torusguard 2.1.2 → 2.1.3

package/.torusguard/.manifest.json

@@ -9,7 +9,7 @@
   "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "305c1dc5b556e8d64ad9dd585dafac1a9955cf1bd5321429955b19b7a62736b6",
-  "config/torusguard.json": "55dbde335997421a01c97709fd1672ad70fa921bfe8346dd57552b799db2419e",
+  "config/torusguard.json": "e8e41f3be04a06deb32ce5faaa93ddd608abfb2694b30325cac5085f3bfec9d8",
   "core/__init__.py": "2120562452ae03c84468d67246dc93376f7ebcde8e4ca767c6253bc92c35dbbf",
   "core/agent_roles.py": "d7189dbf1d3ae4e330eb316bed5d399a18992295addf466f4c6552bc14ae6a34",
   "core/ast_walker.py": "309564d168e6eb9e3e93aceb29a95a61872b35a4da7235ee49e79e9d3a5e7cc6",
@@ -216,9 +216,9 @@
   "scripts/sarif_exporter.py": "86700765212adb3ab590ca72614bf3ad4ce7ce60e3193f7f3bd1a04d34d10f6e",
   "scripts/skill_profiler.py": "ada83e022795febb2365a73753656ff881993d77cf73517e818d668e961adb45",
   "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
-  "scripts/status_runner.py": "4c358c91950c7874bcc6a5f23f2d3fda62b0752efcf6c6b658adf02ed77c7752",
+  "scripts/status_runner.py": "a7421e25e2e34c1b83960ad117f5ea23d6f08b8af8b664be3fe03f70a3962db3",
   "scripts/stride_generator.py": "c7a4ea2a19a7386dfc6c0fb301e933a32de2c8963ffa605e5aaa651cf880507f",
-  "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
+  "scripts/term_ui.py": "a23435c703c4e8b68c5b80a539d59de2eda1cb01b0d9c47909ba72efde3be29b",
   "skills/torusguard/SKILL.md": "15c69cb10eca1a10344b494888dce57e2baf227c3282bd54424a36ce35fb2460",
   "skills/torusguard/bootstrap.py": "f7ce48cc310dcdbf86c028f05a8f5ad22677f4cebb1bec5c90d173a9044342c5",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",

package/.torusguard/config/torusguard.json

@@ -1,6 +1,6 @@
 {
   "$schema": "../schemas/torusguard-config.schema.json",
-  "version": "1.0.0",
+  "version": "2.1.3",
   "product": "TorusGuard Security Skill Kit",
   "severity_threshold": "medium",
   "auto_detect_stack": true,

package/.torusguard/scripts/status_runner.py

@@ -58,7 +58,7 @@ def collect_status(target_dir: Path) -> WorkspaceStatus:
     is_init = tg_dir.is_dir()
 
     # 1. Read config
-    version = "1.4.0"
+    version = "2.1.3"
     stack_name = "Undetected"
     cfg_file = tg_dir / "config" / "torusguard.json"
     if cfg_file.is_file():
@@ -94,7 +94,7 @@ def collect_status(target_dir: Path) -> WorkspaceStatus:
         if rules_root.is_dir():
             active_rules_count = sum(1 for f in rules_root.rglob("TG-*.md"))
     if active_rules_count == 0:
-        active_rules_count = 74  # Canonical rule catalog default
+        active_rules_count = 88  # Canonical rule catalog default
 
     # 3. Read run history
     total_runs = 0
@@ -210,7 +210,7 @@ def print_status_card(status: WorkspaceStatus) -> None:
     print(format_box_line(f"Workspace:    {WHITE}{status.target_path}{RESET}", 67))
     print(format_box_line(f"Status:       {init_str}", 67))
     print(format_box_line(f"Stack:        {BOLD}{WHITE}{status.stack_detected}{RESET}", 67))
-    print(format_box_line(f"Active Rules: {GREEN}{status.active_rules_count}{RESET} canonical rules enabled across 18 families", 67))
+    print(format_box_line(f"Active Rules: {GREEN}{status.active_rules_count}{RESET} canonical rules enabled across 22 families", 67))
     print(card_border_bottom(CYAN))
     print()
 

package/.torusguard/scripts/term_ui.py

@@ -143,7 +143,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.3", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"

package/README.md

@@ -11,8 +11,8 @@
 
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"></a>
-  <a href="https://github.com/githubmofo/TorusGuard/releases"><img src="https://img.shields.io/badge/version-v2.1.2-orange.svg" alt="Version"></a>
-  <a href="https://www.npmjs.com/package/torusguard"><img src="https://img.shields.io/badge/npm-v2.1.2-CB3837?logo=npm&logoColor=white" alt="npm: v2.1.2"></a>
+  <a href="https://github.com/githubmofo/TorusGuard/releases"><img src="https://img.shields.io/badge/version-v2.1.3-orange.svg" alt="Version"></a>
+  <a href="https://www.npmjs.com/package/torusguard"><img src="https://img.shields.io/badge/npm-v2.1.3-CB3837?logo=npm&logoColor=white" alt="npm: v2.1.3"></a>
   <img src="https://img.shields.io/badge/Privacy-Local_First-success" alt="Privacy: Local First">
   <img src="https://img.shields.io/badge/Dependencies-Zero-brightgreen" alt="Dependencies: Zero">
   <img src="https://img.shields.io/badge/SARIF-v2.1.0-6C3483" alt="SARIF">
@@ -276,24 +276,55 @@ flowchart TD
 
 ---
 
-## 🚀 Installation
+## 🚀 Installation & How to Use (3 Options)
+
+TorusGuard can be run without installation via `npx`, installed globally or locally via `npm`, compiled from source with `go build`, or installed via `go install`.
+
+| Option | Method | Best For | Dedicated Guide |
+| :--- | :--- | :--- | :--- |
+| **Option 1** | **npm & npx** | Node.js developers, zero-install CLI, CI/CD | 📖 [Option 1 Guide](docs/usage/option-1-npm.md) |
+| **Option 2** | **Build from Source** | Contributors, custom rules, Go development | 📖 [Option 2 Guide](docs/usage/option-2-source.md) |
+| **Option 3** | **Go Install** | Go projects, single-binary, zero Node.js/npm | 📖 [Option 3 Guide](docs/usage/option-3-go-install.md) |
+
+---
 
 ### Option 1: npm (Primary)
 
+#### Method A: Direct NPX Zero-Install (Recommended)
+Run directly without installing any packages globally or locally:
+
 ```bash
-npm install -g torusguard
+npx torusguard init
 ```
 
-Or use directly without installing:
+*Tip: Use `npx torusguard@latest init` to guarantee the freshest release.*
 
+#### Method B: Global Installation
 ```bash
-npx torusguard init
+npm install -g torusguard
+torusguard init
+```
+
+#### Method C: Local Project Installation
+```bash
+npm install -D torusguard
 ```
 
+> 💡 **Using TorusGuard after `npm install torusguard`:**  
+> TorusGuard is a CLI security engine, not an importable JavaScript library. When installed locally, the binary resides in `node_modules/.bin/torusguard`.  
+> You can run it via:  
+> - `npx torusguard init` *(npx automatically uses your local `node_modules` binary)*  
+> - Adding `"security:audit": "torusguard audit"` to your `package.json` scripts (`npm run security:audit`)  
+> - Direct path: `./node_modules/.bin/torusguard audit`  
+
 <a href="https://www.npmjs.com/package/torusguard">
-  <img src="https://img.shields.io/badge/npm-v2.1.2-CB3837?logo=npm&logoColor=white" alt="npm package">
+  <img src="https://img.shields.io/badge/npm-v2.1.3-CB3837?logo=npm&logoColor=white" alt="npm package">
 </a>
 
+👉 **[Read the Full Option 1 (npm & npx) Dedicated Guide →](docs/usage/option-1-npm.md)**
+
+---
+
 ### Option 2: Build from Source (Recommended for Contributors)
 
 ```bash
@@ -302,12 +333,37 @@ cd TorusGuard
 go build -o torusguard ./cmd/torusguard
 ```
 
+On Windows:
+```powershell
+go build -o torusguard.exe ./cmd/torusguard
+```
+
+Run directly:
+```bash
+./torusguard init
+./torusguard audit
+```
+
+👉 **[Read the Full Option 2 (Build from Source) Dedicated Guide →](docs/usage/option-2-source.md)**
+
+---
+
 ### Option 3: Go Install
 
+Install directly into `$GOPATH/bin`:
+
 ```bash
-go install github.com/torusguard/torusguard/cmd/torusguard@latest
+go install github.com/githubmofo/TorusGuard/cmd/torusguard@latest
 ```
 
+Verify and run:
+```bash
+torusguard --version
+torusguard init
+```
+
+👉 **[Read the Full Option 3 (Go Install) Dedicated Guide →](docs/usage/option-3-go-install.md)**
+
 ---
 
 ## 💻 Usage

package/bin/torusguard.js

@@ -15,14 +15,15 @@ const command = args[0] || 'init';
 const rootDir = path.resolve(__dirname, '..');
 const cwd = process.cwd();
 
+let PKG_VERSION = '2.1.3';
+try {
+  const pkg = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8'));
+  PKG_VERSION = pkg.version || PKG_VERSION;
+} catch (e) {}
+
 // Parse version flag immediately
 if (command === '--version' || command === '-v' || command === 'version') {
-  let ver = '1.4.0';
-  try {
-    const pkg = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8'));
-    ver = pkg.version || ver;
-  } catch (e) {}
-  console.log(`torusguard v${ver}`);
+  console.log(`torusguard v${PKG_VERSION}`);
   process.exit(0);
 }
 
@@ -196,7 +197,7 @@ function cardDivider(title = '', borderColor = CYAN, double = false) {
   return `  ${borderColor}${left}${h.repeat(71)}${right}${RESET}`;
 }
 
-function cardHeader(title, subtitle = '', version = 'v1.3.6', borderColor = CYAN) {
+function cardHeader(title, subtitle = '', version = `v${PKG_VERSION}`, borderColor = CYAN) {
   const top = `  ${borderColor}╭${'─'.repeat(71)}╮${RESET}`;
   const bottom = `  ${borderColor}╰${'─'.repeat(71)}╯${RESET}`;
   const empty = `  ${borderColor}│${' '.repeat(71)}│${RESET}`;
@@ -214,7 +215,7 @@ function cardHeader(title, subtitle = '', version = 'v1.3.6', borderColor = CYAN
 
 function printHelp() {
   console.log();
-  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', 'v1.4.0'));
+  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', `v${PKG_VERSION}`));
   console.log(`\n  ${BOLD}Usage:${RESET}  ${GREEN}npx torusguard${RESET} ${WHITE}[command]${RESET} ${GRAY}[options]${RESET}\n`);
 
   console.log(cardBorderTop('Commands'));
@@ -309,7 +310,7 @@ if (command === 'status') {
       }
 
       console.log();
-      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', 'v1.3.6'));
+      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', `v${PKG_VERSION}`));
       console.log(`\n  ${BOLD}▸ Workspace:${RESET}        ${GREEN}${cwd}${RESET}`);
       console.log(`  ${BOLD}▸ Governance:${RESET}       ${GREEN}Full Local Governance (.torusguard/)${RESET}`);
       console.log(`  ${BOLD}▸ Living Report:${RESET}    ${CYAN}security_report.md${RESET}\n`);
@@ -331,7 +332,7 @@ if (command === 'status') {
       console.log();
 
       console.log(cardBorderTop('Governance Telemetry'));
-      console.log(formatBoxLine(`Rules Catalog:     ${GREEN}74 Canonical Security Rules${RESET} (18 families)`));
+      console.log(formatBoxLine(`Rules Catalog:     ${GREEN}88 Canonical Security Rules${RESET} (22 families)`));
       console.log(formatBoxLine(`Severity Floor:    ${YELLOW}${cfg.severity_threshold || 'medium'}${RESET}`));
       console.log(formatBoxLine(`Runs Directory:    ${DIM}${cfg.runs_dir || '.torusguard/runs'}${RESET}`));
       console.log(formatBoxLine(`Ponytail Bounds:   ${GREEN}<= 35 additions, <= 25 deletions${RESET}`));
@@ -339,16 +340,18 @@ if (command === 'status') {
       console.log(cardBorderBottom());
       console.log();
 
-      console.log(cardBorderTop('Rule Families (18 Families / 74 Rules)'));
-      console.log(formatBoxLine(`${YELLOW}TG-SEC${RESET}     Secrets (7)              ${YELLOW}TG-DB${RESET}      Database Safety (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-INPUT${RESET}   Input Validation (6)     ${YELLOW}TG-AUTH${RESET}    Authentication (8)`));
+      console.log(cardBorderTop('Rule Families (22 Families / 88 Rules)'));
+      console.log(formatBoxLine(`${YELLOW}TG-SEC${RESET}     Secrets & Tokens (7)     ${YELLOW}TG-AUTH${RESET}    Authentication (8)`));
+      console.log(formatBoxLine(`${YELLOW}TG-DB${RESET}      Database Isolation (4)   ${YELLOW}TG-INPUT${RESET}   Input & Traversal (8)`));
       console.log(formatBoxLine(`${YELLOW}TG-RATE${RESET}    Rate Limiting (3)        ${YELLOW}TG-AGENT${RESET}   AI Agent Security (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-SSRF${RESET}    Server Request (4)       ${YELLOW}TG-WEBHOOK${RESET} Webhook Trust (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-WS${RESET}      WebSocket (4)            ${YELLOW}TG-CSRF${RESET}    Cross-Site Request (2)`));
-      console.log(formatBoxLine(`${YELLOW}TG-GQL${RESET}     GraphQL Security (4)     ${YELLOW}TG-SUPPLY${RESET}  Supply Chain (6)`));
-      console.log(formatBoxLine(`${YELLOW}TG-BIZ${RESET}     Business Logic (4)       ${YELLOW}TG-CACHE${RESET}   Cache Isolation (3)`));
-      console.log(formatBoxLine(`${YELLOW}TG-CLIENT${RESET}  Client Bundles (2)       ${YELLOW}TG-PLATFORM${RESET}Platform Config (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-DIFF${RESET}    Diff Inspection (3)      ${YELLOW}TG-EDGE${RESET}    Serverless / Edge (2)`));
+      console.log(formatBoxLine(`${YELLOW}TG-SSRF${RESET}    Server-Side Request (4)  ${YELLOW}TG-WEBHOOK${RESET} Webhook Signature (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-WS${RESET}      WebSocket Safety (4)     ${YELLOW}TG-CSRF${RESET}    Cross-Site Request (2)`));
+      console.log(formatBoxLine(`${YELLOW}TG-GQL${RESET}     GraphQL Introspection (4)${YELLOW}TG-SUPPLY${RESET}  Supply Chain Health (6)`));
+      console.log(formatBoxLine(`${YELLOW}TG-BIZ${RESET}     Business Logic (4)       ${YELLOW}TG-CACHE${RESET}   Cache Poisoning (3)`));
+      console.log(formatBoxLine(`${YELLOW}TG-CLIENT${RESET}  Client Bundle Secrets (2)${YELLOW}TG-PLATFORM${RESET}Platform Hardening (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-DIFF${RESET}    Polyglot Bypass Guard (3)${YELLOW}TG-EDGE${RESET}    Edge & Serverless (2)`));
+      console.log(formatBoxLine(`${YELLOW}TG-CONT${RESET}    Container Hardening (4)  ${YELLOW}TG-GIT${RESET}     Git Secret Mining (3)`));
+      console.log(formatBoxLine(`${YELLOW}TG-REDOS${RESET}   ReDoS Complexity Guard (2)${YELLOW}TG-RAG${RESET}    RAG & Vector Scoping (3)`));
       console.log(cardBorderBottom());
 
       console.log(`\n  ${DIM}Quick Action:${RESET} In your AI chat, run ${CYAN}/torusguard-audit${RESET} to scan.\n`);
@@ -640,6 +643,9 @@ if (command === 'recipes') {
 if (command === 'init') {
   const { target, remaining } = parseTargetAndArgs(args);
   const targetDir = path.resolve(cwd, target);
+  if (!fs.existsSync(targetDir)) {
+    fs.mkdirSync(targetDir, { recursive: true });
+  }
   const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
   const localInstall = path.join(rootDir, 'install.py');
   const scriptToRun = fs.existsSync(localBootstrap) ? localBootstrap : localInstall;
@@ -655,13 +661,7 @@ if (command === 'init') {
 // Subcommand: update
 if (command === 'update') {
   const https = require('https');
-  const pkgJsonPath = path.join(rootDir, 'package.json');
-  let currentVersion = '1.4.0';
-  try {
-    if (fs.existsSync(pkgJsonPath)) {
-      currentVersion = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')).version || currentVersion;
-    }
-  } catch (e) {}
+  const currentVersion = PKG_VERSION;
 
   console.log();
   console.log(cardHeader('🛡️  TORUSGUARD UPDATE CHECK', 'Package Distribution & Registry Verifier', `v${currentVersion}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {
@@ -15,6 +15,7 @@
     "LICENSE"
   ],
   "scripts": {
+    "postinstall": "node -e \"console.log('\\n🛡️  TorusGuard v2.1.3 installed! Run: npx torusguard init\\n')\"",
     "test": "python harness/runner.py",
     "init": "node bin/torusguard.js init",
     "status": "node bin/torusguard.js status",

package/skills/torusguard/bootstrap.py

@@ -144,7 +144,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v2.1.2", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.3", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
@@ -164,7 +164,7 @@ def card_header(title: str, subtitle: str = "", version: str = "v2.1.2", border_
 def print_header():
     """Print the branded TorusGuard header card."""
     print()
-    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.2"))
+    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.3"))
     print()
 
 
@@ -172,13 +172,13 @@ def print_step_1_assets(file_count):
     """Print the enhanced Step 1 asset unpacking card."""
     print(card_border_top("Step 1/3 ─── Unpacking Governance Assets"))
     print(card_line(""))
-    print(card_line(f"{GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Canonical security rules            {DIM}88 rules across 22 families{RESET}"))
     print(card_line(f"{GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}"))
     print(card_line(f"{GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}"))
-    print(card_line(f"{GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}"))
-    print(card_line(f"{GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Governed workflow templates         {DIM}25 commands & 13 MCP tools{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Framework reference guides           {DIM}22 architectural guides{RESET}"))
     print(card_line(""))
-    print(card_line(f"{BOLD}{WHITE}{file_count} files unpacked{RESET}"))
+    print(card_line(f"{BOLD}{WHITE}{file_count} files unpacked into .torusguard/{RESET}"))
     print(card_border_bottom())
 
 
@@ -186,13 +186,18 @@ def print_step_2_profile(detected_stack=None):
     """Print the security profile & coverage card (in-process stack alignment)."""
     print(card_border_top("Step 2/3 ─── Security Profile & Coverage"))
     print(card_line(""))
-    print(card_line(f"{BOLD}Rule Families:{RESET}"))
-    print(card_line(f"  {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety"))
-    print(card_line(f"  {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication"))
-    print(card_line(f"  {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection"))
-    print(card_line(f"  {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless"))
-    print(card_line(f"  {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net"))
-    print(card_line(f"  {YELLOW}TG-BIZ{RESET}     Business Logic"))
+    print(card_line(f"{BOLD}Rule Families (88 Rules Across 22 Families):{RESET}"))
+    print(card_line(f"  {YELLOW}TG-SEC{RESET}     Secrets & Tokens         {YELLOW}TG-AUTH{RESET}    Authentication"))
+    print(card_line(f"  {YELLOW}TG-DB{RESET}      Database Isolation       {YELLOW}TG-INPUT{RESET}   Input Sanitization"))
+    print(card_line(f"  {YELLOW}TG-RATE{RESET}    Rate Limiting            {YELLOW}TG-AGENT{RESET}   AI Prompt Injection"))
+    print(card_line(f"  {YELLOW}TG-SSRF{RESET}    Server-Side Request      {YELLOW}TG-WEBHOOK{RESET} Webhook Signature"))
+    print(card_line(f"  {YELLOW}TG-WS{RESET}      WebSocket Safety         {YELLOW}TG-CSRF{RESET}    Cross-Site Request"))
+    print(card_line(f"  {YELLOW}TG-GQL{RESET}     GraphQL Introspection    {YELLOW}TG-SUPPLY{RESET}  Supply Chain Health"))
+    print(card_line(f"  {YELLOW}TG-BIZ{RESET}     Business Logic Limits    {YELLOW}TG-CACHE{RESET}   Cache Poisoning"))
+    print(card_line(f"  {YELLOW}TG-CLIENT{RESET}  Client Bundle Secrets    {YELLOW}TG-PLATFORM{RESET}Platform Hardening"))
+    print(card_line(f"  {YELLOW}TG-DIFF{RESET}    Polyglot Bypass Guard    {YELLOW}TG-EDGE{RESET}    Edge & Serverless"))
+    print(card_line(f"  {YELLOW}TG-CONT{RESET}    Container Hardening      {YELLOW}TG-GIT{RESET}     Git Secret Mining"))
+    print(card_line(f"  {YELLOW}TG-REDOS{RESET}   ReDoS Complexity Guard   {YELLOW}TG-RAG{RESET}     RAG & Vector Scoping"))
     print(card_line(""))
     print(card_line(f"{BOLD}Supported Stacks:{RESET}"))
     print(card_line(f"  {GREEN}Python{RESET}    Django · FastAPI · Flask · DRF · SQLAlchemy"))
@@ -227,7 +232,7 @@ def print_success_card():
     print(card_line("", border="║", border_color=GREEN))
     print(card_line(f"{BOLD}Next Steps:{RESET}", border="║", border_color=GREEN))
     print(card_line("", border="║", border_color=GREEN))
-    print(card_line(f" {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}", border="║", border_color=GREEN))
+    print(card_line(f" {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard audit{RESET}  or  {WHITE}/torusguard status{RESET}", border="║", border_color=GREEN))
     print(card_line(f" {CYAN}2.{RESET} In Terminal     {WHITE}npx torusguard status{RESET}", border="║", border_color=GREEN))
     print(card_line(f" {CYAN}3.{RESET} In CI/CD        {WHITE}npx torusguard audit{RESET}", border="║", border_color=GREEN))
     print(card_line("", border="║", border_color=GREEN))
@@ -238,16 +243,21 @@ def print_success_card():
 
 
 def print_already_initialized(target_root, cfg):
-    """Print the already-initialized status card."""
+    """Print the already-initialized status card with dynamic width alignment."""
     print()
     top = f"  {CYAN}╭{'─' * 71}╮{RESET}"
     bottom = f"  {CYAN}╰{'─' * 71}╯{RESET}"
-    title_line = card_line(f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}{' ' * 28}{GREEN}[Active]{RESET}")
+    title_text = f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}"
+    status_text = f"{GREEN}[Active]{RESET}"
+    title_vis = get_visual_width("🛡️  TORUSGUARD WORKSPACE")
+    status_vis = get_visual_width("[Active]")
+    pad_count = max(1, 67 - title_vis - status_vis)
+    title_line = card_line(f"{title_text}{' ' * pad_count}{status_text}")
     print(f"{top}\n{title_line}\n{bottom}")
     print(f"""
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.1')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.3')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -454,53 +464,10 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
 3. Follow the phase execution steps defined in the workflow.
 """
 
-    # Ensure .agents/workflows, .agents/skills, .agent/workflows, and .agent/skills are created
-    dest_workflow_dirs = []
-
-    # 1. Antigravity / Gemini (.agents/)
-    agents_wf = target_root / ".agents" / "workflows"
-    agents_wf.mkdir(parents=True, exist_ok=True)
-    (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-    dest_workflow_dirs.append(agents_wf)
-    registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
-
-    # 2. Tribunal Agent Kit (.agent/)
-    agent_wf = target_root / ".agent" / "workflows"
-    agent_wf.mkdir(parents=True, exist_ok=True)
-    (agent_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-    dest_workflow_dirs.append(agent_wf)
-    registered_ides.append("Tribunal Agent Kit       .agent/workflows/torusguard.md")
-
-    # Unpack Skills into .agents/skills and .agent/skills for full IDE resolution
-    src_skills = torusguard_target / "skills"
-    if src_skills.is_dir():
-        for dest_base in [target_root / ".agents" / "skills", target_root / ".agent" / "skills"]:
-            dest_base.mkdir(parents=True, exist_ok=True)
-            for skill_dir in src_skills.iterdir():
-                if skill_dir.is_dir():
-                    target_skill_dir = dest_base / skill_dir.name
-                    if not target_skill_dir.exists():
-                        try:
-                            shutil.copytree(skill_dir, target_skill_dir)
-                        except Exception:
-                            pass
-
-    # When full_commands is requested (e.g. via NPM package npx torusguard init),
-    # unlock and register all individual slash commands
-    if full_commands:
-        src_wf = torusguard_target / "workflows"
-        if src_wf.is_dir():
-            count = 0
-            for wf_file in src_wf.glob("*.md"):
-                if wf_file.name == "torusguard.md":
-                    continue
-                cmd_filename = f"torusguard-{wf_file.name}"
-                for d in dest_workflow_dirs:
-                    shutil.copy2(wf_file, d / cmd_filename)
-                count += 1
-            registered_ides.append(f"{count} Slash Commands          /torusguard-audit, -harden, -apply, ...")
-
-    # Claude Code (.claude/commands)
+    # Core workspace governance is self-contained in .torusguard/
+    registered_ides.append("Workspace Core           .torusguard/ (Workflows & Skills)")
+
+    # Claude Code (.claude/commands) - only if .claude exists
     claude_dir = target_root / ".claude"
     if claude_dir.exists():
         claude_commands = claude_dir / "commands"
@@ -508,7 +475,7 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         (claude_commands / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
         registered_ides.append("Claude Code              .claude/commands/torusguard.md")
 
-    # Cursor (.cursor/rules)
+    # Cursor (.cursor/rules) - only if .cursor exists
     cursor_dir = target_root / ".cursor"
     if cursor_dir.exists():
         cursor_rules = cursor_dir / "rules"

package/skills/torusguard/payload/.manifest.json

@@ -9,7 +9,7 @@
   "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "305c1dc5b556e8d64ad9dd585dafac1a9955cf1bd5321429955b19b7a62736b6",
-  "config/torusguard.json": "55dbde335997421a01c97709fd1672ad70fa921bfe8346dd57552b799db2419e",
+  "config/torusguard.json": "e8e41f3be04a06deb32ce5faaa93ddd608abfb2694b30325cac5085f3bfec9d8",
   "core/__init__.py": "2120562452ae03c84468d67246dc93376f7ebcde8e4ca767c6253bc92c35dbbf",
   "core/agent_roles.py": "d7189dbf1d3ae4e330eb316bed5d399a18992295addf466f4c6552bc14ae6a34",
   "core/ast_walker.py": "309564d168e6eb9e3e93aceb29a95a61872b35a4da7235ee49e79e9d3a5e7cc6",
@@ -215,11 +215,11 @@
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "86700765212adb3ab590ca72614bf3ad4ce7ce60e3193f7f3bd1a04d34d10f6e",
   "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
-  "scripts/status_runner.py": "4c358c91950c7874bcc6a5f23f2d3fda62b0752efcf6c6b658adf02ed77c7752",
-  "scripts/stride_generator.py": "4660713fa65e24119b88b6a050fb41f625d99bad030f1db40d198950d8c55ba8",
-  "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
+  "scripts/status_runner.py": "a7421e25e2e34c1b83960ad117f5ea23d6f08b8af8b664be3fe03f70a3962db3",
+  "scripts/stride_generator.py": "6db98e8d9272c3c69f7c9be71cc4d9db6fe48553a3d7850ca62399ce4471ece8",
+  "scripts/term_ui.py": "a23435c703c4e8b68c5b80a539d59de2eda1cb01b0d9c47909ba72efde3be29b",
   "skills/torusguard/SKILL.md": "15c69cb10eca1a10344b494888dce57e2baf227c3282bd54424a36ce35fb2460",
-  "skills/torusguard/bootstrap.py": "b75ad49e9dade87980cde3269ee1f5c3438f944a34a545c44f839d4496086b63",
+  "skills/torusguard/bootstrap.py": "178145eb36d15974ec9833d5c434dd31bba955d40a04cc9c12aed04058d1936a",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
   "skills/torusguard/references/cache-and-sensitive-responses.md": "81b4a7a08e11dafa4ec58d868c4a35f1f891d0dcdcfbcefaef81e1b9ba94f5a1",
@@ -262,9 +262,9 @@
   "skills/torusguard-recheck/SKILL.md": "a5c4539ec6d091179c8ba53792fba46f26795976f392d2305e357f25a2966c55",
   "skills/torusguard-redos/SKILL.md": "b09b39bd98589613b2107c177e247f6224fb54ab2f028b4339ae01aac9d28c67",
   "skills/torusguard-report/SKILL.md": "509185ea6730601cf9a44e136219cace61cd0523f8e112de03e4ef1c35e60585",
-  "skills/torusguard-review/SKILL.md": "6d9ec907821ddf62bbbeaed8751d1532e72ba42702ea3afdaadaf720f66c35e3",
+  "skills/torusguard-review/SKILL.md": "0c540a587befee455f027d752e261ed5885ec21def2c52471bd29bec69178307",
   "skills/torusguard-status/SKILL.md": "e9741a20313a8304bc7565b194949a59ec7cfd4945b197517680164b3197efc0",
-  "skills/torusguard-threatmodel/SKILL.md": "549903f39a030a75d88c184b7373d86bca921d8f802732c3674bfe9537b14537",
+  "skills/torusguard-threatmodel/SKILL.md": "3f589ea931998475536e25c77f85ddc17447012f860b4cee8d75e7b0f219ce82",
   "skills/torusguard-verify/SKILL.md": "aeb4d3c7924253607d130e48491d83bf7b7a21707cd1dac2ba97d64f5e259fd6",
   "skills/torusguard-web-validate/SKILL.md": "f1df00e10abd823d9a8c4daa1a3af7f26c5263c6c8e58e05b61b647d01a25489",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",

package/skills/torusguard/payload/config/torusguard.json

@@ -1,6 +1,6 @@
 {
   "$schema": "../schemas/torusguard-config.schema.json",
-  "version": "1.0.0",
+  "version": "2.1.3",
   "product": "TorusGuard Security Skill Kit",
   "severity_threshold": "medium",
   "auto_detect_stack": true,

package/skills/torusguard/payload/scripts/status_runner.py

@@ -58,7 +58,7 @@ def collect_status(target_dir: Path) -> WorkspaceStatus:
     is_init = tg_dir.is_dir()
 
     # 1. Read config
-    version = "1.4.0"
+    version = "2.1.3"
     stack_name = "Undetected"
     cfg_file = tg_dir / "config" / "torusguard.json"
     if cfg_file.is_file():
@@ -94,7 +94,7 @@ def collect_status(target_dir: Path) -> WorkspaceStatus:
         if rules_root.is_dir():
             active_rules_count = sum(1 for f in rules_root.rglob("TG-*.md"))
     if active_rules_count == 0:
-        active_rules_count = 74  # Canonical rule catalog default
+        active_rules_count = 88  # Canonical rule catalog default
 
     # 3. Read run history
     total_runs = 0
@@ -210,7 +210,7 @@ def print_status_card(status: WorkspaceStatus) -> None:
     print(format_box_line(f"Workspace:    {WHITE}{status.target_path}{RESET}", 67))
     print(format_box_line(f"Status:       {init_str}", 67))
     print(format_box_line(f"Stack:        {BOLD}{WHITE}{status.stack_detected}{RESET}", 67))
-    print(format_box_line(f"Active Rules: {GREEN}{status.active_rules_count}{RESET} canonical rules enabled across 18 families", 67))
+    print(format_box_line(f"Active Rules: {GREEN}{status.active_rules_count}{RESET} canonical rules enabled across 22 families", 67))
     print(card_border_bottom(CYAN))
     print()
 

package/skills/torusguard/payload/scripts/stride_generator.py

@@ -142,7 +142,7 @@ def generate_stride_report(root_dir: Path) -> str:
 
     report = f"""# TorusGuard Architectural Threat Model & STRIDE Register
 
-**Generated by:** TorusGuard Threat Modeling Engine (v2.1.2)  
+**Generated by:** TorusGuard Threat Modeling Engine (v2.1.3)  
 **Workspace:** `{root_dir.resolve().as_posix()}`  
 **Analyzed Routes:** {comp['total_routes_detected']}  
 **Identified Data Stores:** {', '.join(comp['datastores'])}  

package/skills/torusguard/payload/scripts/term_ui.py

@@ -143,7 +143,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.3", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"

package/skills/torusguard/payload/skills/torusguard/bootstrap.py

@@ -144,7 +144,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v2.1.2", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.3", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
@@ -164,7 +164,7 @@ def card_header(title: str, subtitle: str = "", version: str = "v2.1.2", border_
 def print_header():
     """Print the branded TorusGuard header card."""
     print()
-    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.2"))
+    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.3"))
     print()
 
 
@@ -172,13 +172,13 @@ def print_step_1_assets(file_count):
     """Print the enhanced Step 1 asset unpacking card."""
     print(card_border_top("Step 1/3 ─── Unpacking Governance Assets"))
     print(card_line(""))
-    print(card_line(f"{GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Canonical security rules            {DIM}88 rules across 22 families{RESET}"))
     print(card_line(f"{GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}"))
     print(card_line(f"{GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}"))
-    print(card_line(f"{GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}"))
-    print(card_line(f"{GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Governed workflow templates         {DIM}25 commands & 13 MCP tools{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Framework reference guides           {DIM}22 architectural guides{RESET}"))
     print(card_line(""))
-    print(card_line(f"{BOLD}{WHITE}{file_count} files unpacked{RESET}"))
+    print(card_line(f"{BOLD}{WHITE}{file_count} files unpacked into .torusguard/{RESET}"))
     print(card_border_bottom())
 
 
@@ -186,13 +186,18 @@ def print_step_2_profile(detected_stack=None):
     """Print the security profile & coverage card (in-process stack alignment)."""
     print(card_border_top("Step 2/3 ─── Security Profile & Coverage"))
     print(card_line(""))
-    print(card_line(f"{BOLD}Rule Families:{RESET}"))
-    print(card_line(f"  {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety"))
-    print(card_line(f"  {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication"))
-    print(card_line(f"  {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection"))
-    print(card_line(f"  {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless"))
-    print(card_line(f"  {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net"))
-    print(card_line(f"  {YELLOW}TG-BIZ{RESET}     Business Logic"))
+    print(card_line(f"{BOLD}Rule Families (88 Rules Across 22 Families):{RESET}"))
+    print(card_line(f"  {YELLOW}TG-SEC{RESET}     Secrets & Tokens         {YELLOW}TG-AUTH{RESET}    Authentication"))
+    print(card_line(f"  {YELLOW}TG-DB{RESET}      Database Isolation       {YELLOW}TG-INPUT{RESET}   Input Sanitization"))
+    print(card_line(f"  {YELLOW}TG-RATE{RESET}    Rate Limiting            {YELLOW}TG-AGENT{RESET}   AI Prompt Injection"))
+    print(card_line(f"  {YELLOW}TG-SSRF{RESET}    Server-Side Request      {YELLOW}TG-WEBHOOK{RESET} Webhook Signature"))
+    print(card_line(f"  {YELLOW}TG-WS{RESET}      WebSocket Safety         {YELLOW}TG-CSRF{RESET}    Cross-Site Request"))
+    print(card_line(f"  {YELLOW}TG-GQL{RESET}     GraphQL Introspection    {YELLOW}TG-SUPPLY{RESET}  Supply Chain Health"))
+    print(card_line(f"  {YELLOW}TG-BIZ{RESET}     Business Logic Limits    {YELLOW}TG-CACHE{RESET}   Cache Poisoning"))
+    print(card_line(f"  {YELLOW}TG-CLIENT{RESET}  Client Bundle Secrets    {YELLOW}TG-PLATFORM{RESET}Platform Hardening"))
+    print(card_line(f"  {YELLOW}TG-DIFF{RESET}    Polyglot Bypass Guard    {YELLOW}TG-EDGE{RESET}    Edge & Serverless"))
+    print(card_line(f"  {YELLOW}TG-CONT{RESET}    Container Hardening      {YELLOW}TG-GIT{RESET}     Git Secret Mining"))
+    print(card_line(f"  {YELLOW}TG-REDOS{RESET}   ReDoS Complexity Guard   {YELLOW}TG-RAG{RESET}     RAG & Vector Scoping"))
     print(card_line(""))
     print(card_line(f"{BOLD}Supported Stacks:{RESET}"))
     print(card_line(f"  {GREEN}Python{RESET}    Django · FastAPI · Flask · DRF · SQLAlchemy"))
@@ -227,7 +232,7 @@ def print_success_card():
     print(card_line("", border="║", border_color=GREEN))
     print(card_line(f"{BOLD}Next Steps:{RESET}", border="║", border_color=GREEN))
     print(card_line("", border="║", border_color=GREEN))
-    print(card_line(f" {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}", border="║", border_color=GREEN))
+    print(card_line(f" {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard audit{RESET}  or  {WHITE}/torusguard status{RESET}", border="║", border_color=GREEN))
     print(card_line(f" {CYAN}2.{RESET} In Terminal     {WHITE}npx torusguard status{RESET}", border="║", border_color=GREEN))
     print(card_line(f" {CYAN}3.{RESET} In CI/CD        {WHITE}npx torusguard audit{RESET}", border="║", border_color=GREEN))
     print(card_line("", border="║", border_color=GREEN))
@@ -238,16 +243,21 @@ def print_success_card():
 
 
 def print_already_initialized(target_root, cfg):
-    """Print the already-initialized status card."""
+    """Print the already-initialized status card with dynamic width alignment."""
     print()
     top = f"  {CYAN}╭{'─' * 71}╮{RESET}"
     bottom = f"  {CYAN}╰{'─' * 71}╯{RESET}"
-    title_line = card_line(f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}{' ' * 28}{GREEN}[Active]{RESET}")
+    title_text = f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}"
+    status_text = f"{GREEN}[Active]{RESET}"
+    title_vis = get_visual_width("🛡️  TORUSGUARD WORKSPACE")
+    status_vis = get_visual_width("[Active]")
+    pad_count = max(1, 67 - title_vis - status_vis)
+    title_line = card_line(f"{title_text}{' ' * pad_count}{status_text}")
     print(f"{top}\n{title_line}\n{bottom}")
     print(f"""
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.1')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.3')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -454,53 +464,10 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
 3. Follow the phase execution steps defined in the workflow.
 """
 
-    # Ensure .agents/workflows, .agents/skills, .agent/workflows, and .agent/skills are created
-    dest_workflow_dirs = []
-
-    # 1. Antigravity / Gemini (.agents/)
-    agents_wf = target_root / ".agents" / "workflows"
-    agents_wf.mkdir(parents=True, exist_ok=True)
-    (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-    dest_workflow_dirs.append(agents_wf)
-    registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
-
-    # 2. Tribunal Agent Kit (.agent/)
-    agent_wf = target_root / ".agent" / "workflows"
-    agent_wf.mkdir(parents=True, exist_ok=True)
-    (agent_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-    dest_workflow_dirs.append(agent_wf)
-    registered_ides.append("Tribunal Agent Kit       .agent/workflows/torusguard.md")
-
-    # Unpack Skills into .agents/skills and .agent/skills for full IDE resolution
-    src_skills = torusguard_target / "skills"
-    if src_skills.is_dir():
-        for dest_base in [target_root / ".agents" / "skills", target_root / ".agent" / "skills"]:
-            dest_base.mkdir(parents=True, exist_ok=True)
-            for skill_dir in src_skills.iterdir():
-                if skill_dir.is_dir():
-                    target_skill_dir = dest_base / skill_dir.name
-                    if not target_skill_dir.exists():
-                        try:
-                            shutil.copytree(skill_dir, target_skill_dir)
-                        except Exception:
-                            pass
-
-    # When full_commands is requested (e.g. via NPM package npx torusguard init),
-    # unlock and register all individual slash commands
-    if full_commands:
-        src_wf = torusguard_target / "workflows"
-        if src_wf.is_dir():
-            count = 0
-            for wf_file in src_wf.glob("*.md"):
-                if wf_file.name == "torusguard.md":
-                    continue
-                cmd_filename = f"torusguard-{wf_file.name}"
-                for d in dest_workflow_dirs:
-                    shutil.copy2(wf_file, d / cmd_filename)
-                count += 1
-            registered_ides.append(f"{count} Slash Commands          /torusguard-audit, -harden, -apply, ...")
-
-    # Claude Code (.claude/commands)
+    # Core workspace governance is self-contained in .torusguard/
+    registered_ides.append("Workspace Core           .torusguard/ (Workflows & Skills)")
+
+    # Claude Code (.claude/commands) - only if .claude exists
     claude_dir = target_root / ".claude"
     if claude_dir.exists():
         claude_commands = claude_dir / "commands"
@@ -508,7 +475,7 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         (claude_commands / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
         registered_ides.append("Claude Code              .claude/commands/torusguard.md")
 
-    # Cursor (.cursor/rules)
+    # Cursor (.cursor/rules) - only if .cursor exists
     cursor_dir = target_root / ".cursor"
     if cursor_dir.exists():
         cursor_rules = cursor_dir / "rules"

package/skills/torusguard/payload/skills/torusguard-review/SKILL.md

@@ -2,8 +2,8 @@
 name: torusguard-review
 description: Differential PR and Git diff incremental security review — detects newly introduced vulnerabilities between Git branches or commits with net security score deltas.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 2.1.2
-last-updated: 2026-09-30
+version: 2.1.3
+last-updated: 2026-10-01
 skills:
   - torusguard
   - torusguard-audit

package/skills/torusguard/payload/skills/torusguard-threatmodel/SKILL.md

@@ -2,8 +2,8 @@
 name: torusguard-threatmodel
 description: Synthesizes an architectural STRIDE threat model, interactive Mermaid Data Flow Diagram (DFD), and trust boundary register into SECURITY_THREAT_MODEL.md.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 2.1.2
-last-updated: 2026-09-30
+version: 2.1.3
+last-updated: 2026-10-01
 skills:
   - torusguard
   - torusguard-audit

package/skills/torusguard-review/SKILL.md

@@ -2,8 +2,8 @@
 name: torusguard-review
 description: Differential PR and Git diff incremental security review — detects newly introduced vulnerabilities between Git branches or commits with net security score deltas.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 2.1.2
-last-updated: 2026-09-30
+version: 2.1.3
+last-updated: 2026-10-01
 skills:
   - torusguard
   - torusguard-audit

package/skills/torusguard-threatmodel/SKILL.md

@@ -2,8 +2,8 @@
 name: torusguard-threatmodel
 description: Synthesizes an architectural STRIDE threat model, interactive Mermaid Data Flow Diagram (DFD), and trust boundary register into SECURITY_THREAT_MODEL.md.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 2.1.2
-last-updated: 2026-09-30
+version: 2.1.3
+last-updated: 2026-10-01
 skills:
   - torusguard
   - torusguard-audit