torusguard 2.1.0 → 2.1.2

package/README.md

@@ -11,8 +11,8 @@
 
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"></a>
-  <a href="https://github.com/githubmofo/TorusGuard/releases"><img src="https://img.shields.io/badge/version-v2.1.0-orange.svg" alt="Version"></a>
-  <a href="https://www.npmjs.com/package/torusguard"><img src="https://img.shields.io/badge/npm-v2.1.0-CB3837?logo=npm&logoColor=white" alt="npm: v2.1.0"></a>
+  <a href="https://github.com/githubmofo/TorusGuard/releases"><img src="https://img.shields.io/badge/version-v2.1.2-orange.svg" alt="Version"></a>
+  <a href="https://www.npmjs.com/package/torusguard"><img src="https://img.shields.io/badge/npm-v2.1.2-CB3837?logo=npm&logoColor=white" alt="npm: v2.1.2"></a>
   <img src="https://img.shields.io/badge/Privacy-Local_First-success" alt="Privacy: Local First">
   <img src="https://img.shields.io/badge/Dependencies-Zero-brightgreen" alt="Dependencies: Zero">
   <img src="https://img.shields.io/badge/SARIF-v2.1.0-6C3483" alt="SARIF">
@@ -22,9 +22,10 @@
 <p align="center">
   <img src="https://img.shields.io/badge/Unit%20Tests-100%25%20Passing-brightgreen?logo=go&logoColor=white" alt="Unit Tests: 100% Passing">
   <img src="https://img.shields.io/badge/Polyglot%20Tests-36%2F36%20Repos%20Passed-brightgreen?logo=checkmarx&logoColor=white" alt="Polyglot Tests: 36/36 Repos Passed">
+  <a href="docs/validation/unseen-repos-tri-mode-validation-report.md"><img src="https://img.shields.io/badge/Tri--Mode%20Validation-6%2F6%20Unseen%20Stacks%20Passed-brightgreen?logo=checkmarx&logoColor=white" alt="Tri-Mode Validation: 6/6 Unseen Stacks Passed"></a>
   <img src="https://img.shields.io/badge/Tri--Mode%20E2E-16%2F16%20Verified-blue?logo=checkmarx&logoColor=white" alt="Tri-Mode E2E: 16/16 Verified">
   <img src="https://img.shields.io/badge/Vision%20OCR-Tested%20%26%20Verified-blueviolet?logo=tesseract&logoColor=white" alt="Vision OCR: Tested & Verified">
-  <img src="https://img.shields.io/badge/Rules%20Verified-86%2F86%20Rules-success" alt="Rules: 86/86 Verified">
+  <img src="https://img.shields.io/badge/Rules%20Verified-88%2F88%20Rules-success" alt="Rules: 88/88 Verified">
 </p>
 
 <p align="center">
@@ -60,7 +61,7 @@
 
 ## What Is TorusGuard?
 
-TorusGuard is a **zero-dependency, single-binary security engine** that scans, hardens, and validates AI-generated codebases. It enforces 86 security rules across 22 architectural families and works across three unified operational modes (**Tri-Mode Parity**):
+TorusGuard is a **zero-dependency, single-binary security engine** that scans, hardens, and validates AI-generated codebases. It enforces 88 security rules across 22 architectural families and works across three unified operational modes (**Tri-Mode Parity**):
 
 - **Mode A: Terminal CLI (Go Binary)** — A deterministic scanner and enforcer that runs in your terminal or CI/CD pipeline (`torusguard <command>`).
 - **Mode B: AI Chat Slash Commands** — Integrates natively with Antigravity, Cursor, Claude Code, Windsurf, VS Code, and other AI coding assistants via slash commands (`/torusguard <command>`).
@@ -72,9 +73,12 @@ TorusGuard ensures that the code your AI assistant writes is secure *before* it
 
 ## ✨ Features
 
-- **86 Security Rules** across 22 families (Secrets, Auth, SQL Injection, SSRF, CSRF, GraphQL, Supply Chain, Containers, Git History, ReDoS, AI & RAG, and more)
+- **88 Security Rules** across 22 families (Secrets, Auth, SQL Injection, Deserialization, Open Redirects, SSRF, CSRF, GraphQL, Supply Chain, Containers, Git History, ReDoS, AI & RAG, and more)
+- **Taint Analysis & Interprocedural Dataflow Engine** — Cross-file, interprocedural taint flow tracking from untrusted sources to critical sinks across imports, modules, and call graphs
+- **7-Signal Calibrated Confidence Scorer** — Evidence-chain calibration combining rule severity, taint confirmation, taint depth, sanitizer absence, framework context, multi-line evidence, and persistent memory
 - **First-Principles Security Suite** — Built-in native scanners for Dockerfile/Compose privilege bounds, Git commit log secret mining, exponential regex backtracking, and cross-tenant vector isolation
-- **Heuristic AST Scanner** — Polyglot static analysis for Go, JavaScript, TypeScript, and Python
+- **Polyglot Parser & AST Walker** — Tree-sitter powered AST traversal with unified CST nodes and symbol resolution across Go, JavaScript, TypeScript, and Python
+- **Incremental Hash Cache & Parallel Scanning** — SHA-256 mtime incremental scan caching, process-pool parallelization, and continuous file-watcher debounce
 - **Line-Level Reflection Module** — Semantic patch synthesis (`find_snippet` / `replace_snippet`) that accurately replaces exact code blocks without brittle line-number offsets
 - **1/9th Token Bounded Context Extraction** — AST context extraction (±3 lines) via `scanner.ExtractContext` to keep review prompts hyper-efficient and prevent context saturation
 - **Ponytail Protocol** — Surgical patch bounds (≤35 additions, ≤25 deletions) to prevent full-file rewrites
@@ -114,52 +118,139 @@ TorusGuard uses a **tri-track architecture** where intelligence, deterministic e
 
 ```mermaid
 flowchart TD
-    subgraph Ingress["Unified Tri-Mode Ingress"]
-        ModeA["<b>Mode A: Terminal CLI</b><br/><code>torusguard &lt;cmd&gt;</code><br/>Deterministic Single Binary"]
-        ModeB["<b>Mode B: AI Chat Slash Commands</b><br/><code>/torusguard &lt;cmd&gt;</code><br/>Cursor &bull; Claude &bull; Windsurf &bull; Antigravity"]
-        ModeC["<b>Mode C: Native MCP Tools</b><br/><code>torusguard_*</code> (10 Tools &bull; 2 Resources)<br/>Stdio JSON-RPC 2.0 Agent Server"]
+    %% =========================================================================
+    %% STAGE 1: TRI-MODE INGRESS GATEWAY
+    %% =========================================================================
+    subgraph IngressGateway["1. Unified Tri-Mode Ingress Gateway"]
+        direction LR
+        CLI["<b>Mode A: Terminal CLI</b><br/><code>torusguard &lt;cmd&gt;</code><br/>25 Deterministic Commands"]
+        Chat["<b>Mode B: AI Chat Commands</b><br/><code>/torusguard &lt;cmd&gt;</code><br/>Cursor &bull; Claude &bull; Windsurf"]
+        MCP["<b>Mode C: Native MCP Server</b><br/><code>torusguard_*</code> (13 Tools &bull; 2 Resources)<br/>Stdio JSON-RPC 2.0 Protocol"]
     end
 
-    Ingress --> Router["<b>Command Router &amp; Dispatcher</b><br/>cmd/torusguard (21 Commands)"]
+    %% =========================================================================
+    %% STAGE 2: CORE DISPATCHER & RUNTIME KERNEL
+    %% =========================================================================
+    Kernel["<b>TorusGuard Core Dispatcher &amp; Runtime Kernel</b><br/><code>cmd/torusguard</code> (Single Standalone Go Binary)<br/>Command Parsing &bull; Flag Evaluation (<code>--yes</code>, <code>--html</code>, <code>--rules</code>) &bull; Sandbox Isolation"]
 
-    subgraph Core["TorusGuard Core Security Engine (Go Single Binary)"]
+    CLI -->|"Terminal Exec"| Kernel
+    Chat -->|"Slash Bridge"| Kernel
+    MCP -->|"Agent Tool Call"| Kernel
+
+    %% =========================================================================
+    %% STAGE 3: DETECTION & MULTI-MODAL SUITE
+    %% =========================================================================
+    subgraph DetectionSuite["2. Polyglot Static AST &amp; Multi-Modal Detection Suite"]
         direction TB
-        subgraph Scanners["First-Principles &amp; Multi-Modal Scanner Suite"]
-            AST["<b>Polyglot AST &amp; Heuristic Scanner</b><br/>Go &bull; TS/JS &bull; Python &bull; SQL &bull; Auth &bull; SSRF &bull; CSRF"]
-            OCR["<b>Multi-Modal Vision OCR Engine</b><br/>Tesseract v5.4.0 &bull; Leaked Keys in PNG/JPG &le;10MB"]
-            Container["<b>Container &amp; Dockerfile Auditor</b><br/>Root Execution &bull; Docker Sockets &bull; Build Secrets"]
-            GitMine["<b>Git History Secret Miner</b><br/>Past Commits &bull; Diff Logs &bull; Remote Credentials"]
-            ReDoS["<b>ReDoS Complexity Analyzer</b><br/>Polynomial &amp; Exponential Backtracking Loops"]
-            AIGuard["<b>AI Agent &amp; RAG Vector Guard</b><br/>Prompt Injection &bull; Tenant Vector Contamination"]
+        subgraph StaticGroup["Static Code &amp; Dependency Analysis"]
+            direction LR
+            AST["<b>Polyglot AST &amp; Taint Engine</b><br/>Tree-sitter &bull; 88 Rules across 22 Families<br/>Go &bull; TS/JS &bull; Python &bull; Java &bull; C# &bull; Rust"]
+            TGQL["<b>TG-QL Declarative AST DSL</b><br/>Custom YAML Pattern Queries<br/>Syntax Trees &bull; Taint Sinks &bull; Constraints"]
+            Reach["<b>Reachability &amp; OpenVEX</b><br/>Callgraph Traversal &bull; Reachable CVEs<br/>Zero Ineffective Dependency Alerts"]
+        end
+        subgraph DeepGroup["Forensics, RegEx &amp; Vision OCR"]
+            direction LR
+            OCR["<b>Multi-Modal Vision OCR Engine</b><br/>Tesseract v5.4.0 &bull; Leaked Secrets<br/>Architecture Diagrams &bull; Screenshots"]
+            ReDoS["<b>Thompson NFA ReDoS Engine</b><br/>Polynomial &amp; Exponential Exploder<br/>Catastrophic Backtracking Loops"]
+            GitMine["<b>Git History &amp; Container Audit</b><br/>Commit Packfile Secret Mining<br/>Dockerfile Non-Root Enforcement"]
         end
+    end
+
+    Kernel -->|"Scan Code &amp; Dependencies"| StaticGroup
+    Kernel -->|"Analyze Visuals &amp; Commits"| DeepGroup
+
+    %% =========================================================================
+    %% STAGE 4: CONSENSUS DELIBERATION & TRIAGE
+    %% =========================================================================
+    subgraph DeliberationTriage["3. Deliberation Tournament &amp; Evidence Triage"]
+        direction TB
+        Tournament["<b>3-Perspective Deliberation Tournament</b><br/>Vulnerability Hunter vs. Devil's Advocate / Sanitizer Verifier vs. Ponytail Remediator<br/>Eliminates False Positives &bull; Calibrated Confidence Scoring (0-100%)"]
+        PRGate{"<b>Differential PR Diff Gate</b><br/><code>torusguard review</code><br/>Incremental Git Diff Changes?"}
+        Tournament --> PRGate
+    end
 
-        subgraph Governance["Governance &amp; Remediation Pipeline"]
-            Harden["<b>Harden &amp; Line Reflection</b><br/>Ponytail Bounds: &le;35 Add &bull; &le;25 Del"]
-            Snapshot["<b>Pre-Apply Snapshot Engine</b><br/>Byte-for-Byte Rollback Backups in .torusguard/snapshots/"]
-            HumanGate{"<b>Human Gate Authorization</b><br/>Explicit --yes Confirmation Required"}
-            Recheck["<b>Differential Recheck Engine</b><br/>Zero-Regression Fix Closure"]
+    StaticGroup -->|"Raw AST Findings"| Tournament
+    DeepGroup -->|"Extracted Secrets &amp; Complexities"| Tournament
+
+    %% =========================================================================
+    %% STAGE 5: GOVERNED REMEDIATION & PONYTAIL LOOP
+    %% =========================================================================
+    subgraph GovernedRemediation["4. Governed Remediation Loop &amp; Safety Guardrails (Ponytail Protocol)"]
+        direction TB
+        
+        Harden["<b>Surgical Patch Formulation</b><br/>Semantic Line Snippet Replacement<br/>Strict Line Budget: &le;35 Additions &bull; &le;25 Deletions"]
+        
+        BoundsCheck{"<b>Ponytail Bounds Check</b><br/>Exceeds 35 Add / 25 Del?"}
+        RejectDiff["<b>Diff Rejected</b><br/>Excess Churn Detected<br/>Prompt AI for Minimal Snippet"]
+        
+        SnapshotStore[("<b>Pre-Apply Snapshot Store</b><br/><code>.torusguard/snapshots/&lt;run_id&gt;/</code><br/>Byte-for-Byte Rollback Backup")]
+        
+        HumanGate{"<b>Human Gate Authorization</b><br/>Explicit <code>--yes</code> or Interactive Confirmation"}
+        UserAbort["<b>Operation Aborted</b><br/>Zero Files Touched &bull; Safe Exit"]
+        
+        ApplyPatch["<b>Atomic Patch Application</b><br/>Apply Unified Surgical Diff to Disk"]
+        
+        RecheckGate{"<b>Differential Recheck Engine</b><br/><code>torusguard recheck</code><br/>Fix Closed with Zero Regressions?"}
+        RollbackExec["<b>Auto-Rollback Triggered!</b><br/>Instant Restoration from Snapshot<br/>Quarantine Candidate Patch"]
+        
+        Harden --> BoundsCheck
+        BoundsCheck -->|"Violation"| RejectDiff
+        RejectDiff -.->|"Re-prompt AI"| Harden
+        BoundsCheck -->|"Pass (Within Bounds)"| SnapshotStore
+        SnapshotStore --> HumanGate
+        HumanGate -->|"Denied"| UserAbort
+        HumanGate -->|"Approved"| ApplyPatch
+        ApplyPatch --> RecheckGate
+        RecheckGate -->|"Regressions"| RollbackExec
+        RollbackExec -.->|"Restore Clean State"| SnapshotStore
+    end
+
+    PRGate -->|"Target Findings"| Harden
+
+    %% =========================================================================
+    %% STAGE 6: LIVING SECURITY LEDGER & ENTERPRISE OUTPUTS
+    %% =========================================================================
+    subgraph EnterpriseDeliverables["5. Living Security Ledger &amp; Enterprise Deliverables"]
+        direction TB
+        Ledger[("<b>Living Security Ledger</b><br/><code>security_report.md</code><br/>Synchronized Single Source of Truth &bull; Status: RESOLVED 🟢")]
+        
+        subgraph DeliverableOutputs["Executive Reports &amp; Verified Memory"]
+            direction LR
+            ThreatModel["<b>STRIDE Threat Model</b><br/><code>SECURITY_THREAT_MODEL.md</code><br/>DFD Architecture Diagrams"]
+            SARIF["<b>OASIS SARIF v2.1.0</b><br/>GitHub Advanced Security<br/>CI/CD Security Center"]
+            HTMLReport["<b>Executive Dashboard</b><br/>Single-File HTML Report<br/>Interactive Posture Heatmap"]
+            GoldenRecipes[("<b>Golden Fix Memory</b><br/><code>.torusguard/recipes/</code><br/>Verified Distilled Fixes")]
         end
+
+        Ledger --> DeliverableOutputs
     end
 
-    Router --> Scanners
-    Scanners --> Ledger[("<b>Living Security Ledger</b><br/><code>security_report.md</code><br/>Single Source of Truth")]
-    Ledger --> Harden
-    Harden --> Snapshot
-    Snapshot --> HumanGate
-    HumanGate -- Approved --> Recheck
-    Recheck --> Outputs["<b>Enterprise Outputs</b><br/>OASIS SARIF v2.1.0 &bull; Dark-Mode HTML Report &bull; Golden Fix Distillation"]
-
-    classDef ingressStyle fill:#1e293b,stroke:#38bdf8,stroke-width:2px,color:#f8fafc;
-    classDef scannerStyle fill:#0f172a,stroke:#818cf8,stroke-width:2px,color:#f8fafc;
-    classDef govStyle fill:#0f172a,stroke:#34d399,stroke-width:2px,color:#f8fafc;
-    classDef ledgerStyle fill:#312e81,stroke:#a78bfa,stroke-width:2px,color:#f8fafc;
-    classDef outStyle fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#f8fafc;
-
-    class ModeA,ModeB,ModeC ingressStyle;
-    class AST,OCR,Container,GitMine,ReDoS,AIGuard scannerStyle;
-    class Harden,Snapshot,HumanGate,Recheck govStyle;
+    RecheckGate -->|"Fix Confirmed (Clean Closure)"| Ledger
+
+    %% =========================================================================
+    %% STYLING AND THEME (Modern Dark Cyber Palette)
+    %% =========================================================================
+    classDef ingressStyle fill:#0f172a,stroke:#38bdf8,stroke-width:2px,color:#f8fafc;
+    classDef routerStyle fill:#1e1b4b,stroke:#6366f1,stroke-width:2px,color:#f8fafc;
+    classDef scannerStyle fill:#022c22,stroke:#10b981,stroke-width:2px,color:#f8fafc;
+    classDef tourneyStyle fill:#2e1065,stroke:#a855f7,stroke-width:2px,color:#f8fafc;
+    classDef gateStyle fill:#451a03,stroke:#f59e0b,stroke-width:2px,color:#fef3c7;
+    classDef rejectStyle fill:#450a0a,stroke:#ef4444,stroke-width:2px,color:#fee2e2;
+    classDef actionStyle fill:#064e3b,stroke:#34d399,stroke-width:2px,color:#f8fafc;
+    classDef dbStyle fill:#1e293b,stroke:#94a3b8,stroke-width:2px,color:#f8fafc;
+    classDef ledgerStyle fill:#172554,stroke:#3b82f6,stroke-width:2px,color:#eff6ff;
+    classDef outputStyle fill:#042f2e,stroke:#14b8a6,stroke-width:2px,color:#f0fdfa;
+
+    class CLI,Chat,MCP ingressStyle;
+    class Kernel routerStyle;
+    class AST,TGQL,Reach,OCR,ReDoS,GitMine scannerStyle;
+    class Tournament tourneyStyle;
+    class PRGate,BoundsCheck,HumanGate,RecheckGate gateStyle;
+    class RejectDiff,UserAbort,RollbackExec rejectStyle;
+    class Harden,ApplyPatch actionStyle;
+    class SnapshotStore,GoldenRecipes dbStyle;
     class Ledger ledgerStyle;
-    class Outputs outStyle;
+    class ThreatModel,SARIF,HTMLReport outputStyle;
 ```
 
 > 🌐 **Interactive Architecture Visualizations:**
@@ -200,7 +291,7 @@ npx torusguard init
 ```
 
 <a href="https://www.npmjs.com/package/torusguard">
-  <img src="https://img.shields.io/badge/npm-v2.1.0-CB3837?logo=npm&logoColor=white" alt="npm package">
+  <img src="https://img.shields.io/badge/npm-v2.1.2-CB3837?logo=npm&logoColor=white" alt="npm package">
 </a>
 
 ### Option 2: Build from Source (Recommended for Contributors)
@@ -278,6 +369,9 @@ torusguard exploit-check
 | `init`           | Scaffold `.torusguard/` workspace, detect stack, activate rules |
 | `status`         | Diagnostic overview of posture, stack, and active rules         |
 | `audit`          | Static heuristic security scan against active TG-* rules       |
+| `review`         | Differential PR and Git diff incremental security review       |
+| `threatmodel`    | Synthesize architectural STRIDE threat model & Mermaid DFDs     |
+| `benchmark`      | Run SecurityReviewBench precision & recall evaluation suite    |
 | `verify`         | Live disk line match audit and evidence sufficiency check       |
 | `harden`         | Validate patches against Ponytail Protocol bounds              |
 | `apply`          | Apply patches with pre-apply `.bak` rollback snapshots         |
@@ -287,12 +381,14 @@ torusguard exploit-check
 | `recipes`        | Manage the Golden Fix recipe library                           |
 | `authorize`      | Generate cryptographic auth tokens for runtime probing         |
 | `web-validate`   | Authorized HTTP probing with `X-TorusGuard-Audit` headers      |
+| `exploit-check`  | Bounded single-step exploitability confirmation                |
 | `ocr-scan`       | Run Tesseract OCR secret scan on images/diagrams (<10MB)       |
 | `container`      | Audit Dockerfile, compose, and container configurations        |
 | `git-mine`       | Mine git commit history for leaked secrets & creds             |
 | `redos`          | Analyze regex patterns for catastrophic backtracking           |
 | `ai-guard`       | Scan AI/LLM code for prompt injection & RAG flaws              |
 | `mcp`            | Run native Model Context Protocol (MCP) server over stdio      |
+| `full`           | Master 7-stage closed-loop security governance pipeline        |
 | `update`         | Self-update the TorusGuard engine                              |
 | `help`           | Show interactive command guide                                 |
 
@@ -335,7 +431,7 @@ TorusGuard/
 
 ## 🔒 Security Invariants & Rule Governance
 
-TorusGuard enforces **86 security invariants across 22 architectural families** covering Secrets, Authentication, Multi-Tenant Database Isolation, Input Sanitization, Rate Limiting, AI Agent Prompt Injection, SSRF, Webhooks, WebSockets, CSRF, GraphQL, Supply Chain, Business Logic, Cache Poisoning, Client Bundles, Platform Headers, Polyglot Bypasses, Edge Timeouts, Container & Docker Safety, Git History Secret Mining, Regular Expression Backtracking (ReDoS), and Vector Database RAG Isolation.
+TorusGuard enforces **88 security invariants across 22 architectural families** covering Secrets, Authentication, Multi-Tenant Database Isolation, Input Sanitization, Rate Limiting, AI Agent Prompt Injection, SSRF, Webhooks, WebSockets, CSRF, GraphQL, Supply Chain, Business Logic, Cache Poisoning, Client Bundles, Platform Headers, Polyglot Bypasses, Edge Timeouts, Container & Docker Safety, Git History Secret Mining, Regular Expression Backtracking (ReDoS), and Vector Database RAG Isolation.
 
 > 📘 **Full Rules Catalog & Invariants:**  
 > The complete rulebook with formal invariant definitions, severity scores, and testing signatures is maintained in [`AGENTS.md`](AGENTS.md) and the [`rules/`](rules/) directory.  
@@ -374,7 +470,7 @@ TorusGuard works natively inside AI coding assistants. Add the configuration fil
 
 ### Native MCP Tools (Agent Toolkit Mode)
 
-When configured with `.agents/mcp_config.json` or `mcp_config.json`, AI coding agents gain native tool calling:
+When configured with `.agents/mcp_config.json` or `mcp_config.json`, AI coding agents gain native tool calling (13 Tools & 2 Resources):
 
 - `torusguard_audit`: Deep static AST scan + Vision OCR; writes `security_report.md`
 - `torusguard_ocr_scan`: Dedicated image credential analysis via Tesseract (5-10MB bounds)
@@ -385,6 +481,9 @@ When configured with `.agents/mcp_config.json` or `mcp_config.json`, AI coding a
 - `torusguard_verify`: Asserts evidence sufficiency & line-shift invariant fingerprint matches
 - `torusguard_harden`: Validates remediation diff against Ponytail Protocol bounds
 - `torusguard_recheck`: Differential re-scan confirming fix closure
+- `torusguard_review`: Differential PR and Git diff incremental review; gate decisions
+- `torusguard_threatmodel`: Synthesizes STRIDE threat model & Mermaid DFDs (`SECURITY_THREAT_MODEL.md`)
+- `torusguard_benchmark`: Runs SecurityReviewBench self-evaluating precision & recall suite
 - `torusguard_status`: Workspace posture and tech stack inspection
 - `torusguard://security_report`: MCP Resource reading the living security report
 - `torusguard://rules_catalog`: MCP Resource exploring verified rules catalog & Golden Fix patterns
@@ -397,11 +496,12 @@ TorusGuard undergoes rigorous automated multi-tier testing across polyglot stack
 
 | Testing Tier | Scope & Target Stacks | Pass Rate | Verified Capabilities |
 | :--- | :--- | :---: | :--- |
-| **Go Engine & Unit Tests** | `cmd/torusguard`, `internal/scanner`, `internal/*` | **100% Passing** | Deterministic AST matching, 74 rule patterns, JSON-RPC 2.0 MCP protocol. |
+| **Go Engine & Unit Tests** | `cmd/torusguard`, `internal/scanner`, `internal/*` | **100% Passing** | Deterministic AST matching, 88 canonical rule patterns, JSON-RPC 2.0 MCP protocol (133/133 harness tests passing). |
 | **Mass Polyglot Benchmarks** | **20 Enterprise Tech Stacks** (Go, Python, Java, Node, Rust, PHP, C#, Ruby, Svelte, Vue, Angular) | **20/20 Passed** | Framework auto-profiling, heuristic AST analysis, finding deduplication. |
+| **Unseen Tri-Mode Validation** | **6 Unseen Framework Ecosystems** (SvelteKit 2 + Bun, FastAPI AI RAG, DevOps Git Mine, OCR Asset Suite, Kotlin Ktor, Laravel 11) | **6/6 Passed (100%)** | Mode A (CLI) + Mode B (Slash Commands) + Mode C (Native MCP Tools) across 18/18 canonical skills with automated sandbox cleanup. |
 | **Tri-Mode & Vision E2E** | **16 Diverse Framework Repos** (React, Next.js, Express, Django, FastAPI, Spring Boot, etc.) | **16/16 Passed** | Mode A (CLI) + Mode B (Slash Commands) + Mode C (Native MCP Tools) + Multi-Modal Vision OCR. |
-| **Multi-Modal Vision OCR** | Diagram & Image assets (`.png`, `.jpg`, etc.) via Tesseract v5.4.0 | **100% Recall** | Secrets detection (`TG-SEC-001` - `TG-SEC-007`), 10MB DoS bounding, OCR character substitution tolerance. |
-| **Ponytail Churn Limits** | Surgical patch validation across all 74 rules | **Bounded** | Line bounds (≤35 additions, ≤25 deletions), zero-bypass verification (`TG-DIFF-001`). |
+| **Multi-Modal Vision OCR** | Diagram & Image assets (`.png`, `.jpg`, `.webp`) via Tesseract v5.4.0 | **100% Recall** | Secrets detection (`TG-SEC-001` - `TG-SEC-007`), 10MB DoS bounding, OCR character substitution tolerance. |
+| **Ponytail Churn Limits** | Surgical patch validation across all 88 rules | **Bounded** | Line bounds (≤35 additions, ≤25 deletions), zero-bypass verification (`TG-DIFF-001`). |
 
 All test environments are completely sandboxed, verified with byte-for-byte assertions, and cleaned up automatically.
 
@@ -450,5 +550,6 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines and [CODE_OF_COND
 | [Testing Playbook](docs/usage/testing-playbook.md)        | Testing guide and CI integration         |
 | [Demo Guide](docs/demo.md)                                | Quick start and full lifecycle demo      |
 | [Roadmap](docs/roadmap.md)                                | Feature roadmap and release planning     |
+| [Unseen Stacks Validation Report](docs/validation/unseen-repos-tri-mode-validation-report.md) | Tri-mode validation across 6 unseen ecosystems & vision OCR |
 | [SECURITY.md](SECURITY.md)                                | Vulnerability disclosure policy          |
 | [CHANGELOG.md](CHANGELOG.md)                              | Version history and release notes        |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {
@@ -19,10 +19,18 @@
     "init": "node bin/torusguard.js init",
     "status": "node bin/torusguard.js status",
     "audit": "node bin/torusguard.js audit",
+    "review": "node bin/torusguard.js review",
+    "threatmodel": "node bin/torusguard.js threatmodel",
+    "benchmark": "node bin/torusguard.js benchmark",
     "harden": "node bin/torusguard.js harden",
     "apply": "node bin/torusguard.js apply",
     "recipes": "node bin/torusguard.js recipes",
-    "update": "node bin/torusguard.js update"
+    "update": "node bin/torusguard.js update",
+    "build": "echo \"No build step required\""
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.3",
+    "typescript": "^5.0.0"
   },
   "keywords": [
     "security",

package/skills/torusguard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard
-description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
-version: 2.0.0
+description: Universal autonomous security engine: 88 canonical rules across 22 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, SARIF v2.1.0 exports, and persistent security memory context.
+version: 2.1.1
 ---
 
 # TorusGuard Master Security Engine & Command Router
@@ -30,6 +30,10 @@ TorusGuard operates with 100% feature parity across the compiled terminal CLI, A
 | **Authorize** | `torusguard authorize` | `/torusguard authorize` | `.torusguard/skills/torusguard-authorize`| Legal scope definition & safety boundaries |
 | **Validate** | `torusguard web-validate` | `/torusguard web-validate` | `.torusguard/skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
 | **Exploit** | `torusguard exploit-check` | `/torusguard exploit-check`| `.torusguard/skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
+| **Container** | `torusguard container` | `/torusguard container` | `.torusguard/skills/torusguard-container` | Audits Dockerfile & Compose for root users, sockets, privileged mode |
+| **Git Mine** | `torusguard git-mine` | `/torusguard git-mine` | `.torusguard/skills/torusguard-git-mine` | Mines git commit history & config for leaked credentials & tokens |
+| **ReDoS** | `torusguard redos` | `/torusguard redos` | `.torusguard/skills/torusguard-redos` | Analyzes regex patterns for catastrophic exponential backtracking |
+| **AI Guard** | `torusguard ai-guard` | `/torusguard ai-guard` | `.torusguard/skills/torusguard-ai-guard` | Audits AI agents & RAG pipelines for prompt injection & tenant leaks |
 | **Full** | `torusguard full` | `/torusguard full` | `.torusguard/skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
 | **MCP Server**| `torusguard mcp` | — | Native Stdio JSON-RPC 2.0 | Serves native Model Context Protocol tools to AI coding agents |
 | **Update** | `torusguard update` | `/torusguard update` | `.torusguard/skills/torusguard-init` | Self-update TorusGuard engine binary |

package/skills/torusguard/bootstrap.py

@@ -144,7 +144,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v2.1.0", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.2", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
@@ -164,7 +164,7 @@ def card_header(title: str, subtitle: str = "", version: str = "v2.1.0", border_
 def print_header():
     """Print the branded TorusGuard header card."""
     print()
-    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.0"))
+    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.2"))
     print()
 
 
@@ -247,7 +247,7 @@ def print_already_initialized(target_root, cfg):
     print(f"""
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.0')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.1')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}

package/skills/torusguard/payload/.manifest.json

@@ -10,6 +10,46 @@
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "305c1dc5b556e8d64ad9dd585dafac1a9955cf1bd5321429955b19b7a62736b6",
   "config/torusguard.json": "55dbde335997421a01c97709fd1672ad70fa921bfe8346dd57552b799db2419e",
+  "core/__init__.py": "2120562452ae03c84468d67246dc93376f7ebcde8e4ca767c6253bc92c35dbbf",
+  "core/agent_roles.py": "d7189dbf1d3ae4e330eb316bed5d399a18992295addf466f4c6552bc14ae6a34",
+  "core/ast_walker.py": "309564d168e6eb9e3e93aceb29a95a61872b35a4da7235ee49e79e9d3a5e7cc6",
+  "core/authorization.py": "2bb7f85b4639959276fc7cfd427df7edb8b1f97f8003707a0032f100953d1b30",
+  "core/browser_verifier.py": "e450bdbb8d5c2808a3b3ea7bc33bce2451230cbbb7ed4f17dbc7107ab0f30d56",
+  "core/bundle.py": "82505fba44a5ad867a4caef34e1233ebf76d4bc2e15b943e2413822602f1a95f",
+  "core/call_graph.py": "7e230f8b5fa7dd8f780eafbe7381f2d9538f01a880c1349c41139cce20f9094f",
+  "core/clustering.py": "0ffcad5e8a459084d200248de8799d466c2b53ad627b778314b09f2733df782c",
+  "core/confidence.py": "81c6242a1a3eaea873d39e8b212e5781a2df2316614f18a2fe6ef757561f5bb5",
+  "core/cross_file_taint.py": "1fa323529e5ca2fcce06167e4a59431f9f8217ad7a5097f8afbc6b9a9dc0913d",
+  "core/exploit_checker.py": "74a48e6e1e1b9791107b487ab5434540494946441605cf9115fa90b787bc5c5a",
+  "core/formatter.py": "a9d2a20e52caaf8a801f65f325b3f5bc430eb6301506973095961d4615b7e429",
+  "core/governance.py": "657edfa332c2f855f917545862c9d38f31468cec464d11dd2c012dcf794fb32c",
+  "core/identity.py": "f42d3d81c7ee8ca5d2ef08d48066abdc42d2ccbd5fe0bbd88b35d5c8174b696f",
+  "core/import_resolver.py": "4ac89ac405816b7de599fbabfa47556d10c1557d92f3a700bf50b90f52ba6c75",
+  "core/incremental.py": "8ff9d41f6667bf567d2e952f31ae330271ba1d6cf5411ab4468c355ca2fa6681",
+  "core/lifecycle.py": "f4406acba8464ed9111128ef545f8c576639cadda8b9de7e23ff8a90fad24f9e",
+  "core/models.py": "ed23b50aab2eb7ea9bc16dbb20b0bf4f978f3aae7f39f0a713f7efe08ff238b5",
+  "core/parallel.py": "27fcfdd3760d481ffdd4e7321a79d17ef4823dd3744687fcc9d00349c0bb1d49",
+  "core/parser.py": "2f01e9beb178e86002fd8dd3211cf269ab59f21e5c65aabb5e9d0e110504d1d1",
+  "core/rechecker.py": "2a21b788158cac79db9030db79e3a27021e7f66692c37c39e0bd3fadf483388c",
+  "core/replay_trace.py": "8132cb43dd4593cc96f09f014c2b3882ef5296ebc5029a921423263b07ca7a1d",
+  "core/rules_registry.py": "80c4f5067f151b596388ae9a4546d2f009f10342daa5221412e5c9a222b27a31",
+  "core/run_folder.py": "cc8702dfd3a2768e5dca74f7ac85e316f53f1acb059bad87ca3650eeeae2defa",
+  "core/run_manager.py": "2470ebc8b54edaab3679d909fde48f02c7530f1e12c917b7b5cd5c004062a8b6",
+  "core/runtime_evidence.py": "79c947a3b131c3be2f2938789d12647a0d9010bb4077bf3f33b2c7218ba9028b",
+  "core/runtime_validator.py": "39477ef1138e8deaa5c3859d6402e71d2c0eb6e2e39fbd3db04fe3ad8e2c798c",
+  "core/safety_gate.py": "349e84187930faf79baa38643712d48636de504e8613667e42ec852999efa9fb",
+  "core/sarif.py": "93316e7d5fa0ac3660ce18307a2ef4f9c2b2b24b0a4e40d288f94edd0ef84e6d",
+  "core/stack_profiler.py": "8c5166c712d7e9341d6290b2220da05662f1ba251899d6f501a9875625f5539c",
+  "core/symbol_table.py": "8e700e01e920e7c8a496a16e400195bb6cedd9e3624997fbb44b29124e256d74",
+  "core/taint.py": "f54b3e2d620d480969681847e63149b259876dbac470dc417e90407e1def925b",
+  "core/taint_graph.py": "2f697a4d4c44801f346f7bde0794cc70c481b4a5a28fe02add20fa845fd9a5c5",
+  "core/taint_rules.py": "d29893e0212a2afb21fede6c20afb6d3fe9ff89511659675f02a034ea1e87d8f",
+  "core/v070_reporter.py": "d9e9bebd4e158f4c1b1b50897c04c2c5f9db85919b1700b47331ecf16fe7bd63",
+  "core/v070_workflow.py": "57bf1468c78f47b4aa5fb5804eb3c247825daa0933bb5cf0aad4ae2394adcead",
+  "core/v6_reporter.py": "95fa2ec5b0e708101b62131152445039192382e409d0f40c35cdcbf96648ca26",
+  "core/v6_workflow.py": "3e38afafc3afdbebe8cf76ed24da00435aab27a2ac512a292983f8b1e88ebcb8",
+  "core/watcher.py": "b3d4856023ee2f6c65b2938d3c76c246d7c440c58cdc7b642dc27209d68a959a",
+  "custom_rules/README.md": "787adf6e38498d895cb8ead6e213e91d41304e31051bfdd0440ea8ae107e0104",
   "references/csharp-security.md": "d6e267855b08ed4fdff26f3b876f089ae1f90a7ec6546cba7e8173380d9daa9d",
   "references/django-security.md": "26ea5535ac435e61489df1e381ac62b19e81702edfe095e78c937be93fa15ea7",
   "references/drf-security.md": "c6796398317b0f264d89fff598404e126d819e69e1ea0a5129924a5eb2a7af9d",
@@ -43,6 +83,8 @@
   "rules/TG-INPUT-004-unrestricted-file-upload.md": "d665fb7ede456c24d12229cec22b30374a4dc036c3fe3a41ece22f97ab78a1f4",
   "rules/TG-INPUT-005-unsafe-template-rendering-and-escaping.md": "b6006e741a303d8ff2cd65ef417e6199e5dcf8fe7d603941244db82f6cbe1753",
   "rules/TG-INPUT-006-unsafe-file-path-traversal.md": "5edb665cd2c41b659849c96d0d4b801a6365e130be12c51733a3d6f17cfd85ed",
+  "rules/TG-INPUT-007-unvalidated-redirect.md": "7da41ecbd39a7c90fe90fc683df48f38b0cf5a0d7c2b027f0827830bd8f814f7",
+  "rules/TG-INPUT-008-insecure-deserialization.md": "5f5f85a9429d32959f890f668ff1fd75bd7ce976a7b9406c3b7235fc728989ca",
   "rules/TG-PLATFORM-001-wildcard-cors-with-credentials.md": "fb8154f5b8051e94886c956b1e7bdbc5f316739795b8fb9bb493223ca774fe25",
   "rules/TG-PLATFORM-002-missing-security-headers.md": "207f489453d6256b5d794f79be25c66e9f932ae5cb561b3e8b50d26a28f6a07a",
   "rules/TG-PLATFORM-003-production-stack-trace-exposure.md": "298c75b928c160720243e42ce5bf43397e73cf50ed472482d5ef3f7635fcb839",
@@ -155,14 +197,16 @@
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
   "scripts/apply_runner.py": "b145a68a4bc10fcacb853f972aee81fa3607e32d282b2b850c5a63d8e72da890",
-  "scripts/audit_runner.py": "bc1e06ea5153ae326c4ad1de5d0cbb9503e618186623bea7cb8bb64d7b7b05ec",
+  "scripts/audit_runner.py": "18ebcd46f8363169db4ff4675a5258e0b93df5b219650de95b9a5e9f51da5ff9",
+  "scripts/deliberation_tournament.py": "9581161cdb064a3ed6bfd0c242e71fcb43b0fd083b2eb84bc239ac7cc6568b64",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
-  "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
+  "scripts/finding_scorer.py": "95c7edfe5ee4742be565914f71bb07bd077b2cf4636b769476345389dd85f3cf",
   "scripts/harden_runner.py": "5d5a40029c088ccb66790a9b0128bdefcd35883ef1dac78088ceb9531392a8f1",
   "scripts/html_reporter.py": "655c57be39e13c177db8842ef471664e5853f3e43b9f2a63e590df40ff9c16cb",
   "scripts/manifest_builder.py": "f1f9a0d63c55cf5ff45e9fd39d1b251c2bce05e777f8c1e325741d340f0128db",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
+  "scripts/reachability_analyzer.py": "708a690052f9d850fda7641dd5ec972f43e3c3c3ed5fc61221bd73517593ead3",
   "scripts/recheck_runner.py": "89e93fcc6843493d7e5f0bf97065dbdb40106273a00e07f903250665ca25f6fb",
   "scripts/recipes_runner.py": "090c06ef0de3c640a111c5646837233ceeaca494b161bd5edc630cc1371dca0e",
   "scripts/report_sync.py": "5ebef684690200694a53af30db850d9808d03ec710ed21ef75c4de52b5e5217c",
@@ -172,9 +216,10 @@
   "scripts/sarif_exporter.py": "86700765212adb3ab590ca72614bf3ad4ce7ce60e3193f7f3bd1a04d34d10f6e",
   "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
   "scripts/status_runner.py": "4c358c91950c7874bcc6a5f23f2d3fda62b0752efcf6c6b658adf02ed77c7752",
+  "scripts/stride_generator.py": "4660713fa65e24119b88b6a050fb41f625d99bad030f1db40d198950d8c55ba8",
   "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
-  "skills/torusguard/SKILL.md": "4987faed0081cd75d54b9f3c8378a2539e348e8ec814ffdb78415ed7d478a571",
-  "skills/torusguard/bootstrap.py": "f7ce48cc310dcdbf86c028f05a8f5ad22677f4cebb1bec5c90d173a9044342c5",
+  "skills/torusguard/SKILL.md": "15c69cb10eca1a10344b494888dce57e2baf227c3282bd54424a36ce35fb2460",
+  "skills/torusguard/bootstrap.py": "b75ad49e9dade87980cde3269ee1f5c3438f944a34a545c44f839d4496086b63",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
   "skills/torusguard/references/cache-and-sensitive-responses.md": "81b4a7a08e11dafa4ec58d868c4a35f1f891d0dcdcfbcefaef81e1b9ba94f5a1",
@@ -205,7 +250,7 @@
   "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
   "skills/torusguard-ai-guard/SKILL.md": "130a24d82f1b92fcc3ac2f4edc77d4d999ae629971f2131f66d6fac876f5593f",
   "skills/torusguard-apply/SKILL.md": "edb21eabae4f9ad5be5976b20d217941c87b2a15edfc73383d02460ca3253fca",
-  "skills/torusguard-audit/SKILL.md": "527f7fca458efb814ef656626d080adacc8c1dd95f2d56a457bbae688a9bedaa",
+  "skills/torusguard-audit/SKILL.md": "b9ffc74381360656cbc78438c003fb1e67c4f0787f87627555863b474d57a8ad",
   "skills/torusguard-authorize/SKILL.md": "56bcebc718bddadfd66010ebe2d23b4acf429e6230de05dd2300dab6bd383cc2",
   "skills/torusguard-container/SKILL.md": "f9a2dea0b6b1e2de8ce4a189bb32b1010f1b4d6ff7a529450857b6dab20546ff",
   "skills/torusguard-exploit-check/SKILL.md": "c127f1766e98e28dc967e452dff5dfec87689a26cf671ab6e62a135cd4d46e4b",
@@ -217,7 +262,9 @@
   "skills/torusguard-recheck/SKILL.md": "a5c4539ec6d091179c8ba53792fba46f26795976f392d2305e357f25a2966c55",
   "skills/torusguard-redos/SKILL.md": "b09b39bd98589613b2107c177e247f6224fb54ab2f028b4339ae01aac9d28c67",
   "skills/torusguard-report/SKILL.md": "509185ea6730601cf9a44e136219cace61cd0523f8e112de03e4ef1c35e60585",
+  "skills/torusguard-review/SKILL.md": "6d9ec907821ddf62bbbeaed8751d1532e72ba42702ea3afdaadaf720f66c35e3",
   "skills/torusguard-status/SKILL.md": "e9741a20313a8304bc7565b194949a59ec7cfd4945b197517680164b3197efc0",
+  "skills/torusguard-threatmodel/SKILL.md": "549903f39a030a75d88c184b7373d86bca921d8f802732c3674bfe9537b14537",
   "skills/torusguard-verify/SKILL.md": "aeb4d3c7924253607d130e48491d83bf7b7a21707cd1dac2ba97d64f5e259fd6",
   "skills/torusguard-web-validate/SKILL.md": "f1df00e10abd823d9a8c4daa1a3af7f26c5263c6c8e58e05b61b647d01a25489",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
@@ -226,7 +273,7 @@
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
   "workflows/ai-guard.md": "7d762f4e18f64864b50b64148b972085d2766aeaf13833bc1e6aeb8fddb96999",
   "workflows/apply.md": "0cd0fa84627ff73ffef84aa7eed6d096b57826139c079fa63f1bd745e13b138a",
-  "workflows/audit.md": "4fb2bfe345792572f3e164aa38ab1b103868eac2bff0d9dbf91082514ea9b649",
+  "workflows/audit.md": "9f13b0497553965d30a71ff040a0dc556d526c8bbff136952b8210685632b5d7",
   "workflows/authorize.md": "386779f405c4b7de0282938db4095179ed212fd32296dff158acb3258b41aec1",
   "workflows/container.md": "64936b4873e9dfde6deae8a7d10d572a3bfbbfe9ef2340d0df8a3db5e1d02ad7",
   "workflows/exploit-check.md": "4dc4016b7a22f18d5c32dd6fcfa7a859df07d03300973654aea92fe5251c8a85",
@@ -239,9 +286,11 @@
   "workflows/recipes.md": "300c1fed0167e1a299fcd33c07db05630116b18a71ec2513c385862bba0f179b",
   "workflows/redos.md": "f55a4f510849a5ea7e2ae4b08ecc70dff03c1bf21c7fdc664a4ff3ad0396f904",
   "workflows/report.md": "7c718dfef6da1b66ba0fed300b7dfc90438fc3866af5a9b2aae4b3c3acd638e2",
+  "workflows/review.md": "ac8edc3c1d64571c7d58769e471fb10855969de72d874acb988c9c3c963f9a45",
   "workflows/status.md": "021a962ae4e6fc81383db2ef42d28dcfc1b3e546c9a10a7a15b9910e531cf0c2",
+  "workflows/threatmodel.md": "b509c38754bff5284d768d3e64cea21839ee9abcedb1661e597d291145715cf1",
   "workflows/torusguard-apply.md": "67e1002fc6e9d68e0c7d871c40b6f3c3b9c3919c8e02106a579882729c0f6b9f",
-  "workflows/torusguard-audit.md": "eac9102ca88d53f71da474cd55717d431fd9c3b08c66d0760da9b53a659cf89a",
+  "workflows/torusguard-audit.md": "9f13b0497553965d30a71ff040a0dc556d526c8bbff136952b8210685632b5d7",
   "workflows/torusguard-authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
   "workflows/torusguard-exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
   "workflows/torusguard-harden.md": "7d92132973ff867b99e0425e3aee3c4e91868cb5193ec601069af2e857b6697f",