TorusGuard v2.1.2: Long-Loop Autonomous Security Expansion

TorusGuard v2.1.2: Long-Loop Autonomous Security Expansion

Release Version: v2.1.2
Date: September 30, 2026
License: MIT
Distribution: Pure Go Binary (torusguard), NPM Wrapper (@torusguard), Native MCP Server (stdio JSON-RPC 2.0)

---

Executive Summary

TorusGuard v2.1.2 completes a major architectural expansion inspired by gold-standard engineering ecosystems:

• From codecrafters-io/build-your-own-x: The Declarative Security Query Language (TG-QL), in-process Git packfile forensics, and Thompson NFA ReDoS state simulation.
• From sindresorhus/awesome (AppSec & Threat Modeling): AST call-graph Dependency Reachability Analysis (OpenVEX) and automated STRIDE Threat Modeling + Mermaid DFD Generation.
• From alibaba/open-code-review: Autonomous Tri-Perspective Multi-Agent Deliberation Tournament (Hunter vs. Verifier vs. Remediator) and Differential PR / Git Diff Scanning (torusguard review).

---

What's New in v2.1.2

1. Declarative AST Security Query Language (TG-QL)

Define custom, polyglot security rules dynamically via simple YAML or JSON files in .torusguard/custom_rules/. Rules are automatically compiled and merged into the scanner on every audit, review, and MCP call without recompiling Go code.

2. Differential PR & Git Diff Review Mode (torusguard review)

Rapid incremental scanning on Git pull requests or commits (e.g. against HEAD~1 or origin/main). Analyzes only modified lines in under 300ms, tracks net posture score deltas, and blocks CI gates if new Critical or High severity flaws are introduced.

3. Automated STRIDE Threat Modeling (torusguard threatmodel)

Discovers entrypoints, trust boundaries, datastores, and egress sinks across polyglot source code. Emits SECURITY_THREAT_MODEL.md featuring interactive Mermaid Data Flow Diagrams (DFDs) and a formal STRIDE risk register.

4. Dependency Reachability & OpenVEX Analysis (reachability_analyzer.py)

Eliminates up to 80% of third-party CVE alert fatigue by tracing AST call paths from application entrypoints to imported package functions, separating actively reachable threats from harmless dead code.

5. Tri-Perspective Multi-Agent Deliberation Tournament (deliberation_tournament.py)

Consensus debate between Security Hunter, Devil's Advocate (defense & sanitizer verifier), and Ponytail Remediator, filtering out false positives before reaching the developer.

6. SecurityReviewBench Precision & Recall Harness (torusguard benchmark)

Autonomous self-evaluation suite verifying 100% precision and recall on synthetic polyglot ground truth test pairs.

---

Tri-Mode Parity Matrix

Feature	Mode A: CLI	Mode B: AI Chat Slash Command	Mode C: Native MCP Tool
PR Diff Review	torusguard review [--diff <ref>]	/torusguard review	torusguard_review
STRIDE Threat Model	torusguard threatmodel	/torusguard threatmodel	torusguard_threatmodel
Security Benchmark	torusguard benchmark	/torusguard benchmark	torusguard_benchmark
TG-QL Custom Rules	Automatic on scan	Automatic on scan	Automatic on scan
Vision OCR Scan	torusguard ocr-scan	/torusguard ocr-scan	torusguard_ocr_scan