torusguard 2.0.0-alpha → 2.1.1

package/skills/torusguard/payload/core/governance.py

@@ -0,0 +1,210 @@
+"""
+TorusGuard v6 Minimal Patch Governance Engine
+Enforces strict policy boundaries around automated code modifications:
+- Line churn bounding (max added/removed lines)
+- File count limits (single-file preference)
+- High-risk file escalation (auth, crypto, tenant isolation, DB, uploads, workflows)
+- Comment/boilerplate checks
+- Zero unrelated file changes
+- Automatic application blocking for oversized or high-risk diffs
+"""
+
+from dataclasses import dataclass, field, asdict
+from typing import List, Dict, Any, Tuple, Optional
+import re
+from pathlib import Path
+
+
+# Sensitive Path Categories
+SENSITIVE_CATEGORIES = {
+    "auth": ["auth", "login", "password", "token", "jwt", "session", "oauth", "oidc", "credential"],
+    "tenancy": ["tenant", "tenant_id", "organization_id", "org_id", "workspace_id"],
+    "secrets": ["secret", "api_key", "private_key", "ssh_key", "access_key"],
+    "crypto": ["crypto", "cipher", "encrypt", "decrypt", "hashlib", "hmac"],
+    "uploads": ["upload", "storage", "filepath", "save_file", "download"],
+    "workflows": [".github/workflows", "Dockerfile", "Containerfile", "compose.yaml", "docker-compose"]
+}
+
+HIGH_RISK_KEYWORDS = [kw for kws in SENSITIVE_CATEGORIES.values() for kw in kws]
+
+HIGH_RISK_DIRECTORIES = [
+    "auth", "authentication", "authorization", "security",
+    "crypto", "migrations", ".github/workflows"
+]
+
+
+@dataclass
+class PatchPolicyDecision:
+    allowed_auto_apply: bool
+    escalation_required: bool
+    review_level: str = "Automatic"  # "Automatic" | "Peer Review Recommended" | "Mandatory Security Sign-Off"
+    rejection_reasons: List[str] = field(default_factory=list)
+    risk_factors: List[str] = field(default_factory=list)
+    line_additions: int = 0
+    line_deletions: int = 0
+    files_touched: int = 0
+    file_list: List[str] = field(default_factory=list)
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+class PatchGovernor:
+    """
+    Evaluates proposed diffs against minimal patch governance rules.
+    """
+
+    def __init__(
+        self,
+        max_additions_per_file: int = 35,
+        max_deletions_per_file: int = 25,
+        max_total_files: int = 2,
+        strict_high_risk_escalation: bool = True,
+    ):
+        self.max_additions_per_file = max_additions_per_file
+        self.max_deletions_per_file = max_deletions_per_file
+        self.max_total_files = max_total_files
+        self.strict_high_risk_escalation = strict_high_risk_escalation
+
+    @staticmethod
+    def _parse_diff(diff_content: str, target_file: Optional[str] = None) -> Tuple[set[str], int, int, int]:
+        """Parses unified diff lines to extract modified files, churn counts, and filler comment lines."""
+        lines = diff_content.splitlines()
+        additions = 0
+        deletions = 0
+        files: set[str] = set()
+        unnecessary_comment_lines = 0
+
+        for line in lines:
+            if line.startswith("+++ b/"):
+                files.add(line[6:].strip())
+            elif line.startswith("--- a/"):
+                old_file = line[6:].strip()
+                if old_file != "/dev/null":
+                    files.add(old_file)
+            elif line.startswith("+") and not line.startswith("+++"):
+                additions += 1
+                stripped = line[1:].strip()
+                if stripped.startswith("# TODO:") or stripped.startswith("// Added by AI"):
+                    unnecessary_comment_lines += 1
+            elif line.startswith("-") and not line.startswith("---"):
+                deletions += 1
+
+        if target_file and not files:
+            files.add(target_file)
+
+        return files, additions, deletions, unnecessary_comment_lines
+
+    def enforce_file_bounds(self, files_count: int) -> Optional[str]:
+        """Checks if total files modified exceed policy threshold."""
+        if files_count > self.max_total_files:
+            return f"Patch modifies {files_count} files (maximum allowed is {self.max_total_files})."
+        return None
+
+    def enforce_line_bounds(self, additions: int, deletions: int) -> List[str]:
+        """Checks if line additions or deletions exceed policy thresholds."""
+        reasons = []
+        if additions > self.max_additions_per_file:
+            reasons.append(f"Line additions ({additions}) exceed threshold ({self.max_additions_per_file}).")
+        if deletions > self.max_deletions_per_file:
+            reasons.append(f"Line deletions ({deletions}) exceed threshold ({self.max_deletions_per_file}).")
+        return reasons
+
+    def check_filler_comments(self, unnecessary_comment_lines: int) -> Optional[str]:
+        """Checks for excessive boilerplate or AI commentary in diff."""
+        if unnecessary_comment_lines > 2:
+            return "Patch contains excessive boilerplate or commentary."
+        return None
+
+    def escalate_sensitive_paths(self, files: set[str], diff_content: str = "") -> Tuple[bool, List[str]]:
+        """Identifies if any touched file or diff content matches high-risk sensitive domain keywords."""
+        risk_factors = []
+        escalation_required = False
+        for f in files:
+            norm_f = f.lower().replace("\\", "/")
+            for kw in HIGH_RISK_KEYWORDS:
+                if kw in norm_f:
+                    risk_factors.append(f"File `{f}` touches high-risk domain keyword `{kw}`.")
+                    escalation_required = True
+                    break
+
+        if diff_content:
+            for line in diff_content.splitlines():
+                if (line.startswith("+") and not line.startswith("+++")) or (line.startswith("-") and not line.startswith("---")):
+                    line_lower = line.lower()
+                    for kw in HIGH_RISK_KEYWORDS:
+                        if kw in line_lower:
+                            risk_factors.append(f"Diff line touches high-risk domain keyword `{kw}`.")
+                            escalation_required = True
+                            break
+                    if escalation_required:
+                        break
+
+        return escalation_required, risk_factors
+
+    def determine_review_level(
+        self, escalation_required: bool, additions: int, deletions: int, files_count: int
+    ) -> Tuple[str, bool, List[str]]:
+        """Determines review escalation level and whether auto-apply is blocked."""
+        reasons = []
+        review_level = "Automatic"
+        allowed = True
+
+        if escalation_required:
+            if additions > 10 or deletions > 10 or files_count > 1:
+                review_level = "Mandatory Security Sign-Off"
+                if self.strict_high_risk_escalation:
+                    allowed = False
+                    reasons.append("High-risk file modifications with non-trivial churn require explicit human approval.")
+            else:
+                review_level = "Peer Review Recommended"
+
+        return review_level, allowed, reasons
+
+    def evaluate_patch(self, diff_content: str, target_file: Optional[str] = None) -> PatchPolicyDecision:
+        """
+        Parses unified diff and evaluates all governance policy compliance rules.
+        """
+        files, additions, deletions, comment_lines = self._parse_diff(diff_content, target_file)
+
+        rejection_reasons: List[str] = []
+
+        # 1. File Count Check
+        file_err = self.enforce_file_bounds(len(files))
+        if file_err:
+            rejection_reasons.append(file_err)
+
+        # 2. Line Churn Check
+        rejection_reasons.extend(self.enforce_line_bounds(additions, deletions))
+
+        # 3. Filler Comment Check
+        comment_err = self.check_filler_comments(comment_lines)
+        if comment_err:
+            rejection_reasons.append(comment_err)
+
+        # 4. Sensitive Path Escalation
+        escalation_required, risk_factors = self.escalate_sensitive_paths(files, diff_content)
+
+        # 5. Review Level Determination
+        review_level, allowed_by_escalation, escalation_reasons = self.determine_review_level(
+            escalation_required, additions, deletions, len(files)
+        )
+        rejection_reasons.extend(escalation_reasons)
+
+        allowed = (len(rejection_reasons) == 0) and allowed_by_escalation
+
+        return PatchPolicyDecision(
+            allowed_auto_apply=allowed,
+            escalation_required=escalation_required,
+            review_level=review_level,
+            rejection_reasons=rejection_reasons,
+            risk_factors=risk_factors,
+            line_additions=additions,
+            line_deletions=deletions,
+            files_touched=len(files),
+            file_list=list(files),
+        )
+
+    def evaluate_diff(self, diff_content: str, target_file: Optional[str] = None) -> PatchPolicyDecision:
+        """Backward-compatible alias for evaluate_patch."""
+        return self.evaluate_patch(diff_content, target_file)

package/skills/torusguard/payload/core/identity.py

@@ -0,0 +1,104 @@
+"""
+TorusGuard v6 Stable Finding Identity & Fingerprinting Engine
+Generates deterministic finding identifiers that survive line-number shifts,
+minor refactorings, and file relocations within the same logical scope.
+"""
+
+import hashlib
+import re
+from pathlib import Path
+from typing import Optional, Dict, Any
+from dataclasses import dataclass, asdict
+
+
+def normalize_code_snippet(code: str) -> str:
+    """
+    Normalizes a code snippet to be whitespace- and comment-tolerant
+    so small styling edits or empty lines don't change the region hash.
+    """
+    if not code:
+        return ""
+    lines = []
+    for line in code.strip().splitlines():
+        stripped = line.strip()
+        # Remove single-line comments for hash stability if they are pure comment lines
+        if stripped.startswith("#") or stripped.startswith("//"):
+            continue
+        # Normalize internal whitespace
+        normalized = re.sub(r"\s+", " ", stripped)
+        if normalized:
+            lines.append(normalized)
+    return "\n".join(lines)
+
+
+@dataclass
+class FindingFingerprint:
+    rule_id: str
+    normalized_path: str
+    region_hash: str
+    sink_signature: Optional[str] = None
+    framework_marker: Optional[str] = None
+    fingerprint_id: str = ""
+    taint_depth: Optional[int] = None
+    sanitizer_present: bool = False
+
+    def __post_init__(self):
+        if not self.fingerprint_id:
+            self.fingerprint_id = self.compute_fingerprint_id()
+
+    def compute_fingerprint_id(self) -> str:
+        """
+        Computes a stable hash based on (rule_id, normalized_path, region_hash, sink_signature).
+        Format: TG-FND-<hash12>
+        """
+        data = f"{self.rule_id}|{self.normalized_path}|{self.region_hash}|{self.sink_signature or ''}|{self.framework_marker or ''}"
+        h = hashlib.sha256(data.encode("utf-8")).hexdigest()[:12]
+        # Clean rule id component for readable prefix
+        rule_prefix = self.rule_id.replace("TG-", "").split("-")[0]
+        return f"TG-{rule_prefix}-{h}"
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+class IdentityEngine:
+    """
+    Computes stable finding identities and persists fingerprint maps.
+    """
+
+    @staticmethod
+    def generate_identity(
+        rule_id: str,
+        file_path: str,
+        code_snippet: str,
+        sink_signature: Optional[str] = None,
+        framework_marker: Optional[str] = None,
+        root_path: Optional[Path] = None,
+        taint_depth: Optional[int] = None,
+        sanitizer_present: bool = False,
+    ) -> FindingFingerprint:
+        """
+        Generates a stable FindingFingerprint.
+        """
+        # Normalize file path relative to root
+        norm_path = file_path.replace("\\", "/").lstrip("./")
+        if root_path:
+            try:
+                norm_path = str(Path(file_path).resolve().relative_to(root_path.resolve())).replace("\\", "/")
+            except Exception:
+                norm_path = file_path.replace("\\", "/").lstrip("./")
+
+        # Compute normalized region hash
+        norm_code = normalize_code_snippet(code_snippet)
+        region_hash = hashlib.sha256(norm_code.encode("utf-8")).hexdigest()[:16]
+
+        return FindingFingerprint(
+            rule_id=rule_id,
+            normalized_path=norm_path,
+            region_hash=region_hash,
+            sink_signature=sink_signature,
+            framework_marker=framework_marker,
+            taint_depth=taint_depth,
+            sanitizer_present=sanitizer_present,
+        )
+

package/skills/torusguard/payload/core/import_resolver.py

@@ -0,0 +1,91 @@
+"""
+TorusGuard Import Resolver
+Resolves language-specific import specifiers to canonical file system paths.
+Supports Python, JavaScript, TypeScript, and Go.
+"""
+
+from pathlib import Path
+from typing import Optional, List
+
+
+COMMON_EXTENSIONS = [
+    ".py", ".ts", ".tsx", ".js", ".mjs", ".cjs", ".go"
+]
+
+
+class ImportResolver:
+    """Resolves relative and package imports to on-disk source files."""
+
+    def __init__(self, project_root: Path):
+        self.project_root = project_root.resolve()
+
+    def resolve(self, importing_file: Path, import_module: str) -> Optional[Path]:
+        """
+        Resolves `import_module` referenced by `importing_file` to an absolute Path on disk.
+        """
+        if not import_module:
+            return None
+
+        importing_file = importing_file.resolve()
+        current_dir = importing_file.parent
+
+        # 1. Relative import (e.g. ./utils, ../db, .services)
+        if import_module.startswith("."):
+            # Python style: .models or ..utils
+            if import_module.startswith(".."):
+                rel_parts = import_module.lstrip(".")
+                target_dir = current_dir.parent
+                cand = target_dir / rel_parts.replace(".", "/")
+            elif import_module.startswith("."):
+                rel_parts = import_module.lstrip(".")
+                cand = current_dir / rel_parts.replace(".", "/")
+            else:
+                cand = current_dir / import_module
+
+            resolved = self._try_extensions(cand)
+            if resolved:
+                return resolved
+
+        # 2. Direct path relative to current directory
+        direct_cand = current_dir / import_module
+        resolved = self._try_extensions(direct_cand)
+        if resolved:
+            return resolved
+
+        # 3. Project root relative import (e.g. core.taint, src.services.auth)
+        dotted_cand = self.project_root / import_module.replace(".", "/")
+        resolved = self._try_extensions(dotted_cand)
+        if resolved:
+            return resolved
+
+        # 4. Check under common subdirectories (src, app, lib, internal)
+        for sub in ("src", "app", "lib", "internal"):
+            sub_cand = self.project_root / sub / import_module.replace(".", "/")
+            resolved = self._try_extensions(sub_cand)
+            if resolved:
+                return resolved
+
+        return None
+
+    def _try_extensions(self, base_path: Path) -> Optional[Path]:
+        # Check direct file with extension already
+        if base_path.is_file():
+            return base_path
+
+        # Check with each extension
+        for ext in COMMON_EXTENSIONS:
+            cand = base_path.with_suffix(ext)
+            if cand.is_file():
+                return cand
+
+        # Check directory index / __init__
+        if base_path.is_dir():
+            py_init = base_path / "__init__.py"
+            if py_init.is_file():
+                return py_init
+            for ext in (".ts", ".js", ".tsx"):
+                idx = base_path / f"index{ext}"
+                if idx.is_file():
+                    return idx
+
+        return None

package/skills/torusguard/payload/core/incremental.py

@@ -0,0 +1,102 @@
+"""
+TorusGuard Incremental Static Scanner & Hash Cache
+Identifies modified or newly added source files using cryptographic content hashes
+to enable sub-second re-scans on large codebases.
+"""
+
+from pathlib import Path
+from typing import Dict, List, Set, Optional, Any, Tuple
+import json
+import hashlib
+import time
+
+
+class IncrementalScanner:
+    """Manages file modification tracking and AST cache persistence."""
+
+    def __init__(self, target_root: Path, cache_file: Optional[Path] = None):
+        self.target_root = target_root.resolve()
+        if cache_file:
+            self.cache_file = cache_file.resolve()
+        else:
+            cache_dir = self.target_root / ".torusguard" / "cache"
+            cache_dir.mkdir(parents=True, exist_ok=True)
+            self.cache_file = cache_dir / "ast_cache.json"
+
+        self.cache_data: Dict[str, Dict[str, Any]] = self._load_cache()
+
+    def _load_cache(self) -> Dict[str, Dict[str, Any]]:
+        if self.cache_file.is_file():
+            try:
+                with open(self.cache_file, "r", encoding="utf-8") as f:
+                    return json.load(f)
+            except Exception:
+                return {}
+        return {}
+
+    def save_cache(self) -> None:
+        try:
+            self.cache_file.parent.mkdir(parents=True, exist_ok=True)
+            with open(self.cache_file, "w", encoding="utf-8") as f:
+                json.dump(self.cache_data, f, indent=2)
+        except Exception:
+            pass
+
+    @staticmethod
+    def compute_file_hash(file_path: Path) -> str:
+        """Computes SHA256 of file content."""
+        h = hashlib.sha256()
+        try:
+            with open(file_path, "rb") as f:
+                while chunk := f.read(65536):
+                    h.update(chunk)
+            return h.hexdigest()
+        except Exception:
+            return ""
+
+    def get_changed_files(self, all_files: List[Path]) -> Tuple[List[Path], List[Path]]:
+        """
+        Compares current file hashes to cache.
+        Returns (changed_files, unchanged_files).
+        """
+        changed: List[Path] = []
+        unchanged: List[Path] = []
+
+        for f in all_files:
+            try:
+                rel_path = str(f.resolve().relative_to(self.target_root)).replace("\\", "/")
+            except Exception:
+                rel_path = str(f).replace("\\", "/")
+
+            current_hash = self.compute_file_hash(f)
+            cached_entry = self.cache_data.get(rel_path)
+
+            if cached_entry and cached_entry.get("hash") == current_hash:
+                unchanged.append(f)
+            else:
+                changed.append(f)
+
+        return changed, unchanged
+
+    def get_cached_findings(self, file_path: Path) -> List[Dict[str, Any]]:
+        try:
+            rel_path = str(file_path.resolve().relative_to(self.target_root)).replace("\\", "/")
+        except Exception:
+            rel_path = str(file_path).replace("\\", "/")
+        entry = self.cache_data.get(rel_path)
+        if entry:
+            return entry.get("findings", [])
+        return []
+
+    def update_file_cache(self, file_path: Path, findings: List[Dict[str, Any]]) -> None:
+        try:
+            rel_path = str(file_path.resolve().relative_to(self.target_root)).replace("\\", "/")
+        except Exception:
+            rel_path = str(file_path).replace("\\", "/")
+        current_hash = self.compute_file_hash(file_path)
+        self.cache_data[rel_path] = {
+            "hash": current_hash,
+            "timestamp": time.time(),
+            "findings_count": len(findings),
+            "findings": findings
+        }

package/skills/torusguard/payload/core/lifecycle.py

@@ -0,0 +1,137 @@
+"""
+TorusGuard Finding Lifecycle State Machine (v0.5.1)
+Manages progression across Detect -> Classify -> Verify -> Remediate -> Recheck -> Archive.
+"""
+
+from typing import List, Tuple, Optional
+import datetime
+import hashlib
+from .models import (
+    Finding,
+    LifecycleStage,
+    FindingStatus,
+    ConfidenceBand,
+    RetestRecord,
+)
+
+
+class LifecycleTransitionError(Exception):
+    """Raised when an invalid lifecycle state transition is attempted."""
+    pass
+
+
+class FindingLifecycleManager:
+    """
+    Implements formal lifecycle progression and validation rules for TorusGuard v0.5.1 findings.
+    """
+
+    ALLOWED_TRANSITIONS = {
+        LifecycleStage.DETECT: [LifecycleStage.CLASSIFY, LifecycleStage.ARCHIVE],
+        LifecycleStage.CLASSIFY: [LifecycleStage.VERIFY, LifecycleStage.ARCHIVE],
+        LifecycleStage.VERIFY: [LifecycleStage.REMEDIATE, LifecycleStage.CLASSIFY, LifecycleStage.ARCHIVE],
+        LifecycleStage.REMEDIATE: [LifecycleStage.RECHECK, LifecycleStage.VERIFY],
+        LifecycleStage.RECHECK: [LifecycleStage.ARCHIVE, LifecycleStage.VERIFY, LifecycleStage.REMEDIATE],
+        LifecycleStage.ARCHIVE: [],  # Terminal state
+    }
+
+    @staticmethod
+    def transition(finding: Finding, target_stage: LifecycleStage, note: Optional[str] = None) -> Finding:
+        current = finding.lifecycle_stage
+        allowed = FindingLifecycleManager.ALLOWED_TRANSITIONS.get(current, [])
+
+        if target_stage not in allowed:
+            raise LifecycleTransitionError(
+                f"Invalid lifecycle transition from '{current.value}' to '{target_stage.value}'. "
+                f"Allowed target stages: {[s.value for s in allowed]}"
+            )
+
+        now = datetime.datetime.utcnow().isoformat() + "Z"
+
+        if target_stage == LifecycleStage.CLASSIFY:
+            if not finding.rule_id or not finding.category or not finding.severity:
+                raise LifecycleTransitionError("Classification requires rule_id, category, and severity.")
+            finding.status = FindingStatus.UNCONFIRMED
+
+        elif target_stage == LifecycleStage.VERIFY:
+            # Verification assertion: If no source/test evidence or evidence is insufficient, force Needs Review
+            has_sufficient_evidence = any(
+                e.is_sufficient_for_confirmed for e in finding.evidence
+            )
+            if not has_sufficient_evidence and finding.confidence.band == ConfidenceBand.CONFIRMED:
+                finding.confidence.band = ConfidenceBand.NEEDS_REVIEW
+                finding.status = FindingStatus.NEEDS_REVIEW
+            elif finding.confidence.band == ConfidenceBand.CONFIRMED:
+                finding.status = FindingStatus.CONFIRMED
+            else:
+                finding.status = FindingStatus.HIGH_CONFIDENCE if finding.confidence.score >= 70 else FindingStatus.NEEDS_REVIEW
+
+            finding.timestamps.verified_at = now
+
+        elif target_stage == LifecycleStage.REMEDIATE:
+            if not finding.remediation or not finding.remediation.recommended_fix:
+                raise LifecycleTransitionError("Remediation stage requires a complete remediation proposal.")
+            finding.status = FindingStatus.REMEDIATED
+            finding.timestamps.remediated_at = now
+
+        elif target_stage == LifecycleStage.RECHECK:
+            # Recheck requires retest record verification
+            if not finding.retest_result.retest_performed:
+                raise LifecycleTransitionError("Recheck stage requires an explicit retest to have been executed.")
+            if finding.retest_result.closure_status == FindingStatus.VERIFIED_FIXED:
+                finding.status = FindingStatus.VERIFIED_FIXED
+            finding.timestamps.retested_at = now
+
+        elif target_stage == LifecycleStage.ARCHIVE:
+            if finding.status not in (FindingStatus.VERIFIED_FIXED, FindingStatus.SUPPRESSED):
+                # Allow archive but note state
+                pass
+
+        finding.lifecycle_stage = target_stage
+        finding.timestamps.updated_at = now
+        return finding
+
+    @staticmethod
+    def execute_retest(
+        finding: Finding,
+        post_fix_code: str,
+        safe_pattern_verified: bool,
+        retest_method: str = "Differential Static Re-audit",
+        verifier_notes: str = "Verified safe via AST/pattern inspection."
+    ) -> Tuple[bool, str]:
+        """
+        Executes a formal retest on post-fix source code, hashing the evidence and updating closure status.
+        """
+        now = datetime.datetime.utcnow().isoformat() + "Z"
+        evidence_hash = hashlib.sha256(post_fix_code.strip().encode("utf-8")).hexdigest()
+
+        if safe_pattern_verified:
+            finding.retest_result = RetestRecord(
+                retest_performed=True,
+                closure_status=FindingStatus.VERIFIED_FIXED,
+                fix_applied=finding.remediation.recommended_fix,
+                retest_method=retest_method,
+                retest_evidence_hash=evidence_hash,
+                residual_risk=finding.remediation.residual_risk_notes,
+                verifier_notes=verifier_notes,
+                retest_timestamp=now,
+            )
+            finding.status = FindingStatus.VERIFIED_FIXED
+            finding.lifecycle_stage = LifecycleStage.RECHECK
+            finding.timestamps.retested_at = now
+            finding.timestamps.updated_at = now
+            return True, f"Finding {finding.finding_id} ({finding.rule_id}) successfully verified fixed. Evidence SHA256: {evidence_hash[:12]}..."
+        else:
+            finding.retest_result = RetestRecord(
+                retest_performed=True,
+                closure_status=FindingStatus.OPEN,
+                fix_applied=finding.remediation.recommended_fix,
+                retest_method=retest_method,
+                retest_evidence_hash=evidence_hash,
+                residual_risk="Remediation pattern missing or incomplete.",
+                verifier_notes="Unsafe pattern still detected in post-fix code.",
+                retest_timestamp=now,
+            )
+            finding.status = FindingStatus.OPEN
+            finding.lifecycle_stage = LifecycleStage.VERIFY
+            finding.timestamps.updated_at = now
+            return False, f"Retest failed for {finding.finding_id}: unsafe pattern remains."