thumbgate 1.29.1 → 1.29.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.29.1",
+  "version": "1.29.2",
   "description": "ThumbGate Pre-Action Checks self-improve from ranked lessons and repeated failures, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -22,6 +22,8 @@
     "scripts/activation-quickstart.js",
     "scripts/activation-tracker.js",
     "scripts/agent-audit-trace.js",
+    "scripts/agent-outcome-eval.js",
+    "scripts/agent-outcome-monitor.js",
     "scripts/agent-design-governance.js",
     "scripts/agent-memory-lifecycle.js",
     "scripts/agent-readiness-plan.js",
@@ -121,6 +123,7 @@
     "scripts/hook-stop-anti-claim.js",
     "scripts/hook-thumbgate-cache-updater.js",
     "scripts/hosted-config.js",
+    "scripts/human-escalation.js",
     "scripts/hybrid-feedback-context.js",
     "scripts/imperative-detector.js",
     "scripts/hybrid-supervisor-agent.js",
@@ -202,6 +205,7 @@
     "scripts/rubric-engine.js",
     "scripts/rule-validator.js",
     "scripts/sales-pipeline.js",
+    "scripts/schedule-manager.js",
     "scripts/secret-scanner.js",
     "scripts/secret-fixture-tokens.js",
     "scripts/secret-redaction.js",
@@ -244,6 +248,7 @@
     "scripts/token-tco.js",
     "scripts/tool-contract-validator.js",
     "scripts/tool-registry.js",
+    "scripts/task-outcomes.js",
     "scripts/upstream-contribution-engine.js",
     "scripts/user-profile.js",
     "scripts/validate-workflow-contract.js",
@@ -322,6 +327,9 @@
     "src/"
   ],
   "scripts": {
+    "canary:snapshot": "node scripts/gate-decision-canary.js --snapshot",
+    "canary:check": "node scripts/gate-decision-canary.js --check",
+    "test:canary": "node --test tests/gate-decision-canary.test.js",
     "postinstall": "node bin/postinstall.js || true",
     "start": "node src/api/server.js",
     "numbers:generate": "node scripts/generate-numbers-page.js",
@@ -393,6 +401,8 @@
     "judge:reward:prompt": "node scripts/judge-reward-function.js prompt",
     "llm:behavior": "node scripts/llm-behavior-monitor.js report",
     "llm:behavior:json": "node scripts/llm-behavior-monitor.js json",
+    "eval:agent-outcomes": "node scripts/agent-outcome-eval.js",
+    "monitor:agent-outcomes": "node scripts/agent-outcome-monitor.js",
     "prompt:plan": "node scripts/prompting-operating-system.js plan",
     "prompt:plan:json": "node scripts/prompting-operating-system.js json",
     "credentials:plan": "node scripts/single-use-credential-gate.js plan",
@@ -417,7 +427,7 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:canary && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:verification-evidence && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
     "test:python": "python3 -m pytest tests/*.py",
     "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
@@ -462,7 +472,8 @@
     "test:spec-gate": "node --test tests/spec-gate.test.js",
     "test:dashboard-insights": "node --test tests/dashboard-insights.test.js",
     "test:telemetry-tracked-link-slug": "node --test tests/telemetry-tracked-link-slug.test.js",
-    "test:prompt-eval": "node --test tests/prompt-eval.test.js",
+    "test:prompt-eval": "node --test tests/prompt-eval.test.js tests/verified-agent-outcomes.test.js tests/task-outcome-api.test.js",
+    "test:verified-agent-outcomes": "node --test tests/verified-agent-outcomes.test.js tests/task-outcome-api.test.js",
     "eval:feedback": "node scripts/prompt-eval.js --from-feedback",
     "eval:feedback-quality": "python3 scripts/feedback_quality_eval.py",
     "eval:classifier": "python3 scripts/eval_gate_classifier.py",
@@ -513,6 +524,7 @@
     "test:cloudflare-sandbox": "node --test tests/cloudflare-dynamic-sandbox.test.js tests/cloudflare-sandbox-api.test.js",
     "test:mcp-config": "node --test tests/mcp-config.test.js tests/mcp-capability-exposure.test.js",
     "test:mcp-tool-annotations": "node --test tests/mcp-tool-annotations.test.js",
+    "test:mcp-policy": "node --test tests/mcp-policy.test.js",
     "test:mcp-oauth": "node --test tests/mcp-oauth.test.js",
     "test:mcp-oauth-flow": "node --test tests/mcp-oauth-flow.test.js",
     "test:plan-gate": "node --test tests/plan-gate.test.js",
@@ -548,7 +560,7 @@
     "test:proof": "node --test tests/prove-adapters.test.js tests/prove-attribution.test.js tests/prove-cloudflare-sandbox.test.js tests/prove-data-quality.test.js tests/prove-intelligence.test.js tests/prove-lancedb.test.js tests/prove-loop-closure.test.js tests/prove-training-export.test.js tests/prove-local-intelligence.test.js tests/prove-workflow-contract.test.js tests/prove-autoresearch.test.js tests/prove-claim-verification.test.js tests/prove-data-pipeline.test.js tests/prove-evolution.test.js tests/prove-harnesses.test.js tests/prove-packaged-runtime.test.js tests/prove-runtime.test.js tests/prove-seo-gsd.test.js tests/prove-settings.test.js tests/prove-xmemory.test.js && node --test tests/prove-automation.test.js",
     "test:e2e": "node --test tests/e2e-pipeline.test.js tests/e2e-product-flows.test.js tests/e2e-coverage-contract.test.js tests/interaction-model-e2e.test.js",
     "test:rlaif": "node --test tests/rlaif-self-audit.test.js tests/dpo-optimizer.test.js tests/meta-policy.test.js tests/agent-reward-model.test.js",
-    "test:attribution": "node --test tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js",
+    "test:attribution": "node --test tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js tests/memory-guard-matching.test.js",
     "test:quality": "node --test tests/validate-feedback.test.js tests/feedback-quality-eval-python.test.js tests/eval-gate-classifier.test.js",
     "test:intelligence": "node --test tests/intelligence.test.js",
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
@@ -567,7 +579,7 @@
     "test:ops": "node --test tests/qa-scenario-planner.test.js tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js tests/auto-promote-regression-gate.test.js",
     "test:session-analyzer": "node --test tests/session-analyzer.test.js",
     "test:tessl": "node --test tests/tessl-export.test.js",
-    "test:gates": "node --test tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js",
+    "test:gates": "node --test --test-concurrency=1 tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js tests/git-pathspec-scope.test.js tests/git-global-option-bypass.test.js tests/gate-evasion-matrix.test.js",
     "test:budget": "node --test tests/budget-guard.test.js tests/budget-enforcer.test.js tests/tokenomics-cost-guard.test.js tests/hook-no-budget-lockout.test.js",
     "test:workers": "npm --prefix workers ci && npm --prefix workers test",
     "test:evoskill": "node --test tests/evoskill.test.js",
@@ -745,6 +757,7 @@
     "gate-eval:ci": "node scripts/gate-eval.js run",
     "test:ai-engineering-stack-guardrails": "node --test tests/ai-engineering-stack-guardrails.test.js",
     "test:ai-component-inventory": "node --test tests/ai-component-inventory.test.js",
+    "test:verification-evidence": "node --test tests/verification-evidence.test.js",
     "test:interaction-model": "node --test tests/interaction-model.test.js tests/interaction-model-e2e.test.js",
     "aws-blocks:guardrails": "node scripts/aws-blocks-guardrails.js",
     "test:aws-blocks-guardrails": "node --test tests/aws-blocks-guardrails.test.js",
@@ -895,7 +908,7 @@
     "@google/genai": {
       "protobufjs": "7.6.5"
     },
-    "brace-expansion": "5.0.7",
+    "brace-expansion": "5.0.8",
     "onnxruntime-web": {
       "protobufjs": "7.6.5"
     },

package/public/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="generator" content="ThumbGate">
   <meta name="author" content="Igor Ganapolsky">
-  <meta name="thumbgate-version" content="1.29.1">
+  <meta name="thumbgate-version" content="1.29.2">
   __GOOGLE_SITE_VERIFICATION_META__
   <link rel="icon" type="image/png" href="/thumbgate-icon.png">
   <link rel="canonical" href="__APP_ORIGIN__/">
@@ -595,6 +595,7 @@
           </div>
           <a class="proof-link" href="#proof">See a strict-mode deny example ↓</a>
           <p class="install-hint"><code>npx thumbgate init</code> free local evaluate · first hard gate usually minutes after install · <a href="/pricing">how we stack up</a></p>
+          <p class="install-hint" id="thumbgate-dashboard-command" style="margin-top:10px;">Dashboard: <code>npx thumbgate dashboard --open</code> · <code>/thumbgate-dashboard</code> · bin <code>thumbgate-dashboard</code> if global · <a href="/dashboard#insights">demo</a></p>
         </div>
         <div id="offers" class="offer-stack">
           <form id="buy" class="checkout-card" action="/go/diagnostic-pay" method="POST" data-primary-checkout style="order:-1;border-color:rgba(0,110,82,.35);box-shadow:0 18px 50px rgba(0,110,82,.12);">
@@ -811,11 +812,12 @@ next      decision recorded before execution</pre>
 
   <footer>
     <div class="shell footer-inner">
-      <span>ThumbGate · MIT License · npm v1.29.1</span>
+      <span>ThumbGate · MIT License · npm v1.29.2</span>
       <div class="footer-links">
         <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
         <a href="/guide">Technical setup</a>
         <a href="/dashboard#insights">Live enforcement dashboard</a>
+        <a href="#thumbgate-dashboard-command"><code>thumbgate-dashboard</code> command</a>
         <a href="/guides/developer-machine-supply-chain-guardrails">Developer Machine Supply Chain Guardrails — npm, PyPI, Docker, and CLI compromise paths</a>
         <a href="/learn">Browse the guide library</a>
         <a href="/llm-context.md">Machine-readable context</a>

package/public/numbers.html

@@ -25,7 +25,7 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.29.1",
+  "softwareVersion": "1.29.2",
   "url": "https://thumbgate.ai/numbers",
   "dateModified": "2026-05-07",
   "creator": {
@@ -202,7 +202,7 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-05-07 · Version 1.29.1</div>
+  <div class="freshness">Updated: 2026-05-07 · Version 1.29.2</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>

package/scripts/agent-outcome-eval.js

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const {
+  TASK_OUTCOME_SCHEMA,
+  calculateTaskOutcomeMetrics,
+  normalizeTaskOutcome,
+} = require('./task-outcomes');
+const { validateToolContract } = require('./tool-contract-validator');
+
+const ROOT = path.join(__dirname, '..');
+const DEFAULT_SUITE = path.join(ROOT, 'config', 'evals', 'agent-outcomes-golden.json');
+const DEFAULT_BASELINE = path.join(ROOT, 'config', 'evals', 'agent-outcomes-baseline.json');
+
+function runCase(testCase = {}) {
+  const receipt = normalizeTaskOutcome(testCase.receipt, new Date('2026-07-26T00:00:00.000Z'));
+  const validation = validateToolContract(TASK_OUTCOME_SCHEMA, receipt);
+  const expectedReasons = [...(testCase.expected?.reasons || [])]
+    .sort((left, right) => left.localeCompare(right));
+  const actualReasons = [...(receipt.workingReasons || [])]
+    .sort((left, right) => left.localeCompare(right));
+  const checks = [
+    {
+      id: 'schema_valid',
+      pass: validation.valid,
+      detail: validation.valid ? 'receipt schema valid' : validation.errors.join('; '),
+    },
+    {
+      id: 'working_verdict',
+      pass: receipt.working === testCase.expected?.working,
+      detail: `expected ${testCase.expected?.working}, got ${receipt.working}`,
+    },
+    {
+      id: 'reason_codes',
+      pass: JSON.stringify(actualReasons) === JSON.stringify(expectedReasons),
+      detail: `expected [${expectedReasons.join(', ')}], got [${actualReasons.join(', ')}]`,
+    },
+  ];
+  const passed = checks.every((check) => check.pass);
+  return {
+    id: testCase.id,
+    status: passed ? 'pass' : 'fail',
+    score: Math.round((checks.filter((check) => check.pass).length / checks.length) * 100),
+    severity: testCase.severity,
+    split: testCase.split,
+    checks,
+    receipt,
+  };
+}
+
+function runAgentOutcomeEval(options = {}) {
+  const suitePath = path.resolve(options.suitePath || DEFAULT_SUITE);
+  const suite = JSON.parse(fs.readFileSync(suitePath, 'utf8'));
+  if (!Array.isArray(suite.cases) || suite.cases.length === 0) {
+    throw new Error('Agent outcome suite must contain non-empty cases');
+  }
+  const results = suite.cases.map(runCase);
+  const passed = results.filter((result) => result.status === 'pass').length;
+  const score = Math.round((results.reduce((sum, result) => sum + result.score, 0) / results.length));
+  const minimumCases = Number(suite.successCriteria?.minimumCases || 1);
+  const minimumScore = Number(suite.successCriteria?.minAggregateScore || 100);
+  const baselinePath = path.resolve(options.baselinePath || DEFAULT_BASELINE);
+  const baseline = fs.existsSync(baselinePath)
+    ? JSON.parse(fs.readFileSync(baselinePath, 'utf8'))
+    : null;
+  const regressions = compareBaseline(results, baseline);
+  const report = {
+    suite: suite.name,
+    generatedAt: new Date().toISOString(),
+    evidenceStatus: results.length >= minimumCases ? 'measured' : 'insufficient_evidence',
+    total: results.length,
+    passed,
+    failed: results.length - passed,
+    score,
+    minimumScore,
+    minimumCases,
+    regressions,
+    pass: results.length >= minimumCases
+      && score >= minimumScore
+      && (!suite.successCriteria?.requireNoRegressions || regressions.length === 0),
+    metrics: calculateTaskOutcomeMetrics(results.map((result) => result.receipt)),
+    results,
+  };
+  return report;
+}
+
+function compareBaseline(results, baseline) {
+  if (!baseline) return [];
+  const current = new Map(results.map((result) => [result.id, result]));
+  const regressions = [];
+  for (const previous of baseline.results || []) {
+    const result = current.get(previous.id);
+    if (!result) {
+      regressions.push({ id: previous.id, reason: 'missing_case' });
+    } else if (result.score < previous.score || (previous.status === 'pass' && result.status !== 'pass')) {
+      regressions.push({
+        id: previous.id,
+        reason: 'score_or_status_regression',
+        baselineScore: previous.score,
+        currentScore: result.score,
+      });
+    }
+  }
+  return regressions;
+}
+
+function isCliInvocation() {
+  return Boolean(process.argv[1]) && path.resolve(process.argv[1]) === __filename;
+}
+
+if (isCliInvocation()) {
+  const suitePath = process.argv.find((arg) => arg.startsWith('--suite='))?.slice(8);
+  const baselinePath = process.argv.find((arg) => arg.startsWith('--baseline='))?.slice(11);
+  const outputPath = process.argv.find((arg) => arg.startsWith('--output='))?.slice(9);
+  const report = runAgentOutcomeEval({ suitePath, baselinePath });
+  if (outputPath) {
+    fs.mkdirSync(path.dirname(path.resolve(outputPath)), { recursive: true });
+    fs.writeFileSync(path.resolve(outputPath), `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+  }
+  console.log(JSON.stringify(report, null, 2));
+  process.exitCode = report.pass ? 0 : 1;
+}
+
+module.exports = {
+  compareBaseline,
+  runAgentOutcomeEval,
+  runCase,
+};

package/scripts/agent-outcome-monitor.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { calculateTaskOutcomeMetrics, readTaskOutcomes } = require('./task-outcomes');
+
+const DEFAULT_THRESHOLDS = path.join(__dirname, '..', 'config', 'agent-outcome-monitor-thresholds.json');
+const DEFAULT_HOSTED_ORIGIN = 'https://thumbgate-production.up.railway.app';
+const DEFAULT_MONITOR_PATH = '/v1/task-outcomes/monitor';
+const DEFAULT_SCHEDULE_ID = 'thumbgate-agent-outcome-monitor';
+
+function monitorTaskOutcomes(outcomes = [], options = {}) {
+  const metrics = calculateTaskOutcomeMetrics(outcomes);
+  const thresholds = options.thresholds || JSON.parse(fs.readFileSync(
+    path.resolve(options.thresholdsPath || DEFAULT_THRESHOLDS),
+    'utf8',
+  ));
+  const minimumSamples = Number(thresholds.minimumSamples || 1);
+  if (metrics.sampleSize < minimumSamples) {
+    return {
+      generatedAt: new Date().toISOString(),
+      verdict: 'insufficient_evidence',
+      sampleSize: metrics.sampleSize,
+      minimumSamples,
+      alerts: [{
+        id: 'minimum-samples',
+        severity: 'block',
+        message: `Need ${minimumSamples} task outcomes; observed ${metrics.sampleSize}.`,
+      }],
+      metrics,
+    };
+  }
+
+  const values = flattenMetricValues(metrics);
+  const alerts = [];
+  for (const [id, rule] of Object.entries(thresholds)) {
+    if (id === 'minimumSamples') continue;
+    const actual = values[id];
+    if (actual === null || actual === undefined) {
+      alerts.push({
+        id: `${id}-missing`,
+        severity: rule.severity || 'warn',
+        message: `${id} has no measured denominator.`,
+      });
+      continue;
+    }
+    if (!passesRule(actual, rule)) {
+      alerts.push({
+        id: `${id}-threshold`,
+        severity: rule.severity || 'warn',
+        actual,
+        expected: `${rule.operator} ${rule.value}`,
+        message: `${id}=${actual} violates ${rule.operator} ${rule.value}.`,
+      });
+    }
+  }
+  let verdict = 'healthy';
+  if (alerts.some((alert) => alert.severity === 'block')) {
+    verdict = 'blocked';
+  } else if (alerts.length > 0) {
+    verdict = 'watch';
+  }
+  return {
+    generatedAt: new Date().toISOString(),
+    verdict,
+    sampleSize: metrics.sampleSize,
+    minimumSamples,
+    alerts,
+    metrics,
+  };
+}
+
+function flattenMetricValues(metrics) {
+  return {
+    workingRate: metrics.task.workingRate,
+    verifiedCompletionRate: metrics.task.verifiedCompletionRate,
+    evidenceBackedCompletionRate: metrics.task.evidenceBackedCompletionRate,
+    unsupportedClaimRate: metrics.task.unsupportedClaimRate,
+    toolContractAccuracy: metrics.tools.contractAccuracy,
+    executionSuccessRate: metrics.tools.executionSuccessRate,
+    duplicateSideEffectRate: metrics.tools.duplicateSideEffectRate,
+    unsafeEscapeRate: metrics.safety.unsafeEscapeRate,
+    policyViolationRate: metrics.safety.policyViolationRate,
+    safeFalseBlockRate: metrics.safety.safeFalseBlockRate,
+    correctEscalationRate: metrics.escalation.correctEscalationRate,
+    latencyP95Ms: metrics.efficiency.latencyP95Ms,
+  };
+}
+
+function passesRule(actual, rule) {
+  if (rule.operator === 'gte') return actual >= Number(rule.value);
+  if (rule.operator === 'lte') return actual <= Number(rule.value);
+  if (rule.operator === 'gt') return actual > Number(rule.value);
+  if (rule.operator === 'lt') return actual < Number(rule.value);
+  if (rule.operator === 'eq') return actual === Number(rule.value);
+  throw new Error(`Unsupported threshold operator '${rule.operator}'`);
+}
+
+function isCliInvocation() {
+  return Boolean(process.argv[1]) && path.resolve(process.argv[1]) === __filename;
+}
+
+function parseArgs(argv = []) {
+  return {
+    hosted: argv.includes('--hosted'),
+    installSchedule: argv.includes('--install-schedule'),
+    inputPath: valueForArg(argv, '--input='),
+    thresholdsPath: valueForArg(argv, '--thresholds='),
+    outputPath: valueForArg(argv, '--output='),
+    baseUrl: valueForArg(argv, '--base-url='),
+    workingDirectory: valueForArg(argv, '--working-directory='),
+  };
+}
+
+function valueForArg(argv, prefix) {
+  const value = argv.find((arg) => arg.startsWith(prefix));
+  return value ? value.slice(prefix.length) : undefined;
+}
+
+async function fetchHostedMonitor(options = {}) {
+  const env = options.env || process.env;
+  const { loadObservabilityEnv } = require('./observability-env');
+  loadObservabilityEnv({
+    env,
+    operatorPath: options.operatorPath,
+    observabilityPath: options.observabilityPath,
+    applyStripeManagedFiles: false,
+  });
+
+  const apiKey = String(env.THUMBGATE_OPERATOR_KEY || env.THUMBGATE_API_KEY || '').trim();
+  if (!apiKey) {
+    return {
+      generatedAt: new Date().toISOString(),
+      verdict: 'not_configured',
+      source: 'hosted',
+      reason: 'operator_authentication_unavailable',
+    };
+  }
+
+  const baseUrl = options.baseUrl
+    || env.THUMBGATE_BILLING_API_BASE_URL
+    || DEFAULT_HOSTED_ORIGIN;
+  const url = new URL(DEFAULT_MONITOR_PATH, baseUrl);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), Number(options.timeoutMs || 15000));
+  try {
+    const response = await (options.fetchImpl || globalThis.fetch)(url, {
+      method: 'GET',
+      headers: {
+        authorization: `Bearer ${apiKey}`,
+        accept: 'application/json',
+      },
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      return {
+        generatedAt: new Date().toISOString(),
+        verdict: 'unavailable',
+        source: 'hosted',
+        httpStatus: response.status,
+        reason: 'hosted_monitor_http_error',
+      };
+    }
+    const report = await response.json();
+    return {
+      ...report,
+      source: 'hosted',
+    };
+  } catch (error) {
+    return {
+      generatedAt: new Date().toISOString(),
+      verdict: 'unavailable',
+      source: 'hosted',
+      reason: error?.name === 'AbortError' ? 'hosted_monitor_timeout' : 'hosted_monitor_request_failed',
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function buildAgentOutcomeMonitorSchedule(options = {}) {
+  const workingDirectory = path.resolve(options.workingDirectory || process.cwd());
+  const outputPath = path.resolve(
+    options.outputPath
+      || path.join(os.homedir(), '.thumbgate', 'reports', 'agent-outcome-monitor.json'),
+  );
+  const args = [
+    __filename,
+    '--hosted',
+    `--output=${outputPath}`,
+  ];
+  if (options.baseUrl) args.push(`--base-url=${options.baseUrl}`);
+  const command = [
+    'const { spawnSync } = require(\'node:child_process\');',
+    `const result = spawnSync(process.execPath, ${JSON.stringify(args)}, {`,
+    `  cwd: ${JSON.stringify(workingDirectory)},`,
+    '  env: process.env,',
+    '  stdio: \'inherit\',',
+    '});',
+    'if (result.error) throw result.error;',
+    'process.exit(typeof result.status === \'number\' ? result.status : 1);',
+  ].join(' ');
+  return {
+    id: DEFAULT_SCHEDULE_ID,
+    name: 'ThumbGate Agent Outcome Monitor',
+    description: 'Checks hosted task outcomes daily against fail-closed production thresholds.',
+    schedule: options.schedule || 'daily 10:17',
+    command,
+    workingDirectory,
+  };
+}
+
+function installAgentOutcomeMonitorSchedule(options, manager) {
+  const scheduleManager = manager || require('./schedule-manager');
+  return scheduleManager.createSchedule(buildAgentOutcomeMonitorSchedule(options || {}));
+}
+
+async function main(argv = process.argv.slice(2)) {
+  const options = parseArgs(argv);
+  if (options.installSchedule) {
+    const result = installAgentOutcomeMonitorSchedule(options);
+    console.log(JSON.stringify(result, null, 2));
+    process.exitCode = result.success ? 0 : 1;
+    return result;
+  }
+
+  const report = options.hosted
+    ? await fetchHostedMonitor(options)
+    : monitorTaskOutcomes(
+      readTaskOutcomes({ inputPath: options.inputPath }),
+      { thresholdsPath: options.thresholdsPath },
+    );
+  if (options.outputPath) {
+    const outputPath = path.resolve(options.outputPath);
+    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+    fs.writeFileSync(outputPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+  }
+  console.log(JSON.stringify(report, null, 2));
+  process.exitCode = report.verdict === 'healthy' ? 0 : 1;
+  return report;
+}
+
+if (isCliInvocation()) {
+  main().catch((error) => {
+    console.error(`Agent outcome monitor failed: ${error.message}`);
+    process.exitCode = 1;
+  });
+}
+
+module.exports = {
+  buildAgentOutcomeMonitorSchedule,
+  fetchHostedMonitor,
+  flattenMetricValues,
+  installAgentOutcomeMonitorSchedule,
+  main,
+  monitorTaskOutcomes,
+  parseArgs,
+  passesRule,
+};