torusguard 2.0.0-alpha → 2.1.1

package/.torusguard/.manifest.json

@@ -1,7 +1,7 @@
 {
   "ARCHITECTURE.md": "cdc690a856e82574a6574ab6b1ad8a2d8b3b8264c36931c6212321066eed82e4",
   "TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
-  "rules_catalog.json": "e0b32c1bdde0f19fa390aba26a02b7e5ba1b59b251f9fffd501815b48f2d9af9",
+  "rules_catalog.json": "11240a887dbe457ef5fbe621dabc08ea4e3bc273b56fce85f517df7b6ad19f55",
   "agents/auditor.md": "4ba2c92982823d0886c7ae369126cd5ddd322085a85d3b7e7fa23154f8753314",
   "agents/profiler.md": "0ee9ebbddf4ebd557d454dda8472fffea471e263abeccf40298163084b7ce9a9",
   "agents/remediator.md": "f708a0e315760e8d519bd640d22bdf6b7ec61ed7de3da69bd038bd60dc3d5b47",
@@ -10,6 +10,45 @@
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "305c1dc5b556e8d64ad9dd585dafac1a9955cf1bd5321429955b19b7a62736b6",
   "config/torusguard.json": "55dbde335997421a01c97709fd1672ad70fa921bfe8346dd57552b799db2419e",
+  "core/__init__.py": "2120562452ae03c84468d67246dc93376f7ebcde8e4ca767c6253bc92c35dbbf",
+  "core/agent_roles.py": "d7189dbf1d3ae4e330eb316bed5d399a18992295addf466f4c6552bc14ae6a34",
+  "core/ast_walker.py": "309564d168e6eb9e3e93aceb29a95a61872b35a4da7235ee49e79e9d3a5e7cc6",
+  "core/authorization.py": "2bb7f85b4639959276fc7cfd427df7edb8b1f97f8003707a0032f100953d1b30",
+  "core/browser_verifier.py": "e450bdbb8d5c2808a3b3ea7bc33bce2451230cbbb7ed4f17dbc7107ab0f30d56",
+  "core/bundle.py": "82505fba44a5ad867a4caef34e1233ebf76d4bc2e15b943e2413822602f1a95f",
+  "core/call_graph.py": "7e230f8b5fa7dd8f780eafbe7381f2d9538f01a880c1349c41139cce20f9094f",
+  "core/clustering.py": "0ffcad5e8a459084d200248de8799d466c2b53ad627b778314b09f2733df782c",
+  "core/confidence.py": "81c6242a1a3eaea873d39e8b212e5781a2df2316614f18a2fe6ef757561f5bb5",
+  "core/cross_file_taint.py": "1fa323529e5ca2fcce06167e4a59431f9f8217ad7a5097f8afbc6b9a9dc0913d",
+  "core/exploit_checker.py": "74a48e6e1e1b9791107b487ab5434540494946441605cf9115fa90b787bc5c5a",
+  "core/formatter.py": "a9d2a20e52caaf8a801f65f325b3f5bc430eb6301506973095961d4615b7e429",
+  "core/governance.py": "657edfa332c2f855f917545862c9d38f31468cec464d11dd2c012dcf794fb32c",
+  "core/identity.py": "f42d3d81c7ee8ca5d2ef08d48066abdc42d2ccbd5fe0bbd88b35d5c8174b696f",
+  "core/import_resolver.py": "4ac89ac405816b7de599fbabfa47556d10c1557d92f3a700bf50b90f52ba6c75",
+  "core/incremental.py": "8ff9d41f6667bf567d2e952f31ae330271ba1d6cf5411ab4468c355ca2fa6681",
+  "core/lifecycle.py": "f4406acba8464ed9111128ef545f8c576639cadda8b9de7e23ff8a90fad24f9e",
+  "core/models.py": "ed23b50aab2eb7ea9bc16dbb20b0bf4f978f3aae7f39f0a713f7efe08ff238b5",
+  "core/parallel.py": "27fcfdd3760d481ffdd4e7321a79d17ef4823dd3744687fcc9d00349c0bb1d49",
+  "core/parser.py": "2f01e9beb178e86002fd8dd3211cf269ab59f21e5c65aabb5e9d0e110504d1d1",
+  "core/rechecker.py": "2a21b788158cac79db9030db79e3a27021e7f66692c37c39e0bd3fadf483388c",
+  "core/replay_trace.py": "8132cb43dd4593cc96f09f014c2b3882ef5296ebc5029a921423263b07ca7a1d",
+  "core/rules_registry.py": "80c4f5067f151b596388ae9a4546d2f009f10342daa5221412e5c9a222b27a31",
+  "core/run_folder.py": "cc8702dfd3a2768e5dca74f7ac85e316f53f1acb059bad87ca3650eeeae2defa",
+  "core/run_manager.py": "2470ebc8b54edaab3679d909fde48f02c7530f1e12c917b7b5cd5c004062a8b6",
+  "core/runtime_evidence.py": "79c947a3b131c3be2f2938789d12647a0d9010bb4077bf3f33b2c7218ba9028b",
+  "core/runtime_validator.py": "39477ef1138e8deaa5c3859d6402e71d2c0eb6e2e39fbd3db04fe3ad8e2c798c",
+  "core/safety_gate.py": "349e84187930faf79baa38643712d48636de504e8613667e42ec852999efa9fb",
+  "core/sarif.py": "93316e7d5fa0ac3660ce18307a2ef4f9c2b2b24b0a4e40d288f94edd0ef84e6d",
+  "core/stack_profiler.py": "8c5166c712d7e9341d6290b2220da05662f1ba251899d6f501a9875625f5539c",
+  "core/symbol_table.py": "8e700e01e920e7c8a496a16e400195bb6cedd9e3624997fbb44b29124e256d74",
+  "core/taint.py": "f54b3e2d620d480969681847e63149b259876dbac470dc417e90407e1def925b",
+  "core/taint_graph.py": "2f697a4d4c44801f346f7bde0794cc70c481b4a5a28fe02add20fa845fd9a5c5",
+  "core/taint_rules.py": "d29893e0212a2afb21fede6c20afb6d3fe9ff89511659675f02a034ea1e87d8f",
+  "core/v070_reporter.py": "d9e9bebd4e158f4c1b1b50897c04c2c5f9db85919b1700b47331ecf16fe7bd63",
+  "core/v070_workflow.py": "57bf1468c78f47b4aa5fb5804eb3c247825daa0933bb5cf0aad4ae2394adcead",
+  "core/v6_reporter.py": "95fa2ec5b0e708101b62131152445039192382e409d0f40c35cdcbf96648ca26",
+  "core/v6_workflow.py": "3e38afafc3afdbebe8cf76ed24da00435aab27a2ac512a292983f8b1e88ebcb8",
+  "core/watcher.py": "b3d4856023ee2f6c65b2938d3c76c246d7c440c58cdc7b642dc27209d68a959a",
   "references/csharp-security.md": "d6e267855b08ed4fdff26f3b876f089ae1f90a7ec6546cba7e8173380d9daa9d",
   "references/django-security.md": "26ea5535ac435e61489df1e381ac62b19e81702edfe095e78c937be93fa15ea7",
   "references/drf-security.md": "c6796398317b0f264d89fff598404e126d819e69e1ea0a5129924a5eb2a7af9d",
@@ -43,6 +82,8 @@
   "rules/TG-INPUT-004-unrestricted-file-upload.md": "d665fb7ede456c24d12229cec22b30374a4dc036c3fe3a41ece22f97ab78a1f4",
   "rules/TG-INPUT-005-unsafe-template-rendering-and-escaping.md": "b6006e741a303d8ff2cd65ef417e6199e5dcf8fe7d603941244db82f6cbe1753",
   "rules/TG-INPUT-006-unsafe-file-path-traversal.md": "5edb665cd2c41b659849c96d0d4b801a6365e130be12c51733a3d6f17cfd85ed",
+  "rules/TG-INPUT-007-unvalidated-redirect.md": "7da41ecbd39a7c90fe90fc683df48f38b0cf5a0d7c2b027f0827830bd8f814f7",
+  "rules/TG-INPUT-008-insecure-deserialization.md": "5f5f85a9429d32959f890f668ff1fd75bd7ce976a7b9406c3b7235fc728989ca",
   "rules/TG-PLATFORM-001-wildcard-cors-with-credentials.md": "fb8154f5b8051e94886c956b1e7bdbc5f316739795b8fb9bb493223ca774fe25",
   "rules/TG-PLATFORM-002-missing-security-headers.md": "207f489453d6256b5d794f79be25c66e9f932ae5cb561b3e8b50d26a28f6a07a",
   "rules/TG-PLATFORM-003-production-stack-trace-exposure.md": "298c75b928c160720243e42ce5bf43397e73cf50ed472482d5ef3f7635fcb839",
@@ -100,15 +141,27 @@
   "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "e84d9d314b1616bdda54345fdf0203732e68e375dc7e144d9e2aa7619f9cafb8",
   "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "4e305be49dd14a34d29c9283b535a72ad6cd84c5bd52afb3f006403f2e5a6850",
   "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "235f3eed546b58aa8f04e155aeaef4e0206dd696517a7854983ab9ce8fe61030",
+  "rules/container/TG-CONT-001-root-user-execution.md": "8cabae14353f63dffe69067c369f55c3e99d05791ff96139cd7eeff7f7db6d3f",
+  "rules/container/TG-CONT-002-docker-socket-mount.md": "e375fa7c7fda1ee026b7df9c1ae2aaf21be34926c18182daf8019479db6295fa",
+  "rules/container/TG-CONT-003-privileged-container-mode.md": "0e500f2553b9fb0865396ac8e9f7f18526af576951c72887ee30874b2b543225",
+  "rules/container/TG-CONT-004-build-arg-secret-exposure.md": "91d290078698480a1bd09e6f4d2e5930dd40c877344b25c5f1be7ca705ecdbd8",
   "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "42fcf19ae244a36b3b64d03200b6d4c1acf1b265fdb2fe6a85de8dd69b3837fe",
   "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "c01a55e31e4aaaea8c9f630b514c1ad242b513ab99111534939584ae4fe1a58c",
   "rules/custom/README.md": "f2128661ad3bc4085a69ddfbabbb2211930215fc42a25e2ab2d3e7a4b749a639",
   "rules/edge/TG-EDGE-001-serverless-global-state-leak.md": "82fe764a67228c71359b340a983cb37dc8bf4521d030846e0cea433de43c52d3",
   "rules/edge/TG-EDGE-003-aws-lambda-ephemeral-cold-start.md": "2659db7d38b6689d1d3a99ad5f2504ea264b3d3a601ab38186737b12d4d42c17",
+  "rules/git/TG-GIT-001-historical-secret-in-git-commit.md": "4a0ad519db2ff6c2311eb872d7b015d3b3a0fef114ae821e24ec640d2ca0e99e",
+  "rules/git/TG-GIT-002-plaintext-credentials-in-git-config.md": "5ec5f9e25e73e37b64b8f6861772395a37a41d3c982eb15cd5d0561311a929bc",
+  "rules/git/TG-GIT-003-sensitive-tracked-file-gitignore-breach.md": "34f54569af1fcaeb68bc9e88f3a1baf08ab74a9024f63d8059ab22fe30b2ee91",
   "rules/graphql/TG-GQL-001-missing-query-depth-or-complexity-limits.md": "bfee2cb26c71871cc4b93e224dc56c18de0d0ea692a431f7b27a51e7e408873f",
   "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "e6429fdcf130478446a2711eac83bd64cc502aad8baa35c04de26958d23e5b0f",
   "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "c2e2beb37c4d86f4ba564e1a1fd9587626df3793b9c5dc9e13d0cf0ce3bfe09a",
   "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "54311588945abc1d79e99a0001390821ccb4434772297b2395e7081d276d6602",
+  "rules/rag/TG-RAG-001-untrusted-rag-context-injection.md": "3cc4c87d373293612210b865d0c936fc5c55dfa5dac2adc8f9822e639dd1102b",
+  "rules/rag/TG-RAG-002-autonomous-llm-tool-unsandboxed-call.md": "6935f2c4b1f254148242b6e1ce656024f1cffb5432e432c038abf63094c13ad3",
+  "rules/rag/TG-RAG-003-unpartitioned-vector-tenant-lookup.md": "44722ba00bfd40a0b98abb9789b77a786ac8deed017cc6543867a131b21bbe1e",
+  "rules/redos/TG-REDOS-001-catastrophic-exponential-backtracking.md": "2cac8e899af177c03dbe01f85ac5f3d485e88ef5a08809e3bc17f676e74d5ae5",
+  "rules/redos/TG-REDOS-002-unbounded-nested-quantifier.md": "5b9032ea9268831e3ecf328039083a7dca95feb330347c29f9120db1a30e2278",
   "rules/secrets/TG-SEC-005-secret-in-git-history.md": "089dbe9653b2a4df652ba049b40147434d6abc70c239ac7db81bdcb9d6579387",
   "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "ed20b1c9044149df5257ad8140bd787db7f77063b890dad9ba32efaf4d554fe5",
   "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "b3d4b9f1d0fd9656aa9a586e133209904c1f3b75a2b7e7c1ecb825a125663e6d",
@@ -143,12 +196,12 @@
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
   "scripts/apply_runner.py": "b145a68a4bc10fcacb853f972aee81fa3607e32d282b2b850c5a63d8e72da890",
-  "scripts/audit_runner.py": "bc1e06ea5153ae326c4ad1de5d0cbb9503e618186623bea7cb8bb64d7b7b05ec",
+  "scripts/audit_runner.py": "18ebcd46f8363169db4ff4675a5258e0b93df5b219650de95b9a5e9f51da5ff9",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
-  "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
+  "scripts/finding_scorer.py": "95c7edfe5ee4742be565914f71bb07bd077b2cf4636b769476345389dd85f3cf",
   "scripts/harden_runner.py": "5d5a40029c088ccb66790a9b0128bdefcd35883ef1dac78088ceb9531392a8f1",
   "scripts/html_reporter.py": "655c57be39e13c177db8842ef471664e5853f3e43b9f2a63e590df40ff9c16cb",
-  "scripts/manifest_builder.py": "18db6979b341a87e9bf38fe06525365d12b07d532c0dbfd2ac3ef0f539dc1f6f",
+  "scripts/manifest_builder.py": "f1f9a0d63c55cf5ff45e9fd39d1b251c2bce05e777f8c1e325741d340f0128db",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
   "scripts/recheck_runner.py": "89e93fcc6843493d7e5f0bf97065dbdb40106273a00e07f903250665ca25f6fb",
@@ -158,11 +211,12 @@
   "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "86700765212adb3ab590ca72614bf3ad4ce7ce60e3193f7f3bd1a04d34d10f6e",
+  "scripts/skill_profiler.py": "ada83e022795febb2365a73753656ff881993d77cf73517e818d668e961adb45",
   "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
   "scripts/status_runner.py": "4c358c91950c7874bcc6a5f23f2d3fda62b0752efcf6c6b658adf02ed77c7752",
   "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
-  "skills/torusguard/SKILL.md": "4d5b8e43fa3c09e5e1079cbc3e2184654219a2c47b2272db394da749969318f8",
-  "skills/torusguard/bootstrap.py": "3d946f388cb4befa739c9d3b1404255d9a8ea5770ebbb79e5a1b9839589e9bc7",
+  "skills/torusguard/SKILL.md": "15c69cb10eca1a10344b494888dce57e2baf227c3282bd54424a36ce35fb2460",
+  "skills/torusguard/bootstrap.py": "f7ce48cc310dcdbf86c028f05a8f5ad22677f4cebb1bec5c90d173a9044342c5",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
   "skills/torusguard/references/cache-and-sensitive-responses.md": "81b4a7a08e11dafa4ec58d868c4a35f1f891d0dcdcfbcefaef81e1b9ba94f5a1",
@@ -191,32 +245,42 @@
   "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
   "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
   "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
-  "skills/torusguard-apply/SKILL.md": "4cdd01d8159fc5f7519a806526a119e6d67e41b8af195de018b05d6af09acb12",
-  "skills/torusguard-audit/SKILL.md": "0065336b125cfa8ec766dcec585bce4bbac66b3b063c174b7183dffef18e090d",
-  "skills/torusguard-authorize/SKILL.md": "8694e6cef71cbeb6605fed33dd1f24b74352541069e54de7c3f48c9676e9aa3a",
-  "skills/torusguard-exploit-check/SKILL.md": "87e0e01f28f3efea8dbe81790abaceb845a1290c75a6a16bbd256251cd0539a9",
-  "skills/torusguard-full/SKILL.md": "35f8b38b08fef5a09504312ef3e54921b1f8f31f197bbe2af1474bcce2e83e1c",
-  "skills/torusguard-harden/SKILL.md": "4332761e5454a504176eebbba2d4c585bcf066c8046c014cebc0f5771379c089",
-  "skills/torusguard-init/SKILL.md": "03e599a5dad4262396e6b1a75859f76739b0b1480d8cc64544296106da903dfc",
-  "skills/torusguard-recheck/SKILL.md": "72a0a79b29dcc7f7ae054f00c53e005bc92778f2c6bf3ad828f6391e859d9c1c",
-  "skills/torusguard-report/SKILL.md": "6dc62fb2c9e2986827a802b7cabf41ce41d00a47573524a4bf1642a8d8e2249e",
-  "skills/torusguard-status/SKILL.md": "2ad72e5d317e1d6fe0606f6926b1721dc01ba98b5daa2bfaa90bdd953a67bdf7",
-  "skills/torusguard-verify/SKILL.md": "810c31ba9adc1b410b22eb8503f266be2d51e260a9c6828fd2938e2774e5baa7",
-  "skills/torusguard-web-validate/SKILL.md": "3e02d9734402e8fbc86a0b5c2fdac945ef4fc9d60ba1b992197b1373427ad16e",
+  "skills/torusguard-ai-guard/SKILL.md": "130a24d82f1b92fcc3ac2f4edc77d4d999ae629971f2131f66d6fac876f5593f",
+  "skills/torusguard-apply/SKILL.md": "edb21eabae4f9ad5be5976b20d217941c87b2a15edfc73383d02460ca3253fca",
+  "skills/torusguard-audit/SKILL.md": "b9ffc74381360656cbc78438c003fb1e67c4f0787f87627555863b474d57a8ad",
+  "skills/torusguard-authorize/SKILL.md": "56bcebc718bddadfd66010ebe2d23b4acf429e6230de05dd2300dab6bd383cc2",
+  "skills/torusguard-container/SKILL.md": "f9a2dea0b6b1e2de8ce4a189bb32b1010f1b4d6ff7a529450857b6dab20546ff",
+  "skills/torusguard-exploit-check/SKILL.md": "c127f1766e98e28dc967e452dff5dfec87689a26cf671ab6e62a135cd4d46e4b",
+  "skills/torusguard-full/SKILL.md": "6815ddde9e0e2dec24c174b08e541c80e34569836b1d94fda4ecf9577001e50c",
+  "skills/torusguard-git-mine/SKILL.md": "ebfb2f9955bf83b01be353c0a091396e549e5140564ab725d0479914b161e446",
+  "skills/torusguard-harden/SKILL.md": "14a09c770aa61e39e0ae862bb32304233975299df7e23c640983fd8551bbb0dd",
+  "skills/torusguard-init/SKILL.md": "6f9e9cdc1cc4f98baf2e6047c939b86a6191561c8ddea6c9246651378b00b9a8",
+  "skills/torusguard-ocr-scan/SKILL.md": "5b424d19383a93d757af06c4e777cd88c8cbdbcaaf1adc0c7bb38180ebc2bad8",
+  "skills/torusguard-recheck/SKILL.md": "a5c4539ec6d091179c8ba53792fba46f26795976f392d2305e357f25a2966c55",
+  "skills/torusguard-redos/SKILL.md": "b09b39bd98589613b2107c177e247f6224fb54ab2f028b4339ae01aac9d28c67",
+  "skills/torusguard-report/SKILL.md": "509185ea6730601cf9a44e136219cace61cd0523f8e112de03e4ef1c35e60585",
+  "skills/torusguard-status/SKILL.md": "e9741a20313a8304bc7565b194949a59ec7cfd4945b197517680164b3197efc0",
+  "skills/torusguard-verify/SKILL.md": "aeb4d3c7924253607d130e48491d83bf7b7a21707cd1dac2ba97d64f5e259fd6",
+  "skills/torusguard-web-validate/SKILL.md": "f1df00e10abd823d9a8c4daa1a3af7f26c5263c6c8e58e05b61b647d01a25489",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "8dd37fecc44e2820e82c29e2c6b2970936734ed5102d36950889a9eb8b19dbab",
-  "workflows/audit.md": "7e78ebb885176d65e86ed45a90a4326b942d484c2b5c8bff1d7bda141790de2f",
-  "workflows/authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
-  "workflows/exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
-  "workflows/harden.md": "24c62ea0233bf5cb21308497869790fa6f24b6cbb563fd2ebf858ff02b09bba9",
-  "workflows/init.md": "9a9aeaff6bd2217323ad72fb4043f46057deaa45eb3380f679d9aef3d36bfc8b",
-  "workflows/memory.md": "8ad2ec154176e2540c2859a28eff9f7c2dbca0217aa29d0f4aa88b87c43f8bef",
-  "workflows/recheck.md": "42eecc3ba194564d48a6a88d8003e86cafe003503e887dc565314d4aa558e8fd",
-  "workflows/report.md": "b98652ee0552b7bb73eeb78dc80d2b0a108cc505523cbd1b3ada6064409e4629",
-  "workflows/status.md": "dfbc2b75ba45ff70b60522addca4032a667241364b0907cd77a43bf9271dfa56",
-  "workflows/verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
-  "workflows/web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371"
+  "workflows/ai-guard.md": "7d762f4e18f64864b50b64148b972085d2766aeaf13833bc1e6aeb8fddb96999",
+  "workflows/apply.md": "0cd0fa84627ff73ffef84aa7eed6d096b57826139c079fa63f1bd745e13b138a",
+  "workflows/audit.md": "9f13b0497553965d30a71ff040a0dc556d526c8bbff136952b8210685632b5d7",
+  "workflows/authorize.md": "386779f405c4b7de0282938db4095179ed212fd32296dff158acb3258b41aec1",
+  "workflows/container.md": "64936b4873e9dfde6deae8a7d10d572a3bfbbfe9ef2340d0df8a3db5e1d02ad7",
+  "workflows/exploit-check.md": "4dc4016b7a22f18d5c32dd6fcfa7a859df07d03300973654aea92fe5251c8a85",
+  "workflows/git-mine.md": "3406122bc26c16d6518a77cb5cdd823c3860c3acb2873a0b2accd936040d5ca1",
+  "workflows/harden.md": "8a7e0ad3efe336f087fb4ad0205aaca32509145c1c02747d425591c87616c473",
+  "workflows/init.md": "c5c5fe6efbe9d37037b7b558ed396a60eec96bca4f3cf8cac072a1c61b334a1d",
+  "workflows/memory.md": "e23ce835c4e451a720a75cfc19a70ae81550665bb49a71016a4945fa75be981f",
+  "workflows/ocr-scan.md": "e1cee1a4e099df29b776911ac2b4b41a699a40f41286571e85bcb105bd1e6ecb",
+  "workflows/recheck.md": "f57194675ed465ee5fd6e8fc731e7102becd2dd0a8f8848517c0e11d3de849cf",
+  "workflows/redos.md": "f55a4f510849a5ea7e2ae4b08ecc70dff03c1bf21c7fdc664a4ff3ad0396f904",
+  "workflows/report.md": "7c718dfef6da1b66ba0fed300b7dfc90438fc3866af5a9b2aae4b3c3acd638e2",
+  "workflows/status.md": "021a962ae4e6fc81383db2ef42d28dcfc1b3e546c9a10a7a15b9910e531cf0c2",
+  "workflows/verify.md": "dd2579fe7d6e31ba47a4094edfbf4ab04be0745da7dc79e104b0547395c715d1",
+  "workflows/web-validate.md": "08441b01d15fd16f6697a95244632ea1465193631ecfb0746fe0c58895ff1c2b"
 }

package/.torusguard/core/__init__.py

@@ -0,0 +1,146 @@
+"""
+TorusGuard Core Architecture & Security Workflow Engine (v0.7.0)
+
+Tiered architectural layers:
+- Tier 1: Canonical Data Models, Lifecycle State Machine & Reporting (v0.5 base)
+- Tier 2: Governed Remediation, Clustering, Patch Policy & SARIF Export (v0.6 engine)
+- Tier 3: Authorized Runtime Validation, Exploitability Confirmation & Multi-Agent Roles (v0.7 engine)
+"""
+
+# ==============================================================================
+# Tier 1: Canonical Data Models, Lifecycle & Provenance (v0.5 base)
+# ==============================================================================
+from .models import (
+    Finding,
+    Evidence,
+    Remediation,
+    FrameworkPattern,
+    AffectedComponent,
+    ReproductionMethod,
+    RetestRecord,
+    NotesRecord,
+    FindingTimestamps,
+    ProvenanceChain,
+    ConfidenceScore,
+    ConfidenceFactors,
+    ConfidenceBand,
+    SeverityLevel,
+    SeverityInfo,
+    RemediationPriority,
+    FindingStatus,
+    LifecycleStage,
+    TaxonomyCategory,
+    EvidenceType,
+    AuditReport,
+    mask_sensitive_data,
+)
+from .lifecycle import FindingLifecycleManager, LifecycleTransitionError
+from .formatter import ReportFormatter
+from .run_folder import RunFolder
+
+# ==============================================================================
+# Tier 2: Governed Remediation, Clustering, Patch Policy & SARIF (v0.6 engine)
+# ==============================================================================
+from .identity import IdentityEngine, FindingFingerprint
+from .clustering import ClusteringEngine, RootCauseCluster
+from .bundle import BundleManager, RemediationBundle
+from .governance import PatchGovernor, PatchPolicyDecision, HIGH_RISK_KEYWORDS, SENSITIVE_CATEGORIES
+from .rechecker import TargetedRechecker, TargetedRecheckResult, RecheckOutcome
+from .run_manager import RunManager
+from .sarif import SarifExporter
+from .v6_reporter import V6Reporter
+from .v6_workflow import V6Workflow
+from .stack_profiler import StackProfiler, StackProfile
+
+# ==============================================================================
+# Tier 3: Authorized Runtime Validation & Exploitability Confirmation (v0.7 engine)
+# ==============================================================================
+from .authorization import AuthorizationManager, AuthorizationRecord, TargetScope, AuthorizationError
+from .safety_gate import SafetyGate, SafetyDecision, SafetyReviewLevel
+from .runtime_evidence import EvidenceCollector, RuntimeEvidenceItem, RedactionEngine
+from .runtime_validator import WebValidator, SessionState
+from .exploit_checker import ExploitChecker, ExploitCheckResult, ExploitabilityStatus
+from .browser_verifier import BrowserVerifier, BrowserAction
+from .agent_roles import RoleOrchestrator, RoleHandoff, AgentRole
+from .replay_trace import ReplayManager, ReplayTrace, ReplayStep
+from .v070_reporter import V070Reporter
+from .v070_workflow import V070Workflow
+
+__version__ = "0.7.0"
+
+__all__ = [
+    # Tier 1: Canonical Models & Lifecycle
+    "Finding",
+    "Evidence",
+    "Remediation",
+    "FrameworkPattern",
+    "AffectedComponent",
+    "ReproductionMethod",
+    "RetestRecord",
+    "NotesRecord",
+    "FindingTimestamps",
+    "ProvenanceChain",
+    "ConfidenceScore",
+    "ConfidenceFactors",
+    "ConfidenceBand",
+    "SeverityLevel",
+    "SeverityInfo",
+    "RemediationPriority",
+    "FindingStatus",
+    "LifecycleStage",
+    "TaxonomyCategory",
+    "EvidenceType",
+    "AuditReport",
+    "mask_sensitive_data",
+    "FindingLifecycleManager",
+    "LifecycleTransitionError",
+    "ReportFormatter",
+    "RunFolder",
+    # Tier 2: Governed Remediation & v0.6 Engine
+    "IdentityEngine",
+    "FindingFingerprint",
+    "ClusteringEngine",
+    "RootCauseCluster",
+    "BundleManager",
+    "RemediationBundle",
+    "PatchGovernor",
+    "PatchPolicyDecision",
+    "HIGH_RISK_KEYWORDS",
+    "SENSITIVE_CATEGORIES",
+    "TargetedRechecker",
+    "TargetedRecheckResult",
+    "RecheckOutcome",
+    "RunManager",
+    "SarifExporter",
+    "V6Reporter",
+    "V6Workflow",
+    "StackProfiler",
+    "StackProfile",
+    # Tier 3: Authorized Runtime Validation & v0.7 Engine
+    "AuthorizationManager",
+    "AuthorizationRecord",
+    "TargetScope",
+    "AuthorizationError",
+    "SafetyGate",
+    "SafetyDecision",
+    "SafetyReviewLevel",
+    "EvidenceCollector",
+    "RuntimeEvidenceItem",
+    "RedactionEngine",
+    "WebValidator",
+    "SessionState",
+    "ExploitChecker",
+    "ExploitCheckResult",
+    "ExploitabilityStatus",
+    "BrowserVerifier",
+    "BrowserAction",
+    "RoleOrchestrator",
+    "RoleHandoff",
+    "AgentRole",
+    "ReplayManager",
+    "ReplayTrace",
+    "ReplayStep",
+    "V070Reporter",
+    "V070Workflow",
+]
+

package/.torusguard/core/agent_roles.py

@@ -0,0 +1,104 @@
+"""
+TorusGuard v0.7.0 Role-Based Multi-Agent Workflow Engine
+Coordinates explicit handoff contracts between Profiler, Validator, Remediator,
+and Reviewer agent roles, ensuring strict authority separation and full auditability.
+"""
+
+import json
+from enum import Enum
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Dict, Any, List, Optional, Tuple
+from dataclasses import dataclass, asdict
+
+
+class AgentRole(str, Enum):
+    PROFILER = "Profiler"
+    VALIDATOR = "Validator"
+    REMEDIATOR = "Remediator"
+    REVIEWER = "Reviewer"
+
+
+@dataclass
+class RoleHandoff:
+    handoff_id: str
+    from_role: str
+    to_role: str
+    timestamp: str
+    contract_goal: str
+    inputs_passed: Dict[str, Any]
+    outputs_produced: Dict[str, Any]
+    status: str = "Completed"
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+class RoleOrchestrator:
+    """
+    Coordinates the 4-role multi-agent workflow and records audit logs.
+    """
+
+    def __init__(self, run_id: str):
+        self.run_id = run_id
+        self.handoffs: List[RoleHandoff] = []
+
+    def record_handoff(
+        self,
+        from_role: AgentRole,
+        to_role: AgentRole,
+        contract_goal: str,
+        inputs: Dict[str, Any],
+        outputs: Dict[str, Any]
+    ) -> RoleHandoff:
+        now = datetime.now(timezone.utc).isoformat()
+        h_id = f"HDF-{len(self.handoffs) + 1:02d}"
+        handoff = RoleHandoff(
+            handoff_id=h_id,
+            from_role=from_role.value,
+            to_role=to_role.value,
+            timestamp=now,
+            contract_goal=contract_goal,
+            inputs_passed=inputs,
+            outputs_produced=outputs,
+            status="Completed"
+        )
+        self.handoffs.append(handoff)
+        return handoff
+
+    def write_artifacts(self, run_dir: Path) -> Tuple[Path, Path]:
+        run_dir.mkdir(parents=True, exist_ok=True)
+        audit_file = run_dir / "role-audit.json"
+        handoff_file = run_dir / "agent-handoffs.md"
+
+        # 1. role-audit.json
+        with open(audit_file, "w", encoding="utf-8") as f:
+            json.dump([h.to_dict() for h in self.handoffs], f, indent=2)
+
+        # 2. agent-handoffs.md
+        lines = [
+            "# TorusGuard v0.7.0 Multi-Agent Role Handoff & Governance Trail",
+            f"\n**Run Identifier:** `{self.run_id}`",
+            f"**Total Role Handoffs:** `{len(self.handoffs)}`",
+            "\n---",
+            "\n## 👥 Multi-Agent Responsibility Matrix\n",
+            "| Agent Role | Explicit Authority & Purpose | Forbidden Actions |",
+            "|---|---|---|",
+            "| **🔍 Profiler** | Detects tech stack, framework versions, route ASTs, and storage boundaries. | Cannot execute active probes or generate code patches. |",
+            "| **⚡ Validator** | Executes authorized, bounded runtime HTTP/browser probes; gathers evidence. | Cannot apply code changes or override reviewer policies. |",
+            "| **🛠️ Remediator** | Formulates minimal bounded remediation bundles enriched with runtime context. | Cannot dispatch runtime network probes or declare final sign-off. |",
+            "| **🛡️ Reviewer** | Verifies technical evidence, reviews safety decisions, and issues sign-off. | Does not execute probes or author patches. |",
+            "\n---",
+            "\n## 🔄 Chronological Handoff Log\n",
+            "| Handoff ID | From Role | To Role | Contract Goal | Timestamp | Status |",
+            "|---|---|---|---|---|:---:|",
+        ]
+        for h in self.handoffs:
+            lines.append(
+                f"| `{h.handoff_id}` | **{h.from_role}** | **{h.to_role}** | {h.contract_goal} | `{h.timestamp}` | ✅ {h.status} |"
+            )
+
+        with open(handoff_file, "w", encoding="utf-8") as f:
+            f.write("\n".join(lines) + "\n")
+
+        return audit_file, handoff_file