npm - thumbgate - Versions diffs - 1.29.2 → 1.30.0 - Mend

thumbgate 1.29.2 → 1.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (55) hide show

package/.claude-plugin/plugin.json +1 -1
package/.well-known/mcp/server-card.json +1 -1
package/adapters/claude/.mcp.json +2 -2
package/adapters/forge/forge.yaml +3 -3
package/adapters/mcp/server-stdio.js +78 -7
package/adapters/opencode/opencode.json +1 -1
package/bin/cli.js +7 -5
package/config/mcp-allowlists.json +26 -2
package/config/post-deploy-marketing-pages.json +26 -1
package/package.json +38 -7
package/public/architecture.html +130 -0
package/public/assets/diagrams/agent-integration.png +0 -0
package/public/assets/diagrams/before-after.svg +21 -0
package/public/assets/diagrams/decision.svg +36 -0
package/public/assets/diagrams/feedback-pipeline.png +0 -0
package/public/assets/diagrams/loop.svg +34 -0
package/public/assets/diagrams/plugin-topology.png +0 -0
package/public/assets/diagrams/pre-action-gate-loop.svg +59 -0
package/public/assets/diagrams/stack.svg +18 -0
package/public/assets/diagrams/thumbgate-architecture.png +0 -0
package/public/case-studies.html +151 -0
package/public/eval-scorecard.html +195 -0
package/public/eval-scorecard.json +18 -0
package/public/evaluations.html +168 -0
package/public/index.html +4 -3
package/public/numbers.html +2 -2
package/public/whitepaper.html +189 -0
package/scripts/activation-quickstart.js +1 -0
package/scripts/agent-outcome-monitor.js +71 -1
package/scripts/billing.js +3 -1
package/scripts/claude-feedback-sync.js +3 -2
package/scripts/cli-feedback.js +13 -7
package/scripts/cross-encoder-reranker.js +3 -0
package/scripts/feedback-aggregate.js +5 -2
package/scripts/feedback-loop.js +244 -182
package/scripts/gates-engine.js +81 -4
package/scripts/generate-case-study-outreach.js +253 -0
package/scripts/generate-eval-scorecard.js +276 -0
package/scripts/growth-campaigns.js +183 -0
package/scripts/jsonl-watcher.js +1 -0
package/scripts/lesson-inference.js +23 -4
package/scripts/lesson-retrieval.js +71 -4
package/scripts/lesson-search.js +26 -3
package/scripts/mcp-config.js +26 -5
package/scripts/mcp-oauth.js +37 -2
package/scripts/model-eval.js +308 -0
package/scripts/parallel-workflow-orchestrator.js +86 -22
package/scripts/published-cli.js +11 -1
package/scripts/refresh-proof-pack.js +261 -0
package/scripts/risk-scorer.js +144 -15
package/scripts/statusline-local-stats.js +1 -1
package/scripts/thumbgate-bench.js +13 -0
package/scripts/tool-kpi-tracker.js +124 -0
package/scripts/tool-registry.js +49 -1
package/src/api/server.js +230 -86

package/public/architecture.html ADDED Viewed

@@ -0,0 +1,130 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="generator" content="ThumbGate">
+<meta name="author" content="Igor Ganapolsky">
+<title>ThumbGate Architecture Diagrams — Pre-Action Gate Loop</title>
+<meta name="description" content="Architecture diagrams for ThumbGate: system map, feedback pipeline, agent integration, and pre-action gate loop. The same visuals used in the open-source README, published on thumbgate.ai.">
+<meta property="og:title" content="ThumbGate Architecture Diagrams">
+<meta property="og:description" content="System architecture, feedback pipeline, agent integration, and pre-action gate loop — the visual proof pack for buyers and reviewers.">
+<meta property="og:type" content="article">
+<meta property="og:url" content="https://thumbgate.ai/architecture">
+<link rel="canonical" href="https://thumbgate.ai/architecture">
+<link rel="icon" type="image/png" href="/thumbgate-icon.png">
+<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "ThumbGate Architecture Diagrams",
+  "description": "System architecture, feedback pipeline, agent integration, and pre-action gate loop diagrams for the ThumbGate Reliability Gateway.",
+  "url": "https://thumbgate.ai/architecture",
+  "dateModified": "2026-07-29",
+  "author": { "@type": "Person", "name": "Igor Ganapolsky", "url": "https://github.com/IgorGanapolsky" }
+}
+</script>
+<style>
+  :root {
+    --bg:#0b0f14; --panel:#111823; --border:#1e2a3a; --text:#e6edf3;
+    --muted:#8b98a5; --cyan:#39c5cf;
+  }
+  * { margin:0; padding:0; box-sizing:border-box; }
+  body { background:var(--bg); color:var(--text); font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; line-height:1.65; }
+  nav { padding:1rem 2rem; border-bottom:1px solid var(--border); display:flex; gap:1.25rem; flex-wrap:wrap; align-items:center; }
+  nav a { color:var(--muted); text-decoration:none; font-size:0.9rem; }
+  nav a:hover { color:var(--cyan); }
+  nav .brand { color:var(--text); font-weight:700; }
+  .container { max-width:980px; margin:0 auto; padding:2.5rem 1.5rem 4rem; }
+  h1 { font-size:2rem; margin-bottom:0.4rem; }
+  h2 { font-size:1.3rem; margin:2.4rem 0 0.75rem; color:var(--cyan); }
+  .subtitle { color:var(--muted); font-size:1.05rem; margin-bottom:1.5rem; }
+  figure { background:var(--panel); border:1px solid var(--border); border-radius:12px; padding:1rem; margin:1rem 0 1.75rem; }
+  figure img { width:100%; height:auto; display:block; border-radius:8px; background:#050816; }
+  figcaption { color:var(--muted); font-size:0.9rem; margin-top:0.75rem; }
+  .grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:1rem; margin:1.25rem 0; }
+  .card { background:var(--panel); border:1px solid var(--border); border-radius:10px; padding:1rem 1.1rem; }
+  .card h3 { font-size:1rem; margin-bottom:0.35rem; }
+  .card p { color:var(--muted); font-size:0.92rem; }
+  a.cta { display:inline-block; background:var(--cyan); color:#001018; font-weight:700; padding:0.7rem 1rem; border-radius:8px; text-decoration:none; margin:0.5rem 0.75rem 0.5rem 0; }
+  a.secondary { color:var(--cyan); }
+  .footer-note { color:var(--muted); font-size:0.85rem; margin-top:2.5rem; text-align:center; }
+  .footer-note a { color:var(--cyan); text-decoration:none; }
+</style>
+</head>
+<body>
+<nav>
+  <a class="brand" href="/">ThumbGate</a>
+  <a href="/whitepaper">White paper</a>
+  <a href="/architecture">Architecture</a>
+  <a href="/eval-scorecard">Scorecard</a>
+  <a href="/evaluations">Evaluations</a>
+  <a href="/case-studies">Case studies</a>
+  <a href="/numbers">Numbers</a>
+  <a href="/pricing">Pricing</a>
+</nav>
+<main class="container">
+  <h1>Architecture diagrams</h1>
+  <p class="subtitle">The same system diagrams that ship in the open-source README, published here so buyers and reviewers do not need GitHub to see how PreToolUse enforcement, feedback, and promotion fit together.</p>
+  <div class="grid">
+    <div class="card">
+      <h3>Local-first enforcement</h3>
+      <p>No LLM on the block/allow path. Deterministic rules first; local semantic recall only when needed.</p>
+    </div>
+    <div class="card">
+      <h3>Feedback → rules</h3>
+      <p>Thumbs-down becomes a reviewable lesson, then a prevention rule that fires before the next tool call.</p>
+    </div>
+    <div class="card">
+      <h3>Multi-agent surface</h3>
+      <p>One gate layer across Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, and MCP.</p>
+    </div>
+  </div>
+  <h2>System architecture</h2>
+  <figure>
+    <img src="/assets/diagrams/thumbgate-architecture.png" alt="ThumbGate architecture: agent layer, hooks, MCP tools, gate engine, governance, security, feedback memory, and orchestration" width="1200" height="800" loading="eager">
+    <figcaption>Agents → hooks → MCP tools → gate engine (match / verdict / reasoning / stats), with governance, secret scanning, feedback promotion, and orchestration around the decision path.</figcaption>
+  </figure>
+  <h2>Feedback pipeline (session 1 → session 2)</h2>
+  <figure>
+    <img src="/assets/diagrams/feedback-pipeline.png" alt="Sequence diagram: agent mistake, thumbs-down capture, rule promotion, next session blocked" width="1200" height="700" loading="lazy">
+    <figcaption>Session 1 captures a thumbs-down; the lesson is promoted; session 2 blocks the repeat before execution.</figcaption>
+  </figure>
+  <h2>Pre-action gate loop</h2>
+  <figure>
+    <img src="/assets/diagrams/pre-action-gate-loop.svg" alt="Pre-action gate loop: capture, remember, rank, gate" width="900" height="400" loading="lazy">
+    <figcaption>Capture feedback → remember locally → rank and promote → gate the next tool call.</figcaption>
+  </figure>
+  <h2>Agent integration</h2>
+  <figure>
+    <img src="/assets/diagrams/agent-integration.png" alt="ThumbGate agent integration map across coding agents and MCP" width="1200" height="700" loading="lazy">
+    <figcaption>How ThumbGate attaches to coding agents and MCP tool surfaces without putting a remote model on the enforcement path.</figcaption>
+  </figure>
+  <h2>Plugin topology</h2>
+  <figure>
+    <img src="/assets/diagrams/plugin-topology.png" alt="ThumbGate plugin topology across IDE and CLI surfaces" width="1200" height="700" loading="lazy">
+    <figcaption>Where plugins and marketplace packages sit relative to the local gate runtime.</figcaption>
+  </figure>
+  <h2>Related proof surfaces</h2>
+  <p>
+    <a class="cta" href="/whitepaper">How we know it works</a>
+    <a class="cta" href="/eval-scorecard">Eval scorecard</a>
+    <a class="secondary" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/diagrams/thumbgate_architecture.mmd">Mermaid sources on GitHub →</a>
+  </p>
+  <p class="footer-note">
+    Source diagrams live in <code>docs/diagrams/</code> and are mirrored here for production serving.
+    Also see <a href="/evaluations">ML evaluations</a> and
+    <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md">verification evidence</a>.
+  </p>
+</main>
+</body>
+</html>

package/public/assets/diagrams/agent-integration.png ADDED Viewed

Binary file

package/public/assets/diagrams/before-after.svg ADDED Viewed

@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 280" role="img" aria-labelledby="t d">
+  <title id="t">Before and after ThumbGate</title>
+  <desc id="d">Without ThumbGate the same mistake repeats. With ThumbGate the second attempt is caught.</desc>
+  <rect width="960" height="280" fill="#0a0a0b"/>
+  <g font-family="system-ui,sans-serif">
+    <!-- WITHOUT -->
+    <rect x="40" y="36" width="400" height="208" rx="20" fill="#1a1012" stroke="#f87171" stroke-width="2"/>
+    <text x="240" y="72" text-anchor="middle" fill="#f87171" font-size="18" font-weight="900">WITHOUT</text>
+    <text x="240" y="118" text-anchor="middle" fill="#f5f5f7" font-size="20" font-weight="700">🔥 force-push / bad shell</text>
+    <text x="240" y="152" text-anchor="middle" fill="#e5e7eb" font-size="16">You clean it up…</text>
+    <text x="240" y="182" text-anchor="middle" fill="#e5e7eb" font-size="16">…and it happens again.</text>
+    <text x="240" y="218" text-anchor="middle" fill="#9ca3af" font-size="14">time × trust × risk</text>
+    <!-- WITH -->
+    <rect x="520" y="36" width="400" height="208" rx="20" fill="#0c1a14" stroke="#4ade80" stroke-width="2"/>
+    <text x="720" y="72" text-anchor="middle" fill="#4ade80" font-size="18" font-weight="900">WITH THUMBGATE</text>
+    <text x="720" y="118" text-anchor="middle" fill="#f5f5f7" font-size="20" font-weight="700">👎 once</text>
+    <text x="720" y="152" text-anchor="middle" fill="#e5e7eb" font-size="16">Rule saved locally</text>
+    <text x="720" y="182" text-anchor="middle" fill="#e5e7eb" font-size="16">Next attempt is checked</text>
+    <text x="720" y="218" text-anchor="middle" fill="#9ca3af" font-size="14">one correction → permanent gate</text>
+  </g>
+</svg>

package/public/assets/diagrams/decision.svg ADDED Viewed

@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 300" role="img" aria-labelledby="t d">
+  <title id="t">Which ThumbGate path to pick</title>
+  <desc id="d">Free try, Pro solo, $499 diagnostic, sprint after intake.</desc>
+  <rect width="960" height="300" fill="#0a0a0b"/>
+  <g font-family="system-ui,sans-serif">
+    <text x="480" y="36" text-anchor="middle" fill="#f5f5f7" font-size="17" font-weight="800">Pick the path that matches the pain</text>
+    <!-- Free -->
+    <rect x="28" y="58" width="210" height="210" rx="16" fill="#161618" stroke="#333"/>
+    <text x="133" y="95" text-anchor="middle" fill="#9ca3af" font-size="12" font-weight="700">SOLO TRY</text>
+    <text x="133" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">Free</text>
+    <text x="133" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">npx thumbgate init</text>
+    <text x="133" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Catch one repeat</text>
+    <text x="133" y="230" text-anchor="middle" fill="#4ade80" font-size="12" font-weight="700">prove it works</text>
+    <!-- Pro -->
+    <rect x="258" y="58" width="210" height="210" rx="16" fill="#07151a" stroke="#22d3ee" stroke-width="2"/>
+    <text x="363" y="95" text-anchor="middle" fill="#22d3ee" font-size="12" font-weight="700">SELF-SERVE</text>
+    <text x="363" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">Pro $19/mo</text>
+    <text x="363" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">Unlimited solo</text>
+    <text x="363" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Dashboard · exports</text>
+    <text x="363" y="230" text-anchor="middle" fill="#22d3ee" font-size="12" font-weight="700">checkout today</text>
+    <!-- Diagnostic $499 - HIGHLIGHT -->
+    <rect x="488" y="58" width="220" height="210" rx="16" fill="#0d1b14" stroke="#4ade80" stroke-width="2.5"/>
+    <text x="598" y="95" text-anchor="middle" fill="#4ade80" font-size="12" font-weight="700">ONE WORKFLOW · PAY TODAY</text>
+    <text x="598" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">$499</text>
+    <text x="598" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">Diagnostic</text>
+    <text x="598" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Map block / warn / review</text>
+    <text x="598" y="230" text-anchor="middle" fill="#4ade80" font-size="12" font-weight="700">not Enterprise</text>
+    <!-- Sprint -->
+    <rect x="728" y="58" width="204" height="210" rx="16" fill="#161618" stroke="#333"/>
+    <text x="830" y="95" text-anchor="middle" fill="#9ca3af" font-size="12" font-weight="700">IMPLEMENT</text>
+    <text x="830" y="130" text-anchor="middle" fill="#f5f5f7" font-size="22" font-weight="900">$1,500</text>
+    <text x="830" y="160" text-anchor="middle" fill="#9ca3af" font-size="13">Hardening Sprint</text>
+    <text x="830" y="190" text-anchor="middle" fill="#e5e7eb" font-size="13">Wire + prove gates</text>
+    <text x="830" y="230" text-anchor="middle" fill="#fbbf24" font-size="12" font-weight="700">after scope</text>
+  </g>
+</svg>

package/public/assets/diagrams/feedback-pipeline.png ADDED Viewed

Binary file

package/public/assets/diagrams/loop.svg ADDED Viewed

@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 280" role="img" aria-labelledby="t d">
+  <title id="t">ThumbGate feedback loop</title>
+  <desc id="d">Agent proposes a tool call, ThumbGate decides allow warn or deny, feedback becomes a rule.</desc>
+  <rect width="960" height="280" fill="#0a0a0b"/>
+  <defs>
+    <marker id="arr" markerWidth="10" markerHeight="10" refX="8" refY="4" orient="auto"><path d="M0,0 L8,4 L0,8 Z" fill="#22d3ee"/></marker>
+    <linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#22d3ee"/><stop offset="1" stop-color="#4ade80"/></linearGradient>
+  </defs>
+  <!-- Step 1 -->
+  <rect x="40" y="70" width="180" height="110" rx="18" fill="#161618" stroke="#333"/>
+  <circle cx="70" cy="100" r="16" fill="#222" stroke="#22d3ee" stroke-width="2"/>
+  <text x="70" y="105" text-anchor="middle" fill="#22d3ee" font-family="system-ui,sans-serif" font-size="14" font-weight="800">1</text>
+  <text x="130" y="120" text-anchor="middle" fill="#f5f5f7" font-family="system-ui,sans-serif" font-size="18" font-weight="800">Agent</text>
+  <text x="130" y="146" text-anchor="middle" fill="#9ca3af" font-family="system-ui,sans-serif" font-size="13">proposes a tool</text>
+  <line x1="230" y1="125" x2="290" y2="125" stroke="#22d3ee" stroke-width="3" marker-end="url(#arr)"/>
+  <!-- Step 2 -->
+  <rect x="300" y="50" width="240" height="150" rx="18" fill="#07151a" stroke="url(#g)" stroke-width="2.5"/>
+  <circle cx="340" cy="90" r="16" fill="#0d2530" stroke="#22d3ee" stroke-width="2"/>
+  <text x="340" y="95" text-anchor="middle" fill="#22d3ee" font-family="system-ui,sans-serif" font-size="14" font-weight="800">2</text>
+  <text x="420" y="95" text-anchor="middle" fill="#22d3ee" font-family="system-ui,sans-serif" font-size="20" font-weight="900">ThumbGate</text>
+  <text x="420" y="130" text-anchor="middle" fill="#f5f5f7" font-family="system-ui,sans-serif" font-size="16" font-weight="700">ALLOW · WARN · DENY</text>
+  <text x="420" y="158" text-anchor="middle" fill="#9ca3af" font-family="system-ui,sans-serif" font-size="13">before the tool runs</text>
+  <line x1="550" y1="125" x2="610" y2="125" stroke="#22d3ee" stroke-width="3" marker-end="url(#arr)"/>
+  <!-- Step 3 -->
+  <rect x="620" y="70" width="180" height="110" rx="18" fill="#161618" stroke="#333"/>
+  <circle cx="650" cy="100" r="16" fill="#222" stroke="#4ade80" stroke-width="2"/>
+  <text x="650" y="105" text-anchor="middle" fill="#4ade80" font-family="system-ui,sans-serif" font-size="14" font-weight="800">3</text>
+  <text x="710" y="120" text-anchor="middle" fill="#f5f5f7" font-family="system-ui,sans-serif" font-size="18" font-weight="800">Action</text>
+  <text x="710" y="146" text-anchor="middle" fill="#9ca3af" font-family="system-ui,sans-serif" font-size="13">shell · git · db</text>
+  <!-- Feedback loop -->
+  <path d="M710 185 C710 240 130 240 130 185" fill="none" stroke="#4ade80" stroke-width="3" stroke-dasharray="6 4" marker-end="url(#arr)"/>
+  <rect x="280" y="218" width="280" height="36" rx="18" fill="#0d1b14" stroke="#4ade80"/>
+  <text x="420" y="241" text-anchor="middle" fill="#4ade80" font-family="system-ui,sans-serif" font-size="14" font-weight="700">👍 👎 feedback → lesson → rule</text>
+</svg>

package/public/assets/diagrams/plugin-topology.png ADDED Viewed

Binary file

package/public/assets/diagrams/pre-action-gate-loop.svg ADDED Viewed

@@ -0,0 +1,59 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="520" viewBox="0 0 1200 520" role="img" aria-labelledby="title desc">
+  <title id="title">ThumbGate pre-action gate loop</title>
+  <desc id="desc">Diagram showing an AI agent proposing a tool call, ThumbGate checking it before execution, then either blocking repeated failures or allowing safe actions with an audit receipt.</desc>
+  <defs>
+    <linearGradient id="bg" x1="0" x2="1" y1="0" y2="1">
+      <stop offset="0%" stop-color="#081014"/>
+      <stop offset="100%" stop-color="#111113"/>
+    </linearGradient>
+    <linearGradient id="cyan" x1="0" x2="1" y1="0" y2="0">
+      <stop offset="0%" stop-color="#22d3ee"/>
+      <stop offset="100%" stop-color="#4ade80"/>
+    </linearGradient>
+    <filter id="shadow" x="-10%" y="-10%" width="120%" height="120%">
+      <feDropShadow dx="0" dy="16" stdDeviation="18" flood-color="#000000" flood-opacity="0.35"/>
+    </filter>
+    <marker id="arrow" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto">
+      <path d="M2,2 L10,6 L2,10 Z" fill="#22d3ee"/>
+    </marker>
+  </defs>
+  <rect width="1200" height="520" rx="28" fill="url(#bg)"/>
+  <text x="60" y="72" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="34" font-weight="800">ThumbGate checks agent intent before execution</text>
+  <text x="60" y="106" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="17">Feedback becomes rules. Rules become PreToolUse gates. Gates produce receipts before files, APIs, or production systems change.</text>
+  <g filter="url(#shadow)">
+    <rect x="60" y="170" width="235" height="145" rx="18" fill="#161618" stroke="#222225"/>
+    <text x="86" y="205" fill="#22d3ee" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">AGENT INTENT</text>
+    <text x="86" y="244" fill="#e8e8ec" font-family="SFMono-Regular,Consolas,monospace" font-size="18">git push --force</text>
+    <text x="86" y="272" fill="#e8e8ec" font-family="SFMono-Regular,Consolas,monospace" font-size="18">origin main</text>
+    <text x="86" y="296" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13">Still only proposed. Nothing has run.</text>
+    <rect x="390" y="160" width="270" height="165" rx="18" fill="#10181a" stroke="#22d3ee" stroke-opacity="0.52"/>
+    <text x="416" y="196" fill="#22d3ee" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">PRETOOLUSE GATE</text>
+    <text x="416" y="232" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="18" font-weight="700">Known repeated failure?</text>
+    <text x="416" y="262" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">Checks active rules, protected paths, approvals,</text>
+    <text x="416" y="284" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">secrets, evidence, and workflow scope.</text>
+    <rect x="755" y="120" width="245" height="135" rx="18" fill="#201113" stroke="#f87171" stroke-opacity="0.55"/>
+    <text x="781" y="154" fill="#f87171" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">BLOCK</text>
+    <text x="781" y="191" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="18" font-weight="700">Stop before damage</text>
+    <text x="781" y="220" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">Return the rule and safer next step.</text>
+    <rect x="755" y="305" width="245" height="135" rx="18" fill="#102017" stroke="#4ade80" stroke-opacity="0.55"/>
+    <text x="781" y="339" fill="#4ade80" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">ALLOW</text>
+    <text x="781" y="376" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="18" font-weight="700">Run and log receipt</text>
+    <text x="781" y="405" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="14">Safe actions keep moving with proof.</text>
+  </g>
+  <path d="M310 242 H370" stroke="#22d3ee" stroke-width="3" marker-end="url(#arrow)"/>
+  <path d="M670 230 C710 190 725 175 745 170" stroke="#f87171" stroke-width="3" fill="none" marker-end="url(#arrow)"/>
+  <path d="M670 270 C710 335 725 365 745 375" stroke="#4ade80" stroke-width="3" fill="none" marker-end="url(#arrow)"/>
+  <g>
+    <rect x="60" y="380" width="600" height="70" rx="16" fill="#0a0a0b" stroke="#222225"/>
+    <text x="86" y="412" fill="#8b8b96" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="13" font-weight="800" letter-spacing="1.4">FEEDBACK LOOP</text>
+    <text x="86" y="438" fill="#e8e8ec" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="16">Thumbs-down becomes a lesson, then a prevention rule shared across agents.</text>
+  </g>
+  <path d="M820 120 C760 70 240 72 196 165" stroke="url(#cyan)" stroke-width="3" fill="none" stroke-dasharray="8 8" marker-end="url(#arrow)"/>
+  <text x="900" y="486" fill="#22d3ee" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif" font-size="16" font-weight="800">npx thumbgate init</text>
+</svg>

package/public/assets/diagrams/stack.svg ADDED Viewed

@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 240" role="img" aria-labelledby="t d">
+  <title id="t">Where ThumbGate sits in the stack</title>
+  <desc id="d">Model to agent runtime to ThumbGate pre-action gate to tools.</desc>
+  <rect width="960" height="240" fill="#0a0a0b"/>
+  <g font-family="system-ui,sans-serif">
+    <rect x="60" y="36" width="840" height="40" rx="10" fill="#161618" stroke="#333"/>
+    <text x="480" y="62" text-anchor="middle" fill="#9ca3af" font-size="15" font-weight="600">Model (Claude · GPT · Gemini · local)</text>
+    <text x="480" y="100" text-anchor="middle" fill="#22d3ee" font-size="22">↓</text>
+    <rect x="60" y="112" width="840" height="40" rx="10" fill="#161618" stroke="#333"/>
+    <text x="480" y="138" text-anchor="middle" fill="#e5e7eb" font-size="15" font-weight="600">Agent runtime (Claude Code · Cursor · Codex · …)</text>
+    <text x="480" y="176" text-anchor="middle" fill="#22d3ee" font-size="22">↓</text>
+    <rect x="60" y="188" width="400" height="40" rx="10" fill="#07151a" stroke="#22d3ee" stroke-width="2"/>
+    <text x="260" y="214" text-anchor="middle" fill="#22d3ee" font-size="15" font-weight="800">ThumbGate pre-action gate</text>
+    <text x="490" y="214" text-anchor="middle" fill="#4ade80" font-size="20">→</text>
+    <rect x="520" y="188" width="380" height="40" rx="10" fill="#161618" stroke="#333"/>
+    <text x="710" y="214" text-anchor="middle" fill="#e5e7eb" font-size="15" font-weight="600">shell · git · db · MCP tools</text>
+  </g>
+</svg>

package/public/assets/diagrams/thumbgate-architecture.png ADDED Viewed

Binary file

package/public/case-studies.html ADDED Viewed

@@ -0,0 +1,151 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="generator" content="ThumbGate">
+<meta name="author" content="Igor Ganapolsky">
+<title>Case Studies — ThumbGate Dogfood Proof</title>
+<meta name="description" content="Real ThumbGate case studies from dogfood on this product: sudo evasion grid, fail-open hook recovery, catastrophic free-tier floor, and adversarial measurement. No fabricated logos.">
+<meta property="og:title" content="ThumbGate Case Studies">
+<meta property="og:description" content="Five reproducible dogfood narratives: 62 evasion holes closed, fail-open recovery, catastrophic safety floor, and adversarial grids.">
+<meta property="og:type" content="article">
+<meta property="og:url" content="https://thumbgate.ai/case-studies">
+<link rel="canonical" href="https://thumbgate.ai/case-studies">
+<link rel="icon" type="image/png" href="/thumbgate-icon.png">
+<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "CollectionPage",
+  "name": "ThumbGate Case Studies",
+  "description": "Reproducible dogfood case studies for ThumbGate pre-action checks. No fabricated customer logos.",
+  "url": "https://thumbgate.ai/case-studies",
+  "dateModified": "2026-07-29"
+}
+</script>
+<style>
+  :root {
+    --bg:#0b0f14; --panel:#111823; --border:#1e2a3a; --text:#e6edf3;
+    --muted:#8b98a5; --cyan:#39c5cf; --green:#3fb950; --amber:#d29922;
+  }
+  * { margin:0; padding:0; box-sizing:border-box; }
+  body { background:var(--bg); color:var(--text); font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; line-height:1.65; }
+  nav { padding:1rem 2rem; border-bottom:1px solid var(--border); display:flex; gap:1.25rem; flex-wrap:wrap; align-items:center; }
+  nav a { color:var(--muted); text-decoration:none; font-size:0.9rem; }
+  nav a:hover { color:var(--cyan); }
+  nav .brand { color:var(--text); font-weight:700; }
+  .container { max-width:900px; margin:0 auto; padding:2.5rem 1.5rem 4rem; }
+  h1 { font-size:2rem; margin-bottom:0.4rem; }
+  h2 { font-size:1.25rem; margin:0 0 0.35rem; }
+  .subtitle { color:var(--muted); font-size:1.05rem; margin-bottom:1.5rem; }
+  article { background:var(--panel); border:1px solid var(--border); border-radius:12px; padding:1.35rem 1.4rem; margin:1.1rem 0; }
+  .meta { color:var(--muted); font-size:0.85rem; margin-bottom:0.75rem; }
+  .metric { display:inline-block; background:#0d1420; border:1px solid var(--border); color:var(--cyan); padding:0.2rem 0.55rem; border-radius:6px; font-size:0.82rem; font-weight:600; margin:0 0.35rem 0.35rem 0; }
+  p { margin:0.55rem 0; }
+  pre { background:#0d1420; border:1px solid var(--border); border-radius:8px; padding:0.85rem 1rem; overflow-x:auto; font-size:0.84rem; margin:0.75rem 0; }
+  code { color:var(--cyan); }
+  a.inline { color:var(--cyan); }
+  a.cta { display:inline-block; background:var(--cyan); color:#001018; font-weight:700; padding:0.7rem 1rem; border-radius:8px; text-decoration:none; margin:0.5rem 0.6rem 0.5rem 0; }
+  .note { border-left:3px solid var(--amber); background:var(--panel); padding:0.7rem 1rem; margin:1.25rem 0; color:var(--muted); }
+  .footer-note { color:var(--muted); font-size:0.85rem; margin-top:2.5rem; text-align:center; }
+  .footer-note a { color:var(--cyan); text-decoration:none; }
+</style>
+</head>
+<body>
+<nav>
+  <a class="brand" href="/">ThumbGate</a>
+  <a href="/whitepaper">White paper</a>
+  <a href="/architecture">Architecture</a>
+  <a href="/eval-scorecard">Scorecard</a>
+  <a href="/evaluations">Evaluations</a>
+  <a href="/case-studies">Case studies</a>
+  <a href="/numbers">Numbers</a>
+  <a href="/pricing">Pricing</a>
+</nav>
+<main class="container">
+  <h1>Case studies</h1>
+  <p class="subtitle">Real work on this codebase. No fabricated logos, no aspirational customer counts — every technical claim is verifiable against the open repo or the commands recorded in the full write-up.</p>
+  <div class="note">
+    <strong>Honesty boundary:</strong> these are first-party dogfood / incident narratives, not third-party customer ROI claims.
+    Full longform: <a class="inline" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/THUMBGATE-CASE-STUDIES.md">docs/THUMBGATE-CASE-STUDIES.md</a>.
+  </div>
+  <article id="sudo-evasion">
+    <h2>1. A guardrail you could walk past with <code>sudo</code></h2>
+    <p class="meta">Hard technical problem · shipped in v1.29.2</p>
+    <span class="metric">62 evasion holes → 0</span>
+    <span class="metric">14 commands × 9 transforms</span>
+    <span class="metric">published tarball verified</span>
+    <p><strong>Problem.</strong> Catastrophic gates (<code>rm -rf ~</code>, force-push, hard reset) matched the happy path but missed wrappers: <code>sudo rm -rf ~</code> produced no match on 1.29.1.</p>
+    <p><strong>Action.</strong> Built an adversarial grid instead of hand-picking examples; canonicalized commands centrally; re-evaluated only when the original form missed.</p>
+    <pre>rm -rf ~        → deny
+sudo rm -rf ~   → deny (after fix)
+thumbgate@1.29.1 → 34+ holes
+thumbgate@1.29.2 → 0 holes</pre>
+    <p><strong>Artifact.</strong> <code>tests/gate-evasion-matrix.test.js</code> in CI + 6-hourly job against the published npm artifact.</p>
+  </article>
+  <article id="hypothesis-report">
+    <h2>2. A seven-defect report where most defects weren’t real</h2>
+    <p class="meta">Ambiguous problem · investigation discipline</p>
+    <span class="metric">2 of 7 defects real</span>
+    <span class="metric">disconfirming evidence first</span>
+    <p><strong>Problem.</strong> A confident multi-defect report with statistics would have forced a core rewrite if accepted wholesale.</p>
+    <p><strong>Action.</strong> Treated each claim as a hypothesis: read the consumer’s config, recompute totals from source data, reproduce before believing.</p>
+    <p><strong>Result.</strong> Strict-mode env explained “warn-by-default not working.” Filtered tables understated warns. The investigation also surfaced the sudo evasion class above — worse than anything in the original report.</p>
+  </article>
+  <article id="fail-open">
+    <h2>3. Production failure: a firewall enforcing nothing</h2>
+    <p class="meta">Incident · fail-open PreToolUse hook</p>
+    <span class="metric">hook binary missing</span>
+    <span class="metric">erroring hook = fail open</span>
+    <span class="metric">silent-gate canary added</span>
+    <p><strong>Problem.</strong> Local state vanished and <code>thumbgate-hook</code> was missing. An erroring PreToolUse hook fails open — the product looked “fine” while blocking nothing.</p>
+    <p><strong>Action.</strong> Restored via <code>thumbgate init</code>, then proved enforcement with the same dangerous commands that must deny.</p>
+    <p><strong>Lesson.</strong> This product’s failure mode is silence. Uptime green is not enough; known-dangerous commands must still be denied on a schedule against the published artifact.</p>
+  </article>
+  <article id="catastrophic-floor">
+    <h2>4. Monetization that almost sold off the safety floor</h2>
+    <p class="meta">Stakeholder conflict · product policy</p>
+    <span class="metric">catastrophic gates exempt from daily cap</span>
+    <span class="metric">hotfix bypass still hard-floors secrets</span>
+    <p><strong>Problem.</strong> Free-tier daily block caps + warn-by-default posture could downgrade irreversible actions to warnings after the cap.</p>
+    <p><strong>Action.</strong> Split <em>how many</em> blocks free users get from <em>which</em> actions can never be discounted. Named catastrophic IDs stay deny regardless of tier.</p>
+    <p><strong>Result.</strong> Upgrade pressure remains on negotiable gates; irreversible classes are not for sale.</p>
+  </article>
+  <article id="evasion-matrix">
+    <h2>5. Built the measurement before claiming “fixed”</h2>
+    <p class="meta">Instrument first · property tests</p>
+    <span class="metric">relative invariant</span>
+    <span class="metric">vacuity guards</span>
+    <span class="metric">artifact, not only source</span>
+    <p><strong>Problem.</strong> “We fixed the bypass class” had been claimed twice and been wrong twice.</p>
+    <p><strong>Action.</strong> Built a property suite over commands × spellings, with sandboxing and a minimum number of plain-form denials so empty measurements cannot pass.</p>
+    <p><strong>Result.</strong> “Is it fixed?” became a command with a number, including against the npm tarball users actually install.</p>
+  </article>
+  <p>
+    <a class="cta" href="/whitepaper">Evaluation white paper</a>
+    <a class="cta" href="/eval-scorecard">Bench scorecard</a>
+    <a class="cta" href="/diagnostic">$499 diagnostic gate</a>
+  </p>
+  <p class="footer-note">
+    Want a customer case study here? Ship with ThumbGate and write <a href="mailto:igor.ganapolsky@gmail.com">igor.ganapolsky@gmail.com</a>.
+    We only publish reproducible claims.
+  </p>
+  <p class="footer-note">
+    <a href="/">Home</a> ·
+    <a href="/pricing">Pricing</a> ·
+    <a href="/privacy">Privacy</a> ·
+    <a href="/terms">Terms</a> ·
+    <a href="/support">Support</a>
+  </p>
+</main>
+</body>
+</html>