Skip to content

v0.6.3: Final Drift, Upload and Sensitive-Path Hardening

Choose a tag to compare

View all tags
@githubmofo githubmofo released this 01 Sep 06:17
· 32 commits to main since this release
v0.6.3
081d071

Release Notes: TorusGuard v0.6.3 — Final Drift, Upload & Sensitive-Path Hardening

Release Tag: v0.6.3
Release Date: August 31, 2026
Status: Stable Release (v6 Branch) — Final Hardening of the v0.6.x Product Cycle

🌟 Executive Summary

TorusGuard v0.6.3 is the final hardening milestone of the v0.6.x release series before transitioning into v7 planning.

This release proves long-term reliability and stability when:

  1. Findings are re-audited across multiple git commits with line shifts and comment edits (Zero Identity Drift).
  2. SARIF reports are uploaded to GitHub Code Scanning (partialFingerprints / primaryLocationLineHash for alert deduplication).
  3. Sensitive code paths (Authentication, Tenancy, Secrets, Crypto, Storage, CI/CD) are modified (Strict Review Escalation).
  4. Modern async and dependency injection patterns are analyzed (Zero False Positives on safe code).
  5. Cross-artifact data consistency is audited across all generated reports.

🚀 Key Deliverables in v0.6.3

1. 🧬 Cross-Run Drift Invariance

  • Stable finding fingerprints (TG-FND-<hash12>) remain 100% identical when lines shift or when non-semantic whitespace and inline comments are modified.
  • Root-cause cluster groupings and recheck states remain stable across reruns without status jitter.

2. 🐙 GitHub Code Scanning SARIF Deduplication

  • Generated SARIF v2.1.0 logs incorporate partialFingerprints with 16-character primaryLocationLineHash and torusguard/v6/identity keys.
  • Enables GitHub to track security alerts seamlessly across branch switches, pull requests, and code refactorings without creating duplicate alert noise.

3. 🛡️ Sensitive-Path Governance & Escalation Matrix

  • Enforces strict review levels on critical directories:
    • Authentication & JWT: auth, login, password, jwt, token, session
    • Multi-Tenancy: tenant, tenant_id, organization_id
    • Secrets & Cryptography: secret, api_key, crypto, hmac
    • File Storage: upload, storage, filepath
    • CI/CD Pipelines: .github/workflows/, Dockerfile, compose.yaml
  • Any non-trivial diff ($&gt; 10$ line churn or multi-file changes) in these paths automatically receives Mandatory Security Sign-Off and blocks automatic patching.

4. 🎯 Modern-Stack Negative Tests (Zero False Positives)

  • Verified that safe modern patterns produce zero false positive alerts:
    • Safe Django 5.x aget_object_or_404 with tenant filtering.
    • Safe FastAPI Annotated[User, Depends(get_verified_user)].
    • Safe SQLAlchemy 2.0 select().where(Model.tenant_id == tenant_id).
    • Safe Next.js 14 Server Action with const session = await auth().
    • Safe File Upload Storage with secure_filename() + directory traversal check.

🧪 Validation Sign-Off

The dedicated hardening harness harness/validate_v6_3_hardening.py validates 24/24 assertions.

Phase Subsystem Under Verification Passed / Total Status Highlights
Phase 1 Cross-Run Drift & Identity Stability 4/4 ✅ PASS Fingerprint invariant across 3 simulated commits with line shifts.
Phase 2 GitHub Code Scanning SARIF Upload 5/5 ✅ PASS partialFingerprints (primaryLocationLineHash) verified for alert deduplication.
Phase 3 Sensitive-Path Governance & Escalation 4/4 ✅ PASS Strict escalation (Mandatory Security Sign-Off) enforced on Auth & Tenancy.
Phase 4 Modern-Stack Negative Tests 5/5 ✅ PASS Zero false positives on safe Django async, FastAPI Annotated, SQLAlchemy 2.0, & Next.js.
Phase 5 Cross-Artifact Report Audit 4/4 ✅ PASS 100% data consistency verified across Manifest, Summary, SARIF, Recheck, & Bundles.

Read the full sign-off in QA-SUMMARY-v6.3.md.

Assets 2
Loading