thumbgate 1.29.1 → 1.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.29.1",
+  "version": "1.30.0",
   "description": "ThumbGate Pre-Action Checks self-improve from ranked lessons and repeated failures, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -22,6 +22,8 @@
     "scripts/activation-quickstart.js",
     "scripts/activation-tracker.js",
     "scripts/agent-audit-trace.js",
+    "scripts/agent-outcome-eval.js",
+    "scripts/agent-outcome-monitor.js",
     "scripts/agent-design-governance.js",
     "scripts/agent-memory-lifecycle.js",
     "scripts/agent-readiness-plan.js",
@@ -121,6 +123,7 @@
     "scripts/hook-stop-anti-claim.js",
     "scripts/hook-thumbgate-cache-updater.js",
     "scripts/hosted-config.js",
+    "scripts/human-escalation.js",
     "scripts/hybrid-feedback-context.js",
     "scripts/imperative-detector.js",
     "scripts/hybrid-supervisor-agent.js",
@@ -197,11 +200,13 @@
     "scripts/revenue-action-eligibility.js",
     "scripts/revenue-evidence-remediation.js",
     "scripts/reward-hacking-guardrails.js",
+    "scripts/model-eval.js",
     "scripts/risk-scorer.js",
     "scripts/rlaif-self-audit.js",
     "scripts/rubric-engine.js",
     "scripts/rule-validator.js",
     "scripts/sales-pipeline.js",
+    "scripts/schedule-manager.js",
     "scripts/secret-scanner.js",
     "scripts/secret-fixture-tokens.js",
     "scripts/secret-redaction.js",
@@ -244,6 +249,8 @@
     "scripts/token-tco.js",
     "scripts/tool-contract-validator.js",
     "scripts/tool-registry.js",
+    "scripts/task-outcomes.js",
+    "scripts/tool-kpi-tracker.js",
     "scripts/upstream-contribution-engine.js",
     "scripts/user-profile.js",
     "scripts/validate-workflow-contract.js",
@@ -308,6 +315,13 @@
     "public/learn.html",
     "public/lessons.html",
     "public/numbers.html",
+    "public/assets/diagrams/",
+    "public/whitepaper.html",
+    "public/evaluations.html",
+    "public/eval-scorecard.html",
+    "public/eval-scorecard.json",
+    "public/case-studies.html",
+    "public/architecture.html",
     "public/partner-intake.html",
     "public/pricing.html",
     "public/pro.html",
@@ -319,9 +333,15 @@
     "public/brand/",
     "public/js/",
     "skills/thumbgate/SKILL.md",
-    "src/"
+    "src/",
+    "scripts/generate-eval-scorecard.js",
+    "scripts/refresh-proof-pack.js",
+    "scripts/generate-case-study-outreach.js"
   ],
   "scripts": {
+    "canary:snapshot": "node scripts/gate-decision-canary.js --snapshot",
+    "canary:check": "node scripts/gate-decision-canary.js --check",
+    "test:canary": "node --test tests/gate-decision-canary.test.js",
     "postinstall": "node bin/postinstall.js || true",
     "start": "node src/api/server.js",
     "numbers:generate": "node scripts/generate-numbers-page.js",
@@ -393,6 +413,8 @@
     "judge:reward:prompt": "node scripts/judge-reward-function.js prompt",
     "llm:behavior": "node scripts/llm-behavior-monitor.js report",
     "llm:behavior:json": "node scripts/llm-behavior-monitor.js json",
+    "eval:agent-outcomes": "node scripts/agent-outcome-eval.js",
+    "monitor:agent-outcomes": "node scripts/agent-outcome-monitor.js",
     "prompt:plan": "node scripts/prompting-operating-system.js plan",
     "prompt:plan:json": "node scripts/prompting-operating-system.js json",
     "credentials:plan": "node scripts/single-use-credential-gate.js plan",
@@ -417,7 +439,7 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:proof-pack-cadence && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:canary && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:verification-evidence && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation && npm run test:retrieval-window && npm run test:risk-quality && npm run test:eval-mining && npm run test:state-backup && npm run test:eval-golden && npm run test:task-scope-lease",
     "test:python": "python3 -m pytest tests/*.py",
     "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
@@ -462,7 +484,8 @@
     "test:spec-gate": "node --test tests/spec-gate.test.js",
     "test:dashboard-insights": "node --test tests/dashboard-insights.test.js",
     "test:telemetry-tracked-link-slug": "node --test tests/telemetry-tracked-link-slug.test.js",
-    "test:prompt-eval": "node --test tests/prompt-eval.test.js",
+    "test:prompt-eval": "node --test tests/prompt-eval.test.js tests/verified-agent-outcomes.test.js tests/task-outcome-api.test.js",
+    "test:verified-agent-outcomes": "node --test tests/verified-agent-outcomes.test.js tests/task-outcome-api.test.js",
     "eval:feedback": "node scripts/prompt-eval.js --from-feedback",
     "eval:feedback-quality": "python3 scripts/feedback_quality_eval.py",
     "eval:classifier": "python3 scripts/eval_gate_classifier.py",
@@ -513,6 +536,7 @@
     "test:cloudflare-sandbox": "node --test tests/cloudflare-dynamic-sandbox.test.js tests/cloudflare-sandbox-api.test.js",
     "test:mcp-config": "node --test tests/mcp-config.test.js tests/mcp-capability-exposure.test.js",
     "test:mcp-tool-annotations": "node --test tests/mcp-tool-annotations.test.js",
+    "test:mcp-policy": "node --test tests/mcp-policy.test.js",
     "test:mcp-oauth": "node --test tests/mcp-oauth.test.js",
     "test:mcp-oauth-flow": "node --test tests/mcp-oauth-flow.test.js",
     "test:plan-gate": "node --test tests/plan-gate.test.js",
@@ -548,13 +572,13 @@
     "test:proof": "node --test tests/prove-adapters.test.js tests/prove-attribution.test.js tests/prove-cloudflare-sandbox.test.js tests/prove-data-quality.test.js tests/prove-intelligence.test.js tests/prove-lancedb.test.js tests/prove-loop-closure.test.js tests/prove-training-export.test.js tests/prove-local-intelligence.test.js tests/prove-workflow-contract.test.js tests/prove-autoresearch.test.js tests/prove-claim-verification.test.js tests/prove-data-pipeline.test.js tests/prove-evolution.test.js tests/prove-harnesses.test.js tests/prove-packaged-runtime.test.js tests/prove-runtime.test.js tests/prove-seo-gsd.test.js tests/prove-settings.test.js tests/prove-xmemory.test.js && node --test tests/prove-automation.test.js",
     "test:e2e": "node --test tests/e2e-pipeline.test.js tests/e2e-product-flows.test.js tests/e2e-coverage-contract.test.js tests/interaction-model-e2e.test.js",
     "test:rlaif": "node --test tests/rlaif-self-audit.test.js tests/dpo-optimizer.test.js tests/meta-policy.test.js tests/agent-reward-model.test.js",
-    "test:attribution": "node --test tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js",
+    "test:attribution": "node --test tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js tests/memory-guard-matching.test.js",
     "test:quality": "node --test tests/validate-feedback.test.js tests/feedback-quality-eval-python.test.js tests/eval-gate-classifier.test.js",
     "test:intelligence": "node --test tests/intelligence.test.js",
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
     "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js tests/packed-feedback-retrieval-e2e.test.js tests/packed-provider-payment-reconciler-e2e.test.js tests/packed-revenue-remediation-e2e.test.js",
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js",
-    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/workflow-intake-queue.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js tests/revenue-action-eligibility.test.js tests/revenue-evidence-remediation.test.js tests/gtm-revenue-action-eligibility.test.js tests/revenue-offer-ladder.test.js tests/revenue-offer-system.test.js tests/buyer-paths.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
+    "test:workflow": "node --test tests/parallel-workflow.test.js tests/parallel-workflow-public.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/workflow-intake-queue.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js tests/revenue-action-eligibility.test.js tests/revenue-evidence-remediation.test.js tests/gtm-revenue-action-eligibility.test.js tests/revenue-offer-ladder.test.js tests/revenue-offer-system.test.js tests/buyer-paths.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js && node --test tests/eval-proof-pack-pages.test.js && npm run test:proof-pack-cadence",
     "test:revenue-evidence-remediation": "node --test tests/revenue-evidence-remediation.test.js",
     "test:grafana-revenue-evidence": "node --test tests/grafana-revenue-evidence.test.js",
     "test:sales-pipeline": "node --test tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js",
@@ -567,7 +591,7 @@
     "test:ops": "node --test tests/qa-scenario-planner.test.js tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js tests/auto-promote-regression-gate.test.js",
     "test:session-analyzer": "node --test tests/session-analyzer.test.js",
     "test:tessl": "node --test tests/tessl-export.test.js",
-    "test:gates": "node --test tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js",
+    "test:gates": "node --test --test-concurrency=1 tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js tests/git-pathspec-scope.test.js tests/git-global-option-bypass.test.js tests/gate-evasion-matrix.test.js",
     "test:budget": "node --test tests/budget-guard.test.js tests/budget-enforcer.test.js tests/tokenomics-cost-guard.test.js tests/hook-no-budget-lockout.test.js",
     "test:workers": "npm --prefix workers ci && npm --prefix workers test",
     "test:evoskill": "node --test tests/evoskill.test.js",
@@ -643,7 +667,7 @@
     "test:control-tower": "node --test tests/control-tower.test.js",
     "test:pii-scanner": "node --test tests/pii-scanner.test.js",
     "test:data-governance": "node --test tests/data-governance.test.js",
-    "test:lesson-inference": "node --test tests/conversation-context.test.js tests/lesson-inference.test.js tests/lesson-prompt-shape.test.js",
+    "test:lesson-inference": "node --test tests/conversation-context.test.js tests/lesson-inference.test.js tests/lesson-prompt-shape.test.js tests/lesson-stats-review-origin.test.js",
     "test:lesson-retrieval": "node --test tests/lesson-retrieval.test.js",
     "test:lesson-semantic-retrieval": "node --test tests/lesson-semantic-retrieval.test.js",
     "test:cross-encoder": "node --test tests/cross-encoder-reranker.test.js",
@@ -684,6 +708,7 @@
     "social:publish:latest-release-article": "node scripts/social-analytics/publish-latest-release-article.js",
     "social:publish:latest-release-fallbacks": "node scripts/social-analytics/publish-latest-release-fallbacks.js",
     "social:verify:latest-release": "node scripts/social-analytics/verify-latest-release-posts.js",
+    "social:verify:marketing-agent": "node scripts/social-analytics/verify-marketing-agent-campaign.js",
     "social:schedule:campaign": "node scripts/social-analytics/schedule-thumbgate-campaign.js",
     "social:install:growth": "node scripts/social-analytics/install-growth-automation.js",
     "social:reconcile:campaign": "node scripts/social-analytics/reconcile-thumbgate-campaign.js",
@@ -745,6 +770,7 @@
     "gate-eval:ci": "node scripts/gate-eval.js run",
     "test:ai-engineering-stack-guardrails": "node --test tests/ai-engineering-stack-guardrails.test.js",
     "test:ai-component-inventory": "node --test tests/ai-component-inventory.test.js",
+    "test:verification-evidence": "node --test tests/verification-evidence.test.js",
     "test:interaction-model": "node --test tests/interaction-model.test.js tests/interaction-model-e2e.test.js",
     "aws-blocks:guardrails": "node scripts/aws-blocks-guardrails.js",
     "test:aws-blocks-guardrails": "node --test tests/aws-blocks-guardrails.test.js",
@@ -825,7 +851,25 @@
     "observability:setup": "node scripts/observability-setup.js",
     "observability:doctor": "node scripts/revenue-observability-doctor.js",
     "test:jsonl-window": "node --test tests/jsonl-window.test.js",
-    "test:observability-env": "node --test tests/observability-env.test.js"
+    "test:observability-env": "node --test tests/observability-env.test.js",
+    "test:retrieval-window": "node --test tests/lesson-retrieval-recency-window.test.js",
+    "eval:risk": "node scripts/eval-risk-model.js",
+    "test:risk-quality": "node --test tests/risk-model-quality.test.js tests/model-eval.test.js",
+    "state:backup": "node scripts/state-backup.js",
+    "state:backup:verify": "node scripts/state-backup.js --verify",
+    "state:restore": "node scripts/state-backup.js --restore",
+    "test:state-backup": "node --test tests/state-backup.test.js",
+    "eval:mine": "node scripts/mine-eval-set.js",
+    "eval:baseline": "node scripts/eval-baseline.js",
+    "test:eval-golden": "node --test tests/gate-golden-set.test.js",
+    "test:eval-mining": "node --test tests/mine-eval-set.test.js tests/eval-baseline.test.js",
+    "test:task-scope-lease": "node --test tests/task-scope-lease.test.js",
+    "eval-scorecard:generate": "node scripts/generate-eval-scorecard.js",
+    "proof-pack:refresh": "node scripts/refresh-proof-pack.js --write",
+    "proof-pack:refresh:check": "node scripts/refresh-proof-pack.js --check",
+    "proof-pack:schedule": "node scripts/schedule-manager.js install --label proof-pack-scorecard --spec 'daily 06:15' --command 'npm run proof-pack:refresh' --workingDirectory .",
+    "outreach:case-study": "node scripts/generate-case-study-outreach.js",
+    "test:proof-pack-cadence": "node --test tests/refresh-proof-pack.test.js tests/case-study-outreach.test.js"
   },
   "keywords": [
     "mcp",
@@ -895,7 +939,7 @@
     "@google/genai": {
       "protobufjs": "7.6.5"
     },
-    "brace-expansion": "5.0.7",
+    "brace-expansion": "5.0.8",
     "onnxruntime-web": {
       "protobufjs": "7.6.5"
     },
@@ -909,7 +953,7 @@
     "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
     "@playwright/test": "^1.60.0",
-    "c8": "^11.0.0",
+    "c8": "^12.0.0",
     "undici": "^8.5.0"
   },
   "hotfix": "gate-check-bypass-2026-06-03"

package/public/architecture.html

@@ -0,0 +1,130 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="generator" content="ThumbGate">
+<meta name="author" content="Igor Ganapolsky">
+<title>ThumbGate Architecture Diagrams — Pre-Action Gate Loop</title>
+<meta name="description" content="Architecture diagrams for ThumbGate: system map, feedback pipeline, agent integration, and pre-action gate loop. The same visuals used in the open-source README, published on thumbgate.ai.">
+<meta property="og:title" content="ThumbGate Architecture Diagrams">
+<meta property="og:description" content="System architecture, feedback pipeline, agent integration, and pre-action gate loop — the visual proof pack for buyers and reviewers.">
+<meta property="og:type" content="article">
+<meta property="og:url" content="https://thumbgate.ai/architecture">
+<link rel="canonical" href="https://thumbgate.ai/architecture">
+<link rel="icon" type="image/png" href="/thumbgate-icon.png">
+<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "ThumbGate Architecture Diagrams",
+  "description": "System architecture, feedback pipeline, agent integration, and pre-action gate loop diagrams for the ThumbGate Reliability Gateway.",
+  "url": "https://thumbgate.ai/architecture",
+  "dateModified": "2026-07-29",
+  "author": { "@type": "Person", "name": "Igor Ganapolsky", "url": "https://github.com/IgorGanapolsky" }
+}
+</script>
+<style>
+  :root {
+    --bg:#0b0f14; --panel:#111823; --border:#1e2a3a; --text:#e6edf3;
+    --muted:#8b98a5; --cyan:#39c5cf;
+  }
+  * { margin:0; padding:0; box-sizing:border-box; }
+  body { background:var(--bg); color:var(--text); font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; line-height:1.65; }
+  nav { padding:1rem 2rem; border-bottom:1px solid var(--border); display:flex; gap:1.25rem; flex-wrap:wrap; align-items:center; }
+  nav a { color:var(--muted); text-decoration:none; font-size:0.9rem; }
+  nav a:hover { color:var(--cyan); }
+  nav .brand { color:var(--text); font-weight:700; }
+  .container { max-width:980px; margin:0 auto; padding:2.5rem 1.5rem 4rem; }
+  h1 { font-size:2rem; margin-bottom:0.4rem; }
+  h2 { font-size:1.3rem; margin:2.4rem 0 0.75rem; color:var(--cyan); }
+  .subtitle { color:var(--muted); font-size:1.05rem; margin-bottom:1.5rem; }
+  figure { background:var(--panel); border:1px solid var(--border); border-radius:12px; padding:1rem; margin:1rem 0 1.75rem; }
+  figure img { width:100%; height:auto; display:block; border-radius:8px; background:#050816; }
+  figcaption { color:var(--muted); font-size:0.9rem; margin-top:0.75rem; }
+  .grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:1rem; margin:1.25rem 0; }
+  .card { background:var(--panel); border:1px solid var(--border); border-radius:10px; padding:1rem 1.1rem; }
+  .card h3 { font-size:1rem; margin-bottom:0.35rem; }
+  .card p { color:var(--muted); font-size:0.92rem; }
+  a.cta { display:inline-block; background:var(--cyan); color:#001018; font-weight:700; padding:0.7rem 1rem; border-radius:8px; text-decoration:none; margin:0.5rem 0.75rem 0.5rem 0; }
+  a.secondary { color:var(--cyan); }
+  .footer-note { color:var(--muted); font-size:0.85rem; margin-top:2.5rem; text-align:center; }
+  .footer-note a { color:var(--cyan); text-decoration:none; }
+</style>
+</head>
+<body>
+<nav>
+  <a class="brand" href="/">ThumbGate</a>
+  <a href="/whitepaper">White paper</a>
+  <a href="/architecture">Architecture</a>
+  <a href="/eval-scorecard">Scorecard</a>
+  <a href="/evaluations">Evaluations</a>
+  <a href="/case-studies">Case studies</a>
+  <a href="/numbers">Numbers</a>
+  <a href="/pricing">Pricing</a>
+</nav>
+<main class="container">
+  <h1>Architecture diagrams</h1>
+  <p class="subtitle">The same system diagrams that ship in the open-source README, published here so buyers and reviewers do not need GitHub to see how PreToolUse enforcement, feedback, and promotion fit together.</p>
+
+  <div class="grid">
+    <div class="card">
+      <h3>Local-first enforcement</h3>
+      <p>No LLM on the block/allow path. Deterministic rules first; local semantic recall only when needed.</p>
+    </div>
+    <div class="card">
+      <h3>Feedback → rules</h3>
+      <p>Thumbs-down becomes a reviewable lesson, then a prevention rule that fires before the next tool call.</p>
+    </div>
+    <div class="card">
+      <h3>Multi-agent surface</h3>
+      <p>One gate layer across Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, and MCP.</p>
+    </div>
+  </div>
+
+  <h2>System architecture</h2>
+  <figure>
+    <img src="/assets/diagrams/thumbgate-architecture.png" alt="ThumbGate architecture: agent layer, hooks, MCP tools, gate engine, governance, security, feedback memory, and orchestration" width="1200" height="800" loading="eager">
+    <figcaption>Agents → hooks → MCP tools → gate engine (match / verdict / reasoning / stats), with governance, secret scanning, feedback promotion, and orchestration around the decision path.</figcaption>
+  </figure>
+
+  <h2>Feedback pipeline (session 1 → session 2)</h2>
+  <figure>
+    <img src="/assets/diagrams/feedback-pipeline.png" alt="Sequence diagram: agent mistake, thumbs-down capture, rule promotion, next session blocked" width="1200" height="700" loading="lazy">
+    <figcaption>Session 1 captures a thumbs-down; the lesson is promoted; session 2 blocks the repeat before execution.</figcaption>
+  </figure>
+
+  <h2>Pre-action gate loop</h2>
+  <figure>
+    <img src="/assets/diagrams/pre-action-gate-loop.svg" alt="Pre-action gate loop: capture, remember, rank, gate" width="900" height="400" loading="lazy">
+    <figcaption>Capture feedback → remember locally → rank and promote → gate the next tool call.</figcaption>
+  </figure>
+
+  <h2>Agent integration</h2>
+  <figure>
+    <img src="/assets/diagrams/agent-integration.png" alt="ThumbGate agent integration map across coding agents and MCP" width="1200" height="700" loading="lazy">
+    <figcaption>How ThumbGate attaches to coding agents and MCP tool surfaces without putting a remote model on the enforcement path.</figcaption>
+  </figure>
+
+  <h2>Plugin topology</h2>
+  <figure>
+    <img src="/assets/diagrams/plugin-topology.png" alt="ThumbGate plugin topology across IDE and CLI surfaces" width="1200" height="700" loading="lazy">
+    <figcaption>Where plugins and marketplace packages sit relative to the local gate runtime.</figcaption>
+  </figure>
+
+  <h2>Related proof surfaces</h2>
+  <p>
+    <a class="cta" href="/whitepaper">How we know it works</a>
+    <a class="cta" href="/eval-scorecard">Eval scorecard</a>
+    <a class="secondary" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/diagrams/thumbgate_architecture.mmd">Mermaid sources on GitHub →</a>
+  </p>
+
+  <p class="footer-note">
+    Source diagrams live in <code>docs/diagrams/</code> and are mirrored here for production serving.
+    Also see <a href="/evaluations">ML evaluations</a> and
+    <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md">verification evidence</a>.
+  </p>
+</main>
+</body>
+</html>

package/public/assets/diagrams/before-after.svg

@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 280" role="img" aria-labelledby="t d">
+  <title id="t">Before and after ThumbGate</title>
+  <desc id="d">Without ThumbGate the same mistake repeats. With ThumbGate the second attempt is caught.</desc>
+  <rect width="960" height="280" fill="#0a0a0b"/>
+  <g font-family="system-ui,sans-serif">
+    <!-- WITHOUT -->
+    <rect x="40" y="36" width="400" height="208" rx="20" fill="#1a1012" stroke="#f87171" stroke-width="2"/>
+    <text x="240" y="72" text-anchor="middle" fill="#f87171" font-size="18" font-weight="900">WITHOUT</text>
+    <text x="240" y="118" text-anchor="middle" fill="#f5f5f7" font-size="20" font-weight="700">🔥 force-push / bad shell</text>
+    <text x="240" y="152" text-anchor="middle" fill="#e5e7eb" font-size="16">You clean it up…</text>
+    <text x="240" y="182" text-anchor="middle" fill="#e5e7eb" font-size="16">…and it happens again.</text>
+    <text x="240" y="218" text-anchor="middle" fill="#9ca3af" font-size="14">time × trust × risk</text>
+    <!-- WITH -->
+    <rect x="520" y="36" width="400" height="208" rx="20" fill="#0c1a14" stroke="#4ade80" stroke-width="2"/>
+    <text x="720" y="72" text-anchor="middle" fill="#4ade80" font-size="18" font-weight="900">WITH THUMBGATE</text>
+    <text x="720" y="118" text-anchor="middle" fill="#f5f5f7" font-size="20" font-weight="700">👎 once</text>
+    <text x="720" y="152" text-anchor="middle" fill="#e5e7eb" font-size="16">Rule saved locally</text>
+    <text x="720" y="182" text-anchor="middle" fill="#e5e7eb" font-size="16">Next attempt is checked</text>
+    <text x="720" y="218" text-anchor="middle" fill="#9ca3af" font-size="14">one correction → permanent gate</text>
+  </g>
+</svg>

package/public/assets/diagrams/decision.svg

@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 300" role="img" aria-labelledby="t d">
+  <title id="t">Which ThumbGate path to pick</title>
+  <desc id="d">Free try, Pro solo, $499 diagnostic, sprint after intake.</desc>
+  <rect width="960" height="300" fill="#0a0a0b"/>
+  <g font-family="system-ui,sans-serif">
+    <text x="480" y="36" text-anchor="middle" fill="#f5f5f7" font-size="17" font-weight="800">Pick the path that matches the pain</text>
+    <!-- Free -->
+    <rect x="28" y="58" width="210" height="210" rx="16" fill="#161618" stroke="#333"/>
+    <text x="133" y="95" text-anchor="middle" fill="#9ca3af" font-size="12" font-weight="700">SOLO TRY</text>
+    <text x="133" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">Free</text>
+    <text x="133" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">npx thumbgate init</text>
+    <text x="133" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Catch one repeat</text>
+    <text x="133" y="230" text-anchor="middle" fill="#4ade80" font-size="12" font-weight="700">prove it works</text>
+    <!-- Pro -->
+    <rect x="258" y="58" width="210" height="210" rx="16" fill="#07151a" stroke="#22d3ee" stroke-width="2"/>
+    <text x="363" y="95" text-anchor="middle" fill="#22d3ee" font-size="12" font-weight="700">SELF-SERVE</text>
+    <text x="363" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">Pro $19/mo</text>
+    <text x="363" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">Unlimited solo</text>
+    <text x="363" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Dashboard · exports</text>
+    <text x="363" y="230" text-anchor="middle" fill="#22d3ee" font-size="12" font-weight="700">checkout today</text>
+    <!-- Diagnostic $499 - HIGHLIGHT -->
+    <rect x="488" y="58" width="220" height="210" rx="16" fill="#0d1b14" stroke="#4ade80" stroke-width="2.5"/>
+    <text x="598" y="95" text-anchor="middle" fill="#4ade80" font-size="12" font-weight="700">ONE WORKFLOW · PAY TODAY</text>
+    <text x="598" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">$499</text>
+    <text x="598" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">Diagnostic</text>
+    <text x="598" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Map block / warn / review</text>
+    <text x="598" y="230" text-anchor="middle" fill="#4ade80" font-size="12" font-weight="700">not Enterprise</text>
+    <!-- Sprint -->
+    <rect x="728" y="58" width="204" height="210" rx="16" fill="#161618" stroke="#333"/>
+    <text x="830" y="95" text-anchor="middle" fill="#9ca3af" font-size="12" font-weight="700">IMPLEMENT</text>
+    <text x="830" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">$1,500</text>
+    <text x="830" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">Hardening Sprint</text>
+    <text x="830" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Wire + prove gates</text>
+    <text x="830" y="230" text-anchor="middle" fill="#fbbf24" font-size="12" font-weight="700">after scope</text>
+  </g>
+</svg>

package/public/assets/diagrams/loop.svg

@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 280" role="img" aria-labelledby="t d">
+  <title id="t">ThumbGate feedback loop</title>
+  <desc id="d">Agent proposes a tool call, ThumbGate decides allow warn or deny, feedback becomes a rule.</desc>
+  <rect width="960" height="280" fill="#0a0a0b"/>
+  <defs>
+    <marker id="arr" markerWidth="10" markerHeight="10" refX="8" refY="4" orient="auto"><path d="M0,0 L8,4 L0,8 Z" fill="#22d3ee"/></marker>
+    <linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#22d3ee"/><stop offset="1" stop-color="#4ade80"/></linearGradient>
+  </defs>
+  <!-- Step 1 -->
+  <rect x="40" y="70" width="180" height="110" rx="18" fill="#161618" stroke="#333"/>
+  <circle cx="70" cy="100" r="16" fill="#222" stroke="#22d3ee" stroke-width="2"/>
+  <text x="70" y="105" text-anchor="middle" fill="#22d3ee" font-family="system-ui,sans-serif" font-size="14" font-weight="800">1</text>
+  <text x="130" y="120" text-anchor="middle" fill="#f5f5f7" font-family="system-ui,sans-serif" font-size="18" font-weight="800">Agent</text>
+  <text x="130" y="146" text-anchor="middle" fill="#9ca3af" font-family="system-ui,sans-serif" font-size="13">proposes a tool</text>
+  <line x1="230" y1="125" x2="290" y2="125" stroke="#22d3ee" stroke-width="3" marker-end="url(#arr)"/>
+  <!-- Step 2 -->
+  <rect x="300" y="50" width="240" height="150" rx="18" fill="#07151a" stroke="url(#g)" stroke-width="2.5"/>
+  <circle cx="340" cy="90" r="16" fill="#0d2530" stroke="#22d3ee" stroke-width="2"/>
+  <text x="340" y="95" text-anchor="middle" fill="#22d3ee" font-family="system-ui,sans-serif" font-size="14" font-weight="800">2</text>
+  <text x="420" y="95" text-anchor="middle" fill="#22d3ee" font-family="system-ui,sans-serif" font-size="20" font-weight="900">ThumbGate</text>
+  <text x="420" y="130" text-anchor="middle" fill="#f5f5f7" font-family="system-ui,sans-serif" font-size="16" font-weight="700">ALLOW · WARN · DENY</text>
+  <text x="420" y="158" text-anchor="middle" fill="#9ca3af" font-family="system-ui,sans-serif" font-size="13">before the tool runs</text>
+  <line x1="550" y1="125" x2="610" y2="125" stroke="#22d3ee" stroke-width="3" marker-end="url(#arr)"/>
+  <!-- Step 3 -->
+  <rect x="620" y="70" width="180" height="110" rx="18" fill="#161618" stroke="#333"/>
+  <circle cx="650" cy="100" r="16" fill="#222" stroke="#4ade80" stroke-width="2"/>
+  <text x="650" y="105" text-anchor="middle" fill="#4ade80" font-family="system-ui,sans-serif" font-size="14" font-weight="800">3</text>
+  <text x="710" y="120" text-anchor="middle" fill="#f5f5f7" font-family="system-ui,sans-serif" font-size="18" font-weight="800">Action</text>
+  <text x="710" y="146" text-anchor="middle" fill="#9ca3af" font-family="system-ui,sans-serif" font-size="13">shell · git · db</text>
+  <!-- Feedback loop -->
+  <path d="M710 185 C710 240 130 240 130 185" fill="none" stroke="#4ade80" stroke-width="3" stroke-dasharray="6 4" marker-end="url(#arr)"/>
+  <rect x="280" y="218" width="280" height="36" rx="18" fill="#0d1b14" stroke="#4ade80"/>
+  <text x="420" y="241" text-anchor="middle" fill="#4ade80" font-family="system-ui,sans-serif" font-size="14" font-weight="700">👍 👎 feedback → lesson → rule</text>
+</svg>

package/public/assets/diagrams/pre-action-gate-loop.svg

@@ -0,0 +1,59 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="520" viewBox="0 0 1200 520" role="img" aria-labelledby="title desc">
+  <title id="title">ThumbGate pre-action gate loop</title>
+  <desc id="desc">Diagram showing an AI agent proposing a tool call, ThumbGate checking it before execution, then either blocking repeated failures or allowing safe actions with an audit receipt.</desc>
+  <defs>
+    <linearGradient id="bg" x1="0" x2="1" y1="0" y2="1">
+      <stop offset="0%" stop-color="#081014"/>
+      <stop offset="100%" stop-color="#111113"/>
+    </linearGradient>
+    <linearGradient id="cyan" x1="0" x2="1" y1="0" y2="0">
+      <stop offset="0%" stop-color="#22d3ee"/>
+      <stop offset="100%" stop-color="#4ade80"/>
+    </linearGradient>
+    <filter id="shadow" x="-10%" y="-10%" width="120%" height="120%">
+      <feDropShadow dx="0" dy="16" stdDeviation="18" flood-color="#000000" flood-opacity="0.35"/>
+    </filter>
+    <marker id="arrow" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto">
+      <path d="M2,2 L10,6 L2,10 Z" fill="#22d3ee"/>
+    </marker>
+  </defs>
+  <rect width="1200" height="520" rx="28" fill="url(#bg)"/>
+  <text x="60" y="72" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="34" font-weight="800">ThumbGate checks agent intent before execution</text>
+  <text x="60" y="106" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="17">Feedback becomes rules. Rules become PreToolUse gates. Gates produce receipts before files, APIs, or production systems change.</text>
+
+  <g filter="url(#shadow)">
+    <rect x="60" y="170" width="235" height="145" rx="18" fill="#161618" stroke="#222225"/>
+    <text x="86" y="205" fill="#22d3ee" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">AGENT INTENT</text>
+    <text x="86" y="244" fill="#e8e8ec" font-family="SFMono-Regular,Consolas,monospace" font-size="18">git push --force</text>
+    <text x="86" y="272" fill="#e8e8ec" font-family="SFMono-Regular,Consolas,monospace" font-size="18">origin main</text>
+    <text x="86" y="296" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13">Still only proposed. Nothing has run.</text>
+
+    <rect x="390" y="160" width="270" height="165" rx="18" fill="#10181a" stroke="#22d3ee" stroke-opacity="0.52"/>
+    <text x="416" y="196" fill="#22d3ee" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">PRETOOLUSE GATE</text>
+    <text x="416" y="232" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="18" font-weight="700">Known repeated failure?</text>
+    <text x="416" y="262" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">Checks active rules, protected paths, approvals,</text>
+    <text x="416" y="284" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">secrets, evidence, and workflow scope.</text>
+
+    <rect x="755" y="120" width="245" height="135" rx="18" fill="#201113" stroke="#f87171" stroke-opacity="0.55"/>
+    <text x="781" y="154" fill="#f87171" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">BLOCK</text>
+    <text x="781" y="191" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="18" font-weight="700">Stop before damage</text>
+    <text x="781" y="220" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">Return the rule and safer next step.</text>
+
+    <rect x="755" y="305" width="245" height="135" rx="18" fill="#102017" stroke="#4ade80" stroke-opacity="0.55"/>
+    <text x="781" y="339" fill="#4ade80" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">ALLOW</text>
+    <text x="781" y="376" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="18" font-weight="700">Run and log receipt</text>
+    <text x="781" y="405" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">Safe actions keep moving with proof.</text>
+  </g>
+
+  <path d="M310 242 H370" stroke="#22d3ee" stroke-width="3" marker-end="url(#arrow)"/>
+  <path d="M670 230 C710 190 725 175 745 170" stroke="#f87171" stroke-width="3" fill="none" marker-end="url(#arrow)"/>
+  <path d="M670 270 C710 335 725 365 745 375" stroke="#4ade80" stroke-width="3" fill="none" marker-end="url(#arrow)"/>
+
+  <g>
+    <rect x="60" y="380" width="600" height="70" rx="16" fill="#0a0a0b" stroke="#222225"/>
+    <text x="86" y="412" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">FEEDBACK LOOP</text>
+    <text x="86" y="438" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="16">Thumbs-down becomes a lesson, then a prevention rule shared across agents.</text>
+  </g>
+  <path d="M820 120 C760 70 240 72 196 165" stroke="url(#cyan)" stroke-width="3" fill="none" stroke-dasharray="8 8" marker-end="url(#arrow)"/>
+  <text x="900" y="486" fill="#22d3ee" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="16" font-weight="800">npx thumbgate init</text>
+</svg>

package/public/assets/diagrams/stack.svg

@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 240" role="img" aria-labelledby="t d">
+  <title id="t">Where ThumbGate sits in the stack</title>
+  <desc id="d">Model to agent runtime to ThumbGate pre-action gate to tools.</desc>
+  <rect width="960" height="240" fill="#0a0a0b"/>
+  <g font-family="system-ui,sans-serif">
+    <rect x="60" y="36" width="840" height="40" rx="10" fill="#161618" stroke="#333"/>
+    <text x="480" y="62" text-anchor="middle" fill="#9ca3af" font-size="15" font-weight="600">Model (Claude · GPT · Gemini · local)</text>
+    <text x="480" y="100" text-anchor="middle" fill="#22d3ee" font-size="22">↓</text>
+    <rect x="60" y="112" width="840" height="40" rx="10" fill="#161618" stroke="#333"/>
+    <text x="480" y="138" text-anchor="middle" fill="#e5e7eb" font-size="15" font-weight="600">Agent runtime (Claude Code · Cursor · Codex · …)</text>
+    <text x="480" y="176" text-anchor="middle" fill="#22d3ee" font-size="22">↓</text>
+    <rect x="60" y="188" width="400" height="40" rx="10" fill="#07151a" stroke="#22d3ee" stroke-width="2"/>
+    <text x="260" y="214" text-anchor="middle" fill="#22d3ee" font-size="15" font-weight="800">ThumbGate pre-action gate</text>
+    <text x="490" y="214" text-anchor="middle" fill="#4ade80" font-size="20">→</text>
+    <rect x="520" y="188" width="380" height="40" rx="10" fill="#161618" stroke="#333"/>
+    <text x="710" y="214" text-anchor="middle" fill="#e5e7eb" font-size="15" font-weight="600">shell · git · db · MCP tools</text>
+  </g>
+</svg>