thumbgate 1.26.7 → 1.27.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.26.7",
+  "version": "1.27.2",
   "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 36 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -12,7 +12,8 @@
   },
   "main": "src/index.js",
   "bin": {
-    "thumbgate": "bin/cli.js"
+    "thumbgate": "bin/cli.js",
+    "thumbgate-dashboard": "bin/dashboard-cli.js"
   },
   "files": [
     "scripts/access-anomaly-detector.js",
@@ -23,10 +24,12 @@
     "scripts/agent-memory-lifecycle.js",
     "scripts/agent-readiness-plan.js",
     "scripts/agent-readiness.js",
+    "scripts/agent-operations-planner.js",
     "scripts/agent-reasoning-traces.js",
     "scripts/agent-reward-model.js",
     "scripts/agent-stack-survival-audit.js",
     "scripts/agentic-data-pipeline.js",
+    "scripts/ai-component-inventory.js",
     "scripts/ai-engineering-stack-guardrails.js",
     "scripts/ai-search-distribution.js",
     "scripts/analytics-window.js",
@@ -43,6 +46,7 @@
     "scripts/bot-detection.js",
     "scripts/bot-detector.js",
     "scripts/build-metadata.js",
+    "scripts/classifier-routing.js",
     "scripts/chatgpt-ads-readiness-pack.js",
     "scripts/claude-feedback-sync.js",
     "scripts/cli-demo.js",
@@ -84,6 +88,7 @@
     "scripts/feedback-loop.js",
     "scripts/feedback-paths.js",
     "scripts/feedback-quality.js",
+    "scripts/feedback-sanitizer.js",
     "scripts/feedback-schema.js",
     "scripts/feedback-session.js",
     "scripts/feedback-to-rules.js",
@@ -139,8 +144,10 @@
     "scripts/operational-integrity.js",
     "scripts/oss-pr-opportunity-scout.js",
     "scripts/otel-declarative-config.js",
+    "scripts/parallel-workflow-orchestrator.js",
     "scripts/perplexity-client.js",
     "scripts/plan-gate.js",
+    "scripts/plausible-domain-config.js",
     "scripts/plausible-server-events.js",
     "scripts/pr-manager.js",
     "scripts/private-core-boundary.js",
@@ -155,6 +162,7 @@
     "scripts/prompting-operating-system.js",
     "scripts/provider-action-normalizer.js",
     "scripts/proxy-pointer-rag-guardrails.js",
+    "scripts/qa-scenario-planner.js",
     "scripts/published-cli.js",
     "scripts/rag-precision-guardrails.js",
     "scripts/rate-limiter.js",
@@ -166,6 +174,7 @@
     "scripts/rubric-engine.js",
     "scripts/rule-validator.js",
     "scripts/secret-scanner.js",
+    "scripts/secret-fixture-tokens.js",
     "scripts/security-scanner.js",
     "scripts/self-distill-agent.js",
     "scripts/self-heal.js",
@@ -222,12 +231,14 @@
     "adapters/codex/config.toml",
     "adapters/forge/forge.yaml",
     "adapters/gemini/function-declarations.json",
+    "adapters/gcp/dfcx-webhook-gate.js",
     "adapters/mcp/server-stdio.js",
     "adapters/opencode/opencode.json",
     "bench/programbench-smoke.json",
     "bench/prompt-eval-suite.json",
     "bench/thumbgate-bench.json",
     "bin/cli.js",
+    "bin/dashboard-cli.js",
     "bin/postinstall.js",
     "config/",
     "openapi/",
@@ -236,6 +247,7 @@
     "public/codex-enterprise.html",
     "public/agents-cost-savings.html",
     "public/ai-malpractice-prevention.html",
+    "public/chatgpt-app.html",
     "public/codex-plugin.html",
     "public/compare.html",
     "public/dashboard.html",
@@ -347,10 +359,10 @@
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
     "test:python": "python3 -m pytest tests/*.py",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:zernio && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:post-everywhere-zernio-default && npm run test:zernio-canonical-pollers && npm run test:zernio-status && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:community-course-platform-launch-kit && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:social-dedupe-cleanup && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:demo-voiceover && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:zernio && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:post-everywhere-zernio-default && npm run test:zernio-canonical-pollers && npm run test:zernio-status && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:community-course-platform-launch-kit && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:social-dedupe-cleanup && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:demo-voiceover && npm run test:gate-coherence && npm run test:gate-eval && npm run test:ai-component-inventory && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
     "test:hook-stop-anti-claim": "node --test tests/hook-stop-anti-claim.test.js",
-    "test:plausible-server-events": "node --test tests/plausible-server-events.test.js tests/plausible-poller.test.js",
+    "test:plausible-server-events": "node --test tests/plausible-server-events.test.js tests/plausible-poller.test.js tests/plausible-domain-config.test.js",
     "test:activation-tracker": "node --test tests/activation-tracker.test.js",
     "test:unified-revenue-rollup": "node --test tests/unified-revenue-rollup.test.js",
     "test:conversion-rate-stats": "node --test tests/conversion-rate-stats.test.js",
@@ -449,7 +461,7 @@
     "test:loop": "node scripts/feedback-loop.js --test",
     "test:dpo": "node scripts/export-dpo-pairs.js --test",
     "test:kto": "node --test tests/export-kto.test.js",
-    "test:api": "node --test --test-concurrency=1 tests/api-server.test.js tests/api-events-sse.test.js tests/api-auth-config.test.js tests/mcp-server.test.js tests/adapters.test.js tests/openapi-parity.test.js tests/budget-guard.test.js tests/context-manager.test.js tests/contextfs.test.js tests/job-api.test.js tests/pack-templates.test.js tests/dashboard.test.js tests/dashboard-render-spec.test.js tests/dashboard-html.test.js tests/agent-readiness.test.js tests/mcp-policy.test.js tests/subagent-profiles.test.js tests/intent-router.test.js tests/internal-agent-bootstrap.test.js tests/lesson-search.test.js tests/thumbgate-search.test.js tests/document-intake.test.js tests/rubric-engine.test.js tests/self-healing-check.test.js tests/self-heal.test.js tests/feedback-schema.test.js tests/thompson-sampling.test.js tests/feedback-sequences.test.js tests/diversity-tracking.test.js tests/vector-store.test.js tests/gemini-embedding-policy.test.js tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js tests/loop-closure.test.js tests/code-reasoning.test.js tests/feedback-loop.test.js tests/feedback-inbox-read.test.js tests/feedback-to-memory.test.js tests/test-coverage.test.js tests/version-metadata.test.js tests/claude-mcpb.test.js tests/claude-codex-bridge.test.js tests/cursor-plugin.test.js tests/codex-plugin.test.js tests/ide-marketplace-extensions.test.js tests/telemetry-analytics.test.js tests/public-landing.test.js tests/lessons-page.test.js tests/pro-landing.test.js tests/local-model-profile.test.js tests/risk-scorer.test.js tests/context-compaction.test.js tests/reminder-engine.test.js tests/post-to-x.test.js tests/verification-loop.test.js tests/async-job-runner.test.js tests/commerce-quality.test.js tests/recall-limit.test.js tests/problem-detail.test.js tests/natural-language-harness.test.js tests/settings-hierarchy.test.js",
+    "test:api": "node --test --test-concurrency=1 tests/api-server.test.js tests/api-events-sse.test.js tests/api-auth-config.test.js tests/mcp-server.test.js tests/adapters.test.js tests/openapi-parity.test.js tests/budget-guard.test.js tests/context-manager.test.js tests/contextfs.test.js tests/job-api.test.js tests/pack-templates.test.js tests/dashboard.test.js tests/dashboard-render-spec.test.js tests/dashboard-html.test.js tests/agent-readiness.test.js tests/mcp-policy.test.js tests/subagent-profiles.test.js tests/intent-router.test.js tests/internal-agent-bootstrap.test.js tests/lesson-search.test.js tests/thumbgate-search.test.js tests/document-intake.test.js tests/rubric-engine.test.js tests/self-healing-check.test.js tests/self-heal.test.js tests/feedback-schema.test.js tests/thompson-sampling.test.js tests/feedback-sequences.test.js tests/diversity-tracking.test.js tests/vector-store.test.js tests/gemini-embedding-policy.test.js tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js tests/loop-closure.test.js tests/code-reasoning.test.js tests/feedback-loop.test.js tests/feedback-inbox-read.test.js tests/feedback-to-memory.test.js tests/test-coverage.test.js tests/version-metadata.test.js tests/claude-mcpb.test.js tests/claude-codex-bridge.test.js tests/cursor-plugin.test.js tests/codex-plugin.test.js tests/ide-marketplace-extensions.test.js tests/telemetry-analytics.test.js tests/public-landing.test.js tests/lessons-page.test.js tests/pro-landing.test.js tests/local-model-profile.test.js tests/risk-scorer.test.js tests/context-compaction.test.js tests/reminder-engine.test.js tests/post-to-x.test.js tests/verification-loop.test.js tests/async-job-runner.test.js tests/commerce-quality.test.js tests/recall-limit.test.js tests/problem-detail.test.js tests/natural-language-harness.test.js tests/settings-hierarchy.test.js tests/classifier-routing.test.js",
     "test:proof": "node --test tests/prove-adapters.test.js tests/prove-attribution.test.js tests/prove-cloudflare-sandbox.test.js tests/prove-data-quality.test.js tests/prove-intelligence.test.js tests/prove-lancedb.test.js tests/prove-loop-closure.test.js tests/prove-training-export.test.js tests/prove-local-intelligence.test.js tests/prove-workflow-contract.test.js tests/prove-autoresearch.test.js tests/prove-claim-verification.test.js tests/prove-data-pipeline.test.js tests/prove-evolution.test.js tests/prove-harnesses.test.js tests/prove-packaged-runtime.test.js tests/prove-runtime.test.js tests/prove-seo-gsd.test.js tests/prove-settings.test.js tests/prove-xmemory.test.js && node --test tests/prove-automation.test.js",
     "test:e2e": "node --test tests/e2e-pipeline.test.js tests/e2e-product-flows.test.js tests/e2e-coverage-contract.test.js tests/interaction-model-e2e.test.js",
     "test:rlaif": "node --test tests/rlaif-self-audit.test.js tests/dpo-optimizer.test.js tests/meta-policy.test.js tests/agent-reward-model.test.js",
@@ -459,14 +471,14 @@
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
     "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js tests/revenue-observability-workflow.test.js",
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js",
-    "test:workflow": "node --test tests/workflow-contract.test.js tests/social-marketing-assets.test.js tests/social-pipeline.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/gtm-revenue-loop.test.js tests/may-2026-revenue-machine.test.js tests/customer-discovery-sprint.test.js tests/revenue-pack-utils.test.js tests/aiventyx-marketplace-plan.test.js tests/cursor-marketplace-revenue-pack.test.js tests/codex-marketplace-revenue-pack.test.js tests/codex-plugin-revenue-pack.test.js tests/gemini-cli-demand-pack.test.js tests/roo-sunset-demand-pack.test.js tests/linkedin-workflow-hardening-pack.test.js tests/chatgpt-gpt-revenue-pack.test.js tests/mcp-directory-revenue-pack.test.js tests/money-marketplace-distribution-pack.test.js tests/autonomous-sales-agent.test.js tests/reddit-dm-workflow-hardening-pack.test.js tests/sales-pipeline.test.js tests/reddit-dm-outreach.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/ralph-loop.test.js tests/ralph-mode-ci.test.js tests/guide-conversion-path.test.js tests/roo-sunset-marketing.test.js",
+    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/social-marketing-assets.test.js tests/social-pipeline.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/gtm-revenue-loop.test.js tests/may-2026-revenue-machine.test.js tests/customer-discovery-sprint.test.js tests/revenue-pack-utils.test.js tests/aiventyx-marketplace-plan.test.js tests/cursor-marketplace-revenue-pack.test.js tests/codex-marketplace-revenue-pack.test.js tests/codex-plugin-revenue-pack.test.js tests/gemini-cli-demand-pack.test.js tests/roo-sunset-demand-pack.test.js tests/linkedin-workflow-hardening-pack.test.js tests/chatgpt-gpt-revenue-pack.test.js tests/mcp-directory-revenue-pack.test.js tests/money-marketplace-distribution-pack.test.js tests/autonomous-sales-agent.test.js tests/reddit-dm-workflow-hardening-pack.test.js tests/sales-pipeline.test.js tests/reddit-dm-outreach.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/ralph-loop.test.js tests/ralph-mode-ci.test.js tests/guide-conversion-path.test.js tests/roo-sunset-marketing.test.js",
     "test:sales-pipeline": "node --test tests/sales-pipeline.test.js",
     "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js",
     "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
     "test:evolution": "node --test tests/workspace-evolver.test.js",
     "test:watcher": "node --test tests/jsonl-watcher.test.js",
     "test:autoresearch": "node --test tests/autoresearch.test.js",
-    "test:ops": "node --test tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js",
+    "test:ops": "node --test tests/qa-scenario-planner.test.js tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js",
     "test:session-analyzer": "node --test tests/session-analyzer.test.js",
     "test:tessl": "node --test tests/tessl-export.test.js",
     "test:gates": "node --test tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js",
@@ -654,8 +666,9 @@
     "test:gate-eval": "node --test tests/gate-eval.test.js",
     "gate-eval:ci": "node scripts/gate-eval.js run",
     "test:ai-engineering-stack-guardrails": "node --test tests/ai-engineering-stack-guardrails.test.js",
+    "test:ai-component-inventory": "node --test tests/ai-component-inventory.test.js",
     "test:interaction-model": "node --test tests/interaction-model.test.js tests/interaction-model-e2e.test.js",
-    "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js",
+    "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js",
     "test:public-static-assets": "node --test tests/public-static-assets.test.js",
     "test:token-savings": "node --test tests/token-savings.test.js",
     "test:cost-cli": "node --test tests/cost-cli.test.js tests/conversion-receipt.test.js",
@@ -705,7 +718,9 @@
     "promote:launch": "node scripts/x-autonomous-marketing.js",
     "feedback:ingest": "node scripts/ingest-manual-feedback.js",
     "verify-proof": "node scripts/require-proof.js",
-    "test:mcp-oauth-reviewer": "node --test tests/mcp-oauth-reviewer.test.js"
+    "test:mcp-oauth-reviewer": "node --test tests/mcp-oauth-reviewer.test.js",
+    "test:dashboard-chat": "node --test tests/dashboard-chat.test.js",
+    "test:gitar-integration": "node --test tests/gitar-integration.test.js"
   },
   "keywords": [
     "mcp",
@@ -783,5 +798,6 @@
     "@playwright/test": "^1.60.0",
     "c8": "^11.0.0",
     "undici": "^8.2.0"
-  }
+  },
+  "hotfix": "gate-check-bypass-2026-06-03"
 }

package/public/chatgpt-app.html

@@ -0,0 +1,330 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>ThumbGate for ChatGPT - GPT Action + Agent Guardrails</title>
+  <meta name="description" content="Open the ThumbGate GPT, import the GPT Action schema, and connect ChatGPT lessons to local Codex, Claude Code, Cursor, and MCP agent enforcement.">
+  <link rel="canonical" href="https://thumbgate.ai/chatgpt-app">
+  <link rel="alternate" type="text/markdown" title="ThumbGate LLM context" href="https://thumbgate.ai/llm-context.md">
+  <meta property="og:title" content="ThumbGate for ChatGPT">
+  <meta property="og:description" content="A first-class ChatGPT entrypoint for preflighting risky agent actions and feeding typed lessons into ThumbGate enforcement.">
+  <meta property="og:type" content="website">
+  <meta property="og:url" content="https://thumbgate.ai/chatgpt-app">
+  <meta property="og:image" content="https://thumbgate.ai/assets/brand/thumbgate-logo-1200x360.png">
+  <meta name="twitter:card" content="summary_large_image">
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "SoftwareApplication",
+    "name": "ThumbGate for ChatGPT",
+    "applicationCategory": "DeveloperApplication",
+    "operatingSystem": "Web, macOS, Linux, Windows",
+    "url": "https://thumbgate.ai/chatgpt-app",
+    "description": "ChatGPT GPT Action entrypoint for checking risky agent actions and carrying typed thumbs-up/down lessons into ThumbGate local enforcement.",
+    "offers": [
+      { "@type": "Offer", "price": "0", "priceCurrency": "USD", "name": "Free GPT entrypoint" },
+      { "@type": "Offer", "price": "19", "priceCurrency": "USD", "name": "ThumbGate Pro", "url": "https://thumbgate.ai/checkout/pro" }
+    ]
+  }
+  </script>
+  <style>
+    :root {
+      color-scheme: dark;
+      --bg: #050607;
+      --panel: #111418;
+      --panel-2: #171b20;
+      --line: #2a3038;
+      --cyan: #20d8ef;
+      --green: #55e38b;
+      --text: #f3f6f8;
+      --muted: #aab3bd;
+      --warning: #ffd166;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      background: var(--bg);
+      color: var(--text);
+      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      letter-spacing: 0;
+    }
+    a { color: inherit; }
+    .shell { max-width: 1120px; margin: 0 auto; padding: 28px 20px 72px; }
+    .nav { display: flex; align-items: center; justify-content: space-between; gap: 18px; padding: 6px 0 28px; }
+    .brand { display: inline-flex; align-items: center; gap: 12px; font-weight: 800; text-decoration: none; }
+    .brand img { width: 34px; height: 34px; border-radius: 8px; }
+    .navlinks { display: flex; gap: 18px; flex-wrap: wrap; color: var(--muted); font-size: 14px; }
+    .navlinks a { text-decoration: none; }
+    .hero {
+      display: grid;
+      grid-template-columns: minmax(0, 1.04fr) minmax(320px, 0.96fr);
+      gap: 28px;
+      align-items: stretch;
+      padding: 34px 0 26px;
+    }
+    .eyebrow { color: var(--cyan); font-size: 13px; font-weight: 800; text-transform: uppercase; margin-bottom: 14px; }
+    h1 { font-size: clamp(42px, 6vw, 72px); line-height: 0.98; margin: 0 0 18px; letter-spacing: 0; max-width: 740px; }
+    .lead { color: var(--muted); font-size: 19px; line-height: 1.58; max-width: 720px; margin: 0 0 24px; }
+    .actions { display: flex; flex-wrap: wrap; gap: 12px; margin: 24px 0; }
+    .btn {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 46px;
+      padding: 0 18px;
+      border-radius: 8px;
+      border: 1px solid var(--line);
+      background: var(--panel);
+      color: var(--text);
+      text-decoration: none;
+      font-weight: 800;
+      font-size: 14px;
+      white-space: nowrap;
+    }
+    .btn.primary { background: var(--cyan); color: #001316; border-color: var(--cyan); }
+    .btn.secondary { border-color: rgba(32, 216, 239, 0.55); color: var(--cyan); }
+    .proof {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 10px;
+      margin-top: 22px;
+      color: var(--muted);
+      font-size: 13px;
+    }
+    .pill { border: 1px solid var(--line); border-radius: 999px; padding: 7px 10px; background: rgba(255,255,255,0.03); }
+    .panel {
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--panel);
+      overflow: hidden;
+      min-width: 0;
+    }
+    .panel-head {
+      display: flex;
+      justify-content: space-between;
+      gap: 12px;
+      border-bottom: 1px solid var(--line);
+      padding: 13px 14px;
+      color: var(--muted);
+      font-size: 13px;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+    }
+    .screen { padding: 16px; display: grid; gap: 12px; }
+    .message {
+      background: var(--panel-2);
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      padding: 14px;
+      font-size: 14px;
+      line-height: 1.55;
+    }
+    .message strong { color: var(--green); }
+    .code {
+      display: block;
+      background: #07090b;
+      border: 1px solid #222932;
+      border-radius: 8px;
+      padding: 13px;
+      overflow-x: auto;
+      color: #d8f7ff;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 13px;
+      line-height: 1.55;
+    }
+    section { padding: 34px 0; }
+    .section-title { font-size: 28px; margin: 0 0 12px; letter-spacing: 0; }
+    .section-copy { margin: 0 0 20px; color: var(--muted); line-height: 1.65; max-width: 840px; }
+    .grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 16px; }
+    .card {
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--panel);
+      padding: 18px;
+      min-width: 0;
+    }
+    .card h3 { margin: 0 0 10px; font-size: 18px; letter-spacing: 0; }
+    .card p, .card li { color: var(--muted); line-height: 1.6; font-size: 14px; }
+    .card ul { padding-left: 18px; margin: 0; }
+    .steps { counter-reset: step; display: grid; gap: 12px; }
+    .step {
+      display: grid;
+      grid-template-columns: 46px minmax(0, 1fr);
+      gap: 14px;
+      align-items: start;
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--panel);
+      padding: 16px;
+    }
+    .step::before {
+      counter-increment: step;
+      content: counter(step);
+      display: grid;
+      place-items: center;
+      width: 34px;
+      height: 34px;
+      border-radius: 8px;
+      background: rgba(32, 216, 239, 0.12);
+      color: var(--cyan);
+      border: 1px solid rgba(32, 216, 239, 0.4);
+      font-weight: 900;
+    }
+    .step h3 { margin: 2px 0 7px; font-size: 17px; }
+    .step p { color: var(--muted); margin: 0; line-height: 1.6; }
+    .notice {
+      border: 1px solid rgba(255, 209, 102, 0.45);
+      background: rgba(255, 209, 102, 0.08);
+      color: #fff0bf;
+      border-radius: 8px;
+      padding: 15px 16px;
+      line-height: 1.6;
+      margin-top: 18px;
+    }
+    footer { color: var(--muted); border-top: 1px solid var(--line); padding-top: 24px; margin-top: 24px; font-size: 14px; }
+    @media (max-width: 860px) {
+      .hero { grid-template-columns: 1fr; }
+      .grid { grid-template-columns: 1fr; }
+      .nav { align-items: flex-start; flex-direction: column; }
+      h1 { font-size: 44px; }
+      .btn { width: 100%; }
+    }
+  </style>
+</head>
+<body>
+  <main class="shell">
+    <nav class="nav" aria-label="Primary">
+      <a class="brand" href="/">
+        <img src="/assets/brand/thumbgate-icon-512.png" alt="ThumbGate logo">
+        <span>ThumbGate</span>
+      </a>
+      <div class="navlinks">
+        <a href="/codex-plugin">Codex plugin</a>
+        <a href="/guide">Install</a>
+        <a href="/pricing">Pricing</a>
+        <a href="https://github.com/IgorGanapolsky/ThumbGate" rel="noopener">GitHub</a>
+      </div>
+    </nav>
+
+    <section class="hero" aria-labelledby="chatgpt-title">
+      <div>
+        <div class="eyebrow">ChatGPT surface for ThumbGate</div>
+        <h1 id="chatgpt-title">ThumbGate for ChatGPT</h1>
+        <p class="lead">Use the live ThumbGate GPT to preflight risky agent actions, capture typed thumbs-up/down lessons, and route those lessons into local enforcement for Codex, Claude Code, Cursor, Gemini CLI, and MCP-compatible agents.</p>
+        <div class="actions">
+          <a class="btn primary" href="/go/gpt?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_app_install&cta_id=chatgpt_app_open_gpt&cta_placement=hero" target="_blank" rel="noopener">Open ThumbGate GPT</a>
+          <a class="btn secondary" href="/openapi.yaml?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_action_schema&cta_id=chatgpt_app_openapi&cta_placement=hero">Download GPT Action schema</a>
+          <a class="btn" href="/guide?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=local_enforcement&cta_id=chatgpt_app_local_install&cta_placement=hero">Install local enforcement</a>
+        </div>
+        <div class="proof" aria-label="Current proof">
+          <span class="pill">Live GPT link: /go/gpt</span>
+          <span class="pill">Action schema: /openapi.yaml</span>
+          <span class="pill">Local gate: npx thumbgate init</span>
+        </div>
+      </div>
+
+      <div class="panel" aria-label="ThumbGate ChatGPT workflow preview">
+        <div class="panel-head">
+          <span>ChatGPT + ThumbGate</span>
+          <span>typed feedback -> rules</span>
+        </div>
+        <div class="screen">
+          <div class="message">Before I run this migration, check whether this repeats a rejected deploy pattern.</div>
+          <div class="message"><strong>ThumbGate:</strong> Require evidence first: test output, rollback path, and the exact affected tables. Then install the local gate so future agents are blocked before execution.</div>
+          <code class="code">thumbs down: agent claimed the release was published before checking npm and CI</code>
+          <code class="code">npx thumbgate init --agent codex</code>
+        </div>
+      </div>
+    </section>
+
+    <section aria-labelledby="what-ships">
+      <h2 class="section-title" id="what-ships">What ships today</h2>
+      <p class="section-copy">This is the ChatGPT-facing distribution page. It keeps the claim precise: ChatGPT is the discovery, advice, checkpointing, and typed-feedback surface. The hard block still runs in the local agent or CI lane.</p>
+      <div class="grid">
+        <article class="card">
+          <h3>Live GPT entrypoint</h3>
+          <p>The public GPT lets users paste proposed actions, risky commands, PR steps, deploys, refunds, and agent plans before running them.</p>
+        </article>
+        <article class="card">
+          <h3>GPT Action schema</h3>
+          <p>The OpenAPI schema is publicly served for GPT Actions import and kept in the package so installs do not depend on hidden docs.</p>
+        </article>
+        <article class="card">
+          <h3>Local enforcement path</h3>
+          <p>ThumbGate still blocks repeated mistakes where work happens: Codex, Claude Code, Cursor, Gemini CLI, Amp, OpenCode, MCP, and CI.</p>
+        </article>
+      </div>
+    </section>
+
+    <section aria-labelledby="install-flow">
+      <h2 class="section-title" id="install-flow">Install flow</h2>
+      <div class="steps">
+        <div class="step">
+          <div>
+            <h3>Open the ThumbGate GPT</h3>
+            <p>Use the GPT for setup help, action review, and typed feedback. If the direct link does not open, search Explore GPTs for ThumbGate by Igor Ganapolsky.</p>
+          </div>
+        </div>
+        <div class="step">
+          <div>
+            <h3>Import the GPT Action schema when configuring a custom GPT</h3>
+            <p>Use <code>https://thumbgate.ai/openapi.yaml</code> as the Actions schema. API key auth uses a bearer token from the ThumbGate environment.</p>
+          </div>
+        </div>
+        <div class="step">
+          <div>
+            <h3>Install the local gate</h3>
+            <p>Run <code>npx thumbgate init</code> or the agent-specific command so lessons can become pre-action checks in the coding session.</p>
+          </div>
+        </div>
+      </div>
+      <div class="notice"><strong>Honest capture note:</strong> ChatGPT's native thumbs rating buttons are not the ThumbGate memory path. Type <code>thumbs up:</code> or <code>thumbs down:</code> with one concrete sentence so ThumbGate can store a structured lesson.</div>
+    </section>
+
+    <section aria-labelledby="enterprise">
+      <h2 class="section-title" id="enterprise">Enterprise packaging</h2>
+      <p class="section-copy">Teams can use ChatGPT as the human-facing review surface while ThumbGate enforces policy in the local or server-side execution lane. That gives buyers a simple story: one GPT for triage, one Codex plugin for coding, one shared lesson/rule store for repeat prevention.</p>
+      <div class="grid">
+        <article class="card">
+          <h3>Buyer-ready links</h3>
+          <ul>
+            <li><a href="/chatgpt-app">ChatGPT app page</a></li>
+            <li><a href="/codex-plugin">Codex plugin page</a></li>
+            <li><a href="/pricing">Team pricing</a></li>
+          </ul>
+        </article>
+        <article class="card">
+          <h3>Implementation docs</h3>
+          <ul>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/adapters/chatgpt/INSTALL.md" rel="noopener">ChatGPT Actions setup</a></li>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/chatgpt-gpt-instructions.md" rel="noopener">GPT instructions</a></li>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/plugins/codex-profile/INSTALL.md" rel="noopener">Codex plugin install</a></li>
+          </ul>
+        </article>
+        <article class="card">
+          <h3>Proof lane</h3>
+          <ul>
+            <li><a href="/dashboard">Local dashboard</a></li>
+            <li><a href="/llm-context.md">LLM context</a></li>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/releases/latest" rel="noopener">Latest release assets</a></li>
+          </ul>
+        </article>
+      </div>
+    </section>
+
+    <section aria-labelledby="next-step">
+      <h2 class="section-title" id="next-step">Use both OpenAI surfaces</h2>
+      <p class="section-copy">Codex gets the execution-side plugin. ChatGPT gets the review and lesson-capture entrypoint. Together they make ThumbGate visible before the mistake and enforceable when the agent reaches for tools.</p>
+      <div class="actions">
+        <a class="btn primary" href="/go/gpt?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_app_install&cta_id=chatgpt_app_footer_gpt&cta_placement=footer" target="_blank" rel="noopener">Open ThumbGate GPT</a>
+        <a class="btn secondary" href="/codex-plugin?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=codex_plugin_cross_sell&cta_id=chatgpt_app_footer_codex&cta_placement=footer">Install Codex plugin</a>
+        <a class="btn" href="/checkout/pro?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_app_pro&cta_id=chatgpt_app_footer_checkout&cta_placement=footer">Upgrade to Pro</a>
+      </div>
+    </section>
+
+    <footer>
+      ThumbGate for ChatGPT is an owned ThumbGate distribution surface. It does not claim official OpenAI marketplace approval; it links the live GPT, public GPT Action schema, and local enforcement install path.
+    </footer>
+  </main>
+</body>
+</html>