Skip to content

v0.6.0: Governed Remediation & Targeted Recheck System

Choose a tag to compare

View all tags
@githubmofo githubmofo released this 01 Sep 06:17
· 36 commits to main since this release
v0.6.0
59cb74e

Release Notes: TorusGuard v0.6.0 — Governed Remediation & Targeted Recheck System

Release Tag: v0.6.0
Release Date: August 31, 2026
Status: Stable Release (v6 Branch)

🌟 Executive Summary

TorusGuard v0.6.0 evolves TorusGuard from a static detection and auditing tool into a governed security remediation and targeted recheck system.

While traditional security scanners generate fragmented lists of individual line-level alerts, TorusGuard v0.6.0 introduces:

  1. Isolated Run Folders (runs/<run-id>/): Every execution generates a single, fully-contained run folder housing all manifests, structured reports, evidence maps, diff summaries, and logs.
  2. Stable Finding Identity & Invariance: Deterministic finding fingerprints computed across Rule ID, normalized file path, code region hash, and sink signatures that survive minor code edits and line shifts.
  3. Root-Cause Clustering: Automatic grouping of related findings into shared root causes (e.g. Missing Tenant Query Scoping, Unsafe Path Traversal Storage, Disabled Template Autoescaping).
  4. Structured Remediation Bundles: Self-contained remediation packages (finding.md, remediation.md, minimal_patch_plan.md, verify-after-change.md, metadata.json).
  5. Minimal Patch Governance: Strict policy enforcement over automated code modifications (bounding line churn, file counts, and escalating sensitive contexts such as auth, crypto, and database queries).
  6. Targeted Scoped Rechecks: Scoped differential verification focusing strictly on modified files and adjacent trust boundaries with explicit status transitions (Confirmed Fixed, Partially Fixed, Needs Manual Review, Regressed, Not Reproducible).
  7. SARIF v2.1.0 JSON Export: Optional standard SARIF export for seamless integration with GitHub Advanced Security, CI/CD pipelines, and enterprise SIEMs.

🚀 Key Features in v0.6.0

1. Dedicated Run Folder Organization

Every TorusGuard command (audit, harden, apply, recheck) writes its state and outputs to an isolated run folder under .torusguard/runs/<run-id>/:

  • manifest.json: Execution metadata, git commit hash, and status counts.
  • summary.md: Executive summary and root-cause cluster breakdown.
  • findings.md: Detailed finding cards with stable IDs and evidence snippets.
  • remediation.md: Structured remediation guidance per cluster.
  • apply-plan.md: Patch policy decisions, line additions/deletions, and escalation status.
  • recheck.md: Targeted recheck outcome and regression analysis.
  • evidence.json: Full evidence ledger with SHA-256 integrity hashes.
  • diff-summary.md: Unified git diff ledger of all applied changes.
  • changed-files.txt: Line-separated list of modified files.
  • sarif.json: Standard SARIF v2.1.0 JSON structured export.
  • logs/: Subdirectory for runtime and execution logs.

2. Line-Shift Invariant Finding Fingerprints

Findings no longer drift or duplicate when minor code changes occur. Finding identities are derived deterministically:

FindingFingerprint = SHA256(RuleID | NormalizedPath | RegionHash | SinkSignature | FrameworkMarker)

3. Systemic Root-Cause Clusters

Findings are automatically grouped into cohesive root causes:

  • cluster-tenant-isolation: Multi-tenant scoping & ORM isolation.
  • cluster-path-traversal: Upload directories and filename sanitization.
  • cluster-template-escaping: HTML autoescaping and XSS mitigation.
  • cluster-header-trust: Insecure client header reliance and role spoofing.
  • cluster-idor-scoping: Direct object reference ownership checks.
  • cluster-rate-limiting: Endpoint throttling and resource bounding.
  • cluster-ssrf-network: Outbound HTTP request destinations.
  • cluster-webhook-auth: Webhook HMAC signatures and replay attacks.
  • cluster-secrets: Hardcoded credentials and environment hygiene.

4. Minimal Patch Governance (Ponytail Engine)

Automated code modifications are governed by strict safety constraints:

  • Max additions/deletions threshold: Rejects massive diffs or complete file rewrites.
  • Single-file preference: Focuses patches on the exact target component.
  • High-Risk Escalation: Flag changes touching auth, authorization, tenant isolation, secrets, crypto, uploads, DB access, or workflow files as HIGH_RISK_ESCALATED requiring human review if churn is non-trivial.
  • Zero Commentary Bloat: Strips AI boilerplate and unnecessary comments.

5. Targeted Rechecks & Trust Boundary Verification

/torusguard recheck evaluates only modified files and adjacent trust boundaries:

  • Confirmed Fixed: Vulnerability resolved with zero detected regressions.
  • Partially Fixed: Fix partially in place, but residual risk remains.
  • Needs Manual Review: Fix requires out-of-band infrastructure verification.
  • Regressed: Patch introduced a secondary security vulnerability.
  • Not Reproducible: Target code unchanged; fix not detected in active buffer.

🛠️ Verification & Test Suite

All 75 automated test cases across schemas, models, rules, and v6 subsystems pass cleanly:

python tests/test_v6_governed_remediation.py
python harness/runner.py
Assets 2
Loading