thumbgate 1.29.1 → 1.30.0

package/src/api/server.js

@@ -166,6 +166,20 @@ const {
 const {
   evaluateWorkflowSentinel,
 } = require('../../scripts/workflow-sentinel');
+const {
+  calculateTaskOutcomeMetrics,
+  getTaskOutcome,
+  readTaskOutcomes,
+  recordTaskOutcome,
+} = require('../../scripts/task-outcomes');
+const { monitorProductionSignals } = require('../../scripts/agent-outcome-monitor');
+const { computeToolKpis, recordToolCall } = require('../../scripts/tool-kpi-tracker');
+const {
+  calculateEscalationMetrics,
+  decideEscalation,
+  listEscalations,
+  requestEscalation,
+} = require('../../scripts/human-escalation');
 const {
   normalizeProviderAction,
 } = require('../../scripts/provider-action-normalizer');
@@ -224,6 +238,7 @@ const { sendProblem, PROBLEM_TYPES } = require('../../scripts/problem-detail');
 const { TOOLS: MCP_TOOLS } = require('../../scripts/tool-registry');
 const mcpOauth = require('../../scripts/mcp-oauth');
 const { packCheckoutReference } = require('../../scripts/checkout-attribution-reference');
+const { normalizeCampaignId } = require('../../scripts/growth-campaigns');
 // OAuth 2.1 (PKCE) authorization-server state for the remote MCP connector
 // (Claude Connectors Directory requires OAuth for authenticated services).
 const oauthStore = mcpOauth.createStore();
@@ -253,6 +268,11 @@ const CODEX_PLUGIN_PAGE_PATH = path.resolve(__dirname, '../../public/codex-plugi
 const COMPARE_PAGE_PATH = path.resolve(__dirname, '../../public/compare.html');
 const LEARN_PAGE_PATH = path.resolve(__dirname, '../../public/learn.html');
 const NUMBERS_PAGE_PATH = path.resolve(__dirname, '../../public/numbers.html');
+const ARCHITECTURE_PAGE_PATH = path.resolve(__dirname, '../../public/architecture.html');
+const WHITEPAPER_PAGE_PATH = path.resolve(__dirname, '../../public/whitepaper.html');
+const EVAL_SCORECARD_PAGE_PATH = path.resolve(__dirname, '../../public/eval-scorecard.html');
+const EVALUATIONS_PAGE_PATH = path.resolve(__dirname, '../../public/evaluations.html');
+const CASE_STUDIES_PAGE_PATH = path.resolve(__dirname, '../../public/case-studies.html');
 const FEDERAL_PAGE_PATH = path.resolve(__dirname, '../../public/federal.html');
 const PRICING_PAGE_PATH = path.resolve(__dirname, '../../public/pricing.html');
 const ABOUT_PAGE_PATH = path.resolve(__dirname, '../../public/about.html');
@@ -404,7 +424,7 @@ const BUILD_METADATA = resolveBuildMetadata();
 const TERMINAL_JOB_STATUSES = new Set(['completed', 'failed', 'cancelled']);
 const IDLE_JOB_STATUSES = new Set(['queued', 'paused', 'resume_requested']);
 const JOB_CONTROL_ACTIONS = new Set(['pause', 'cancel', 'resume']);
-const TRACKED_LINK_QUERY_KEYS = [
+const TRACKED_LINK_QUERY_KEYS = new Set([
   'utm_source',
   'utm_medium',
   'utm_campaign',
@@ -432,7 +452,7 @@ const TRACKED_LINK_QUERY_KEYS = [
   'seat_count',
   'landing_path',
   'referrer_host',
-];
+]);
 const TRACKED_LINK_TARGETS = Object.freeze({
   gpt: {
     href: 'https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate',
@@ -863,11 +883,13 @@ function updateLessonRecord(feedbackDir, lessonId, updater) {
 }
 
 function getPublicMcpTools() {
-  return MCP_TOOLS.map((tool) => ({
+  const { getExposedTools } = require('../../adapters/mcp/server-stdio');
+  return getExposedTools().map((tool) => ({
     name: tool.name,
     ...(tool.title ? { title: tool.title } : {}),
     description: tool.description,
     inputSchema: tool.inputSchema,
+    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),
     // Serve the tool-registry annotations (readOnlyHint/destructiveHint). Required
     // by the Claude Connectors Directory (missing annotations = the #1 rejection
     // cause) and used by MCP clients for permission prompts. Was being dropped here.
@@ -876,13 +898,7 @@ function getPublicMcpTools() {
 }
 
 function getServerCardTools() {
-  return MCP_TOOLS.map((tool) => ({
-    name: tool.name,
-    ...(tool.title ? { title: tool.title } : {}),
-    description: tool.description,
-    inputSchema: tool.inputSchema,
-    ...(tool.annotations ? { annotations: tool.annotations } : {}),
-  }));
+  return getPublicMcpTools();
 }
 
 function buildPublicUrl(hostedConfig, pathname) {
@@ -892,7 +908,7 @@ function buildPublicUrl(hostedConfig, pathname) {
 const VERIFICATION_EVIDENCE_URL = 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md';
 
 function getToolDiscoveryIndex(hostedConfig) {
-  return MCP_TOOLS.map((tool) => ({
+  return getPublicMcpTools().map((tool) => ({
     name: tool.name,
     description: tool.description,
     annotations: tool.annotations || {},
@@ -902,7 +918,7 @@ function getToolDiscoveryIndex(hostedConfig) {
 
 function getContextFootprintReport(hostedConfig) {
   return buildContextFootprintReport({
-    tools: MCP_TOOLS,
+    tools: getPublicMcpTools(),
     schemaUrlTemplate: buildPublicUrl(hostedConfig, '/.well-known/mcp/tools/{name}.json'),
   });
 }
@@ -1260,7 +1276,8 @@ function inferSearchQuery(referrer) {
 
 function getAttributionValue(params, key, fallbackValue) {
   const value = params.get(key);
-  return value && value.trim() ? value.trim() : fallbackValue;
+  const resolved = value?.trim() || fallbackValue;
+  return key === 'utm_campaign' ? normalizeCampaignId(resolved) : resolved;
 }
 
 function parseUrlSearchParams(urlValue) {
@@ -1632,17 +1649,28 @@ function projectWorkflowIntakeQueueLead(lead = {}, options = {}) {
       page: attribution.page || null,
       landingPath: attribution.landingPath || null,
     },
-    nextOperatorStep: options.closePacket?.status === 'approval_ready_not_authorized'
-      ? 'request_action_time_approval'
-      : options.discoveryPacket?.status === 'approval_ready_not_authorized'
-        ? 'request_action_time_approval_for_discovery'
-        : lead.status === 'new' ? 'review_and_qualify' : 'prepare_scope_or_hold',
+    nextOperatorStep: resolveNextOperatorStep(lead, options),
     qualificationCard: options.qualificationCard || buildIntakeQualificationCard(lead, options),
     discoveryPacket: options.discoveryPacket || buildIntakeDiscoveryPacket(lead, options),
     closePacket: options.closePacket || buildIntakeClosePacket(lead, options),
   };
 }
 
+/**
+ * Which action the operator should take next on an intake lead. Extracted from a three-level
+ * nested ternary: the precedence (close packet, then discovery packet, then lead status) is the
+ * actual logic and is far easier to check when it reads top to bottom.
+ */
+function resolveNextOperatorStep(lead, options) {
+  if (options.closePacket?.status === 'approval_ready_not_authorized') {
+    return 'request_action_time_approval';
+  }
+  if (options.discoveryPacket?.status === 'approval_ready_not_authorized') {
+    return 'request_action_time_approval_for_discovery';
+  }
+  return lead.status === 'new' ? 'review_and_qualify' : 'prepare_scope_or_hold';
+}
+
 function buildWorkflowIntakeQueue(parsed, workflowSprintIntake, feedbackDir, options = {}) {
   const { limit, statuses } = resolveWorkflowIntakeQueueOptions(parsed, workflowSprintIntake);
   const leads = workflowSprintIntake.loadWorkflowSprintLeads(feedbackDir);
@@ -1721,7 +1749,7 @@ function sendInvalidAnalyticsWindowProblem(res, title, err) {
 }
 
 function sendWorkflowIntakeQueueProblem(res, err) {
-  const status = Number(err && err.statusCode) || 400;
+  const status = Number(err?.statusCode) || 400;
   sendProblem(res, {
     type: status >= 500 ? PROBLEM_TYPES.INTERNAL : PROBLEM_TYPES.INVALID_REQUEST,
     title: status >= 500
@@ -2676,7 +2704,10 @@ function appendTrackedLinkQueryParams(destinationUrl, parsed, target) {
   for (const key of TRACKED_LINK_QUERY_KEYS) {
     const value = params.get(key);
     if (value && value.trim()) {
-      destinationUrl.searchParams.set(key, value.trim());
+      const normalizedValue = key === 'utm_campaign'
+        ? normalizeCampaignId(value)
+        : value.trim();
+      destinationUrl.searchParams.set(key, normalizedValue);
     }
   }
   if (target.allowCustomerEmail) {
@@ -2717,7 +2748,7 @@ function buildTrackedLinkAttribution(target, parsed, req, journeyState, destinat
   const source = pickFirstText(
     params.get('source'),
     params.get('utm_source'),
-    target.defaults && target.defaults.utm_source,
+    target.defaults?.utm_source,
     inferSource(referrerHost)
   );
 
@@ -2731,19 +2762,21 @@ function buildTrackedLinkAttribution(target, parsed, req, journeyState, destinat
     traceId: pickFirstText(params.get('trace_id')),
     source,
     utmSource: pickFirstText(params.get('utm_source'), source),
-    utmMedium: pickFirstText(params.get('utm_medium'), target.defaults && target.defaults.utm_medium, 'link_router'),
-    utmCampaign: pickFirstText(params.get('utm_campaign'), target.defaults && target.defaults.utm_campaign, 'first_party_redirect'),
+    utmMedium: pickFirstText(params.get('utm_medium'), target.defaults?.utm_medium, 'link_router'),
+    utmCampaign: normalizeCampaignId(
+      pickFirstText(params.get('utm_campaign'), target.defaults?.utm_campaign, 'first_party_redirect')
+    ),
     utmContent: pickFirstText(params.get('utm_content')),
     utmTerm: pickFirstText(params.get('utm_term')),
     creator: pickFirstText(params.get('creator'), params.get('creator_handle')),
     community: pickFirstText(params.get('community'), params.get('subreddit')),
     postId: pickFirstText(params.get('post_id')),
     commentId: pickFirstText(params.get('comment_id')),
-    campaignVariant: pickFirstText(params.get('campaign_variant'), target.defaults && target.defaults.campaign_variant),
+    campaignVariant: pickFirstText(params.get('campaign_variant'), target.defaults?.campaign_variant),
     offerCode: pickFirstText(params.get('offer_code')),
     ctaId: pickFirstText(params.get('cta_id'), target.ctaId),
     ctaPlacement: pickFirstText(params.get('cta_placement'), target.ctaPlacement),
-    planId: pickFirstText(params.get('plan_id'), target.defaults && target.defaults.plan_id),
+    planId: pickFirstText(params.get('plan_id'), target.defaults?.plan_id),
     landingPath: pickFirstText(params.get('landing_path'), `/go/${target.slug}`),
     page: `/go/${target.slug}`,
     referrer,
@@ -3809,6 +3842,12 @@ function renderSitemapXml(runtimeConfig) {
     { path: '/codex-enterprise', changefreq: 'weekly', priority: '0.85' },
     { path: '/agents-cost-savings', changefreq: 'weekly', priority: '0.85' },
     { path: '/ai-malpractice-prevention', changefreq: 'weekly', priority: '0.9' },
+    { path: '/whitepaper', changefreq: 'weekly', priority: '0.9' },
+    { path: '/architecture', changefreq: 'weekly', priority: '0.85' },
+    { path: '/eval-scorecard', changefreq: 'weekly', priority: '0.9' },
+    { path: '/evaluations', changefreq: 'weekly', priority: '0.85' },
+    { path: '/case-studies', changefreq: 'weekly', priority: '0.9' },
+    { path: '/numbers', changefreq: 'weekly', priority: '0.8' },
     { path: '/learn/background-agent-control-layer', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/ac-dc-runtime-enforcement', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/feedback-loop-vs-decision-layer', changefreq: 'weekly', priority: '0.9' },
@@ -3875,6 +3914,8 @@ function buildHostedRuntimePresence(hostedConfig, { expectedApiKey, expectedOper
     THUMBGATE_FEEDBACK_DIR: Boolean(process.env.THUMBGATE_FEEDBACK_DIR),
     THUMBGATE_OPERATOR_KEY: Boolean(expectedOperatorKey),
     THUMBGATE_API_KEY: Boolean(expectedApiKey),
+    THUMBGATE_HUMAN_REVIEWER_KEY: Boolean(process.env.THUMBGATE_HUMAN_REVIEWER_KEY),
+    THUMBGATE_HUMAN_REVIEWER_ID: Boolean(process.env.THUMBGATE_HUMAN_REVIEWER_ID),
     THUMBGATE_PUBLIC_APP_ORIGIN: Boolean(hostedConfig.appOrigin),
     THUMBGATE_BILLING_API_BASE_URL: Boolean(hostedConfig.billingApiBaseUrl),
     THUMBGATE_GA_MEASUREMENT_ID: Boolean(hostedConfig.gaMeasurementId),
@@ -4890,6 +4931,15 @@ function getExpectedOperatorKey() {
   return key || null;
 }
 
+function getHumanReviewerConfig(expectedApiKey, expectedOperatorKey) {
+  const key = String(process.env.THUMBGATE_HUMAN_REVIEWER_KEY || '').trim();
+  const id = String(process.env.THUMBGATE_HUMAN_REVIEWER_ID || '').trim();
+  const independent = Boolean(key)
+    && !safeKeyEqual(key, expectedApiKey)
+    && !safeKeyEqual(key, expectedOperatorKey);
+  return { key: key || null, id: id || null, independent };
+}
+
 function isAuthorized(req, expected) {
   if (!expected) return true;
   const token = extractApiKey(req);
@@ -4957,6 +5007,21 @@ function safeKeyEqual(a, b) {
   return require('crypto').timingSafeEqual(x, y);
 }
 
+function authenticateHumanReviewer(req, reviewerConfig) {
+  if (!reviewerConfig.key || !reviewerConfig.id || !reviewerConfig.independent) {
+    throw createHttpError(503, 'Human escalation decisions are unavailable until an independent reviewer key and identity are configured');
+  }
+  const header = req.headers['x-thumbgate-human-reviewer-key'];
+  const presented = Array.isArray(header) ? header[0] : header;
+  if (!safeKeyEqual(presented, reviewerConfig.key)) {
+    throw createHttpError(403, 'A valid human reviewer credential is required to decide an escalation');
+  }
+  return {
+    id: reviewerConfig.id,
+    kind: 'human',
+  };
+}
+
 function resolveKeyRole(key) {
   const k = String(key || '').trim();
   const adminKey = String(process.env.THUMBGATE_API_KEY || '').trim();
@@ -5143,6 +5208,7 @@ function resolveDocumentImportFilePath(inputPath, options = {}) {
 function createApiServer() {
   const expectedApiKey = getExpectedApiKey();
   const expectedOperatorKey = getExpectedOperatorKey();
+  const humanReviewerConfig = getHumanReviewerConfig(expectedApiKey, expectedOperatorKey);
 
   const eventBus = new EventEmitter();
   eventBus.setMaxListeners(200);
@@ -5233,6 +5299,14 @@ function createApiServer() {
                 ? mcpOauth.tokenAudienceValid(oauthSession, resourceUrl)
                 : rawKeyValid;
               if (!authed) {
+                recordToolCall({
+                  toolName: msg.params?.name || 'unknown',
+                  serverName: 'mcp-http',
+                  latencyMs: 0,
+                  success: false,
+                  agentId: 'unauthenticated',
+                  metadata: { denied: true, deniedReason: 'authentication_required' },
+                });
                 res.writeHead(401, {
                   'Content-Type': 'application/json',
                   // RFC 9728: point unauthenticated clients at the resource metadata.
@@ -5255,6 +5329,14 @@ function createApiServer() {
                 const tool = MCP_TOOLS.find((t) => t.name === name);
                 const readOnly = Boolean(tool && tool.annotations && tool.annotations.readOnlyHint === true);
                 if (!readOnly) {
+                  recordToolCall({
+                    toolName: name || 'unknown',
+                    serverName: 'mcp-http',
+                    latencyMs: 0,
+                    success: false,
+                    agentId: 'reviewer',
+                    metadata: { denied: true, deniedReason: 'reviewer_read_only' },
+                  });
                   sendJson(res, 200, {
                     jsonrpc: '2.0', id: msg.id,
                     error: { code: -32002, message: `Tool "${name}" requires write access; the reviewer credential is read-only.` },
@@ -5262,15 +5344,39 @@ function createApiServer() {
                   return;
                 }
               }
+              if (oauthSession) {
+                const name = msg.params && msg.params.name;
+                const tool = MCP_TOOLS.find((candidate) => candidate.name === name);
+                const requiredScope = tool?.annotations?.readOnlyHint === true ? 'mcp:read' : 'mcp:write';
+                if (!mcpOauth.scopeAllows(oauthSession, requiredScope)) {
+                  recordToolCall({
+                    toolName: name || 'unknown',
+                    serverName: 'mcp-http',
+                    latencyMs: 0,
+                    success: false,
+                    agentId: oauthSession.clientId || 'oauth-client',
+                    metadata: {
+                      denied: true,
+                      deniedReason: 'insufficient_scope',
+                      requiredScope,
+                    },
+                  });
+                  sendJson(res, 200, {
+                    jsonrpc: '2.0', id: msg.id,
+                    error: { code: -32003, message: `OAuth token is missing required scope "${requiredScope}".` },
+                  });
+                  return;
+                }
+              }
               (async () => {
                 try {
                   const { callTool } = require('../../adapters/mcp/server-stdio');
-                  const name = msg.params && msg.params.name;
+                  const name = msg.params?.name;
                   const args = (msg.params && msg.params.arguments) || {};
                   const result = await callTool(name, args);
                   sendJson(res, 200, {
                     jsonrpc: '2.0', id: msg.id,
-                    result: { content: [{ type: 'text', text: typeof result === 'string' ? result : JSON.stringify(result) }] },
+                    result,
                   });
                 } catch (err) {
                   sendJson(res, 200, {
@@ -5553,7 +5659,7 @@ function createApiServer() {
       let trackedParsed = parsed;
       if (req.method === 'POST') {
         const target = getTrackedLinkTarget(trackedLinkMatch[1]);
-        if (!target || !target.requiresPost) {
+        if (!target?.requiresPost) {
           sendJson(res, target ? 405 : 404, target
             ? { error: 'POST is not supported for this tracked link' }
             : { error: 'Tracked link not found', allowed: Object.keys(TRACKED_LINK_TARGETS) }, {
@@ -5572,7 +5678,7 @@ function createApiServer() {
         const form = await parseFormBody(req, 16 * 1024);
         trackedParsed = new URL(parsed.toString());
         for (const [key, value] of Object.entries(form)) {
-          if (key === 'customer_email' || TRACKED_LINK_QUERY_KEYS.includes(key)) {
+          if (key === 'customer_email' || TRACKED_LINK_QUERY_KEYS.has(key)) {
             trackedParsed.searchParams.set(key, String(value || '').trim());
           }
         }
@@ -5644,10 +5750,31 @@ function createApiServer() {
       return;
     }
 
-    // Quick feedback capture via GET — for statusline clickable links
-    if (isGetLikeRequest && pathname === '/feedback/quick') {
+    // GET/HEAD only render a confirmation. Capture requires an authenticated
+    // POST so prefetchers and link checkers cannot create human feedback.
+    if ((isGetLikeRequest || req.method === 'POST') && pathname === '/feedback/quick') {
       const signal = parsed.searchParams.get('signal');
       if (signal === 'up' || signal === 'down') {
+        const emoji = signal === 'up' ? '👍' : '👎';
+        const label = signal === 'up' ? 'Positive' : 'Negative';
+        if (isHeadRequest) {
+          sendHtml(res, 200, '', {}, { headOnly: true });
+          return;
+        }
+        if (req.method === 'GET') {
+          sendHtml(res, 200, `<!DOCTYPE html><html><head><meta charset="utf-8"><title>ThumbGate feedback</title></head>
+<body style="background:#0a0a0a;color:#fff;font-family:system-ui;display:grid;place-items:center;height:100vh;margin:0">
+<form method="post" action="/feedback/quick?signal=${signal}" style="text-align:center;background:#141414;padding:40px;border-radius:16px">
+<div style="font-size:64px">${emoji}</div><h1>Record ${label.toLowerCase()} feedback?</h1>
+<p>This confirmation prevents previews and crawlers from recording feedback.</p>
+<button type="submit" style="padding:10px 20px;font-weight:700">Record ${emoji} feedback</button>
+</form></body></html>`);
+          return;
+        }
+        if (!isAuthorized(req, expectedApiKey)) {
+          sendJson(res, 401, { error: 'Authentication required to record human feedback' });
+          return;
+        }
         const chatHistory = readRecentConversationWindow({
           feedbackDir: requestSafeDataDir,
           limit: 10,
@@ -5657,35 +5784,17 @@ function createApiServer() {
           context: 'Quick capture from Claude Code statusline',
           chatHistory,
           tags: ['statusline', 'quick-capture'],
+          reviewOrigin: 'human',
         });
-        const emoji = signal === 'up' ? '👍' : '👎';
-        const color = signal === 'up' ? '#22c55e' : '#ef4444';
-        const label = signal === 'up' ? 'Positive' : 'Negative';
         const opposite = signal === 'up' ? 'down' : 'up';
         const oppEmoji = signal === 'up' ? '👎' : '👍';
         const feedbackId = result.feedbackEvent?.id || 'saved';
         const promoted = result.accepted ? 'Promoted to memory' : 'Stored';
         sendHtml(res, 200, `<!DOCTYPE html><html><head><meta charset="utf-8"><title>ThumbGate — ${label} feedback</title>
 <style>
-*{box-sizing:border-box}
 body{background:#0a0a0a;color:#fff;font-family:system-ui,-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
 .card{text-align:center;background:#141414;border:1px solid #222;border-radius:16px;padding:48px 40px;max-width:420px;width:90%;box-shadow:0 8px 32px rgba(0,0,0,.5)}
-.emoji{font-size:80px;margin-bottom:12px;animation:pop .4s ease-out}
-@keyframes pop{0%{transform:scale(0)}50%{transform:scale(1.2)}100%{transform:scale(1)}}
-.msg{font-size:22px;color:${color};font-weight:700;margin-bottom:4px}
-.sub{font-size:13px;color:#666;margin-top:6px;font-family:ui-monospace,monospace}
-.context-form{margin-top:20px;text-align:left}
-.context-form label{font-size:12px;color:#888;display:block;margin-bottom:6px}
-.context-form textarea{width:100%;background:#1a1a1a;border:1px solid #333;border-radius:8px;color:#ccc;padding:10px;font-size:13px;resize:vertical;min-height:60px;font-family:system-ui}
-.context-form textarea:focus{outline:none;border-color:${color}}
-.context-form button{margin-top:8px;background:${color};color:#000;border:none;border-radius:8px;padding:8px 20px;font-size:13px;font-weight:600;cursor:pointer}
-.context-form button:hover{opacity:.85}
-.actions{margin-top:24px;display:flex;gap:12px;justify-content:center;flex-wrap:wrap}
-.actions a{color:#22d3ee;text-decoration:none;font-size:13px;padding:8px 16px;border:1px solid #333;border-radius:8px;transition:all .15s}
-.actions a:hover{background:#1a2a2e;border-color:#22d3ee}
-.toast{position:fixed;bottom:24px;left:50%;transform:translateX(-50%);background:#22c55e;color:#000;padding:10px 24px;border-radius:8px;font-size:14px;font-weight:600;display:none;animation:slideUp .3s ease-out}
-@keyframes slideUp{from{opacity:0;transform:translateX(-50%) translateY(12px)}to{opacity:1;transform:translateX(-50%) translateY(0)}}
-.badge{display:inline-block;font-size:11px;padding:2px 8px;border-radius:4px;background:#1a1a1a;border:1px solid #333;color:#888;margin-top:8px}
+.emoji{font-size:64px}.sub,label{color:#888}textarea{width:100%;min-height:60px}.actions{margin-top:20px}.actions a{color:#22d3ee;margin:8px}
 </style></head><body>
 <div class="card">
   <div class="emoji">${emoji}</div>
@@ -5698,7 +5807,7 @@ body{background:#0a0a0a;color:#fff;font-family:system-ui,-apple-system,sans-seri
   </div>
   <div class="actions">
     <a href="/lessons/${feedbackId}" title="View the full lesson and edit it">📋 View Lesson</a>
-    <a href="/feedback/quick?signal=${opposite}" title="Meant to click ${oppEmoji}?">Undo → send ${oppEmoji} instead</a>
+    <a href="/feedback/quick?signal=${opposite}" title="Meant to click ${oppEmoji}?">Record ${oppEmoji} instead</a>
     <a href="/dashboard">Dashboard →</a>
   </div>
 </div>
@@ -5722,6 +5831,10 @@ async function addContext(){
     }
 
     if (req.method === 'POST' && pathname === '/feedback/quick/context') {
+      if (!isAuthorized(req, expectedApiKey)) {
+        sendJson(res, 401, { error: 'Authentication required to update human feedback' });
+        return;
+      }
       const body = await parseJsonBody(req);
       const signal = body.signal;
       const context = typeof body.context === 'string' ? body.context.trim() : '';
@@ -6166,6 +6279,74 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (pathname === '/architecture' || pathname === '/architecture.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(ARCHITECTURE_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'architecture' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Architecture page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/whitepaper' || pathname === '/whitepaper.html' || pathname === '/how-we-know' || pathname === '/how-we-know-it-works')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(WHITEPAPER_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'whitepaper' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'White paper page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/eval-scorecard' || pathname === '/eval-scorecard.html' || pathname === '/scorecard' || pathname === '/bench')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(EVAL_SCORECARD_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'eval_scorecard' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Eval scorecard page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/evaluations' || pathname === '/evaluations.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(EVALUATIONS_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'evaluations' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Evaluations page not found' });
+      }
+      return;
+    }
+
     if (isGetLikeRequest && (pathname === '/federal' || pathname === '/federal.html' || pathname === '/government' || pathname === '/gov')) {
       // Federal lead-gen page. Routed through servePublicMarketingPage so agency
       // arrivals via SBIR / GSA / outbound channels capture UTM attribution and
@@ -6430,7 +6611,7 @@ async function addContext(){
           if (
             key === 'confirm'
             || key === 'customer_email'
-            || TRACKED_LINK_QUERY_KEYS.includes(key)
+            || TRACKED_LINK_QUERY_KEYS.has(key)
           ) {
             parsed.searchParams.set(key, String(value || '').trim());
           }
@@ -6946,7 +7127,8 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           // are configured (production) the key MUST match a configured admin /
           // operator / reviewer key — otherwise OAuth would authenticate nobody.
           // In insecure/dev mode (no keys configured) any non-empty key is accepted.
-          if (!resolveKeyRole(form.get('api_key') || '')) {
+          const keyRole = resolveKeyRole(form.get('api_key') || '');
+          if (!keyRole) {
             sendJson(res, 400, { error: 'access_denied', error_description: 'invalid ThumbGate API key' });
             return;
           }
@@ -6956,6 +7138,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
             codeChallenge: authorizationParams.codeChallenge,
             codeChallengeMethod: authorizationParams.codeChallengeMethod,
             scope: authorizationParams.scope,
+            allowedScopes: keyRole === 'reviewer' ? ['mcp:read'] : mcpOauth.SUPPORTED_SCOPES,
             resource: authorizationParams.resource || buildPublicUrl(hostedConfig, '/mcp'),
             boundKey: form.get('api_key') || '',
             state,
@@ -6999,7 +7182,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       sendJson(res, 200, {
         name: 'thumbgate',
         version: pkg.version,
-        count: MCP_TOOLS.length,
+        count: getPublicMcpTools().length,
         tools: getToolDiscoveryIndex(hostedConfig),
       }, {}, {
         headOnly: isHeadRequest,
@@ -7032,7 +7215,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         });
         return;
       }
-      const tool = MCP_TOOLS.find((candidate) => candidate.name === toolName);
+      const tool = getPublicMcpTools().find((candidate) => candidate.name === toolName);
       if (!tool) {
         sendJson(res, 404, {
           error: 'tool_not_found',
@@ -7048,6 +7231,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         description: tool.description,
         annotations: tool.annotations || {},
         inputSchema: tool.inputSchema,
+        ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),
       }, {}, {
         headOnly: isHeadRequest,
       });
@@ -8038,29 +8222,25 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       return;
     }
 
-    // Public case studies — proof surface for buyers. Conversion-optimization
-    // surface that was missing: thumbgate.ai had no /case-studies, so visitors
-    // landed on CLI install commands without seeing whether anyone actually
-    // got value. First entry is the Aiventyx Teams listing integration: real
-    // third-party CTR signal (5/8 clicks before the /go/teams fix, now routed
-    // through team intake so scope happens before checkout).
-    if (isGetLikeRequest && pathname === '/case-studies') {
-      sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Case Studies — ThumbGate</title><meta name="description" content="Real integrations of ThumbGate's pre-action checks for AI coding agents. Proof, not promises."><style>body{font-family:system-ui,-apple-system,sans-serif;max-width:780px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}h1{font-size:32px;margin:0 0 8px}.lede{color:#6b7280;font-size:18px;margin:0 0 32px}article{border:1px solid #e5e7eb;border-radius:12px;padding:24px;margin-bottom:24px;background:#fff}article h2{margin:0 0 4px;font-size:22px}.meta{color:#6b7280;font-size:13px;margin-bottom:16px}h3{font-size:15px;margin:20px 0 8px;color:#374151;text-transform:uppercase;letter-spacing:0.5px}.metric{display:inline-block;background:#0f172a;color:#fff;padding:4px 10px;border-radius:6px;font-weight:600;font-size:14px;margin:0 4px 4px 0}p{margin:8px 0}a{color:#0066cc}code{background:#f3f4f6;padding:1px 6px;border-radius:4px;font-size:13.5px}footer{margin-top:48px;padding-top:24px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
-<h1>Case Studies</h1>
-<p class="lede">Real integrations. No fabricated logos, no aspirational numbers — every claim below is reproducible.</p>
-
-<p><em>New case studies for individual Pro operators coming soon.</em></p>
-
-<footer>
-<p>Want to be the next case study? The product is real, the integration is 30 seconds: <code>npx thumbgate init</code>. If you ship something with ThumbGate and want it documented here, email <a href="mailto:igor.ganapolsky@gmail.com">igor.ganapolsky@gmail.com</a>.</p>
-<p><a href="https://thumbgate.ai">Home</a> · <a href="/pricing">Pricing</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a> · <a href="/support">Support</a></p>
-</footer>
-</body></html>`, {}, {
-        headOnly: isHeadRequest,
-      });
+    // Public case studies — dogfood proof narratives (static HTML; no fabricated logos).
+    if (isGetLikeRequest && (pathname === '/case-studies' || pathname === '/case-studies.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(CASE_STUDIES_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'case_studies' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Case studies page not found' });
+      }
       return;
     }
 
+
         // Public canonical pricing page. The audit flagged "pricing schizophrenia":
     // sales/pricing.json said $49 / $299, COMMERCIAL_TRUTH.md said $19 / $149,
     // and there was no buyer-facing surface to reconcile the two. This is now
@@ -8215,7 +8395,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           });
           return;
         }
-        if (result && result.retryable === true) {
+        if (result?.retryable === true) {
           sendProblem(res, {
             type: PROBLEM_TYPES.INTERNAL,
             title: 'Fulfillment temporarily unavailable',
@@ -8403,14 +8583,15 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         }
 
         const resolvedTraceId = result.traceId || requestedTraceId;
-        const nextSteps = result.apiKey
-          ? {
+        let nextSteps = {};
+        if (result.apiKey) {
+          nextSteps = {
             env: `THUMBGATE_API_KEY=${result.apiKey}\nTHUMBGATE_API_BASE_URL=${hostedConfig.billingApiBaseUrl}`,
             curl: `curl -X POST ${hostedConfig.billingApiBaseUrl}/v1/feedback/capture \\\n+  -H 'Authorization: Bearer ${result.apiKey}' \\\n+  -H 'Content-Type: application/json' \\\n+  -d '{"signal":"down","context":"example","whatWentWrong":"example","whatToChange":"example"}'`,
-          }
-          : result.offerKind === 'workflow_hardening_diagnostic'
-            ? { fulfillment: 'Payment confirmed. Diagnostic fulfillment is processing; an email will arrive when it completes.' }
-            : {};
+          };
+        } else if (result.offerKind === 'workflow_hardening_diagnostic') {
+          nextSteps = { fulfillment: 'Payment confirmed. Diagnostic fulfillment is processing; an email will arrive when it completes.' };
+        }
 
         sendJson(res, 200, {
           ...result,
@@ -8442,14 +8623,19 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       return;
     }
 
-    // Operator key is allowed to bypass the general admin gate for its dedicated endpoint
+    // Operator key is allowed to bypass the general admin gate for dedicated
+    // read-only operational endpoints.
     const _reqToken = extractApiKey(req);
-    const isOperatorBillingRequest = Boolean(expectedOperatorKey)
-      && _reqToken === expectedOperatorKey
+    const isOperatorReadRequest = Boolean(expectedOperatorKey)
+      && safeKeyEqual(_reqToken, expectedOperatorKey)
       && req.method === 'GET'
-      && ['/v1/billing/summary', '/v1/intake/workflow-sprint/queue'].includes(pathname);
+      && [
+        '/v1/billing/summary',
+        '/v1/intake/workflow-sprint/queue',
+        '/v1/task-outcomes/monitor',
+      ].includes(pathname);
 
-    if (!isOperatorBillingRequest && !isAuthorized(req, expectedApiKey)) {
+    if (!isOperatorReadRequest && !isAuthorized(req, expectedApiKey)) {
       sendProblem(res, {
         type: PROBLEM_TYPES.UNAUTHORIZED,
         title: 'Unauthorized',
@@ -8469,7 +8655,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       if (req.method === 'GET' && pathname === '/v1/feedback/stats') {
         const stats = shouldAggregateFeedback()
           ? computeAggregateFeedbackStats({ feedbackDir: requestFeedbackPaths.FEEDBACK_DIR })
-          : analyzeFeedback(requestFeedbackPaths.FEEDBACK_LOG_PATH);
+          : analyzeFeedback(requestFeedbackPaths.FEEDBACK_LOG_PATH, { humanOnly: true });
         try {
           const { getStatuslineMeta } = require('../../scripts/statusline-meta');
           const meta = getStatuslineMeta({ env: process.env });
@@ -8989,6 +9175,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           workflowContract: body.workflowContract,
           repoPath: body.repoPath,
           localOnly: body.localOnly === true,
+          ttlMs: body.ttlMs,
           clear: body.clear === true,
         });
         sendJson(res, 200, { scope });
@@ -9037,6 +9224,84 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         return;
       }
 
+      if (req.method === 'POST' && pathname === '/v1/task-outcomes') {
+        const body = await parseJsonBody(req);
+        try {
+          const result = recordTaskOutcome(body, { feedbackDir: requestFeedbackDir });
+          sendJson(res, result.recorded ? 201 : 200, result);
+        } catch (error) {
+          throw createHttpError(400, error.message);
+        }
+        return;
+      }
+
+      if (req.method === 'GET' && pathname === '/v1/task-outcomes') {
+        const taskId = parsed.searchParams.get('taskId');
+        const limit = Math.max(1, Math.min(100, Number(parsed.searchParams.get('limit') || 20)));
+        if (taskId) {
+          const outcome = getTaskOutcome(taskId, { feedbackDir: requestFeedbackDir });
+          if (!outcome) throw createHttpError(404, `Task outcome not found: ${taskId}`);
+          sendJson(res, 200, outcome);
+        } else {
+          sendJson(res, 200, {
+            outcomes: readTaskOutcomes({ feedbackDir: requestFeedbackDir }).slice(-limit),
+          });
+        }
+        return;
+      }
+
+      if (req.method === 'GET' && pathname === '/v1/task-outcomes/metrics') {
+        const outcomes = readTaskOutcomes({ feedbackDir: requestFeedbackDir });
+        sendJson(res, 200, calculateTaskOutcomeMetrics(outcomes));
+        return;
+      }
+
+      if (req.method === 'GET' && pathname === '/v1/task-outcomes/monitor') {
+        const outcomes = readTaskOutcomes({ feedbackDir: requestFeedbackDir });
+        const toolKpis = computeToolKpis({ feedbackDir: requestFeedbackDir });
+        sendJson(res, 200, monitorProductionSignals(outcomes, toolKpis));
+        return;
+      }
+
+      if (req.method === 'POST' && pathname === '/v1/escalations') {
+        const body = await parseJsonBody(req);
+        try {
+          const result = requestEscalation(body, { feedbackDir: requestFeedbackDir });
+          sendJson(res, result.recorded ? 201 : 200, result);
+        } catch (error) {
+          throw createHttpError(400, error.message);
+        }
+        return;
+      }
+
+      if (req.method === 'GET' && pathname === '/v1/escalations') {
+        const status = parsed.searchParams.get('status') || undefined;
+        const escalations = listEscalations({ feedbackDir: requestFeedbackDir, status });
+        sendJson(res, 200, {
+          escalations,
+          metrics: calculateEscalationMetrics(escalations),
+        });
+        return;
+      }
+
+      if (req.method === 'POST' && /^\/v1\/escalations\/[^/]+\/decision$/.test(pathname)) {
+        const escalationId = decodeURIComponent(pathname.split('/')[3]);
+        const authenticatedActor = authenticateHumanReviewer(req, humanReviewerConfig);
+        const body = await parseJsonBody(req);
+        try {
+          sendJson(res, 200, decideEscalation({
+            ...body,
+            escalationId,
+          }, {
+            authenticatedActor,
+            feedbackDir: requestFeedbackDir,
+          }));
+        } catch (error) {
+          throw createHttpError(400, error.message);
+        }
+        return;
+      }
+
       if (req.method === 'GET' && pathname === '/v1/ops/integrity') {
         const command = parsed.searchParams.get('command') || undefined;
         const baseBranch = parsed.searchParams.get('baseBranch') || undefined;
@@ -9207,6 +9472,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           guardrails: body.guardrails,
           tags: extractTags(body.tags),
           skill: body.skill,
+          reviewOrigin: 'human',
         });
         const actionIntegration = inferActionIntegration(body, req.headers);
         appendBestEffortTelemetry(requestFeedbackDir, {