thumbgate 1.27.18 → 1.27.20

package/public/dashboard.html

@@ -5,12 +5,13 @@
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>ThumbGate Dashboard — Gate Stats, Agent Inventory, Remediations</title>
 <meta name="description" content="Live ThumbGate dashboard showing gate enforcement stats, agent surface inventory, actionable remediations, prevention impact, and system health for pre-action checks.">
-<link rel="canonical" href="https://thumbgate-production.up.railway.app/dashboard">
+<link rel="canonical" href="https://thumbgate.ai/dashboard">
 <link rel="icon" type="image/png" href="/thumbgate-icon.png">
 <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg">
 <meta name="robots" content="noindex">
+<meta name="referrer" content="same-origin">
 <!-- Privacy-friendly analytics by Plausible -->
-<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
+<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
 <script type="application/ld+json">
 {
   "@context": "https://schema.org",
@@ -18,7 +19,7 @@
   "name": "ThumbGate Dashboard",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform",
-  "url": "https://thumbgate-production.up.railway.app/dashboard",
+  "url": "https://thumbgate.ai/dashboard",
   "dateModified": "2026-04-20",
   "creator": {
     "@type": "Person",
@@ -102,7 +103,7 @@
   .result-tags { display: flex; gap: 6px; margin-top: 10px; flex-wrap: wrap; }
   .tag { font-size: 11px; background: var(--cyan-dim); color: var(--cyan); padding: 2px 8px; border-radius: 4px; cursor: pointer; transition: background 0.15s, transform 0.1s; border: none; font-family: inherit; }
   .tag:hover { background: rgba(34,211,238,0.25); transform: translateY(-1px); }
-  mark { background: rgba(34,211,238,0.25); color: var(--cyan); border-radius: 2px; padding: 0 2px; }
+  mark { background: #fbbf24; color: #000000; font-weight: bold; border-radius: 2px; padding: 0 3px; }
 
   /* GATES */
   .gates-section { margin-bottom: 32px; }
@@ -178,6 +179,74 @@
   .demo-banner a { color: var(--cyan); text-decoration: none; font-weight: 600; }
   .demo-banner a:hover { text-decoration: underline; }
 
+  /* Tooltips styling */
+  .tooltip-trigger {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 14px;
+    height: 14px;
+    border-radius: 50%;
+    background: var(--border);
+    color: var(--text-muted);
+    font-size: 9px;
+    font-weight: bold;
+    cursor: help;
+    margin-left: 6px;
+    position: relative;
+    vertical-align: middle;
+    user-select: none;
+  }
+  .tooltip-trigger:hover {
+    background: var(--cyan);
+    color: var(--bg);
+  }
+  .tooltip-trigger .tooltip-content {
+    visibility: hidden;
+    opacity: 0;
+    width: 220px;
+    background-color: #161618;
+    color: #e8e8ec;
+    text-align: left;
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    padding: 8px 12px;
+    position: absolute;
+    z-index: 1000;
+    bottom: 130%;
+    left: 50%;
+    transform: translateX(-50%);
+    transition: opacity 0.15s, visibility 0.15s;
+    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.6);
+    font-weight: normal;
+    font-size: 11px;
+    line-height: 1.4;
+    white-space: normal;
+    pointer-events: none;
+    font-family: var(--font);
+    text-transform: none;
+    letter-spacing: normal;
+  }
+  .tooltip-trigger .tooltip-content::after {
+    content: "";
+    position: absolute;
+    top: 100%;
+    left: 50%;
+    transform: translateX(-50%);
+    border-width: 5px;
+    border-style: solid;
+    border-color: #161618 transparent transparent transparent;
+  }
+  .tooltip-trigger:hover .tooltip-content {
+    visibility: visible;
+    opacity: 1;
+  }
+  #disconnectBtn:hover {
+    background: rgba(248,113,113,0.1) !important;
+    border-color: #f87171 !important;
+    color: #f87171 !important;
+  }
+
   .empty { text-align: center; padding: 48px; color: var(--text-muted); font-size: 15px; }
   .loading { text-align: center; padding: 24px; color: var(--text-muted); }
   h2 { font-size: 20px; font-weight: 700; margin-bottom: 16px; letter-spacing: -0.02em; }
@@ -189,11 +258,31 @@
   .settings-card .team-value, .origin-value { font-size: 18px; font-weight: 700; color: var(--text); margin-top: 8px; word-break: break-word; }
   .origin-list, .layer-list, .routing-list { display: flex; flex-direction: column; gap: 12px; }
   .origin-note, .layer-note, .routing-note { font-size: 13px; color: var(--text-muted); line-height: 1.55; }
+  .enterprise-chat-layout { display: grid; grid-template-columns: minmax(0, 1.3fr) minmax(260px, 0.7fr); gap: 16px; align-items: start; }
+  .enterprise-chat-box { min-height: 110px; resize: vertical; width: 100%; background: var(--bg-raised); border: 1px solid var(--border); border-radius: 8px; padding: 12px 14px; color: var(--text); font-size: 14px; font-family: var(--font); line-height: 1.5; }
+  .enterprise-chat-box:focus { outline: none; border-color: var(--cyan); }
+  .enterprise-answer { margin-top: 14px; background: var(--bg-raised); border: 1px solid var(--border); border-radius: 10px; padding: 16px; min-height: 92px; font-size: 14px; color: var(--text); line-height: 1.65; }
+  .enterprise-answer.blocked { border-color: rgba(248,113,113,0.45); background: rgba(248,113,113,0.07); }
+  .enterprise-source-list { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 12px; }
+  .enterprise-source { font-size: 11px; border: 1px solid var(--border); border-radius: 999px; padding: 4px 9px; color: var(--text-muted); background: var(--bg-card); }
+
+  .quick-nav-link {
+    cursor: pointer;
+    transition: opacity 0.15s ease, color 0.15s ease;
+  }
+  .quick-nav-link:hover {
+    color: var(--cyan);
+    opacity: 0.95;
+  }
+  .quick-nav-link:hover strong {
+    color: var(--cyan) !important;
+    text-decoration: underline;
+  }
 
   @media (max-width: 700px) {
     .stats-grid { grid-template-columns: repeat(2, 1fr); }
     .search-filters { flex-wrap: wrap; }
-    .team-grid, .template-grid, .team-columns, .settings-grid, .generated-grid, .inventory-grid { grid-template-columns: 1fr; }
+    .team-grid, .template-grid, .team-columns, .settings-grid, .generated-grid, .inventory-grid, .enterprise-chat-layout { grid-template-columns: 1fr; }
   }
 </style>
 </head>
@@ -201,7 +290,7 @@
 
 <nav>
   <div class="container">
-    <a href="/" class="nav-logo"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate Dashboard</span></a>
+    <a href="/" class="nav-logo"><img src="/assets/brand/thumbgate-mark-inline-v3.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate Dashboard</span></a>
     <div class="nav-links">
       <a href="/dashboard" class="active" style="color:var(--cyan);">Dashboard</a>
       <a href="/lessons">Lessons</a>
@@ -214,13 +303,14 @@
 <div class="auth-bar">
   <div class="container">
     <div style="margin-bottom:10px;">
-      <span style="font-size:14px;font-weight:600;">Connect your API key</span>
+      <span id="authTitle" style="font-size:14px;font-weight:600;">Connect your API key</span>
       <span id="authHelp" style="font-size:13px;color:var(--text-muted);margin-left:8px;">Pro auto-connects locally when you launch with <code style="font-family:var(--mono);font-size:12px;background:var(--cyan-dim);color:var(--cyan);padding:2px 6px;border-radius:4px;">npx thumbgate pro</code>. Otherwise paste your <code style="font-family:var(--mono);font-size:12px;background:var(--cyan-dim);color:var(--cyan);padding:2px 6px;border-radius:4px;">THUMBGATE_API_KEY</code> manually.</span>
     </div>
     <div style="display:flex;gap:12px;align-items:center;">
       <input type="password" class="auth-input" id="apiKey" placeholder="Paste your API key here (THUMBGATE_API_KEY or THUMBGATE_PRO_KEY)..." />
       <button class="btn" id="connectBtn" onclick="connect()">Connect</button>
        <button class="btn-outline" id="demoBtn" onclick="loadDemo()">Try Demo</button>
+       <button class="btn-outline" id="disconnectBtn" onclick="disconnectKey()" style="display:none; border-color:#f87171; color:#f87171;">Disconnect Key</button>
        <span class="auth-status" id="authStatus"></span>
     </div>
   </div>
@@ -233,10 +323,10 @@
     <p style="font-size:12px;color:var(--text-muted);margin-bottom:8px;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
     <p style="font-size:14px;color:var(--text-muted);line-height:1.6;max-width:700px;">What's happening right now? Search memories, inspect active checks, manage your team, and export training data. <span style="color:var(--cyan);font-weight:600;">This is your control plane for AI agent behavior.</span></p>
     <div style="display:flex;gap:16px;margin-top:12px;font-size:12px;color:var(--text-muted);">
-      <span>🔍 <strong style="color:var(--text);">Search</strong> — find any memory</span>
-      <span>🛡️ <strong style="color:var(--text);">Gates</strong> — what's blocking</span>
-      <span>👥 <strong style="color:var(--text);">Team</strong> — org metrics</span>
-      <span>📤 <strong style="color:var(--text);">Export</strong> — DPO training data</span>
+      <span class="quick-nav-link" onclick="switchTab('search')">🔍 <strong style="color:var(--text);">Search</strong> — find any memory</span>
+      <span class="quick-nav-link" onclick="switchTab('gates')">🛡️ <strong style="color:var(--text);">Gates</strong> — what's blocking</span>
+      <span class="quick-nav-link" onclick="switchTab('team')">👥 <strong style="color:var(--text);">Team</strong> — org metrics</span>
+      <span class="quick-nav-link" onclick="switchTab('export')">📤 <strong style="color:var(--text);">Export</strong> — DPO training data</span>
     </div>
   </div>
 
@@ -247,16 +337,33 @@
 
   <!-- STATS -->
   <div class="stats-grid" id="statsGrid">
-    <a class="stat-card" data-card-action="all" onclick="selectCard(this,'all')" href="/lessons" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view all feedback → Lessons page"><div class="stat-label">Total Feedback</div><div class="stat-value cyan" id="statTotal">—</div></a>
-    <a class="stat-card" data-card-action="up" onclick="selectCard(this,'up')" href="/lessons?signal=positive" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view positive feedback → Lessons page"><div class="stat-label">👍 Positive</div><div class="stat-value green" id="statPositive">—</div></a>
-    <a class="stat-card" data-card-action="down" onclick="selectCard(this,'down')" href="/lessons?signal=negative" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view negative feedback → Lessons page"><div class="stat-label">👎 Negative</div><div class="stat-value red" id="statNegative">—</div></a>
-    <a class="stat-card" data-card-action="gates" onclick="selectCard(this,'gates');return false;" href="#" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view active checks"><div class="stat-label">Active Gates</div><div class="stat-value cyan" id="statGates">—</div></a>
+    <a class="stat-card" data-card-action="all" onclick="selectCard(this,'all')" href="/lessons?signal=all" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view all feedback → Lessons page"><div class="stat-label">Total Feedback <span class="tooltip-trigger" onclick="event.stopPropagation(); event.preventDefault();">?<span class="tooltip-content">Total thumbs-up and thumbs-down signals captured from your AI agent interactions.</span></span></div><div class="stat-value cyan" id="statTotal">—</div></a>
+    <a class="stat-card" data-card-action="up" onclick="selectCard(this,'up')" href="/lessons?signal=up" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view positive feedback → Lessons page"><div class="stat-label">👍 Positive <span class="tooltip-trigger" onclick="event.stopPropagation(); event.preventDefault();">?<span class="tooltip-content">Successful outcomes where the agent's work met expectations (thumbs-up).</span></span></div><div class="stat-value green" id="statPositive">—</div></a>
+    <a class="stat-card" data-card-action="down" onclick="selectCard(this,'down')" href="/lessons?signal=down" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view negative feedback → Lessons page"><div class="stat-label">👎 Negative <span class="tooltip-trigger" onclick="event.stopPropagation(); event.preventDefault();">?<span class="tooltip-content">Unsuccessful runs or errors that we need to learn from to prevent repeat failures (thumbs-down).</span></span></div><div class="stat-value red" id="statNegative">—</div></a>
+    <a class="stat-card" data-card-action="gates" onclick="selectCard(this,'gates');return false;" href="#" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view active checks"><div class="stat-label">Active Gates <span class="tooltip-trigger" onclick="event.stopPropagation(); event.preventDefault();">?<span class="tooltip-content">Pre-action checks actively monitoring and blocking known-bad tool calls before they run.</span></span></div><div class="stat-value cyan" id="statGates">—</div></a>
+  </div>
+
+  <div class="panel" id="chatPanel" style="margin-bottom:20px;">
+    <div style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;margin-bottom:10px;">
+      <h2 style="margin:0;">💬 Chat with your data</h2>
+      <span style="font-size:13px;color:var(--text-muted);">Ask about your gates, blocks, feedback, and lessons — answered <strong>locally from your own data</strong>, no cloud. (An optional BYO model only kicks in for open-ended questions.)</span>
+    </div>
+    <div id="chatMessages" style="max-height:360px;overflow-y:auto;margin-bottom:12px;display:none;padding-right:4px;"></div>
+    <div style="display:flex;gap:8px;">
+      <input id="chatInput" class="auth-input" style="flex:1;" placeholder="e.g. What mistakes have we made, and how do we avoid them?" onkeydown="if(event.key==='Enter'){event.preventDefault();sendChat();}" />
+      <button class="btn" id="chatSend" onclick="sendChat()">Ask</button>
+    </div>
+    <div id="chatHint" style="font-size:12px;color:var(--text-muted);margin-top:8px;display:flex;align-items:center;gap:8px;">
+      <span>Powered by local dashboard data. Optional Gemini/Perplexity keys only expand open-ended analysis.</span>
+      <input type="password" id="geminiKeyInput" placeholder="Optional GEMINI_API_KEY..." style="background:var(--bg-raised); border:1px solid var(--border); border-radius:4px; padding:4px 8px; color:var(--text); font-family:var(--mono); font-size:11px; flex:1; max-width: 250px;" onkeydown="if(event.key==='Enter'){event.preventDefault();saveGeminiKey();}" />
+      <button class="btn-outline" style="padding:4px 10px;font-size:11px;border-radius:4px;" onclick="saveGeminiKey()">Save</button>
+    </div>
   </div>
 
   <div class="panel" id="reviewDeltaPanel" style="margin-bottom:20px;">
     <div style="display:flex;justify-content:space-between;gap:16px;align-items:flex-start;flex-wrap:wrap;">
       <div>
-        <h3 style="margin:0 0 8px 0;font-size:14px;letter-spacing:0.04em;text-transform:uppercase;color:var(--text-muted);">🆕 Since Last Review</h3>
+        <h3 style="margin:0 0 8px 0;font-size:14px;letter-spacing:0.04em;text-transform:uppercase;color:var(--text-muted);display:inline-flex;align-items:center;">🆕 Since Last Review <span class="tooltip-trigger" onclick="event.stopPropagation(); event.preventDefault();">?<span class="tooltip-content">Shows new feedback, negative signals, lessons, and blocks registered since your last baseline checkpoint.</span></span></h3>
         <p class="template-summary" id="reviewDeltaHeadline" style="margin-bottom:0;">No review checkpoint yet. Mark the current dashboard as reviewed to start seeing only new changes.</p>
       </div>
       <button class="btn-outline" id="reviewCheckpointBtn" onclick="markReviewed()">Mark Current Dashboard Reviewed</button>
@@ -284,6 +391,8 @@
     <div class="tab active" onclick="switchTab('search')">🔍 Search Memories</div>
     <div class="tab" onclick="switchTab('gates')">🛡️ Active Gates</div>
     <div class="tab" onclick="switchTab('team')">👥 Team</div>
+    <div class="tab" onclick="switchTab('enterprise')">🏢 Governed Data Chat</div>
+    <div class="tab" onclick="switchTab('ai-inventory')">🧬 AI Inventory</div>
     <div class="tab" onclick="switchTab('generated')">🧩 Generated Views</div>
     <div class="tab" onclick="switchTab('settings')">⚙️ Policy Origins</div>
     <div class="tab" onclick="switchTab('templates')">🧱 Gate Templates</div>
@@ -293,6 +402,12 @@
 
   <!-- SEARCH TAB -->
   <div class="tab-content active" id="tab-search">
+    <div class="panel" style="margin-bottom:24px;">
+      <h3 style="margin-top:0;">📈 Feedback Trend (Last 30 Days)</h3>
+      <div style="position:relative;height:180px;margin-top:12px;">
+        <canvas id="feedbackTrendChart"></canvas>
+      </div>
+    </div>
     <div class="search-section">
       <div class="search-bar">
         <input type="text" class="search-input" id="searchQuery" placeholder="Search memories... (try: git, test, deploy, secrets, database)" onkeydown="if(event.key==='Enter')search()" />
@@ -314,6 +429,74 @@
   <div class="tab-content" id="tab-gates">
     <div class="gates-section">
       <h2>Active Pre-Action Checks</h2>
+
+      <!-- Interactive Gating Workflow Diagram -->
+      <details class="flow-details" style="margin-bottom: 24px; border: 1px solid var(--border); border-radius: 8px; background: var(--bg-card); padding: 16px;" open>
+        <summary style="font-weight: 600; cursor: pointer; color: var(--cyan); display: flex; align-items: center; gap: 8px; user-select: none;">
+          <span>🛡️ How Pre-Action Gating Works (Interactive Flow Diagram)</span>
+        </summary>
+        <div style="margin-top:20px; text-align:center;">
+          <svg viewBox="0 0 800 220" width="100%" height="auto" style="max-width: 800px; font-family: var(--font); font-size: 11px;">
+            <style>
+              .flow-node { fill: #1c1c1f; stroke: var(--border); stroke-width: 1.5; rx: 8px; transition: stroke 0.2s, fill 0.2s; }
+              .flow-node:hover { fill: rgba(34,211,238,0.06); stroke: var(--cyan); cursor: help; }
+              .flow-text { fill: var(--text); font-weight: 600; pointer-events: none; }
+              .flow-subtext { fill: var(--text-muted); font-size: 10px; pointer-events: none; }
+              .flow-arrow { fill: none; stroke: var(--border); stroke-width: 1.5; marker-end: url(#arrow-head); }
+            </style>
+            
+            <defs>
+              <marker id="arrow-head" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
+                <path d="M 0 1 L 10 5 L 0 9 z" fill="#8b8b96" />
+              </marker>
+            </defs>
+
+            <!-- Step 1: Tool Call -->
+            <g>
+              <rect x="10" y="80" width="130" height="60" class="flow-node" />
+              <text x="75" y="105" text-anchor="middle" class="flow-text">1. Tool Call</text>
+              <text x="75" y="125" text-anchor="middle" class="flow-subtext">Agent requests action</text>
+            </g>
+
+            <path d="M 140 110 L 190 110" class="flow-arrow" />
+
+            <!-- Step 2: Hook Intercept -->
+            <g>
+              <rect x="200" y="80" width="140" height="60" class="flow-node" />
+              <text x="270" y="105" text-anchor="middle" class="flow-text">2. PreToolUse Hook</text>
+              <text x="270" y="125" text-anchor="middle" class="flow-subtext">Intercepts tool execution</text>
+            </g>
+
+            <path d="M 340 110 L 390 110" class="flow-arrow" />
+
+            <!-- Step 3: Policy / DB Lookup -->
+            <g>
+              <rect x="400" y="80" width="150" height="60" class="flow-node" />
+              <text x="475" y="105" text-anchor="middle" class="flow-text">3. Gate Evaluation</text>
+              <text x="475" y="125" text-anchor="middle" class="flow-subtext">Validates matching rules</text>
+            </g>
+
+            <!-- Branch Arrows -->
+            <path d="M 550 100 L 640 55" class="flow-arrow" />
+            <path d="M 550 120 L 640 165" class="flow-arrow" />
+
+            <!-- Step 4a: Block -->
+            <g>
+              <rect x="650" y="20" width="130" height="60" class="flow-node" style="stroke:#ef4444;" />
+              <text x="715" y="45" text-anchor="middle" class="flow-text" style="fill:#ef4444;">❌ BLOCK</text>
+              <text x="715" y="65" text-anchor="middle" class="flow-subtext">Matches rule -> aborted</text>
+            </g>
+
+            <!-- Step 4b: Allow -->
+            <g>
+              <rect x="650" y="140" width="130" height="60" class="flow-node" style="stroke:#22c55e;" />
+              <text x="715" y="165" text-anchor="middle" class="flow-text" style="fill:#22c55e;">✅ ALLOW</text>
+              <text x="715" y="185" text-anchor="middle" class="flow-subtext">Runs safely & logs</text>
+            </g>
+          </svg>
+        </div>
+      </details>
+
       <div id="gatesList"><div class="loading">Loading gates...</div></div>
     </div>
   </div>
@@ -387,6 +570,56 @@
     </div>
   </div>
 
+  <!-- ENTERPRISE CHAT TAB -->
+  <div class="tab-content" id="tab-enterprise">
+    <div class="templates-section">
+      <h2>Governed Data Chat</h2>
+      <p class="template-summary">Ask questions over your local ThumbGate data (lessons, raw feedback via LanceDB vectors, gate stats, receipts). Uses local retrieval plus your configured LLM, including open-source/local endpoints through <code>THUMBGATE_LOCAL_LLM_ENDPOINT</code>. Dialogflow is not the chatbot layer; DFCX/Vertex cards are optional deployment-readiness checks for buyers who run their own Google agent stack.</p>
+      <div class="enterprise-chat-layout">
+        <div class="panel">
+          <h3>Chat With Local ThumbGate Data</h3>
+          <textarea class="enterprise-chat-box" id="enterpriseChatPrompt" placeholder="Ask: What mistakes are recurring? Which gates blocked the most? Are we running local-only or cloud-integrated?"></textarea>
+          <div style="display:flex;gap:10px;align-items:center;margin-top:12px;flex-wrap:wrap;">
+            <button class="btn" id="enterpriseChatBtn" onclick="sendEnterpriseChat()">Ask ThumbGate</button>
+            <button class="btn-outline" onclick="setEnterprisePrompt('Which gates are blocking risky actions?')">Gates</button>
+            <button class="btn-outline" onclick="setEnterprisePrompt('What feedback mistakes keep repeating?')">Feedback</button>
+            <button class="btn-outline" onclick="setEnterprisePrompt('Are we running local-only or cloud-integrated?')">Runtime</button>
+          </div>
+          <div class="enterprise-answer" id="enterpriseChatAnswer">Connect your dashboard, then ask about local ThumbGate data.</div>
+          <div class="enterprise-source-list" id="enterpriseChatSources"></div>
+        </div>
+        <div class="panel">
+          <h3>Runtime Readiness</h3>
+          <div class="inventory-tools" id="enterpriseStatusCards"><div class="loading">Loading enterprise status...</div></div>
+          <div class="template-summary" style="margin-top:14px;margin-bottom:0;">The chat itself is local RAG plus your LLM. Open-source/local models are the default enterprise path; DFCX/Vertex readiness is optional evidence for teams that already operate Google agents in their own tenancy.</div>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <!-- AI INVENTORY TAB -->
+  <div class="tab-content" id="tab-ai-inventory">
+    <div class="templates-section">
+      <h2>AI Component Inventory</h2>
+      <p class="template-summary">Enterprise evidence for AI/ML usage: provider SDKs, agent frameworks, vector databases, Vertex/Gemini/Dialogflow CX references, and local model artifacts. Export this as ML-BOM proof before claiming an AI system is production-ready.</p>
+      <div class="inventory-grid" id="aiInventorySummaryCards"><div class="loading">Scanning AI inventory...</div></div>
+      <div class="team-columns" style="margin-top:16px;">
+        <div class="panel">
+          <h3>Detected Components</h3>
+          <div class="inventory-tools" id="aiInventoryComponents"><div class="loading">Scanning components...</div></div>
+        </div>
+        <div class="panel">
+          <h3>Export Evidence</h3>
+          <div class="template-summary" style="margin-bottom:12px;">CLI export:</div>
+          <pre style="white-space:pre-wrap;background:var(--bg);border:1px solid var(--border);border-radius:8px;padding:12px;font-size:12px;color:var(--text);">npx thumbgate ai-inventory --format=cyclonedx --output=.thumbgate/ai-mlbom.json</pre>
+          <div class="template-summary" style="margin-top:12px;">API export:</div>
+          <pre style="white-space:pre-wrap;background:var(--bg);border:1px solid var(--border);border-radius:8px;padding:12px;font-size:12px;color:var(--text);">GET /v1/dashboard/ai-inventory?format=cyclonedx</pre>
+          <div id="aiInventoryExportNote" class="template-summary" style="margin-top:12px;margin-bottom:0;">Waiting for inventory evidence...</div>
+        </div>
+      </div>
+    </div>
+  </div>
+
   <!-- GENERATED TAB -->
   <div class="tab-content" id="tab-generated">
     <div class="templates-section">
@@ -460,13 +693,7 @@
       </div>
 
       <!-- Charts -->
-      <div class="team-columns" style="margin-bottom:24px;">
-        <div class="panel">
-          <h3>Feedback Trend (30 days)</h3>
-          <div style="position:relative;height:260px;margin-top:12px;">
-            <canvas id="feedbackTrendChart"></canvas>
-          </div>
-        </div>
+      <div style="margin-bottom:24px;">
         <div class="panel">
           <h3>Lessons Generated (30 days)</h3>
           <div style="position:relative;height:260px;margin-top:12px;">
@@ -539,6 +766,91 @@
 </div>
 
 <script>
+// TG_TOKEN_SAVINGS — browser shim that mirrors scripts/token-savings.js
+// so loadDemo()'s TG_TOKEN_SAVINGS.compute(blockedCalls, deflectedBots)
+// call resolves. Pre-2026-05-26 the dashboard referenced this global
+// without ever defining it, silently halting loadDemo() at line ~1452.
+var TG_TOKEN_SAVINGS = (function () {
+  var DEFAULT_MODEL_MIX = { 'claude-sonnet-4-5': 0.80, 'claude-opus-4-6': 0.15, 'claude-haiku-4-5': 0.05 };
+  var DEFAULT_MODEL_PRICES = {
+    'claude-sonnet-4-5': { input: 3.0, output: 15.0 },
+    'claude-opus-4-6':   { input: 5.0, output: 25.0 },
+    'claude-haiku-4-5':  { input: 1.0, output: 5.0 },
+    'gpt-4o':            { input: 2.50, output: 10.0 }
+  };
+  var DEFAULT_AVG_INPUT_TOKENS = 2000;
+  var DEFAULT_AVG_OUTPUT_TOKENS = 600;
+  function clamp(n, fb) { var v = Number(n); return (isFinite(v) && v >= 0) ? v : fb; }
+  function blended(mix, prices) {
+    var i = 0, o = 0, w = 0;
+    for (var m in mix) {
+      var ww = clamp(mix[m], 0); if (ww <= 0) continue;
+      var p = prices[m]; if (!p) continue;
+      i += clamp(p.input, 0) * ww; o += clamp(p.output, 0) * ww; w += ww;
+    }
+    return w > 0 ? { input: i / w, output: o / w } : { input: 0, output: 0 };
+  }
+  function fmtTokens(n) {
+    if (!isFinite(n) || n <= 0) return '0';
+    if (n >= 1e9) return (n / 1e9).toFixed(1) + 'B';
+    if (n >= 1e6) return (n / 1e6).toFixed(1) + 'M';
+    if (n >= 1e3) return (n / 1e3).toFixed(0) + 'K';
+    return String(Math.round(n));
+  }
+  function fmtDollars(n) {
+    if (!isFinite(n)) return '$0.00';
+    if (n >= 1000) return '$' + Math.round(n).toLocaleString('en-US');
+    if (n >= 100) return '$' + n.toFixed(0);
+    if (n >= 10) return '$' + n.toFixed(1);
+    if (n >= 0.01) return '$' + n.toFixed(2);
+    if (n > 0) return '$' + n.toFixed(4);
+    return '$0.00';
+  }
+  function compute(blockedCalls, deflectedBots, opts) {
+    opts = opts || {};
+    var total = clamp(blockedCalls, 0) + clamp(deflectedBots, 0);
+    var avgIn = clamp(opts.avgInputTokensPerBlock, DEFAULT_AVG_INPUT_TOKENS);
+    var avgOut = clamp(opts.avgOutputTokensPerBlock, DEFAULT_AVG_OUTPUT_TOKENS);
+    var mix = (opts.modelMix && Object.keys(opts.modelMix).length) ? opts.modelMix : DEFAULT_MODEL_MIX;
+    var prices = opts.modelPrices || DEFAULT_MODEL_PRICES;
+    var b = blended(mix, prices);
+    var ti = total * avgIn, to = total * avgOut;
+    var dollars = (ti * b.input + to * b.output) / 1e6;
+    return {
+      blockedCalls: clamp(blockedCalls, 0),
+      deflectedBots: clamp(deflectedBots, 0),
+      tokensSavedInput: ti,
+      tokensSavedOutput: to,
+      tokensSavedTotal: ti + to,
+      dollarsSaved: dollars,
+      dollarsSavedDisplay: fmtDollars(dollars),
+      tokensSavedDisplay: fmtTokens(ti + to),
+      blendedPricePer1M: b,
+      modelMix: mix
+    };
+  }
+  return { compute: compute, formatDollars: fmtDollars, formatTokens: fmtTokens };
+})();
+
+// renderTopBlockedGates — defensive stub for the loadDemo() legacy direct
+// call. The current dashboard layout surfaces top-blocked gates via the
+// team panel (renderTeam → team.topBlockedGates) and has no dedicated
+// #topBlockedGates element. Stub keeps loadDemo() from throwing while
+// also rendering into a target element if one is ever added.
+function renderTopBlockedGates(gates) {
+  if (!Array.isArray(gates)) return;
+  var target = document.getElementById('topBlockedGates')
+    || document.getElementById('topBlockedList');
+  if (!target || typeof escHtml !== 'function') return;
+  target.innerHTML = gates.map(function (g) {
+    return '<div class="blocked-row"><div><div class="blocked-name">'
+      + escHtml(g.name || '')
+      + '</div></div><div class="blocked-meta">'
+      + (g.blocked || 0)
+      + '</div></div>';
+  }).join('');
+}
+
 let API_KEY = '';
 let currentSource = 'all';
 let isDemo = false;
@@ -548,38 +860,237 @@ let currentGeneratedView = 'team-review';
 const BOOTSTRAP_API_KEY = __DASHBOARD_BOOTSTRAP_KEY__;
 const LOCAL_PRO_BOOTSTRAP = __DASHBOARD_BOOTSTRAP_ENABLED__;
 
+let ACTIVE_PROJECT_DIR = '';
+try {
+  var urlParams = new URLSearchParams(window.location.search);
+  ACTIVE_PROJECT_DIR = urlParams.get('project') || '';
+} catch (e) {}
+
+function preserveProjectQueryParams() {
+  if (!ACTIVE_PROJECT_DIR) return;
+  var links = document.querySelectorAll('a[href^="/dashboard"], a[href^="/lessons"], a[href="/"]');
+  links.forEach(function(link) {
+    try {
+      var url = new URL(link.href, window.location.origin);
+      url.searchParams.set('project', ACTIVE_PROJECT_DIR);
+      link.href = url.pathname + url.search + url.hash;
+    } catch (e) {}
+  });
+}
+
 function getHeaders() {
-  return { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' };
+  var headers = { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' };
+  if (ACTIVE_PROJECT_DIR) {
+    headers['x-thumbgate-project-dir'] = ACTIVE_PROJECT_DIR;
+  }
+  return headers;
+}
+
+// --- Chat with your data ---------------------------------------------------
+function chatEscape(s) {
+  return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
+    return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+  });
+}
+function chatAppend(who, text) {
+  var messages = document.getElementById('chatMessages');
+  var row = document.createElement('div');
+  row.style.cssText = 'margin-bottom:14px;';
+  row.innerHTML = '<div style="font-size:11px;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:3px;">'
+    + (who === 'you' ? 'You' : 'ThumbGate') + '</div><div class="chat-body" style="line-height:1.5;">' + chatEscape(text) + '</div>';
+  messages.appendChild(row);
+  return row.querySelector('.chat-body');
+}
+function chatRenderAnswer(a) {
+  return chatEscape(a)
+    .replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
+    .replace(/\[(\d+)\]/g, '<sup style="color:var(--cyan);font-weight:600;">[$1]</sup>')
+    .replace(/\n/g, '<br>');
+}
+function chatRenderSources(sources, answerText) {
+  if (!sources || !sources.length) return '';
+  var citedNums = new Set();
+  var regex = /\[(\d+)\]/g;
+  var match;
+  while ((match = regex.exec(answerText || '')) !== null) {
+    citedNums.add(parseInt(match[1], 10));
+  }
+
+  var items = sources.map(function (s, i) {
+    var num = i + 1;
+    var isCited = citedNums.has(num);
+    var label = chatEscape(String(s.title || s.id || '').slice(0, 64));
+    
+    var bg = isCited ? 'var(--cyan-dim)' : 'var(--bg-raised)';
+    var color = isCited ? 'var(--cyan)' : 'var(--text-muted)';
+    var border = isCited ? '1px solid var(--cyan)' : '1px solid var(--border)';
+    var weight = isCited ? '600' : 'normal';
+
+    return '<span title="' + label + '" style="display:inline-block;font-size:11px;background:' + bg + ';color:' + color + ';border:' + border + ';font-weight:' + weight + ';padding:2px 7px;border-radius:5px;margin:4px 5px 0 0;">[' + num + '] ' + label + '</span>';
+  }).join('');
+
+  return '<div style="margin-top:12px;border-top:1px dashed var(--border);padding-top:10px;">' +
+         '<div style="font-size:11px;color:var(--text-muted);margin-bottom:6px;font-weight:600;">Database logs analyzed to answer your question:</div>' +
+         items +
+         '</div>';
+}
+async function sendChat() {
+  var input = document.getElementById('chatInput');
+  var q = (input.value || '').trim();
+  if (!q) return;
+  var messages = document.getElementById('chatMessages');
+  var sendBtn = document.getElementById('chatSend');
+  messages.style.display = 'block';
+  chatAppend('you', q);
+  input.value = '';
+  sendBtn.disabled = true;
+  var pending = chatAppend('bot', 'Thinking…');
+  try {
+    var res = await fetch('/v1/chat', { method: 'POST', headers: getHeaders(), body: JSON.stringify({ question: q }) });
+    var data = await res.json();
+    if (data && data.ok) {
+      pending.innerHTML = chatRenderAnswer(data.answer) + chatRenderSources(data.sources, data.answer);
+    } else if (data && data.error === 'gemini_error') {
+      pending.innerHTML = '<em style="color:#f87171;">Gemini rejected the key: ' + chatEscape(data.message || 'invalid') +
+        '<br>Fix: paste a valid key in the "Set GEMINI_API_KEY..." box below (get one at <a href="https://aistudio.google.com/app/apikey" target="_blank" style="color:#67e8f9;">AI Studio</a>) and click Save.</em>';
+    } else {
+      pending.innerHTML = '<em style="color:var(--text-muted);">' + chatEscape((data && data.message) || 'Chat is unavailable.') + '</em>';
+    }
+  } catch (e) {
+    pending.innerHTML = '<em style="color:var(--text-muted);">Chat request failed: ' + chatEscape(String((e && e.message) || e)) + '</em>';
+  } finally {
+    sendBtn.disabled = false;
+    messages.scrollTop = messages.scrollHeight;
+  }
+}
+
+async function saveGeminiKey() {
+  var input = document.getElementById('geminiKeyInput');
+  var val = (input.value || '').trim();
+  if (!val) return;
+  var oldPlaceholder = input.placeholder;
+  input.disabled = true;
+  input.placeholder = 'Saving...';
+  try {
+    var res = await fetch('/v1/settings/gemini-key', {
+      method: 'POST',
+      headers: getHeaders(),
+      body: JSON.stringify({ key: val })
+    });
+    var data = await res.json();
+    if (data && data.ok) {
+      input.value = '';
+      input.placeholder = '✓ Key saved to .env';
+      setTimeout(function() {
+        document.getElementById('chatHint').innerHTML = '<span style="color:var(--green)">✓ Key validated. Hybrid (Perplexity/Gemini) supported for chat with your data.</span>';
+      }, 2000);
+    } else {
+      input.placeholder = '✗ Failed: ' + (data.message || data.error || 'Unknown error');
+    }
+  } catch (e) {
+    input.placeholder = '✗ Network error';
+  } finally {
+    input.disabled = false;
+    setTimeout(function() { if (input.placeholder.startsWith('✗')) input.placeholder = oldPlaceholder; }, 3000);
+  }
 }
 
 function hasBootstrapKey() {
   return LOCAL_PRO_BOOTSTRAP && Boolean(BOOTSTRAP_API_KEY);
 }
 
+async function checkLocalLlmReachable(url) {
+  try {
+    var controller = new AbortController();
+    var timeout = setTimeout(function() { controller.abort(); }, 400);
+    // Use no-cors mode to bypass CORS block (only care if network request succeeds/fails)
+    await fetch(url, { method: 'GET', signal: controller.signal, mode: 'no-cors' });
+    clearTimeout(timeout);
+    return true;
+  } catch (e) {
+    return false;
+  }
+}
+
+function disconnectKey() {
+  API_KEY = '';
+  isDemo = false;
+  var input = document.getElementById('apiKey');
+  input.value = '';
+  input.disabled = false;
+  input.placeholder = "Paste your API key here (THUMBGATE_API_KEY or THUMBGATE_PRO_KEY)...";
+  var btn = document.getElementById('connectBtn');
+  btn.disabled = false;
+  document.getElementById('demoBtn').style.display = 'inline-block';
+  document.getElementById('disconnectBtn').style.display = 'none';
+  document.getElementById('authStatus').className = 'auth-status';
+  document.getElementById('authStatus').textContent = 'Disconnected';
+  document.getElementById('authTitle').textContent = 'Connect your API key';
+  document.getElementById('authHelp').innerHTML = 'Pro auto-connects locally when you launch with <code style="font-family:var(--mono);font-size:12px;background:var(--cyan-dim);color:var(--cyan);padding:2px 6px;border-radius:4px;">npx thumbgate pro</code>. Otherwise paste your <code style="font-family:var(--mono);font-size:12px;background:var(--cyan-dim);color:var(--cyan);padding:2px 6px;border-radius:4px;">THUMBGATE_API_KEY</code> manually.';
+  document.getElementById('dashboardContent').style.display = 'none';
+}
+
 async function connect(options) {
   var opts = options || {};
   var input = document.getElementById('apiKey');
   API_KEY = String(opts.key || input.value || '').trim();
   if (!API_KEY) return;
+  
+  var isEnterprise = API_KEY.startsWith('tg_op_') || API_KEY.startsWith('tg_creator_');
+  var tierName = isEnterprise ? 'Enterprise' : 'Pro';
+
   const status = document.getElementById('authStatus');
   const btn = document.getElementById('connectBtn');
   btn.disabled = true;
   status.className = 'auth-status';
-  status.textContent = opts.localPro ? 'Connecting local dashboard...' : 'Connecting...';
+  status.textContent = opts.localPro ? `Connecting local dashboard...` : 'Connecting...';
   try {
     const res = await fetch('/v1/feedback/stats', { headers: getHeaders() });
     if (!res.ok) throw new Error('Invalid API key');
     const data = await res.json();
+    
+    if (data.tier) {
+      isEnterprise = (data.tier === 'Enterprise');
+      tierName = data.tier;
+    }
+    
+    if (data.localLlmConfigured) {
+      var modelLabel = data.localLlmModel ? ' (' + data.localLlmModel + ')' : '';
+      var llmUrl = data.localLlmEndpoint || 'http://localhost:11434/v1';
+      document.getElementById('chatHint').innerHTML = '<span style="color:var(--text-muted)">Checking local LLM reachability...</span>';
+      checkLocalLlmReachable(llmUrl.replace(/\/v1$/, '')).then(function(reachable) {
+        if (reachable) {
+          document.getElementById('chatHint').innerHTML = '<span style="color:var(--green)">✓ Local LLM' + modelLabel + ' ready. Chat answers are generated locally — no cloud calls.</span>';
+        } else {
+          document.getElementById('chatHint').innerHTML = '<span style="color:#f59e0b">⚠ Ollama is offline. Launch it to chat locally: <code style="font-family:var(--mono);font-size:12px;background:rgba(245,158,11,0.1);color:#f59e0b;padding:2px 6px;border-radius:4px;">ollama run qwen2.5-coder:14b</code></span>';
+        }
+      });
+    } else if (data.geminiKeyStatus === 'validated' || data.geminiValidatedAt) {
+      var when = data.geminiValidatedAt ? ' (validated ' + new Date(data.geminiValidatedAt).toLocaleTimeString() + ')' : '';
+      document.getElementById('chatHint').innerHTML = '<span style="color:var(--green)">✓ Gemini API key validated' + when + '. You can now chat with your data.</span>';
+    } else if (data.perplexityConfigured) {
+      document.getElementById('chatHint').innerHTML = '<span style="color:var(--green)">✓ Perplexity hybrid (local-cloud) key present. Supports hybrid inference for chat with your data.</span>';
+    } else if (data.geminiConfigured) {
+      document.getElementById('chatHint').innerHTML = '<span style="color:#f59e0b">⚠ Gemini key present in .env (click Save below to validate it). Perplexity hybrid also supported for cost/privacy.</span>';
+    }
+
     status.className = 'auth-status ok';
-    status.textContent = opts.localPro ? '✓ Local Pro dashboard connected' : '✓ Connected';
+    status.textContent = opts.localPro ? `✓ Local ${tierName} connected` : '✓ Connected';
+    document.getElementById('disconnectBtn').style.display = 'inline-block';
+    const titleEl = document.getElementById('authTitle');
+    if (titleEl) {
+      titleEl.textContent = opts.localPro ? `${tierName} License Active` : 'API Key Connected';
+    }
     document.getElementById('dashboardContent').style.display = 'block';
     if (opts.localPro) {
+      const localProActiveMessage = 'Local Pro is active on this machine. Your dashboard is using the saved license key automatically.';
+      const localEnterpriseActiveMessage = 'Local Enterprise is active on this machine. Your dashboard is using the saved license key automatically. Click Disconnect to switch keys.';
       input.value = 'local-license';
       input.disabled = true;
-      input.placeholder = 'Local Pro auto-connected';
+      input.placeholder = `Local ${tierName} auto-connected`;
       btn.disabled = true;
       document.getElementById('demoBtn').style.display = 'none';
-      document.getElementById('authHelp').textContent = 'Local Pro is active on this machine. Your personal dashboard is using the saved license key automatically.';
+      document.getElementById('authHelp').textContent = isEnterprise ? localEnterpriseActiveMessage : localProActiveMessage;
     }
     renderStats(data);
     setSelectedCard('all');
@@ -591,8 +1102,12 @@ async function connect(options) {
   } catch (e) {
     status.className = 'auth-status err';
     status.textContent = '✗ ' + e.message;
+    const titleEl = document.getElementById('authTitle');
+    if (titleEl) {
+      titleEl.textContent = 'Connect your API key';
+    }
     if (opts.localPro) {
-      document.getElementById('authHelp').textContent = 'Local Pro bootstrap failed. Paste your THUMBGATE_API_KEY manually or retry the local launcher.';
+      document.getElementById('authHelp').textContent = `Local ${tierName} bootstrap failed. Paste your THUMBGATE_API_KEY manually or retry the local launcher.`;
     }
   }
   if (!opts.localPro) {
@@ -656,24 +1171,88 @@ async function search() {
 }
 
 function renderResult(r) {
-  const signal = r.signal || r.type || '';
+  let contextText = r.context || r.text || r.content || '';
+  let signal = r.signal || r.type || '';
+
+  if (contextText && contextText.trim().startsWith('{')) {
+    const originalText = contextText;
+    try {
+      let cleanText = contextText.trim();
+      if (cleanText.endsWith('…')) {
+        cleanText = cleanText.slice(0, -1);
+      }
+      if (cleanText.endsWith(',...')) {
+        cleanText = cleanText.slice(0, -4);
+      }
+      let parsed = null;
+      try {
+        parsed = JSON.parse(cleanText);
+      } catch (_) {
+        try { parsed = JSON.parse(cleanText + '"}'); } catch (_) {}
+        try { parsed = JSON.parse(cleanText + '}'); } catch (_) {}
+        try { parsed = JSON.parse(cleanText + '"} }'); } catch (_) {}
+      }
+      if (parsed && (parsed.context || parsed.text || parsed.content || parsed.message)) {
+        contextText = parsed.context || parsed.text || parsed.content || parsed.message;
+      } else {
+        let contextMatch = originalText.match(/"context"\s*:\s*"((?:[^"\\]|\\.)*?)"/);
+        if (!contextMatch) {
+          contextMatch = originalText.match(/"context"\s*:\s*"((?:[^"\\]|\\.)*)/);
+        }
+        if (!contextMatch || !contextMatch[1]) {
+          let otherMatch = originalText.match(/"(?:text|content|message)"\s*:\s*"((?:[^"\\]|\\.)*?)"/);
+          if (!otherMatch) {
+            otherMatch = originalText.match(/"(?:text|content|message)"\s*:\s*"((?:[^"\\]|\\.)*)/);
+          }
+          if (otherMatch && otherMatch[1]) {
+            contextMatch = otherMatch;
+          }
+        }
+        if (contextMatch && contextMatch[1]) {
+          let val = contextMatch[1];
+          val = val.replace(/(?:"\s*,\s*"[^"]*"\s*:?|"\s*,\s*|"\s*\}?\s*|\s*,\s*|\s*\}?\s*)$/, '');
+          val = val.replace(/(?:\.\.\.|…|",\.\.\.|",…|"\s*,\s*\.\.\.|"\s*,\s*…)$/, '');
+          contextText = val.replace(/\\"/g, '"').replace(/\\\\/g, '\\');
+        }
+      }
+      if (parsed && parsed.signal) {
+        signal = parsed.signal;
+      } else {
+        const signalMatch = originalText.match(/"signal"\s*:\s*"([^"]+)"/);
+        if (signalMatch && !signal) {
+          signal = signalMatch[1];
+        }
+      }
+    } catch (_) {}
+  }
+
   const isUp = signal === 'up' || signal === 'positive' || signal === 'thumbs_up';
   const isDown = signal === 'down' || signal === 'negative' || signal === 'thumbs_down';
   const signalClass = isUp ? 'up' : isDown ? 'down' : '';
   const signalLabel = isUp ? '👍 Positive' : isDown ? '👎 Negative' : signal;
-  const title = r.title || r.context || r.text || '';
-  const context = r.context || r.text || r.content || '';
+
+  let displayTitle = r.title || contextText || '';
+  if (displayTitle && displayTitle.startsWith('feedback_')) {
+    const parts = displayTitle.split('_');
+    if (parts.length >= 3) {
+      const type = parts[1];
+      const id = parts.slice(2).join('_');
+      displayTitle = (type === 'positive' ? '👍' : '👎') + ' Feedback (' + id + ')';
+    }
+  }
+
   const tags = r.tags || [];
   const date = r.timestamp ? new Date(r.timestamp).toLocaleDateString() : '';
+
   return '<div class="result-card">' +
     '<div class="result-header">' +
       (signalLabel ? '<span class="result-signal ' + signalClass + '">' + signalLabel + '</span>' : '<span></span>') +
       '<span class="result-date">' + date + '</span>' +
     '</div>' +
-    (title ? '<div class="result-title">' + highlightText(title) + '</div>' : '') +
-    (context && context !== title ? '<div class="result-context">' + highlightText(context.slice(0, 300)) + '</div>' : '') +
+    (displayTitle ? '<div class="result-title">' + highlightText(displayTitle) + '</div>' : '') +
+    (contextText && contextText !== displayTitle ? '<div class="result-context">' + highlightText(contextText.slice(0, 300)) + '</div>' : '') +
     (tags.length ? '<div class="result-tags">' + tags.map(function(t) {
-      return '<button type="button" class="tag" data-tag="' + encodeURIComponent(String(t)) + '" title="' + escAttr('Search for ' + t) + '">' + escHtml(t) + '</button>';
+      return '<button type="button" class="tag" data-tag="' + encodeURIComponent(String(t)) + '" title="' + escAttr('Search for ' + t) + '">' + highlightText(t) + '</button>';
     }).join('') + '</div>' : '') +
   '</div>';
 }
@@ -750,10 +1329,23 @@ function setSource(el, source) {
 function switchTab(name) {
   document.querySelectorAll('.tab').forEach(function(t) { t.classList.remove('active'); });
   document.querySelectorAll('.tab-content').forEach(function(c) { c.classList.remove('active'); });
-  var tabEl = document.querySelector('[onclick*="' + name + '"]');
+  // Scope the header lookup to .tab — the prior selector
+  // [onclick*="<name>"] also matched the stat-cards (which carry onclick
+  // attributes like selectCard(this,'gates')), and a stat-card appears
+  // before the tab header in DOM order, so for 'gates' the wrong element
+  // (the card) got the .active class and the tab header stayed dormant.
+  var tabEl = document.querySelector('.tab[onclick*="' + name + '"]');
   var contentEl = document.getElementById('tab-' + name);
   if (tabEl) tabEl.classList.add('active');
-  if (contentEl) contentEl.classList.add('active');
+  if (contentEl) {
+    contentEl.classList.add('active');
+    // Stat-card clicks fire switchTab from above the fold; without this scroll
+    // the user sees "nothing happen" because the just-activated content sits
+    // below the viewport. Same class of bug as the /lessons tile fix in #2268.
+    try {
+      contentEl.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    } catch (_e) { /* older browsers without smooth-scroll: no-op */ }
+  }
   // Sync URL hash so deep-links stay shareable without scroll jump
   try {
     if (('#' + name) !== window.location.hash) {
@@ -765,11 +1357,11 @@ function switchTab(name) {
 /**
  * Resolve deep-link tab target from URL hash or query string.
  * Supports: /dashboard#insights, /dashboard?tab=gates, /dashboard#tab-export.
- * Valid targets match tab-content ids (search, gates, team, generated,
- * settings, templates, insights, export).
+ * Valid targets match tab-content ids (search, gates, team, enterprise,
+ * ai-inventory, generated, settings, templates, insights, export).
  */
 function getDeepLinkTab() {
-  var valid = ['search', 'gates', 'team', 'generated', 'settings', 'templates', 'insights', 'export'];
+  var valid = ['search', 'gates', 'team', 'enterprise', 'ai-inventory', 'generated', 'settings', 'templates', 'insights', 'export'];
   var raw = (window.location.hash || '').replace(/^#/, '').replace(/^tab-/, '');
   if (!raw) {
     try {
@@ -936,9 +1528,14 @@ async function markReviewed() {
   try {
     var res = await fetch('/v1/dashboard/review-state', {
       method: 'POST',
-      headers: getHeaders()
+      headers: getHeaders(),
+      body: JSON.stringify({ reviewedAt: new Date().toISOString() })
     });
-    if (!res.ok) throw new Error('Failed to save review checkpoint');
+    if (!res.ok) {
+      var errText = '';
+      try { errText = await res.text(); } catch (_) { errText = ''; }
+      throw new Error(errText || 'Failed to save review checkpoint');
+    }
     var body = await res.json();
     renderReviewDelta(body.reviewDelta || {});
   } catch (e) {
@@ -976,6 +1573,68 @@ function renderDashboardData(data) {
   renderRegulatedProof(data.regulatedProof || {});
   renderTemplates(data.templateLibrary || {});
   renderInsights(data);
+  loadAiInventory();
+  loadEnterpriseDataChatStatus();
+}
+
+async function loadAiInventory() {
+  var summaryEl = document.getElementById('aiInventorySummaryCards');
+  var componentsEl = document.getElementById('aiInventoryComponents');
+  var exportEl = document.getElementById('aiInventoryExportNote');
+  if (!summaryEl || !componentsEl) return;
+
+  try {
+    var res = await fetch('/v1/dashboard/ai-inventory', { headers: getHeaders() });
+    if (!res.ok) {
+      var text = await res.text();
+      throw new Error(text || 'Failed to load AI inventory');
+    }
+    var inventory = await res.json();
+    renderAiInventory(inventory);
+  } catch (e) {
+    var message = e && e.message ? e.message : 'Failed to load AI inventory';
+    setMessageState(summaryEl, 'empty', message);
+    setMessageState(componentsEl, 'empty', message);
+    if (exportEl) exportEl.textContent = message;
+  }
+}
+
+function renderAiInventory(inventory) {
+  var summaryEl = document.getElementById('aiInventorySummaryCards');
+  var componentsEl = document.getElementById('aiInventoryComponents');
+  var exportEl = document.getElementById('aiInventoryExportNote');
+  var components = Array.isArray(inventory.components) ? inventory.components : [];
+  var byCategory = inventory.summary && inventory.summary.byCategory ? inventory.summary.byCategory : {};
+  var modelArtifacts = byCategory.model_artifact || 0;
+  var vectorDbs = byCategory.vector_database || 0;
+
+  summaryEl.innerHTML = [
+    '<div class="team-card"><div class="team-kicker">Files scanned</div><div class="team-value">' + escHtml(String(inventory.filesScanned || 0)) + '</div><div class="team-note">source, manifests, model artifacts</div></div>',
+    '<div class="team-card"><div class="team-kicker">AI components</div><div class="team-value">' + escHtml(String(inventory.componentCount || components.length)) + '</div><div class="team-note">inventory evidence items</div></div>',
+    '<div class="team-card"><div class="team-kicker">Vector stores</div><div class="team-value">' + escHtml(String(vectorDbs)) + '</div><div class="team-note">retrieval governance surface</div></div>',
+    '<div class="team-card"><div class="team-kicker">Model artifacts</div><div class="team-value">' + escHtml(String(modelArtifacts)) + '</div><div class="team-note">local ML-BOM artifacts</div></div>'
+  ].join('');
+
+  if (!components.length) {
+    componentsEl.innerHTML = '<div class="empty">No AI/ML components detected in this project root.</div>';
+  } else {
+    componentsEl.innerHTML = components.map(function(item) {
+      var evidence = Array.isArray(item.evidence) ? item.evidence.slice(0, 4) : [];
+      var evidenceHtml = evidence.map(function(e) {
+        var loc = e.line ? (e.file + ':' + e.line) : e.file;
+        return '<li><code>' + escHtml(loc || 'unknown') + '</code> <span style="color:var(--text-muted);">[' + escHtml(e.kind || 'evidence') + ']</span></li>';
+      }).join('');
+      return '<div class="tool-card">' +
+        '<div class="tool-title">' + escHtml(item.name || item.id || 'AI component') + '</div>' +
+        '<div class="tool-meta">' + escHtml(item.category || 'unknown') + ' · ' + escHtml(item.ecosystem || 'unknown') + '</div>' +
+        '<ul style="margin:8px 0 0 18px;padding:0;">' + evidenceHtml + '</ul>' +
+      '</div>';
+    }).join('');
+  }
+
+  if (exportEl) {
+    exportEl.textContent = 'Ready: export ' + String(inventory.componentCount || components.length) + ' component(s) as CycloneDX ML-BOM evidence.';
+  }
 }
 
 function renderGeneratedViewToolbar(spec) {
@@ -1415,6 +2074,108 @@ function renderTemplates(templateLibrary) {
     : '<div class="empty">No check templates available</div>';
 }
 
+function renderEnterpriseStatus(status) {
+  var target = document.getElementById('enterpriseStatusCards');
+  if (!target) return;
+  var vertex = status && status.vertex ? status.vertex : {};
+  var dfcx = status && status.dfcx ? status.dfcx : {};
+  var localLlm = status && status.chat ? status.chat.localLlmEndpointConfigured : false;
+  var connectionMode = localLlm
+    ? 'Local/open-source LLM configured'
+    : (dfcx.liveAgentConfigured ? 'Google agent guard configured' : (vertex.configured ? 'Vertex routing configured' : 'Local deterministic fallback'));
+  var rows = [
+    { name: 'Chat runtime', value: connectionMode, note: localLlm ? 'Using THUMBGATE_LOCAL_LLM_ENDPOINT for local/open-source inference.' : 'Local deterministic summaries work without cloud credentials; configure a local LLM for generated answers.' },
+    { name: 'Data boundary', value: 'Local by default', note: 'Dashboard answers are grounded in local ThumbGate data and do not require Google Cloud.' },
+    { name: 'Vertex adapter', value: vertex.configured ? 'Configured' : 'Optional', note: vertex.projectId ? ('Project: ' + vertex.projectId + ' · ' + (vertex.location || '')) : 'Only needed when the buyer chooses Google-hosted routing.' },
+    { name: 'Dialogflow guard adapter', value: dfcx.liveAgentConfigured ? 'Configured' : 'Optional', note: dfcx.verification || 'Only needed for customer-owned Dialogflow CX agent deployments.' },
+    { name: 'Legacy gcloud CX command', value: 'Unsupported', note: 'Do not use the old alpha gcloud CX command group; use REST API or console for DFCX proof.' }
+  ];
+
+  function draw() {
+    target.innerHTML = rows.map(function(row) {
+      return '<div class="inventory-row"><div><div class="inventory-name">' + escHtml(row.name) + '</div><div class="inventory-subtitle">' + escHtml(row.note) + '</div></div><span class="remediation-action">' + escHtml(row.value) + '</span></div>';
+    }).join('');
+  }
+
+  draw();
+
+  if (localLlm) {
+    var llmUrl = 'http://localhost:11434/v1';
+    checkLocalLlmReachable(llmUrl).then(function(reachable) {
+      if (reachable) {
+        rows[0].value = '✓ Local LLM Online';
+        draw();
+      } else {
+        rows[0].value = '⚠ Local LLM Offline';
+        rows[0].note = 'Ollama is offline. Launch it to chat locally: ollama run qwen2.5-coder:14b';
+        draw();
+      }
+    });
+  }
+}
+
+async function loadEnterpriseDataChatStatus() {
+  if (!API_KEY || isDemo) {
+    renderEnterpriseStatus({ vertex: {}, dfcx: { verification: 'Connect to load local status.' } });
+    return;
+  }
+  try {
+    var res = await fetch('/v1/enterprise/data-chat/status', { headers: getHeaders() });
+    if (!res.ok) throw new Error('status unavailable');
+    renderEnterpriseStatus(await res.json());
+  } catch (err) {
+    var target = document.getElementById('enterpriseStatusCards');
+    if (target) target.innerHTML = '<div class="empty">Enterprise status unavailable.</div>';
+  }
+}
+
+function setEnterprisePrompt(prompt) {
+  var input = document.getElementById('enterpriseChatPrompt');
+  if (input) input.value = prompt;
+}
+
+async function sendEnterpriseChat() {
+  var input = document.getElementById('enterpriseChatPrompt');
+  var answer = document.getElementById('enterpriseChatAnswer');
+  var sources = document.getElementById('enterpriseChatSources');
+  var button = document.getElementById('enterpriseChatBtn');
+  var prompt = input ? input.value.trim() : '';
+  if (!prompt) {
+    answer.textContent = 'Ask a question first.';
+    return;
+  }
+  if (!API_KEY) {
+    answer.textContent = 'Connect your dashboard before using Enterprise Chat.';
+    return;
+  }
+  button.disabled = true;
+  answer.className = 'enterprise-answer';
+  answer.textContent = 'Local RAG (LanceDB + lessons) plus your LLM...';
+  sources.innerHTML = '';
+  try {
+    var res = await fetch('/v1/chat', {
+      method: 'POST',
+      headers: getHeaders(),
+      body: JSON.stringify({ question: prompt })
+    });
+    var data = await res.json();
+    if (!res.ok) throw new Error(data.detail || data.error || data.message || 'chat failed');
+    answer.className = 'enterprise-answer';
+    answer.textContent = data.answer || data.message || 'No answer returned.';
+    var list = Array.isArray(data.sources) ? data.sources : [];
+    sources.innerHTML = list.map(function(source) {
+      var label = typeof source === 'string' ? source : (source && (source.title || source.id || ''));
+      return '<span class="enterprise-source">' + escHtml(label) + '</span>';
+    }).join('');
+    loadEnterpriseDataChatStatus();
+  } catch (err) {
+    answer.className = 'enterprise-answer blocked';
+    answer.textContent = err.message || 'Chat failed. Configure a local LLM endpoint or API key for RAG.';
+  } finally {
+    button.disabled = false;
+  }
+}
+
 document.addEventListener('click', function(event) {
   var tagButton = event.target.closest('.tag[data-tag]');
   if (!tagButton) return;
@@ -1428,71 +2189,65 @@ function loadDemo() {
   // Demo badge in nav
   var logo = document.querySelector('.nav-logo');
   if (!document.getElementById('demoBadge')) {
-    logo.insertAdjacentHTML('afterend', '<span class="demo-badge" id="demoBadge">Demo Mode</span>');
+    logo.insertAdjacentHTML('afterend', '<span class="demo-badge" id="demoBadge">Demo Mode — Jamie M., Partner · Litigation Intake</span>');
   }
   // Stats
-  document.getElementById('statTotal').textContent = '297';
-  document.getElementById('statPositive').textContent = '37';
-  document.getElementById('statNegative').textContent = '260';
-  document.getElementById('statGates').textContent = '21';
+  document.getElementById('statTotal').textContent = '184';
+  document.getElementById('statPositive').textContent = '91';
+  document.getElementById('statNegative').textContent = '93';
+  document.getElementById('statGates').textContent = '14';
   setSelectedCard('all');
-  // Demo: 260 negative-feedback events have produced ~180 actual gate blocks
-  // and ~85 bot deflections on /checkout/pro. Kept as illustrative defaults
-  // so the savings card never reads "0" in demo mode.
-  var demoSavings = TG_TOKEN_SAVINGS.compute(180, 85);
+  var demoSavings = TG_TOKEN_SAVINGS.compute(93, 42);
   var tEl = document.getElementById('statTokensSaved');
   var dEl = document.getElementById('statDollarsSaved');
   if (tEl) tEl.textContent = demoSavings.tokensSavedDisplay;
   if (dEl) dEl.textContent = '≈ ' + demoSavings.dollarsSavedDisplay + ' saved';
   renderTopBlockedGates([
-    { name: 'gate:no-force-push', blocked: 47 },
-    { name: 'gate:no-drop-prod', blocked: 31 },
-    { name: 'gate:no-hallucinated-import', blocked: 28 },
-    { name: 'gate:no-secret-commit', blocked: 19 },
-    { name: 'gate:require-tests-before-done', blocked: 14 },
-    { name: 'gate:no-figma-claim-without-check', blocked: 9 },
+    { name: 'gate:block-unauthorized-practice', blocked: 34 },
+    { name: 'gate:require-conflict-clearance', blocked: 22 },
+    { name: 'gate:block-privileged-egress', blocked: 17 },
+    { name: 'gate:require-approved-disclaimer', blocked: 11 },
+    { name: 'gate:restrict-model-endpoint', blocked: 6 },
+    { name: 'gate:require-attorney-review', blocked: 3 },
   ]);
   renderReviewDelta({
     hasBaseline: true,
-    reviewedAt: '2025-06-18T09:00:00Z',
-    previousHead: '9f1a2c3d',
-    currentHead: '5c7e9b1a',
-    feedbackAdded: 6,
-    negativeAdded: 4,
-    lessonsAdded: 2,
-    blocksAdded: 5,
-    warnsAdded: 1,
-    headline: 'Since your last review: 6 feedback events · 4 negative · 2 lessons · 5 gate blocks.',
+    reviewedAt: '2026-05-22T09:00:00Z',
+    previousHead: 'a4c1e7f2',
+    currentHead: 'b8d3f9a1',
+    feedbackAdded: 8,
+    negativeAdded: 5,
+    lessonsAdded: 3,
+    blocksAdded: 7,
+    warnsAdded: 2,
+    headline: 'Since your last review: 8 intake events · 5 blocked · 3 lessons · 7 gate enforcements.',
     latestFeedback: {
-      title: 'Claimed fix worked without running tests',
-      timestamp: '2025-06-22T10:20:00Z'
+      title: 'Intake agent provided jurisdictional recommendation without attorney review',
+      timestamp: '2026-05-25T14:20:00Z'
     },
     latestLesson: {
-      title: 'MISTAKE: Claimed Figma compliance without visual verification',
-      timestamp: '2025-06-21T08:10:00Z'
+      title: 'BLOCKED: Advice-shaped response detected — routed to attorney review queue',
+      timestamp: '2026-05-24T11:10:00Z'
     }
   });
   document.getElementById('reviewCheckpointBtn').disabled = true;
   document.getElementById('reviewCheckpointBtn').textContent = 'Connect to save your own review checkpoint';
-  // Sample memories — realistic scenarios from real agent-driven development
+  // Sample memories — legal AI intake scenarios for law firm pilot demo
   var demoResults = [
-    { signal: 'down', title: 'Claimed fix worked without running tests', context: 'Agent announced "fixed and pushed" but never ran the test suite. CI failed on 3 tests. Check now requires test evidence before any completion claim.', tags: ['anti-lying', 'verification-gap', 'ci', 'trust-breach'], timestamp: '2025-06-22T10:20:00Z' },
-    { signal: 'down', title: 'Force-pushed to main and lost teammate commits', context: 'Used git push --force on main to fix a rebase. Overwrote 3 commits from another team member. Had to recover from reflog. Check now blocks all --force pushes to protected branches.', tags: ['git', 'destructive', 'auto-blocked'], timestamp: '2025-06-20T09:15:00Z' },
-    { signal: 'up', title: 'Pre-action check caught .env commit', context: 'Check blocked a git add that included .env with production API keys. Saved from leaking secrets to a public repo.', tags: ['security', 'prevention', 'secrets'], timestamp: '2025-06-19T11:30:00Z' },
-    { signal: 'down', title: 'PR scope creep — 72 changed files for a 2-file fix', context: 'Agent included unrelated formatting changes, config files, and lock file updates in a PR that should have touched 2 files. User had to manually separate the changes.', tags: ['pr-scope', 'scope-creep', 'user-frustration', 'git-workflow'], timestamp: '2025-06-18T14:30:00Z' },
-    { signal: 'up', title: 'Full PR review cycle with on-device verification', context: 'Fixed 3 review findings, verified on physical Android device with fresh debug build, confirmed Delete Account flow end-to-end before marking PR ready.', tags: ['pr-review', 'on-device-verification', 'evidence-based', 'metric:ROI'], timestamp: '2025-06-17T16:45:00Z' },
-    { signal: 'down', title: 'Claimed Figma compliance without visual verification', context: 'Said UI matched Figma designs without actually checking. User pointed out wrong colors, missing spacing, and incorrect font weights. Should have used screenshot comparison.', tags: ['anti-lying', 'figma', 'visual-verification', 'trust-breach'], timestamp: '2025-06-16T08:05:00Z' },
-    { signal: 'down', title: 'Deployed without running tests', context: 'Pushed a refactor to main without running the test suite. Two integration tests failed in CI, blocking the release for 3 hours.', tags: ['ci', 'testing', 'deployment'], timestamp: '2025-06-15T09:15:00Z' },
-    { signal: 'up', title: 'Atomic commits improved bisect speed', context: 'Splitting a large feature into 8 atomic commits made git bisect find the regression in under 2 minutes instead of manual debugging.', tags: ['git', 'debugging', 'evidence-based'], timestamp: '2025-06-14T16:45:00Z' },
-    { signal: 'down', title: 'Deleted production database table', context: 'AI agent ran DROP TABLE on a staging-named table that was actually aliased to production. Added a gate requiring explicit confirmation for any destructive SQL.', tags: ['database', 'destructive', 'critical', 'auto-blocked'], timestamp: '2025-06-13T08:05:00Z' },
-    { signal: 'up', title: 'Read file before editing prevented breaking change', context: 'Always read the target file before making changes. Agent caught that the function signature had changed upstream and adapted the edit accordingly.', tags: ['code-quality', 'prevention', 'evidence-based'], timestamp: '2025-06-12T14:30:00Z' },
-    { signal: 'down', title: 'Pushed to wrong branch — created new PR instead of updating existing', context: 'Agent pushed changes to a new branch instead of the open PR branch. Had to cherry-pick commits and force-close the duplicate PR.', tags: ['git-workflow', 'branch-strategy', 'delegation', 'user-frustration'], timestamp: '2025-06-11T10:20:00Z' },
-    { signal: 'up', title: 'ADO tickets split correctly with parallel execution', context: 'Split frontend/backend tasks, corrected area path and iteration, created investigation subtask, and updated PR description — all done efficiently in parallel.', tags: ['ado-workflow', 'parallel-execution', 'triage', 'metric:ROI'], timestamp: '2025-06-10T13:00:00Z' },
-    { signal: 'down', title: 'Delegated debugging to QA instead of investigating', context: 'Told user to ask QA engineer for error logs instead of investigating the issue directly. Wasted 30 minutes of back-and-forth when the fix was a one-line config change.', tags: ['delegation', 'user-frustration', 'debugging', 'speed'], timestamp: '2025-06-09T15:30:00Z' },
-    { signal: 'down', title: 'iOS build failed — forgot pod install after adding dependency', context: 'Added a new npm package but did not run pod install or rebuild the native project. Build failed on iOS physical device. Metro bundler showed stale cache.', tags: ['ios-build', 'metro', 'speed', 'mobile'], timestamp: '2025-06-08T09:45:00Z' },
-    { signal: 'up', title: 'Prevention rule stopped repeat mistake', context: 'Gate auto-generated from 3 prior "forgot pod install" failures now blocks any npm install that touches native modules without a follow-up pod install step.', tags: ['prevention', 'ios-build', 'auto-generated', 'metric:ROI'], timestamp: '2025-06-07T11:00:00Z' },
-    { signal: 'down', title: 'Claimed performance fix without benchmarking', context: 'Said the optimization reduced render time by 40% but never ran a before/after benchmark. Actual measurement showed no improvement. Gate now requires metrics evidence.', tags: ['anti-lying', 'performance', 'verification-gap', 'measure-first'], timestamp: '2025-06-06T14:20:00Z' },
-    { signal: 'up', title: 'DPO export caught systematic failure pattern', context: 'Exported 47 preference pairs revealing that 80% of negative feedback involved claiming work was done without verification. Led to a new mandatory evidence gate.', tags: ['dpo-export', 'evidence-based', 'prevention', 'metric:ROI'], timestamp: '2025-06-05T10:15:00Z' }
+    { signal: 'down', title: 'Intake agent provided outcome prediction to prospect', context: 'Prospect asked about wrongful termination in Florida. Agent said "you likely have a strong case." ThumbGate blocked the advice-shaped response before delivery under ABA Rule 5.5.', tags: ['upl-risk', 'aba-rule-5.5', 'auto-blocked', 'critical'], timestamp: '2026-05-25T14:20:00Z' },
+    { signal: 'up', title: 'Conflict pre-check stopped intake before facts collected', context: 'Adverse party matched the synthetic conflict list. ThumbGate halted intake before privileged facts were disclosed, preventing a Rule 1.7/1.9 conflict issue.', tags: ['conflict-check', 'aba-rule-1.7', 'aba-rule-1.9', 'prevention'], timestamp: '2026-05-25T11:45:00Z' },
+    { signal: 'down', title: 'Agent attempted to send case summary to external CRM', context: 'Agent tried to push matter IDs and consultation notes to an external CRM. ThumbGate blocked the outbound call for privileged-content markers.', tags: ['privilege-egress', 'aba-rule-1.6', 'auto-blocked', 'critical'], timestamp: '2026-05-24T16:30:00Z' },
+    { signal: 'up', title: 'Safe handoff collected neutral facts only', context: 'After a UPL block, the agent pivoted to neutral routing facts: name, contact, practice area, and callback time. No legal conclusion was delivered.', tags: ['safe-handoff', 'compliant-response', 'aba-rule-5.5', 'metric:ROI'], timestamp: '2026-05-24T11:10:00Z' },
+    { signal: 'down', title: 'Agent made jurisdictional recommendation without review', context: 'Prospect asked where to file. Agent gave a venue recommendation. ThumbGate blocked it because jurisdiction guidance requires attorney supervision.', tags: ['upl-risk', 'jurisdiction', 'aba-rule-5.5', 'auto-blocked'], timestamp: '2026-05-23T15:20:00Z' },
+    { signal: 'up', title: 'Audit export preserved full decision chain', context: 'Export showed matched rule, proposed reply, deny decision, attorney-review route, and UTC timestamp. Compliance can replay the decision.', tags: ['audit-trail', 'compliance', 'aba-opinion-512', 'metric:ROI'], timestamp: '2026-05-23T09:00:00Z' },
+    { signal: 'down', title: 'Response missing firm-approved disclaimer', context: 'Agent drafted a prospect reply without the required non-engagement disclaimer. ThumbGate blocked delivery until approved text was added.', tags: ['disclaimer-missing', 'non-engagement', 'aba-rule-5.5', 'auto-blocked'], timestamp: '2026-05-22T14:45:00Z' },
+    { signal: 'up', title: 'Model endpoint restricted to approved provider', context: 'Agent tried a consumer model endpoint. ThumbGate enforced the allowlist and rerouted to the firm-approved Azure OpenAI endpoint.', tags: ['model-governance', 'data-handling', 'aba-opinion-512', 'prevention'], timestamp: '2026-05-22T10:30:00Z' },
+    { signal: 'down', title: 'Agent disclosed opposing counsel information to prospect', context: 'Agent referenced opposing-counsel information from another matter. ThumbGate blocked the cross-matter leak under Rule 1.6.', tags: ['privilege-egress', 'cross-matter', 'aba-rule-1.6', 'critical'], timestamp: '2026-05-21T16:15:00Z' },
+    { signal: 'up', title: 'Conflict check cleared — intake proceeded safely', context: 'Adverse party cleared the synthetic fixture. ThumbGate allowed intake and logged timestamp plus rule version.', tags: ['conflict-check', 'cleared', 'aba-rule-1.7', 'compliant-response'], timestamp: '2026-05-21T11:00:00Z' },
+    { signal: 'down', title: 'Intake agent attempted to schedule consultation directly', context: 'Agent tried to book a consultation without attorney review. ThumbGate blocked the routing action pending supervisor approval.', tags: ['routing-governance', 'attorney-review', 'auto-blocked'], timestamp: '2026-05-20T13:30:00Z' },
+    { signal: 'up', title: 'Egress rerouted to in-tenant system successfully', context: 'Agent needed to store intake notes. ThumbGate rerouted the write to the firm tenant, keeping privileged content inside the boundary.', tags: ['privilege-egress', 'in-tenant-reroute', 'aba-rule-1.6', 'metric:ROI'], timestamp: '2026-05-20T09:45:00Z' },
+    { signal: 'up', title: 'DPO export identified systematic UPL pattern', context: 'Exported 34 blocked intake pairs. 76% were outcome predictions after "do I have a case?" prompts, driving revised intake scripts.', tags: ['dpo-export', 'upl-pattern', 'prevention', 'metric:ROI'], timestamp: '2026-05-19T14:00:00Z' },
+    { signal: 'down', title: 'Agent used non-approved model for privilege-sensitive query', context: 'Privileged intake query was routed to an endpoint without enterprise DPA. ThumbGate blocked and logged it for security review.', tags: ['model-governance', 'privilege-risk', 'aba-opinion-512', 'auto-blocked'], timestamp: '2026-05-18T11:20:00Z' }
   ];
   isDemo = true;
   demoData = demoResults;
@@ -1506,14 +2261,14 @@ function loadDemo() {
     'style="flex:none;background:#b85c2d;color:#fff;padding:8px 18px;border-radius:8px;text-decoration:none;font-weight:700;font-size:13px;white-space:nowrap;">Go Pro — $19/mo</a>' +
     '</div>';
   document.getElementById('searchResults').innerHTML = upgradeBanner + teaserHtml;
-  // Sample gates
+  // Sample gates — legal AI intake enforcement
   var demoGates = [
-    { name: 'no-force-push', pattern: 'Block git push --force to main or master branches', action: 'block' },
-    { name: 'read-before-edit', pattern: 'Must read file contents before any edit_file call', action: 'block' },
-    { name: 'test-before-deploy', pattern: 'Run npm test before any deployment or push to main', action: 'block' },
-    { name: 'no-secrets-in-commits', pattern: 'Block git add on .env, credentials, or API key files', action: 'block' },
-    { name: 'evidence-before-claim', pattern: 'Run verification commands before claiming task completion', action: 'block' },
-    { name: 'atomic-commits', pattern: 'Each commit should contain a single logical change', action: 'warn' }
+    { name: 'block-unauthorized-practice', pattern: 'Block advice-shaped intake replies from non-attorney agents (ABA Rule 5.5)', action: 'block' },
+    { name: 'require-conflict-clearance', pattern: 'Require adverse-party clearance before facts or scheduling (Rules 1.7/1.9/1.10)', action: 'block' },
+    { name: 'block-privileged-egress', pattern: 'Block outbound calls with matter IDs or attorney-client markers (Rule 1.6)', action: 'block' },
+    { name: 'require-approved-disclaimer', pattern: 'Require firm-approved non-engagement disclaimer before delivery', action: 'block' },
+    { name: 'restrict-model-endpoint', pattern: 'Allow only enterprise-approved model endpoints (ABA Opinion 512)', action: 'block' },
+    { name: 'require-attorney-review', pattern: 'Route case assignment and scheduling through attorney review', action: 'warn' }
   ];
   document.getElementById('gatesList').innerHTML = demoGates.map(function(g) {
     return '<div class="gate-card"><div><div class="gate-name">' + escHtml(g.name) + '</div>' +
@@ -1521,141 +2276,144 @@ function loadDemo() {
       '<span class="gate-action ' + g.action + '">' + g.action.toUpperCase() + '</span></div>';
   }).join('');
   renderTeam({
-    totalAgents: 8,
-    activeAgents: 5,
+    totalAgents: 4,
+    activeAgents: 3,
     windowHours: 24,
-    orgAdherenceRate: 92.4,
+    orgAdherenceRate: 96.1,
     riskAgents: [
-      { id: 'claude-reviewer', project: 'checkout-flow', branch: 'fix/stripe-timeout', adherenceRate: 67.5 },
-      { id: 'codex-second-pass', project: 'dashboard', branch: 'feat/team-rollout', adherenceRate: 74.2 }
+      { id: 'intake-chatbot-prod', project: 'client-intake', branch: 'litigation-practice', adherenceRate: 88.2 },
+      { id: 'intake-chatbot-staging', project: 'client-intake', branch: 'ip-practice-pilot', adherenceRate: 91.7 }
     ],
     topBlockedGates: [
-      { gateId: 'evidence-before-done', blocked: 12, warned: 1 },
-      { gateId: 'never-force-push-main', blocked: 7, warned: 0 }
+      { gateId: 'block-unauthorized-practice', blocked: 34, warned: 0 },
+      { gateId: 'require-conflict-clearance', blocked: 22, warned: 3 }
     ]
   }, {
     northStar: {
-      weeklyTeamsRunningProofBackedWorkflows: 3,
+      weeklyTeamsRunningProofBackedWorkflows: 2,
       paidTeamRuns: 1
     }
   });
   renderPredictive({
     upgradePropensity: {
-      pro: { band: 'high', score: 0.71 },
-      team: { band: 'medium', score: 0.54 }
+      pro: { band: 'high', score: 0.84 },
+      team: { band: 'high', score: 0.72 }
     },
     revenueForecast: {
-      predictedBookedRevenueCents: 12800,
-      incrementalOpportunityCents: 4900
+      predictedBookedRevenueCents: 8400000,
+      incrementalOpportunityCents: 3200000
     },
     anomalySummary: {
       count: 2,
       severity: 'warning'
     },
     topCreators: [
-      { key: 'reach_vb', opportunityRevenueCents: 3100 }
+      { key: 'innovation_team', opportunityRevenueCents: 4800000 }
     ],
     topSources: [
-      { key: 'producthunt', opportunityRevenueCents: 1800 }
+      { key: 'direct_outreach', opportunityRevenueCents: 2400000 }
     ],
     anomalies: [
-      { type: 'pricing_resistance', message: 'Price sensitivity dominates current loss reasons.', severity: 'warning' },
-      { type: 'creator_underperformance', message: 'Creator reach_vb is generating intent without revenue conversion.', severity: 'warning' }
+      { type: 'upl_risk_concentration', message: 'UPL blocks concentrate in litigation intake — add practice-area rules.', severity: 'warning' },
+      { type: 'egress_pattern', message: 'Privilege egress attempts cluster after hours — add reviewer coverage.', severity: 'warning' }
     ]
   });
   renderAgentInventory({
-    profile: 'default',
-    tier: 'builder',
-    configuredServerCount: 3,
-    observedToolCount: 4,
+    profile: 'legal-intake',
+    tier: 'enterprise',
+    configuredServerCount: 2,
+    observedToolCount: 5,
     observedTools: [
-      { toolName: 'Bash', evaluations: 120, intercepted: 19, allow: 101, deny: 12, warn: 7 },
-      { toolName: 'Edit', evaluations: 64, intercepted: 6, allow: 58, deny: 2, warn: 4 },
-      { toolName: 'Read', evaluations: 42, intercepted: 0, allow: 42, deny: 0, warn: 0 }
+      { toolName: 'intake_reply', evaluations: 89, intercepted: 34, allow: 55, deny: 34, warn: 0 },
+      { toolName: 'conflict_lookup', evaluations: 67, intercepted: 22, allow: 45, deny: 19, warn: 3 },
+      { toolName: 'send_to_crm', evaluations: 41, intercepted: 17, allow: 24, deny: 14, warn: 3 },
+      { toolName: 'schedule_consultation', evaluations: 28, intercepted: 3, allow: 25, deny: 0, warn: 3 },
+      { toolName: 'export_audit', evaluations: 19, intercepted: 0, allow: 19, deny: 0, warn: 0 }
     ],
     policySources: [
-      { source: 'gates-engine', count: 23 },
-      { source: 'secret-guard', count: 6 },
-      { source: 'workflow-sentinel', count: 4 }
+      { source: 'legal-intake-rules', count: 14 },
+      { source: 'privilege-guard', count: 6 },
+      { source: 'conflict-sentinel', count: 4 }
     ]
   });
   renderActionableRemediations([
     {
-      title: 'tighten verification before response · recent-signals',
-      rationale: 'Recent approval rate has dropped below the lifetime baseline, so fast completion claims need tighter proof.',
-      action: 'tighten-verification-before-response',
+      title: 'add practice-area-specific UPL rules · litigation-intake',
+      rationale: 'Litigation intake generates 76% of UPL blocks. Add targeted rules to reduce false positives.',
+      action: 'add-practice-area-rules',
     },
     {
-      title: 'audit domain failures · git-workflow',
-      rationale: 'Git workflow events are overrepresented in high-risk outcomes and deserve a stronger pre-action gate.',
-      action: 'audit-domain-failures',
+      title: 'extend conflict check to affiliated entities · conflict-detection',
+      rationale: 'Conflict fixture covers named parties only. Add affiliates and parents.',
+      action: 'extend-conflict-coverage',
     },
     {
-      title: 'review and update skill · github',
-      rationale: 'GitHub-related failures have crossed the negative-rate threshold, so the skill needs a correction pass.',
-      action: 'review-and-update-skill',
+      title: 'schedule attorney reviewer for off-hours intake · privilege-egress',
+      rationale: 'Egress attempts cluster after 6pm. Add a backup reviewer queue.',
+      action: 'schedule-off-hours-reviewer',
     }
   ]);
   renderSettingsStatus({
     activeLayers: [
       { scope: 'defaults', exists: true, leafCount: 7, sourcePath: null },
-      { scope: 'user', exists: true, leafCount: 2, sourcePath: '~/.thumbgate/settings.json' },
-      { scope: 'project', exists: true, leafCount: 2, sourcePath: '.thumbgate/settings.json' },
-      { scope: 'local', exists: false, leafCount: 0, sourcePath: '.thumbgate/settings.local.json' },
-      { scope: 'managed', exists: true, leafCount: 3, sourcePath: 'config/thumbgate-settings.managed.json' }
+      { scope: 'firm', exists: true, leafCount: 6, sourcePath: 'config/firm-intake-policy.json' },
+      { scope: 'practice-area', exists: true, leafCount: 4, sourcePath: 'config/litigation-rules.json' },
+      { scope: 'pilot', exists: true, leafCount: 3, sourcePath: '.thumbgate/pilot-settings.json' },
+      { scope: 'managed', exists: true, leafCount: 5, sourcePath: 'config/thumbgate-settings.managed.json' }
     ],
     resolvedSettings: {
-      mcp: { defaultProfile: 'essential', readonlySessionProfile: 'readonly' },
+      intake: { defaultProfile: 'legal-intake', enforcementMode: 'strict' },
       harnesses: { enabled: true, allowRuntimeExecution: true }
     },
     routingPreview: {
-      dashboardTool: { profile: 'readonly', reason: 'dashboard is available in the most restrictive profile that contains it' },
-      defaultSession: { profile: 'essential', reason: 'default auto-routing — essential profile from settings hierarchy' },
-      reviewSession: { profile: 'readonly', reason: 'read-only session detected — routing to readonly profile' }
+      intakeAgent: { profile: 'legal-intake', reason: 'all intake agents use strict legal gates' },
+      auditExport: { profile: 'readonly', reason: 'audit export has no firm-system write access' },
+      reviewQueue: { profile: 'attorney-review', reason: 'blocked responses route to attorney review' }
     },
     origins: [
-      { path: 'mcp.defaultProfile', value: 'essential', scope: 'project', sourcePath: '.thumbgate/settings.json' },
-      { path: 'mcp.readonlySessionProfile', value: 'readonly', scope: 'project', sourcePath: '.thumbgate/settings.json' },
-      { path: 'harnesses.allowRuntimeExecution', value: true, scope: 'project', sourcePath: '.thumbgate/settings.json' },
-      { path: 'dashboard.showPolicyOrigins', value: true, scope: 'managed', sourcePath: 'config/thumbgate-settings.managed.json' }
+      { path: 'intake.defaultProfile', value: 'legal-intake', scope: 'firm', sourcePath: 'config/firm-intake-policy.json' },
+      { path: 'intake.enforcementMode', value: 'strict', scope: 'firm', sourcePath: 'config/firm-intake-policy.json' },
+      { path: 'gates.conflictFixturePath', value: 'fixtures/adverse-parties.json', scope: 'pilot', sourcePath: '.thumbgate/pilot-settings.json' },
+      { path: 'gates.privilegeMarkers', value: ['attorney-client', 'work-product', 'matter-id'], scope: 'firm', sourcePath: 'config/firm-intake-policy.json' }
     ]
   });
   renderTemplates({
     total: 6,
     categories: {
-      'Git Safety': 1,
-      'Verification': 1,
-      'Agent Honesty': 1,
-      'Database Safety': 1,
-      'Secrets Hygiene': 1,
-      'Positive Reinforcement': 1
+      'UPL Prevention': 2,
+      'Conflict Detection': 1,
+      'Privilege Protection': 1,
+      'Model Governance': 1,
+      'Intake Routing': 1
     },
     templates: [
-      { name: 'Never force-push to main', category: 'Git Safety', signal: '👎', defaultAction: 'block', severity: 'critical', problem: 'Stops destructive history rewrites on protected branches before they land.', roi: 'Protects every shared repo from the fastest irreversible mistake.', rollout: 'Enable on every team repo on day one.', pattern: 'git\\s+push\\s+(--force|-f)' },
-      { name: 'Never skip tests before commit', category: 'Verification', signal: '👎', defaultAction: 'block', severity: 'high', problem: 'Requires proof before code leaves the laptop.', roi: 'Cuts review churn and CI rollback time across the team.', rollout: 'Pair with repository-specific test commands.', pattern: 'git\\s+commit' },
-      { name: 'Require evidence before saying done', category: 'Agent Honesty', signal: '👎', defaultAction: 'block', severity: 'high', problem: 'Prevents unsupported completion claims.', roi: 'Raises trust in autonomous runs.', rollout: 'Use anywhere proof matters more than speed.', pattern: 'completion_claim_without_verification' },
-      { name: 'Protect production SQL', category: 'Database Safety', signal: '👎', defaultAction: 'block', severity: 'critical', problem: 'Blocks destructive SQL operations on production-like targets.', roi: 'One saved incident pays for the rollout.', rollout: 'Turn on for any team touching live data.', pattern: '(drop|truncate|delete)\\s+.*production' }
+      { name: 'Block unauthorized practice of law', category: 'UPL Prevention', signal: '👎', defaultAction: 'block', severity: 'critical', problem: 'Stops advice-shaped intake replies under ABA Rule 5.5.', roi: 'Prevents malpractice exposure before delivery.', rollout: 'Enable on every AI intake channel.', pattern: '(outcome prediction|jurisdictional recommendation|you (should|could|might) (file|sue|claim))' },
+      { name: 'Require approved disclaimer', category: 'UPL Prevention', signal: '👎', defaultAction: 'block', severity: 'high', problem: 'Requires firm-approved non-engagement language.', roi: 'Reduces inadvertent client-relationship risk.', rollout: 'Load approved disclaimer during pilot.', pattern: '(intake_response|client_reply).*(missing|no).*(disclaimer)' },
+      { name: 'Require conflict check before intake', category: 'Conflict Detection', signal: '👎', defaultAction: 'block', severity: 'critical', problem: 'Requires adverse-party clearance before sensitive facts.', roi: 'Catches conflicts before privileged facts cross walls.', rollout: 'Use conflicts API or synthetic pilot fixture.', pattern: '(collect_case_facts|intake_continue).*(missing|no).*(conflict|clearance)' },
+      { name: 'Block privileged content egress', category: 'Privilege Protection', signal: '👎', defaultAction: 'block', severity: 'critical', problem: 'Blocks outbound actions with privilege markers.', roi: 'Prevents single-action privilege waiver.', rollout: 'Define markers; start with hard block.', pattern: '(send_email|api_call|external_request).*(privileged|attorney[_-]client|matter[_-]id)' },
+      { name: 'Restrict model endpoint to approved list', category: 'Model Governance', signal: '👎', defaultAction: 'block', severity: 'high', problem: 'Blocks unapproved model endpoints.', roi: 'Keeps data inside approved vendor boundaries.', rollout: 'Allowlist endpoints during pilot.', pattern: '(model_call|llm_request).*(unapproved|unknown|consumer)' },
+      { name: 'Require attorney review before routing', category: 'Intake Routing', signal: '👎', defaultAction: 'warn', severity: 'high', problem: 'Requires review before routing or scheduling.', roi: 'Prevents bad prospect routing.', rollout: 'Start strict; relax after pilot evidence.', pattern: '(route_to_attorney|schedule_consultation).*(no|missing).*(review|approval)' }
     ]
   });
   renderGeneratedView(buildDemoGeneratedViewSpec(currentGeneratedView));
   renderInsights({
-    gateStats: { blocked: 180 },
+    gateStats: { blocked: 93 },
     tokenSavings: {
       dollarsSaved: 0,
       dollarsSavedDisplay: '$0.00',
       tokensSavedDisplay: '0',
       blockedCalls: 0,
-      modelMix: { 'sonnet-4.5': 0.8, 'opus-4.6': 0.15, 'haiku-4.5': 0.05 },
-      blendedPricePer1M: { input: 6.2, output: 24.1 }
+      modelMix: { 'gpt-4o': 0.5, 'claude-sonnet-4.5': 0.35, 'azure-openai': 0.15 },
+      blendedPricePer1M: { input: 5.0, output: 15.0 }
     },
     lessonPipeline: {
       stages: [
-        { id: 'feedback', label: 'Feedback Signals', count: 297, detail: '37 up / 260 down' },
-        { id: 'lessons', label: 'Lessons Distilled', count: 94, detail: '72 mistakes / 22 good patterns' },
-        { id: 'gates', label: 'Gates Promoted', count: 21, detail: '22% of lessons become gates' },
-        { id: 'blocked', label: 'Actions Blocked', count: 180, detail: 'Repeat mistakes prevented' }
+        { id: 'feedback', label: 'Intake Events', count: 184, detail: '91 safe / 93 blocked' },
+        { id: 'lessons', label: 'Rules Refined', count: 42, detail: '28 UPL patterns / 14 egress patterns' },
+        { id: 'gates', label: 'Gates Active', count: 14, detail: '33% of rules become enforcement gates' },
+        { id: 'blocked', label: 'Risks Prevented', count: 93, detail: 'UPL, conflict, and privilege violations stopped' }
       ],
-      rates: { feedbackToLesson: 32, lessonToGate: 22 }
+      rates: { feedbackToLesson: 23, lessonToGate: 33 }
     },
     feedbackTimeSeries: {
       days: Array.from({ length: 30 }, function(_, index) {
@@ -1679,14 +2437,14 @@ function loadDemo() {
     },
     actionableRemediations: [
       {
-        title: 'tighten verification before response · recent-signals',
-        rationale: 'Recent approval rate has dropped below the lifetime baseline, so fast completion claims need tighter proof.',
-        action: 'tighten-verification-before-response'
+        title: 'add litigation-specific UPL rules',
+        rationale: '76% of UPL blocks come from litigation intake. Add targeted rules.',
+        action: 'add-practice-area-rules'
       },
       {
-        title: 'audit domain failures · git-workflow',
-        rationale: 'Git workflow events are overrepresented in high-risk outcomes and deserve a stronger pre-action gate.',
-        action: 'audit-domain-failures'
+        title: 'extend conflict checks to affiliates',
+        rationale: 'Named-party fixture misses affiliates and parents.',
+        action: 'extend-conflict-coverage'
       }
     ]
   });
@@ -1694,6 +2452,7 @@ function loadDemo() {
 
 // Auto-load demo on first visit so visitors see the product immediately
 window.addEventListener('DOMContentLoaded', function() {
+  preserveProjectQueryParams();
   if (hasBootstrapKey()) {
     connect({ key: BOOTSTRAP_API_KEY, localPro: true });
     return;
@@ -1848,6 +2607,7 @@ function chartDefaults() {
 function renderFeedbackTrendChart(ts) {
   var canvas = document.getElementById('feedbackTrendChart');
   if (!canvas) return;
+  if (typeof Chart === 'undefined') return;
   var days = ts.days || [];
   if (feedbackChart) feedbackChart.destroy();
 
@@ -1898,6 +2658,7 @@ function renderFeedbackTrendChart(ts) {
 function renderLessonTrendChart(ts) {
   var canvas = document.getElementById('lessonTrendChart');
   if (!canvas) return;
+  if (typeof Chart === 'undefined') return;
   var days = ts.days || [];
   if (lessonChart) lessonChart.destroy();
 
@@ -1956,6 +2717,7 @@ function renderLessonTrendChart(ts) {
 function renderGateAuditChartFromData(gateAudit) {
   var canvas = document.getElementById('gateAuditChart');
   if (!canvas) return;
+  if (typeof Chart === 'undefined') return;
   var days = gateAudit.days || [];
   if (gateAuditChart) gateAuditChart.destroy();
 
@@ -1999,6 +2761,8 @@ function renderGateAuditChartFromData(gateAudit) {
     },
   });
 }
+
 </script>
+<script src="/js/buyer-intent.js"></script>
 </body>
 </html>