thumbgate 1.28.4 → 1.29.1

package/openapi/openapi.yaml

@@ -338,6 +338,150 @@ components:
         sprintBriefUrl:
           type: string
           format: uri
+    WorkflowIntakeClosePacket:
+      type: object
+      required:
+        - status
+        - leadId
+        - blockers
+        - verificationPlan
+        - externalActionAuthorized
+        - revenueRecognized
+      properties:
+        status:
+          type: string
+          enum: [approval_ready_not_authorized, hold_not_approval_ready]
+        leadId:
+          type: string
+        destination:
+          type: object
+          nullable: true
+          properties:
+            channel:
+              type: string
+              enum: [email]
+            address:
+              type: string
+              format: email
+        offer:
+          type: object
+          nullable: true
+          additionalProperties: true
+        draft:
+          type: object
+          nullable: true
+          properties:
+            subject:
+              type: string
+            body:
+              type: string
+        approvalPhrase:
+          type: string
+          nullable: true
+        blockers:
+          type: array
+          items:
+            type: string
+        evidence:
+          type: object
+          additionalProperties: true
+        verificationPlan:
+          type: array
+          items:
+            type: string
+        externalActionAuthorized:
+          type: boolean
+          enum: [false]
+        revenueRecognized:
+          type: boolean
+          enum: [false]
+    WorkflowIntakeDiscoveryPacket:
+      type: object
+      required:
+        - type
+        - status
+        - leadId
+        - blockers
+        - verificationPlan
+        - externalActionAuthorized
+        - revenueRecognized
+      properties:
+        type:
+          type: string
+          enum: [discovery_questions]
+        status:
+          type: string
+          enum: [approval_ready_not_authorized, hold_not_approval_ready]
+        leadId:
+          type: string
+        destination:
+          type: object
+          nullable: true
+          properties:
+            channel:
+              type: string
+              enum: [email]
+            address:
+              type: string
+              format: email
+        draft:
+          type: object
+          nullable: true
+          properties:
+            subject:
+              type: string
+            body:
+              type: string
+        approvalPhrase:
+          type: string
+          nullable: true
+        blockers:
+          type: array
+          items:
+            type: string
+        evidence:
+          type: object
+          additionalProperties: true
+        verificationPlan:
+          type: array
+          items:
+            type: string
+        externalActionAuthorized:
+          type: boolean
+          enum: [false]
+        revenueRecognized:
+          type: boolean
+          enum: [false]
+    WorkflowIntakeQueueResponse:
+      type: object
+      required: [generatedAt, total, eligibleTotal, returned, approvalReadyTotal, discoveryReadyTotal, leads]
+      properties:
+        generatedAt:
+          type: string
+          format: date-time
+        total:
+          type: integer
+        eligibleTotal:
+          type: integer
+        returned:
+          type: integer
+        approvalReadyTotal:
+          type: integer
+        discoveryReadyTotal:
+          type: integer
+        primaryApprovalAction:
+          nullable: true
+          allOf:
+            - $ref: '#/components/schemas/WorkflowIntakeClosePacket'
+        primaryDiscoveryAction:
+          nullable: true
+          allOf:
+            - $ref: '#/components/schemas/WorkflowIntakeDiscoveryPacket'
+        leads:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
     WorkflowSprintAdvanceRequest:
       type: object
       required: [leadId, status]
@@ -361,6 +505,66 @@ components:
           type: array
           items:
             type: string
+        qualificationReview:
+          type: object
+          description: Required evidence-based buyer qualification review when advancing to qualified.
+          required:
+            - severityAndFrequency
+            - measurableImpact
+            - urgencyAndTrigger
+            - decisionAuthority
+            - budgetMechanism
+            - offerFit
+            - proofRequired
+            - nextStep
+            - evidenceReferences
+            - zeroSpendStatus
+          properties:
+            severityAndFrequency:
+              type: string
+            measurableImpact:
+              type: string
+            urgencyAndTrigger:
+              type: string
+            decisionAuthority:
+              type: string
+            budgetMechanism:
+              type: string
+            offerFit:
+              type: string
+            proofRequired:
+              type: string
+            nextStep:
+              type: string
+            evidenceReferences:
+              type: array
+              minItems: 1
+              items:
+                type: string
+            zeroSpendStatus:
+              type: string
+              enum: [proceed_zero_cost]
+            priceUnderstandingConfirmed:
+              type: boolean
+            workflowCount:
+              type: integer
+              minimum: 1
+            authorityConfirmed:
+              type: boolean
+            urgencyDays:
+              type: integer
+              minimum: 1
+            budgetCents:
+              type: integer
+              minimum: 0
+            readyToImplement:
+              type: boolean
+            proofBackedSprint:
+              type: boolean
+            completedEnterprisePilot:
+              type: boolean
+            requiresUnavailableHostedFeature:
+              type: boolean
     WorkflowSprintAdvanceResponse:
       type: object
       properties:
@@ -1104,6 +1308,36 @@ paths:
                 $ref: '#/components/schemas/WorkflowSprintIntakeResponse'
         '400':
           description: Invalid sprint intake request
+  /v1/intake/workflow-sprint/queue:
+    get:
+      operationId: getWorkflowSprintCloseQueue
+      parameters:
+        - in: query
+          name: status
+          description: Comma-separated workflow lifecycle statuses or all.
+          schema:
+            type: string
+            default: new,qualified
+        - in: query
+          name: limit
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 100
+            default: 50
+      responses:
+        '200':
+          description: Private no-store intake queue with fail-closed approval packets
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WorkflowIntakeQueueResponse'
+        '400':
+          description: Invalid queue filter
+        '403':
+          description: Forbidden
+        '503':
+          description: Workflow intake capability is unavailable in this runtime
   /v1/intake/workflow-sprint/advance:
     post:
       operationId: advanceWorkflowSprintLead
@@ -1695,13 +1929,14 @@ paths:
           description: Webhook accepted
         '400':
           description: Invalid webhook signature or payload
-k signature or payload
-  /v1/billing/github-webhook:
+  /v1/billing/paypal-webhook:
     post:
-      operationId: githubMarketplaceWebhook
+      operationId: paypalBillingWebhook
       security: []
       responses:
         '200':
-          description: Webhook accepted
+          description: PayPal-verified payment event durably recorded
         '400':
-          description: Invalid webhook signature or payload
+          description: Invalid PayPal transmission headers, event, or remote signature verification
+        '503':
+          description: PayPal verified the event but durable evidence storage failed

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
-  "version": "1.28.4",
-  "description": "ThumbGate Pre-Action Checks derive rules from repeated failures, flag risky tool calls, hard-block detected secret leaks, and block matches in strict mode.",
+  "version": "1.29.1",
+  "description": "ThumbGate Pre-Action Checks self-improve from ranked lessons and repeated failures, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
     "type": "git",
@@ -13,7 +13,8 @@
   "main": "src/index.js",
   "bin": {
     "thumbgate": "bin/cli.js",
-    "thumbgate-dashboard": "bin/dashboard-cli.js"
+    "thumbgate-dashboard": "bin/dashboard-cli.js",
+    "thumbgate-revenue-evidence": "scripts/grafana-revenue-evidence.js"
   },
   "files": [
     "scripts/access-anomaly-detector.js",
@@ -65,7 +66,9 @@
     "scripts/code-reasoning.js",
     "scripts/codegraph-context.js",
     "scripts/codex-self-heal.js",
+    "scripts/buyer-paths.js",
     "scripts/commercial-offer.js",
+    "scripts/revenue-offer-system.js",
     "scripts/context-engine.js",
     "scripts/context-footprint.js",
     "scripts/context-manager.js",
@@ -87,6 +90,9 @@
     "scripts/export-databricks-bundle.js",
     "scripts/entitlement.js",
     "config/entitlement-public-keys.json",
+    "scripts/external-customer-audit.js",
+    "scripts/stripe-revenue-catalog.js",
+    "scripts/stripe-revenue-catalog-audit.js",
     "scripts/export-dpo-pairs.js",
     "scripts/export-hf-dataset.js",
     "scripts/failure-diagnostics.js",
@@ -103,6 +109,7 @@
     "scripts/feedback_quality_eval.py",
     "scripts/filesystem-search.js",
     "scripts/fs-utils.js",
+    "scripts/grafana-revenue-evidence.js",
     "scripts/gate-stats.js",
     "scripts/gate-templates.js",
     "scripts/gates-engine.js",
@@ -155,6 +162,9 @@
     "scripts/noop-detect.js",
     "scripts/obsidian-export.js",
     "scripts/operational-integrity.js",
+    "scripts/observability-setup.js",
+    "scripts/observability-env.js",
+    "scripts/jsonl-window.js",
     "scripts/oss-pr-opportunity-scout.js",
     "scripts/otel-declarative-config.js",
     "scripts/parallel-workflow-orchestrator.js",
@@ -173,6 +183,9 @@
     "scripts/prompt-guard.js",
     "scripts/prompt-programs.js",
     "scripts/prompting-operating-system.js",
+    "scripts/provider-live-evidence.js",
+    "scripts/provider-payment-reconciler.js",
+    "scripts/provider-revenue-evidence.js",
     "scripts/provider-action-normalizer.js",
     "scripts/proxy-pointer-rag-guardrails.js",
     "scripts/qa-scenario-planner.js",
@@ -181,11 +194,14 @@
     "scripts/rate-limiter.js",
     "scripts/reasoning-efficiency-guardrails.js",
     "scripts/repeat-metric.js",
+    "scripts/revenue-action-eligibility.js",
+    "scripts/revenue-evidence-remediation.js",
     "scripts/reward-hacking-guardrails.js",
     "scripts/risk-scorer.js",
     "scripts/rlaif-self-audit.js",
     "scripts/rubric-engine.js",
     "scripts/rule-validator.js",
+    "scripts/sales-pipeline.js",
     "scripts/secret-scanner.js",
     "scripts/secret-fixture-tokens.js",
     "scripts/secret-redaction.js",
@@ -205,6 +221,7 @@
     "scripts/skill-rag-router.js",
     "scripts/slo-alert-engine.js",
     "scripts/spec-gate.js",
+    "scripts/stripe-credentials.js",
     "scripts/statusline-cache-read.js",
     "scripts/statusline-cache-path.js",
     "scripts/statusline-context.js",
@@ -237,6 +254,7 @@
     "scripts/visitor-journey.js",
     "scripts/workflow-runs.js",
     "scripts/workflow-sentinel.js",
+    "scripts/workflow-intake-queue.js",
     "scripts/workspace-agent-routines.js",
     "scripts/workspace-evolver.js",
     "scripts/xmemory-lite.js",
@@ -247,6 +265,8 @@
     ".well-known/",
     "LICENSE",
     "README.md",
+    "docs/integrations/grafana/README.md",
+    "docs/integrations/grafana/thumbgate-revenue-evidence-dashboard.json",
     "adapters/amp/skills/thumbgate-feedback/SKILL.md",
     "adapters/claude/.mcp.json",
     "adapters/codex/config.toml",
@@ -272,6 +292,7 @@
     "public/about.html",
     "public/agent-manager.html",
     "public/blog.html",
+    "public/blog/",
     "public/codex-enterprise.html",
     "public/agents-cost-savings.html",
     "public/ai-malpractice-prevention.html",
@@ -316,9 +337,12 @@
     "verify:full": "node scripts/verify-run.js full",
     "budget:status": "node scripts/budget-guard.js --status",
     "revenue:status": "node scripts/revenue-status.js",
+    "revenue:intake-queue": "node scripts/workflow-intake-queue.js",
+    "revenue:offers": "node scripts/revenue-offer-system.js",
     "revenue:truth": "bash bin/revenue-truth.sh",
     "revenue:doctor": "node scripts/revenue-observability-doctor.js",
     "revenue:plan": "node scripts/may-2026-revenue-machine.js",
+    "revenue:remediate": "node scripts/revenue-evidence-remediation.js",
     "revenue:status:local": "node bin/cli.js cfo",
     "revenue:repair:github-marketplace": "node bin/cli.js repair-github-marketplace --write",
     "cfo:report": "node bin/cli.js cfo",
@@ -339,6 +363,7 @@
     "medium:weekly:draft": "node scripts/medium-weekly.js --write",
     "medium:weekly:schedule": "node scripts/medium-weekly.js --schedule",
     "sales:pipeline": "node scripts/sales-pipeline.js",
+    "sales:reconcile-payment": "node scripts/provider-payment-reconciler.js",
     "social:poll": "node scripts/social-analytics/poll-all.js",
     "social:poll:github": "node scripts/social-analytics/pollers/github.js",
     "social:poll:instagram": "node scripts/social-analytics/pollers/instagram.js",
@@ -392,18 +417,26 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
     "test:python": "python3 -m pytest tests/*.py",
     "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
     "test:hook-stop-anti-claim": "node --test tests/hook-stop-anti-claim.test.js",
+    "test:stop-hook-json-contract": "node --test tests/stop-hook-json-contract.test.js",
     "test:plausible-server-events": "node --test tests/plausible-server-events.test.js tests/plausible-poller.test.js tests/plausible-domain-config.test.js",
     "test:activation-tracker": "node --test tests/activation-tracker.test.js",
     "test:activation-onboarding": "node --test tests/activation-onboarding.test.js",
     "test:unified-revenue-rollup": "node --test tests/unified-revenue-rollup.test.js",
     "test:conversion-rate-stats": "node --test tests/conversion-rate-stats.test.js",
-    "test:external-customer-audit": "node --test tests/external-customer-audit.test.js",
+    "test:external-customer-audit": "node --test tests/external-customer-audit*.test.js tests/stripe-revenue-catalog-audit.test.js tests/revenue-truth-workflow.test.js",
+    "test:revenue-truth-workflow": "node --test tests/revenue-truth-workflow.test.js",
+    "stripe:catalog-audit": "node scripts/stripe-revenue-catalog-audit.js --json",
     "test:stripe-checkout-diagnostic": "node --test tests/stripe-checkout-diagnostic.test.js",
+    "test:revenue-offer-ladder": "node --test tests/revenue-offer-ladder.test.js",
+    "test:revenue-offer-system": "node --test tests/revenue-offer-system.test.js",
+    "test:revenue-action-eligibility": "node --test tests/revenue-action-eligibility.test.js tests/gtm-revenue-action-eligibility.test.js tests/github-outreach.test.js",
+    "test:public-enterprise-capability-boundary": "node --test tests/public-enterprise-capability-boundary.test.js",
+    "test:buyer-paths": "node --test tests/buyer-paths.test.js",
     "test:stripe-business-identity-probe": "node --test tests/stripe-business-identity-probe.test.js",
     "test:ci-cd-hygiene-audit": "node --test tests/ci-cd-hygiene-audit.test.js",
     "test:telemetry-export": "node --test tests/telemetry-export.test.js tests/telemetry-analytics-quality.test.js",
@@ -519,11 +552,13 @@
     "test:quality": "node --test tests/validate-feedback.test.js tests/feedback-quality-eval-python.test.js tests/eval-gate-classifier.test.js",
     "test:intelligence": "node --test tests/intelligence.test.js",
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
-    "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js tests/packed-feedback-retrieval-e2e.test.js",
+    "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js tests/packed-feedback-retrieval-e2e.test.js tests/packed-provider-payment-reconciler-e2e.test.js tests/packed-revenue-remediation-e2e.test.js",
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js",
-    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
-    "test:sales-pipeline": "node --test tests/sales-pipeline.test.js",
-    "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js tests/checkout-attribution-reference.test.js",
+    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/workflow-intake-queue.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js tests/revenue-action-eligibility.test.js tests/revenue-evidence-remediation.test.js tests/gtm-revenue-action-eligibility.test.js tests/revenue-offer-ladder.test.js tests/revenue-offer-system.test.js tests/buyer-paths.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
+    "test:revenue-evidence-remediation": "node --test tests/revenue-evidence-remediation.test.js",
+    "test:grafana-revenue-evidence": "node --test tests/grafana-revenue-evidence.test.js",
+    "test:sales-pipeline": "node --test tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js",
+    "test:billing": "node --test tests/billing.test.js tests/paypal-billing.test.js tests/stripe-sync-product-images.test.js tests/checkout-attribution-reference.test.js",
     "test:billing-setup": "node --test tests/billing-setup-redaction.test.js",
     "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/feedback-lesson-sanitization.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
     "test:evolution": "node --test tests/workspace-evolver.test.js",
@@ -640,12 +675,12 @@
     "test:social-quality-gate": "node --test tests/social-quality-gate.test.js tests/validate-social-post.test.js",
     "test:a2ui-engine": "node --test tests/a2ui-engine.test.js",
     "test:gate-satisfy": "node --test tests/gate-satisfy.test.js",
-    "test:money-watcher": "node --test tests/money-watcher.test.js",
+    "test:money-watcher": "node --test tests/money-watcher.test.js tests/install-revenue-truth-automation.test.js",
     "test:quick-start": "node --test tests/quick-start.test.js",
     "test:utm": "node --test tests/utm.test.js",
     "test:product-feedback": "node --test tests/product-feedback.test.js",
     "test:feedback-root-consolidator": "node --test tests/feedback-root-consolidator.test.js",
-    "social:publish:launch": "node scripts/social-analytics/publish-thumbgate-launch.js",
+    "social:publish:launch": "node scripts/social-analytics/run-publish-thumbgate-launch.js",
     "social:publish:latest-release-article": "node scripts/social-analytics/publish-latest-release-article.js",
     "social:publish:latest-release-fallbacks": "node scripts/social-analytics/publish-latest-release-fallbacks.js",
     "social:verify:latest-release": "node scripts/social-analytics/verify-latest-release-posts.js",
@@ -714,7 +749,7 @@
     "aws-blocks:guardrails": "node scripts/aws-blocks-guardrails.js",
     "test:aws-blocks-guardrails": "node --test tests/aws-blocks-guardrails.test.js",
     "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js tests/aws-blocks-guardrails.test.js",
-    "test:public-static-assets": "node --test tests/public-static-assets.test.js",
+    "test:public-static-assets": "node --test tests/public-static-assets.test.js tests/public-checkout-intent-gate.test.js tests/public-enterprise-capability-boundary.test.js",
     "test:token-savings": "node --test tests/token-savings.test.js",
     "test:cost-cli": "node --test tests/cost-cli.test.js tests/conversion-receipt.test.js",
     "test:numbers-page": "node --test tests/numbers-page.test.js",
@@ -729,7 +764,7 @@
     "test:e2e:playwright:headed": "playwright test --headed",
     "test:e2e:playwright:ui": "playwright test --ui",
     "test:e2e:playwright:report": "playwright show-report",
-    "test:public-package-parity": "node --test tests/public-package-parity.test.js",
+    "test:public-package-parity": "node --test tests/public-package-parity.test.js tests/blog-hub.test.js",
     "prepare": "bash bin/install-hooks.sh >/dev/null 2>&1 || true",
     "install:hooks": "bash bin/install-hooks.sh",
     "test:token-savings-dashboard": "node --test tests/token-savings-dashboard.test.js",
@@ -786,7 +821,11 @@
     "test:self-protect-enforcement": "node --test tests/self-protect-enforcement.test.js",
     "test:pack-runtime-integrity": "node --test tests/pack-runtime-integrity.test.js",
     "test:entitlement": "node --test tests/entitlement.test.js",
-    "test:xss-checkout-escape": "node --test tests/xss-checkout-escape.test.js"
+    "test:xss-checkout-escape": "node --test tests/xss-checkout-escape.test.js",
+    "observability:setup": "node scripts/observability-setup.js",
+    "observability:doctor": "node scripts/revenue-observability-doctor.js",
+    "test:jsonl-window": "node --test tests/jsonl-window.test.js",
+    "test:observability-env": "node --test tests/observability-env.test.js"
   },
   "keywords": [
     "mcp",
@@ -843,26 +882,27 @@
   "dependencies": {
     "@anthropic-ai/sdk": "0.102.0",
     "@google/genai": "2.7.0",
-    "@huggingface/transformers": "^4.2.0",
     "@lancedb/lancedb": "^0.30.0",
     "apache-arrow": "^18.1.0",
     "better-sqlite3": "^12.9.0",
     "dotenv": "^17.4.2",
     "playwright-core": "^1.59.1",
-    "protobufjs": "^8.5.0",
+    "protobufjs": "^8.7.1",
     "stripe": "^22.2.0"
   },
   "overrides": {
+    "adm-zip": "0.6.0",
     "@google/genai": {
-      "protobufjs": "7.6.4"
+      "protobufjs": "7.6.5"
     },
+    "brace-expansion": "5.0.7",
     "onnxruntime-web": {
-      "protobufjs": "7.6.4"
+      "protobufjs": "7.6.5"
     },
     "express@4.22.1": {
       "path-to-regexp": "0.1.13"
     },
-    "js-yaml": "4.2.0"
+    "js-yaml": "4.3.0"
   },
   "mcpName": "io.github.IgorGanapolsky/thumbgate",
   "devDependencies": {