torusguard 2.0.0-alpha → 2.1.1

package/skills/torusguard/payload/core/exploit_checker.py

@@ -0,0 +1,317 @@
+"""
+TorusGuard v0.7.0 Bounded Exploitability Confirmation Engine
+Confirms practical reachability and exploitability for approved issue classes
+using safe, non-destructive, single-step verification probes.
+"""
+
+from enum import Enum
+from pathlib import Path
+from typing import Dict, Any, List, Optional
+from dataclasses import dataclass, asdict
+
+from core.runtime_validator import WebValidator
+
+
+class ExploitabilityStatus(str, Enum):
+    RUNTIME_CONFIRMED = "Runtime Confirmed"
+    RUNTIME_LIKELY = "Runtime Likely"
+    NEEDS_MANUAL_REVIEW = "Needs Manual Review"
+    NOT_REPRODUCIBLE_IN_SCOPE = "Not Reproducible in Scope"
+    BLOCKED_BY_CONTROLS = "Blocked by Environment / Controls"
+
+
+@dataclass
+class ExploitCheckResult:
+    finding_id: str
+    issue_class: str
+    status: str
+    confidence_score: int
+    probe_url: str
+    http_status_observed: int
+    proof_summary: str
+    reproducible: bool
+    remediation_advice: str
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+class ExploitChecker:
+    """
+    Executes bounded, safe probes to confirm practical exploitability of static findings.
+    """
+
+    @classmethod
+    def check_auth_bypass(
+        cls,
+        validator: WebValidator,
+        finding_id: str,
+        cluster_id: str,
+        endpoint_url: str,
+        expected_sensitive_marker: Optional[str] = None,
+        pre_approved: bool = True
+    ) -> ExploitCheckResult:
+        """
+        Validates whether an endpoint flagged for missing authentication
+        returns sensitive data to unauthenticated requests.
+        """
+        status, headers, body, decision = validator.execute_probe(
+            finding_id=finding_id,
+            cluster_id=cluster_id,
+            method="GET",
+            target_url=endpoint_url,
+            headers={},  # Explicitly unauthenticated
+            pre_approved=pre_approved,
+            route_context="auth_bypass_probe"
+        )
+
+        if not decision.allowed_to_proceed:
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="auth_bypass",
+                status=ExploitabilityStatus.BLOCKED_BY_CONTROLS.value,
+                confidence_score=50,
+                probe_url=endpoint_url,
+                http_status_observed=status,
+                proof_summary="Probe blocked by TorusGuard Safety Gate.",
+                reproducible=False,
+                remediation_advice="Review endpoint permissions manually."
+            )
+
+        if status in [401, 403, 302]:
+            # Endpoint has active authentication barrier
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="auth_bypass",
+                status=ExploitabilityStatus.NOT_REPRODUCIBLE_IN_SCOPE.value,
+                confidence_score=20,
+                probe_url=endpoint_url,
+                http_status_observed=status,
+                proof_summary=f"Endpoint returned HTTP {status}, enforcing auth barrier at runtime.",
+                reproducible=True,
+                remediation_advice="Static finding may be protected by middleware or gateway barrier."
+            )
+
+        if status == 200:
+            if expected_sensitive_marker and expected_sensitive_marker not in body:
+                return ExploitCheckResult(
+                    finding_id=finding_id,
+                    issue_class="auth_bypass",
+                    status=ExploitabilityStatus.RUNTIME_LIKELY.value,
+                    confidence_score=75,
+                    probe_url=endpoint_url,
+                    http_status_observed=status,
+                    proof_summary="Endpoint returned HTTP 200 without auth, but expected payload marker was absent.",
+                    reproducible=True,
+                    remediation_advice="Enforce login_required or authentication dependency."
+                )
+
+            # Confirmed unauthenticated access
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="auth_bypass",
+                status=ExploitabilityStatus.RUNTIME_CONFIRMED.value,
+                confidence_score=98,
+                probe_url=endpoint_url,
+                http_status_observed=status,
+                proof_summary=f"Unauthenticated GET to {endpoint_url} returned HTTP 200 with sensitive payload.",
+                reproducible=True,
+                remediation_advice="Immediate remediation required: Add authentication barrier (e.g. Depends(get_current_user))."
+            )
+
+        return ExploitCheckResult(
+            finding_id=finding_id,
+            issue_class="auth_bypass",
+            status=ExploitabilityStatus.NEEDS_MANUAL_REVIEW.value,
+            confidence_score=60,
+            probe_url=endpoint_url,
+            http_status_observed=status,
+            proof_summary=f"Ambiguous response HTTP {status} received.",
+            reproducible=True,
+            remediation_advice="Inspect route handler and server error logs."
+        )
+
+    @classmethod
+    def check_tenant_isolation(
+        cls,
+        validator: WebValidator,
+        finding_id: str,
+        cluster_id: str,
+        tenant_a_resource_url: str,
+        tenant_b_auth_headers: Dict[str, str],
+        tenant_a_data_marker: str,
+        pre_approved: bool = True
+    ) -> ExploitCheckResult:
+        """
+        Validates IDOR / Multi-tenant isolation: accesses Tenant A's resource
+        using Tenant B's credentials.
+        """
+        status, headers, body, decision = validator.execute_probe(
+            finding_id=finding_id,
+            cluster_id=cluster_id,
+            method="GET",
+            target_url=tenant_a_resource_url,
+            headers=tenant_b_auth_headers,
+            pre_approved=pre_approved,
+            route_context="tenant_isolation_probe"
+        )
+
+        if not decision.allowed_to_proceed:
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="tenant_isolation",
+                status=ExploitabilityStatus.BLOCKED_BY_CONTROLS.value,
+                confidence_score=50,
+                probe_url=tenant_a_resource_url,
+                http_status_observed=status,
+                proof_summary="Probe blocked by Safety Gate.",
+                reproducible=False,
+                remediation_advice="Review tenant boundary manually."
+            )
+
+        if status in [403, 404]:
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="tenant_isolation",
+                status=ExploitabilityStatus.NOT_REPRODUCIBLE_IN_SCOPE.value,
+                confidence_score=15,
+                probe_url=tenant_a_resource_url,
+                http_status_observed=status,
+                proof_summary=f"Tenant B credentials received HTTP {status} accessing Tenant A resource. Tenant scoping holds.",
+                reproducible=True,
+                remediation_advice="Static rule may have flagged query without detecting surrounding tenant middleware."
+            )
+
+        if status == 200 and tenant_a_data_marker in body:
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="tenant_isolation",
+                status=ExploitabilityStatus.RUNTIME_CONFIRMED.value,
+                confidence_score=99,
+                probe_url=tenant_a_resource_url,
+                http_status_observed=status,
+                proof_summary="Tenant B credentials successfully retrieved Tenant A's private data (Cross-Tenant IDOR confirmed).",
+                reproducible=True,
+                remediation_advice="Add tenant_id filter predicate to database query."
+            )
+
+        return ExploitCheckResult(
+            finding_id=finding_id,
+            issue_class="tenant_isolation",
+            status=ExploitabilityStatus.NEEDS_MANUAL_REVIEW.value,
+            confidence_score=60,
+            probe_url=tenant_a_resource_url,
+            http_status_observed=status,
+            proof_summary=f"HTTP {status} returned; marker presence inconclusive.",
+            reproducible=True,
+            remediation_advice="Manually verify multi-tenant query filter."
+        )
+
+    @classmethod
+    def check_header_trust(
+        cls,
+        validator: WebValidator,
+        finding_id: str,
+        cluster_id: str,
+        endpoint_url: str,
+        spoofed_headers: Dict[str, str],
+        expected_reflection_marker: str,
+        pre_approved: bool = True
+    ) -> ExploitCheckResult:
+        """
+        Validates whether the backend implicitly trusts spoofed client headers (e.g. X-Tenant-ID, X-Role).
+        """
+        status, headers, body, decision = validator.execute_probe(
+            finding_id=finding_id,
+            cluster_id=cluster_id,
+            method="GET",
+            target_url=endpoint_url,
+            headers=spoofed_headers,
+            pre_approved=pre_approved,
+            route_context="header_trust_probe"
+        )
+
+        if not decision.allowed_to_proceed:
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="header_trust",
+                status=ExploitabilityStatus.BLOCKED_BY_CONTROLS.value,
+                confidence_score=50,
+                probe_url=endpoint_url,
+                http_status_observed=status,
+                proof_summary="Probe blocked by Safety Gate.",
+                reproducible=False,
+                remediation_advice="Review header trust manually."
+            )
+
+        if status == 200 and expected_reflection_marker in body:
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="header_trust",
+                status=ExploitabilityStatus.RUNTIME_CONFIRMED.value,
+                confidence_score=95,
+                probe_url=endpoint_url,
+                http_status_observed=status,
+                proof_summary=f"Backend adopted spoofed header values: '{expected_reflection_marker}' reflected in state/response.",
+                reproducible=True,
+                remediation_advice="Derive user and tenant identity from verified server-side session/JWT, not request headers."
+            )
+
+        return ExploitCheckResult(
+            finding_id=finding_id,
+            issue_class="header_trust",
+            status=ExploitabilityStatus.NOT_REPRODUCIBLE_IN_SCOPE.value,
+            confidence_score=20,
+            probe_url=endpoint_url,
+            http_status_observed=status,
+            proof_summary="Header spoofing rejected or ignored by backend.",
+            reproducible=True,
+            remediation_advice="Ensure gateway strips untrusted client headers."
+        )
+
+    @classmethod
+    def check_debug_exposure(
+        cls,
+        validator: WebValidator,
+        finding_id: str,
+        cluster_id: str,
+        debug_url: str,
+        debug_marker: str,
+        pre_approved: bool = True
+    ) -> ExploitCheckResult:
+        """
+        Validates whether internal debug/profiler endpoints are exposed to public callers.
+        """
+        status, headers, body, decision = validator.execute_probe(
+            finding_id=finding_id,
+            cluster_id=cluster_id,
+            method="GET",
+            target_url=debug_url,
+            pre_approved=pre_approved,
+            route_context="debug_exposure_probe"
+        )
+
+        if status == 200 and debug_marker in body:
+            return ExploitCheckResult(
+                finding_id=finding_id,
+                issue_class="debug_exposure",
+                status=ExploitabilityStatus.RUNTIME_CONFIRMED.value,
+                confidence_score=97,
+                probe_url=debug_url,
+                http_status_observed=status,
+                proof_summary=f"Debug endpoint {debug_url} is active and leaks internal environment markers.",
+                reproducible=True,
+                remediation_advice="Set DEBUG=False and disable development profiler routes in production."
+            )
+
+        return ExploitCheckResult(
+            finding_id=finding_id,
+            issue_class="debug_exposure",
+            status=ExploitabilityStatus.NOT_REPRODUCIBLE_IN_SCOPE.value,
+            confidence_score=10,
+            probe_url=debug_url,
+            http_status_observed=status,
+            proof_summary="Debug route disabled or restricted (HTTP 404/403).",
+            reproducible=True,
+            remediation_advice="Maintain strict environment variable isolation."
+        )

package/skills/torusguard/payload/core/formatter.py

@@ -0,0 +1,351 @@
+"""
+TorusGuard Report Formatter (v0.5.4)
+Renders comprehensive, actionable, ticket-ready Markdown and structured JSON audit reports.
+"""
+
+from typing import Dict, Any, List
+from .models import (
+    AuditReport,
+    Finding,
+    SeverityLevel,
+    ConfidenceBand,
+    FindingStatus,
+    RemediationPriority,
+)
+
+
+class ReportFormatter:
+    """
+    Produces deterministic, human-readable, ticket-ready Markdown and structured JSON audit reports.
+    """
+
+    SEVERITY_BADGES = {
+        SeverityLevel.CRITICAL: "🔴 Critical",
+        SeverityLevel.HIGH: "🟠 High",
+        SeverityLevel.MEDIUM: "🟡 Medium",
+        SeverityLevel.LOW: "🔵 Low",
+        SeverityLevel.INFORMATIONAL: "ℹ️ Info",
+    }
+
+    CONFIDENCE_BADGES = {
+        ConfidenceBand.CONFIRMED: "🔒 Confirmed",
+        ConfidenceBand.HIGH_CONFIDENCE: "🟢 High Confidence",
+        ConfidenceBand.MEDIUM_CONFIDENCE: "🟡 Medium Confidence",
+        ConfidenceBand.LOW_CONFIDENCE: "🟠 Low Confidence",
+        ConfidenceBand.UNCONFIRMED: "⚪ Unconfirmed",
+        ConfidenceBand.NEEDS_REVIEW: "🔍 Needs Review",
+        ConfidenceBand.INFORMATIONAL: "ℹ️ Informational",
+        ConfidenceBand.NOT_APPLICABLE: "⚪ N/A",
+    }
+
+    STATUS_BADGES = {
+        FindingStatus.CONFIRMED: "🔴 Confirmed",
+        FindingStatus.HIGH_CONFIDENCE: "🟠 High Confidence",
+        FindingStatus.MEDIUM_CONFIDENCE: "🟡 Medium Confidence",
+        FindingStatus.LOW_CONFIDENCE: "⚪ Low Confidence",
+        FindingStatus.UNCONFIRMED: "⚪ Unconfirmed",
+        FindingStatus.NEEDS_REVIEW: "🔍 Needs Review",
+        FindingStatus.REMEDIATED: "🟡 Remediated (Pending Retest)",
+        FindingStatus.VERIFIED_FIXED: "🟢 Verified Fixed",
+        FindingStatus.SUPPRESSED: "⚪ Suppressed",
+    }
+
+    PRIORITY_BADGES = {
+        RemediationPriority.IMMEDIATE: "🚨 Immediate (P0)",
+        RemediationPriority.NEAR_TERM: "🟠 Near-Term (P1)",
+        RemediationPriority.BACKLOG: "🟡 Backlog (P2)",
+    }
+
+    @staticmethod
+    def render_markdown(report: AuditReport) -> str:
+        report.calculate_summary()
+        summary = report.summary_counts
+
+        # Overall posture indicator
+        if summary.get("critical", 0) > 0 or summary.get("high", 0) > 0:
+            posture_icon = "🔴 Action Required (Pre-Deployment Blockers Found)"
+        elif summary.get("medium", 0) > 0:
+            posture_icon = "🟡 Warnings Found (Hardening Recommended)"
+        elif summary.get("needs_review", 0) > 0:
+            posture_icon = "🔍 Needs Review (Architectural Verification Required)"
+        else:
+            posture_icon = "🟢 Ready / Verified Safe (All Checks Passing)"
+
+        lines = [
+            f"# TorusGuard Security Audit & Remediation Report",
+            f"",
+            f"> **Project:** `{report.project_name}` | **Repository Reference:** `{report.repository_ref}`  ",
+            f"> **Engine Version:** TorusGuard `{report.torusguard_version}` (Actionable Remediation & Usability Release)  ",
+            f"> **Generated At:** `{report.generated_at}` | **Report Owner:** `{report.report_owner}`  ",
+            f"> **Overall Security Posture:** **{posture_icon}**",
+            f"",
+            f"---",
+            f"",
+            f"## 1. 📋 Executive Summary",
+            f"",
+            f"This security assessment evaluated **{report.project_name}** using TorusGuard's evidence-backed finding lifecycle and deterministic validation engine. The scan analyzed source files, configuration manifests, data queries, and API endpoint boundaries.",
+            f"",
+            f"- **Key Risk Themes:** " + (
+                "Critical authorization boundaries, input handling, and configuration exposures require remediation."
+                if summary.get("critical", 0) > 0 or summary.get("high", 0) > 0
+                else "No high-severity vulnerabilities detected; defensive baselines satisfied."
+            ),
+            f"- **Validation Status:** `{summary.get('confirmed', 0)}` Confirmed Findings | `{summary.get('needs_review', 0)}` Needs Review | `{summary.get('verified_fixed', 0)}` Verified Fixed",
+            f"- **Immediate Action Required:** " + (
+                f"Triage and remediate `{summary.get('immediate_priority', 0)}` P0 immediate priority finding(s) before production deployment."
+                if summary.get("immediate_priority", 0) > 0
+                else "Application meets primary security release criteria."
+            ),
+            f"",
+            f"### 📊 Security Metrics at a Glance",
+            f"",
+            f"| Metric | Count | Stakeholder Guidance |",
+            f"|---|:---:|---|",
+            f"| **Total Tracked Findings** | `{summary.get('total_findings', 0)}` | Total normalized finding objects |",
+            f"| **Immediate Priority (P0)** | `{summary.get('immediate_priority', 0)}` | 🚨 Pre-deployment blockers |",
+            f"| **Near-Term Priority (P1)** | `{summary.get('near_term_priority', 0)}` | 🟠 Current sprint patch cycle |",
+            f"| **Backlog / Hardening (P2)** | `{summary.get('backlog_priority', 0)}` | 🟡 Defense-in-depth backlog |",
+            f"| **Auditable Average Confidence** | `{summary.get('average_confidence_score', 0)}/100` | Mathematical evidence score |",
+            f"| **Verified Fixed Post-Retest** | `{summary.get('verified_fixed', 0)}` | 🟢 Retest confirmed resolution |",
+            f"",
+            f"---",
+            f"",
+            f"## 2. 🔍 Scope and Methodology",
+            f"",
+            f"- **Target Application:** `{report.project_name}`",
+            f"- **Detected Stack:** `{report.detected_stack.get('language', 'Unknown')}` / `{report.detected_stack.get('framework', 'Unknown')}` (Data layer: `{report.detected_stack.get('data_layer', 'None')}`)",
+            f"- **Tested Scope:** Source code AST structures, route handlers, serializer definitions, database queries, upload paths, and environment configurations.",
+            f"- **Out of Scope:** Live production network penetration testing, active DDoS simulation, third-party SaaS infrastructure compliance audits.",
+            f"- **Interpretation Guide:** Every finding is backed by immutable cryptographic evidence hashes. Findings marked `Needs Review` reflect out-of-band architecture requiring human architectural verification.",
+            f"",
+            f"---",
+            f"",
+            f"## 3. 📑 Key Findings Summary Table",
+            f"",
+            f"| Ref ID | Title | Category | Severity | Confidence | Status | Priority | Location |",
+            f"|---|---|---|:---:|:---:|:---:|:---:|---|",
+        ]
+
+        if not report.findings:
+            lines.append("| — | *No findings identified* | — | — | — | 🟢 Safe | — | — |")
+        else:
+            for f in report.findings:
+                sev_badge = ReportFormatter.SEVERITY_BADGES.get(f.severity.level, str(f.severity.level))
+                conf_badge = f"{f.confidence.score}/100"
+                stat_badge = ReportFormatter.STATUS_BADGES.get(f.status, str(f.status.value))
+                pri_badge = ReportFormatter.PRIORITY_BADGES.get(f.remediation_priority, str(f.remediation_priority))
+                loc_str = f"`{f.affected_component.target_path}`"
+                if f.affected_component.start_line:
+                    loc_str += f":{f.affected_component.start_line}"
+                lines.append(
+                    f"| `{f.rule_id}` | **{f.title}** | `{f.category.value}` | {sev_badge} | {conf_badge} | {stat_badge} | {pri_badge} | {loc_str} |"
+                )
+
+        lines.extend([
+            f"",
+            f"---",
+            f"",
+            f"## 4. 🛡️ Detailed Findings",
+            f"",
+        ])
+
+        if not report.findings:
+            lines.append("🎉 **No vulnerabilities detected!** Application complies with all TorusGuard security baselines.\n")
+        else:
+            for idx, f in enumerate(report.findings, 1):
+                sev_badge = ReportFormatter.SEVERITY_BADGES.get(f.severity.level, str(f.severity.level))
+                conf_badge = ReportFormatter.CONFIDENCE_BADGES.get(f.confidence.band, str(f.confidence.band))
+                status_badge = ReportFormatter.STATUS_BADGES.get(f.status, str(f.status.value))
+                pri_badge = ReportFormatter.PRIORITY_BADGES.get(f.remediation_priority, str(f.remediation_priority))
+
+                loc_str = f"{f.affected_component.target_path}"
+                if f.affected_component.start_line:
+                    loc_str += f":{f.affected_component.start_line}"
+                if f.affected_component.symbol:
+                    loc_str += f" (`{f.affected_component.symbol}`)"
+
+                factors = f.confidence.factors
+
+                lines.extend([
+                    f"### {idx}. [{f.rule_id}] {f.title}",
+                    f"",
+                    f"> **Finding ID:** `{f.finding_id}` | **Remediation Priority:** **{pri_badge}**  ",
+                    f"> **Severity:** {sev_badge} | **Auditable Confidence:** {conf_badge} (`{f.confidence.score}/100`) | **Status:** {status_badge}  ",
+                    f"> **Location:** `{loc_str}` | **Lifecycle Stage:** `{f.lifecycle_stage.value}`",
+                    f"",
+                    f"#### 🏢 Business Impact & Executive Context",
+                    f"{f.notes.business_impact}",
+                    f"",
+                    f"#### ⚙️ Technical Mechanics & Threat Context",
+                    f"{f.notes.technical_description}",
+                    f"",
+                    f"#### 🔍 Auditable Confidence Score Breakdown (`{f.confidence.score}/100`)",
+                    f"- **Evidence Quality:** `{factors.evidence_quality}/35` pts (Direct source AST/syntax match)",
+                    f"- **Reproduction Success:** `{factors.reproduction_success}/25` pts (Deterministic reproduction path)",
+                    f"- **Independent Confirmations:** `{factors.independent_confirmations}/15` pts (Corroborated across files)",
+                    f"- **Environmental Clarity:** `{factors.environmental_clarity}/15` pts (No ambiguous out-of-band proxy/service)",
+                    f"- **Manual Review Status:** `{factors.manual_review_status}/10` pts (Reviewer validation)",
+                    f"- **Confidence Justification:** {f.confidence.rationale}",
+                    f"",
+                    f"#### 🔗 Provenance Chain",
+                    f"- **Discovery Module:** `{f.provenance.discovery_module}`",
+                    f"- **Triggering Input:** `{f.provenance.triggering_input}`",
+                    f"- **Decision Path:**",
+                ])
+
+                for step in f.provenance.decision_path:
+                    lines.append(f"  1. {step}")
+
+                lines.extend([
+                    f"- **Verification Step:** {f.provenance.verification_step}",
+                    f"",
+                    f"#### 📦 Technical Evidence Package",
+                ])
+
+                for ev_idx, ev in enumerate(f.evidence, 1):
+                    lines.extend([
+                        f"**Evidence Item #{ev_idx} ({ev.type.value}):** `{ev.location}`",
+                        f"- **SHA-256 Checksum:** `{ev.sha256_checksum}`",
+                        f"- **Rationale:** {ev.rationale}",
+                        f"```",
+                        f"{ev.get_masked_snippet().strip()}",
+                        f"```",
+                    ])
+
+                lines.extend([
+                    f"#### 🛠️ Prescriptive Remediation",
+                    f"**Problem Statement:** {f.remediation.problem_statement}",
+                    f"",
+                    f"**Recommended Action:** {f.remediation.recommended_fix}",
+                    f"",
+                    f"**Framework Patch ({f.remediation.framework_pattern.framework}):**",
+                    f"```diff",
+                    f"- // UNSAFE ORIGINAL",
+                    f"- {f.remediation.framework_pattern.unsafe_snippet.strip()}",
+                    f"+ // SAFE REMEDIATION",
+                    f"+ {f.remediation.framework_pattern.safe_snippet.strip()}",
+                    f"```",
+                    f"",
+                    f"**Verification Method:** {f.remediation.verification_method}",
+                    f"",
+                    f"**Residual Risk Notes:** {f.remediation.residual_risk_notes}",
+                    f"",
+                    f"#### 🔁 Retest & Closure Status",
+                ])
+
+                if f.retest_result.retest_performed:
+                    lines.extend([
+                        f"- **Retest Executed:** ✅ Yes (`{f.retest_result.retest_timestamp}`)",
+                        f"- **Closure Status:** **`{f.retest_result.closure_status.value}`**",
+                        f"- **Retest Method:** `{f.retest_result.retest_method}`",
+                        f"- **Post-Fix Evidence Hash:** `{f.retest_result.retest_evidence_hash}`",
+                        f"- **Verifier Notes:** {f.retest_result.verifier_notes}",
+                    ])
+                else:
+                    lines.extend([
+                        f"- **Retest Executed:** ⏳ Pending (Run `/torusguard recheck` after applying fix)",
+                        f"- **Closure Status:** `{f.status.value}`",
+                    ])
+
+                # Copy-pasteable Ticket/Issue payload
+                lines.extend([
+                    f"",
+                    f"<details>",
+                    f"<summary>🎫 Copy-Paste Issue Tracker Payload (GitHub / Jira / Linear)</summary>",
+                    f"",
+                    f"```markdown",
+                    f"### [Security] Fix {f.rule_id}: {f.title}",
+                    f"",
+                    f"**Priority:** {pri_badge} | **Severity:** {sev_badge} | **Location:** `{loc_str}`",
+                    f"",
+                    f"#### Problem",
+                    f"{f.remediation.problem_statement}",
+                    f"",
+                    f"#### Business Impact",
+                    f"{f.notes.business_impact}",
+                    f"",
+                    f"#### Proposed Fix",
+                    f"{f.remediation.recommended_fix}",
+                    f"",
+                    f"#### Verification",
+                    f"Run `/torusguard recheck` to verify resolution.",
+                    f"```",
+                    f"</details>",
+                    f"",
+                    f"---",
+                    f"",
+                ])
+
+        # Section 5: Remediation Priorities
+        lines.extend([
+            f"## 5. 🎯 Remediation Priorities & Triage Roadmap",
+            f"",
+            f"### 🚨 Immediate Priority (P0 — Pre-Deployment Blockers)",
+        ])
+
+        immediate_findings = [f for f in report.findings if f.remediation_priority == RemediationPriority.IMMEDIATE]
+        if immediate_findings:
+            for f in immediate_findings:
+                lines.append(f"- [ ] **[{f.rule_id}] {f.title}** (`{f.affected_component.target_path}`) — {f.remediation.recommended_fix}")
+        else:
+            lines.append("- *No immediate P0 blockers.*")
+
+        lines.extend([
+            f"",
+            f"### 🟠 Near-Term Priority (P1 — Current Sprint Patch Cycle)",
+        ])
+
+        near_term_findings = [f for f in report.findings if f.remediation_priority == RemediationPriority.NEAR_TERM]
+        if near_term_findings:
+            for f in near_term_findings:
+                lines.append(f"- [ ] **[{f.rule_id}] {f.title}** (`{f.affected_component.target_path}`) — {f.remediation.recommended_fix}")
+        else:
+            lines.append("- *No near-term P1 items.*")
+
+        lines.extend([
+            f"",
+            f"### 🟡 Backlog / Hardening (P2 — Defense-in-Depth)",
+        ])
+
+        backlog_findings = [f for f in report.findings if f.remediation_priority == RemediationPriority.BACKLOG]
+        if backlog_findings:
+            for f in backlog_findings:
+                lines.append(f"- [ ] **[{f.rule_id}] {f.title}** (`{f.affected_component.target_path}`) — {f.remediation.recommended_fix}")
+        else:
+            lines.append("- *No backlog hardening items.*")
+
+        # Section 6: Retest & Verification
+        lines.extend([
+            f"",
+            f"---",
+            f"",
+            f"## 6. 🔁 Retest & Verification Workflow",
+            f"1. **Apply Code Patches:** Follow the Before/After framework diffs provided in Section 4.",
+            f"2. **Execute Retest:** Run `/torusguard recheck` to verify that findings transition to `Verified Fixed`.",
+            f"3. **Inspect Needs Review Items:** For items marked `Needs Review`, manually verify service-layer authorization and cloud IAM policies.",
+            f"",
+            f"---",
+            f"",
+            f"## 7. ⚖️ Limitations & Operational Boundaries",
+            f"- **Source-Only Analysis:** Findings are derived from static source code inspection, AST patterns, and configuration files.",
+            f"- **Manual Review Boundary:** When authorization or validation is delegated to out-of-band microservices, reverse proxies, or cloud IAM, TorusGuard assigns `Needs Review`.",
+            f"- **Sensitive Data Masking:** All secrets, tokens, and credentials in evidence snippets are automatically redacted.",
+            f"",
+            f"---",
+            f"",
+            f"## 8. 📚 Appendix & Reference Models",
+            f"",
+            f"### Confidence Scoring Model (0–100)",
+            f"- **90–100 (`Confirmed`):** Direct, indisputable proof of vulnerability with reachable sink.",
+            f"- **70–89 (`High Confidence`):** Strong static indicators present; localized verification recommended.",
+            f"- **50–69 (`Medium Confidence`):** Probable flaw; runtime confirmation recommended.",
+            f"- **< 50 (`Needs Review`):** Insufficient evidence or out-of-band architectural delegation.",
+            f"",
+            f"### Severity Rubric",
+            f"- **Critical (P0):** Remote Code Execution, unauthenticated SQL injection, hardcoded secrets, complete auth bypass.",
+            f"- **High (P1):** Object-level authorization bypass (IDOR), SSRF, XSS, tenant data leakage.",
+            f"- **Medium (P2):** Missing rate limits, insecure cookie attributes, missing CSRF tokens.",
+            f"- **Low / Info:** Verbose error banners, public source maps, hardening recommendations.",
+        ])
+
+        return "\n".join(lines)