thumbgate 1.27.20 → 1.28.1

package/public/diagnostic.html

@@ -252,7 +252,7 @@ footer { padding: 32px 0 44px; color: var(--muted); }
         <option>We need an independent proof checklist first</option>
       </select>
       <button type="submit" data-revenue-cta data-cta-id="diagnostic_page_submit" data-cta-placement="intake">Submit for diagnostic scope</button>
-      <p class="hint">Ready to pay now? Use the $499 diagnostic checkout above. If the workflow needs fit review first, submit it here and we will route you to the diagnostic or sprint only when the scope is real.</p>
+      <p class="hint" data-diagnostic-payment-hint>Ready to pay now? Use the $499 diagnostic checkout above. If the workflow needs fit review first, submit it here and we will route you to the diagnostic or sprint only when the scope is real.</p>
     </form>
   </div>
   <section>
@@ -295,6 +295,28 @@ footer { padding: 32px 0 44px; color: var(--muted); }
 <script>
 (function () {
   const search = new URLSearchParams(window.location.search);
+  const paidCta = document.querySelector('[data-cta-id="diagnostic_hero_paid"]');
+  const inboundSource = search.get('utm_source') || search.get('source');
+  const isAiventyxTraffic = String(inboundSource || '').trim().toLowerCase() === 'aiventyx';
+  if (paidCta && isAiventyxTraffic) {
+    paidCta.remove();
+    const paymentHint = document.querySelector('[data-diagnostic-payment-hint]');
+    if (paymentHint) {
+      paymentHint.textContent = 'Submit the workflow here. Aiventyx will collect payment on its checkout once the scope is accepted.';
+    }
+  } else if (paidCta) {
+    const href = new URL(paidCta.getAttribute('href'), window.location.origin);
+    const passthrough = /^(utm_(source|medium|campaign|content|term)|source|acquisition_id|visitor_id|session_id|visitor_session_id|install_id|trace_id|creator|community|post_id|comment_id|campaign_variant|offer_code|referrer_host)$/i;
+    for (const [key, value] of search.entries()) {
+      if (!passthrough.test(key) || !value.trim()) continue;
+      href.searchParams.set(key, value.trim());
+    }
+    if (inboundSource && inboundSource.trim()) {
+      href.searchParams.set('utm_source', inboundSource.trim());
+    }
+    paidCta.setAttribute('href', `${href.pathname}${href.search}${href.hash}`);
+  }
+
   const form = document.querySelector('[data-diagnostic-intake-form]');
   if (form) {
     for (const [key, value] of search.entries()) {

package/public/federal.html

@@ -223,7 +223,7 @@ __GA_BOOTSTRAP__
       </div>
       <div class="card">
         <h3>Repeated-failure prevention</h3>
-        <p>A thumbs-down from an agency engineer becomes a permanent prevention rule. The same risky action never reaches the model on the next attempt — relevant for cost control and for documenting "we did not let the agent do X" in incident review.</p>
+        <p>A thumbs-down from an agency engineer becomes a prevention rule. On the next attempt that risky action is flagged and logged — and hard-blocked for the highest-risk classes or under strict enforcement mode — relevant for cost control and for documenting "we did not let the agent do X" in incident review.</p>
       </div>
       <div class="card">
         <h3>Vendor-neutral</h3>
@@ -268,7 +268,7 @@ __GA_BOOTSTRAP__
         <tr><th>Family</th><th>Control</th><th>How ThumbGate supports it</th></tr>
       </thead>
       <tbody>
-        <tr><td>AC</td><td><code>AC-3</code> Access Enforcement</td><td>PreToolUse hook blocks tool calls that violate policy regardless of operator intent.</td></tr>
+        <tr><td>AC</td><td><code>AC-3</code> Access Enforcement</td><td>PreToolUse hook flags and logs tool calls that violate policy regardless of operator intent, and hard-blocks them under strict enforcement mode.</td></tr>
         <tr><td>AC</td><td><code>AC-6</code> Least Privilege</td><td>Per-gate scopes bind agent actions to declared task scope.</td></tr>
         <tr><td>AU</td><td><code>AU-2 / AU-3 / AU-12</code> Audit Logging</td><td>Every gate decision logged with full payload, PII-redacted, exportable to agency SIEM.</td></tr>
         <tr><td>CM</td><td><code>CM-3</code> Configuration Change Control</td><td>Branch governance gate requires <code>releaseVersion</code> declaration before release/publish actions.</td></tr>

package/public/guide.html

@@ -9,7 +9,7 @@
 <meta name="description" content="The complete guide to preventing AI coding agent mistakes with pre-action checks, history-aware lesson distillation, and automatic prevention rules.">
 <meta name="keywords" content="AI agent mistakes, Claude Code force push, AI coding agent memory, MCP server guardrails, pre-action checks, vibe coding safety, PreToolUse hooks, ThumbGate, SpecLock alternative, Mem0 alternative">
 <meta property="og:title" content="How to Stop AI Coding Agents From Repeating Mistakes">
-<meta property="og:description" content="Pre-action checks that physically block AI agents from repeating known mistakes. The complete guide.">
+<meta property="og:description" content="Pre-action checks that flag and log known agent mistakes — and hard-block the catastrophic ones. The complete guide.">
 <meta property="og:type" content="article">
 <meta property="og:url" content="https://thumbgate.ai/guide">
 <link rel="canonical" href="https://thumbgate.ai/guide">
@@ -69,8 +69,8 @@
     {
       "@type": "HowToStep",
       "position": 4,
-      "name": "Checks block mistakes before they happen",
-      "text": "PreToolUse hooks intercept tool calls and check them against known failure patterns. Bad actions are blocked before execution."
+      "name": "Checks flag mistakes before they happen",
+      "text": "PreToolUse hooks intercept tool calls and check them against known failure patterns. Risky actions are flagged and logged before execution; catastrophic ones (secret exfiltration, destructive deletes) are hard-blocked, and any rule can hard-block under strict mode."
     }
   ]
 }
@@ -94,7 +94,7 @@
       "name": "Why does my Claude Code agent keep force-pushing to main?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "Because prompt rules are suggestions the agent can ignore. ThumbGate solves this with enforcement: a PreToolUse hook fires before every tool call and checks it against known failure patterns. If the action matches a check (like git push --force to main), it is physically blocked before execution."
+        "text": "Because prompt rules are suggestions the agent can ignore. ThumbGate adds enforcement: a PreToolUse hook fires before every tool call and checks it against known failure patterns. When the action matches a check (like git push --force to main), it is flagged and logged before execution — and hard-blocked when strict enforcement (THUMBGATE_STRICT_ENFORCEMENT=1) is on. Catastrophic actions such as secret exfiltration and destructive deletes are hard-blocked by default."
       }
     },
     {
@@ -102,7 +102,7 @@
       "name": "What is the difference between pre-action checks and prompt rules?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "Prompt rules (like CLAUDE.md or .cursorrules) are instructions the agent may ignore. Pre-action checks are enforcement: they intercept the tool call at the PreToolUse hook level and block it before execution. Checks are auto-generated from feedback and use Thompson Sampling to adapt their sensitivity."
+        "text": "Prompt rules (like CLAUDE.md or .cursorrules) are instructions the agent may ignore. Pre-action checks are enforcement: they intercept the tool call at the PreToolUse hook level and act on it before execution — flagging and logging by default, hard-blocking catastrophic actions and anything under strict mode. Checks are auto-generated from feedback and use Thompson Sampling to adapt their sensitivity."
       }
     },
     {
@@ -110,7 +110,7 @@
       "name": "How does ThumbGate compare to SpecLock?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "SpecLock requires manually writing constraints or compiling them from a PRD. ThumbGate learns automatically from thumbs-up/down feedback and auto-generates prevention rules from repeated failures. SpecLock locks files from modification; ThumbGate blocks specific actions before they execute."
+        "text": "SpecLock requires manually writing constraints or compiling them from a PRD. ThumbGate learns automatically from thumbs-up/down feedback and auto-generates prevention rules from repeated failures. SpecLock locks files from modification; ThumbGate flags specific actions before they execute and hard-blocks the catastrophic ones (or any rule under strict mode)."
       }
     },
     {
@@ -118,7 +118,7 @@
       "name": "How does ThumbGate compare to Mem0?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "Mem0 is cloud-hosted memory for AI apps. ThumbGate is local-first enforcement. Mem0 remembers context but cannot block actions. ThumbGate captures feedback, promotes it to prevention rules, and physically blocks tool calls that match known failure patterns."
+        "text": "Mem0 is cloud-hosted memory for AI apps. ThumbGate is local-first enforcement. Mem0 remembers context but does not gate actions. ThumbGate captures feedback, promotes it to prevention rules, and flags tool calls that match known failure patterns — hard-blocking the catastrophic ones (or any rule under strict mode)."
       }
     },
     {
@@ -223,7 +223,7 @@
 <p>This happens because <strong>prompt rules are suggestions</strong>. The agent can read them, forget them, or override them. There is no enforcement at the tool-call level.</p>
 
 <h2>The Fix: Pre-Action Checks</h2>
-<p>ThumbGate adds an enforcement layer between your agent and its tools. When the agent tries to execute a tool call, a <code>PreToolUse</code> hook fires <em>before</em> the action runs. The hook checks the call against known failure patterns. If it matches a check, the action is blocked.</p>
+<p>ThumbGate adds an enforcement layer between your agent and its tools. When the agent tries to execute a tool call, a <code>PreToolUse</code> hook fires <em>before</em> the action runs. The hook checks the call against known failure patterns. If it matches a check, the action is flagged and logged — and hard-blocked for secret exfiltration and guardrail-tampering by default (destructive deletes, force-push, and supply-chain warn by default) or when strict enforcement (<code>THUMBGATE_STRICT_ENFORCEMENT=1</code>) is on.</p>
 
 <div class="card">
 <h3>Before ThumbGate</h3>
@@ -231,7 +231,7 @@
 Result: Force-pushed. You lose 3 commits. Again.</code></pre>
 <h3>After ThumbGate</h3>
 <pre><code>Agent: git push --force origin main
-[check] Blocked: no-force-push (confidence: 0.94)
+[check] Warn: no-force-push (confidence: 0.94) — hard-blocked under strict mode
 Agent: git push origin feature-branch
 [check] Passed</code></pre>
 </div>
@@ -257,7 +257,7 @@ npx thumbgate init --agent gemini</code></pre>
       <td><strong>Machine-wide</strong> (default)</td>
       <td><code>npx thumbgate init</code></td>
       <td><code>~/.claude/memory/feedback/</code> — <strong>one shared dashboard across every repo on the machine</strong></td>
-      <td>Solo developer. A lesson learned in <code>repo-A</code> automatically blocks the same mistake in <code>repo-B</code>.</td>
+      <td>Solo developer. A lesson learned in <code>repo-A</code> automatically flags the same mistake in <code>repo-B</code>.</td>
     </tr>
     <tr>
       <td><strong>Per-project</strong></td>
@@ -315,7 +315,7 @@ npx thumbgate init --agent gemini</code></pre>
 <table class="comparison-table">
   <tr><th>Feature</th><th>Prompt Rules</th><th>Pre-Action Checks</th></tr>
   <tr><td>Where they live</td><td>CLAUDE.md, .cursorrules</td><td>PreToolUse hooks</td></tr>
-  <tr><td>Enforcement</td><td>Suggestion (can be ignored)</td><td>Blocks execution</td></tr>
+  <tr><td>Enforcement</td><td>Suggestion (can be ignored)</td><td>Flags + logs; hard-blocks critical / strict mode</td></tr>
   <tr><td>When they fire</td><td>At prompt load</td><td>Before every tool call</td></tr>
   <tr><td>Auto-generated</td><td>No — hand-written</td><td>Yes — from feedback</td></tr>
   <tr><td>Adaptive</td><td>No</td><td>Yes — Thompson Sampling</td></tr>
@@ -325,7 +325,7 @@ npx thumbgate init --agent gemini</code></pre>
 <h2>ThumbGate vs Alternatives</h2>
 <table class="comparison-table">
   <tr><th>Feature</th><th>ThumbGate</th><th>SpecLock</th><th>Mem0</th></tr>
-  <tr><td>Blocks mistakes before execution</td><td>Yes — PreToolUse checks</td><td>Yes — Patch Firewall</td><td>No</td></tr>
+  <tr><td>Flags mistakes before execution</td><td>Yes — PreToolUse checks (hard-blocks critical / strict mode)</td><td>Yes — Patch Firewall</td><td>No</td></tr>
   <tr><td>Learns from feedback</td><td>Yes — thumbs up/down</td><td>No — manual specs</td><td>Yes — auto-capture</td></tr>
   <tr><td>Auto-generates rules</td><td>Yes — from repeated failures</td><td>No</td><td>No</td></tr>
   <tr><td>Agent support</td><td>Claude Code, Codex, Gemini, Amp, Cursor, OpenCode</td><td>Claude Code, Cursor, Windsurf, Cline</td><td>Claude, Cursor</td></tr>
@@ -342,7 +342,7 @@ npx thumbgate init --agent gemini</code></pre>
 <p>Give a thumbs-down: "committed code with failing tests." ThumbGate learns the pattern and checks future commits when test results show failures.</p>
 
 <h3>Agent uses wrong API endpoint</h3>
-<p>Give a thumbs-down: "called staging API in production code." The check blocks tool calls that reference staging URLs in production contexts.</p>
+<p>Give a thumbs-down: "called staging API in production code." The check flags and logs tool calls that reference staging URLs in production contexts (and hard-blocks them under strict mode).</p>
 
 <h2>When ThumbGate becomes a paid decision</h2>
 <p>Stay on the free install path while one operator is proving the workflow locally. The paid motion starts when a workflow owner asks for proof, shared enforcement, or a safer rollout path.</p>
@@ -375,7 +375,7 @@ npx thumbgate init --agent gemini</code></pre>
 <a href="__SPRINT_DIAGNOSTIC_CHECKOUT_URL__" class="cta cta-secondary">Pay $499 diagnostic</a>
 <a href="__WORKFLOW_SPRINT_CHECKOUT_URL__" class="cta cta-secondary">Pay $1500 sprint</a>
 <a href="https://thumbgate.ai/#workflow-sprint-intake" class="cta cta-secondary">Send workflow first</a>
-<p style="color:var(--muted); font-size:0.85rem;">Free: 2 captures/day, 10 total captures, 3 active prevention rules, hook blocking. Pro: hosted sync, dashboard, recall, lesson search, unlimited captures/rules, DPO export. Enterprise: intake first, then custom pricing scoped to your rollout.</p>
+<p style="color:var(--muted); font-size:0.85rem;">Free: 2 captures/day, 10 total captures, 3 active prevention rules, hook blocking. Pro: personal dashboard, recall, search, unlimited captures/rules, managed adapters, DPO export. Enterprise: shared hosted lessons, org visibility, custom rollout support.</p>
 
 </div>
 <script src="/js/buyer-intent.js"></script>