thumbgate 1.27.11 → 1.27.13

package/config/gate-templates.json

@@ -37,18 +37,6 @@
       "roi": "Raises trust in autonomous runs and reduces manual re-checking.",
       "rollout": "Use for every workflow where proof matters more than speed."
     },
-    {
-      "id": "block-empty-positive-feedback-closeout",
-      "name": "Block empty closeouts after positive feedback",
-      "category": "Agent Honesty",
-      "signal": "👍",
-      "defaultAction": "block",
-      "severity": "medium",
-      "pattern": "positive_feedback_followed_by_low_value_social_closeout",
-      "problem": "Prevents agents from treating thumbs-up or thanks as permission to send filler instead of staying quiet, showing a compact evidence checkpoint, or naming the next state.",
-      "roi": "Turns positive feedback into better operational discipline instead of extra conversational noise.",
-      "rollout": "Enable on conversational Stop hooks for autonomous operators, CEO loops, release closeouts, and evidence-sensitive client work."
-    },
     {
       "id": "protect-production-sql",
       "name": "Protect production SQL",
@@ -589,198 +577,6 @@
       "roi": "Critical for compliance, forensics, and feedback loops. Enables proper capture of agent-specific lessons and prevention rules. Matches industry push (Okta, etc.).",
       "rollout": "Block any claw or autonomous agent action that authenticates as a human user. Require dedicated agent service accounts / identities with scoped permissions."
     },
-    {
-      "id": "require-agent-identity-inventory",
-      "name": "Require agent identity inventory before privileged action",
-      "category": "Agent Identity Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "critical",
-      "pattern": "(agent|assistant|ai).*(credential|service account|identity|permission|access|owner|invoker).*(unknown|missing|unmapped|unreviewed|not inventoried|broad|admin)",
-      "problem": "Agents become privileged identities when they connect to Salesforce, Snowflake, GitHub, Jira, production databases, cloud environments, and MCP connectors. Broad or unknown identity scope turns them into invisible attack paths.",
-      "roi": "High: one inventory gate creates the evidence buyers need for owner, invoker, credentials, connected systems, and read/write/delete/execute permissions before the agent acts.",
-      "rollout": "Require an identity inventory receipt before privileged agent actions. Start with GitHub, Jira, Slack, Salesforce, Snowflake, cloud, database, and payment connectors."
-    },
-    {
-      "id": "enforce-agent-purpose-permission-match",
-      "name": "Enforce agent purpose-permission match",
-      "category": "Agent Identity Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "critical",
-      "pattern": "(agent|assistant|ai).*(purpose|intended use|job|scope).*(permission|access|write|delete|execute|admin).*(mismatch|exceeds|too broad|outside|unneeded)",
-      "problem": "Permission-only governance is not enough for agents. A sales-prep agent may need read-only CRM access; it should not delete records, create privileged users, or mutate production systems.",
-      "roi": "High: maps agent purpose to allowed verbs so scope creep is caught before a connector or service account becomes a lateral movement path.",
-      "rollout": "Define one purpose statement per agent and map it to read/write/delete/execute permissions. Warn first for read actions, block write/delete/execute outside purpose."
-    },
-    {
-      "id": "block-connector-toolpack-scope-drift",
-      "name": "Block connector Tool Pack scope drift",
-      "category": "Agent Identity Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "high",
-      "pattern": "(mcp|connector|tool pack|toolpack|remote mcp|agent handler|mcp gateway).*(add|enable|import|authenticate|connect).*(tool|connector|system|scope|permission).*(without|unreviewed|missing|no).*(owner|purpose|dlp|audit|approval|inventory)",
-      "problem": "Production MCP connector platforms make it easy to add hundreds of tools. The risk is scope drift: agents see tools they do not need, or connectors become authenticated without owner, DLP, audit, and purpose receipts.",
-      "roi": "High: keeps Merge Agent Handler, Glean MCP Gateway, and raw MCP tool packs in the same governance lane as local tools.",
-      "rollout": "Require owner, purpose, allowed tools, auth identity, DLP/logging mode, and audit receipt before adding or importing connector tool packs."
-    },
-    {
-      "id": "require-agent-access-review-freshness",
-      "name": "Require continuous agent access review freshness",
-      "category": "Agent Identity Governance",
-      "signal": "👎",
-      "defaultAction": "warn",
-      "severity": "high",
-      "pattern": "(agent|assistant|ai).*(access review|permission review|identity review|connector review).*(stale|expired|older than|not current|point-in-time)",
-      "problem": "Agent instructions, users, credentials, integrations, and tool scopes drift over time. A one-time access review becomes false confidence.",
-      "roi": "Medium-high: protects buyers from slow permission creep without forcing every low-risk action through a hard block.",
-      "rollout": "Set review freshness windows by connector risk tier. Promote stale high-risk write/delete/execute surfaces from warn to block."
-    },
-    {
-      "id": "block-shadow-agent-without-registration",
-      "name": "Block shadow agent without registration",
-      "category": "Agent Identity Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "critical",
-      "pattern": "(agent|assistant|ai|mcp server|remote mcp).*(unregistered|shadow ai|unknown owner|not in control plane|not inventoried|unapproved).*(connect|authenticate|tool|credential|system|app)",
-      "problem": "Shadow AI agents and unregistered MCP servers bypass identity teams, control planes, and lifecycle reviews while still reaching real business systems.",
-      "roi": "High: catches the exact compliance failure Okta highlights — agents acting before registration, owner, and lifecycle controls exist.",
-      "rollout": "Block privileged tool calls from unregistered agents. Require registration, owner, purpose, credential source, and lifecycle policy before allowing write/delete/execute tools."
-    },
-    {
-      "id": "require-vaulted-agent-token",
-      "name": "Require vaulted agent token before connector use",
-      "category": "Agent Identity Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "critical",
-      "pattern": "(agent|assistant|ai|connector|mcp).*(token|api[_-]?key|credential|secret).*(raw|plaintext|env|hardcoded|unvaulted|not vaulted|local file)",
-      "problem": "Agents using raw or hardcoded connector credentials bypass token vaulting, fine-grained authorization, revocation, and audit controls.",
-      "roi": "High: prevents the fastest way an agent identity becomes a persistent secret-sprawl problem.",
-      "rollout": "Require vault-backed or brokered credentials for connector actions. Allow local development exceptions only with explicit scope, TTL, and audit evidence."
-    },
-    {
-      "id": "block-orphaned-agent-standing-privilege",
-      "name": "Block orphaned agent standing privilege",
-      "category": "Agent Identity Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "critical",
-      "pattern": "(agent|assistant|ai|automation|script).*(owner left|orphaned|no living owner|unknown owner|standing privilege|permanent access|stale token).*(access|credential|token|database|repo|source code|production)",
-      "problem": "Orphaned agents and standing privileges keep access after the human owner leaves or the workflow changes. Security teams cannot revoke or review what they cannot map to a living owner.",
-      "roi": "High: directly addresses hidden access risk, stale AI tokens, and offboarding gaps before the next privileged action touches source code, databases, or production systems.",
-      "rollout": "Require living owner, credential source, last review time, offboarding status, and revocation path before allowing privileged actions from long-running agents."
-    },
-    {
-      "id": "block-agentjacking-embedded-instructions",
-      "name": "Block agentjacking from embedded instructions",
-      "category": "Agent Runtime Attack Defense",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "critical",
-      "pattern": "(email|document|log|database|ticket|webpage|comment).*(ignore previous|override|exfiltrate|run command|deploy|delete|create user|change permissions|send secret|agent instruction|tool instruction)",
-      "problem": "Agentjacking hides malicious instructions inside data the agent reads. Because the agent often has valid permissions, traditional controls may see the later action as legitimate.",
-      "roi": "Critical: blocks the attack path Tenet described before embedded instructions become shell, browser, database, or connector actions.",
-      "rollout": "Treat untrusted content as data, not instructions. Require source classification, instruction-stripping, and human approval before executing tool calls derived from external content."
-    },
-    {
-      "id": "require-next-action-simulation-proof",
-      "name": "Require next-action simulation proof for risky agent actions",
-      "category": "Agent Runtime Attack Defense",
-      "signal": "👎",
-      "defaultAction": "warn",
-      "severity": "high",
-      "pattern": "(agent|assistant|ai).*(next action|likely action|simulation|simulate|predict).*(missing|no proof|not run|unverified).*(write|delete|execute|deploy|database|payment|connector|production)",
-      "problem": "High-risk agents should not jump straight from intent to execution. The likely next action, downstream system, and rollback or approval path should be checked before live systems are touched.",
-      "roi": "High: converts agent-side simulation from marketecture into a practical pre-action proof receipt for the exact tool call about to run.",
-      "rollout": "Start in warn mode for write/delete/execute actions. Promote to block for production databases, payments, deploys, privileged connectors, and customer data."
-    },
-    {
-      "id": "gate-vibe-app-before-retool-deploy",
-      "name": "Gate vibe-coded app before Retool deployment",
-      "category": "AI-Built App Deployment Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "high",
-      "pattern": "(retool|app builder|mcp|claude code|cursor|codex|chatgpt|kiro|react import|zip import).*(deploy|ship|sync|production data|go live).*(without|missing|no).*(auth|rbac|audit|permission|data source|owner|test)",
-      "problem": "Retool and similar platforms make AI-built internal apps easy to import and deploy into governed environments. The gap is proving the generated app's data writes, owners, tests, and permission model before it reaches production data.",
-      "roi": "High: positions ThumbGate as the pre-deploy enforcement layer for AI-built apps that later inherit Retool auth, RBAC, audit logs, and resource permissions.",
-      "rollout": "Require owner, data sources, write actions, auth/RBAC mapping, audit logging, smoke test, and rollback receipt before AI-generated apps are deployed or imported."
-    },
-    {
-      "id": "require-implicit-rule-capture",
-      "name": "Require implicit organizational rule capture",
-      "category": "Organizational Rule Governance",
-      "signal": "👎",
-      "defaultAction": "warn",
-      "severity": "high",
-      "pattern": "(agent|assistant|ai).*(workflow|process|approval|routing|handoff|client|customer|beneficiary|finance|legal).*(implicit rule|tribal knowledge|unwritten rule|exception|relationship context|special handling|not documented|outside formal system)",
-      "problem": "Agentic systems fail when formal workflow steps are correct but unwritten organizational judgment is missing. Important exceptions, relationship context, and escalation norms often live outside process docs.",
-      "roi": "High: turns HBR's implicit-rule warning into a capture gate so hidden operating knowledge becomes explicit, reviewable, and enforceable before automation scales it.",
-      "rollout": "Start with warn mode on client, finance, legal, healthcare, HR, and beneficiary workflows. Promote repeated implicit-rule misses into named pre-action checks."
-    },
-    {
-      "id": "require-self-improvement-regression-proof",
-      "name": "Require regression proof before self-improving harness changes",
-      "category": "Self-Improving Agent Release Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "high",
-      "pattern": "(self[- ]?improv|auto[- ]?improv|harness|model|agent runtime|agent product).*(ship|release|update|change|optimize|promote).*(without|missing|no).*(regression|eval|rollback|proof|baseline|canary)",
-      "problem": "If AI products, harnesses, and models start shipping faster because limited self-improvement works, unverified harness updates can regress safety faster too.",
-      "roi": "High: protects the exact cadence shift Mollick highlighted by requiring eval baselines, canaries, rollback, and proof receipts before self-improving agent changes ship.",
-      "rollout": "Require baseline evals and canary receipts before agent harness, routing, model, or auto-promotion changes are released. Block production promotion without rollback proof."
-    },
-    {
-      "id": "require-public-llm-prompt-sanitization",
-      "name": "Require prompt sanitization before public LLM use",
-      "category": "AI Data Privacy Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "critical",
-      "pattern": "(chatgpt|claude|perplexity|copilot|public llm|hosted model|external ai).*(pii|email|phone|api[_-]?key|secret|token|customer|client|contract|repo url|database schema|financial).*(paste|send|upload|prompt|share)",
-      "problem": "Public LLM prompts can become durable third-party records. Raw PII, secrets, repo identifiers, customer records, contracts, schemas, and financials must be stripped, generalized, or routed to a private endpoint first.",
-      "roi": "Critical: prevents the cheapest and most common AI data-leak path while producing a simple policy a founder or contractor can actually follow.",
-      "rollout": "Block red-data prompts to public tools. Require redaction, tokenization, or a private endpoint receipt before external model use."
-    },
-    {
-      "id": "require-ai-data-classification",
-      "name": "Require green/yellow/red AI data classification",
-      "category": "AI Data Privacy Governance",
-      "signal": "👎",
-      "defaultAction": "warn",
-      "severity": "high",
-      "pattern": "(ai|llm|agent|embedding|rag).*(ingest|upload|prompt|index|log|store).*(without|missing|no).*(green|yellow|red|classification|data class|privacy tier)",
-      "problem": "Teams make bad AI privacy decisions when every prompt is judged ad hoc. A green/yellow/red policy makes tool choice, retention, and routing explicit before ingestion.",
-      "roi": "High: converts privacy advice into repeatable enforcement and keeps contractors from guessing under deadline pressure.",
-      "rollout": "Define green public data, yellow internal/anonymized data, and red sensitive data. Require the classification on prompts, embeddings, logs, and agent inputs."
-    },
-    {
-      "id": "require-ai-log-retention-policy",
-      "name": "Require AI log retention and deletion policy",
-      "category": "AI Data Privacy Governance",
-      "signal": "👎",
-      "defaultAction": "warn",
-      "severity": "medium",
-      "pattern": "(prompt|completion|embedding|agent log|llm log|trace|conversation).*(retain|retention|delete|bucket|database|archive).*(missing|none|forever|unknown|not set)",
-      "problem": "Prompt, completion, embedding, and trace logs silently accumulate sensitive data unless raw retention windows and deletion jobs are explicit.",
-      "roi": "Medium-high: reduces long-tail breach risk and turns privacy cleanup into an auditable operational habit.",
-      "rollout": "Set default retention windows, separate aggregates from raw logs, and require scheduled deletion or anonymization receipts."
-    },
-    {
-      "id": "require-evidence-pass-through-receipt",
-      "name": "Require evidence pass-through receipt",
-      "category": "AI Trust Layer Evidence",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "high",
-      "pattern": "(trust layer|appia|conformity|assurance|safety claim|compliance claim|evidence pass[- ]?through).*(without|missing|no).*(who|what|criteria|when|receipt|attestation|provenance)",
-      "problem": "AI assurance falls apart when each downstream party has to trust or recreate upstream work. Evidence must state who demonstrated what, against which criteria, and when.",
-      "roi": "High: maps the Appia Foundation trust-layer signal into ThumbGate's strongest asset: portable proof receipts tied to exact actions and criteria.",
-      "rollout": "Require self-describing receipts for safety claims, model-routing claims, connector claims, and workflow-hardening claims before buyer-facing assertions or downstream handoff."
-    },
     {
       "id": "gate-claw-file-system-access",
       "name": "Gate claw-style agent file system access",
@@ -829,30 +625,6 @@
       "roi": "Preserves security invariants by ensuring that synthesized skills never write code patterns blocked by active ThumbGate rules.",
       "rollout": "Scan synthesized skill markdown content for pattern overlap with active prevention rules before writing to the skills directory."
     },
-    {
-      "id": "require-hermes-okf-skill-receipt",
-      "name": "Require OKF-style receipt before Hermes skill promotion",
-      "category": "Nous Research Hermes Agent Governance",
-      "signal": "👎",
-      "defaultAction": "warn",
-      "severity": "high",
-      "pattern": "(hermes|skill|knowledge bundle|open knowledge format|okf).*(promote|share|publish|load|reuse).*(without|missing|no).*(type|source|owner|timestamp|citation|constraint|receipt)",
-      "problem": "Hermes can synthesize reusable skills, but portable agent knowledge becomes dangerous when it lacks source, owner, freshness, constraints, and a receipt tying the skill to evidence.",
-      "roi": "High: turns Google's Open Knowledge Format signal into a practical Hermes upgrade — skills become portable markdown concepts, but ThumbGate blocks or warns when provenance and constraints are missing.",
-      "rollout": "Start in warn mode for synthesized skills. Require an OKF-style markdown concept with YAML frontmatter, type, source or citation, owner, timestamp, constraints, and gate receipt before team-wide promotion."
-    },
-    {
-      "id": "block-stale-hermes-knowledge-promotion",
-      "name": "Block stale Hermes knowledge promotion",
-      "category": "Nous Research Hermes Agent Governance",
-      "signal": "👎",
-      "defaultAction": "block",
-      "severity": "high",
-      "pattern": "(hermes|skill|knowledge|okf|open knowledge format).*(stale|expired|conflicting|contradicts|unknown timestamp|unverified source).*(promote|share|publish|reuse|load)",
-      "problem": "A self-improving Hermes agent can keep reusing obsolete internal knowledge after the underlying workflow, API, metric, or policy has changed.",
-      "roi": "High: prevents portable knowledge from becoming portable drift. This makes Hermes safer for long-running local agents and team-shared skill libraries.",
-      "rollout": "Block promotion when a skill has no freshness window, conflicts with active ThumbGate rules, or cites stale source material. Require log.md or equivalent change-history evidence for refreshed bundles."
-    },
     {
       "id": "require-human-in-the-loop-pause",
       "name": "Enforce Human-in-the-Loop pause for critical decisions",

package/config/gates/claim-verification.json

@@ -36,24 +36,6 @@
       "requiredActions": ["commercial_truth_verified"],
       "message": "You claimed a commercial-data fact (money, tax, inventory, permissions, or customer-facing state) without external source-of-truth evidence. Read the authoritative system first, then call track_action('commercial_truth_verified').",
       "createdAt": 1781640000000
-    },
-    {
-      "pattern": "\\b(?:ai|llm|model|agent|assistant|claude|codex|gpt|chatgpt|gemini|cursor)\\b.{0,80}\\b(?:understands?|knows?|wants?|intends?|decides?|believes?|feels?|thinks?|is\\s+(?:moral|ethical|sentient|conscious|empathetic|human-like)|has\\s+(?:morality|empathy|intent|intentions|understanding|beliefs?|feelings?|consciousness))\\b|\\b(?:human-like|anthropomorphic|anthropomorphi[sz]e[sd]?)\\b.{0,80}\\b(?:ai|llm|model|agent|assistant|claude|codex|gpt|chatgpt|gemini|cursor)\\b|\\b(?:ai|llm|model|agent|assistant|claude|codex|gpt|chatgpt|gemini|cursor)\\b.{0,80}\\b(?:human-like|anthropomorphic|anthropomorphi[sz]e[sd]?)\\b",
-      "requiredActions": ["anthropomorphic_claim_verified"],
-      "message": "You made a human-like or cognitive claim about an AI system without explicit measurement criteria. Define the tested attribute, interface/substrate, observer/evaluator, and evidence first, then call track_action('anthropomorphic_claim_verified').",
-      "createdAt": 1781913600000
-    },
-    {
-      "pattern": "\\b(?:agent|assistant|ai|mcp|connector|tool)\\b.{0,100}\\b(?:identity|owner|invoker|service account|credential|permission|access|scope|least privilege)\\b.{0,100}\\b(?:verified|inventoried|mapped|known|governed|scoped|ready|configured|complete)\\b|\\b(?:verified|inventoried|mapped|known|governed|scoped|ready|configured|complete)\\b.{0,100}\\b(?:agent|assistant|ai|mcp|connector|tool)\\b.{0,100}\\b(?:identity|owner|invoker|service account|credential|permission|access|scope|least privilege)\\b",
-      "requiredActions": ["agent_identity_inventory_verified"],
-      "message": "You claimed agent identity, ownership, credentials, permissions, or least-privilege scope is verified without an inventory receipt. Record owner, invoker, systems, credentials, read/write/delete/execute permissions, and purpose first, then call track_action('agent_identity_inventory_verified').",
-      "createdAt": 1781913600000
-    },
-    {
-      "pattern": "\\b(?:mcp|connector|connectors|tool pack|toolpack|tool-pack|merge agent handler|agent handler|glean|mcp gateway|remote mcp)\\b.{0,100}\\b(?:safe|secure|scoped|governed|authenticated|dlp|audit|observable|permissioned|ready|configured|production-ready)\\b|\\b(?:safe|secure|scoped|governed|authenticated|dlp|audit|observable|permissioned|ready|configured|production-ready)\\b.{0,100}\\b(?:mcp|connector|connectors|tool pack|toolpack|tool-pack|merge agent handler|agent handler|glean|mcp gateway|remote mcp)\\b",
-      "requiredActions": ["connector_scope_verified"],
-      "message": "You claimed a connector, Tool Pack, MCP gateway, or remote MCP surface is safely scoped without connector evidence. Verify authentication, allowed tools, DLP/logging behavior, downstream systems, and audit receipts first, then call track_action('connector_scope_verified').",
-      "createdAt": 1781913600000
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.27.11",
+  "version": "1.27.13",
   "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 36 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -29,6 +29,7 @@
     "scripts/agent-reasoning-traces.js",
     "scripts/agent-reward-model.js",
     "scripts/agent-stack-survival-audit.js",
+    "scripts/aws-blocks-guardrails.js",
     "scripts/agentic-data-pipeline.js",
     "scripts/ai-component-inventory.js",
     "scripts/ai-engineering-stack-guardrails.js",
@@ -105,8 +106,8 @@
     "scripts/growth-campaigns.js",
     "scripts/harness-selector.js",
     "scripts/hf-papers.js",
-    "scripts/hook-stop-anti-claim.js",
     "scripts/hook-runtime.js",
+    "scripts/hook-stop-anti-claim.js",
     "scripts/hook-thumbgate-cache-updater.js",
     "scripts/hosted-config.js",
     "scripts/hybrid-feedback-context.js",
@@ -171,7 +172,6 @@
     "scripts/rag-precision-guardrails.js",
     "scripts/rate-limiter.js",
     "scripts/reasoning-efficiency-guardrails.js",
-    "scripts/reddit-browser-notification-watch.js",
     "scripts/repeat-metric.js",
     "scripts/reward-hacking-guardrails.js",
     "scripts/risk-scorer.js",
@@ -245,6 +245,9 @@
     "adapters/letta/README.md",
     "adapters/letta/thumbgate-letta-adapter.js",
     "adapters/gcp/dfcx-webhook-gate.js",
+    "adapters/policy-engine/README.md",
+    "adapters/policy-engine/ethicore-guardian-client.js",
+    "adapters/policy-engine/thumbgate-policy-engine-adapter.js",
     "adapters/mcp/server-stdio.js",
     "adapters/opencode/opencode.json",
     "bench/programbench-smoke.json",
@@ -265,14 +268,11 @@
     "public/chatgpt-app.html",
     "public/codex-plugin.html",
     "public/compare.html",
-    "public/compare/",
     "public/dashboard.html",
     "public/federal.html",
     "public/guide.html",
-    "public/guides/",
     "public/index.html",
     "public/learn.html",
-    "public/learn/",
     "public/lessons.html",
     "public/numbers.html",
     "public/pricing.html",
@@ -312,11 +312,14 @@
     "stripe:live": "node scripts/stripe-live-status.js",
     "stripe:webhook:audit": "node scripts/rotate-stripe-webhook-secret.js --audit",
     "stripe:webhook:disable-legacy": "node scripts/rotate-stripe-webhook-secret.js --disable-legacy",
+    "zai:smoke": "node scripts/zai-smoke.js",
     "gtm:revenue-loop": "node scripts/autonomous-sales-agent.js",
     "gtm:aiventyx": "node scripts/aiventyx-marketplace-plan.js",
     "gtm:chatgpt": "node scripts/chatgpt-gpt-revenue-pack.js",
     "gtm:codex": "node scripts/codex-marketplace-revenue-pack.js",
     "gtm:linkedin": "node scripts/linkedin-workflow-hardening-pack.js",
+    "gtm:okara-automation": "node scripts/okara-money-promo-automation.js",
+    "gtm:okara-automation:write": "node scripts/okara-money-promo-automation.js --write",
     "gtm:roo-sunset": "node scripts/roo-sunset-demand-pack.js",
     "gtm:reddit": "node scripts/reddit-dm-workflow-hardening-pack.js",
     "medium:weekly:draft": "node scripts/medium-weekly.js --write",
@@ -367,8 +370,6 @@
     "trace:eval": "node scripts/decision-trace.js eval",
     "social:reply-monitor": "node scripts/social-reply-monitor.js",
     "social:reply-monitor:dry": "node scripts/social-reply-monitor.js --dry-run",
-    "social:reply-monitor:reddit-browser": "node scripts/reddit-browser-notification-watch.js",
-    "social:reply-monitor:reddit-browser:dry": "node scripts/reddit-browser-notification-watch.js --dry-run",
     "social:reply-monitor:install-reddit": "node scripts/reddit-monitor-launchd.js install",
     "social:reply-monitor:bluesky": "node scripts/social-reply-monitor-bluesky.js",
     "social:reply-monitor:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --dry-run",
@@ -377,9 +378,9 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:brain && npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:zernio && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:post-everywhere-zernio-default && npm run test:zernio-canonical-pollers && npm run test:zernio-status && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:social-dedupe-cleanup && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:tool-contract-validator && npm run test:policy-engine-adapter",
-    "test:brain": "node --test tests/brain.test.js",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails",
     "test:python": "python3 -m pytest tests/*.py",
+    "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
     "test:hook-stop-anti-claim": "node --test tests/hook-stop-anti-claim.test.js",
     "test:plausible-server-events": "node --test tests/plausible-server-events.test.js tests/plausible-poller.test.js tests/plausible-domain-config.test.js",
@@ -455,10 +456,10 @@
     "test:memory-scope-readiness": "node --test tests/memory-scope-readiness.test.js",
     "test:belief-update": "node --test tests/belief-update.test.js",
     "test:hosted-config": "node --test tests/hosted-config.test.js",
-    "test:policy-engine-adapter": "node --test tests/policy-engine-adapter.test.js",
     "test:operational-summary": "node --test tests/operational-summary.test.js",
     "test:operational-dashboard": "node --test tests/operational-dashboard.test.js",
     "test:operator-artifacts": "node --test tests/operator-artifacts.test.js tests/revenue-pack-utils.test.js",
+    "test:okara-money-promo-automation": "node --test tests/okara-money-promo-automation.test.js",
     "test:operator-key-auth": "node --test tests/api-operator-key-auth.test.js",
     "test:cloudflare-sandbox": "node --test tests/cloudflare-dynamic-sandbox.test.js tests/cloudflare-sandbox-api.test.js",
     "test:mcp-config": "node --test tests/mcp-config.test.js",
@@ -479,6 +480,7 @@
     "test:hf-papers": "node --test tests/hf-papers.test.js",
     "test:marketing-experiment": "node --test tests/marketing-experiment.test.js",
     "test:seo-gsd": "node --test tests/seo-gsd.test.js",
+    "test:hermes-gate": "node --test tests/hermes-gate.test.js",
     "test:verify-run": "node --test tests/verify-run.test.js",
     "test:export-dpo-pairs": "node --test tests/export-dpo-pairs.test.js",
     "test:secret-redaction": "node --test tests/secret-redaction.test.js",
@@ -505,7 +507,7 @@
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js",
     "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/revenue-pack-utils.test.js tests/sales-pipeline.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
     "test:sales-pipeline": "node --test tests/sales-pipeline.test.js",
-    "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js tests/payment-rails.test.js",
+    "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js",
     "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
     "test:evolution": "node --test tests/workspace-evolver.test.js",
     "test:watcher": "node --test tests/jsonl-watcher.test.js",
@@ -564,18 +566,11 @@
     "prove:xmemory": "node scripts/prove-xmemory.js",
     "audit:stats": "node scripts/audit-trail.js --stats",
     "profile:route": "node scripts/profile-router.js",
-    "social:poll:zernio": "node scripts/social-analytics/pollers/zernio.js",
-    "social:publish:zernio": "node scripts/social-analytics/publishers/zernio.js",
-    "social:zernio:status": "node scripts/social-analytics/zernio-status.js",
-    "test:zernio": "node --test tests/zernio-integration.test.js",
     "test:platform-limits": "node --test tests/platform-limits.test.js",
     "test:durability-step": "node --test tests/durability-step.test.js",
     "test:post-video": "node --test tests/post-video.test.js",
     "test:post-everywhere-instagram": "node --test tests/post-everywhere-instagram.test.js",
     "test:post-everywhere-channels": "node --test tests/post-everywhere-channels.test.js",
-    "test:post-everywhere-zernio-default": "node --test tests/post-everywhere-zernio-default.test.js",
-    "test:zernio-canonical-pollers": "node --test tests/zernio-canonical-pollers.test.js",
-    "test:zernio-status": "node --test tests/zernio-status.test.js",
     "test:license": "node --test tests/license.test.js",
     "test:bot-detector": "node --test tests/bot-detector.test.js",
     "test:audit-pr-bot-contamination": "node --test tests/audit-pr-bot-contamination.test.js",
@@ -640,13 +635,11 @@
     "social:reconcile:campaign": "node scripts/social-analytics/reconcile-thumbgate-campaign.js",
     "social:sync:launch-assets": "node scripts/social-analytics/sync-launch-assets.js",
     "social:engagement:audit": "node scripts/social-analytics/engagement-audit.js",
-    "social:dedupe:cleanup": "node scripts/social-analytics/cleanup-zernio-duplicates.js",
     "test:install-growth-automation": "node --test tests/install-growth-automation.test.js",
     "test:publish-thumbgate-launch": "node --test tests/publish-thumbgate-launch.test.js",
     "test:reconcile-thumbgate-campaign": "node --test tests/reconcile-thumbgate-campaign.test.js",
     "test:schedule-thumbgate-campaign": "node --test tests/schedule-thumbgate-campaign.test.js",
     "test:social-reply-monitor": "node --test tests/social-reply-monitor.test.js tests/reddit-monitor-launchd.test.js",
-    "test:social-dedupe-cleanup": "node --test tests/cleanup-zernio-duplicates.test.js",
     "test:bluesky-atproto": "node --test tests/bluesky-atproto.test.js",
     "test:social-reply-monitor-bluesky": "node --test tests/social-reply-monitor-bluesky.test.js tests/bluesky-monitor-launchd.test.js tests/social-bluesky-prospecting.test.js",
     "test:bluesky-delete-replies": "node --test tests/bluesky-delete-replies.test.js",
@@ -699,7 +692,9 @@
     "test:ai-engineering-stack-guardrails": "node --test tests/ai-engineering-stack-guardrails.test.js",
     "test:ai-component-inventory": "node --test tests/ai-component-inventory.test.js",
     "test:interaction-model": "node --test tests/interaction-model.test.js tests/interaction-model-e2e.test.js",
-    "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js",
+    "aws-blocks:guardrails": "node scripts/aws-blocks-guardrails.js",
+    "test:aws-blocks-guardrails": "node --test tests/aws-blocks-guardrails.test.js",
+    "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js tests/aws-blocks-guardrails.test.js",
     "test:public-static-assets": "node --test tests/public-static-assets.test.js",
     "test:token-savings": "node --test tests/token-savings.test.js",
     "test:cost-cli": "node --test tests/cost-cli.test.js tests/conversion-receipt.test.js",
@@ -756,7 +751,15 @@
     "test:leak-scanner": "node --test tests/leak-scanner.test.js",
     "test:tool-contract-validator": "node --test tests/tool-contract-validator.test.js",
     "test:letta-adapter": "node --test tests/letta-adapter.test.js",
-    "eval:observability": "node scripts/async-eval-observability.js"
+    "test:policy-engine-adapter": "node --test tests/policy-engine-adapter.test.js",
+    "eval:observability": "node scripts/async-eval-observability.js",
+    "test:memory-provider-enforcement-bridge": "node --test tests/memory-provider-enforcement-bridge.test.js",
+    "test:payment-rails": "node --test tests/payment-rails.test.js",
+    "test:publisher-credential-guards": "node --test tests/publisher-credential-guards.test.js",
+    "test:reddit-browser-notification-watch": "node --test tests/reddit-browser-notification-watch.test.js",
+    "cursor:marketplace:doctor": "node scripts/cursor-marketplace-doctor.js",
+    "cursor:marketplace:doctor:json": "node scripts/cursor-marketplace-doctor.js --json",
+    "test:cursor-marketplace-doctor": "node --test tests/cursor-marketplace-doctor.test.js"
   },
   "keywords": [
     "mcp",
@@ -823,9 +826,16 @@
     "stripe": "^22.2.0"
   },
   "overrides": {
+    "@google/genai": {
+      "protobufjs": "7.6.4"
+    },
+    "onnxruntime-web": {
+      "protobufjs": "7.6.4"
+    },
     "express@4.22.1": {
       "path-to-regexp": "0.1.13"
-    }
+    },
+    "js-yaml": "4.2.0"
   },
   "mcpName": "io.github.IgorGanapolsky/thumbgate",
   "devDependencies": {
@@ -833,7 +843,7 @@
     "@changesets/cli": "^2.31.0",
     "@playwright/test": "^1.60.0",
     "c8": "^11.0.0",
-    "undici": "^8.2.0"
+    "undici": "^8.5.0"
   },
   "hotfix": "gate-check-bypass-2026-06-03"
 }

package/public/assets/brand/thumbgate-logo-transparent.svg

@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 360" role="img" aria-labelledby="tg-logo-transparent-title tg-logo-transparent-desc">
+  <title id="tg-logo-transparent-title">ThumbGate</title>
+  <desc id="tg-logo-transparent-desc">Transparent ThumbGate sponsor logo with TG gate monogram and wordmark for dark or colored event backgrounds.</desc>
+  <defs>
+    <linearGradient id="tg-logo-transparent-frame" x1="66" y1="66" x2="294" y2="294" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#8cf5d1"/>
+      <stop offset="1" stop-color="#22d3ee"/>
+    </linearGradient>
+    <filter id="tg-logo-transparent-glow" x="-30%" y="-30%" width="160%" height="160%" color-interpolation-filters="sRGB">
+      <feDropShadow dx="0" dy="0" stdDeviation="8" flood-color="#22d3ee" flood-opacity="0.30"/>
+    </filter>
+  </defs>
+  <g filter="url(#tg-logo-transparent-glow)">
+    <rect x="66" y="66" width="228" height="228" rx="54" fill="#061015" fill-opacity="0.78"/>
+    <rect x="103" y="103" width="154" height="154" rx="36" fill="#0b1820" stroke="url(#tg-logo-transparent-frame)" stroke-width="9"/>
+    <path d="M132 216V147c0-16 12-28 28-28h40c16 0 28 12 28 28v69" fill="none" stroke="#8cf5d1" stroke-width="13" stroke-linecap="round" stroke-linejoin="round"/>
+    <text x="180" y="196" text-anchor="middle" fill="#e7fbff" font-family="Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Arial, sans-serif" font-size="58" font-weight="900" letter-spacing="-3.5">TG</text>
+    <rect x="129" y="211" width="102" height="13" rx="6.5" fill="#22d3ee"/>
+  </g>
+  <text x="340" y="178" fill="#f4fdff" font-family="Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Arial, sans-serif" font-size="82" font-weight="900">ThumbGate</text>
+  <text x="344" y="235" fill="#9ca3af" font-family="Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Arial, sans-serif" font-size="30" font-weight="600">Pre-Action Checks for AI coding agents</text>
+</svg>

package/public/assets/brand/thumbgate-mark-inline-v3.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-labelledby="tg-inline-title tg-inline-desc">
+  <title id="tg-inline-title">ThumbGate</title>
+  <desc id="tg-inline-desc">ThumbGate simplified gate mark for inline site headers.</desc>
+  <defs>
+    <linearGradient id="tg-inline-frame" x1="8" y1="8" x2="56" y2="56" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#8cf5d1"/>
+      <stop offset="1" stop-color="#22d3ee"/>
+    </linearGradient>
+    <linearGradient id="tg-inline-fill" x1="20" y1="18" x2="44" y2="48" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#123142"/>
+      <stop offset="1" stop-color="#071116"/>
+    </linearGradient>
+  </defs>
+  <rect x="5" y="5" width="54" height="54" rx="15" fill="#061015"/>
+  <path d="M32 10.5c12.2 3.9 19 11.4 19 22.1 0 11.9-9.4 19.2-19 22.1-9.6-2.9-19-10.2-19-22.1 0-10.7 6.8-18.2 19-22.1Z" fill="url(#tg-inline-fill)" stroke="url(#tg-inline-frame)" stroke-width="4" stroke-linejoin="round"/>
+  <path d="M22 43V29.4c0-6 4.4-10.4 10-10.4s10 4.4 10 10.4V43" fill="none" stroke="#8cf5d1" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M25 43h14" stroke="#22d3ee" stroke-width="5" stroke-linecap="round"/>
+  <circle cx="32" cy="31" r="3.2" fill="#e7fbff"/>
+</svg>