thumbgate 1.29.2 → 1.30.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.29.2",
+  "version": "1.30.0",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.29.2",
+  "version": "1.30.0",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate.ai",
   "transport": "stdio",

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.29.2", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.30.0", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.29.2", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.30.0", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/forge/forge.yaml

@@ -9,12 +9,12 @@ version: "1"
 skills:
   thumbgate-gate-check:
     description: "ThumbGate PreToolUse gate — blocks known-bad tool calls"
-    command: "npx --yes --package thumbgate@1.29.2 thumbgate gate-check"
+    command: "npx --yes --package thumbgate@1.30.0 thumbgate gate-check"
     trigger: pre_tool_use
 
   thumbgate-feedback:
     description: "ThumbGate feedback capture — logs user prompt context"
-    command: "npx --yes --package thumbgate@1.29.2 thumbgate hook-auto-capture"
+    command: "npx --yes --package thumbgate@1.30.0 thumbgate hook-auto-capture"
     trigger: user_prompt
 
 mcp:
@@ -23,6 +23,6 @@ mcp:
     args:
       - "--yes"
       - "--package"
-      - "thumbgate@1.29.2"
+      - "thumbgate@1.30.0"
       - "thumbgate"
       - "serve"

package/adapters/mcp/server-stdio.js

@@ -96,6 +96,7 @@ const {
   requestEscalation,
 } = require('../../scripts/human-escalation');
 const { recordReasoningTrace } = require('../../scripts/agent-reasoning-traces');
+const { recordToolCall } = require('../../scripts/tool-kpi-tracker');
 const {
   evaluateOperationalIntegrity,
 } = require('../../scripts/operational-integrity');
@@ -316,7 +317,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.29.2' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.30.0' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',
@@ -379,6 +380,9 @@ function toTextResult(payload) {
   const text = typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2);
   return {
     content: [{ type: 'text', text }],
+    ...(payload !== null && typeof payload === 'object'
+      ? { structuredContent: payload }
+      : {}),
   };
 }
 
@@ -416,7 +420,7 @@ function toCaptureFeedbackTextResult(result) {
   if (reminder) {
     blocks.push({ type: 'text', text: reminder });
   }
-  return { content: blocks };
+  return { content: blocks, structuredContent: result };
 }
 
 function formatContextPack(pack) {
@@ -758,10 +762,27 @@ function buildEstimateUncertaintyResponse(args = {}) {
 }
 
 async function callTool(name, args = {}) {
+  const attemptStartMs = Date.now();
   const activeProfile = getActiveMcpProfile();
-  assertToolAllowed(name, activeProfile);
+  try {
+    assertToolAllowed(name, activeProfile);
+  } catch (error) {
+    recordMcpToolTrace(name, args, {
+      success: false,
+      category: 'profile_denied',
+      evidence: [error.message],
+      latencyMs: Date.now() - attemptStartMs,
+    });
+    throw error;
+  }
   const capability = getToolCapability(name);
   if (!capability.available) {
+    recordMcpToolTrace(name, args, {
+      success: false,
+      category: 'capability',
+      evidence: capability.missingModules,
+      latencyMs: Date.now() - attemptStartMs,
+    });
     if (capability.availability === 'private_core') {
       return unavailablePrivateMcpFeature(name);
     }
@@ -788,6 +809,7 @@ async function callTool(name, args = {}) {
         success: false,
         category: 'contract',
         evidence: validation.errors,
+        latencyMs: Date.now() - attemptStartMs,
       });
       throw err;
     }
@@ -803,6 +825,7 @@ async function callTool(name, args = {}) {
         success: false,
         category: 'permission',
         evidence: [firewallResult.message],
+        latencyMs: Date.now() - attemptStartMs,
       });
       throw err;
     }
@@ -816,11 +839,24 @@ async function callTool(name, args = {}) {
       success: false,
       category: err.errorCategory || 'execution',
       evidence: [err.code || err.message || 'tool execution failed'],
-      latencyMs: Date.now() - startMs,
+      latencyMs: Date.now() - attemptStartMs,
     });
     throw err;
   }
   const latencyMs = Date.now() - startMs;
+  const outputValidation = validateMcpToolOutput(toolDef, result);
+  if (!outputValidation.valid) {
+    const err = new Error(`Structured output contract violation on '${name}': ${outputValidation.errors.join('; ')}`);
+    err.errorCategory = 'output_contract';
+    err.isRetryable = false;
+    recordMcpToolTrace(name, args, {
+      success: false,
+      category: 'output_contract',
+      evidence: outputValidation.errors,
+      latencyMs,
+    });
+    throw err;
+  }
   recordMcpToolTrace(name, args, {
     success: true,
     category: 'success',
@@ -840,7 +876,31 @@ async function callTool(name, args = {}) {
   return result;
 }
 
+function validateMcpToolOutput(toolDef, result) {
+  if (!toolDef || !toolDef.outputSchema) return { valid: true, errors: [] };
+  const { validateStructuredOutput } = require('../../scripts/tool-contract-validator');
+  if (!result || result.structuredContent === undefined) {
+    return { valid: false, errors: ['Tool response is missing structuredContent'] };
+  }
+  return validateStructuredOutput(result.structuredContent, toolDef.outputSchema);
+}
+
 function recordMcpToolTrace(name, args, outcome = {}) {
+  try {
+    recordToolCall({
+      toolName: name,
+      serverName: 'mcp',
+      latencyMs: Number(outcome.latencyMs || 0),
+      success: outcome.success === true,
+      agentId: args.agentId || args.processId || args.taskId || 'unknown',
+      metadata: {
+        category: outcome.category || 'unknown',
+        traceId: args.traceId || args.taskId || null,
+      },
+    });
+  } catch {
+    // KPI telemetry must not change the tool's functional outcome.
+  }
   try {
     const traceId = args.traceId || args.taskId || `mcp-${Date.now()}-${name}`;
     recordReasoningTrace({
@@ -888,10 +948,13 @@ async function callToolInner(name, args) {
       // action receipt (this action -> this outcome) before promotion. Returns
       // args unchanged when there is no matching receipt (non-breaking).
       const pairedFeedback = pairFeedbackWithReceipt(args);
-      return toCaptureFeedbackTextResult(captureFeedback(pairedFeedback));
+      return toCaptureFeedbackTextResult(captureFeedback({
+        ...pairedFeedback,
+        reviewOrigin: 'automated',
+      }));
     }
     case 'feedback_summary':
-      return toTextResult(feedbackSummary(Number(args.recent || 20)));
+      return toTextResult(feedbackSummary(Number(args.recent || 20), { humanOnly: true }));
     case 'search_lessons': {
       const module = loadPrivateMcpModule('lessonSearch');
       if (!module) return unavailablePrivateMcpFeature('search_lessons');
@@ -899,6 +962,9 @@ async function callToolInner(name, args) {
         limit: Number(args.limit || 10),
         category: args.category,
         tags: Array.isArray(args.tags) ? args.tags : [],
+        scope: args.scope,
+        requireScope: args.requireScope === true,
+        includeShared: args.includeShared !== false,
       }));
     }
     case 'suggest_fix':
@@ -918,6 +984,9 @@ async function callToolInner(name, args) {
         {
           candidateCount: 20,
           maxResults: Number(args.maxResults || 5),
+          scope: args.scope,
+          requireScope: args.requireScope === true,
+          includeShared: args.includeShared !== false,
         },
       ));
     }
@@ -970,7 +1039,7 @@ async function callToolInner(name, args) {
       return toTextResult(document);
     }
     case 'feedback_stats':
-      return toTextResult(analyzeFeedback());
+      return toTextResult(analyzeFeedback(undefined, { humanOnly: true }));
     case 'diagnose_failure':
       return buildDiagnoseFailureResponse(args);
     case 'reflect_on_feedback':
@@ -1148,6 +1217,7 @@ async function callToolInner(name, args) {
           workflowContract: args.workflowContract,
           repoPath: args.repoPath,
           localOnly: args.localOnly === true,
+          ttlMs: args.ttlMs,
           clear: args.clear === true,
         }),
       });
@@ -1744,5 +1814,6 @@ module.exports = {
     listAvailableTools,
     unavailablePrivateMcpFeature,
     callToolInner,
+    validateMcpToolOutput,
   },
 };

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.29.2",
+        "thumbgate@1.30.0",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -1185,7 +1185,7 @@ function capture() {
   }
 
   if (args.summary) {
-    console.log(feedbackSummary(Number(args.recent || 20)));
+    console.log(feedbackSummary(Number(args.recent || 20), { humanOnly: true }));
     return;
   }
 
@@ -1271,6 +1271,7 @@ function capture() {
     whatWorked: args['what-worked'],
     tags: args.tags,
     gateAction: gateAction || undefined,
+    reviewOrigin: 'human',
   });
 
   if (result.accepted) {
@@ -1386,6 +1387,7 @@ function feedbackSelfTest() {
         ? (args['what-worked'] || 'Feedback capture persisted and was verified by a self-test')
         : undefined,
       tags: args.tags || 'self-test,dogfood,feedback-capture',
+      reviewOrigin: 'automated',
     });
 
     const paths = getFeedbackPaths();
@@ -1444,7 +1446,7 @@ function stats() {
   trackEvent('cli_stats', { command: 'stats' });
   const args = parseArgs(process.argv.slice(3));
   const { analyzeFeedback } = require(path.join(PKG_ROOT, 'scripts', 'feedback-loop'));
-  const data = analyzeFeedback();
+  const data = analyzeFeedback(undefined, { humanOnly: true });
 
   // Gate enforcement stats — runtime intercepts + configured gates
   let gateData = { blocked: 0, warned: 0, passed: 0, byGate: {} };
@@ -1761,7 +1763,7 @@ function summary() {
   const args = parseArgs(process.argv.slice(3));
   const { feedbackSummary, analyzeFeedback } = require(path.join(PKG_ROOT, 'scripts', 'feedback-loop'));
   if (args.json) {
-    const data = analyzeFeedback();
+    const data = analyzeFeedback(undefined, { humanOnly: true });
     console.log(JSON.stringify({
       total: data.total,
       positives: data.totalPositive,
@@ -1771,7 +1773,7 @@ function summary() {
     }, null, 2));
     return;
   }
-  console.log(feedbackSummary(Number(args.recent || 20)));
+  console.log(feedbackSummary(Number(args.recent || 20), { humanOnly: true }));
 }
 
 function lessons() {
@@ -2861,7 +2863,7 @@ function sessionStart() {
   } catch (_) { /* best-effort fallback sync */ }
   const { analyzeFeedback } = require(path.join(PKG_ROOT, 'scripts', 'feedback-loop'));
   const { refreshStatuslineCache } = require(path.join(PKG_ROOT, 'scripts', 'hook-thumbgate-cache-updater'));
-  refreshStatuslineCache(analyzeFeedback());
+  refreshStatuslineCache(analyzeFeedback(undefined, { humanOnly: true }));
 
   // Build a top-level <system-reminder> block that Claude Code's SessionStart
   // hook surfaces to the agent as first-class context — not buried stderr.

package/config/mcp-allowlists.json

@@ -46,6 +46,11 @@
       "detect_noop",
       "record_action_receipt",
       "get_action_receipts",
+      "record_task_outcome",
+      "get_task_outcomes",
+      "get_agent_outcome_metrics",
+      "request_human_escalation",
+      "list_human_escalations",
       "verify_claim",
       "check_operational_integrity",
       "workflow_sentinel",
@@ -73,6 +78,7 @@
       "run_self_distill",
       "self_distill_status",
       "context_stuff_lessons",
+      "parallel_workflow",
       "perplexity_search",
       "perplexity_ask",
       "perplexity_research",
@@ -105,6 +111,11 @@
       "get_branch_governance",
       "approve_protected_action",
       "track_action",
+      "record_task_outcome",
+      "get_task_outcomes",
+      "get_agent_outcome_metrics",
+      "request_human_escalation",
+      "list_human_escalations",
       "verify_claim",
       "check_operational_integrity",
       "workflow_sentinel",
@@ -115,6 +126,7 @@
       "require_evidence_for_claim",
       "session_report",
       "generate_operator_artifact",
+      "parallel_workflow",
       "suggest_fix"
     ],
     "commerce": [
@@ -129,6 +141,11 @@
       "get_branch_governance",
       "approve_protected_action",
       "track_action",
+      "record_task_outcome",
+      "get_task_outcomes",
+      "get_agent_outcome_metrics",
+      "request_human_escalation",
+      "list_human_escalations",
       "verify_claim",
       "check_operational_integrity",
       "workflow_sentinel",
@@ -156,11 +173,12 @@
       "list_harnesses",
       "list_intents",
       "plan_intent",
-      "start_handoff",
-      "complete_handoff",
       "context_provenance",
       "get_scope_state",
       "get_branch_governance",
+      "get_task_outcomes",
+      "get_agent_outcome_metrics",
+      "list_human_escalations",
       "verify_claim",
       "check_operational_integrity",
       "workflow_sentinel",
@@ -202,6 +220,9 @@
       "context_provenance",
       "get_scope_state",
       "get_branch_governance",
+      "get_task_outcomes",
+      "get_agent_outcome_metrics",
+      "list_human_escalations",
       "verify_claim",
       "check_operational_integrity",
       "workflow_sentinel",
@@ -237,6 +258,9 @@
       "list_harnesses",
       "get_scope_state",
       "get_branch_governance",
+      "get_task_outcomes",
+      "get_agent_outcome_metrics",
+      "list_human_escalations",
       "verify_claim",
       "check_operational_integrity",
       "workflow_sentinel",

package/config/post-deploy-marketing-pages.json

@@ -5,7 +5,7 @@
     {
       "route": "/",
       "sentinel": "Stop AI agent mistakes before they cost you",
-      "description": "Home page hero (lifeblood — never regress)"
+      "description": "Home page hero (lifeblood \u2014 never regress)"
     },
     {
       "route": "/pro",
@@ -75,6 +75,31 @@
       "route": "/leash-beta",
       "sentinel": "Stop Runaway AI Agents From Freezing Your Machine",
       "description": "Hermes Mobile founding beta / Leash Pro pricing landing"
+    },
+    {
+      "route": "/whitepaper",
+      "sentinel": "How we know ThumbGate works",
+      "description": "Evaluation white paper"
+    },
+    {
+      "route": "/architecture",
+      "sentinel": "Architecture diagrams",
+      "description": "Public diagram gallery"
+    },
+    {
+      "route": "/eval-scorecard",
+      "sentinel": "Eval scorecard",
+      "description": "ThumbGate Bench scorecard"
+    },
+    {
+      "route": "/evaluations",
+      "sentinel": "How We Evaluate",
+      "description": "ML evaluation methodology page"
+    },
+    {
+      "route": "/case-studies",
+      "sentinel": "Case studies",
+      "description": "Dogfood case studies proof page"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.29.2",
+  "version": "1.30.0",
   "description": "ThumbGate Pre-Action Checks self-improve from ranked lessons and repeated failures, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -200,6 +200,7 @@
     "scripts/revenue-action-eligibility.js",
     "scripts/revenue-evidence-remediation.js",
     "scripts/reward-hacking-guardrails.js",
+    "scripts/model-eval.js",
     "scripts/risk-scorer.js",
     "scripts/rlaif-self-audit.js",
     "scripts/rubric-engine.js",
@@ -249,6 +250,7 @@
     "scripts/tool-contract-validator.js",
     "scripts/tool-registry.js",
     "scripts/task-outcomes.js",
+    "scripts/tool-kpi-tracker.js",
     "scripts/upstream-contribution-engine.js",
     "scripts/user-profile.js",
     "scripts/validate-workflow-contract.js",
@@ -313,6 +315,13 @@
     "public/learn.html",
     "public/lessons.html",
     "public/numbers.html",
+    "public/assets/diagrams/",
+    "public/whitepaper.html",
+    "public/evaluations.html",
+    "public/eval-scorecard.html",
+    "public/eval-scorecard.json",
+    "public/case-studies.html",
+    "public/architecture.html",
     "public/partner-intake.html",
     "public/pricing.html",
     "public/pro.html",
@@ -324,7 +333,10 @@
     "public/brand/",
     "public/js/",
     "skills/thumbgate/SKILL.md",
-    "src/"
+    "src/",
+    "scripts/generate-eval-scorecard.js",
+    "scripts/refresh-proof-pack.js",
+    "scripts/generate-case-study-outreach.js"
   ],
   "scripts": {
     "canary:snapshot": "node scripts/gate-decision-canary.js --snapshot",
@@ -427,7 +439,7 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:canary && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:verification-evidence && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:proof-pack-cadence && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:canary && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:verification-evidence && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation && npm run test:retrieval-window && npm run test:risk-quality && npm run test:eval-mining && npm run test:state-backup && npm run test:eval-golden && npm run test:task-scope-lease",
     "test:python": "python3 -m pytest tests/*.py",
     "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
@@ -566,7 +578,7 @@
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
     "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js tests/packed-feedback-retrieval-e2e.test.js tests/packed-provider-payment-reconciler-e2e.test.js tests/packed-revenue-remediation-e2e.test.js",
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js",
-    "test:workflow": "node --test tests/parallel-workflow.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/workflow-intake-queue.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js tests/revenue-action-eligibility.test.js tests/revenue-evidence-remediation.test.js tests/gtm-revenue-action-eligibility.test.js tests/revenue-offer-ladder.test.js tests/revenue-offer-system.test.js tests/buyer-paths.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js",
+    "test:workflow": "node --test tests/parallel-workflow.test.js tests/parallel-workflow-public.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/workflow-intake-queue.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js tests/revenue-action-eligibility.test.js tests/revenue-evidence-remediation.test.js tests/gtm-revenue-action-eligibility.test.js tests/revenue-offer-ladder.test.js tests/revenue-offer-system.test.js tests/buyer-paths.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js && node --test tests/eval-proof-pack-pages.test.js && npm run test:proof-pack-cadence",
     "test:revenue-evidence-remediation": "node --test tests/revenue-evidence-remediation.test.js",
     "test:grafana-revenue-evidence": "node --test tests/grafana-revenue-evidence.test.js",
     "test:sales-pipeline": "node --test tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js",
@@ -655,7 +667,7 @@
     "test:control-tower": "node --test tests/control-tower.test.js",
     "test:pii-scanner": "node --test tests/pii-scanner.test.js",
     "test:data-governance": "node --test tests/data-governance.test.js",
-    "test:lesson-inference": "node --test tests/conversation-context.test.js tests/lesson-inference.test.js tests/lesson-prompt-shape.test.js",
+    "test:lesson-inference": "node --test tests/conversation-context.test.js tests/lesson-inference.test.js tests/lesson-prompt-shape.test.js tests/lesson-stats-review-origin.test.js",
     "test:lesson-retrieval": "node --test tests/lesson-retrieval.test.js",
     "test:lesson-semantic-retrieval": "node --test tests/lesson-semantic-retrieval.test.js",
     "test:cross-encoder": "node --test tests/cross-encoder-reranker.test.js",
@@ -696,6 +708,7 @@
     "social:publish:latest-release-article": "node scripts/social-analytics/publish-latest-release-article.js",
     "social:publish:latest-release-fallbacks": "node scripts/social-analytics/publish-latest-release-fallbacks.js",
     "social:verify:latest-release": "node scripts/social-analytics/verify-latest-release-posts.js",
+    "social:verify:marketing-agent": "node scripts/social-analytics/verify-marketing-agent-campaign.js",
     "social:schedule:campaign": "node scripts/social-analytics/schedule-thumbgate-campaign.js",
     "social:install:growth": "node scripts/social-analytics/install-growth-automation.js",
     "social:reconcile:campaign": "node scripts/social-analytics/reconcile-thumbgate-campaign.js",
@@ -838,7 +851,25 @@
     "observability:setup": "node scripts/observability-setup.js",
     "observability:doctor": "node scripts/revenue-observability-doctor.js",
     "test:jsonl-window": "node --test tests/jsonl-window.test.js",
-    "test:observability-env": "node --test tests/observability-env.test.js"
+    "test:observability-env": "node --test tests/observability-env.test.js",
+    "test:retrieval-window": "node --test tests/lesson-retrieval-recency-window.test.js",
+    "eval:risk": "node scripts/eval-risk-model.js",
+    "test:risk-quality": "node --test tests/risk-model-quality.test.js tests/model-eval.test.js",
+    "state:backup": "node scripts/state-backup.js",
+    "state:backup:verify": "node scripts/state-backup.js --verify",
+    "state:restore": "node scripts/state-backup.js --restore",
+    "test:state-backup": "node --test tests/state-backup.test.js",
+    "eval:mine": "node scripts/mine-eval-set.js",
+    "eval:baseline": "node scripts/eval-baseline.js",
+    "test:eval-golden": "node --test tests/gate-golden-set.test.js",
+    "test:eval-mining": "node --test tests/mine-eval-set.test.js tests/eval-baseline.test.js",
+    "test:task-scope-lease": "node --test tests/task-scope-lease.test.js",
+    "eval-scorecard:generate": "node scripts/generate-eval-scorecard.js",
+    "proof-pack:refresh": "node scripts/refresh-proof-pack.js --write",
+    "proof-pack:refresh:check": "node scripts/refresh-proof-pack.js --check",
+    "proof-pack:schedule": "node scripts/schedule-manager.js install --label proof-pack-scorecard --spec 'daily 06:15' --command 'npm run proof-pack:refresh' --workingDirectory .",
+    "outreach:case-study": "node scripts/generate-case-study-outreach.js",
+    "test:proof-pack-cadence": "node --test tests/refresh-proof-pack.test.js tests/case-study-outreach.test.js"
   },
   "keywords": [
     "mcp",
@@ -922,7 +953,7 @@
     "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
     "@playwright/test": "^1.60.0",
-    "c8": "^11.0.0",
+    "c8": "^12.0.0",
     "undici": "^8.5.0"
   },
   "hotfix": "gate-check-bypass-2026-06-03"