torusguard 2.0.0-alpha → 2.1.1

package/skills/torusguard/payload/scripts/audit_runner.py

@@ -42,8 +42,16 @@ def get_ist_now() -> datetime.datetime:
 
 # ─── UI Formatter Bridge ──────────────────────────────────────────────────────
 scripts_dir = Path(__file__).resolve().parent
+tg_root = Path(__file__).resolve().parent.parent
+project_root = Path(__file__).resolve().parent.parent.parent
 if str(scripts_dir) not in sys.path:
     sys.path.insert(0, str(scripts_dir))
+if str(tg_root) not in sys.path:
+    sys.path.insert(0, str(tg_root))
+if str(project_root) not in sys.path:
+    sys.path.insert(0, str(project_root))
+
+
 
 try:
     import term_ui as tui
@@ -1240,9 +1248,10 @@ def scan_file(file_path: Path, target_root: Path) -> List[Dict[str, Any]]:
     return findings
 
 
-def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path) -> Tuple[List[Dict[str, Any]], Dict[str, List[Dict[str, Any]]]]:
+def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path, taint_paths: Optional[List[Any]] = None) -> Tuple[List[Dict[str, Any]], Dict[str, List[Dict[str, Any]]]]:
     """
-    Score each finding using finding_scorer.py and persistent memory patterns.
+    Score each finding using finding_scorer.py, persistent memory patterns,
+    and taint dataflow analysis.
     Returns (scored_findings, clusters_map).
     """
     try:
@@ -1253,6 +1262,15 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
     scored = []
     clusters: Dict[str, List[Dict[str, Any]]] = {}
 
+    # Map taint paths by (file_path, line_number)
+    taint_by_loc: Dict[Tuple[str, int], Any] = {}
+    if taint_paths:
+        for tp in taint_paths:
+            sink_node = getattr(tp, "sink", None)
+            if sink_node:
+                norm_p = getattr(sink_node, "file_path", "").replace("\\", "/")
+                taint_by_loc[(norm_p, getattr(sink_node, "line_number", 0))] = tp
+
     # Phase 1d: Pre-compute cross-file corroboration bonus
     # If multiple rule families flag the same file, each finding gets +5 confidence
     file_rule_families: Dict[str, set] = {}
@@ -1267,6 +1285,14 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
         band = "High Confidence"
         factors = {}
 
+        # Check for correlated taint path
+        matching_tp = taint_by_loc.get((f["file_path"], f["line_number"]))
+        is_taint_confirmed = matching_tp is not None
+        taint_depth = getattr(matching_tp, "depth", None) if matching_tp else None
+        is_sanitized = getattr(matching_tp, "is_sanitized", False) if matching_tp else False
+        if matching_tp and hasattr(matching_tp, "to_dict"):
+            f["taint_path"] = matching_tp.to_dict()
+
         if finding_scorer:
             try:
                 # Phase 1d: Dynamic evidence quality based on rule precision
@@ -1291,7 +1317,11 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
                     manual_review_status=mr,
                     rule_id=f["rule_id"],
                     file_path=f["file_path"],
-                    root_dir=target_root
+                    root_dir=target_root,
+                    taint_path_confirmed=is_taint_confirmed,
+                    taint_depth=taint_depth,
+                    sanitizer_present=is_sanitized,
+                    rule_severity=f.get("severity", "High")
                 )
                 score = s
                 band = b
@@ -1315,6 +1345,7 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
     return scored, clusters
 
 
+
 def emit_run_artifacts(run_folder: Path, scored_findings: List[Dict[str, Any]], clusters: Dict[str, List[Dict[str, Any]]], target_root: Path) -> None:
     """Generate findings.json, findings.md, and summary.md into run folder."""
     now_ist = get_ist_now()
@@ -1501,7 +1532,14 @@ def run_watch_mode(target_root: Path, severity_floor: str = "medium", json_outpu
         print(f"\n  {YELLOW}🛑 Watch mode stopped.{RESET}\n")
 
 
-def execute_audit(target_root: Path, severity_floor: str = "medium", json_output: bool = False, include_tests: bool = False) -> Dict[str, Any]:
+def execute_audit(
+    target_root: Path,
+    severity_floor: str = "medium",
+    json_output: bool = False,
+    include_tests: bool = False,
+    incremental: bool = False,
+    use_taint: bool = True
+) -> Dict[str, Any]:
     """Execute the full TorusGuard static security audit."""
     start_time = time.perf_counter()
     target_root = target_root.resolve()
@@ -1522,14 +1560,64 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
         except Exception:
             pass
 
-    # 2. Collect files & scan
+    # 2. Collect files to scan
     files = find_files_to_scan(target_root, include_tests=include_tests)
     all_findings = []
-    for f in files:
-        all_findings.extend(scan_file(f, target_root))
 
-    # 3. Score & Cluster
-    scored_findings, clusters = score_and_cluster_findings(all_findings, target_root)
+    inc_scanner = None
+    files_to_scan = files
+    unchanged_files = []
+
+    if incremental:
+        try:
+            from core.incremental import IncrementalScanner
+            inc_scanner = IncrementalScanner(target_root)
+            files_to_scan, unchanged_files = inc_scanner.get_changed_files(files)
+            # Rehydrate findings for unchanged files
+            for uf in unchanged_files:
+                all_findings.extend(inc_scanner.get_cached_findings(uf))
+        except Exception:
+            files_to_scan = files
+            unchanged_files = []
+
+    # Parallel or sequential scan on files_to_scan
+    new_findings = []
+    try:
+        from core.parallel import ParallelAuditExecutor
+        executor = ParallelAuditExecutor()
+        new_findings = executor.scan_files_parallel(files_to_scan, lambda f: scan_file(f, target_root))
+    except Exception:
+        for f in files_to_scan:
+            new_findings.extend(scan_file(f, target_root))
+
+    all_findings.extend(new_findings)
+
+    # Update cache if incremental scanner is active
+    if inc_scanner:
+        # Group new findings by file
+        file_to_findings: Dict[Path, List[Dict[str, Any]]] = {f: [] for f in files_to_scan}
+        for nf in new_findings:
+            raw_fp = nf.get("file_path", "")
+            target_f = target_root / raw_fp
+            if target_f in file_to_findings:
+                file_to_findings[target_f].append(nf)
+        for target_f, f_list in file_to_findings.items():
+            inc_scanner.update_file_cache(target_f, f_list)
+        inc_scanner.save_cache()
+
+    # 2.5 Taint Dataflow Analysis (if enabled)
+    taint_paths = []
+    if use_taint:
+        try:
+            from core.cross_file_taint import CrossFileTaintAnalyzer
+            analyzer = CrossFileTaintAnalyzer(target_root)
+            # Analyze target files (capped to 200 files for high responsiveness)
+            taint_paths = analyzer.analyze_project(files[:200])
+        except Exception:
+            taint_paths = []
+
+    # 3. Score & Cluster with Taint Evidence
+    scored_findings, clusters = score_and_cluster_findings(all_findings, target_root, taint_paths=taint_paths)
 
     # 4. Allocate run folder
     runs_dir = target_root / ".torusguard" / "runs"
@@ -1595,6 +1683,8 @@ def main():
     parser.add_argument("--scope", "-s", help="Alternative path to target project")
     parser.add_argument("--severity", choices=["critical", "high", "medium", "low"], default="medium", help="Severity floor")
     parser.add_argument("--watch", "-w", action="store_true", help="Continuous watch mode: re-scan on file save")
+    parser.add_argument("--incremental", "-i", action="store_true", help="Incremental mode: only scan modified files")
+    parser.add_argument("--no-taint", action="store_true", help="Disable taint-aware dataflow analysis")
     parser.add_argument("--sarif", action="store_true", help="Automatically export findings to OASIS SARIF v2.1.0")
     parser.add_argument("--sarif-out", help="Output file path for SARIF export")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
@@ -1607,10 +1697,18 @@ def main():
         run_watch_mode(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests, sarif=args.sarif, sarif_out=args.sarif_out)
         sys.exit(0)
 
-    res = execute_audit(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests)
+    res = execute_audit(
+        target,
+        severity_floor=args.severity,
+        json_output=args.json,
+        include_tests=args.include_tests,
+        incremental=args.incremental,
+        use_taint=(not args.no_taint)
+    )
     if args.sarif:
         export_sarif(target, res.get("run_folder"), args.sarif_out)
 
+
     sys.exit(0 if res["critical_count"] == 0 else 1)
 
 

package/skills/torusguard/payload/scripts/finding_scorer.py

@@ -11,9 +11,14 @@ import argparse
 from pathlib import Path
 from typing import Dict, Any, Tuple, Optional
 
+# Ensure .torusguard directory is in sys.path for core imports
+_TG_DIR = Path(__file__).resolve().parent.parent
+if str(_TG_DIR) not in sys.path:
+    sys.path.insert(0, str(_TG_DIR))
+
 
 def compute_memory_boost(
-    rule_id: str,
+    rule_id: Optional[str] = None,
     file_path: Optional[str] = None,
     root_dir: Optional[Path] = None
 ) -> int:
@@ -112,21 +117,35 @@ def compute_confidence_score(
     memory_boost: int = 0,
     rule_id: Optional[str] = None,
     file_path: Optional[str] = None,
-    root_dir: Optional[Path] = None
+    root_dir: Optional[Path] = None,
+    taint_path_confirmed: bool = False,
+    taint_depth: Optional[int] = None,
+    sanitizer_present: bool = False,
+    rule_severity: str = "High",
+    use_evidence_chain: bool = False,
+    **kwargs
 ) -> Tuple[int, str, Dict[str, Any]]:
     """
     Computes total score and assigns confidence band.
-    Max points:
-    - evidence_quality: 35
-    - reproduction_success: 25
-    - independent_confirmations: 15
-    - environmental_clarity: 15
-    - manual_review_status: 10
-    - memory_boost: -30 to +20 (modifier from persistent memory)
-    - test_deduction: -30 if file is located in a test/mock path
-    - doc_deduction: -25 if file is located in documentation
-    Total is clamped to [0, 100].
+    Supports classical factor evaluation and multi-signal evidence-chain calibration.
     """
+    if use_evidence_chain:
+        try:
+            from core.confidence import ConfidenceCalibrator, EvidenceSignals
+            signals = EvidenceSignals(
+                rule_severity=rule_severity,
+                taint_path_confirmed=taint_path_confirmed,
+                taint_depth=taint_depth,
+                sanitizer_present=sanitizer_present,
+                framework_context_match=True,
+                has_multiline_evidence=(evidence_quality >= 30),
+                is_test_or_mock=is_test_path(file_path),
+                memory_boost=memory_boost or (compute_memory_boost(rule_id, file_path=file_path, root_dir=root_dir) if rule_id else 0)
+            )
+            return ConfidenceCalibrator.calculate_score(signals)
+        except Exception:
+            pass
+
     eq = min(max(evidence_quality, 0), 35)
     rs = min(max(reproduction_success, 0), 25)
     ic = min(max(independent_confirmations, 0), 15)
@@ -138,6 +157,13 @@ def compute_confidence_score(
     if rule_id and eff_mem_boost == 0:
         eff_mem_boost = compute_memory_boost(rule_id, file_path=file_path, root_dir=root_dir)
 
+    # Taint path adjustments
+    taint_mod = 0
+    if taint_path_confirmed:
+        taint_mod += 15
+    if sanitizer_present:
+        taint_mod -= 35
+
     # Test and Doc path noise suppression
     is_test = is_test_path(file_path)
     test_deduction = -30 if is_test else 0
@@ -145,7 +171,7 @@ def compute_confidence_score(
     is_doc = is_doc_path(file_path)
     doc_deduction = -25 if is_doc else 0
 
-    raw_total = eq + rs + ic + ec + mr + eff_mem_boost + test_deduction + doc_deduction
+    raw_total = eq + rs + ic + ec + mr + eff_mem_boost + taint_mod + test_deduction + doc_deduction
     total = min(max(raw_total, 0), 100)
 
     if total >= 90:
@@ -164,6 +190,9 @@ def compute_confidence_score(
         "environmental_clarity": ec,
         "manual_review_status": mr,
         "memory_boost": eff_mem_boost,
+        "taint_path_confirmed": taint_path_confirmed,
+        "taint_depth": taint_depth,
+        "sanitizer_present": sanitizer_present,
         "test_exemption": is_test,
         "test_deduction": test_deduction,
         "total_score": total,
@@ -172,6 +201,7 @@ def compute_confidence_score(
     return total, band, factors
 
 
+
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Confidence Scorer")
     parser.add_argument("--dir", type=str, help="Target project root directory to scan and score")

package/skills/torusguard/payload/scripts/manifest_builder.py

@@ -39,7 +39,7 @@ def scan_workspace_files(base_dir):
             dirs.remove("__pycache__")
 
         for f in sorted(files):
-            if f in [".manifest.json", ".gitkeep"] or f.endswith(".pyc"):
+            if f in [".manifest.json", ".gitkeep", "auth.json"] or f.endswith(".pyc"):
                 continue
             full_path = Path(root) / f
             rel_path = full_path.relative_to(base_dir).as_posix()

package/skills/torusguard/payload/skills/torusguard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard
-description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
-version: 1.3.6
+description: Universal autonomous security engine: 88 canonical rules across 22 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
+version: 2.1.1
 ---
 
 # TorusGuard Master Security Engine & Command Router
@@ -10,38 +10,54 @@ version: 1.3.6
 
 ---
 
-## Command Catalog: Terminal CLI & AI Chat Parity
+## Tri-Mode Execution & Command Catalog
 
-TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
+TorusGuard operates with 100% feature parity across the compiled terminal CLI, AI chat slash commands, and Model Context Protocol (MCP) tools:
 
-| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
+| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Governed Purpose |
 | :--- | :--- | :--- | :--- | :--- |
-| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
-| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
-| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
-| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
-| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
-| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
-| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
-| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
-| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
-| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
-| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
-| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
-| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
-| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
-| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
+| **Init** | `torusguard init` | `/torusguard init` | `.torusguard/skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
+| **Status** | `torusguard status` | `/torusguard status` | `.torusguard/skills/torusguard-status` | Posture score, active rules, run history, scope check |
+| **Audit** | `torusguard audit` | `/torusguard audit` | `.torusguard/skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
+| **OCR Vision**| `torusguard ocr-scan <path>` | `/torusguard ocr-scan` | `.torusguard/skills/torusguard-ocr-scan` | Tesseract OCR secret scan on images/diagrams |
+| **Verify** | `torusguard verify` | `/torusguard verify` | `.torusguard/skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
+| **Harden** | `torusguard harden <patch>` | `/torusguard harden` | `.torusguard/skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) & reflection validation |
+| **Apply** | `torusguard apply [--yes]` | `/torusguard apply` | `.torusguard/skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
+| **Rollback** | `torusguard rollback` | `/torusguard rollback` | `.torusguard/skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
+| **Recheck** | `torusguard recheck` | `/torusguard recheck` | `.torusguard/skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
+| **Recipes** | `torusguard recipes` | `/torusguard recipes` | `.torusguard/skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
+| **Report** | `torusguard report --html` | `/torusguard report` | `.torusguard/skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
+| **Authorize** | `torusguard authorize` | `/torusguard authorize` | `.torusguard/skills/torusguard-authorize`| Legal scope definition & safety boundaries |
+| **Validate** | `torusguard web-validate` | `/torusguard web-validate` | `.torusguard/skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
+| **Exploit** | `torusguard exploit-check` | `/torusguard exploit-check`| `.torusguard/skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
+| **Container** | `torusguard container` | `/torusguard container` | `.torusguard/skills/torusguard-container` | Audits Dockerfile & Compose for root users, sockets, privileged mode |
+| **Git Mine** | `torusguard git-mine` | `/torusguard git-mine` | `.torusguard/skills/torusguard-git-mine` | Mines git commit history & config for leaked credentials & tokens |
+| **ReDoS** | `torusguard redos` | `/torusguard redos` | `.torusguard/skills/torusguard-redos` | Analyzes regex patterns for catastrophic exponential backtracking |
+| **AI Guard** | `torusguard ai-guard` | `/torusguard ai-guard` | `.torusguard/skills/torusguard-ai-guard` | Audits AI agents & RAG pipelines for prompt injection & tenant leaks |
+| **Full** | `torusguard full` | `/torusguard full` | `.torusguard/skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
+| **MCP Server**| `torusguard mcp` | — | Native Stdio JSON-RPC 2.0 | Serves native Model Context Protocol tools to AI coding agents |
+| **Update** | `torusguard update` | `/torusguard update` | `.torusguard/skills/torusguard-init` | Self-update TorusGuard engine binary |
+| **Help** | `torusguard help` | `/torusguard help` | — | Interactive command guide |
 
 ---
 
 ## Non-Negotiable Invariants
 
-1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
-2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
+1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code (`TG-CLIENT-001`).
+2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`) (`TG-DB-001`).
 3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
 4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
-5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
+5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()` (`TG-DIFF-001`).
 6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
+7. **Living Report Ground Truth:** All findings synchronize directly with `security_report.md` at workspace root.
+
+---
+
+## 🏛️ Alibaba OpenCodeReview Hybrid Architecture Integration
+TorusGuard employs the dual-track hybrid architecture battle-tested at Alibaba Group scale:
+1. **Deterministic Engineering Pipeline (Go CLI Engine):** Mechanical tasks (file traversal, whitespace tolerance, exact AST matching, Ponytail churn bounds calculation, pre-apply snapshot capture, and OCR extraction) are strictly executed by the compiled Go binary.
+2. **Context Minimization (1/9th Token Strategy):** Agents never dump full files into prompt context. Bounded AST windows ($\pm 3$ lines) are extracted via `ExtractContext` to keep review tokens hyper-dense.
+3. **Line-Level Reflection:** In remediation, the agent provides semantic intent (`find_snippet` + `replace_snippet`). The Go CLI reflection module pins and verifies line bounds deterministically, preventing line-number drift.
 
 ---
 
@@ -67,9 +83,42 @@ TorusGuard operates with 100% feature parity across both the terminal CLI and AI
 │       ├── report.html          # Single-file visual dark-mode HTML report
 │       ├── results.sarif        # OASIS SARIF v2.1.0 log
 │       └── bundles/             # Formulated Ponytail remediation bundles
+├── skills/                      # Canonical distribution skills for end-user AI agents
+├── workflows/                   # Operational step-by-step workflow guides
 └── snapshots/
     └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
 ```
 
-## Living Report Ground Truth
-- Read `security_report.md` in the workspace root before taking any action. Update the relevant finding card after completing remediation.
+---
+
+## 🚨 LLM Trap Table
+
+| Pattern | What AI Does Wrong | What Is Actually Correct |
+| :--- | :--- | :--- |
+| **Line-Number Diff Hallucination** | Guesses line numbers in unified diff headers (`@@ -42,5 +42,7 @@`) causing patch rejection. | Use the Line-Level Reflection Module (`SemanticPatch` with `find_snippet` and `replace_snippet`) to let Go resolve exact lines. |
+| **Context Window Bloating** | Dumps entire 1,000-line source files into conversation when diagnosing a single finding. | Use bounded AST context extraction ($\pm 3$ lines) matching OpenCodeReview's 1/9th token efficiency. |
+| **Full-File Rewrites** | Rewrites the entire file or surrounding business logic when fixing a vulnerability. | Strictly conform to Ponytail bounds ($\le 35$ additions, $\le 25$ deletions per bundle). |
+| **Security Bypass Insertion** | Introduces `# nosec`, `verify=False`, or `[AllowAnonymous]` to make tests pass. | Strictly forbidden (`TG-DIFF-001`). Rejections are enforced fail-closed by the Go engine. |
+| **Missing Multi-Tenant Scope** | Modifies queries to filter only by record `id`. | Always scope database lookups by tenant or user ownership (`tenantId: user.tenantId`). |
+
+---
+
+## ✅ Pre-Flight Self-Audit
+
+Before producing any security remediation or analysis, verify:
+- [ ] Did I read `security_report.md` at workspace root before proposing changes?
+- [ ] Did I inspect only the bounded AST context window ($\pm 3$ lines) rather than the entire file?
+- [ ] Does my proposed remediation stay strictly within Ponytail bounds ($\le 35$ additions, $\le 25$ deletions)?
+- [ ] Is the fix free of any `# nosec`, `verify=False`, or bypass flags?
+- [ ] Did I verify multi-tenant isolation on all database and model queries?
+- [ ] Can this patch be applied via deterministic reflection (`find_snippet` -> `replace_snippet`)?
+
+---
+
+## 🔁 VBC Protocol (Verify → Build → Confirm)
+
+```
+VERIFY: Inspect living security_report.md and bounded AST context snippet.
+BUILD:  Formulate surgical SemanticPatch (find_snippet + replace_snippet within <=35 add / <=25 del).
+CONFIRM: Validate via torusguard harden, apply snapshot, and execute differential torusguard recheck.
+```

package/skills/torusguard/payload/skills/torusguard/bootstrap.py

@@ -63,14 +63,15 @@ import unicodedata
 ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
 
 def get_visual_width(text: str) -> int:
-    """Calculate the printable display width of a string (ANSI and emoji aware)."""
+    """Calculate the printable display width of a string (ANSI, emoji and variation selector aware)."""
     clean = ANSI_REGEX.sub('', text)
     width = 0
     for ch in clean:
+        cp = ord(ch)
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            continue
         ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif ord(ch) >= 0x1F300:
+        if ea in ('W', 'F') or cp >= 0x1F300:
             width += 2
         else:
             width += 1
@@ -82,7 +83,7 @@ def truncate_visual(text: str, max_w: int = 67) -> str:
         return text
     out, curr_w, in_ansi, ansi_buf = [], 0, False, ''
     for ch in text:
-        if ch == '\033':
+        if ch in ('\033', '\x1b'):
             in_ansi = True
             ansi_buf = ch
             continue
@@ -92,13 +93,19 @@ def truncate_visual(text: str, max_w: int = 67) -> str:
                 in_ansi = False
                 out.append(ansi_buf)
             continue
+        cp = ord(ch)
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            out.append(ch)
+            continue
         ea = unicodedata.east_asian_width(ch)
-        cw = 2 if ea in ('W', 'F') or ord(ch) >= 0x1F300 else 1
+        cw = 2 if (ea in ('W', 'F') or cp >= 0x1F300) else 1
         if curr_w + cw > max_w - 3:
-            out.append('...')
+            out.append(RESET + '...')
+            curr_w += 3
             break
         out.append(ch)
         curr_w += cw
+    out.append(RESET)
     return ''.join(out)
 
 def card_line(content: str, max_w: int = 67, border: str = "│", border_color: str = CYAN) -> str:
@@ -109,37 +116,56 @@ def card_line(content: str, max_w: int = 67, border: str = "│", border_color:
     return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
 
 def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column top border (single ┌ or double ╔) with optional title."""
     left = "╔" if double else "┌"
     right = "╗" if double else "┐"
     h = "═" if double else "─"
     if title:
         vis = get_visual_width(title)
-        rem = max(0, 71 - 3 - vis - 1)
+        rem = max(0, 68 - vis)
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
 def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column bottom border (single └ or double ╚)."""
     left = "╚" if double else "└"
     right = "╝" if double else "┘"
     h = "═" if double else "─"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_divider(border_color: str = CYAN, double: bool = False) -> str:
+def card_divider(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column divider (single ├ or double ╠) with optional title."""
     left = "╠" if double else "├"
     right = "╣" if double else "┤"
     h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.1", border_color: str = CYAN) -> str:
+    """Generate standardized 75-column curved header box."""
+    top = f"  {border_color}╭{'─' * 71}╮{RESET}"
+    bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
+    empty = f"  {border_color}│{' ' * 71}│{RESET}"
+
+    title_vis = get_visual_width(title)
+    ver_vis = get_visual_width(version)
+    space_count = max(1, 67 - title_vis - ver_vis)
+    title_str = f"{BOLD}{WHITE}{title}{RESET}{' ' * space_count}{GRAY}{version}{RESET}"
+
+    lines = [top, empty, card_line(title_str, max_w=67, border_color=border_color)]
+    if subtitle:
+        lines.append(card_line(f"{DIM}{subtitle}{RESET}", max_w=67, border_color=border_color))
+    lines.extend([empty, bottom])
+    return "\n".join(lines)
+
 def print_header():
     """Print the branded TorusGuard header card."""
-    print(f"""
-  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
-  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
-  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v1.3.0{RESET}   {CYAN}│{RESET}
-  {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
-  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
-  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
-""")
+    print()
+    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.1"))
+    print()
 
 
 def print_step_1_assets(file_count):
@@ -213,14 +239,15 @@ def print_success_card():
 
 def print_already_initialized(target_root, cfg):
     """Print the already-initialized status card."""
+    print()
+    top = f"  {CYAN}╭{'─' * 71}╮{RESET}"
+    bottom = f"  {CYAN}╰{'─' * 71}╯{RESET}"
+    title_line = card_line(f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}{' ' * 28}{GREEN}[Active]{RESET}")
+    print(f"{top}\n{title_line}\n{bottom}")
     print(f"""
-  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
-  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}                           {GREEN}[Active]{RESET}         {CYAN}│{RESET}
-  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
-
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.3.0')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.1')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -228,7 +255,7 @@ def print_already_initialized(target_root, cfg):
 """)
 
 
-def scaffold_workspace(target_root=None, force=False, full_commands=False):
+def scaffold_workspace(target_root=None, force=False, full_commands=False, template=None, **kwargs):
     """Scaffold the .torusguard workspace into the target project root."""
     target_root = Path(target_root or find_project_root()).resolve()
     torusguard_target = target_root / ".torusguard"
@@ -379,7 +406,13 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
         try:
             with open(config_file, "r", encoding="utf-8") as f:
                 cfg = json.load(f)
-            if detected_stack and detected_stack.get("framework") != "None":
+            if template and template.lower() in ("golang", "go"):
+                cfg["detected_stack"] = {
+                    "language": "Go",
+                    "framework": "Gin",
+                    "data_layer": "None"
+                }
+            elif detected_stack and detected_stack.get("framework") != "None":
                 cfg["detected_stack"] = {
                     "language": detected_stack.get("language"),
                     "framework": detected_stack.get("framework"),