torusguard 2.0.0-alpha → 2.1.1

package/.torusguard/workflows/status.md

@@ -1,14 +1,15 @@
 ---
 description: Read-only diagnostic overview of workspace security posture, active configuration, rules catalog, and run history.
-tools: Read, Grep, Glob, Bash
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: reviewer
 lifecycle-phase: System / Diagnostics
 required-skills:
   - torusguard-status
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/run_manager.py
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
+  - internal/workspace/workspace.go
 ---
 
 # /torusguard status — Workspace Security Posture & Diagnostic Overview
@@ -18,30 +19,27 @@ $ARGUMENTS
 ---
 
 ## Objective
-Read-only diagnostic overview of workspace security posture, active configuration, and run history.
+Read-only diagnostic overview of workspace security posture, active configuration, and run history across 74 canonical security rules and 18 families.
 
 ---
 
-## Mandatory Pre-Flight Context Inspection
+## Tri-Mode Execution
 
-Inspect workspace state and configuration records prior to status display:
-1. **Config State (`.torusguard/config/torusguard.json`):** Confirm workspace initialization and read detected stack.
-2. **Active Rules Directory (`.torusguard/rules/active/`):** Count active rule files.
-3. **Run Folder Ledger (`.torusguard/runs/`):** Check run history and locate latest `manifest.json`.
-4. **Scope Record (`.torusguard/config/scope.json`):** Check whether runtime authorization TTL is active or expired.
-5. **Read-Only Invariant:** Ensure command performs zero file modifications or disk mutations.
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard status [--json]` | Terminal execution of 75-column diagnostic cards. |
+| **Mode B: AI Chat Slash** | `/torusguard status` | Conversational diagnostic inspection of active config and ledger. |
+| **Mode C: Native MCP Tool** | `torusguard_status` | Agent tool call with `{"target": "."}` returning posture JSON/string. |
 
 ---
 
-## When to Use /torusguard status
+## Mandatory Pre-Flight Context Inspection
 
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Checking workspace configuration and active security posture | Run `/torusguard status` |
-| Reviewing recent audit runs and finding counts | Run `/torusguard status` |
-| Checking active legal scope authorization TTL | Run `/torusguard status` |
-| Initializing workspace for the first time | Run `/torusguard init` |
-| Executing full security scan | Run `/torusguard audit` |
+Inspect workspace state and configuration records prior to status display:
+1. **Config State (`.torusguard/config/torusguard.json`):** Confirm workspace initialization and read detected stack.
+2. **Active Rules Directory (`.torusguard/rules/active/`):** Count active rule files (74 canonical rules).
+3. **Living Report (`security_report.md`):** Read current open vs resolved findings.
+4. **Read-Only Invariant:** Ensure command performs zero file modifications or disk mutations.
 
 ---
 
@@ -49,33 +47,16 @@ Inspect workspace state and configuration records prior to status display:
 - Reads current health score and status breakdown directly from `security_report.md`.
 - Displays 18 rule families and 74 rules in standardized 75-column terminal cards.
 
-## Execution Steps
-
-1. **Read Configuration:** Load `.torusguard/config/torusguard.json`; extract stack, version, and enabled rule count.
-2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-3. **Inspect Run History:**
-   ```bash
-   python .torusguard/scripts/run_manager.py list
-   ```
-4. **Evaluate Scope Expiry:** Parse `.torusguard/config/scope.json`; report if TTL is valid or expired.
-5. **Print Status Overview:** Render complete workspace diagnostic overview card.
-
 ---
 
-## Failure Recovery
-
-- **Uninitialized Workspace:** If config is missing, prompt user to execute `/torusguard init`.
-- **Zero Runs Found:** Display clean status card noting no historical audit runs exist yet.
-- **Corrupt Config File:** Report parsing error and recommend re-running `/torusguard init`.
-- **Halt Trigger:** Abort command if read access to `.torusguard/` is denied.
-
----
-
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never display fabricated finding counts not substantiated by run manifests.
-- ❌ Never execute modifying shell commands or edit source code during status inspection.
-- ✅ Always report factual file counts from `.torusguard/rules/active/` and `.torusguard/runs/`.
+1. **Trigger Status Check:**
+   - **Mode A (CLI):** Run `torusguard status`.
+   - **Mode B (Chat):** Read `torusguard.json` and `security_report.md`.
+   - **Mode C (MCP):** Call `torusguard_status`.
+2. **Evaluate Posture:** Report detected stack, active invariants, and living findings ledger.
+3. **Recommend Next Actions:** Direct user to audit or remediation as needed.
 
 ---
 
@@ -83,13 +64,11 @@ Inspect workspace state and configuration records prior to status display:
 
 ```markdown
 ### 🛡️ TorusGuard Workspace Status
-- **Version:** v0.9.2
-- **Framework Detected:** [Stack or None]
-- **Active Rules:** [Count] rules active in `.torusguard/rules/active/`
-- **Total Runs:** [Count] historical runs recorded
-- **Latest Run:** `run-YYYYMMDD-HHMMSS` ([Findings Count] findings)
-- **Scope Status:** [Authorized (TTL Active) / Expired / Unconfigured]
-- **Health Posture:** [GOOD / ACTION NEEDED]
+- **Version:** v2.0.0
+- **Framework Detected:** [Stack]
+- **Active Rules:** 74 canonical rules active across 18 families
+- **Living Report:** `security_report.md`
+- **Health Posture:** [OPTIMAL DEFENSE / ACTION NEEDED]
 ```
 
 ---
@@ -97,4 +76,4 @@ Inspect workspace state and configuration records prior to status display:
 ## Next Steps
 
 1. Run `/torusguard audit` to scan codebase for security vulnerabilities.
-2. Run `/torusguard authorize` to configure or refresh live target scope.
+2. Run `/torusguard report --html` to view interactive dashboard.

package/.torusguard/workflows/verify.md

@@ -1,14 +1,15 @@
 ---
 description: Evidence sufficiency verification, live disk line match audit, and finding score refinement.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: validator
 lifecycle-phase: Phase 3a (Evidence Verification)
 required-skills:
   - torusguard-verify
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/finding_scorer.py
+  - internal/validate/validate.go
+  - cmd/torusguard/main.go
+  - cmd/torusguard/mcp.go
 ---
 
 # /torusguard verify — Evidence Verification & Score Refinement
@@ -22,26 +23,22 @@ Evidence sufficiency verification, live disk line match audit, and finding score
 
 ---
 
-## Mandatory Pre-Flight Context Inspection
+## Tri-Mode Execution
 
-Inspect finding records and evidence integrity before verification:
-1. **Latest Run Records (`.torusguard/runs/`):** Locate most recent audit run directory.
-2. **Finding Files:** Confirm `findings.md` or `findings.json` exists in the target run folder.
-3. **Live File Drift:** Assert cited source files have not been edited or relocated on disk.
-4. **Scoring Model Calibration:** Ensure `finding_scorer.py` evaluates all 5 rubric dimensions.
-5. **Role Boundary:** Enforce validator role; do not apply code modifications during verification.
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard verify` | Terminal audit of living security report and evidence presence. |
+| **Mode B: AI Chat Slash** | `/torusguard verify` | Live code line inspection, taint flow audit, and false-positive filtering. |
+| **Mode C: Native MCP Tool** | `torusguard_verify` | Agent tool call with `{"target": "."}` returning line audit proofs. |
 
 ---
 
-## When to Use /torusguard verify
+## Mandatory Pre-Flight Context Inspection
 
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Auditing whether static findings are valid code flaws | Run `/torusguard verify` |
-| Upgrading Medium confidence finding to Confirmed | Run `/torusguard verify` |
-| No audit run executed yet | Run `/torusguard audit` first |
-| Running live network requests against endpoints | Run `/torusguard web-validate` |
-| Generating patch after verification | Run `/torusguard harden` |
+Inspect finding records and evidence integrity before verification:
+1. **Living Report (`security_report.md`):** Confirm report exists at workspace root.
+2. **Live File Drift:** Assert cited source files have not been edited or relocated on disk.
+3. **Role Boundary:** Enforce validator role; do not apply code modifications during verification.
 
 ---
 
@@ -49,34 +46,18 @@ Inspect finding records and evidence integrity before verification:
 - Confirmed evidence sufficiency transitions findings in `security_report.md` to `VERIFIED 🟠`.
 - False positives transition to `FALSE POSITIVE ⚪`.
 
+---
+
 ## Execution Steps
 
-1. **Locate Target Findings:** Load active findings from latest run directory.
+1. **Trigger Verification:**
+   - **Mode A (CLI):** Run `torusguard verify`.
+   - **Mode B (Chat):** Read cited lines via `view_file` and verify source-to-sink flow.
+   - **Mode C (MCP):** Call `torusguard_verify`.
 2. **Live Disk Line Match:** Read current code at cited line ranges; verify AST snippet matches.
 3. **Audit Evidence Sufficiency:** Assess whether taint path is unbroken and caller context is exposed.
-4. **Refine Confidence Scores:**
-   ```bash
-   python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
-   ```
-5. **Classify Status:** Assign verified state (`Confirmed`, `Plausible`, or `False Positive / Disputed`).
-6. **Emit Verification Ledger:** Write `verified-evidence.md` into the active run folder.
-
----
-
-## Failure Recovery
-
-- **Missing Run Folder:** Run `/torusguard audit` first to produce a valid run baseline.
-- **Line Drift Detected:** Flag line mismatch; scan nearby lines (±25) for relocated AST sink.
-- **Malformed Finding JSON:** Repair JSON structure using finding schema before scoring.
-- **Halt Trigger:** Abort if cited files are completely deleted from disk.
-
----
-
-## Hallucination Guard
-
-- ❌ Never confirm a finding if the cited sink has already been sanitized by middleware.
-- ❌ Never bump confidence score without documenting unbroken taint source-to-sink flow.
-- ✅ Always anchor line matches to live disk reads using `view_file`.
+4. **Classify Status:** Assign verified state (`Confirmed`, `Plausible`, or `False Positive`).
+5. **Update Living Ledger:** Update statuses in `security_report.md`.
 
 ---
 
@@ -84,17 +65,16 @@ Inspect finding records and evidence integrity before verification:
 
 ```markdown
 ### 🧪 TorusGuard Evidence Verification
-- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
+- **Report File:** `security_report.md`
 - **Findings Evaluated:** [Count] findings
 - **Confirmed Real:** [Count] verified flaws
-- **Downgraded / False Positives:** [Count] filtered out
-- **Refined Mean Score:** [Score]/100
-- **Ledger:** `.torusguard/runs/<run_id>/verified-evidence.md`
+- **False Positives Filtered:** [Count]
+- **Status:** Evidence verified on disk
 ```
 
 ---
 
 ## Next Steps
 
-1. Run `/torusguard web-validate` if live endpoint probing is required.
-2. Run `/torusguard harden` to build surgical patch bundles for verified flaws.
+1. Run `/torusguard harden` to build surgical patch bundles for verified flaws.
+2. Run `/torusguard web-validate` if live endpoint probing is required.

package/.torusguard/workflows/web-validate.md

@@ -1,14 +1,14 @@
 ---
 description: Authorized HTTP probing, token redaction, transparent audit header injection, and replay trace capture.
-tools: Read, Grep, Glob, Bash, Write
-version: 1.3.6
+tools: Read, Grep, Glob, Bash, Write, run_command
+version: 2.0.0
 agent: validator
 lifecycle-phase: Phase 3b (Runtime Web Validation)
 required-skills:
   - torusguard-web-validate
 scripts-binding:
-  - .torusguard/scripts/report_sync.py
-  - .torusguard/scripts/safety_gate.py
+  - internal/validate/validate.go
+  - cmd/torusguard/main.go
 ---
 
 # /torusguard web-validate — Bounded HTTP Probing & Session Capture
@@ -18,7 +18,17 @@ $ARGUMENTS
 ---
 
 ## Objective
-Authorized HTTP probing, token redaction, transparent audit header injection, and replay capture.
+Authorized HTTP probing, token redaction, transparent audit header injection, and replay capture against local/staging web applications.
+
+---
+
+## Tri-Mode Execution
+
+| Mode | Command / Tool | Execution Method |
+| :--- | :--- | :--- |
+| **Mode A: Terminal CLI** | `torusguard web-validate [--url <url>]` | Terminal execution of bounded HTTP validator. |
+| **Mode B: AI Chat Slash** | `/torusguard web-validate` | Interactive verification of endpoints and security headers. |
+| **Mode C: Native MCP Tool** | Scope Guarded Probing | Safe runtime probing guarded by `scope.json` and SSRF boundaries. |
 
 ---
 
@@ -26,53 +36,21 @@ Authorized HTTP probing, token redaction, transparent audit header injection, an
 
 Inspect authorization parameters and safety limits before sending HTTP requests:
 1. **Active Scope (`.torusguard/config/scope.json`):** Assert target host and path are authorized with valid TTL.
-2. **Safety Gate Classification:** Test proposed endpoint against `.torusguard/scripts/safety_gate.py`.
+2. **SSRF Boundary Enforcement:** Assert target does not resolve to private cloud metadata (`169.254.169.254`).
 3. **Sensitive Route Guard:** Ensure destructive endpoints (`DELETE`, account drops) are never called automatically.
 4. **Token Redaction Pipeline:** Ensure bearer tokens and session cookies are masked (`Bearer [REDACTED]`).
 5. **Request Budget:** Enforce maximum cap of 50 requests per validation session.
 
 ---
 
-## When to Use /torusguard web-validate
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Testing live route accessibility and security headers | Run `/torusguard web-validate` |
-| Verifying cookie security flags (`HttpOnly`, `Secure`, `SameSite`) | Run `/torusguard web-validate` |
-| Checking CORS headers and authentication barriers | Run `/torusguard web-validate` |
-| Pure static source code analysis | Run `/torusguard audit` |
-| Confirming exploitable attack vectors | Run `/torusguard exploit-check` |
-
----
-
 ## Execution Steps
 
-1. **Verify Legal Scope:** Check target URL against `.torusguard/config/scope.json`.
-2. **Invoke Safety Gate:**
-   ```bash
-   python .torusguard/scripts/safety_gate.py check --url <target_url> --method GET
-   ```
-3. **Dispatch Non-Destructive Probe:** Send bounded HTTP request with audit header `X-TorusGuard-AuthID`.
-4. **Redact Sensitive Headers:** Sanitize auth tokens and credentials in request and response objects.
-5. **Write Replay Artifacts:**
-   Record sanitized trace in `.torusguard/runs/<run_id>/requests.json` and emit `web-validation.md`.
-
----
-
-## Failure Recovery
-
-- **Target Offline:** Verify local dev server is active and accessible on designated host port.
-- **Safety Gate Rejection (Manual Only):** Halt probe immediately; report endpoint requires human manual test.
-- **Rate Limit / 429:** Back off exponentially (1s, 2s, 4s); stop session if 429 persists.
-- **Halt Trigger:** Abort if target domain deviates from authorized allowlist in `scope.json`.
-
----
-
-## Hallucination Guard
-
-- ❌ Never dispatch HTTP requests outside domains explicitly listed in `.torusguard/config/scope.json`.
-- ❌ Never write raw Authorization headers or plaintext secrets to disk.
-- ✅ Always include transparent audit headers (`X-TorusGuard-AuthID`).
+1. **Trigger Web Validation:**
+   - **Mode A (CLI):** Run `torusguard web-validate --url http://localhost:3000`.
+   - **Mode B (Chat):** Send non-destructive probe and inspect response headers.
+2. **Audit Security Headers:** Check CSP, HSTS, X-Content-Type-Options, and CORS headers.
+3. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+4. **Sanitize Traces:** Redact all secrets and save sanitized replay trace.
 
 ---
 
@@ -84,7 +62,6 @@ Inspect authorization parameters and safety limits before sending HTTP requests:
 - **Endpoints Probed:** [Count] routes tested
 - **Security Headers:** [CSP / HSTS / CORS status]
 - **Cookie Security:** [HttpOnly / Secure / SameSite status]
-- **Replay Trace:** `.torusguard/runs/<run_id>/replay.json`
 - **Status:** COMPLETED — non-destructive probe finished
 ```