thumbgate 1.28.0 → 1.28.1

package/adapters/mcp/server-stdio.js

@@ -231,7 +231,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.28.0' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.28.1' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',
@@ -1430,22 +1430,14 @@ function writeNdjsonResponse(id, payload, error = null) {
   process.stdout.write(`${body}\n`);
 }
 
-/**
- * Default staleness threshold: if a lock is older than this (ms), the holder
- * is considered orphaned even if its PID is still alive — it likely belongs
- * to a defunct Claude Code session whose process was never reaped.
- */
-const LOCK_STALE_MS = Number(process.env.THUMBGATE_LOCK_STALE_MS) || 2 * 60 * 60 * 1000; // 2 hours
-
 /**
  * Acquire a file-system lock to prevent duplicate MCP server instances.
- * Returns { lockFile, cleanupLock } on success, or calls process.exit(1)
- * if another live server holds the lock.
+ * Returns { lockFile, cleanupLock } on success.
  *
- * Staleness reaping: if the lock-holding process is alive but the lock is
- * older than LOCK_STALE_MS, the holder is killed (SIGTERM) and the lock is
- * reclaimed. This prevents orphaned `thumbgate serve` processes from permanently
- * blocking new sessions.
+ * Every live stdio client needs its own MCP process, and those sessions can
+ * legitimately run for many hours. A lock's age is therefore not evidence that
+ * its owner is orphaned. Live owners coexist through per-session locks; only a
+ * lock whose PID is no longer running is reclaimed.
  */
 function acquireLock() {
   const feedbackDir = getFeedbackPaths().FEEDBACK_DIR;
@@ -1458,26 +1450,19 @@ function acquireLock() {
       try { process.kill(lockData.pid, 0); isRunning = true; } catch { /* process is dead */ }
 
       if (isRunning) {
-        const lockAge = Date.now() - new Date(lockData.startedAt).getTime();
-        if (lockAge > LOCK_STALE_MS) {
-          // Orphaned process — kill it and take over
-          process.stderr.write(`[thumbgate] Lock held by PID ${lockData.pid} is ${Math.round(lockAge / 60000)}m old (threshold: ${Math.round(LOCK_STALE_MS / 60000)}m). Reaping orphaned process.\n`);
-          try { process.kill(lockData.pid, 'SIGTERM'); } catch { /* already gone */ }
-        } else {
-          // Another session's MCP server is running — coexist via per-session lock.
-          // Each Claude session communicates via its own stdio pipe and needs its own server.
-          // SQLite WAL mode handles concurrent access safely.
-          process.stderr.write(`[thumbgate] Another MCP server (PID ${lockData.pid}) is running for ${feedbackDir}. Starting concurrent session.\n`);
-          const sessionLockFile = path.join(feedbackDir, `.mcp-server-${process.pid}.lock`);
-          fs.writeFileSync(sessionLockFile, JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
-          const cleanupSessionLock = () => { try { fs.unlinkSync(sessionLockFile); } catch { /* already removed */ } };
-          process.on('exit', cleanupSessionLock);
-          process.on('SIGTERM', () => { cleanupSessionLock(); process.exit(0); });
-          process.on('SIGINT', () => { cleanupSessionLock(); process.exit(0); });
-          return { lockFile: sessionLockFile, cleanupLock: cleanupSessionLock };
-        }
+        // Another session's MCP server is running — coexist via per-session lock.
+        // Each client communicates via its own stdio pipe and needs its own server.
+        // SQLite WAL mode handles concurrent access safely.
+        process.stderr.write(`[thumbgate] Another MCP server (PID ${lockData.pid}) is running for ${feedbackDir}. Starting concurrent session.\n`);
+        const sessionLockFile = path.join(feedbackDir, `.mcp-server-${process.pid}.lock`);
+        fs.writeFileSync(sessionLockFile, JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
+        const cleanupSessionLock = () => { try { fs.unlinkSync(sessionLockFile); } catch { /* already removed */ } };
+        process.on('exit', cleanupSessionLock);
+        process.on('SIGTERM', () => { cleanupSessionLock(); process.exit(0); });
+        process.on('SIGINT', () => { cleanupSessionLock(); process.exit(0); });
+        return { lockFile: sessionLockFile, cleanupLock: cleanupSessionLock };
       }
-      // Stale lock from a dead or reaped process — remove it
+      // Stale lock from a dead process — remove it.
       try { fs.unlinkSync(lockFile); } catch { /* already gone */ }
       process.stderr.write(`[thumbgate] Removed stale lock (PID ${lockData.pid} is no longer running).\n`);
     }

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.28.0",
+        "thumbgate@1.28.1",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -2695,23 +2695,27 @@ function install() {
 }
 
 async function gateCheck() {
-  // Explicit emergency escape hatch ONLY. The 2026-06-03 hotfix made this
-  // bypass-by-default, which silently disabled ThumbGate's enforcement entirely
-  // (the firewall approved everything). Restored 2026-06-04: enforcement runs by
-  // default in warn-by-default posture (see gates-engine applyEnforcementPosture);
-  // set THUMBGATE_HOTFIX_BYPASS=1 to disable all checks if a gate ever misfires.
-  if (process.env.THUMBGATE_HOTFIX_BYPASS === '1') {
-    process.stdout.write(JSON.stringify({
-      decision: 'approve',
-      reason: 'hotfix-bypass-opt-in',
-      hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: '' }
-    }) + '\n');
-    return;
-  }
   try {
     const payload = readStdinText();
     const input = payload ? JSON.parse(payload) : {};
     const gatesEngine = require(path.join(PKG_ROOT, 'scripts', 'gates-engine'));
+
+    // The operator bypass only skips advisory and strict-mode gates. Security and
+    // self-protection floors are evaluated before the early approval path.
+    if (process.env.THUMBGATE_HOTFIX_BYPASS === '1') {
+      const hardFloorOutput = gatesEngine.runHardFloor(input);
+      if (hardFloorOutput) {
+        process.stdout.write(hardFloorOutput + '\n');
+        return;
+      }
+      process.stdout.write(JSON.stringify({
+        decision: 'approve',
+        reason: 'operator-bypass-opt-in',
+        hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: '' }
+      }) + '\n');
+      return;
+    }
+
     const output = await gatesEngine.runAsync(input);
     process.stdout.write(output + '\n');
   } catch (err) {
@@ -2749,11 +2753,18 @@ function statuslineRender() {
 
 function hookAutoCapture() {
   syncActiveProjectContext();
+  const { extractPromptEnvelope } = require(path.join(PKG_ROOT, 'scripts', 'feedback-sanitizer'));
+  const rawStdin = readStdinText();
+  const promptEnvelope = extractPromptEnvelope(rawStdin);
+  // stdin on a UserPromptSubmit hook is the JSON payload
+  // {session_id, transcript_path, cwd, prompt, ...}. Persist ONLY the human
+  // `.prompt` field — never the whole stdin object — so session metadata blobs
+  // can't be promoted as lessons.
   const prompt = process.env.CLAUDE_USER_PROMPT
     || process.env.THUMBGATE_USER_PROMPT
     || process.env.CODEX_USER_PROMPT
     || process.env.USER_PROMPT
-    || readStdinText().trim();
+    || promptEnvelope.prompt;
   const { evaluatePromptGuard } = require(path.join(PKG_ROOT, 'scripts', 'prompt-guard'));
   const { processInlineFeedback, formatCliOutput } = require(path.join(PKG_ROOT, 'scripts', 'cli-feedback'));
   const { detectFeedbackSignal } = require(path.join(PKG_ROOT, 'scripts', 'feedback-quality'));
@@ -2766,25 +2777,39 @@ function hookAutoCapture() {
     })
   );
 
-  recordConversationEntry({
-    author: 'user',
-    text: prompt,
-    source: 'claude_user_prompt',
-  });
-
   const guardResult = evaluatePromptGuard(prompt);
   if (guardResult) {
+    recordConversationEntry({
+      author: 'user',
+      text: prompt,
+      source: 'claude_user_prompt',
+    });
     process.stdout.write(`${JSON.stringify(guardResult)}\n`);
     return;
   }
 
   const detected = detectFeedbackSignal(prompt);
   if (!detected) {
+    recordConversationEntry({
+      author: 'user',
+      text: prompt,
+      source: 'claude_user_prompt',
+    });
     return;
   }
 
   const signal = detected.signal;
   const conversationWindow = readRecentConversationWindow({ limit: 8 });
+  const { buildFeedbackSourceIdentity } = require(path.join(PKG_ROOT, 'scripts', 'feedback-loop'));
+  const sourceEvent = buildFeedbackSourceIdentity({
+    signal,
+    promptText: prompt,
+    sessionId: promptEnvelope.sessionId || process.env.CLAUDE_SESSION_ID,
+    promptId: promptEnvelope.promptId,
+    projectDir: promptEnvelope.projectDir || CWD,
+    timestamp: promptEnvelope.timestamp,
+    source: 'claude-user-prompt',
+  });
   const result = processInlineFeedback({
     signal,
     context: prompt,
@@ -2793,7 +2818,15 @@ function hookAutoCapture() {
       : undefined,
     whatWentWrong: signal === 'down' ? prompt : undefined,
     whatWorked: signal === 'up' ? prompt : undefined,
+    sourceEvent,
   });
+  if (!result.feedbackResult || !result.feedbackResult.duplicate) {
+    recordConversationEntry({
+      author: 'user',
+      text: prompt,
+      source: 'claude_user_prompt',
+    });
+  }
   process.stdout.write(formatCliOutput(result) + '\n');
 }
 
@@ -3947,53 +3980,6 @@ switch (COMMAND) {
   case 'dispatch-brief':
     dispatchBrief();
     break;
-  case 'gate-check': {
-    // PreToolUse hook interface: reads tool call JSON from stdin, outputs gate verdict
-    // Used by: generate-pretool-hook.sh → npx thumbgate gate-check
-    const { run: gateRun, runAsync: gateRunAsync } = require(path.join(PKG_ROOT, 'scripts', 'gates-engine'));
-    const { evaluateSelfProtection } = require(path.join(PKG_ROOT, 'scripts', 'self-protection'));
-    let stdinData = '';
-    process.stdin.setEncoding('utf8');
-    process.stdin.on('data', (chunk) => { stdinData += chunk; });
-    process.stdin.on('end', async () => {
-      try {
-        const input = JSON.parse(stdinData);
-        const output = await gateRunAsync(input);
-        // Self-protection overlay (2026-07-08): the gate engine only denies edits
-        // to ThumbGate's own governance files under strict enforcement; by default
-        // such edits pass as a clean ALLOW. Surface them (or block in strict) so an
-        // agent can't silently disable the firewall. Only overlays when the engine
-        // did not already produce a hard deny.
-        let verdict = output;
-        try {
-          const parsed = JSON.parse(output || '{}');
-          const alreadyDeny = (parsed.hookSpecificOutput && parsed.hookSpecificOutput.permissionDecision === 'deny')
-            || parsed.decision === 'block';
-          if (!alreadyDeny) {
-            const sp = evaluateSelfProtection(input.tool_name, input.tool_input);
-            if (sp && sp.action === 'block') {
-              verdict = JSON.stringify({
-                decision: 'block',
-                reason: sp.message,
-                hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: sp.message },
-              });
-            } else if (sp && sp.action === 'warn') {
-              verdict = JSON.stringify({
-                hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: sp.message },
-              });
-            }
-          }
-        } catch (_e) { /* non-JSON engine output: pass through unchanged */ }
-        process.stdout.write(verdict + '\n');
-        process.exit(0);
-      } catch (err) {
-        process.stderr.write(`gate-check error: ${err.message}\n`);
-        process.stdout.write(JSON.stringify({}) + '\n');
-        process.exit(0);
-      }
-    });
-    break;
-  }
   case 'hermes-gate': {
     // Nous Research Hermes Agent `pre_tool_call` shell hook.
     // Hermes pipes each pending tool call as JSON to stdin and reads a decision from stdout;
@@ -4004,7 +3990,7 @@ switch (COMMAND) {
     // Hermes `pre_tool_call` is binary (block or allow) with no warn channel, and the whole point
     // of wiring it is to gate, so we run STRICT enforcement by default — otherwise ThumbGate's
     // warn-by-default posture would pass every deny through and the hook would block nothing.
-    // Opt out with THUMBGATE_HERMES_WARN_ONLY=1; THUMBGATE_HOTFIX_BYPASS=1 still disables checks.
+    // Opt out with THUMBGATE_HERMES_WARN_ONLY=1; the operator bypass also leaves ordinary gates advisory.
     // Wire it in ~/.hermes/config.yaml — see adapters/hermes/config.yaml.
     if (process.env.THUMBGATE_HERMES_WARN_ONLY !== '1' && process.env.THUMBGATE_HOTFIX_BYPASS !== '1') {
       process.env.THUMBGATE_STRICT_ENFORCEMENT = '1';
@@ -4016,8 +4002,22 @@ switch (COMMAND) {
     process.stdin.on('end', async () => {
       try {
         const payload = JSON.parse(hermesStdin);
-        // Hermes sends snake_case tool_name/tool_input — gates-engine reads these directly.
-        const verdict = await hermesGateRun({ tool_name: payload.tool_name, tool_input: payload.tool_input });
+        const hermesToolName = String(payload.tool_name || '');
+        const canonicalToolNames = {
+          terminal: 'Bash',
+          process: 'Bash',
+          execute_code: 'Bash',
+          patch: 'Edit',
+          write_file: 'Write',
+          read_file: 'Read',
+        };
+        const verdict = await hermesGateRun({
+          tool_name: canonicalToolNames[hermesToolName] || hermesToolName,
+          tool_input: {
+            ...(payload.tool_input || {}),
+            hermes_tool_name: hermesToolName,
+          },
+        });
         let parsed = {};
         try { parsed = JSON.parse(verdict); } catch (_e) { parsed = {}; }
         const hso = parsed.hookSpecificOutput || {};

package/config/gates/default.json

@@ -342,7 +342,7 @@
       "id": "self-protect-config",
       "layer": "Execution",
       "toolNames": ["Edit", "Write", "MultiEdit"],
-      "pattern": "(?:config/gates/|config/budget\\.json|\\.thumbgate/|thumbgate\\.json)",
+      "pattern": "(?:config/gates/|config/(?:budget|enforcement|mcp-allowlists)\\.json|\\.thumbgate/config\\.json|thumbgate\\.json)",
       "action": "block",
       "message": "Self-protection: agent cannot modify ThumbGate configuration, gate rules, or budget settings.",
       "severity": "critical",
@@ -372,7 +372,7 @@
       "id": "self-protect-hooks-disable",
       "layer": "Execution",
       "toolNames": ["Edit", "Write", "Bash"],
-      "pattern": "(?:settings\\.json|settings\\.local\\.json).*(?:hooks|PreToolUse|PostToolUse)",
+      "pattern": "(?:\\.claude/settings(?:\\.local)?\\.json|\\.codex/config\\.toml|scripts/hook-[^/]+\\.(?:js|sh))",
       "action": "block",
       "message": "Self-protection: agent cannot modify hook registrations.",
       "severity": "critical",

package/config/github-about.json

@@ -2,14 +2,11 @@
   "repo": "IgorGanapolsky/ThumbGate",
   "repositoryUrl": "https://github.com/IgorGanapolsky/ThumbGate",
   "homepageUrl": "https://thumbgate.ai",
-  "githubDescription": "Agent governance: thumbs become Pre-Action Checks that flag repeat mistakes and hard-block catastrophic classes before code or systems change.",
-  "metaDescription": "ThumbGate is the pre-action governance runtime for AI coding agents (Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode): 👍 thumbs up and 👎 thumbs down feedback become history-aware lessons stored locally; Enterprise adds shared lessons and org visibility. PreToolUse checks flag and log risky tool calls — hard-blocking catastrophic classes by default and warning on the rest, with strict mode to hard-block every rule.",
+  "githubDescription": "ThumbGate Pre-Action Checks derive rules from repeated failures, flag risky tool calls, hard-block detected secret leaks, and block matches in strict mode.",
+  "metaDescription": "ThumbGate is the local pre-action governance runtime for AI coding agents (Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode): accepted 👍 thumbs-up and 👎 thumbs-down feedback becomes history-aware local lessons; repeated failures can become prevention rules. PreToolUse checks flag and log risky tool calls, hard-block detected secret leaks, and block matching actions in strict mode. Pro is for individual operators; Enterprise rollout is scoped after intake.",
   "topics": [
     "thumbgate",
     "pre-action-checks",
-    "save-llm-tokens",
-    "reduce-llm-cost",
-    "ai-cost-optimization",
     "mcp",
     "mcp-server",
     "ai-agents",

package/config/post-deploy-marketing-pages.json

@@ -4,7 +4,7 @@
   "pages": [
     {
       "route": "/",
-      "sentinel": "Stop paying for the same AI mistake twice",
+      "sentinel": "Catch AI agents before they spend money",
       "description": "Home page hero (lifeblood — never regress)"
     },
     {

package/hooks/hooks.json

@@ -0,0 +1,38 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/hook-pre-tool-use.js"]
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${CLAUDE_PLUGIN_ROOT}/bin/cli.js", "hook-auto-capture"]
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${CLAUDE_PLUGIN_ROOT}/bin/cli.js", "session-start"]
+          }
+        ]
+      }
+    ]
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
-  "version": "1.28.0",
-  "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 36 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
+  "version": "1.28.1",
+  "description": "ThumbGate Pre-Action Checks derive rules from repeated failures, flag risky tool calls, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
     "type": "git",
@@ -46,6 +46,7 @@
     "scripts/bayes-optimal-gate.js",
     "scripts/belief-update.js",
     "scripts/billing.js",
+    "scripts/checkout-attribution-reference.js",
     "scripts/bot-detection.js",
     "scripts/build-metadata.js",
     "scripts/classifier-routing.js",
@@ -235,6 +236,7 @@
     "scripts/workspace-evolver.js",
     "scripts/xmemory-lite.js",
     ".claude-plugin/plugin.json",
+    "hooks/hooks.json",
     ".claude/commands/",
     "commands/",
     ".well-known/",
@@ -280,9 +282,11 @@
     "public/learn.html",
     "public/lessons.html",
     "public/numbers.html",
+    "public/partner-intake.html",
     "public/pricing.html",
     "public/pro.html",
     "public/assets/brand/",
+    "!public/assets/brand/github-social-preview.png",
     "public/assets/claude-thumbgate-statusbar.svg",
     "public/assets/codex-thumbgate-statusbar-test.svg",
     "public/assets/legal-intake-control-flow.svg",
@@ -383,7 +387,7 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:cursor-marketplace-doctor && npm run test:okara-money-promo-automation",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
     "test:python": "python3 -m pytest tests/*.py",
     "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
@@ -444,7 +448,7 @@
     "test:memory-dedup": "node --test tests/memory-dedup.test.js",
     "test:lesson-db": "node --test tests/lesson-db.test.js",
     "test:lesson-rotation": "node --test tests/lesson-rotation.test.js",
-    "test:feedback-quality": "node --test tests/feedback-quality.test.js",
+    "test:feedback-quality": "node --test tests/feedback-quality.test.js tests/feedback-event-idempotency.test.js",
     "test:sync-version": "node --test tests/sync-version.test.js",
     "test:release-window": "node --test tests/release-window.test.js",
     "test:team-sync": "node --test tests/team-sync.test.js",
@@ -512,11 +516,11 @@
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
     "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js",
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js",
-    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/revenue-pack-utils.test.js tests/sales-pipeline.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
+    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
     "test:sales-pipeline": "node --test tests/sales-pipeline.test.js",
-    "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js",
+    "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js tests/checkout-attribution-reference.test.js",
     "test:billing-setup": "node --test tests/billing-setup-redaction.test.js",
-    "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
+    "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/feedback-lesson-sanitization.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
     "test:evolution": "node --test tests/workspace-evolver.test.js",
     "test:watcher": "node --test tests/jsonl-watcher.test.js",
     "test:autoresearch": "node --test tests/autoresearch.test.js",
@@ -637,13 +641,16 @@
     "test:product-feedback": "node --test tests/product-feedback.test.js",
     "test:feedback-root-consolidator": "node --test tests/feedback-root-consolidator.test.js",
     "social:publish:launch": "node scripts/social-analytics/publish-thumbgate-launch.js",
+    "social:publish:latest-release-article": "node scripts/social-analytics/publish-latest-release-article.js",
+    "social:publish:latest-release-fallbacks": "node scripts/social-analytics/publish-latest-release-fallbacks.js",
+    "social:verify:latest-release": "node scripts/social-analytics/verify-latest-release-posts.js",
     "social:schedule:campaign": "node scripts/social-analytics/schedule-thumbgate-campaign.js",
     "social:install:growth": "node scripts/social-analytics/install-growth-automation.js",
     "social:reconcile:campaign": "node scripts/social-analytics/reconcile-thumbgate-campaign.js",
     "social:sync:launch-assets": "node scripts/social-analytics/sync-launch-assets.js",
     "social:engagement:audit": "node scripts/social-analytics/engagement-audit.js",
     "test:install-growth-automation": "node --test tests/install-growth-automation.test.js",
-    "test:publish-thumbgate-launch": "node --test tests/publish-thumbgate-launch.test.js",
+    "test:publish-thumbgate-launch": "node --test tests/publish-thumbgate-launch.test.js tests/publish-latest-release-article.test.js tests/latest-release-campaign-ops.test.js",
     "test:reconcile-thumbgate-campaign": "node --test tests/reconcile-thumbgate-campaign.test.js",
     "test:schedule-thumbgate-campaign": "node --test tests/schedule-thumbgate-campaign.test.js",
     "test:social-reply-monitor": "node --test tests/social-reply-monitor.test.js tests/reddit-monitor-launchd.test.js",
@@ -762,12 +769,15 @@
     "eval:observability": "node scripts/async-eval-observability.js",
     "test:memory-provider-enforcement-bridge": "node --test tests/memory-provider-enforcement-bridge.test.js",
     "test:payment-rails": "node --test tests/payment-rails.test.js",
+    "test:service-checkout-price-integrity": "node --test tests/service-checkout-price-integrity.test.js",
     "test:publisher-credential-guards": "node --test tests/publisher-credential-guards.test.js",
     "test:reddit-browser-notification-watch": "node --test tests/reddit-browser-notification-watch.test.js",
     "cursor:marketplace:doctor": "node scripts/cursor-marketplace-doctor.js",
     "cursor:marketplace:doctor:json": "node scripts/cursor-marketplace-doctor.js --json",
     "test:cursor-marketplace-doctor": "node --test tests/cursor-marketplace-doctor.test.js",
+    "test:plugin-hooks-manifest": "node --test tests/plugin-hooks-manifest.test.js",
     "test:hook-self-protection": "node --test tests/hook-self-protection.test.js",
+    "test:never-bypass-branch-protection": "node --test tests/never-bypass-branch-protection.test.js",
     "test:self-protect-enforcement": "node --test tests/self-protect-enforcement.test.js",
     "test:pack-runtime-integrity": "node --test tests/pack-runtime-integrity.test.js",
     "test:entitlement": "node --test tests/entitlement.test.js",

package/public/chatgpt-app.html

@@ -230,7 +230,7 @@
         </div>
         <div class="screen">
           <div class="message">Before I run this migration, check whether this repeats a rejected deploy pattern.</div>
-          <div class="message"><strong>ThumbGate:</strong> Require evidence first: test output, rollback path, and the exact affected tables. Then install the local gate so future risky actions are flagged and logged before execution (and hard-blocked for catastrophic classes or under strict mode).</div>
+          <div class="message"><strong>ThumbGate:</strong> Require evidence first: test output, rollback path, and the exact affected tables. Then install the local gate so future risky actions are flagged and logged before execution (and hard-blocked for secret exfiltration and guardrail-tampering by default, or under strict mode).</div>
           <code class="code">thumbs down: agent claimed the release was published before checking npm and CI</code>
           <code class="code">npx thumbgate init --agent codex</code>
         </div>
@@ -239,7 +239,7 @@
 
     <section aria-labelledby="what-ships">
       <h2 class="section-title" id="what-ships">What ships today</h2>
-      <p class="section-copy">This is the ChatGPT-facing distribution page. It keeps the claim precise: ChatGPT is the discovery, advice, checkpointing, and typed-feedback surface. The enforcement — flag and log by default, hard-block for catastrophic classes or under strict mode — still runs in the local agent or CI lane.</p>
+      <p class="section-copy">This is the ChatGPT-facing distribution page. It keeps the claim precise: ChatGPT is the discovery, advice, checkpointing, and typed-feedback surface. The enforcement — flag and log by default, hard-block for secret exfiltration and guardrail-tampering by default, or every rule under strict mode — still runs in the local agent or CI lane.</p>
       <div class="grid">
         <article class="card">
           <h3>Live GPT entrypoint</h3>

package/public/codex-enterprise.html

@@ -78,7 +78,7 @@
     </div>
     <div class="card">
       <h3>Promote repeat failures to PreToolUse gates</h3>
-      <p>When the same agent mistake shows up twice, ThumbGate distills it into a prevention rule and flags the next attempt at the tool-call boundary — hard-blocking it for catastrophic classes or under strict enforcement — with the rule that fired in the agent's reasoning trace, so Codex chooses a safer plan instead of being told to "be more careful."</p>
+      <p>When the same agent mistake shows up twice, ThumbGate distills it into a prevention rule and flags the next attempt at the tool-call boundary — hard-blocking it for secret exfiltration and guardrail-tampering by default, or every rule under strict enforcement — with the rule that fired in the agent's reasoning trace, so Codex chooses a safer plan instead of being told to "be more careful."</p>
     </div>
     <div class="card">
       <h3>Audit trail enterprise procurement requires</h3>

package/public/codex-plugin.html

@@ -256,7 +256,7 @@ $ npx thumbgate feedback-self-test
     </div>
     <div class="tile">
       <h3>Checks before action</h3>
-      <p>Pre-Action Checks evaluate commands, file edits, publishes, merges, and other high-risk actions before execution. Bad repeats are flagged and logged before they burn time or tokens — and hard-blocked for catastrophic classes (secret exfiltration, destructive deletes) or when strict enforcement is enabled.</p>
+      <p>Pre-Action Checks evaluate commands, file edits, publishes, merges, and other high-risk actions before execution. Bad repeats are flagged and logged before they burn time or tokens — and hard-blocked for secret exfiltration and guardrail-tampering by default (destructive deletes, force-push, and supply-chain warn by default) or when strict enforcement is enabled.</p>
     </div>
   </section>
 

package/public/diagnostic.html

@@ -252,7 +252,7 @@ footer { padding: 32px 0 44px; color: var(--muted); }
         <option>We need an independent proof checklist first</option>
       </select>
       <button type="submit" data-revenue-cta data-cta-id="diagnostic_page_submit" data-cta-placement="intake">Submit for diagnostic scope</button>
-      <p class="hint">Ready to pay now? Use the $499 diagnostic checkout above. If the workflow needs fit review first, submit it here and we will route you to the diagnostic or sprint only when the scope is real.</p>
+      <p class="hint" data-diagnostic-payment-hint>Ready to pay now? Use the $499 diagnostic checkout above. If the workflow needs fit review first, submit it here and we will route you to the diagnostic or sprint only when the scope is real.</p>
     </form>
   </div>
   <section>
@@ -295,6 +295,28 @@ footer { padding: 32px 0 44px; color: var(--muted); }
 <script>
 (function () {
   const search = new URLSearchParams(window.location.search);
+  const paidCta = document.querySelector('[data-cta-id="diagnostic_hero_paid"]');
+  const inboundSource = search.get('utm_source') || search.get('source');
+  const isAiventyxTraffic = String(inboundSource || '').trim().toLowerCase() === 'aiventyx';
+  if (paidCta && isAiventyxTraffic) {
+    paidCta.remove();
+    const paymentHint = document.querySelector('[data-diagnostic-payment-hint]');
+    if (paymentHint) {
+      paymentHint.textContent = 'Submit the workflow here. Aiventyx will collect payment on its checkout once the scope is accepted.';
+    }
+  } else if (paidCta) {
+    const href = new URL(paidCta.getAttribute('href'), window.location.origin);
+    const passthrough = /^(utm_(source|medium|campaign|content|term)|source|acquisition_id|visitor_id|session_id|visitor_session_id|install_id|trace_id|creator|community|post_id|comment_id|campaign_variant|offer_code|referrer_host)$/i;
+    for (const [key, value] of search.entries()) {
+      if (!passthrough.test(key) || !value.trim()) continue;
+      href.searchParams.set(key, value.trim());
+    }
+    if (inboundSource && inboundSource.trim()) {
+      href.searchParams.set('utm_source', inboundSource.trim());
+    }
+    paidCta.setAttribute('href', `${href.pathname}${href.search}${href.hash}`);
+  }
+
   const form = document.querySelector('[data-diagnostic-intake-form]');
   if (form) {
     for (const [key, value] of search.entries()) {