidence: <Response snippet or status code>
 Next: Run `/torusguard harden` to formulate surgical remediation bundle.
 ```
+
+---
+
+## 🚨 LLM Trap Table
+
+| Pattern | What AI Does Wrong | What Is Actually Correct |
+| :--- | :--- | :--- |
+| **Destructive Payloads** | Generates real data-altering payloads (`'; DROP TABLE users;--`, `<script>evil()</script>`). | Use strictly inert canaries (`' OR 1=1--`, `<tg-canary-tag>`) that cannot destroy state or exfiltrate data. |
+| **Fuzzing Floods** | Runs recursive wordlist fuzzing or multi-hundred request automated attacks. | Enforce single-step bounded confirmation (1-2 deterministic probe requests max). |
+| **False Confirmation** | Declares finding "Confirmed" based on a generic HTTP 500 error without validating the canary reflection. | Require differential response evidence (e.g. reflection of exact sentinel tag or tenant leak). |
+| **Missing Scope Check** | Probes external auth providers (OAuth Google/GitHub) during auth validation. | Confine probes strictly to internal endpoints authorized in `scope.json`. |
+
+---
+
+## ✅ Pre-Flight Self-Audit
+
+Before dispatching an exploitability check:
+- [ ] Is the probe payload completely inert and non-destructive?
+- [ ] Is the route explicitly in scope and within TTL?
+- [ ] Is the `X-TorusGuard-AuthID` header attached?
+- [ ] Is the outcome classification mapped to one of the 5 canonical statuses?
+
+---
+
+## 🔁 VBC Protocol (Verify → Build → Confirm)
+
+```
+VERIFY:  Check route authorization in scope.json and confirm finding AST context.
+BUILD:   Select inert canary token (e.g. <tg-canary-tag>) and construct probe.
+CONFIRM: Evaluate response for differential proof, classify status, and record trace.
+```

package/skills/torusguard-full/SKILL.md

@@ -1,16 +1,14 @@
 ---
 name: torusguard-full
 description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
-version: 1.3.6
+version: 2.0.0
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Bash, Edit, Write, run_command
 scripts-binding:
+  - internal/scanner/scanner.go
+  - internal/harden/patch.go
+  - internal/apply/apply.go
   - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/stack_detect.py
-  - .torusguard/scripts/safety_gate.py
-  - .torusguard/scripts/finding_scorer.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/sarif_exporter.py
 ---
 
 # TorusGuard Full — Master 7-Stage Pipeline Orchestrator
@@ -20,15 +18,33 @@ Execute the full, closed-loop TorusGuard security lifecycle from stack discovery
 
 ---
 
+## Tri-Mode Pipeline Parity
+
+| Stage | Mode A: Terminal CLI | Mode B: AI Chat Slash | Mode C: Native MCP Tool |
+| :--- | :--- | :--- | :--- |
+| **0. Init** | `torusguard init` | `/torusguard init` | Init + `torusguard_status` |
+| **1. Authorize** | `torusguard authorize` | `/torusguard authorize` | Safety Gate Boundary |
+| **2. Audit & Vision** | `torusguard audit` / `ocr-scan` | `/torusguard audit` / `ocr-scan` | `torusguard_audit` / `torusguard_ocr_scan` |
+| **3. Verify** | `torusguard verify` | `/torusguard verify` | `torusguard_verify` |
+| **4. Harden** | `torusguard harden` | `/torusguard harden` | `torusguard_harden` |
+| **5. Apply** | `torusguard apply [--yes]` | `/torusguard apply` | Human Gate Approval |
+| **6. Recheck** | `torusguard recheck` | `/torusguard recheck` | `torusguard_recheck` |
+| **7. Report** | `torusguard report --html` | `/torusguard report` | `torusguard://security_report` |
+
+---
+
 ## 7-Stage Security Pipeline
-0. Init (Baseline) ──► 1. Authorize (Scope) ──► 2. Audit (AST Scan) ──► 3. Validate (Evidence/Exploit) ──► 4. Harden (Ponytail Patch) ──► 5. Apply (Backup & Edit) ──► 6. Recheck (Regression) ──► 7. Report (SARIF)
+```
+0. Init ──► 1. Authorize ──► 2. Audit ──► 3. Validate ──► 4. Harden ──► 5. Apply ──► 6. Recheck ──► 7. Report
+(Baseline)   (Scope Gate)     (AST Scan)   (Evidence)     (Ponytail)   (Human Gate)  (Regression)   (SARIF/HTML)
+```
 
 ---
 
 ## Specialist Skill Routing
 - **Phase 0:** `torusguard-init` (`profiler`)
 - **Phase 1:** `torusguard-authorize` (`reviewer`)
-- **Phase 2:** `torusguard-audit` (`auditor`)
+- **Phase 2:** `torusguard-audit` (`auditor`) / `torusguard-ocr-scan` (`vision`)
 - **Phase 3:** `torusguard-verify` / `torusguard-exploit-check` (`validator`)
 - **Phase 4:** `torusguard-harden` (`remediator`)
 - **Phase 5:** `torusguard-apply` (`remediator`)
@@ -38,19 +54,14 @@ Execute the full, closed-loop TorusGuard security lifecycle from stack discovery
 ---
 
 ## Pipeline Execution Instructions
-1. **Init:** Detect stack via `stack_detect.py` and activate rules in `.torusguard/rules/active/`.
+1. **Init:** Detect stack via `torusguard init` and activate tailored rules in `.torusguard/rules/active/`.
 2. **Authorize:** Verify target ownership and TTL in `.torusguard/config/scope.json`.
-3. **Audit:** Scan ASTs; assign fingerprints; cluster root causes; compute confidence scores.
+3. **Audit:** Scan ASTs via `torusguard audit` (or `torusguard ocr-scan` for visual assets); assign fingerprints; compute confidence scores.
 4. **Validate:** Audit evidence sufficiency; optionally send bounded probe canary.
-5. **Harden:** Formulate surgical diffs bound by Ponytail limits ($\le 35$ add, $\le 25$ del).
-6. **Apply:** Save `.bak` snapshot in `pre_apply/`; obtain Human Gate; apply patch.
-7. **Recheck:** Re-scan modified files; assert findings are `Fixed` with zero regressions.
-8. **Report:** Export OASIS SARIF v2.1.0 and emit signed markdown summary.
-
----
-
-## Confidence Scoring Rubric
-Evaluates Evidence (35 pts), Reproduction (25 pts), Corroboration (15 pts), Environment (15 pts), and Review Status (10 pts) into 4 bands: Confirmed (90–100), High (70–89), Medium (50–69), Needs Review (<50).
+5. **Harden:** Formulate surgical diffs bound by Ponytail limits ($\le 35$ additions, $\le 25$ deletions).
+6. **Apply:** Capture `.bak` snapshot in `.torusguard/snapshots/`; obtain Human Gate; apply patch via `torusguard apply`.
+7. **Recheck:** Re-scan modified files via `torusguard recheck`; assert findings are `Fixed` with zero regressions.
+8. **Report:** Export OASIS SARIF v2.1.0 and emit visual HTML dashboard via `torusguard report --html`.
 
 ---
 
@@ -62,6 +73,7 @@ Evaluates Evidence (35 pts), Reproduction (25 pts), Corroboration (15 pts), Envi
 - Human Gate mandatory before code modifications in Phase 5.
 - Enforce Ponytail line bounds ($\le 35$ additions, $\le 25$ deletions).
 - Never dispatch network probes outside authorized scope in `scope.json`.
+- Zero security bypasses permitted (`TG-DIFF-001`).
 
 ---
 
@@ -73,3 +85,34 @@ Evaluates Evidence (35 pts), Reproduction (25 pts), Corroboration (15 pts), Envi
 - SARIF Log: `.torusguard/runs/<run_id>/results.sarif`
 - Report: `.torusguard/runs/<run_id>/report.md`
 ```
+
+---
+
+## 🚨 LLM Trap Table
+
+| Pattern | What AI Does Wrong | What Is Actually Correct |
+| :--- | :--- | :--- |
+| **Pipeline Step Skipping** | Jumps directly from Audit to Apply without verifying evidence or validating Ponytail patch bounds. | Follow the 7 stages in sequential order; each stage gate must be satisfied. |
+| **Human Gate Bypass** | Writes modifications directly to disk without presenting candidate diffs or awaiting user confirmation. | Always require explicit Human Gate confirmation before Phase 5 (`torusguard apply`). |
+| **Full File Rewrites** | Rewrites complete source files during remediation, causing massive line churn and regression risk. | Formulate surgical patches respecting Ponytail bounds ($\le 35$ add, $\le 25$ del) using Line-Level Reflection. |
+| **Unsynchronized State** | Generates reports that don't match the statuses in `security_report.md`. | Keep `security_report.md` synchronized at every phase transition as the single living source of truth. |
+
+---
+
+## ✅ Pre-Flight Self-Audit
+
+Before orchestrating the full pipeline:
+- [ ] Are all prerequisite tools (`torusguard` binary) available?
+- [ ] Is `security_report.md` inspected prior to initiating any scans or fixes?
+- [ ] Are all patches bounded by Ponytail limits and verified without security bypasses?
+- [ ] Is a `.bak` snapshot captured before any disk modification?
+
+---
+
+## 🔁 VBC Protocol (Verify → Build → Confirm)
+
+```
+VERIFY:  Review current workspace security posture and verify phase prerequisites.
+BUILD:   Execute the pipeline stage by stage using designated specialist skills.
+CONFIRM: Validate final SARIF, HTML report, and synchronized security_report.md.
+```

package/skills/torusguard-git-mine/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: torusguard-git-mine
+description: Mines git commit history, commit diffs, and local repository metadata for leaked credentials, private keys, and historical API tokens via CLI, Chat, or MCP.
+version: 2.0.0
+workflow: .torusguard/workflows/git-mine.md
+tools: Read, Grep, Glob, Write, run_command
+scripts-binding:
+  - internal/scanner/git_mine.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
+---
+
+# TorusGuard Git History Secret Mining
+
+## Objective
+Inspect local `.git` metadata, remote configurations, and commit logs across the repository's commit history to identify leaked API tokens, private keys, database URIs, and credentials that were committed in past revisions or embedded in remote URLs.
+
+---
+
+## Tri-Mode Execution
+
+### Mode A: Automated CLI Execution
+Run Git history mining against current repository or specified target workspace:
+```bash
+# Mine Git commit history and .git/config in current workspace
+torusguard git-mine
+
+# Mine specific repository target
+torusguard git-mine --target /path/to/repo
+```
+
+### Mode B: In-Session AI Chat Slash Command
+Run `/torusguard git-mine` in chat.
+The agent executes the compiled Go Git mining engine or MCP tool to inspect commit history logs, detect historical secret leaks, and provide provider revocation guidance.
+
+### Mode C: Native MCP Tool Call
+MCP-enabled coding agents (Antigravity, Cursor, Windsurf, Claude Code) call:
+```json
+{
+  "tool": "torusguard_git_mine",
+  "arguments": {
+    "target": "."
+  }
+}
+```
+
+---
+
+## Supported Patterns & Invariants
+- **TG-GIT-001 (Historical Secret Commit):** Detects API keys (OpenAI `sk-...`, AWS `AKIA...`, GitHub `ghp_...`), private certificates, or database credentials introduced in prior git commits even if removed from the current working tree.
+- **TG-GIT-002 (Plaintext Remote Credentials):** Flags remote URLs in `.git/config` containing basic authentication credentials (`https://user:token@github.com/...`).
+- **TG-GIT-003 (Sensitive File History Tracking):** Detects tracked `.env`, `id_rsa`, `.pem`, or `.key` files in git log metadata that bypass `.gitignore`.
+
+---
+
+## 🏛️ OpenCodeReview Hybrid Architecture Integration
+- **Deterministic History Inspection:** Analyzes commit logs via local Git commands or fallback file reading with strict 5-second timeouts and bounded commit depths.
+- **Token Minimization:** Emits commit SHA, author timestamp, and redacted secret preview rather than dumping full commit logs into LLM context.
+- **Revocation-First Governance:** Prioritizes immediate credential revocation at the provider (OpenAI, AWS, GitHub) before history rewrites (`git filter-repo` / BFG).
+
+---
+
+## 🚨 LLM Trap Table
+
+| Pattern | What AI Does Wrong | What Is Actually Correct |
+| :--- | :--- | :--- |
+| **Working Tree Only Bias** | Only scans files currently on disk, assuming deleted secrets are safely removed. | Always mine Git commit history (`git log -p`) because Git never forgets past commits. |
+| **Token in Remote Origin URL** | Recommends `git remote set-url origin https://ghp_xxx@github.com/...` which writes token to disk in plaintext. | Use SSH keys, GitHub CLI (`gh auth login`), or credential helpers (`git credential-manager`). |
+| **History Rewriting Over Revocation** | Recommends scrubbing Git history before revoking the leaked secret at the cloud provider. | Always rotate and revoke the credential immediately at the provider first; assume it was scraped. |
+| **Single Commit Amends** | Recommends `git commit --amend` when the secret was committed 5 commits ago. | Use `git rebase -i` or `git-filter-repo` for deeper historical scrubbing. |
+| **Tracking .env in Git** | Adds `.env` to `.gitignore` without running `git rm --cached .env`, leaving file tracked. | Run `git rm --cached <file>` so Git stops tracking the sensitive file in subsequent commits. |
+
+---
+
+## ✅ Pre-Flight Self-Audit
+
+Before concluding a Git repository security audit, verify:
+- [ ] Is `.git` directory present and valid?
+- [ ] Were remote URLs in `.git/config` checked for embedded plaintext passwords or tokens?
+- [ ] Were the most recent 50 commits audited for added secrets in commit diffs?
+- [ ] Did I verify whether `.env` or private keys were ever tracked in git history?
+- [ ] Was the user instructed to rotate/revoke leaked keys at the provider immediately?
+
+---
+
+## 🔁 VBC Protocol (Verify → Build → Confirm)
+
+```
+VERIFY: Confirm workspace is a valid Git repository with accessible commit history.
+BUILD:  Execute torusguard git-mine or torusguard_git_mine to detect historical leaks and credential configs.
+CONFIRM: Provide immediate rotation steps, clean .git/config, and scrub historical commits via git-filter-repo.
+```

package/skills/torusguard-harden/SKILL.md

@@ -1,78 +1,80 @@
 ---
 name: torusguard-harden
 description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions) via CLI or AI Agent.
-version: 1.3.6
+version: 2.0.0
 workflow: .torusguard/workflows/harden.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/harden_runner.py
-  - .torusguard/scripts/diff_guard.py
-  - .torusguard/scripts/term_ui.py
+  - internal/harden/harden.go
+  - internal/harden/patch.go
+  - internal/harden/reflection.go
+  - cmd/torusguard/main.go
 ---
 
 # TorusGuard Harden — Governed Remediation & Bundle Packaging
 
 ## Objective
-Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs into auditable remediation bundles ready for review.
+Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs or semantic reflection patches into auditable remediation bundles ready for review.
 
 ---
 
-## Two Execution Modes
+## Tri-Mode Execution
 
 ### Mode A: Automated CLI Execution (Recommended First Step)
 Run the autonomous remediation engine via the terminal:
 ```bash
-# Harden latest audit run
-npx torusguard harden
+# Validate candidate patch or semantic patch against Ponytail bounds
+torusguard harden candidate.patch
 
-# Harden specific project directory
-npx torusguard harden ./my-project
-
-# Harden specific run ID
-npx torusguard harden --run run-20260910-121618-audit
-
-# Machine-readable JSON output
-npx torusguard harden --json
+# Validate semantic JSON patch
+torusguard harden patch.json
 ```
-**Under the Hood:** Executes `python .torusguard/scripts/harden_runner.py`.
-- Discovers findings in `.torusguard/runs/<run_id>/findings.json`.
-- Matches findings against canonical AST patch templates (`TG-SEC-*`, `TG-INPUT-*`, `TG-DB-*`, `TG-PLATFORM-*`, `TG-AUTH-*`, `TG-DIFF-*`).
-- Validates that every candidate patch strictly satisfies Ponytail bounds ($\le 35$ additions, $\le 25$ deletions).
-- Packages candidate bundles into `.torusguard/runs/<run_id>/bundles/<bundle_id>/` containing `patch.diff`, `minimal_patch_plan.md`, and `metadata.json`.
-- Emits run-level summary `remediation.md`.
+**Under the Hood:** Executes compiled Go hardening engine (`internal/harden`).
+- Evaluates patch churn strictly against Ponytail bounds ($\le 35$ additions, $\le 25$ deletions).
+- Scans replacement code for security bypasses (`# nosec`, `verify=False`, `InsecureSkipVerify: true`).
+- Supports both unified diff files (`.diff`, `.patch`) and Semantic Reflection JSON files.
 - Renders pixel-perfect 75-column terminal cards.
 
 ### Mode B: In-Session AI Chat Agent Remediation
-When findings require complex architectural changes, or when the automated CLI cannot formulate a template match:
-1. **Locate Target Finding:** Inspect `.torusguard/runs/<run_id>/findings.md` or `findings.json`.
-2. **Inspect AST Context:** Read surrounding lines ($\pm 15$) of the vulnerable sink using `view_file`.
-3. **Formulate Minimal Fix:** Craft a surgical code modification:
+When findings require complex architectural changes, or when formulating fixes:
+1. **Locate Target Finding:** Inspect `security_report.md` at workspace root.
+2. **Inspect AST Context (1/9th Token Strategy):** Inspect only surrounding lines ($\pm 3$ lines) via `ExtractContext` rather than ingesting entire files.
+3. **Formulate Minimal Semantic Patch:** Formulate a surgical code modification using the Line-Level Reflection Module:
+   - Provide `target_file`, `find_snippet`, and `replace_snippet`.
    - Parameterize SQL queries (replace concatenation with `?` or `$1` or `%s`).
-   - Add tenant isolation (`where: { tenantId }`, `organization_id=...`).
-   - Replace unsafe HTML injection (`dangerouslySetInnerHTML`, `.innerHTML = ...`) with safe text rendering (`textContent`, React elements).
-   - Sanitize path traversal using `path.basename()` or `os.path.basename()`.
-   - Constrain wildcard CORS headers to verified origin environment variables.
-   - Restore TLS verification flags (`verify=True`, `rejectUnauthorized: true`).
+   - Add tenant isolation (`where: { tenantId: user.tenantId }`).
+   - Replace unsafe HTML injection with safe text rendering (`textContent`).
+   - Sanitize path traversal using `filepath.Base()` or `path.basename()`.
+   - Restore TLS verification flags.
 4. **Validate Ponytail Bounds:** Count additions ($\le 35$) and deletions ($\le 25$). Never perform full-file rewrites.
-5. **Package Bundle Artifacts:** Write bundle under `.torusguard/runs/<run_id>/bundles/<bundle_id>/`:
-   - `patch.diff`: Standard unified diff.
-   - `minimal_patch_plan.md`: Context, rationale, and diff preview.
-   - `metadata.json`: Bundle metadata.
-6. **Report to Operator:** Present proposed diff card and recommend running `/torusguard apply` or `npx torusguard apply`.
+5. **Report to Operator:** Present proposed diff card and recommend running `/torusguard apply` or `torusguard apply`.
+
+### Mode C: Native MCP Tool Execution
+For autonomous AI coding agents (Antigravity, Cursor, Windsurf, Claude Code):
+- **Tool Invocation:** Call `torusguard_harden` with semantic reflection arguments:
+  ```json
+  {
+    "target_file": "src/controllers/userController.js",
+    "find_snippet": "const query = `SELECT * FROM users WHERE id = ${req.params.id}`;",
+    "replace_snippet": "const query = 'SELECT * FROM users WHERE id = ? AND tenant_id = ?';\nconst params = [req.params.id, req.user.tenantId];"
+  }
+  ```
+- **Programmatic Return:** Receives exact line ranges matched by Go AST, calculated additions/deletions, and verification that no `# nosec` or security bypasses exist.
 
 ---
 
-## Remediation Bundle Structure
-```
-.torusguard/runs/<run_id>/
-├── remediation.md                         # Run-level catalog of formulated candidate patches
-└── bundles/
-    └── bnd-<rule_id>-<line>-<hash>/
-        ├── patch.diff                    # Unified diff preview
-        ├── minimal_patch_plan.md         # Detailed explanation, rationale, and churn stats
-        └── metadata.json                 # Machine-readable bundle metadata
+## 🏛️ Line-Level Reflection Module (OpenCodeReview Hybrid Engine)
+Instead of forcing the LLM to guess error-prone unified diff line offsets (`@@ -14,6 +14,8 @@`), TorusGuard allows formulating **Semantic Patches**:
+```json
+{
+  "target_file": "server/index.js",
+  "rule_id": "TG-SEC-001",
+  "find_snippet": "const jwtSecret = 'hardcoded-dev-secret-key-12345';",
+  "replace_snippet": "const jwtSecret = process.env.JWT_SECRET;",
+  "rationale": "Extracted hardcoded JWT secret to environment variable"
+}
 ```
+The Go engine deterministically matches `find_snippet` against the target file, counts additions/deletions, verifies Ponytail bounds, and guarantees zero line-number drift.
 
 ---
 
@@ -90,9 +92,38 @@ When findings require complex architectural changes, or when the automated CLI c
 - **Target Finding:** `[TG-SEC-001]` at `server/index.js:9`
 - **Ponytail Churn:** +1 / -1 (Compliant <= 35 add, <= 25 del)
 - **Strategy:** Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
-- **Bundle Directory:** `.torusguard/runs/<run_id>/bundles/bnd-tg-sec-001-9-a8310c/`
-- **Next Step:** Run `npx torusguard apply` or `/torusguard apply` to review and apply
+- **Mode:** Line-Level Reflection Match (Semantic Patch)
+- **Next Step:** Run `torusguard apply` or `/torusguard apply` to review and apply
 ```
 
-## Living Report Ground Truth
-- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.
+---
+
+## 🚨 LLM Trap Table
+
+| Pattern | What AI Does Wrong | What Is Actually Correct |
+| :--- | :--- | :--- |
+| **Line-Number Drift** | Formulates diff headers with estimated line numbers that fail `git apply`. | Use semantic patches (`find_snippet` -> `replace_snippet`) so Go reflection pins line bounds. |
+| **Exceeding Ponytail Budget** | Produces patches with +50 additions or +40 deletions rewriting surrounding logic. | Split complex remediations or keep changes surgical ($\le 35$ additions, $\le 25$ deletions). |
+| **Introducing Bypass Flags** | Inserts `# nosec`, `verify=False`, or `@csrf_exempt` to quickly silence warnings. | Fix the root cause without disabling security invariants. Bypasses trigger immediate error. |
+| **Formatting Unrelated Lines** | Re-indents or cleans up imports in unrelated sections of the target file. | Zero unrelated churn. Touch only the lines required for vulnerability remediation. |
+
+---
+
+## ✅ Pre-Flight Self-Audit
+
+Before formulating a remediation bundle, verify:
+- [ ] Did I read only the bounded AST context window ($\pm 3$ lines) to keep tokens minimal?
+- [ ] Is `find_snippet` an exact, verbatim substring of the target file?
+- [ ] Are total additions $\le 35$ and deletions $\le 25$?
+- [ ] Does `replace_snippet` strictly avoid any bypass flags (`# nosec`, `verify=False`)?
+- [ ] Does the fix preserve existing application behavior and business contracts?
+
+---
+
+## 🔁 VBC Protocol (Verify → Build → Confirm)
+
+```
+VERIFY: Inspect target finding context and verify verbatim match of find_snippet in source code.
+BUILD:  Formulate minimal SemanticPatch or unified diff conforming to Ponytail budget (<=35 add, <=25 del).
+CONFIRM: Validate via torusguard harden or torusguard_harden MCP tool; verify zero bypass rejections.
+```