torusguard 2.0.0-alpha → 2.1.1

package/skills/torusguard/bootstrap.py

@@ -63,14 +63,15 @@ import unicodedata
 ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
 
 def get_visual_width(text: str) -> int:
-    """Calculate the printable display width of a string (ANSI and emoji aware)."""
+    """Calculate the printable display width of a string (ANSI, emoji and variation selector aware)."""
     clean = ANSI_REGEX.sub('', text)
     width = 0
     for ch in clean:
+        cp = ord(ch)
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            continue
         ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif ord(ch) >= 0x1F300:
+        if ea in ('W', 'F') or cp >= 0x1F300:
             width += 2
         else:
             width += 1
@@ -82,7 +83,7 @@ def truncate_visual(text: str, max_w: int = 67) -> str:
         return text
     out, curr_w, in_ansi, ansi_buf = [], 0, False, ''
     for ch in text:
-        if ch == '\033':
+        if ch in ('\033', '\x1b'):
             in_ansi = True
             ansi_buf = ch
             continue
@@ -92,13 +93,19 @@ def truncate_visual(text: str, max_w: int = 67) -> str:
                 in_ansi = False
                 out.append(ansi_buf)
             continue
+        cp = ord(ch)
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            out.append(ch)
+            continue
         ea = unicodedata.east_asian_width(ch)
-        cw = 2 if ea in ('W', 'F') or ord(ch) >= 0x1F300 else 1
+        cw = 2 if (ea in ('W', 'F') or cp >= 0x1F300) else 1
         if curr_w + cw > max_w - 3:
-            out.append('...')
+            out.append(RESET + '...')
+            curr_w += 3
             break
         out.append(ch)
         curr_w += cw
+    out.append(RESET)
     return ''.join(out)
 
 def card_line(content: str, max_w: int = 67, border: str = "│", border_color: str = CYAN) -> str:
@@ -109,37 +116,56 @@ def card_line(content: str, max_w: int = 67, border: str = "│", border_color:
     return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
 
 def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column top border (single ┌ or double ╔) with optional title."""
     left = "╔" if double else "┌"
     right = "╗" if double else "┐"
     h = "═" if double else "─"
     if title:
         vis = get_visual_width(title)
-        rem = max(0, 71 - 3 - vis - 1)
+        rem = max(0, 68 - vis)
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
 def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column bottom border (single └ or double ╚)."""
     left = "╚" if double else "└"
     right = "╝" if double else "┘"
     h = "═" if double else "─"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_divider(border_color: str = CYAN, double: bool = False) -> str:
+def card_divider(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column divider (single ├ or double ╠) with optional title."""
     left = "╠" if double else "├"
     right = "╣" if double else "┤"
     h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.1", border_color: str = CYAN) -> str:
+    """Generate standardized 75-column curved header box."""
+    top = f"  {border_color}╭{'─' * 71}╮{RESET}"
+    bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
+    empty = f"  {border_color}│{' ' * 71}│{RESET}"
+
+    title_vis = get_visual_width(title)
+    ver_vis = get_visual_width(version)
+    space_count = max(1, 67 - title_vis - ver_vis)
+    title_str = f"{BOLD}{WHITE}{title}{RESET}{' ' * space_count}{GRAY}{version}{RESET}"
+
+    lines = [top, empty, card_line(title_str, max_w=67, border_color=border_color)]
+    if subtitle:
+        lines.append(card_line(f"{DIM}{subtitle}{RESET}", max_w=67, border_color=border_color))
+    lines.extend([empty, bottom])
+    return "\n".join(lines)
+
 def print_header():
     """Print the branded TorusGuard header card."""
-    print(f"""
-  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
-  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
-  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v1.4.0{RESET}   {CYAN}│{RESET}
-  {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
-  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
-  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
-""")
+    print()
+    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.1"))
+    print()
 
 
 def print_step_1_assets(file_count):
@@ -213,14 +239,15 @@ def print_success_card():
 
 def print_already_initialized(target_root, cfg):
     """Print the already-initialized status card."""
+    print()
+    top = f"  {CYAN}╭{'─' * 71}╮{RESET}"
+    bottom = f"  {CYAN}╰{'─' * 71}╯{RESET}"
+    title_line = card_line(f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}{' ' * 28}{GREEN}[Active]{RESET}")
+    print(f"{top}\n{title_line}\n{bottom}")
     print(f"""
-  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
-  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}                           {GREEN}[Active]{RESET}         {CYAN}│{RESET}
-  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
-
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.4.0')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.1')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -228,7 +255,7 @@ def print_already_initialized(target_root, cfg):
 """)
 
 
-def scaffold_workspace(target_root=None, force=False, full_commands=False, template=None, run_audit=False):
+def scaffold_workspace(target_root=None, force=False, full_commands=False, template=None, **kwargs):
     """Scaffold the .torusguard workspace into the target project root."""
     target_root = Path(target_root or find_project_root()).resolve()
     torusguard_target = target_root / ".torusguard"
@@ -348,18 +375,13 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False, templ
             "cards": []
         }, indent=2), encoding="utf-8")
 
-    # Ensure target project root .gitignore excludes .torusguard/memory/ and report.html
+    # Ensure target project root .gitignore excludes .torusguard/memory/
     root_gitignore = target_root / ".gitignore"
     if root_gitignore.exists():
         try:
             gi_content = root_gitignore.read_text(encoding="utf-8")
-            to_add = []
             if ".torusguard/memory" not in gi_content:
-                to_add.append(".torusguard/memory/")
-            if "report.html" not in gi_content:
-                to_add.append("report.html")
-            if to_add:
-                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard local artifacts\n" + "\n".join(to_add) + "\n", encoding="utf-8")
+                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard security memory (local only)\n.torusguard/memory/\n", encoding="utf-8")
         except Exception:
             pass
 
@@ -379,25 +401,17 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False, templ
         except Exception:
             detected_stack = None
 
-    TEMPLATE_MAP = {
-        "golang": {"language": "Go", "framework": "Gin/Fiber", "data_layer": "database/sql"},
-        "go": {"language": "Go", "framework": "Gin/Fiber", "data_layer": "database/sql"},
-        "nextjs": {"language": "TypeScript", "framework": "Next.js", "data_layer": "Prisma ORM"},
-        "fastapi": {"language": "Python", "framework": "FastAPI", "data_layer": "SQLAlchemy"},
-        "express": {"language": "JavaScript", "framework": "Express", "data_layer": "Mongoose"},
-        "django": {"language": "Python", "framework": "Django", "data_layer": "Django ORM"},
-        "react": {"language": "JavaScript/TypeScript", "framework": "React / Vite", "data_layer": "Supabase"}
-    }
-    if template and template.lower() in TEMPLATE_MAP:
-        detected_stack = TEMPLATE_MAP[template.lower()]
-
     config_file = torusguard_target / "config" / "torusguard.json"
     if config_file.exists():
         try:
             with open(config_file, "r", encoding="utf-8") as f:
                 cfg = json.load(f)
-            if template and template.lower() in TEMPLATE_MAP:
-                cfg["detected_stack"] = TEMPLATE_MAP[template.lower()]
+            if template and template.lower() in ("golang", "go"):
+                cfg["detected_stack"] = {
+                    "language": "Go",
+                    "framework": "Gin",
+                    "data_layer": "None"
+                }
             elif detected_stack and detected_stack.get("framework") != "None":
                 cfg["detected_stack"] = {
                     "language": detected_stack.get("language"),
@@ -530,40 +544,15 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
 
     # ── Success Card ────────────────────────────────────────────────────────
     print_success_card()
-
-    # ── Optional Immediate Audit ────────────────────────────────────────────
-    if run_audit:
-        audit_script = torusguard_target / "scripts" / "audit_runner.py"
-        if audit_script.is_file():
-            print(f"\n  {CYAN}▸ Running immediate baseline security audit (--audit)...{RESET}\n")
-            try:
-                import importlib.util
-                spec = importlib.util.spec_from_file_location("audit_runner", str(audit_script))
-                if spec and spec.loader:
-                    ar_mod = importlib.util.module_from_spec(spec)
-                    spec.loader.exec_module(ar_mod)
-                    if hasattr(ar_mod, "execute_audit"):
-                        ar_mod.execute_audit(target_root)
-            except Exception as e:
-                print(f"  {YELLOW}⚠ Immediate audit notice: {e}{RESET}")
-
     return True
 
 
 if __name__ == "__main__":
     parser = argparse.ArgumentParser(description="TorusGuard Autonomous Workspace Bootstrapper")
-    parser.add_argument("--target", "-t", type=str, help="Target project root directory")
+    parser.add_argument("--target", type=str, help="Target project root directory")
     parser.add_argument("--force", action="store_true", help="Force overwrite existing workspace")
     parser.add_argument("--full-commands", action="store_true", help="Unlock and register all 11 individual slash commands")
-    parser.add_argument("--template", choices=["golang", "go", "nextjs", "fastapi", "express", "django", "react"], help="Pre-configure target framework stack template")
-    parser.add_argument("--audit", action="store_true", help="Execute immediate baseline audit post-initialization")
     args = parser.parse_args()
 
-    success = scaffold_workspace(
-        target_root=args.target,
-        force=args.force,
-        full_commands=args.full_commands,
-        template=args.template,
-        run_audit=args.audit
-    )
+    success = scaffold_workspace(target_root=args.target, force=args.force, full_commands=args.full_commands)
     sys.exit(0 if success else 1)

package/skills/torusguard/payload/.manifest.json

@@ -1,7 +1,7 @@
 {
   "ARCHITECTURE.md": "cdc690a856e82574a6574ab6b1ad8a2d8b3b8264c36931c6212321066eed82e4",
   "TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
-  "rules_catalog.json": "e0b32c1bdde0f19fa390aba26a02b7e5ba1b59b251f9fffd501815b48f2d9af9",
+  "rules_catalog.json": "11240a887dbe457ef5fbe621dabc08ea4e3bc273b56fce85f517df7b6ad19f55",
   "agents/auditor.md": "4ba2c92982823d0886c7ae369126cd5ddd322085a85d3b7e7fa23154f8753314",
   "agents/profiler.md": "0ee9ebbddf4ebd557d454dda8472fffea471e263abeccf40298163084b7ce9a9",
   "agents/remediator.md": "f708a0e315760e8d519bd640d22bdf6b7ec61ed7de3da69bd038bd60dc3d5b47",
@@ -10,6 +10,45 @@
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "305c1dc5b556e8d64ad9dd585dafac1a9955cf1bd5321429955b19b7a62736b6",
   "config/torusguard.json": "55dbde335997421a01c97709fd1672ad70fa921bfe8346dd57552b799db2419e",
+  "core/__init__.py": "2120562452ae03c84468d67246dc93376f7ebcde8e4ca767c6253bc92c35dbbf",
+  "core/agent_roles.py": "d7189dbf1d3ae4e330eb316bed5d399a18992295addf466f4c6552bc14ae6a34",
+  "core/ast_walker.py": "309564d168e6eb9e3e93aceb29a95a61872b35a4da7235ee49e79e9d3a5e7cc6",
+  "core/authorization.py": "2bb7f85b4639959276fc7cfd427df7edb8b1f97f8003707a0032f100953d1b30",
+  "core/browser_verifier.py": "e450bdbb8d5c2808a3b3ea7bc33bce2451230cbbb7ed4f17dbc7107ab0f30d56",
+  "core/bundle.py": "82505fba44a5ad867a4caef34e1233ebf76d4bc2e15b943e2413822602f1a95f",
+  "core/call_graph.py": "7e230f8b5fa7dd8f780eafbe7381f2d9538f01a880c1349c41139cce20f9094f",
+  "core/clustering.py": "0ffcad5e8a459084d200248de8799d466c2b53ad627b778314b09f2733df782c",
+  "core/confidence.py": "81c6242a1a3eaea873d39e8b212e5781a2df2316614f18a2fe6ef757561f5bb5",
+  "core/cross_file_taint.py": "1fa323529e5ca2fcce06167e4a59431f9f8217ad7a5097f8afbc6b9a9dc0913d",
+  "core/exploit_checker.py": "74a48e6e1e1b9791107b487ab5434540494946441605cf9115fa90b787bc5c5a",
+  "core/formatter.py": "a9d2a20e52caaf8a801f65f325b3f5bc430eb6301506973095961d4615b7e429",
+  "core/governance.py": "657edfa332c2f855f917545862c9d38f31468cec464d11dd2c012dcf794fb32c",
+  "core/identity.py": "f42d3d81c7ee8ca5d2ef08d48066abdc42d2ccbd5fe0bbd88b35d5c8174b696f",
+  "core/import_resolver.py": "4ac89ac405816b7de599fbabfa47556d10c1557d92f3a700bf50b90f52ba6c75",
+  "core/incremental.py": "8ff9d41f6667bf567d2e952f31ae330271ba1d6cf5411ab4468c355ca2fa6681",
+  "core/lifecycle.py": "f4406acba8464ed9111128ef545f8c576639cadda8b9de7e23ff8a90fad24f9e",
+  "core/models.py": "ed23b50aab2eb7ea9bc16dbb20b0bf4f978f3aae7f39f0a713f7efe08ff238b5",
+  "core/parallel.py": "27fcfdd3760d481ffdd4e7321a79d17ef4823dd3744687fcc9d00349c0bb1d49",
+  "core/parser.py": "2f01e9beb178e86002fd8dd3211cf269ab59f21e5c65aabb5e9d0e110504d1d1",
+  "core/rechecker.py": "2a21b788158cac79db9030db79e3a27021e7f66692c37c39e0bd3fadf483388c",
+  "core/replay_trace.py": "8132cb43dd4593cc96f09f014c2b3882ef5296ebc5029a921423263b07ca7a1d",
+  "core/rules_registry.py": "80c4f5067f151b596388ae9a4546d2f009f10342daa5221412e5c9a222b27a31",
+  "core/run_folder.py": "cc8702dfd3a2768e5dca74f7ac85e316f53f1acb059bad87ca3650eeeae2defa",
+  "core/run_manager.py": "2470ebc8b54edaab3679d909fde48f02c7530f1e12c917b7b5cd5c004062a8b6",
+  "core/runtime_evidence.py": "79c947a3b131c3be2f2938789d12647a0d9010bb4077bf3f33b2c7218ba9028b",
+  "core/runtime_validator.py": "39477ef1138e8deaa5c3859d6402e71d2c0eb6e2e39fbd3db04fe3ad8e2c798c",
+  "core/safety_gate.py": "349e84187930faf79baa38643712d48636de504e8613667e42ec852999efa9fb",
+  "core/sarif.py": "93316e7d5fa0ac3660ce18307a2ef4f9c2b2b24b0a4e40d288f94edd0ef84e6d",
+  "core/stack_profiler.py": "8c5166c712d7e9341d6290b2220da05662f1ba251899d6f501a9875625f5539c",
+  "core/symbol_table.py": "8e700e01e920e7c8a496a16e400195bb6cedd9e3624997fbb44b29124e256d74",
+  "core/taint.py": "f54b3e2d620d480969681847e63149b259876dbac470dc417e90407e1def925b",
+  "core/taint_graph.py": "2f697a4d4c44801f346f7bde0794cc70c481b4a5a28fe02add20fa845fd9a5c5",
+  "core/taint_rules.py": "d29893e0212a2afb21fede6c20afb6d3fe9ff89511659675f02a034ea1e87d8f",
+  "core/v070_reporter.py": "d9e9bebd4e158f4c1b1b50897c04c2c5f9db85919b1700b47331ecf16fe7bd63",
+  "core/v070_workflow.py": "57bf1468c78f47b4aa5fb5804eb3c247825daa0933bb5cf0aad4ae2394adcead",
+  "core/v6_reporter.py": "95fa2ec5b0e708101b62131152445039192382e409d0f40c35cdcbf96648ca26",
+  "core/v6_workflow.py": "3e38afafc3afdbebe8cf76ed24da00435aab27a2ac512a292983f8b1e88ebcb8",
+  "core/watcher.py": "b3d4856023ee2f6c65b2938d3c76c246d7c440c58cdc7b642dc27209d68a959a",
   "references/csharp-security.md": "d6e267855b08ed4fdff26f3b876f089ae1f90a7ec6546cba7e8173380d9daa9d",
   "references/django-security.md": "26ea5535ac435e61489df1e381ac62b19e81702edfe095e78c937be93fa15ea7",
   "references/drf-security.md": "c6796398317b0f264d89fff598404e126d819e69e1ea0a5129924a5eb2a7af9d",
@@ -43,6 +82,8 @@
   "rules/TG-INPUT-004-unrestricted-file-upload.md": "d665fb7ede456c24d12229cec22b30374a4dc036c3fe3a41ece22f97ab78a1f4",
   "rules/TG-INPUT-005-unsafe-template-rendering-and-escaping.md": "b6006e741a303d8ff2cd65ef417e6199e5dcf8fe7d603941244db82f6cbe1753",
   "rules/TG-INPUT-006-unsafe-file-path-traversal.md": "5edb665cd2c41b659849c96d0d4b801a6365e130be12c51733a3d6f17cfd85ed",
+  "rules/TG-INPUT-007-unvalidated-redirect.md": "7da41ecbd39a7c90fe90fc683df48f38b0cf5a0d7c2b027f0827830bd8f814f7",
+  "rules/TG-INPUT-008-insecure-deserialization.md": "5f5f85a9429d32959f890f668ff1fd75bd7ce976a7b9406c3b7235fc728989ca",
   "rules/TG-PLATFORM-001-wildcard-cors-with-credentials.md": "fb8154f5b8051e94886c956b1e7bdbc5f316739795b8fb9bb493223ca774fe25",
   "rules/TG-PLATFORM-002-missing-security-headers.md": "207f489453d6256b5d794f79be25c66e9f932ae5cb561b3e8b50d26a28f6a07a",
   "rules/TG-PLATFORM-003-production-stack-trace-exposure.md": "298c75b928c160720243e42ce5bf43397e73cf50ed472482d5ef3f7635fcb839",
@@ -100,15 +141,27 @@
   "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "e84d9d314b1616bdda54345fdf0203732e68e375dc7e144d9e2aa7619f9cafb8",
   "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "4e305be49dd14a34d29c9283b535a72ad6cd84c5bd52afb3f006403f2e5a6850",
   "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "235f3eed546b58aa8f04e155aeaef4e0206dd696517a7854983ab9ce8fe61030",
+  "rules/container/TG-CONT-001-root-user-execution.md": "8cabae14353f63dffe69067c369f55c3e99d05791ff96139cd7eeff7f7db6d3f",
+  "rules/container/TG-CONT-002-docker-socket-mount.md": "e375fa7c7fda1ee026b7df9c1ae2aaf21be34926c18182daf8019479db6295fa",
+  "rules/container/TG-CONT-003-privileged-container-mode.md": "0e500f2553b9fb0865396ac8e9f7f18526af576951c72887ee30874b2b543225",
+  "rules/container/TG-CONT-004-build-arg-secret-exposure.md": "91d290078698480a1bd09e6f4d2e5930dd40c877344b25c5f1be7ca705ecdbd8",
   "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "42fcf19ae244a36b3b64d03200b6d4c1acf1b265fdb2fe6a85de8dd69b3837fe",
   "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "c01a55e31e4aaaea8c9f630b514c1ad242b513ab99111534939584ae4fe1a58c",
   "rules/custom/README.md": "f2128661ad3bc4085a69ddfbabbb2211930215fc42a25e2ab2d3e7a4b749a639",
   "rules/edge/TG-EDGE-001-serverless-global-state-leak.md": "82fe764a67228c71359b340a983cb37dc8bf4521d030846e0cea433de43c52d3",
   "rules/edge/TG-EDGE-003-aws-lambda-ephemeral-cold-start.md": "2659db7d38b6689d1d3a99ad5f2504ea264b3d3a601ab38186737b12d4d42c17",
+  "rules/git/TG-GIT-001-historical-secret-in-git-commit.md": "4a0ad519db2ff6c2311eb872d7b015d3b3a0fef114ae821e24ec640d2ca0e99e",
+  "rules/git/TG-GIT-002-plaintext-credentials-in-git-config.md": "5ec5f9e25e73e37b64b8f6861772395a37a41d3c982eb15cd5d0561311a929bc",
+  "rules/git/TG-GIT-003-sensitive-tracked-file-gitignore-breach.md": "34f54569af1fcaeb68bc9e88f3a1baf08ab74a9024f63d8059ab22fe30b2ee91",
   "rules/graphql/TG-GQL-001-missing-query-depth-or-complexity-limits.md": "bfee2cb26c71871cc4b93e224dc56c18de0d0ea692a431f7b27a51e7e408873f",
   "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "e6429fdcf130478446a2711eac83bd64cc502aad8baa35c04de26958d23e5b0f",
   "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "c2e2beb37c4d86f4ba564e1a1fd9587626df3793b9c5dc9e13d0cf0ce3bfe09a",
   "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "54311588945abc1d79e99a0001390821ccb4434772297b2395e7081d276d6602",
+  "rules/rag/TG-RAG-001-untrusted-rag-context-injection.md": "3cc4c87d373293612210b865d0c936fc5c55dfa5dac2adc8f9822e639dd1102b",
+  "rules/rag/TG-RAG-002-autonomous-llm-tool-unsandboxed-call.md": "6935f2c4b1f254148242b6e1ce656024f1cffb5432e432c038abf63094c13ad3",
+  "rules/rag/TG-RAG-003-unpartitioned-vector-tenant-lookup.md": "44722ba00bfd40a0b98abb9789b77a786ac8deed017cc6543867a131b21bbe1e",
+  "rules/redos/TG-REDOS-001-catastrophic-exponential-backtracking.md": "2cac8e899af177c03dbe01f85ac5f3d485e88ef5a08809e3bc17f676e74d5ae5",
+  "rules/redos/TG-REDOS-002-unbounded-nested-quantifier.md": "5b9032ea9268831e3ecf328039083a7dca95feb330347c29f9120db1a30e2278",
   "rules/secrets/TG-SEC-005-secret-in-git-history.md": "089dbe9653b2a4df652ba049b40147434d6abc70c239ac7db81bdcb9d6579387",
   "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "ed20b1c9044149df5257ad8140bd787db7f77063b890dad9ba32efaf4d554fe5",
   "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "b3d4b9f1d0fd9656aa9a586e133209904c1f3b75a2b7e7c1ecb825a125663e6d",
@@ -143,12 +196,12 @@
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
   "scripts/apply_runner.py": "b145a68a4bc10fcacb853f972aee81fa3607e32d282b2b850c5a63d8e72da890",
-  "scripts/audit_runner.py": "bc1e06ea5153ae326c4ad1de5d0cbb9503e618186623bea7cb8bb64d7b7b05ec",
+  "scripts/audit_runner.py": "18ebcd46f8363169db4ff4675a5258e0b93df5b219650de95b9a5e9f51da5ff9",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
-  "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
+  "scripts/finding_scorer.py": "95c7edfe5ee4742be565914f71bb07bd077b2cf4636b769476345389dd85f3cf",
   "scripts/harden_runner.py": "5d5a40029c088ccb66790a9b0128bdefcd35883ef1dac78088ceb9531392a8f1",
   "scripts/html_reporter.py": "655c57be39e13c177db8842ef471664e5853f3e43b9f2a63e590df40ff9c16cb",
-  "scripts/manifest_builder.py": "18db6979b341a87e9bf38fe06525365d12b07d532c0dbfd2ac3ef0f539dc1f6f",
+  "scripts/manifest_builder.py": "f1f9a0d63c55cf5ff45e9fd39d1b251c2bce05e777f8c1e325741d340f0128db",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
   "scripts/recheck_runner.py": "89e93fcc6843493d7e5f0bf97065dbdb40106273a00e07f903250665ca25f6fb",
@@ -161,8 +214,8 @@
   "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
   "scripts/status_runner.py": "4c358c91950c7874bcc6a5f23f2d3fda62b0752efcf6c6b658adf02ed77c7752",
   "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
-  "skills/torusguard/SKILL.md": "4d5b8e43fa3c09e5e1079cbc3e2184654219a2c47b2272db394da749969318f8",
-  "skills/torusguard/bootstrap.py": "3d946f388cb4befa739c9d3b1404255d9a8ea5770ebbb79e5a1b9839589e9bc7",
+  "skills/torusguard/SKILL.md": "15c69cb10eca1a10344b494888dce57e2baf227c3282bd54424a36ce35fb2460",
+  "skills/torusguard/bootstrap.py": "bd59b64acdab2c359ebaf29b3c6ba763fb4795a8ca6882a760fed23a8a1b50af",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
   "skills/torusguard/references/cache-and-sensitive-responses.md": "81b4a7a08e11dafa4ec58d868c4a35f1f891d0dcdcfbcefaef81e1b9ba94f5a1",
@@ -191,35 +244,45 @@
   "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
   "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
   "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
-  "skills/torusguard-apply/SKILL.md": "4cdd01d8159fc5f7519a806526a119e6d67e41b8af195de018b05d6af09acb12",
-  "skills/torusguard-audit/SKILL.md": "0065336b125cfa8ec766dcec585bce4bbac66b3b063c174b7183dffef18e090d",
-  "skills/torusguard-authorize/SKILL.md": "8694e6cef71cbeb6605fed33dd1f24b74352541069e54de7c3f48c9676e9aa3a",
-  "skills/torusguard-exploit-check/SKILL.md": "87e0e01f28f3efea8dbe81790abaceb845a1290c75a6a16bbd256251cd0539a9",
-  "skills/torusguard-full/SKILL.md": "35f8b38b08fef5a09504312ef3e54921b1f8f31f197bbe2af1474bcce2e83e1c",
-  "skills/torusguard-harden/SKILL.md": "4332761e5454a504176eebbba2d4c585bcf066c8046c014cebc0f5771379c089",
-  "skills/torusguard-init/SKILL.md": "03e599a5dad4262396e6b1a75859f76739b0b1480d8cc64544296106da903dfc",
-  "skills/torusguard-recheck/SKILL.md": "72a0a79b29dcc7f7ae054f00c53e005bc92778f2c6bf3ad828f6391e859d9c1c",
-  "skills/torusguard-report/SKILL.md": "6dc62fb2c9e2986827a802b7cabf41ce41d00a47573524a4bf1642a8d8e2249e",
-  "skills/torusguard-status/SKILL.md": "2ad72e5d317e1d6fe0606f6926b1721dc01ba98b5daa2bfaa90bdd953a67bdf7",
-  "skills/torusguard-verify/SKILL.md": "810c31ba9adc1b410b22eb8503f266be2d51e260a9c6828fd2938e2774e5baa7",
-  "skills/torusguard-web-validate/SKILL.md": "3e02d9734402e8fbc86a0b5c2fdac945ef4fc9d60ba1b992197b1373427ad16e",
+  "skills/torusguard-ai-guard/SKILL.md": "130a24d82f1b92fcc3ac2f4edc77d4d999ae629971f2131f66d6fac876f5593f",
+  "skills/torusguard-apply/SKILL.md": "edb21eabae4f9ad5be5976b20d217941c87b2a15edfc73383d02460ca3253fca",
+  "skills/torusguard-audit/SKILL.md": "b9ffc74381360656cbc78438c003fb1e67c4f0787f87627555863b474d57a8ad",
+  "skills/torusguard-authorize/SKILL.md": "56bcebc718bddadfd66010ebe2d23b4acf429e6230de05dd2300dab6bd383cc2",
+  "skills/torusguard-container/SKILL.md": "f9a2dea0b6b1e2de8ce4a189bb32b1010f1b4d6ff7a529450857b6dab20546ff",
+  "skills/torusguard-exploit-check/SKILL.md": "c127f1766e98e28dc967e452dff5dfec87689a26cf671ab6e62a135cd4d46e4b",
+  "skills/torusguard-full/SKILL.md": "6815ddde9e0e2dec24c174b08e541c80e34569836b1d94fda4ecf9577001e50c",
+  "skills/torusguard-git-mine/SKILL.md": "ebfb2f9955bf83b01be353c0a091396e549e5140564ab725d0479914b161e446",
+  "skills/torusguard-harden/SKILL.md": "14a09c770aa61e39e0ae862bb32304233975299df7e23c640983fd8551bbb0dd",
+  "skills/torusguard-init/SKILL.md": "6f9e9cdc1cc4f98baf2e6047c939b86a6191561c8ddea6c9246651378b00b9a8",
+  "skills/torusguard-ocr-scan/SKILL.md": "5b424d19383a93d757af06c4e777cd88c8cbdbcaaf1adc0c7bb38180ebc2bad8",
+  "skills/torusguard-recheck/SKILL.md": "a5c4539ec6d091179c8ba53792fba46f26795976f392d2305e357f25a2966c55",
+  "skills/torusguard-redos/SKILL.md": "b09b39bd98589613b2107c177e247f6224fb54ab2f028b4339ae01aac9d28c67",
+  "skills/torusguard-report/SKILL.md": "509185ea6730601cf9a44e136219cace61cd0523f8e112de03e4ef1c35e60585",
+  "skills/torusguard-status/SKILL.md": "e9741a20313a8304bc7565b194949a59ec7cfd4945b197517680164b3197efc0",
+  "skills/torusguard-verify/SKILL.md": "aeb4d3c7924253607d130e48491d83bf7b7a21707cd1dac2ba97d64f5e259fd6",
+  "skills/torusguard-web-validate/SKILL.md": "f1df00e10abd823d9a8c4daa1a3af7f26c5263c6c8e58e05b61b647d01a25489",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "67e1002fc6e9d68e0c7d871c40b6f3c3b9c3919c8e02106a579882729c0f6b9f",
-  "workflows/audit.md": "eac9102ca88d53f71da474cd55717d431fd9c3b08c66d0760da9b53a659cf89a",
-  "workflows/authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
-  "workflows/exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
-  "workflows/harden.md": "7d92132973ff867b99e0425e3aee3c4e91868cb5193ec601069af2e857b6697f",
-  "workflows/init.md": "611418577ff9d5719df459f56b3fa53b91eb3717b02c4b4e5e86ed483bed3bfa",
-  "workflows/memory.md": "8ad2ec154176e2540c2859a28eff9f7c2dbca0217aa29d0f4aa88b87c43f8bef",
-  "workflows/recheck.md": "42eecc3ba194564d48a6a88d8003e86cafe003503e887dc565314d4aa558e8fd",
+  "workflows/ai-guard.md": "7d762f4e18f64864b50b64148b972085d2766aeaf13833bc1e6aeb8fddb96999",
+  "workflows/apply.md": "0cd0fa84627ff73ffef84aa7eed6d096b57826139c079fa63f1bd745e13b138a",
+  "workflows/audit.md": "9f13b0497553965d30a71ff040a0dc556d526c8bbff136952b8210685632b5d7",
+  "workflows/authorize.md": "386779f405c4b7de0282938db4095179ed212fd32296dff158acb3258b41aec1",
+  "workflows/container.md": "64936b4873e9dfde6deae8a7d10d572a3bfbbfe9ef2340d0df8a3db5e1d02ad7",
+  "workflows/exploit-check.md": "4dc4016b7a22f18d5c32dd6fcfa7a859df07d03300973654aea92fe5251c8a85",
+  "workflows/git-mine.md": "3406122bc26c16d6518a77cb5cdd823c3860c3acb2873a0b2accd936040d5ca1",
+  "workflows/harden.md": "8a7e0ad3efe336f087fb4ad0205aaca32509145c1c02747d425591c87616c473",
+  "workflows/init.md": "c5c5fe6efbe9d37037b7b558ed396a60eec96bca4f3cf8cac072a1c61b334a1d",
+  "workflows/memory.md": "e23ce835c4e451a720a75cfc19a70ae81550665bb49a71016a4945fa75be981f",
+  "workflows/ocr-scan.md": "e1cee1a4e099df29b776911ac2b4b41a699a40f41286571e85bcb105bd1e6ecb",
+  "workflows/recheck.md": "f57194675ed465ee5fd6e8fc731e7102becd2dd0a8f8848517c0e11d3de849cf",
   "workflows/recipes.md": "300c1fed0167e1a299fcd33c07db05630116b18a71ec2513c385862bba0f179b",
-  "workflows/report.md": "ecbd67bfa95bde3c0f51e06aac6fad70d5989b0be82245116cd7ba367f378a4c",
-  "workflows/status.md": "7f07e726bbb0488e48b718c2f36971634b1422bc2ddfbb381eb3e1ea67c1cfbf",
+  "workflows/redos.md": "f55a4f510849a5ea7e2ae4b08ecc70dff03c1bf21c7fdc664a4ff3ad0396f904",
+  "workflows/report.md": "7c718dfef6da1b66ba0fed300b7dfc90438fc3866af5a9b2aae4b3c3acd638e2",
+  "workflows/status.md": "021a962ae4e6fc81383db2ef42d28dcfc1b3e546c9a10a7a15b9910e531cf0c2",
   "workflows/torusguard-apply.md": "67e1002fc6e9d68e0c7d871c40b6f3c3b9c3919c8e02106a579882729c0f6b9f",
-  "workflows/torusguard-audit.md": "eac9102ca88d53f71da474cd55717d431fd9c3b08c66d0760da9b53a659cf89a",
+  "workflows/torusguard-audit.md": "9f13b0497553965d30a71ff040a0dc556d526c8bbff136952b8210685632b5d7",
   "workflows/torusguard-authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
   "workflows/torusguard-exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
   "workflows/torusguard-harden.md": "7d92132973ff867b99e0425e3aee3c4e91868cb5193ec601069af2e857b6697f",
@@ -231,6 +294,6 @@
   "workflows/torusguard-verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
   "workflows/torusguard-web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371",
   "workflows/torusguard.md": "4b5da6d38dae6be277bd52782121cdb181a75f1400068041310ca69deae89589",
-  "workflows/verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
-  "workflows/web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371"
+  "workflows/verify.md": "dd2579fe7d6e31ba47a4094edfbf4ab04be0745da7dc79e104b0547395c715d1",
+  "workflows/web-validate.md": "08441b01d15fd16f6697a95244632ea1465193631ecfb0746fe0c58895ff1c2b"
 }

package/skills/torusguard/payload/core/__init__.py

@@ -0,0 +1,146 @@
+"""
+TorusGuard Core Architecture & Security Workflow Engine (v0.7.0)
+
+Tiered architectural layers:
+- Tier 1: Canonical Data Models, Lifecycle State Machine & Reporting (v0.5 base)
+- Tier 2: Governed Remediation, Clustering, Patch Policy & SARIF Export (v0.6 engine)
+- Tier 3: Authorized Runtime Validation, Exploitability Confirmation & Multi-Agent Roles (v0.7 engine)
+"""
+
+# ==============================================================================
+# Tier 1: Canonical Data Models, Lifecycle & Provenance (v0.5 base)
+# ==============================================================================
+from .models import (
+    Finding,
+    Evidence,
+    Remediation,
+    FrameworkPattern,
+    AffectedComponent,
+    ReproductionMethod,
+    RetestRecord,
+    NotesRecord,
+    FindingTimestamps,
+    ProvenanceChain,
+    ConfidenceScore,
+    ConfidenceFactors,
+    ConfidenceBand,
+    SeverityLevel,
+    SeverityInfo,
+    RemediationPriority,
+    FindingStatus,
+    LifecycleStage,
+    TaxonomyCategory,
+    EvidenceType,
+    AuditReport,
+    mask_sensitive_data,
+)
+from .lifecycle import FindingLifecycleManager, LifecycleTransitionError
+from .formatter import ReportFormatter
+from .run_folder import RunFolder
+
+# ==============================================================================
+# Tier 2: Governed Remediation, Clustering, Patch Policy & SARIF (v0.6 engine)
+# ==============================================================================
+from .identity import IdentityEngine, FindingFingerprint
+from .clustering import ClusteringEngine, RootCauseCluster
+from .bundle import BundleManager, RemediationBundle
+from .governance import PatchGovernor, PatchPolicyDecision, HIGH_RISK_KEYWORDS, SENSITIVE_CATEGORIES
+from .rechecker import TargetedRechecker, TargetedRecheckResult, RecheckOutcome
+from .run_manager import RunManager
+from .sarif import SarifExporter
+from .v6_reporter import V6Reporter
+from .v6_workflow import V6Workflow
+from .stack_profiler import StackProfiler, StackProfile
+
+# ==============================================================================
+# Tier 3: Authorized Runtime Validation & Exploitability Confirmation (v0.7 engine)
+# ==============================================================================
+from .authorization import AuthorizationManager, AuthorizationRecord, TargetScope, AuthorizationError
+from .safety_gate import SafetyGate, SafetyDecision, SafetyReviewLevel
+from .runtime_evidence import EvidenceCollector, RuntimeEvidenceItem, RedactionEngine
+from .runtime_validator import WebValidator, SessionState
+from .exploit_checker import ExploitChecker, ExploitCheckResult, ExploitabilityStatus
+from .browser_verifier import BrowserVerifier, BrowserAction
+from .agent_roles import RoleOrchestrator, RoleHandoff, AgentRole
+from .replay_trace import ReplayManager, ReplayTrace, ReplayStep
+from .v070_reporter import V070Reporter
+from .v070_workflow import V070Workflow
+
+__version__ = "0.7.0"
+
+__all__ = [
+    # Tier 1: Canonical Models & Lifecycle
+    "Finding",
+    "Evidence",
+    "Remediation",
+    "FrameworkPattern",
+    "AffectedComponent",
+    "ReproductionMethod",
+    "RetestRecord",
+    "NotesRecord",
+    "FindingTimestamps",
+    "ProvenanceChain",
+    "ConfidenceScore",
+    "ConfidenceFactors",
+    "ConfidenceBand",
+    "SeverityLevel",
+    "SeverityInfo",
+    "RemediationPriority",
+    "FindingStatus",
+    "LifecycleStage",
+    "TaxonomyCategory",
+    "EvidenceType",
+    "AuditReport",
+    "mask_sensitive_data",
+    "FindingLifecycleManager",
+    "LifecycleTransitionError",
+    "ReportFormatter",
+    "RunFolder",
+    # Tier 2: Governed Remediation & v0.6 Engine
+    "IdentityEngine",
+    "FindingFingerprint",
+    "ClusteringEngine",
+    "RootCauseCluster",
+    "BundleManager",
+    "RemediationBundle",
+    "PatchGovernor",
+    "PatchPolicyDecision",
+    "HIGH_RISK_KEYWORDS",
+    "SENSITIVE_CATEGORIES",
+    "TargetedRechecker",
+    "TargetedRecheckResult",
+    "RecheckOutcome",
+    "RunManager",
+    "SarifExporter",
+    "V6Reporter",
+    "V6Workflow",
+    "StackProfiler",
+    "StackProfile",
+    # Tier 3: Authorized Runtime Validation & v0.7 Engine
+    "AuthorizationManager",
+    "AuthorizationRecord",
+    "TargetScope",
+    "AuthorizationError",
+    "SafetyGate",
+    "SafetyDecision",
+    "SafetyReviewLevel",
+    "EvidenceCollector",
+    "RuntimeEvidenceItem",
+    "RedactionEngine",
+    "WebValidator",
+    "SessionState",
+    "ExploitChecker",
+    "ExploitCheckResult",
+    "ExploitabilityStatus",
+    "BrowserVerifier",
+    "BrowserAction",
+    "RoleOrchestrator",
+    "RoleHandoff",
+    "AgentRole",
+    "ReplayManager",
+    "ReplayTrace",
+    "ReplayStep",
+    "V070Reporter",
+    "V070Workflow",
+]
+