thumbgate 1.27.20 → 1.28.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
-  "version": "1.27.20",
-  "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 36 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
+  "version": "1.28.1",
+  "description": "ThumbGate Pre-Action Checks derive rules from repeated failures, flag risky tool calls, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
     "type": "git",
@@ -46,6 +46,7 @@
     "scripts/bayes-optimal-gate.js",
     "scripts/belief-update.js",
     "scripts/billing.js",
+    "scripts/checkout-attribution-reference.js",
     "scripts/bot-detection.js",
     "scripts/build-metadata.js",
     "scripts/classifier-routing.js",
@@ -83,6 +84,8 @@
     "scripts/explore-subcommands.js",
     "scripts/explore.js",
     "scripts/export-databricks-bundle.js",
+    "scripts/entitlement.js",
+    "config/entitlement-public-keys.json",
     "scripts/export-dpo-pairs.js",
     "scripts/export-hf-dataset.js",
     "scripts/failure-diagnostics.js",
@@ -110,6 +113,7 @@
     "scripts/hook-thumbgate-cache-updater.js",
     "scripts/hosted-config.js",
     "scripts/hybrid-feedback-context.js",
+    "scripts/imperative-detector.js",
     "scripts/hybrid-supervisor-agent.js",
     "scripts/inference-cache-policy.js",
     "scripts/install-shim.js",
@@ -232,6 +236,7 @@
     "scripts/workspace-evolver.js",
     "scripts/xmemory-lite.js",
     ".claude-plugin/plugin.json",
+    "hooks/hooks.json",
     ".claude/commands/",
     "commands/",
     ".well-known/",
@@ -277,9 +282,11 @@
     "public/learn.html",
     "public/lessons.html",
     "public/numbers.html",
+    "public/partner-intake.html",
     "public/pricing.html",
     "public/pro.html",
     "public/assets/brand/",
+    "!public/assets/brand/github-social-preview.png",
     "public/assets/claude-thumbgate-statusbar.svg",
     "public/assets/codex-thumbgate-statusbar-test.svg",
     "public/assets/legal-intake-control-flow.svg",
@@ -380,7 +387,7 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:cursor-marketplace-doctor && npm run test:okara-money-promo-automation",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
     "test:python": "python3 -m pytest tests/*.py",
     "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
@@ -410,6 +417,7 @@
     "test:single-use-credential-gate": "node --test tests/single-use-credential-gate.test.js",
     "test:structured-prompt-driven": "node --test tests/structured-prompt-driven.test.js",
     "test:require-evidence-gate": "node --test tests/require-evidence-gate.test.js",
+    "test:imperative-detector": "node --test tests/imperative-detector.test.js",
     "test:rule-validator": "node --test tests/rule-validator.test.js",
     "test:session-health": "node --test tests/session-health-sensor.test.js",
     "test:session-episodes": "node --test tests/session-episode-store.test.js",
@@ -440,8 +448,9 @@
     "test:memory-dedup": "node --test tests/memory-dedup.test.js",
     "test:lesson-db": "node --test tests/lesson-db.test.js",
     "test:lesson-rotation": "node --test tests/lesson-rotation.test.js",
-    "test:feedback-quality": "node --test tests/feedback-quality.test.js",
+    "test:feedback-quality": "node --test tests/feedback-quality.test.js tests/feedback-event-idempotency.test.js",
     "test:sync-version": "node --test tests/sync-version.test.js",
+    "test:release-window": "node --test tests/release-window.test.js",
     "test:team-sync": "node --test tests/team-sync.test.js",
     "test:sync-telemetry": "node --test tests/sync-telemetry-from-prod.test.js",
     "test:check-congruence": "node --test tests/check-congruence.test.js",
@@ -507,18 +516,18 @@
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
     "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js",
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js",
-    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/revenue-pack-utils.test.js tests/sales-pipeline.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
+    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
     "test:sales-pipeline": "node --test tests/sales-pipeline.test.js",
-    "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js",
+    "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js tests/checkout-attribution-reference.test.js",
     "test:billing-setup": "node --test tests/billing-setup-redaction.test.js",
-    "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
+    "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/feedback-lesson-sanitization.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
     "test:evolution": "node --test tests/workspace-evolver.test.js",
     "test:watcher": "node --test tests/jsonl-watcher.test.js",
     "test:autoresearch": "node --test tests/autoresearch.test.js",
     "test:ops": "node --test tests/qa-scenario-planner.test.js tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js tests/auto-promote-regression-gate.test.js",
     "test:session-analyzer": "node --test tests/session-analyzer.test.js",
     "test:tessl": "node --test tests/tessl-export.test.js",
-    "test:gates": "node --test tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js",
+    "test:gates": "node --test tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js",
     "test:budget": "node --test tests/budget-guard.test.js tests/budget-enforcer.test.js tests/tokenomics-cost-guard.test.js tests/hook-no-budget-lockout.test.js",
     "test:workers": "npm --prefix workers ci && npm --prefix workers test",
     "test:evoskill": "node --test tests/evoskill.test.js",
@@ -632,13 +641,16 @@
     "test:product-feedback": "node --test tests/product-feedback.test.js",
     "test:feedback-root-consolidator": "node --test tests/feedback-root-consolidator.test.js",
     "social:publish:launch": "node scripts/social-analytics/publish-thumbgate-launch.js",
+    "social:publish:latest-release-article": "node scripts/social-analytics/publish-latest-release-article.js",
+    "social:publish:latest-release-fallbacks": "node scripts/social-analytics/publish-latest-release-fallbacks.js",
+    "social:verify:latest-release": "node scripts/social-analytics/verify-latest-release-posts.js",
     "social:schedule:campaign": "node scripts/social-analytics/schedule-thumbgate-campaign.js",
     "social:install:growth": "node scripts/social-analytics/install-growth-automation.js",
     "social:reconcile:campaign": "node scripts/social-analytics/reconcile-thumbgate-campaign.js",
     "social:sync:launch-assets": "node scripts/social-analytics/sync-launch-assets.js",
     "social:engagement:audit": "node scripts/social-analytics/engagement-audit.js",
     "test:install-growth-automation": "node --test tests/install-growth-automation.test.js",
-    "test:publish-thumbgate-launch": "node --test tests/publish-thumbgate-launch.test.js",
+    "test:publish-thumbgate-launch": "node --test tests/publish-thumbgate-launch.test.js tests/publish-latest-release-article.test.js tests/latest-release-campaign-ops.test.js",
     "test:reconcile-thumbgate-campaign": "node --test tests/reconcile-thumbgate-campaign.test.js",
     "test:schedule-thumbgate-campaign": "node --test tests/schedule-thumbgate-campaign.test.js",
     "test:social-reply-monitor": "node --test tests/social-reply-monitor.test.js tests/reddit-monitor-launchd.test.js",
@@ -757,13 +769,19 @@
     "eval:observability": "node scripts/async-eval-observability.js",
     "test:memory-provider-enforcement-bridge": "node --test tests/memory-provider-enforcement-bridge.test.js",
     "test:payment-rails": "node --test tests/payment-rails.test.js",
+    "test:service-checkout-price-integrity": "node --test tests/service-checkout-price-integrity.test.js",
     "test:publisher-credential-guards": "node --test tests/publisher-credential-guards.test.js",
     "test:reddit-browser-notification-watch": "node --test tests/reddit-browser-notification-watch.test.js",
     "cursor:marketplace:doctor": "node scripts/cursor-marketplace-doctor.js",
     "cursor:marketplace:doctor:json": "node scripts/cursor-marketplace-doctor.js --json",
     "test:cursor-marketplace-doctor": "node --test tests/cursor-marketplace-doctor.test.js",
+    "test:plugin-hooks-manifest": "node --test tests/plugin-hooks-manifest.test.js",
     "test:hook-self-protection": "node --test tests/hook-self-protection.test.js",
-    "test:pack-runtime-integrity": "node --test tests/pack-runtime-integrity.test.js"
+    "test:never-bypass-branch-protection": "node --test tests/never-bypass-branch-protection.test.js",
+    "test:self-protect-enforcement": "node --test tests/self-protect-enforcement.test.js",
+    "test:pack-runtime-integrity": "node --test tests/pack-runtime-integrity.test.js",
+    "test:entitlement": "node --test tests/entitlement.test.js",
+    "test:xss-checkout-escape": "node --test tests/xss-checkout-escape.test.js"
   },
   "keywords": [
     "mcp",

package/public/about.html

@@ -66,8 +66,7 @@ __GOOGLE_SITE_VERIFICATION_META__
     "https://www.linkedin.com/in/igor-ganapolsky-5324b7330",
     "https://dev.to/igorganapolsky",
     "https://www.upwork.com/freelancers/~01b5f08ed8b1a9a3c1",
-    "https://huggingface.co/IgorGanapolsky",
-    "https://x.com/igorganapolsky"
+    "https://huggingface.co/IgorGanapolsky"
   ],
   "worksFor": {
     "@type": "Organization",
@@ -131,7 +130,6 @@ footer{padding:2rem 1.5rem;color:#64748b;font-size:.9rem;text-align:center}
 <section class="section">
 <h2>Recent ships</h2>
 <ul>
-<li><strong>Hilltown Media Group · Pretix Stripe Connect plugin</strong> — production payments + automation, 100% test coverage, milestone-funded delivery.</li>
 <li><strong>ThumbGate v1.27</strong> — pre-action governance for AI coding agents, available on npm as <code>thumbgate</code>.</li>
 <li><strong>Resume revenue ML stack</strong> — Thompson-sampling bandit + copy/buyer logistic regression + Agentic RAG for closed-loop UpWork bidding.</li>
 </ul>
@@ -149,7 +147,6 @@ footer{padding:2rem 1.5rem;color:#64748b;font-size:.9rem;text-align:center}
 <li><a href="https://dev.to/igorganapolsky" rel="me">dev.to</a></li>
 <li><a href="https://www.upwork.com/freelancers/~01b5f08ed8b1a9a3c1" rel="me">Upwork</a></li>
 <li><a href="https://huggingface.co/IgorGanapolsky" rel="me">Hugging Face</a></li>
-<li><a href="https://x.com/igorganapolsky" rel="me">X</a></li>
 </ul>
 
 </main>

package/public/agent-manager.html

@@ -46,7 +46,7 @@
       "name": "How does ThumbGate help the Agent Manager?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "ThumbGate is the pre-action enforcement layer underneath what the role owns. It runs PreToolUse hooks at the tool-call boundary, auto-distills prevention rules from real thumbs-down feedback and writes them into CLAUDE.md, provides an org-wide rule library and hosted dashboard, and keeps an adapter matrix current as Claude Code, Cursor, and Codex change — so the role does not have to be the operator themselves. Each block carries the rule that fired and the evidence that triggered it, so the agent can choose a safer plan."
+        "text": "ThumbGate is the pre-action enforcement layer under the role. It runs PreToolUse hooks, distills repeated thumbs-down feedback into CLAUDE.md rules, and shows the rule plus evidence on each block. Pro keeps personal recall, exports, dashboard proof, and adapters maintained; Enterprise adds the org-wide rule library and hosted dashboard."
       }
     },
     {
@@ -54,7 +54,7 @@
       "name": "Is ThumbGate free for the Agent Manager to start?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "Yes. npx thumbgate init in one repo is free and MIT licensed, and the gates work locally without a hosted account. The paid tier adds the hosted dashboard, the org-wide rule library, DPO/HuggingFace export, and 24x7 ops on the adapter matrix — the operational work the role would otherwise have to do itself."
+        "text": "Yes. npx thumbgate init in one repo is free and MIT licensed, and gates work locally without a hosted account. Pro adds personal recall, dashboard proof, DPO/HuggingFace export, and managed adapters. Enterprise adds the hosted dashboard, org-wide rule library, and rollout support."
       }
     },
     {
@@ -112,7 +112,7 @@
     <tbody>
       <tr>
         <td><strong>CLAUDE.md hierarchy</strong><br>Keeping the policy that the model reads on every session current and consistent across repos.</td>
-        <td>Prevention rules auto-distilled from real <code>👎</code> feedback and written into <code>CLAUDE.md</code> by <code>scripts/feedback-to-rules.js</code>. Org-wide rule library on the hosted dashboard.</td>
+        <td>Prevention rules distilled from repeated real <code>👎</code> feedback and written into <code>CLAUDE.md</code> by <code>scripts/feedback-to-rules.js</code>. Enterprise adds the hosted org-wide rule library.</td>
       </tr>
       <tr>
         <td><strong>Plugin marketplace</strong><br>Deciding which Claude Code / Cursor / Codex plugins are blessed and which are not.</td>
@@ -128,7 +128,7 @@
       </tr>
       <tr>
         <td><strong>Keep them current</strong><br>When Claude Code ships a breaking change to hooks or to the plugin API, your rollout cannot wait a quarter.</td>
-        <td>24×7 ops on the adapter matrix. SonarCloud regressions fixed in &lt;24h. The hosted tier is the operator the role does not have to be themselves.</td>
+        <td>24×7 ops on the adapter matrix. SonarCloud regressions fixed in &lt;24h. Pro covers personal adapter maintenance; Enterprise is the hosted operator.</td>
       </tr>
     </tbody>
   </table>
@@ -145,7 +145,7 @@
     </div>
     <div class="card">
       <h3>Phase 2 — Rollout lands</h3>
-      <p>Infrastructure is ready; the first wave finds it productive. This is where the Agent Manager becomes a named role. ThumbGate's hosted dashboard, org-wide rule library, and DPO export are what that role uses to keep CLAUDE.md and the permissions policy consistent across repos.</p>
+      <p>Infrastructure is ready; the first wave finds it productive. This is where the Agent Manager becomes a named role. ThumbGate Enterprise's hosted dashboard, org-wide rule library, and DPO export keep CLAUDE.md and permissions consistent across repos.</p>
     </div>
     <div class="card">
       <h3>Phase 3 — Adoption spreads</h3>
@@ -156,7 +156,7 @@
   <h2>How to start</h2>
   <ol>
     <li><strong>Install free.</strong> <code>npx thumbgate init</code> in one repo. Captures thumbs-up/down feedback locally; auto-promotes repeated failures into prevention rules.</li>
-    <li><strong>Wire one Pre-Action Check.</strong> Pick the most-repeated agent mistake your org has felt this month. Promote that one to a rule. Watch the next attempt get blocked at the tool-call boundary, with the rule that fired in the agent's reasoning trace.</li>
+    <li><strong>Wire one Pre-Action Check.</strong> Pick the most-repeated agent mistake your org has felt this month. Promote that one to a rule. Watch the next attempt get flagged and logged at the tool-call boundary (and hard-blocked under strict enforcement), with the rule that fired in the agent's reasoning trace.</li>
     <li><strong>Run the Workflow Hardening Sprint.</strong> When phase 2 hits — when you need shared rules, org dashboard visibility, and adapter coverage you do not have to maintain yourself — the sprint is the path from local proof to managed rollout.</li>
   </ol>
 

package/public/agents-cost-savings.html

@@ -78,7 +78,7 @@
   <p>"Measurable" is the operative word. A token-spend dashboard tells finance how much got burned; it doesn't tell the CIO board what was averted. <code>thumbgate cost</code> prints a single conservative dollar figure backed by the gate-block count from <em>your</em> machine — not "what enterprises like you saved." That's the artifact that survives a 2026 budget review.</p>
 
   <h2>One command, one number</h2>
-  <p>Once ThumbGate is installed and gates have been firing, this is what an operator sees:</p>
+  <p>Once ThumbGate is installed and gates have been firing, this is what an operator sees. The figures below are an <strong>illustrative example</strong> — your numbers are computed from your own machine's <code>gate-stats.json</code>, not from ThumbGate traction data:</p>
   <pre><code>$ thumbgate cost
 
 💰 ThumbGate cost-savings — cumulative
@@ -105,7 +105,7 @@
       <tr><td>See what agents spent last week</td><td>✅</td><td>Partial (via dashboard)</td></tr>
       <tr><td>Allocate spend to teams / features</td><td>✅</td><td>Per-gate breakdown via <code>byGate</code></td></tr>
       <tr><td>Stop a known-bad tool call before it hits the model</td><td>❌</td><td>✅ — PreToolUse gate fires, no API call made</td></tr>
-      <tr><td>Promote a one-off failure into a permanent gate</td><td>❌</td><td>✅ — feedback loop + lesson DB</td></tr>
+      <tr><td>Promote a one-off failure into a persistent gate</td><td>❌</td><td>✅ — feedback loop + lesson DB</td></tr>
       <tr><td>Surface gate candidates from <em>silent</em> failures (where no human ever gave thumbs-down)</td><td>❌</td><td>✅ — unsupervised silent-failure clustering, on by default</td></tr>
       <tr><td>Print conservative $ saved per day</td><td>❌</td><td>✅ — <code>thumbgate cost</code></td></tr>
       <tr><td>K8s pod-level allocation, finance-grade reporting</td><td>✅ (that's their core)</td><td>❌ (not our layer)</td></tr>
@@ -131,7 +131,7 @@ npx thumbgate cost        # see what the gates were worth</code></pre>
   <div class="quote">"The category isn't 'FinOps for AI' — it's 'gates that stop the spend so FinOps has less to report on.' One sits behind the other."</div>
 
   <div class="card">
-    <p><strong>The free CLI is real. The paid tier is the hosted dashboard, org-wide rule library, and the operator the Agent Manager doesn't have to be themselves.</strong></p>
+    <p><strong>The free CLI is real. Pro adds the personal dashboard, recall, exports, and managed adapters. Enterprise is the hosted dashboard, org-wide rule library, and the operator the Agent Manager doesn't have to be themselves.</strong></p>
     <p>
       <a href="/#workflow-sprint-intake?utm_source=website&amp;utm_medium=agents_cost_savings_page&amp;utm_campaign=finops_sprint&amp;cta_id=agents_cost_savings_sprint_intake&amp;cta_placement=agents_cost_savings_page" class="cta">Start the Workflow Hardening Sprint</a>
       <a href="/checkout/pro?utm_source=website&amp;utm_medium=agents_cost_savings_page&amp;utm_campaign=pro_upgrade&amp;cta_id=agents_cost_savings_pro_checkout&amp;cta_placement=agents_cost_savings_page&amp;plan_id=pro" class="secondary">Or start Pro at $19/mo →</a>

package/public/ai-malpractice-prevention.html

@@ -428,7 +428,7 @@
 
     <section>
       <h2>Yes, the pilot can start with preloaded ground truth.</h2>
-      <p class="section-lead">The first pilot should not ask the model to discover the firm's risk posture. ThumbGate should load the approved rule pack before the first intake simulation, then prove that the agent is physically stopped when a proposed action violates that pack.</p>
+      <p class="section-lead">The first pilot should not ask the model to discover the firm's risk posture. ThumbGate should load the approved rule pack before the first intake simulation, then prove that the agent is stopped at the tool-call boundary when a proposed action violates that pack (in hard-block mode; gates can also be set to review-queue or warn).</p>
       <div class="grid">
         <div class="card">
           <span class="tag green">Inputs</span>

package/public/blog.html

@@ -213,16 +213,18 @@
         <h3>Real examples</h3>
         <ul>
           <li>
-            <strong>Force-push to main</strong> &mdash; Gate fires, push never
-            happens. Agent is redirected to create a branch and open a PR.
+            <strong>Force-push to main</strong> &mdash; Gate fires and logs;
+            the agent is redirected to create a branch and open a PR. Hard-blocked
+            under strict enforcement.
           </li>
           <li>
             <strong>Unknown dependency install</strong> &mdash; Flagged for human
             review. Agent pauses until you approve.
           </li>
           <li>
-            <strong>Destructive shell command</strong> &mdash; Blocked by a
-            prevention rule learned from a prior incident.
+            <strong>Destructive shell command</strong> &mdash; Hard-blocked by a
+            prevention rule learned from a prior incident (destructive deletes are
+            a hard-block class by default).
           </li>
         </ul>
 
@@ -310,8 +312,9 @@
         <p>
           Claude Code has a sophisticated permission model and tool-calling
           pipeline. What it does <strong>not</strong> have is feedback-driven
-          enforcement — the ability to learn from past mistakes and physically
-          block the agent from repeating them.
+          enforcement — the ability to learn from past mistakes and flag the
+          agent (hard-blocking the catastrophic ones, or any rule under strict
+          enforcement) before it repeats them.
         </p>
 
         <p>
@@ -325,8 +328,9 @@
             prevention rule
           </li>
           <li>
-            <strong>Gates enforce</strong> — PreToolUse hooks block the action
-            before execution
+            <strong>Gates enforce</strong> — PreToolUse hooks flag and log the
+            action before execution, and hard-block the catastrophic ones (or any
+            rule under strict enforcement)
           </li>
           <li>
             <strong>Reasoning chains explain</strong> — every block tells you
@@ -464,7 +468,6 @@
       <div class="container">
         <a href="/">Home</a> ·
         <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> ·
-        <a href="https://x.com/IgorGanapolsky">X</a> ·
         <a href="https://www.linkedin.com/in/igorganapolsky">LinkedIn</a>
         <br /><br />© 2026 ThumbGate · MIT License
       </div>

package/public/chatgpt-app.html

@@ -230,7 +230,7 @@
         </div>
         <div class="screen">
           <div class="message">Before I run this migration, check whether this repeats a rejected deploy pattern.</div>
-          <div class="message"><strong>ThumbGate:</strong> Require evidence first: test output, rollback path, and the exact affected tables. Then install the local gate so future agents are blocked before execution.</div>
+          <div class="message"><strong>ThumbGate:</strong> Require evidence first: test output, rollback path, and the exact affected tables. Then install the local gate so future risky actions are flagged and logged before execution (and hard-blocked for secret exfiltration and guardrail-tampering by default, or under strict mode).</div>
           <code class="code">thumbs down: agent claimed the release was published before checking npm and CI</code>
           <code class="code">npx thumbgate init --agent codex</code>
         </div>
@@ -239,7 +239,7 @@
 
     <section aria-labelledby="what-ships">
       <h2 class="section-title" id="what-ships">What ships today</h2>
-      <p class="section-copy">This is the ChatGPT-facing distribution page. It keeps the claim precise: ChatGPT is the discovery, advice, checkpointing, and typed-feedback surface. The hard block still runs in the local agent or CI lane.</p>
+      <p class="section-copy">This is the ChatGPT-facing distribution page. It keeps the claim precise: ChatGPT is the discovery, advice, checkpointing, and typed-feedback surface. The enforcement — flag and log by default, hard-block for secret exfiltration and guardrail-tampering by default, or every rule under strict mode — still runs in the local agent or CI lane.</p>
       <div class="grid">
         <article class="card">
           <h3>Live GPT entrypoint</h3>
@@ -251,7 +251,7 @@
         </article>
         <article class="card">
           <h3>Local enforcement path</h3>
-          <p>ThumbGate still blocks repeated mistakes where work happens: Codex, Claude Code, Cursor, Gemini CLI, Amp, OpenCode, MCP, and CI.</p>
+          <p>ThumbGate still flags repeated mistakes where work happens — and hard-blocks the catastrophic ones (or any rule under strict mode): Codex, Claude Code, Cursor, Gemini CLI, Amp, OpenCode, MCP, and CI.</p>
         </article>
       </div>
     </section>

package/public/codex-enterprise.html

@@ -67,7 +67,7 @@
 <div class="container">
   <span class="pill">Codex in the Enterprise</span>
   <h1>Codex in production needs a governance layer. Dell-distributed or self-hosted, agents repeat the same mistakes.</h1>
-  <p>OpenAI and Dell <a href="https://openai.com/index/dell-codex-enterprise-partnership/" target="_blank" rel="noopener" style="color:var(--cyan)">just announced</a> a partnership to distribute Codex into the enterprise — Dell PCs, Dell servers, and Dell's enterprise sales motion become a delivery channel for OpenAI's coding agent. Codex's addressable market jumps from individual developer install to org-wide procurement. The governance gap jumps with it: every enterprise that turns Codex on now needs a runtime layer that captures what the agent did, blocks the repeat failures, and produces the audit trail their security review will ask for.</p>
+  <p>OpenAI and Dell <a href="https://openai.com/index/dell-codex-enterprise-partnership/" target="_blank" rel="noopener" style="color:var(--cyan)">just announced</a> a partnership to distribute Codex into the enterprise — Dell PCs, Dell servers, and Dell's enterprise sales motion become a delivery channel for OpenAI's coding agent. Codex's addressable market jumps from individual developer install to org-wide procurement. The governance gap jumps with it: every enterprise that turns Codex on now needs a runtime layer that captures what the agent did, flags the repeat failures (and hard-blocks the catastrophic ones, or any rule under strict enforcement), and produces the audit trail their security review will ask for.</p>
   <p>ThumbGate already ships a <a href="/codex-plugin">Codex plugin</a>. The free CLI is real, MIT-licensed, and the gates work locally without a hosted account. This page is what that plugin maps to once Codex is no longer one developer's experiment but a procurement line item.</p>
 
   <h2>What the governance layer ships</h2>
@@ -78,7 +78,7 @@
     </div>
     <div class="card">
       <h3>Promote repeat failures to PreToolUse gates</h3>
-      <p>When the same agent mistake shows up twice, ThumbGate distills it into a prevention rule and blocks the next attempt at the tool-call boundary — with the rule that fired in the agent's reasoning trace, so Codex chooses a safer plan instead of being told to "be more careful."</p>
+      <p>When the same agent mistake shows up twice, ThumbGate distills it into a prevention rule and flags the next attempt at the tool-call boundary — hard-blocking it for secret exfiltration and guardrail-tampering by default, or every rule under strict enforcement — with the rule that fired in the agent's reasoning trace, so Codex chooses a safer plan instead of being told to "be more careful."</p>
     </div>
     <div class="card">
       <h3>Audit trail enterprise procurement requires</h3>
@@ -101,7 +101,7 @@
   <p>This wires the Codex hook, sets up the local lesson DB, and gives you the capture/promote/block loop without a hosted account. If you want the standalone Codex plugin as a self-contained zip — for offline distribution to Dell-managed machines or for security review — grab it from <a href="https://github.com/IgorGanapolsky/ThumbGate/releases" target="_blank" rel="noopener" style="color:var(--cyan)">GitHub releases</a> (look for <code>codex-plugin-*.zip</code>).</p>
 
   <div class="card">
-    <p><strong>The free CLI is real. The paid tier is the hosted dashboard, the org-wide rule library, and the operator the Agent Manager doesn't have to be themselves.</strong></p>
+    <p><strong>The free CLI is real. Pro adds the personal dashboard, recall, exports, and managed adapters. Enterprise is the hosted dashboard, the org-wide rule library, and the operator the Agent Manager doesn't have to be themselves.</strong></p>
     <p>
       <a href="/#workflow-sprint-intake?utm_source=website&amp;utm_medium=codex_enterprise_page&amp;utm_campaign=codex_enterprise_sprint&amp;cta_id=codex_enterprise_sprint_intake&amp;cta_placement=codex_enterprise_page" class="cta">Start the Workflow Hardening Sprint</a>
       <a href="/checkout/pro?utm_source=website&amp;utm_medium=codex_enterprise_page&amp;utm_campaign=pro_upgrade&amp;cta_id=codex_enterprise_pro_checkout&amp;cta_placement=codex_enterprise_page&amp;plan_id=pro" class="secondary">Or start Pro at $19/mo →</a>

package/public/codex-plugin.html

@@ -224,7 +224,7 @@
   <section class="hero">
     <div class="wrap">
       <div class="eyebrow">Codex MCP plugin + Pre-Action Checks</div>
-      <h1>Give Codex a thumbs-down once. Block the repeat before it runs again.</h1>
+      <h1>Give Codex a thumbs-down once. Catch the repeat before it runs again.</h1>
       <p class="sub" style="font-size:13px;opacity:0.85;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
       <p class="sub">ThumbGate wires Codex into local-first feedback memory, MCP tools, and hook enforcement. The launcher resolves <code>thumbgate@latest</code> when Codex starts, so published npm fixes reach your active MCP server after a restart.</p>
       <div class="actions">
@@ -235,7 +235,7 @@
       <nav class="proof-bar" aria-label="Codex proof and conversion links">
         <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
         <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/COMMERCIAL_TRUTH.md" target="_blank" rel="noopener">Commercial truth</a>
-        <a href="/checkout/pro?utm_source=codex&utm_medium=plugin_page&utm_campaign=codex_plugin_follow_on&utm_content=pro&campaign_variant=pro_follow_on&offer_code=CODEX-PRO_FOLLOW_ON&cta_id=codex_pro_follow_on&cta_placement=plugin_page&plan_id=pro&surface=codex_plugin">Upgrade after one blocked repeat</a>
+        <a href="/checkout/pro?utm_source=codex&utm_medium=plugin_page&utm_campaign=codex_plugin_follow_on&utm_content=pro&campaign_variant=pro_follow_on&offer_code=CODEX-PRO_FOLLOW_ON&cta_id=codex_pro_follow_on&cta_placement=plugin_page&plan_id=pro&surface=codex_plugin">Upgrade after one caught repeat</a>
         <a href="/?utm_source=codex&utm_medium=plugin_page&utm_campaign=codex_team_follow_on&utm_content=workflow_sprint&campaign_variant=teams_follow_on&offer_code=CODEX-TEAMS_FOLLOW_ON&cta_id=codex_team_follow_on&cta_placement=plugin_page&surface=codex_plugin#workflow-sprint-intake">Team workflow sprint</a>
       </nav>
       <pre class="terminal">$ npx thumbgate init --agent codex
@@ -255,8 +255,8 @@ $ npx thumbgate feedback-self-test
       <p>The Codex launcher installs <code>thumbgate@latest</code> into <code>~/.thumbgate/runtime</code> before running MCP or gate checks. A new npm publish reaches Codex after the app restarts.</p>
     </div>
     <div class="tile">
-      <h3>Hard stop before action</h3>
-      <p>Pre-Action Checks evaluate commands, file edits, publishes, merges, and other high-risk actions before execution. Bad repeats get blocked before they burn time or tokens.</p>
+      <h3>Checks before action</h3>
+      <p>Pre-Action Checks evaluate commands, file edits, publishes, merges, and other high-risk actions before execution. Bad repeats are flagged and logged before they burn time or tokens — and hard-blocked for secret exfiltration and guardrail-tampering by default (destructive deletes, force-push, and supply-chain warn by default) or when strict enforcement is enabled.</p>
     </div>
   </section>
 
@@ -334,7 +334,7 @@ $ npx thumbgate feedback-self-test
   <section class="wrap grid" aria-label="Proof-backed next steps">
     <div class="tile">
       <h3>Pro only after proof</h3>
-      <p>Use the free Codex path to prove one real blocked repeat first. Upgrade to Pro only when you want the personal dashboard, proof-ready exports, and a review surface after that proof exists.</p>
+      <p>Use the free Codex path to prove one real caught repeat first. Upgrade to Pro only when you want the personal dashboard, proof-ready exports, and a review surface after that proof exists.</p>
     </div>
     <div class="tile">
       <h3>Commercial truth stays inspectable</h3>

package/public/compare.html

@@ -46,7 +46,7 @@
       "name": "What is a pre-action check for AI coding agents?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests. ThumbGate implements pre-action checks via PreToolUse hooks that fire before every tool call."
+        "text": "A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks flag and log risky actions, and hard-block the most dangerous classes by default (secret exfiltration, supply-chain installs, and rm -rf-class deletes). Actions such as force-pushing to main, off-scope edits, or skipping tests warn by default and hard-block under strict enforcement mode (THUMBGATE_STRICT_ENFORCEMENT=1). ThumbGate implements pre-action checks via PreToolUse hooks that fire before every tool call."
       }
     },
     {
@@ -62,7 +62,7 @@
       "name": "Is ThumbGate free?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "ThumbGate has a free tier that includes local enforcement with 2 feedback captures/day, 10 total captures, up to 3 active auto-promoted prevention rules, and pre-action check blocking. Pro ($19/mo or $149/yr) adds hosted sync, a personal local dashboard, recall, lesson search, unlimited captures/rules, and DPO export. Enterprise (custom pricing, scoped after intake) adds a shared lesson database and org dashboard."
+        "text": "ThumbGate free includes local enforcement with 2 captures/day, 10 total captures, 3 active auto-promoted prevention rules, and pre-action blocking. Pro ($19/mo or $149/yr) adds personal recall, search, a local dashboard, managed adapters, unlimited captures/rules, and DPO export. Enterprise adds a shared hosted lesson DB and org dashboard."
       }
     },
     {
@@ -70,7 +70,7 @@
       "name": "How is ThumbGate different from .cursorrules or CLAUDE.md rules?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback, so you never have to write rules manually."
+        "text": "Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is flagged and logged, and hard-blocked before execution for the most dangerous classes or under strict enforcement mode. Additionally, ThumbGate auto-generates prevention rules from feedback, so you never have to write rules manually."
       }
     },
     {
@@ -161,8 +161,8 @@
     <th>ESLint / Linters</th>
   </tr>
   <tr>
-    <td>Blocks bad actions before execution</td>
-    <td class="yes">Yes -- PreToolUse hooks</td>
+    <td>Intercepts bad actions before execution</td>
+    <td class="yes">Yes -- PreToolUse hooks warn by default; hard-block high-risk classes and strict mode</td>
     <td class="partial">Partially -- after PR only</td>
     <td class="no">No -- damage already done</td>
     <td class="partial">Partially -- suggestions only</td>
@@ -237,7 +237,7 @@
 
 <h2>Why ThumbGate Wins</h2>
 <ul>
-  <li><strong>Enforcement, not suggestions.</strong> Prompt rules in CLAUDE.md or .cursorrules are instructions the agent can ignore. ThumbGate intercepts tool calls at the PreToolUse hook level and physically blocks dangerous actions before they execute.</li>
+  <li><strong>Enforcement, not suggestions.</strong> Prompt rules in CLAUDE.md or .cursorrules are instructions the agent can ignore. ThumbGate intercepts tool calls at the PreToolUse hook level, flags and logs risky actions, and hard-blocks the most dangerous classes (secret exfiltration, supply-chain installs, rm -rf-class deletes) before they execute — with force-push, off-scope edits, and skip-tests escalated to hard blocks under strict enforcement mode.</li>
   <li><strong>Learns and adapts automatically.</strong> Every thumbs-down becomes a data point. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule. Checks adapt their sensitivity over time using Thompson Sampling -- aggressive checks that over-block get tuned down, effective checks get reinforced.</li>
   <li><strong>Works across all major AI coding agents.</strong> One install command covers Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, and OpenCode. No per-agent configuration needed.</li>
   <li><strong>Prevention is cheaper than recovery.</strong> Manual code review catches mistakes after the PR. Git revert catches them after the push. ThumbGate catches them before the tool call executes -- saving the time, context switches, and cleanup cost of undoing damage.</li>
@@ -271,7 +271,7 @@
 <p style="color:var(--muted);">Every head-to-head in one place. ThumbGate is the local-first, learning enforcement layer at the tool-call boundary — most of these tools sit at a different layer and are complementary.</p>
 <ul class="compare-index">
   <li><a href="/compare/sigmashake">ThumbGate vs SigmaShake</a> — learns the rule from your thumbs-down vs a hand-picked ruleset hub</li>
-  <li><a href="/compare/claude-code-hooks">ThumbGate vs claude-code-hooks</a> — hosted sync &amp; learning on top of local shell-script hooks</li>
+  <li><a href="/compare/claude-code-hooks">ThumbGate vs claude-code-hooks</a> — personal recall, exports, and managed adapters on top of local shell-script hooks</li>
   <li><a href="/compare/arcjet">ThumbGate vs Arcjet</a> — agent-outbound gate pairs with an app-inbound firewall</li>
   <li><a href="/compare/bumblebee">ThumbGate vs Bumblebee</a> — runtime enforcement pairs with static inventory</li>
   <li><a href="/compare/anthropic-containment">ThumbGate vs Anthropic's Claude Containment</a> — an IDE-agent extension of Anthropic's published architecture</li>
@@ -324,7 +324,7 @@
 
 <div class="card">
   <h3>What is a pre-action check?</h3>
-  <p>A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests.</p>
+  <p>A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks flag and log risky actions and hard-block the most dangerous classes by default (secret exfiltration, supply-chain installs, rm -rf-class deletes). Actions such as force-pushing to main, off-scope edits, or skipping tests warn by default and hard-block under strict enforcement mode.</p>
 </div>
 
 <div class="card">
@@ -334,12 +334,12 @@
 
 <div class="card">
   <h3>Is ThumbGate free?</h3>
-  <p>ThumbGate has a free tier that includes local enforcement with 2 feedback captures/day, 10 total captures, up to 3 active auto-promoted prevention rules, and pre-action check blocking. Pro ($19/mo or $149/yr) adds hosted sync, a personal local dashboard, recall, lesson search, unlimited captures/rules, and DPO export. Enterprise (custom pricing, scoped after intake) adds a shared lesson database and org dashboard.</p>
+  <p>ThumbGate free includes local enforcement with 2 captures/day, 10 total captures, 3 active auto-promoted prevention rules, and pre-action blocking. Pro ($19/mo or $149/yr) adds personal recall, search, a local dashboard, managed adapters, unlimited captures/rules, and DPO export. Enterprise adds a shared hosted lesson DB and org dashboard.</p>
 </div>
 
 <div class="card">
   <h3>How is ThumbGate different from .cursorrules or CLAUDE.md rules?</h3>
-  <p>Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback -- no manual rule writing.</p>
+  <p>Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is flagged and logged, and hard-blocked before execution for the most dangerous classes or under strict enforcement mode. Additionally, ThumbGate auto-generates prevention rules from feedback -- no manual rule writing.</p>
 </div>
 
 <div class="card">

package/public/dashboard.html

@@ -756,7 +756,7 @@
           <div><span style="color:var(--green);">👍 "chosen"</span> — the response that worked</div>
           <div><span style="color:var(--red);">👎 "rejected"</span> — the response that failed</div>
         </div>
-        <p style="color:var(--text-muted);font-size:14px;line-height:1.65;">Use these pairs to fine-tune any model (OpenAI, Llama, Mistral) so it <strong style="color:var(--text);">actually learns from your corrections</strong> — not just blocks mistakes, but stops making them.</p>
+        <p style="color:var(--text-muted);font-size:14px;line-height:1.65;">Use these pairs to fine-tune any model (OpenAI, Llama, Mistral) so it <strong style="color:var(--text);">actually learns from your corrections</strong> — not just flags mistakes at the gate, but stops making them.</p>
       </div>
       <button class="export-btn" onclick="exportDpo()">📥 Download DPO Pairs (JSON)</button>
       <div id="exportStatus" style="margin-top:12px;font-size:13px;color:var(--text-muted);"></div>