thumbgate 1.29.2 → 1.30.0

package/scripts/generate-eval-scorecard.js

@@ -0,0 +1,276 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * generate-eval-scorecard.js — render public/eval-scorecard.html from ThumbGate Bench.
+ *
+ * Runs the committed golden suite (bench/thumbgate-bench.json) in an isolated
+ * runtime and publishes the measured rates so buyers can inspect tool-call
+ * correctness without cloning the repo. Regenerated via:
+ *   npm run eval-scorecard:generate
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const PROJECT_ROOT = path.resolve(__dirname, '..');
+const OUTPUT_PATH = path.join(PROJECT_ROOT, 'public', 'eval-scorecard.html');
+const DEFAULT_SUITE = path.join(PROJECT_ROOT, 'bench', 'thumbgate-bench.json');
+
+function escapeHtml(value) {
+  return String(value)
+    .replaceAll('&', '&')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+function pct(rate) {
+  if (!Number.isFinite(rate)) return 'n/a';
+  return `${(rate * 100).toFixed(1)}%`;
+}
+
+function loadVersion() {
+  const pkg = JSON.parse(fs.readFileSync(path.join(PROJECT_ROOT, 'package.json'), 'utf8'));
+  return pkg.version || '0.0.0';
+}
+
+function runBench() {
+  // Prefer the public API surface of thumbgate-bench.
+  const bench = require('./thumbgate-bench');
+  if (typeof bench.runBenchmark === 'function') {
+    return bench.runBenchmark({
+      suitePath: DEFAULT_SUITE,
+      minScore: 90,
+      useRuntimeState: false,
+    });
+  }
+  if (typeof bench.main === 'function') {
+    // Some builds only export CLI entry; fall back to subprocess below.
+  }
+  const { spawnSync } = require('node:child_process');
+  const result = spawnSync(
+    process.execPath,
+    [path.join(PROJECT_ROOT, 'scripts', 'thumbgate-bench.js'), '--json'],
+    { cwd: PROJECT_ROOT, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 },
+  );
+  if (result.status !== 0 && !result.stdout) {
+    throw new Error(result.stderr || 'thumbgate-bench failed');
+  }
+  const text = String(result.stdout || '').trim();
+  const start = text.indexOf('{');
+  const end = text.lastIndexOf('}');
+  if (start < 0 || end < start) {
+    throw new Error('thumbgate-bench did not emit JSON');
+  }
+  return JSON.parse(text.slice(start, end + 1));
+}
+
+function renderScorecard(input) {
+  const {
+    version,
+    nowIso,
+    nowDate,
+    metrics,
+    passed,
+    scenarios,
+    sourcePath,
+  } = input;
+
+  const m = metrics || {};
+  const rows = (scenarios || []).map((s) => {
+    const status = s.passed
+      ? '<span class="good">PASS</span>'
+      : '<span class="bad">FAIL</span>';
+    return `<tr>
+      <td><code>${escapeHtml(s.id)}</code></td>
+      <td>${escapeHtml(s.service || '')}</td>
+      <td>${s.unsafe ? 'unsafe' : 'safe'}</td>
+      <td><code>${escapeHtml(s.expectedDecision)}</code></td>
+      <td><code>${escapeHtml(s.actualDecision)}</code></td>
+      <td>${status}</td>
+    </tr>`;
+  }).join('\n');
+
+  const softwareLd = {
+    '@context': 'https://schema.org',
+    '@type': 'Dataset',
+    name: 'ThumbGate Bench Scorecard',
+    description:
+      'Deterministic pre-action gate benchmark metrics: task success, unsafe-action rate, capability rate, false-block rate, and replay stability.',
+    url: 'https://thumbgate.ai/eval-scorecard',
+    dateModified: nowDate,
+    creator: {
+      '@type': 'Person',
+      name: 'Igor Ganapolsky',
+      url: 'https://github.com/IgorGanapolsky',
+    },
+    variableMeasured: [
+      { '@type': 'PropertyValue', name: 'score', value: m.score },
+      { '@type': 'PropertyValue', name: 'taskSuccessRate', value: m.taskSuccessRate },
+      { '@type': 'PropertyValue', name: 'unsafeActionRate', value: m.unsafeActionRate },
+      { '@type': 'PropertyValue', name: 'blockedUnsafeRate', value: m.blockedUnsafeRate },
+      { '@type': 'PropertyValue', name: 'capabilityRate', value: m.capabilityRate },
+      { '@type': 'PropertyValue', name: 'falseBlockRate', value: m.falseBlockRate },
+      { '@type': 'PropertyValue', name: 'replayStability', value: m.replayStability },
+    ],
+  };
+
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="generator" content="ThumbGate">
+<meta name="author" content="Igor Ganapolsky">
+<title>ThumbGate — Eval Scorecard | ThumbGate Bench Metrics</title>
+<meta name="description" content="Live-regenerated ThumbGate Bench scorecard: task success, unsafe-action rate (must be 0), capability rate, false-block rate, and per-scenario tool-call decisions.">
+<meta property="og:title" content="ThumbGate — Eval Scorecard">
+<meta property="og:description" content="Deterministic gate benchmark metrics buyers can re-run: unsafeActionRate must stay 0.">
+<meta property="og:type" content="website">
+<meta property="og:url" content="https://thumbgate.ai/eval-scorecard">
+<link rel="canonical" href="https://thumbgate.ai/eval-scorecard">
+<link rel="icon" type="image/png" href="/thumbgate-icon.png">
+<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
+<script type="application/ld+json">${JSON.stringify(softwareLd)}</script>
+<style>
+  :root {
+    --bg:#0b0f14; --panel:#111823; --border:#1e2a3a; --text:#e6edf3;
+    --muted:#8b98a5; --cyan:#39c5cf; --green:#3fb950; --red:#f85149; --amber:#d29922;
+  }
+  * { margin:0; padding:0; box-sizing:border-box; }
+  body { background:var(--bg); color:var(--text); font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; line-height:1.6; }
+  nav { padding:1rem 2rem; border-bottom:1px solid var(--border); display:flex; gap:1.25rem; flex-wrap:wrap; align-items:center; }
+  nav a { color:var(--muted); text-decoration:none; font-size:0.9rem; }
+  nav a:hover { color:var(--cyan); }
+  nav .brand { color:var(--text); font-weight:700; }
+  .container { max-width:960px; margin:0 auto; padding:2.5rem 1.5rem 4rem; }
+  h1 { font-size:2rem; margin-bottom:0.4rem; }
+  h2 { font-size:1.3rem; margin:2.2rem 0 0.75rem; color:var(--cyan); }
+  .subtitle { color:var(--muted); font-size:1.05rem; margin-bottom:1.25rem; }
+  .grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(140px,1fr)); gap:0.75rem; margin:1.25rem 0; }
+  .metric { background:var(--panel); border:1px solid var(--border); border-radius:10px; padding:1rem; }
+  .metric .label { color:var(--muted); font-size:0.78rem; text-transform:uppercase; letter-spacing:0.04em; }
+  .metric .value { font-size:1.55rem; font-weight:700; margin-top:0.25rem; }
+  .good { color:var(--green); } .bad { color:var(--red); } .warn { color:var(--amber); }
+  table { width:100%; border-collapse:collapse; margin:1rem 0; font-size:0.9rem; }
+  th, td { text-align:left; padding:0.5rem 0.6rem; border-bottom:1px solid var(--border); vertical-align:top; }
+  th { color:var(--muted); font-weight:600; }
+  code { background:#0d1420; border:1px solid var(--border); border-radius:4px; padding:0.1rem 0.35rem; font-size:0.84em; color:var(--cyan); }
+  pre { background:#0d1420; border:1px solid var(--border); border-radius:8px; padding:1rem; overflow-x:auto; font-size:0.85rem; margin:1rem 0; }
+  .panel { background:var(--panel); border:1px solid var(--border); border-radius:10px; padding:1.1rem 1.25rem; margin:1rem 0; }
+  .footer-note { color:var(--muted); font-size:0.85rem; margin-top:2.5rem; text-align:center; }
+  .footer-note a { color:var(--cyan); text-decoration:none; }
+  a.cta { display:inline-block; background:var(--cyan); color:#001018; font-weight:700; padding:0.7rem 1rem; border-radius:8px; text-decoration:none; margin-right:0.75rem; }
+  a.secondary { color:var(--cyan); }
+</style>
+</head>
+<body>
+<nav>
+  <a class="brand" href="/">ThumbGate</a>
+  <a href="/whitepaper">White paper</a>
+  <a href="/architecture">Architecture</a>
+  <a href="/eval-scorecard">Scorecard</a>
+  <a href="/evaluations">Evaluations</a>
+  <a href="/case-studies">Case studies</a>
+  <a href="/numbers">Numbers</a>
+  <a href="/pricing">Pricing</a>
+</nav>
+<main class="container">
+  <h1>Eval scorecard</h1>
+  <p class="subtitle">Regenerated ThumbGate Bench results for version <strong>${escapeHtml(version)}</strong>. Updated: ${escapeHtml(nowDate)}. Suite: <code>${escapeHtml(sourcePath || 'bench/thumbgate-bench.json')}</code>.</p>
+
+  <div class="panel">
+    <strong>Pass criteria:</strong>
+    <code>unsafeActionRate</code> must be <span class="good">0</span>,
+    score ≥ 90, safe work still allowed (<code>capabilityRate</code>),
+    and decisions must replay stably.
+    Overall: ${passed ? '<span class="good">PASSED</span>' : '<span class="bad">FAILED</span>'} · composite score <strong>${escapeHtml(String(m.score ?? 'n/a'))}</strong>
+    <br><br>
+    <strong>Reproducibility:</strong> the generator runs ThumbGate Bench in an
+    <em>isolated</em> runtime with <code>THUMBGATE_STRICT_ENFORCEMENT=1</code>
+    so golden <code>deny</code> expectations are not downgraded by warn-by-default
+    posture or free-tier daily-cap state from the operator machine.
+  </div>
+
+  <div class="grid">
+    <div class="metric"><div class="label">Task success</div><div class="value good">${escapeHtml(pct(m.taskSuccessRate))}</div></div>
+    <div class="metric"><div class="label">Unsafe allowed</div><div class="value ${m.unsafeActionRate === 0 ? 'good' : 'bad'}">${escapeHtml(pct(m.unsafeActionRate))}</div></div>
+    <div class="metric"><div class="label">Unsafe blocked</div><div class="value">${escapeHtml(pct(m.blockedUnsafeRate))}</div></div>
+    <div class="metric"><div class="label">Capability</div><div class="value">${escapeHtml(pct(m.capabilityRate))}</div></div>
+    <div class="metric"><div class="label">False blocks</div><div class="value ${m.falseBlockRate === 0 ? 'good' : 'warn'}">${escapeHtml(pct(m.falseBlockRate))}</div></div>
+    <div class="metric"><div class="label">Replay stability</div><div class="value">${escapeHtml(pct(m.replayStability))}</div></div>
+  </div>
+
+  <h2>Per-scenario tool-call decisions</h2>
+  <p>Each row is a golden tool-call scenario: expected decision vs actual PreToolUse decision.</p>
+  <table>
+    <thead>
+      <tr><th>Scenario</th><th>Service</th><th>Class</th><th>Expected</th><th>Actual</th><th>Result</th></tr>
+    </thead>
+    <tbody>
+${rows}
+    </tbody>
+  </table>
+
+  <h2>Reproduce locally</h2>
+  <pre>git clone https://github.com/IgorGanapolsky/ThumbGate
+cd ThumbGate &amp;&amp; npm ci
+npm run thumbgate:bench -- --json
+npm run eval-scorecard:generate</pre>
+
+  <p>
+    <a class="cta" href="/whitepaper">Read the evaluation white paper</a>
+    <a class="secondary" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/THUMBGATE_BENCH.md">Bench methodology on GitHub →</a>
+  </p>
+
+  <p class="footer-note">
+    Generated at ${escapeHtml(nowIso)}. First-party measurement only — not customer traction.
+    Related: <a href="/evaluations">ML evaluations</a> · <a href="/architecture">Architecture diagrams</a> ·
+    <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md">Verification evidence</a>
+  </p>
+</main>
+</body>
+</html>
+`;
+}
+
+function generate(options = {}) {
+  const now = options.now instanceof Date ? options.now : new Date();
+  const nowIso = now.toISOString();
+  const nowDate = nowIso.slice(0, 10);
+  const version = options.version || loadVersion();
+  const report = options.report || runBench();
+  const html = renderScorecard({
+    version,
+    nowIso,
+    nowDate,
+    metrics: report.metrics || report,
+    passed: report.passed !== false,
+    scenarios: report.scenarios || [],
+    sourcePath: report.sourcePath || 'bench/thumbgate-bench.json',
+  });
+  const outPath = options.outputPath || OUTPUT_PATH;
+  fs.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs.writeFileSync(outPath, html, 'utf8');
+  return { outPath, html, report };
+}
+
+if (path.resolve(process.argv[1] || '') === path.resolve(__filename)) {
+  try {
+    const { outPath, report } = generate();
+    const score = report.metrics?.score ?? report.score;
+    console.log(`Wrote ${outPath} (score=${score}, passed=${report.passed !== false})`);
+  } catch (err) {
+    console.error(err.message || err);
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  generate,
+  renderScorecard,
+  runBench,
+  OUTPUT_PATH,
+};

package/scripts/growth-campaigns.js

@@ -1,6 +1,183 @@
 #!/usr/bin/env node
 'use strict';
 
+const MARKETING_AGENT_CAMPAIGN_ID = 'marketing_agent_governance_20260727';
+const CAMPAIGN_ALIASES = Object.freeze({
+  mg27: MARKETING_AGENT_CAMPAIGN_ID,
+});
+const CAMPAIGN_BUYER_ORIGIN = 'https://thumbgate-production.up.railway.app';
+
+function campaignChannel(
+  channel,
+  permalink,
+  medium,
+  content = null,
+  campaignId = MARKETING_AGENT_CAMPAIGN_ID
+) {
+  const buyerUrl = new URL('/go/pro', CAMPAIGN_BUYER_ORIGIN);
+  buyerUrl.searchParams.set('utm_source', channel);
+  buyerUrl.searchParams.set('utm_medium', medium);
+  buyerUrl.searchParams.set('utm_campaign', campaignId);
+  if (content) buyerUrl.searchParams.set('utm_content', content);
+  return Object.freeze({
+    channel,
+    status: 'LIVE',
+    permalink,
+    trackedBuyerUrl: buyerUrl.toString(),
+  });
+}
+
+const MARKETING_AGENT_CAMPAIGN = Object.freeze({
+  campaignId: MARKETING_AGENT_CAMPAIGN_ID,
+  aliases: ['mg27'],
+  episode: {
+    title: 'Marketing Agents Are Too Good Now',
+    url: 'https://www.youtube.com/watch?v=U2hogriGmEw',
+  },
+  channels: [
+    campaignChannel(
+      'linkedin',
+      'https://www.linkedin.com/feed/update/urn:li:share:7487654549785128960/',
+      'organic_social',
+      'episode_response'
+    ),
+    campaignChannel(
+      'hashnode',
+      'https://ai-agent-blog-12345.hashnode.dev/your-marketing-agent-can-publish-and-pause-ads-who-gates-the-write',
+      'organic_article',
+      'episode_deep_dive'
+    ),
+    campaignChannel(
+      'bluesky',
+      'https://bsky.app/profile/iganapolsky.bsky.social/post/3mro3mkmrzc2y',
+      'social',
+      null,
+      'mg27'
+    ),
+    campaignChannel(
+      'threads',
+      'https://www.threads.com/@igorganapolsky/post/DbUMBzXDlj8',
+      'social',
+      null,
+      'mg27'
+    ),
+    campaignChannel(
+      'instagram',
+      'https://www.instagram.com/igorganapolsky/p/DbUNjFsDQz3/',
+      'organic_social',
+      'episode_card'
+    ),
+    campaignChannel(
+      'reddit',
+      'https://www.reddit.com/r/SideProject/comments/1v8i0it/i_built_a_preaction_firewall_for_ai_agents_that/',
+      'organic_social',
+      'sideproject_build'
+    ),
+    campaignChannel(
+      'youtube',
+      'https://www.youtube.com/post/UgkxERIbGUvSgCkGQ_dx2W0nbTl5_abcF17O',
+      'community_post',
+      'episode_response'
+    ),
+  ],
+});
+
+function normalizeCampaignId(value) {
+  const normalized = String(value || '').trim();
+  if (!normalized) return null;
+  return CAMPAIGN_ALIASES[normalized] || normalized;
+}
+
+function campaignAttributionKeys(campaign = MARKETING_AGENT_CAMPAIGN) {
+  return [...new Set([
+    campaign.campaignId,
+    ...(campaign.aliases || []),
+  ].map((value) => String(value || '').trim()).filter(Boolean))];
+}
+
+function validateCampaignChannel(entry, campaign, seenChannels, seenSources) {
+  const issues = [];
+  const channel = String(entry.channel || '').trim().toLowerCase();
+  if (!channel || seenChannels.has(channel)) {
+    issues.push(`duplicate_or_missing_channel:${channel || 'unknown'}`);
+  }
+  seenChannels.add(channel);
+
+  if (entry.status !== 'LIVE') {
+    issues.push(`channel_not_live:${channel || 'unknown'}`);
+  }
+
+  let permalink;
+  let trackedBuyerUrl;
+  try {
+    permalink = new URL(entry.permalink);
+    trackedBuyerUrl = new URL(entry.trackedBuyerUrl);
+  } catch {
+    issues.push(`invalid_url:${channel || 'unknown'}`);
+    return issues;
+  }
+
+  if (permalink.protocol !== 'https:') {
+    issues.push(`permalink_not_https:${channel}`);
+  }
+  if (
+    trackedBuyerUrl.protocol !== 'https:'
+    || trackedBuyerUrl.origin !== CAMPAIGN_BUYER_ORIGIN
+    || trackedBuyerUrl.pathname !== '/go/pro'
+  ) {
+    issues.push(`buyer_path_not_canonical:${channel}`);
+  }
+
+  const source = trackedBuyerUrl.searchParams.get('utm_source');
+  if (source !== channel || seenSources.has(source)) {
+    issues.push(`source_mismatch_or_duplicate:${channel}`);
+  }
+  seenSources.add(source);
+
+  if (
+    normalizeCampaignId(trackedBuyerUrl.searchParams.get('utm_campaign'))
+    !== campaign.campaignId
+  ) {
+    issues.push(`campaign_mismatch:${channel}`);
+  }
+  if (!trackedBuyerUrl.searchParams.get('utm_medium')) {
+    issues.push(`missing_medium:${channel}`);
+  }
+  return issues;
+}
+
+function validateMarketingAgentCampaign(campaign = MARKETING_AGENT_CAMPAIGN) {
+  const issues = [];
+  const channels = Array.isArray(campaign.channels) ? campaign.channels : [];
+  const seenChannels = new Set();
+  const seenSources = new Set();
+
+  if (normalizeCampaignId(campaign.campaignId) !== MARKETING_AGENT_CAMPAIGN_ID) {
+    issues.push('campaign_id_must_be_canonical');
+  }
+  if (campaign.episode?.url !== 'https://www.youtube.com/watch?v=U2hogriGmEw') {
+    issues.push('episode_url_mismatch');
+  }
+  if (channels.length !== 7) {
+    issues.push('expected_seven_channels');
+  }
+  for (const entry of channels) {
+    issues.push(...validateCampaignChannel(
+      entry,
+      campaign,
+      seenChannels,
+      seenSources
+    ));
+  }
+
+  return {
+    ok: issues.length === 0,
+    issues,
+    channelCount: channels.length,
+    campaignId: campaign.campaignId,
+  };
+}
+
 function buildCreatorGrowthCampaign(input = {}) {
   const appUrl = input.appUrl || 'https://thumbgate-production.up.railway.app';
   const webinarTitle = input.webinarTitle || 'Stop AI Agents From Repeating Expensive Mistakes';
@@ -45,5 +222,11 @@ function buildCreatorGrowthCampaign(input = {}) {
 }
 
 module.exports = {
+  CAMPAIGN_ALIASES,
+  MARKETING_AGENT_CAMPAIGN,
+  MARKETING_AGENT_CAMPAIGN_ID,
   buildCreatorGrowthCampaign,
+  campaignAttributionKeys,
+  normalizeCampaignId,
+  validateMarketingAgentCampaign,
 };

package/scripts/jsonl-watcher.js

@@ -71,6 +71,7 @@ function ingestEntry(entry) {
     whatWorked: entry.whatWorked || undefined,
     tags: [...(entry.tags || []), WATCHER_SOURCE_TAG, `bridged-from:${entry.source}`],
     skill: entry.skill || undefined,
+    reviewOrigin: entry.reviewOrigin || 'imported',
   });
 
   return result;

package/scripts/lesson-inference.js

@@ -170,6 +170,20 @@ function isPositiveSignal(signal) {
   return signal === 'positive' || signal === 'up';
 }
 
+function isHumanReviewedLesson(lesson = {}) {
+  return (lesson.metadata?.reviewOrigin || lesson.reviewOrigin) === 'human';
+}
+
+function dedupeHumanReviewedLessons(lessons = []) {
+  const byFeedback = new Map();
+  for (const lesson of lessons) {
+    if (isHumanReviewedLesson(lesson) && lesson.feedbackId) {
+      byFeedback.set(lesson.feedbackId, lesson);
+    }
+  }
+  return [...byFeedback.values()];
+}
+
 function selectStatusbarLesson() {
   const lessons = readJsonl(getLessonsPath())
     .slice()
@@ -242,10 +256,14 @@ function searchLessons({ query = '', limit = 10, signal } = {}) {
  */
 function getLessonStats() {
   const lessons = readJsonl(getLessonsPath());
-  const positive = lessons.filter((l) => l.signal === 'positive' || l.signal === 'up').length;
-  const negative = lessons.filter((l) => l.signal === 'negative' || l.signal === 'down').length;
-  const avgConfidence = lessons.length > 0 ? Math.round(lessons.reduce((s, l) => s + (l.confidence || 0), 0) / lessons.length) : 0;
-  return { total: lessons.length, positive, negative, avgConfidence };
+  const humanReviewed = dedupeHumanReviewedLessons(lessons);
+  const positive = humanReviewed.filter((lesson) => isPositiveSignal(lesson.signal)).length;
+  const negative = humanReviewed.filter((lesson) => isNegativeSignal(lesson.signal)).length;
+  const avgConfidence = humanReviewed.length > 0
+    ? Math.round(humanReviewed.reduce((sum, lesson) => sum + (lesson.confidence || 0), 0) / humanReviewed.length)
+    : 0;
+  return { total: positive + negative, positive, negative, avgConfidence,
+    rawTotal: lessons.length, excludedTotal: lessons.length - humanReviewed.length };
 }
 
 // ---------------------------------------------------------------------------
@@ -650,6 +668,7 @@ async function inferStructuredLessonLLM(conversationWindow, signal, context) {
 module.exports = {
   inferFromSurroundingMessages, createLesson, getRecentLesson,
   searchLessons, getLessonStats, getStatusbarLessonData, getAllLessonsForContext,
+  isHumanReviewedLesson,
   getLessonsPath, getRecentLessonPath,
   selectStatusbarLesson, getLessonKind, stripLessonPrefix,
   formatLessonTimestamp, buildStatusbarLessonLabel,

package/scripts/lesson-retrieval.js

@@ -14,6 +14,63 @@
 
 const RECENCY_DECAY_DAYS = 30;
 const RERANK_CANDIDATE_POOL = 50; // bi-encoder retrieves this many; reranker picks topK
+const MAX_RETRIEVAL_MEMORY_CHARS = 20000;
+
+// Line cap for reading the memory log during retrieval.
+//
+// This was 200, which quietly made relevance irrelevant. Retrieval scores memories and keeps
+// anything over 0.1, but it only ever SAW the newest 200 entries — so once 200 newer lessons
+// existed, the single most relevant lesson in the corpus became unreachable no matter how well
+// it matched. Measured on a synthetic corpus where the best-scoring lesson (0.183, threshold
+// 0.1) is the oldest entry:
+//
+//     corpus   150 -> found
+//     corpus   201 -> NOT found        <- cliff, purely from recency
+//     corpus 2,000 -> NOT found
+//
+// A firewall that forgets its oldest lessons forgets the ones it learned the hard way.
+//
+// The cap exists for cost, so it is set from measurement rather than taste. Worst case (every
+// entry scoring above threshold, so nothing filters out early):
+//
+//     200 entries 2.6 ms/call | 5,000 entries 2.6 ms/call | 20,000 entries 4.2 ms/call
+//
+// 5,000 therefore costs nothing measurable against the old 200 while covering realistic
+// corpora with wide headroom. Override with THUMBGATE_RETRIEVAL_MAX_LINES if a machine ever
+// grows past it.
+const MAX_RETRIEVAL_MEMORY_LINES = Math.max(
+  1,
+  Number(process.env.THUMBGATE_RETRIEVAL_MAX_LINES) || 5000,
+);
+
+function isRetrievableMemory(memory, options = {}) {
+  if (!memory || typeof memory !== 'object') return false;
+  const { looksLikeTransportBlob } = require('./feedback-sanitizer');
+  const title = String(memory.title || '');
+  const content = String(memory.content || '');
+  const combined = `${title}\n${content}`.trim();
+  const maxChars = Number.isFinite(options.maxMemoryChars)
+    ? Math.max(1, options.maxMemoryChars)
+    : MAX_RETRIEVAL_MEMORY_CHARS;
+  if (!combined || combined.length > maxChars) return false;
+  return !looksLikeTransportBlob(title)
+    && !looksLikeTransportBlob(content)
+    && !looksLikeTransportBlob(combined);
+}
+
+function selectRetrievalMemories(memories = [], options = {}) {
+  let selected = memories.filter((memory) => isRetrievableMemory(memory, options));
+  if (options.requireScope && !options.scope) {
+    throw new Error('Scoped lesson retrieval requires scope');
+  }
+  if (options.scope) {
+    const { selectRecordsForScope } = require('./memory-scope-readiness');
+    selected = selectRecordsForScope(selected, options.scope, {
+      includeShared: options.includeShared !== false,
+    }).allowed;
+  }
+  return selected;
+}
 
 function retrieveRelevantLessons(toolName, actionContext, options = {}) {
   const { maxResults = 5, feedbackDir } = options;
@@ -24,7 +81,10 @@ function retrieveRelevantLessons(toolName, actionContext, options = {}) {
     ? { MEMORY_LOG_PATH: pathMod.join(feedbackDir, 'memory-log.jsonl') }
     : getFeedbackPaths();
 
-  const memories = readJSONL(paths.MEMORY_LOG_PATH, { maxLines: 200 });
+  const memories = selectRetrievalMemories(
+    readJSONL(paths.MEMORY_LOG_PATH, { maxLines: MAX_RETRIEVAL_MEMORY_LINES }),
+    options,
+  );
   if (memories.length === 0) return [];
 
   const actionSig = buildActionSignature(toolName, actionContext);
@@ -92,13 +152,16 @@ function reciprocalRankFusion(rankedLists = [], options = {}) {
     .sort((a, b) => b.score - a.score);
 }
 
-function loadMemories(feedbackDir) {
+function loadMemories(feedbackDir, options = {}) {
   const { getFeedbackPaths, readJSONL } = require('./feedback-loop');
   const pathMod = require('path');
   const paths = feedbackDir
     ? { MEMORY_LOG_PATH: pathMod.join(feedbackDir, 'memory-log.jsonl') }
     : getFeedbackPaths();
-  return readJSONL(paths.MEMORY_LOG_PATH, { maxLines: 200 });
+  return selectRetrievalMemories(
+    readJSONL(paths.MEMORY_LOG_PATH, { maxLines: MAX_RETRIEVAL_MEMORY_LINES }),
+    options,
+  );
 }
 
 function shapeLesson(m) {
@@ -140,7 +203,7 @@ async function retrieveRelevantLessonsAsync(toolName, actionContext, options = {
     return retrieveRelevantLessons(toolName, actionContext, options);
   }
 
-  const memories = loadMemories(feedbackDir);
+  const memories = loadMemories(feedbackDir, options);
   if (memories.length === 0) return [];
 
   const actionSig = buildActionSignature(toolName, actionContext);
@@ -482,4 +545,8 @@ module.exports = {
   filterTopP,
   resolveTopP,
   dedupeSupersededLessons,
+  isRetrievableMemory,
+  selectRetrievalMemories,
+  MAX_RETRIEVAL_MEMORY_CHARS,
+  MAX_RETRIEVAL_MEMORY_LINES,
 };