torusguard 2.0.0-alpha → 2.1.0

package/.torusguard/workflows/harden.md

@@ -1,16 +1,16 @@
 ---
 description: Governed remediation formulation under strict Ponytail Protocol bounds (<= 35 additions, <= 25 deletions) and bundle packaging.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: remediator
 lifecycle-phase: Phase 4 (Remediation Formulation)
 required-skills:
   - torusguard-harden
 scripts-binding:
-  - .torusguard/scripts/harden_runner.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/diff_guard.py
+  - internal/harden/patch.go
+  - internal/harden/reflection.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard harden — Governed Remediation & Bundle Packaging
@@ -20,31 +20,29 @@ $ARGUMENTS
 ---
 
 ## Objective
-Governed remediation formulation under strict Ponytail Protocol bounds (<=35 add, <=25 del).
+Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$ additions, $\le 25$ deletions), packaging unified diffs or semantic reflection patches into auditable remediation bundles ready for review.
+
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard harden <candidate.patch \| patch.json>` | Shell validation of patch against Ponytail bounds. |
+| **Mode B: AI Chat Slash** | `/torusguard harden` | Formulate semantic patch with Line-Level Reflection. |
+| **Mode C: Native MCP Tool** | `torusguard_harden` | Automated validation of patch file or `find_snippet` / `replace_snippet`. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect finding targets and patch constraints before generating diffs:
-1. **Target Finding (`findings.md`):** Identify prioritized verified findings.
+1. **Target Finding (`security_report.md`):** Identify prioritized verified findings.
 2. **Ponytail Protocol:** Enforce hard limit ($\le 35$ additions, $\le 25$ deletions). Ban rewrites.
-3. **Sensitive Path Review:** Flag changes touching `auth/` or `settings.py` for human sign-off.
+3. **Sensitive Path Review:** Flag changes touching `auth/` or credentials for explicit sign-off.
 4. **Behavior Preservation:** Ensure patch addresses flaw without breaking public APIs.
 5. **Dry-Run Rule:** Do NOT apply changes to disk during harden; emit bundle for review.
-6. **Backup Readiness:** Ensure rollback procedures are prepared before staging patch.
-
----
-
-## When to Use /torusguard harden
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Formulating minimal patches for verified findings | Run `/torusguard harden` |
-| Packaging a 4-artifact remediation bundle for review | Run `/torusguard harden` |
-| Writing and applying changes to code files | Run `/torusguard apply` |
-| Differentially re-scanning code after patch application | Run `/torusguard recheck` |
-| Discovering new vulnerabilities | Run `/torusguard audit` |
+6. **Zero Bypasses:** Reject `# nosec`, `verify=False`, or `InsecureSkipVerify` under rule `TG-DIFF-001`.
 
 ---
 
@@ -52,30 +50,15 @@ Inspect finding targets and patch constraints before generating diffs:
 - Candidate patches transition findings in `security_report.md` into `CANDIDATE 🟡` status.
 - Every patch strictly conforms to Ponytail bounds (<= 35 additions, <= 25 deletions).
 
-## Execution Steps
-
-1. **Select Target Finding:** Choose verified flaw from active run directory.
-2. **Examine Live Code Context:** Read surrounding lines (±15) of vulnerable sink.
-3. **Draft Unified Diff:** Formulate minimal fix adhering to Ponytail Protocol limits.
-4. **Audit Patch Safety:** Run `python .torusguard/scripts/diff_guard.py <patch.diff>`.
-5. **Package 4-Artifact Bundle:** Write `patch.diff`, `plan.md`, `verification.md`, `rollback.md` to `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
-
----
-
-## Failure Recovery
-
-- **Line Churn Exceeded (>35 add or >25 del):** Decompose patch into smaller sequential sub-fixes.
-- **Sensitive Path Conflict:** Mark bundle with `Requires Sensitive-Path Sign-Off` in `plan.md`.
-- **Finding Not Found:** Ensure finding ID exists in active `findings.md`.
-- **Halt Trigger:** Abort if target source file cannot be read from disk.
-
 ---
 
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never generate full-file replacements or unconstrained cosmetic code refactoring.
-- ❌ Never modify imports, variables, or functions unrelated to the vulnerability.
-- ✅ Always calculate addition and deletion line counts before emitting `patch.diff`.
+1. **Select Target Finding:** Choose verified flaw from `security_report.md`.
+2. **Examine Live Code Context:** Read surrounding lines ($\pm 3$) using bounded context extraction.
+3. **Formulate Minimal Semantic Patch:** Formulate `find_snippet` and `replace_snippet`.
+4. **Audit Patch Safety:** Run `torusguard harden` or call `torusguard_harden`.
+5. **Package Bundle:** Prepare candidate patch ready for the Human Gate.
 
 ---
 
@@ -84,10 +67,8 @@ Inspect finding targets and patch constraints before generating diffs:
 ```markdown
 ### 🛠️ TorusGuard Remediation Bundle
 - **Finding Target:** `TG-XXX-HASH` ([Vulnerability Name])
-- **File Affected:** `src/path/to/file.py`
+- **File Affected:** `src/path/to/file`
 - **Line Churn:** +[Additions] / -[Deletions] (Ponytail: PASS)
-- **Sensitive Path:** [Yes (Sign-Off Needed) / No (Standard)]
-- **Bundle Path:** `.torusguard/runs/<run_id>/remediation/<finding_id>/`
 - **Status:** READY FOR REVIEW — run `/torusguard apply` to execute
 ```
 
@@ -95,5 +76,5 @@ Inspect finding targets and patch constraints before generating diffs:
 
 ## Next Steps
 
-1. Review proposed diff in `.torusguard/runs/<run_id>/remediation/<finding_id>/patch.diff`.
-2. Run `/torusguard apply` to execute the governed patch with automatic rollback backup.
+1. Review proposed diff or semantic reflection snippet.
+2. Run `/torusguard apply` or `torusguard apply` with Human Gate approval.

package/.torusguard/workflows/init.md

@@ -1,14 +1,15 @@
 ---
 description: Baseline project discovery, workspace scaffolding, stack detection, and framework-tailored security rule activation.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: profiler
 lifecycle-phase: Phase 0 (Baseline Setup)
 required-skills:
   - torusguard-init
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/stack_detect.py
+  - internal/workspace/workspace.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard init — Project Baseline & Workspace Initialization
@@ -18,65 +19,42 @@ $ARGUMENTS
 ---
 
 ## Objective
-Baseline project discovery, workspace scaffolding, stack detection, and security rule activation.
+Baseline project discovery, workspace scaffolding across polyglot stacks, and activation of 74 canonical security rules across 18 families.
 
 ---
 
-## Mandatory Pre-Flight Context Inspection
+## Tri-Mode Execution
 
-Inspect workspace state before running initialization:
-1. **Config State (`.torusguard/config/torusguard.json`):** Check if workspace is already initialized. If active, prompt before re-writing.
-2. **Project Manifests:** Check root for `package.json`, `manage.py`, `requirements.txt`, `pyproject.toml`, `go.mod`, or `Cargo.toml`.
-3. **Disclosure Policy (`SECURITY.md`):** Check for existing responsible disclosure policy.
-4. **Bootstrapper:** If `.torusguard/` is absent, invoke `python skills/torusguard/bootstrap.py` to unpack offline assets.
-5. **Runtime Preconditions:** Ensure Python 3.10+ is available in the current execution shell.
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard init [--force] [--stack <name>]` | Terminal execution of workspace scaffolder. |
+| **Mode B: AI Chat Slash** | `/torusguard init` | Conversational stack profiling and rule activation. |
+| **Mode C: Native MCP Tool** | Administrative Command | Agents execute `torusguard init` via shell and monitor via `torusguard_status`. |
 
 ---
 
-## When to Use /torusguard init
+## Mandatory Pre-Flight Context Inspection
 
-| Trigger Scenario | Recommended Command |
-| :--- | :--- |
-| First-time onboarding in any repository | Run `/torusguard init` |
-| Framework upgrade or major dependency changes | Run `/torusguard init` to refresh tailored rules |
-| Repository already configured | Run `/torusguard audit` |
-| Inspecting existing configuration | Run `/torusguard status` |
-| Testing legal boundaries | Run `/torusguard authorize` |
+Inspect workspace state before running initialization:
+1. **Config State (`.torusguard/config/torusguard.json`):** Check if workspace is already initialized.
+2. **Project Manifests:** Check root for `package.json`, `go.mod`, `Cargo.toml`, `requirements.txt`, `pyproject.toml`.
+3. **Disclosure Policy (`SECURITY.md`):** Check for existing responsible disclosure policy.
 
 ---
 
 ## Living Report Invariant
-- Provisions baseline `security_report.md` single-source-of-truth ledger.
+- Provisions baseline `SECURITY.md` responsible disclosure policy.
 - Activates tailored rules across 18 families based on detected stack.
 
-## Execution Steps
-
-1. **Scaffold Directory Topology:** Verify `.torusguard/` structure (`config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`).
-2. **Execute Stack Detection:**
-   ```bash
-   python .torusguard/scripts/stack_detect.py .
-   ```
-3. **Activate Tailored Rules:** Symlink or copy matching security rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
-4. **Write Configuration (`.torusguard/config/torusguard.json`):**
-   Record detected stack, enabled rules count, timestamp, and runtime constraints.
-5. **Verify Initialization:** Assert `.torusguard/config/torusguard.json` and `.torusguard/config/scope.json` exist.
-
 ---
 
-## Failure Recovery
-
-- **Script Exit 1 (Detection Failed):** Check Python version (`python --version` >= 3.10) and verify read access to root manifests.
-- **Permission Error:** Verify write permissions for `.torusguard/config/` and `.torusguard/rules/active/`.
-- **Missing Directories:** Re-run directory scaffolding if any subfolder creation fails.
-- **Halt Condition:** If root directory is empty, halt and prompt user to open the project root.
-
----
-
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never invent framework dependencies not present in `package.json` or `requirements.txt`.
-- ❌ Never overwrite an existing `.torusguard/config/scope.json` containing authorized domains.
-- ✅ Always execute `.torusguard/scripts/stack_detect.py` to ground detected technologies.
+1. **Scaffold Directory Topology:** Create `.torusguard/` structure (`config/`, `rules/active/`, `runs/`, `snapshots/`, `memory/`).
+2. **Detect Stack:** Automatically identify frameworks across 16+ polyglot languages.
+3. **Persist Configuration:** Write `.torusguard/config/torusguard.json`.
+4. **Provision Policy:** Generate baseline `SECURITY.md` at workspace root.
+5. **Recommend Audit:** Direct user to `/torusguard audit` or `torusguard audit`.
 
 ---
 
@@ -84,11 +62,10 @@ Inspect workspace state before running initialization:
 
 ```markdown
 ### 🛡️ TorusGuard Workspace Initialization
-- **Primary Framework:** [Detected Stack or None]
-- **Components:** [Backend / Frontend / Database]
-- **Active Rules:** [Count] rules enabled in `.torusguard/rules/active/`
+- **Primary Framework:** [Detected Stack]
+- **Active Rules:** 74 rules enabled across 18 families
 - **Config:** `.torusguard/config/torusguard.json` generated
-- **Scope Template:** `.torusguard/config/scope.json` ready
+- **Policy:** `SECURITY.md` provisioned
 - **Status:** READY — run `/torusguard audit` to scan codebase
 ```
 

package/.torusguard/workflows/memory.md

@@ -1,14 +1,15 @@
 ---
 description: TorusGuard Adaptive Security Memory Engine — view memory stats, export/import intelligence, apply TTL decay, and manage false positives.
-tools: Read, Grep, Glob, Bash
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: Intelligence / Memory
 required-skills:
   - torusguard
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/memory_engine.py
+  - internal/memory/recipes.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard memory — Adaptive Security Memory Engine & Intelligence Management
@@ -18,37 +19,31 @@ $ARGUMENTS
 ---
 
 ## Objective
-Inspect, manage, export, import, or compact persistent local security memory patterns, context window cards, and false positive suppressions.
+Inspect, manage, export, import, or compact persistent local security memory patterns, context window cards, and Golden Fix Recipes.
 
 ---
 
-## Subcommands & Usage
+## Tri-Mode Execution
 
-| Command | Action | Description |
+| Mode | Command / Tool | Execution Method |
 | :--- | :--- | :--- |
-| `npx torusguard memory` | Status | Display memory stats, pattern count, and context token estimate |
-| `npx torusguard memory context` | Context Dump | Output the active pre-computed context window cards |
-| `npx torusguard memory fp --rule <RULE_ID>` | False Positive | Suppress rule as false positive across future scans |
-| `npx torusguard memory decay [--ttl 90]` | TTL Decay | Apply confidence decay to stale, unconfirmed patterns |
-| `npx torusguard memory export --path <FILE>` | Export | Export memory bundle for team sharing |
-| `npx torusguard memory import --path <FILE>` | Import | Merge external memory bundle into local project intelligence |
-| `npx torusguard memory compact` | Compaction | Archive raw events older than 30 days into single archive |
+| **Mode A: Terminal CLI** | `torusguard recipes [list \| show \| export]` | Terminal management of Golden Fix Recipes. |
+| **Mode B: AI Chat Slash** | `/torusguard recipes` | Interactive exploration of verified remediation patterns. |
+| **Mode C: Native MCP Tool** | `torusguard://rules_catalog` | Programmatic access to catalog rules and distilled patterns. |
 
 ---
 
-## Execution Steps
+## Subcommands & Usage
 
-1. **Verify Memory Subsystem:** Confirm `.torusguard/memory/` exists and is shielded by `.gitignore`.
-2. **Execute Requested Action:** Invoke `.torusguard/scripts/memory_engine.py` with appropriate action flag:
-   ```bash
-   python .torusguard/scripts/memory_engine.py --action status
-   ```
-3. **Verify Context Token Budget:** Confirm `context.json` remains within token budget ($\le 2,000$ tokens).
-4. **Display Intelligence Card:** Render summary card to user.
+| Command | Action | Description |
+| :--- | :--- | :--- |
+| `torusguard recipes` | List | Display Golden Fix recipes library |
+| `torusguard recipes list` | Catalog | Enumerate verified fix patterns |
+| `torusguard recipes export` | Export | Export memory bundle for team sharing |
 
 ---
 
 ## Privacy & Security Invariants
 - Memory files remain strictly local under `.torusguard/memory/` and are always gitignored.
-- Memory files are never packaged into npm release tarballs.
+- Memory files are never packaged into release tarballs.
 - Export operations only occur when explicitly invoked by user command.

package/.torusguard/workflows/ocr-scan.md

@@ -0,0 +1,25 @@
+# /torusguard-ocr-scan — Multi-Modal OCR Secret Scanning
+
+$ARGUMENTS
+
+---
+
+## Objective
+Detect optical leaks of private API keys, AWS credentials, database URIs, GitHub personal access tokens, and private certificates embedded inside visual artifacts (`.png`, `.jpg`, `.jpeg`, `.webp`, `.bmp`, `.tiff`) up to 10MB using Tesseract OCR and deterministic regex signatures.
+
+---
+
+## Tri-Mode Parity
+- **Mode A (Terminal CLI):** `torusguard ocr-scan <target>`
+- **Mode B (AI Chat Slash Command):** `/torusguard ocr-scan <target>`
+- **Mode C (Native MCP Tool):** `torusguard_ocr_scan`
+
+---
+
+## Execution Steps
+
+1. **Verify Target:** Check target image or directory exists on disk.
+2. **Inspect File Size:** Reject images exceeding 10MB (`DefaultMaxImageSize`) to preserve DoS resilience.
+3. **Execute OCR Extraction:** Run Tesseract optical text analysis via Go scanner or MCP tool.
+4. **Pattern Match Secrets:** Evaluate optical text against `TG-SEC-001` through `TG-SEC-007` signatures.
+5. **Redact & Report:** Emit sanitized finding cards and synchronize into `security_report.md`.

package/.torusguard/workflows/recheck.md

@@ -1,16 +1,15 @@
 ---
 description: Targeted differential AST re-scan, fix closure verification, and regression state machine transitions.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: Phase 6 (Targeted Recheck & Verification)
 required-skills:
   - torusguard-recheck
 scripts-binding:
-  - .torusguard/scripts/recheck_runner.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/finding_scorer.py
+  - internal/recheck/recheck.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard recheck — Targeted Differential Recheck & Regression Audit
@@ -20,31 +19,28 @@ $ARGUMENTS
 ---
 
 ## Objective
-Targeted differential AST re-scan, fix closure verification, and regression state transitions.
+Targeted differential AST re-scan, fix closure verification, and regression state machine transitions across modified files.
+
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard recheck` | Terminal execution of differential AST scanner. |
+| **Mode B: AI Chat Slash** | `/torusguard recheck` | Conversational differential review and regression verification. |
+| **Mode C: Native MCP Tool** | `torusguard_recheck` | Agent tool call with `{"target": "."}` returning diff assertions. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect applied patch history and target file scope before re-checking:
-1. **Applied Patch Record:** Verify `apply-log.json` or modified file list exists in the active run.
+1. **Applied Patch Record:** Inspect git status or diff for modified files.
 2. **Scope Limitation:** Restrict differential scan strictly to modified files to conserve token budget.
-3. **Rollback Availability:** Confirm `.bak` snapshot exists in `pre_apply/` in case regression is detected.
+3. **Rollback Availability:** Confirm `.bak` snapshot exists in `.torusguard/snapshots/` in case regression is detected.
 4. **4-State Transition Engine:** Prepare to transition findings to `Fixed`, `Partially Fixed`, `Not Fixed`, or `Regression`.
 5. **Fresh Syntax Validation:** Ensure no compiler or syntax errors exist before re-evaluating rules.
-6. **AST Consistency:** Ensure imported dependencies on modified lines resolve correctly.
-
----
-
-## When to Use /torusguard recheck
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Immediately after applying a remediation patch | Run `/torusguard recheck` |
-| Verifying that a specific finding is eliminated | Run `/torusguard recheck` |
-| Checking whether a patch introduced new security flaws | Run `/torusguard recheck` |
-| Whole repository baseline audit | Run `/torusguard audit` |
-| Generating final signed release report | Run `/torusguard report` |
 
 ---
 
@@ -52,32 +48,19 @@ Inspect applied patch history and target file scope before re-checking:
 - Verified fix closures transition findings in `security_report.md` to `RESOLVED 🟢`.
 - Regressions transition findings to `REGRESSED ❌`.
 
-## Execution Steps
-
-1. **Identify Modified Files:** Extract list of altered files from latest apply step.
-2. **Execute Differential AST Scan:** Re-run active security rules exclusively against modified files.
-3. **Evaluate Finding Status:**
-   - If original vulnerable AST pattern is absent and no new sink appears: transition to `Fixed`.
-   - If new security rule triggers on altered lines: classify as `Regression`.
-4. **Update Finding State:** Record verified resolution status into `findings.json`.
-5. **Emit Recheck Report:** Write `recheck-report.md` into the active run folder.
-
----
-
-## Failure Recovery
-
-- **Finding Still Present (`Not Fixed`):** Review patch diff; the remediation did not neutralize the AST sink.
-- **New Vulnerability Detected (`Regression`):** Alert operator; prompt to revert from `.bak` snapshot.
-- **File Not Found:** Verify file path matches git repository layout.
-- **Halt Trigger:** Abort if diff shows changes outside approved patch scope.
-
 ---
 
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never mark a finding as `Fixed` without re-scanning the actual AST of the patched file.
-- ❌ Never ignore new warnings introduced in modified lines.
-- ✅ Always provide before/after line comparisons confirming sink removal.
+1. **Trigger Recheck:**
+   - **Mode A (CLI):** Run `torusguard recheck`.
+   - **Mode B (Chat):** Review modified files and re-scan AST sinks.
+   - **Mode C (MCP):** Call `torusguard_recheck`.
+2. **Evaluate Finding Status:**
+   - If original vulnerable pattern is absent and no new sink appears: transition to `✔ [Confirmed Fixed]`.
+   - If new security rule triggers on altered lines: classify as `✖ [Regressed]`.
+3. **Update Finding State:** Update `security_report.md`.
+4. **Recommend Posture Report:** Advise running `torusguard report --html`.
 
 ---
 
@@ -89,7 +72,6 @@ Inspect applied patch history and target file scope before re-checking:
 - **Target Finding:** `TG-XXX-HASH`
 - **Result:** [FIXED / REGRESSION / PARTIAL]
 - **Regressions Introduced:** 0
-- **Report:** `.torusguard/runs/<run_id>/recheck-report.md`
 - **Status:** VERIFIED — ready for `/torusguard report`
 ```
 

package/.torusguard/workflows/redos.md

@@ -0,0 +1,27 @@
+# /torusguard-redos — Regular Expression Complexity Scanner
+
+$ARGUMENTS
+
+---
+
+## Objective
+Detect and remediate catastrophic exponential ($O(2^n)$) and polynomial backtracking regular expressions in web applications to prevent availability and thread starvation DoS attacks.
+
+---
+
+## Tri-Mode Parity
+- **Mode A (Terminal CLI):** `torusguard redos [target]`
+- **Mode B (AI Chat Slash Command):** `/torusguard redos [target]`
+- **Mode C (Native MCP Tool):** `torusguard_redos`
+
+---
+
+## Execution Steps
+
+1. **Locate Regex Definitions:** Walk source tree to find regex literals and constructor calls (`RegExp`, `re.compile`, `regexp.MustCompile`).
+2. **Analyze Backtracking Complexity:**
+   - Detect nested quantifiers (`(x+)+`, `(x*)*`) causing $O(2^n)$ exponential blowup (`TG-REDOS-001`).
+   - Detect overlapping alternations with outer repetition causing polynomial blowup (`TG-REDOS-002`).
+3. **Audit Input Length Guardrails:** Check if untrusted inputs evaluated against regexes are bounded in character length.
+4. **Formulate Safe Remediation:** Refactor vulnerable regexes into linear deterministic expressions, anchor tokens, or parser logic.
+5. **Synchronize Report:** Log all ReDoS findings in `security_report.md`.

package/.torusguard/workflows/report.md

@@ -1,16 +1,16 @@
 ---
 description: Executive posture reporting, cluster analysis, signed compliance audit, and OASIS SARIF v2.1.0 structured export.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: Phase 7 (Reporting & SARIF Export)
 required-skills:
   - torusguard-report
 scripts-binding:
-  - .torusguard/scripts/html_reporter.py
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/sarif_exporter.py
-  - .torusguard/scripts/run_manager.py
+  - internal/report/html.go
+  - internal/report/sarif.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard report — Unified Security Posture Report & SARIF Export
@@ -20,30 +20,28 @@ $ARGUMENTS
 ---
 
 ## Objective
-Executive posture reporting, cluster analysis, signed compliance audit, and SARIF v2.1.0 export.
+Executive posture reporting, cluster analysis, signed compliance audit, and OASIS SARIF v2.1.0 export.
+
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard report --html [--sarif]` | Shell compilation of HTML dashboard and SARIF log. |
+| **Mode B: AI Chat Slash** | `/torusguard report` | Executive summary generation and posture calculation. |
+| **Mode C: Native MCP Tool** | `torusguard://security_report` | Agent reads resource payload directly from living report. |
 
 ---
 
 ## Mandatory Pre-Flight Context Inspection
 
 Inspect run records and reporting parameters before generating release artifacts:
-1. **Active Run Records:** Ensure target run folder contains `findings.json` or `findings.md`.
+1. **Living Report State:** Ensure `security_report.md` exists and reflects latest findings.
 2. **SARIF v2.1.0 Schema:** Validate output structure against official OASIS SARIF standard.
 3. **Multi-Analysis Category:** Tag static findings under category `torusguard/static` to prevent CI collision.
 4. **Secret Masking:** Ensure zero unredacted authorization tokens or API keys appear in report.
-5. **Role Boundary:** Enforce reviewer agent sign-off before archiving run results.
-
----
-
-## When to Use /torusguard report
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Concluding a security review cycle or audit milestone | Run `/torusguard report` |
-| Exporting SARIF v2.1.0 logs for GitHub Code Scanning | Run `/torusguard report` |
-| Sharing executive posture summaries with stakeholders | Run `/torusguard report` |
-| Applying code modifications | Run `/torusguard apply` |
-| Re-checking modified files | Run `/torusguard recheck` |
+5. **Zero-CDN Guarantee:** Ensure HTML report contains zero external CDN script dependencies.
 
 ---
 
@@ -51,33 +49,17 @@ Inspect run records and reporting parameters before generating release artifacts
 - Executive posture reports incorporate health scoring and metrics from `security_report.md`.
 - Emits visual dark-mode HTML (`--html`) and OASIS SARIF v2.1.0 (`--sarif`).
 
-## Execution Steps
-
-1. **Aggregate Lifecycle Data:** Load all finding cards, verification traces, and recheck logs.
-2. **Export OASIS SARIF v2.1.0:**
-   ```bash
-   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
-   ```
-3. **Compile Executive Markdown Report:** Generate `report.md` with executive summary, posture score, and metrics.
-4. **Sign Off Run Manifest:** Update `.torusguard/runs/<run_id>/manifest.json` with final status counts.
-5. **Archive Results:** Confirm artifacts (`report.md`, `results.sarif`, `summary.md`) are saved on disk.
-
----
-
-## Failure Recovery
-
-- **SARIF Schema Error:** Re-run `sarif_exporter.py` with schema validation flag to locate invalid properties.
-- **Empty Findings List:** Emit valid clean report indicating zero security vulnerabilities detected.
-- **Missing Run Folder:** Point script to latest valid timestamped run in `.torusguard/runs/`.
-- **Halt Trigger:** Abort if unredacted private secrets are detected in output text.
-
 ---
 
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never invent vulnerability counts not backed by actual findings in the run ledger.
-- ❌ Never generate invalid SARIF JSON with missing physical location URIs.
-- ✅ Always export standard-compliant SARIF v2.1.0 with AST line fingerprints.
+1. **Trigger Report Generation:**
+   - **Mode A (CLI):** Run `torusguard report --html --sarif`.
+   - **Mode B (Chat):** Calculate posture score from `security_report.md` and present summary card.
+   - **Mode C (MCP):** Query resource `torusguard://security_report`.
+2. **Compile Visual HTML:** Generate zero-dependency dark-mode HTML dashboard at `report.html`.
+3. **Export SARIF v2.1.0:** Produce schema-compliant SARIF log for CI/CD pipelines.
+4. **Sign Off Ledger:** Confirm artifacts are persisted to disk.
 
 ---
 
@@ -85,12 +67,11 @@ Inspect run records and reporting parameters before generating release artifacts
 
 ```markdown
 ### 📊 TorusGuard Security Posture Report
-- **Run ID:** `run-YYYYMMDD-HHMMSS`
-- **Total Findings:** [Count] ([Fixed] Fixed, [Open] Open)
-- **Security Posture Score:** [Score]/100
-- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif`
-- **Executive Report:** `.torusguard/runs/<run_id>/report.md`
-- **Status:** COMPLETE — report published
+- **Posture Score:** 100/100 (OPTIMAL DEFENSE)
+- **Total Invariants:** 74 Defended across 18 families
+- **HTML Dashboard:** `report.html`
+- **SARIF v2.1.0 Export:** `results.sarif`
+- **Living Ledger:** `security_report.md`
 ```
 
 ---
@@ -98,4 +79,4 @@ Inspect run records and reporting parameters before generating release artifacts
 ## Next Steps
 
 1. Upload `results.sarif` to GitHub Code Scanning via `.github/workflows/`.
-2. Share `report.md` with engineering stakeholders and project maintainers.
+2. Open `report.html` in browser for visual audit presentation.