thumbgate 1.29.2 → 1.31.0

package/src/api/server.js

@@ -172,7 +172,8 @@ const {
   readTaskOutcomes,
   recordTaskOutcome,
 } = require('../../scripts/task-outcomes');
-const { monitorTaskOutcomes } = require('../../scripts/agent-outcome-monitor');
+const { monitorProductionSignals } = require('../../scripts/agent-outcome-monitor');
+const { computeToolKpis, recordToolCall } = require('../../scripts/tool-kpi-tracker');
 const {
   calculateEscalationMetrics,
   decideEscalation,
@@ -209,7 +210,7 @@ const {
   getSettingsStatus,
 } = require('../../scripts/settings-hierarchy');
 const {
-  searchThumbgate,
+  searchThumbgateAsync,
 } = require('../../scripts/thumbgate-search');
 const {
   appendTelemetryPing,
@@ -237,6 +238,7 @@ const { sendProblem, PROBLEM_TYPES } = require('../../scripts/problem-detail');
 const { TOOLS: MCP_TOOLS } = require('../../scripts/tool-registry');
 const mcpOauth = require('../../scripts/mcp-oauth');
 const { packCheckoutReference } = require('../../scripts/checkout-attribution-reference');
+const { normalizeCampaignId } = require('../../scripts/growth-campaigns');
 // OAuth 2.1 (PKCE) authorization-server state for the remote MCP connector
 // (Claude Connectors Directory requires OAuth for authenticated services).
 const oauthStore = mcpOauth.createStore();
@@ -266,6 +268,11 @@ const CODEX_PLUGIN_PAGE_PATH = path.resolve(__dirname, '../../public/codex-plugi
 const COMPARE_PAGE_PATH = path.resolve(__dirname, '../../public/compare.html');
 const LEARN_PAGE_PATH = path.resolve(__dirname, '../../public/learn.html');
 const NUMBERS_PAGE_PATH = path.resolve(__dirname, '../../public/numbers.html');
+const ARCHITECTURE_PAGE_PATH = path.resolve(__dirname, '../../public/architecture.html');
+const WHITEPAPER_PAGE_PATH = path.resolve(__dirname, '../../public/whitepaper.html');
+const EVAL_SCORECARD_PAGE_PATH = path.resolve(__dirname, '../../public/eval-scorecard.html');
+const EVALUATIONS_PAGE_PATH = path.resolve(__dirname, '../../public/evaluations.html');
+const CASE_STUDIES_PAGE_PATH = path.resolve(__dirname, '../../public/case-studies.html');
 const FEDERAL_PAGE_PATH = path.resolve(__dirname, '../../public/federal.html');
 const PRICING_PAGE_PATH = path.resolve(__dirname, '../../public/pricing.html');
 const ABOUT_PAGE_PATH = path.resolve(__dirname, '../../public/about.html');
@@ -417,7 +424,7 @@ const BUILD_METADATA = resolveBuildMetadata();
 const TERMINAL_JOB_STATUSES = new Set(['completed', 'failed', 'cancelled']);
 const IDLE_JOB_STATUSES = new Set(['queued', 'paused', 'resume_requested']);
 const JOB_CONTROL_ACTIONS = new Set(['pause', 'cancel', 'resume']);
-const TRACKED_LINK_QUERY_KEYS = [
+const TRACKED_LINK_QUERY_KEYS = new Set([
   'utm_source',
   'utm_medium',
   'utm_campaign',
@@ -445,7 +452,7 @@ const TRACKED_LINK_QUERY_KEYS = [
   'seat_count',
   'landing_path',
   'referrer_host',
-];
+]);
 const TRACKED_LINK_TARGETS = Object.freeze({
   gpt: {
     href: 'https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate',
@@ -473,6 +480,25 @@ const TRACKED_LINK_TARGETS = Object.freeze({
     },
     allowCustomerEmail: true,
   },
+  // Human skip from Pro interstitial: same-origin hop so crawlers never see buy.stripe.com
+  // in the interstitial HTML (bot-guard contract). Bots are deflected to /checkout/pro.
+  'pro-direct': {
+    fallbackHref: PRO_CHECKOUT_URL,
+    external: true,
+    botDeflectPath: '/checkout/pro',
+    ctaId: 'pro_checkout_direct_stripe',
+    ctaPlacement: 'checkout_interstitial',
+    eventType: 'pro_checkout_direct_stripe',
+    defaults: {
+      utm_source: 'website',
+      utm_medium: 'checkout_interstitial',
+      utm_campaign: 'pro_upgrade',
+      plan_id: 'pro',
+      billing_cycle: 'monthly',
+    },
+    allowCustomerEmail: true,
+    prefillStripeEmail: true,
+  },
   // 2026-06-02: Teams/Aiventyx deprecated. Redirect legacy links to Pro.
   teams: {
     path: '/go/pro?utm_source=legacy_teams&utm_medium=redirect',
@@ -830,6 +856,67 @@ function getRequestFeedbackPaths(req, parsed) {
   });
 }
 
+const DATA_IDENTITY_CACHE = new Map();
+const DATA_IDENTITY_CACHE_LIMIT = 2048;
+
+function hashDataIdentity(prefix, value) {
+  const normalized = String(value || '');
+  const cacheKey = `${prefix}\0${normalized}`;
+  const cached = DATA_IDENTITY_CACHE.get(cacheKey);
+  if (cached) return cached;
+
+  // Billing identifiers can be email-like and API keys must never be made
+  // guessable through a fast digest. A memory-hard KDF gives us a stable,
+  // path-safe pseudonym without persisting the source identifier.
+  const derived = `${prefix}_${crypto.scryptSync(
+    normalized,
+    `thumbgate-${prefix}-data-identity-v1`,
+    16,
+    { N: 16384, r: 8, p: 1 }
+  ).toString('hex').slice(0, 24)}`;
+
+  if (DATA_IDENTITY_CACHE.size >= DATA_IDENTITY_CACHE_LIMIT) {
+    DATA_IDENTITY_CACHE.clear();
+  }
+  DATA_IDENTITY_CACHE.set(cacheKey, derived);
+  return derived;
+}
+
+function buildHostedTenantIdentity(validation = {}) {
+  if (!validation || validation.valid !== true || !validation.customerId) return null;
+  const tenantSeed = validation.customerId;
+  const principalSeed = validation.installId || tenantSeed;
+  const tenantId = hashDataIdentity('tenant', tenantSeed);
+  return {
+    partition: tenantId,
+    accessContext: {
+      tenantId,
+      principalId: hashDataIdentity('principal', principalSeed),
+      isAdmin: false,
+    },
+  };
+}
+
+function resolveRequestDataIdentity(req, expectedApiKey) {
+  const token = extractApiKey(req);
+  if (!token || (expectedApiKey && safeKeyEqual(token, expectedApiKey))) {
+    return { partition: null, accessContext: null };
+  }
+  const validation = validateApiKey(token);
+  const identity = buildHostedTenantIdentity(validation);
+  if (validation.valid === true && !identity) {
+    return { partition: null, accessContext: null, invalidHostedIdentity: true };
+  }
+  return identity || { partition: null, accessContext: null };
+}
+
+function partitionFeedbackPaths(paths, dataIdentity) {
+  if (!dataIdentity?.partition) return paths;
+  return getFeedbackPaths({
+    feedbackDir: path.join(paths.FEEDBACK_DIR, 'tenants', dataIdentity.partition),
+  });
+}
+
 function getSafeDataDir(req, parsed) {
   const { FEEDBACK_LOG_PATH } = getRequestFeedbackPaths(req, parsed);
   return path.resolve(path.dirname(FEEDBACK_LOG_PATH));
@@ -876,11 +963,13 @@ function updateLessonRecord(feedbackDir, lessonId, updater) {
 }
 
 function getPublicMcpTools() {
-  return MCP_TOOLS.map((tool) => ({
+  const { getExposedTools } = require('../../adapters/mcp/server-stdio');
+  return getExposedTools().map((tool) => ({
     name: tool.name,
     ...(tool.title ? { title: tool.title } : {}),
     description: tool.description,
     inputSchema: tool.inputSchema,
+    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),
     // Serve the tool-registry annotations (readOnlyHint/destructiveHint). Required
     // by the Claude Connectors Directory (missing annotations = the #1 rejection
     // cause) and used by MCP clients for permission prompts. Was being dropped here.
@@ -889,13 +978,7 @@ function getPublicMcpTools() {
 }
 
 function getServerCardTools() {
-  return MCP_TOOLS.map((tool) => ({
-    name: tool.name,
-    ...(tool.title ? { title: tool.title } : {}),
-    description: tool.description,
-    inputSchema: tool.inputSchema,
-    ...(tool.annotations ? { annotations: tool.annotations } : {}),
-  }));
+  return getPublicMcpTools();
 }
 
 function buildPublicUrl(hostedConfig, pathname) {
@@ -905,7 +988,7 @@ function buildPublicUrl(hostedConfig, pathname) {
 const VERIFICATION_EVIDENCE_URL = 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md';
 
 function getToolDiscoveryIndex(hostedConfig) {
-  return MCP_TOOLS.map((tool) => ({
+  return getPublicMcpTools().map((tool) => ({
     name: tool.name,
     description: tool.description,
     annotations: tool.annotations || {},
@@ -915,7 +998,7 @@ function getToolDiscoveryIndex(hostedConfig) {
 
 function getContextFootprintReport(hostedConfig) {
   return buildContextFootprintReport({
-    tools: MCP_TOOLS,
+    tools: getPublicMcpTools(),
     schemaUrlTemplate: buildPublicUrl(hostedConfig, '/.well-known/mcp/tools/{name}.json'),
   });
 }
@@ -1273,7 +1356,8 @@ function inferSearchQuery(referrer) {
 
 function getAttributionValue(params, key, fallbackValue) {
   const value = params.get(key);
-  return value && value.trim() ? value.trim() : fallbackValue;
+  const resolved = value?.trim() || fallbackValue;
+  return key === 'utm_campaign' ? normalizeCampaignId(resolved) : resolved;
 }
 
 function parseUrlSearchParams(urlValue) {
@@ -1645,17 +1729,28 @@ function projectWorkflowIntakeQueueLead(lead = {}, options = {}) {
       page: attribution.page || null,
       landingPath: attribution.landingPath || null,
     },
-    nextOperatorStep: options.closePacket?.status === 'approval_ready_not_authorized'
-      ? 'request_action_time_approval'
-      : options.discoveryPacket?.status === 'approval_ready_not_authorized'
-        ? 'request_action_time_approval_for_discovery'
-        : lead.status === 'new' ? 'review_and_qualify' : 'prepare_scope_or_hold',
+    nextOperatorStep: resolveNextOperatorStep(lead, options),
     qualificationCard: options.qualificationCard || buildIntakeQualificationCard(lead, options),
     discoveryPacket: options.discoveryPacket || buildIntakeDiscoveryPacket(lead, options),
     closePacket: options.closePacket || buildIntakeClosePacket(lead, options),
   };
 }
 
+/**
+ * Which action the operator should take next on an intake lead. Extracted from a three-level
+ * nested ternary: the precedence (close packet, then discovery packet, then lead status) is the
+ * actual logic and is far easier to check when it reads top to bottom.
+ */
+function resolveNextOperatorStep(lead, options) {
+  if (options.closePacket?.status === 'approval_ready_not_authorized') {
+    return 'request_action_time_approval';
+  }
+  if (options.discoveryPacket?.status === 'approval_ready_not_authorized') {
+    return 'request_action_time_approval_for_discovery';
+  }
+  return lead.status === 'new' ? 'review_and_qualify' : 'prepare_scope_or_hold';
+}
+
 function buildWorkflowIntakeQueue(parsed, workflowSprintIntake, feedbackDir, options = {}) {
   const { limit, statuses } = resolveWorkflowIntakeQueueOptions(parsed, workflowSprintIntake);
   const leads = workflowSprintIntake.loadWorkflowSprintLeads(feedbackDir);
@@ -1734,7 +1829,7 @@ function sendInvalidAnalyticsWindowProblem(res, title, err) {
 }
 
 function sendWorkflowIntakeQueueProblem(res, err) {
-  const status = Number(err && err.statusCode) || 400;
+  const status = Number(err?.statusCode) || 400;
   sendProblem(res, {
     type: status >= 500 ? PROBLEM_TYPES.INTERNAL : PROBLEM_TYPES.INVALID_REQUEST,
     title: status >= 500
@@ -2486,8 +2581,9 @@ ${hiddenInputs}
 <p class="email-note">Required so the checkout has attributable buyer intent and your receipt can be recovered.</p>
 <button type="submit" class="primary">Pay $19/mo with Stripe →</button>
 </form>
+<a class="secondary" data-i="pro_checkout_direct_stripe" rel="nofollow" href="/go/pro-direct?utm_source=website&amp;utm_medium=checkout_interstitial&amp;utm_campaign=pro_upgrade&amp;utm_content=skip_form&amp;cta_id=pro_checkout_direct_stripe&amp;cta_placement=checkout_interstitial">Skip form — open Stripe checkout directly →</a>
 <a class="secondary" data-i="workflow_sprint_intake" href="/#workflow-sprint-intake">Not sure yet? Send the workflow first</a>
-<p class="choice-note">Cancel anytime. 7-day refund, no questions. Diagnostics and sprints have their own pages.</p>
+<p class="choice-note">Cancel anytime. 7-day refund, no questions. Diagnostics and sprints have their own pages. Email path keeps receipts attributable; skip uses a same-origin hop that bot-deflects crawlers.</p>
 <div class="objection-box" aria-label="Checkout feedback">
 <strong>Not buying today?</strong>
 <p class="objection-note">Tap one reason so we know what to fix. This does not sign you up.</p>
@@ -2689,7 +2785,10 @@ function appendTrackedLinkQueryParams(destinationUrl, parsed, target) {
   for (const key of TRACKED_LINK_QUERY_KEYS) {
     const value = params.get(key);
     if (value && value.trim()) {
-      destinationUrl.searchParams.set(key, value.trim());
+      const normalizedValue = key === 'utm_campaign'
+        ? normalizeCampaignId(value)
+        : value.trim();
+      destinationUrl.searchParams.set(key, normalizedValue);
     }
   }
   if (target.allowCustomerEmail) {
@@ -2730,7 +2829,7 @@ function buildTrackedLinkAttribution(target, parsed, req, journeyState, destinat
   const source = pickFirstText(
     params.get('source'),
     params.get('utm_source'),
-    target.defaults && target.defaults.utm_source,
+    target.defaults?.utm_source,
     inferSource(referrerHost)
   );
 
@@ -2744,19 +2843,21 @@ function buildTrackedLinkAttribution(target, parsed, req, journeyState, destinat
     traceId: pickFirstText(params.get('trace_id')),
     source,
     utmSource: pickFirstText(params.get('utm_source'), source),
-    utmMedium: pickFirstText(params.get('utm_medium'), target.defaults && target.defaults.utm_medium, 'link_router'),
-    utmCampaign: pickFirstText(params.get('utm_campaign'), target.defaults && target.defaults.utm_campaign, 'first_party_redirect'),
+    utmMedium: pickFirstText(params.get('utm_medium'), target.defaults?.utm_medium, 'link_router'),
+    utmCampaign: normalizeCampaignId(
+      pickFirstText(params.get('utm_campaign'), target.defaults?.utm_campaign, 'first_party_redirect')
+    ),
     utmContent: pickFirstText(params.get('utm_content')),
     utmTerm: pickFirstText(params.get('utm_term')),
     creator: pickFirstText(params.get('creator'), params.get('creator_handle')),
     community: pickFirstText(params.get('community'), params.get('subreddit')),
     postId: pickFirstText(params.get('post_id')),
     commentId: pickFirstText(params.get('comment_id')),
-    campaignVariant: pickFirstText(params.get('campaign_variant'), target.defaults && target.defaults.campaign_variant),
+    campaignVariant: pickFirstText(params.get('campaign_variant'), target.defaults?.campaign_variant),
     offerCode: pickFirstText(params.get('offer_code')),
     ctaId: pickFirstText(params.get('cta_id'), target.ctaId),
     ctaPlacement: pickFirstText(params.get('cta_placement'), target.ctaPlacement),
-    planId: pickFirstText(params.get('plan_id'), target.defaults && target.defaults.plan_id),
+    planId: pickFirstText(params.get('plan_id'), target.defaults?.plan_id),
     landingPath: pickFirstText(params.get('landing_path'), `/go/${target.slug}`),
     page: `/go/${target.slug}`,
     referrer,
@@ -2805,6 +2906,37 @@ function serveTrackedLinkRedirect({ req, res, parsed, hostedConfig, isHeadReques
 
   const { FEEDBACK_DIR } = getFeedbackPaths();
   const journeyState = resolveJourneyState(req, parsed);
+  const botClassification = classifyRequester(req.headers);
+  if (target.botDeflectPath && botClassification.isBot) {
+    const deflectUrl = new URL(target.botDeflectPath, hostedConfig.appOrigin);
+    appendTrackedLinkQueryParams(deflectUrl, parsed, target);
+    if (!isHeadRequest) {
+      appendBestEffortTelemetry(
+        FEEDBACK_DIR,
+        {
+          eventType: 'checkout_bot_deflected',
+          clientType: 'web',
+          page: `/go/${target.slug}`,
+          reason: botClassification.reason || 'bot',
+          destinationSlug: target.slug,
+          acquisitionId: journeyState.acquisitionId,
+          visitorId: journeyState.visitorId,
+          sessionId: journeyState.sessionId,
+        },
+        req.headers,
+        `tracked_link_bot_deflect:${target.slug}`
+      );
+    }
+    res.writeHead(302, {
+      ...(journeyState.setCookieHeaders.length ? { 'Set-Cookie': journeyState.setCookieHeaders } : {}),
+      'Cache-Control': 'no-store',
+      'X-Robots-Tag': 'noindex,nofollow',
+      'X-ThumbGate-Link-Slug': target.slug,
+      Location: deflectUrl.toString(),
+    });
+    res.end();
+    return;
+  }
   const destinationUrl = buildTrackedLinkDestination(target, hostedConfig, parsed);
   const attribution = buildTrackedLinkAttribution(target, parsed, req, journeyState, destinationUrl);
   if (target.external) {
@@ -3822,6 +3954,12 @@ function renderSitemapXml(runtimeConfig) {
     { path: '/codex-enterprise', changefreq: 'weekly', priority: '0.85' },
     { path: '/agents-cost-savings', changefreq: 'weekly', priority: '0.85' },
     { path: '/ai-malpractice-prevention', changefreq: 'weekly', priority: '0.9' },
+    { path: '/whitepaper', changefreq: 'weekly', priority: '0.9' },
+    { path: '/architecture', changefreq: 'weekly', priority: '0.85' },
+    { path: '/eval-scorecard', changefreq: 'weekly', priority: '0.9' },
+    { path: '/evaluations', changefreq: 'weekly', priority: '0.85' },
+    { path: '/case-studies', changefreq: 'weekly', priority: '0.9' },
+    { path: '/numbers', changefreq: 'weekly', priority: '0.8' },
     { path: '/learn/background-agent-control-layer', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/ac-dc-runtime-enforcement', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/feedback-loop-vs-decision-layer', changefreq: 'weekly', priority: '0.9' },
@@ -5198,9 +5336,10 @@ function createApiServer() {
       sendJson(res, 403, { error: 'project selection is only available on localhost requests' });
       return;
     }
-    const requestFeedbackPaths = getRequestFeedbackPaths(req, parsed);
-    const requestFeedbackDir = requestFeedbackPaths.FEEDBACK_DIR;
-    const requestSafeDataDir = getSafeDataDir(req, parsed);
+    let requestFeedbackPaths = getRequestFeedbackPaths(req, parsed);
+    let requestFeedbackDir = requestFeedbackPaths.FEEDBACK_DIR;
+    let requestSafeDataDir = getSafeDataDir(req, parsed);
+    let requestDocumentAccessContext = null;
 
     // PostHog reverse proxy -- bypasses ad blockers.
     // Only allow known PostHog API paths to prevent SSRF (CodeQL js/request-forgery).
@@ -5273,6 +5412,14 @@ function createApiServer() {
                 ? mcpOauth.tokenAudienceValid(oauthSession, resourceUrl)
                 : rawKeyValid;
               if (!authed) {
+                recordToolCall({
+                  toolName: msg.params?.name || 'unknown',
+                  serverName: 'mcp-http',
+                  latencyMs: 0,
+                  success: false,
+                  agentId: 'unauthenticated',
+                  metadata: { denied: true, deniedReason: 'authentication_required' },
+                });
                 res.writeHead(401, {
                   'Content-Type': 'application/json',
                   // RFC 9728: point unauthenticated clients at the resource metadata.
@@ -5295,6 +5442,14 @@ function createApiServer() {
                 const tool = MCP_TOOLS.find((t) => t.name === name);
                 const readOnly = Boolean(tool && tool.annotations && tool.annotations.readOnlyHint === true);
                 if (!readOnly) {
+                  recordToolCall({
+                    toolName: name || 'unknown',
+                    serverName: 'mcp-http',
+                    latencyMs: 0,
+                    success: false,
+                    agentId: 'reviewer',
+                    metadata: { denied: true, deniedReason: 'reviewer_read_only' },
+                  });
                   sendJson(res, 200, {
                     jsonrpc: '2.0', id: msg.id,
                     error: { code: -32002, message: `Tool "${name}" requires write access; the reviewer credential is read-only.` },
@@ -5302,15 +5457,39 @@ function createApiServer() {
                   return;
                 }
               }
+              if (oauthSession) {
+                const name = msg.params && msg.params.name;
+                const tool = MCP_TOOLS.find((candidate) => candidate.name === name);
+                const requiredScope = tool?.annotations?.readOnlyHint === true ? 'mcp:read' : 'mcp:write';
+                if (!mcpOauth.scopeAllows(oauthSession, requiredScope)) {
+                  recordToolCall({
+                    toolName: name || 'unknown',
+                    serverName: 'mcp-http',
+                    latencyMs: 0,
+                    success: false,
+                    agentId: oauthSession.clientId || 'oauth-client',
+                    metadata: {
+                      denied: true,
+                      deniedReason: 'insufficient_scope',
+                      requiredScope,
+                    },
+                  });
+                  sendJson(res, 200, {
+                    jsonrpc: '2.0', id: msg.id,
+                    error: { code: -32003, message: `OAuth token is missing required scope "${requiredScope}".` },
+                  });
+                  return;
+                }
+              }
               (async () => {
                 try {
                   const { callTool } = require('../../adapters/mcp/server-stdio');
-                  const name = msg.params && msg.params.name;
+                  const name = msg.params?.name;
                   const args = (msg.params && msg.params.arguments) || {};
                   const result = await callTool(name, args);
                   sendJson(res, 200, {
                     jsonrpc: '2.0', id: msg.id,
-                    result: { content: [{ type: 'text', text: typeof result === 'string' ? result : JSON.stringify(result) }] },
+                    result,
                   });
                 } catch (err) {
                   sendJson(res, 200, {
@@ -5593,7 +5772,7 @@ function createApiServer() {
       let trackedParsed = parsed;
       if (req.method === 'POST') {
         const target = getTrackedLinkTarget(trackedLinkMatch[1]);
-        if (!target || !target.requiresPost) {
+        if (!target?.requiresPost) {
           sendJson(res, target ? 405 : 404, target
             ? { error: 'POST is not supported for this tracked link' }
             : { error: 'Tracked link not found', allowed: Object.keys(TRACKED_LINK_TARGETS) }, {
@@ -5612,7 +5791,7 @@ function createApiServer() {
         const form = await parseFormBody(req, 16 * 1024);
         trackedParsed = new URL(parsed.toString());
         for (const [key, value] of Object.entries(form)) {
-          if (key === 'customer_email' || TRACKED_LINK_QUERY_KEYS.includes(key)) {
+          if (key === 'customer_email' || TRACKED_LINK_QUERY_KEYS.has(key)) {
             trackedParsed.searchParams.set(key, String(value || '').trim());
           }
         }
@@ -5684,10 +5863,31 @@ function createApiServer() {
       return;
     }
 
-    // Quick feedback capture via GET — for statusline clickable links
-    if (isGetLikeRequest && pathname === '/feedback/quick') {
+    // GET/HEAD only render a confirmation. Capture requires an authenticated
+    // POST so prefetchers and link checkers cannot create human feedback.
+    if ((isGetLikeRequest || req.method === 'POST') && pathname === '/feedback/quick') {
       const signal = parsed.searchParams.get('signal');
       if (signal === 'up' || signal === 'down') {
+        const emoji = signal === 'up' ? '👍' : '👎';
+        const label = signal === 'up' ? 'Positive' : 'Negative';
+        if (isHeadRequest) {
+          sendHtml(res, 200, '', {}, { headOnly: true });
+          return;
+        }
+        if (req.method === 'GET') {
+          sendHtml(res, 200, `<!DOCTYPE html><html><head><meta charset="utf-8"><title>ThumbGate feedback</title></head>
+<body style="background:#0a0a0a;color:#fff;font-family:system-ui;display:grid;place-items:center;height:100vh;margin:0">
+<form method="post" action="/feedback/quick?signal=${signal}" style="text-align:center;background:#141414;padding:40px;border-radius:16px">
+<div style="font-size:64px">${emoji}</div><h1>Record ${label.toLowerCase()} feedback?</h1>
+<p>This confirmation prevents previews and crawlers from recording feedback.</p>
+<button type="submit" style="padding:10px 20px;font-weight:700">Record ${emoji} feedback</button>
+</form></body></html>`);
+          return;
+        }
+        if (!isAuthorized(req, expectedApiKey)) {
+          sendJson(res, 401, { error: 'Authentication required to record human feedback' });
+          return;
+        }
         const chatHistory = readRecentConversationWindow({
           feedbackDir: requestSafeDataDir,
           limit: 10,
@@ -5697,35 +5897,17 @@ function createApiServer() {
           context: 'Quick capture from Claude Code statusline',
           chatHistory,
           tags: ['statusline', 'quick-capture'],
+          reviewOrigin: 'human',
         });
-        const emoji = signal === 'up' ? '👍' : '👎';
-        const color = signal === 'up' ? '#22c55e' : '#ef4444';
-        const label = signal === 'up' ? 'Positive' : 'Negative';
         const opposite = signal === 'up' ? 'down' : 'up';
         const oppEmoji = signal === 'up' ? '👎' : '👍';
         const feedbackId = result.feedbackEvent?.id || 'saved';
         const promoted = result.accepted ? 'Promoted to memory' : 'Stored';
         sendHtml(res, 200, `<!DOCTYPE html><html><head><meta charset="utf-8"><title>ThumbGate — ${label} feedback</title>
 <style>
-*{box-sizing:border-box}
 body{background:#0a0a0a;color:#fff;font-family:system-ui,-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
 .card{text-align:center;background:#141414;border:1px solid #222;border-radius:16px;padding:48px 40px;max-width:420px;width:90%;box-shadow:0 8px 32px rgba(0,0,0,.5)}
-.emoji{font-size:80px;margin-bottom:12px;animation:pop .4s ease-out}
-@keyframes pop{0%{transform:scale(0)}50%{transform:scale(1.2)}100%{transform:scale(1)}}
-.msg{font-size:22px;color:${color};font-weight:700;margin-bottom:4px}
-.sub{font-size:13px;color:#666;margin-top:6px;font-family:ui-monospace,monospace}
-.context-form{margin-top:20px;text-align:left}
-.context-form label{font-size:12px;color:#888;display:block;margin-bottom:6px}
-.context-form textarea{width:100%;background:#1a1a1a;border:1px solid #333;border-radius:8px;color:#ccc;padding:10px;font-size:13px;resize:vertical;min-height:60px;font-family:system-ui}
-.context-form textarea:focus{outline:none;border-color:${color}}
-.context-form button{margin-top:8px;background:${color};color:#000;border:none;border-radius:8px;padding:8px 20px;font-size:13px;font-weight:600;cursor:pointer}
-.context-form button:hover{opacity:.85}
-.actions{margin-top:24px;display:flex;gap:12px;justify-content:center;flex-wrap:wrap}
-.actions a{color:#22d3ee;text-decoration:none;font-size:13px;padding:8px 16px;border:1px solid #333;border-radius:8px;transition:all .15s}
-.actions a:hover{background:#1a2a2e;border-color:#22d3ee}
-.toast{position:fixed;bottom:24px;left:50%;transform:translateX(-50%);background:#22c55e;color:#000;padding:10px 24px;border-radius:8px;font-size:14px;font-weight:600;display:none;animation:slideUp .3s ease-out}
-@keyframes slideUp{from{opacity:0;transform:translateX(-50%) translateY(12px)}to{opacity:1;transform:translateX(-50%) translateY(0)}}
-.badge{display:inline-block;font-size:11px;padding:2px 8px;border-radius:4px;background:#1a1a1a;border:1px solid #333;color:#888;margin-top:8px}
+.emoji{font-size:64px}.sub,label{color:#888}textarea{width:100%;min-height:60px}.actions{margin-top:20px}.actions a{color:#22d3ee;margin:8px}
 </style></head><body>
 <div class="card">
   <div class="emoji">${emoji}</div>
@@ -5738,7 +5920,7 @@ body{background:#0a0a0a;color:#fff;font-family:system-ui,-apple-system,sans-seri
   </div>
   <div class="actions">
     <a href="/lessons/${feedbackId}" title="View the full lesson and edit it">📋 View Lesson</a>
-    <a href="/feedback/quick?signal=${opposite}" title="Meant to click ${oppEmoji}?">Undo → send ${oppEmoji} instead</a>
+    <a href="/feedback/quick?signal=${opposite}" title="Meant to click ${oppEmoji}?">Record ${oppEmoji} instead</a>
     <a href="/dashboard">Dashboard →</a>
   </div>
 </div>
@@ -5762,6 +5944,10 @@ async function addContext(){
     }
 
     if (req.method === 'POST' && pathname === '/feedback/quick/context') {
+      if (!isAuthorized(req, expectedApiKey)) {
+        sendJson(res, 401, { error: 'Authentication required to update human feedback' });
+        return;
+      }
       const body = await parseJsonBody(req);
       const signal = body.signal;
       const context = typeof body.context === 'string' ? body.context.trim() : '';
@@ -6206,6 +6392,74 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (pathname === '/architecture' || pathname === '/architecture.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(ARCHITECTURE_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'architecture' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Architecture page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/whitepaper' || pathname === '/whitepaper.html' || pathname === '/how-we-know' || pathname === '/how-we-know-it-works')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(WHITEPAPER_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'whitepaper' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'White paper page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/eval-scorecard' || pathname === '/eval-scorecard.html' || pathname === '/scorecard' || pathname === '/bench')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(EVAL_SCORECARD_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'eval_scorecard' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Eval scorecard page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/evaluations' || pathname === '/evaluations.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(EVALUATIONS_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'evaluations' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Evaluations page not found' });
+      }
+      return;
+    }
+
     if (isGetLikeRequest && (pathname === '/federal' || pathname === '/federal.html' || pathname === '/government' || pathname === '/gov')) {
       // Federal lead-gen page. Routed through servePublicMarketingPage so agency
       // arrivals via SBIR / GSA / outbound channels capture UTM attribution and
@@ -6470,7 +6724,7 @@ async function addContext(){
           if (
             key === 'confirm'
             || key === 'customer_email'
-            || TRACKED_LINK_QUERY_KEYS.includes(key)
+            || TRACKED_LINK_QUERY_KEYS.has(key)
           ) {
             parsed.searchParams.set(key, String(value || '').trim());
           }
@@ -6986,7 +7240,8 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           // are configured (production) the key MUST match a configured admin /
           // operator / reviewer key — otherwise OAuth would authenticate nobody.
           // In insecure/dev mode (no keys configured) any non-empty key is accepted.
-          if (!resolveKeyRole(form.get('api_key') || '')) {
+          const keyRole = resolveKeyRole(form.get('api_key') || '');
+          if (!keyRole) {
             sendJson(res, 400, { error: 'access_denied', error_description: 'invalid ThumbGate API key' });
             return;
           }
@@ -6996,6 +7251,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
             codeChallenge: authorizationParams.codeChallenge,
             codeChallengeMethod: authorizationParams.codeChallengeMethod,
             scope: authorizationParams.scope,
+            allowedScopes: keyRole === 'reviewer' ? ['mcp:read'] : mcpOauth.SUPPORTED_SCOPES,
             resource: authorizationParams.resource || buildPublicUrl(hostedConfig, '/mcp'),
             boundKey: form.get('api_key') || '',
             state,
@@ -7039,7 +7295,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       sendJson(res, 200, {
         name: 'thumbgate',
         version: pkg.version,
-        count: MCP_TOOLS.length,
+        count: getPublicMcpTools().length,
         tools: getToolDiscoveryIndex(hostedConfig),
       }, {}, {
         headOnly: isHeadRequest,
@@ -7072,7 +7328,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         });
         return;
       }
-      const tool = MCP_TOOLS.find((candidate) => candidate.name === toolName);
+      const tool = getPublicMcpTools().find((candidate) => candidate.name === toolName);
       if (!tool) {
         sendJson(res, 404, {
           error: 'tool_not_found',
@@ -7088,6 +7344,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         description: tool.description,
         annotations: tool.annotations || {},
         inputSchema: tool.inputSchema,
+        ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),
       }, {}, {
         headOnly: isHeadRequest,
       });
@@ -8078,29 +8335,25 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       return;
     }
 
-    // Public case studies — proof surface for buyers. Conversion-optimization
-    // surface that was missing: thumbgate.ai had no /case-studies, so visitors
-    // landed on CLI install commands without seeing whether anyone actually
-    // got value. First entry is the Aiventyx Teams listing integration: real
-    // third-party CTR signal (5/8 clicks before the /go/teams fix, now routed
-    // through team intake so scope happens before checkout).
-    if (isGetLikeRequest && pathname === '/case-studies') {
-      sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Case Studies — ThumbGate</title><meta name="description" content="Real integrations of ThumbGate's pre-action checks for AI coding agents. Proof, not promises."><style>body{font-family:system-ui,-apple-system,sans-serif;max-width:780px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}h1{font-size:32px;margin:0 0 8px}.lede{color:#6b7280;font-size:18px;margin:0 0 32px}article{border:1px solid #e5e7eb;border-radius:12px;padding:24px;margin-bottom:24px;background:#fff}article h2{margin:0 0 4px;font-size:22px}.meta{color:#6b7280;font-size:13px;margin-bottom:16px}h3{font-size:15px;margin:20px 0 8px;color:#374151;text-transform:uppercase;letter-spacing:0.5px}.metric{display:inline-block;background:#0f172a;color:#fff;padding:4px 10px;border-radius:6px;font-weight:600;font-size:14px;margin:0 4px 4px 0}p{margin:8px 0}a{color:#0066cc}code{background:#f3f4f6;padding:1px 6px;border-radius:4px;font-size:13.5px}footer{margin-top:48px;padding-top:24px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
-<h1>Case Studies</h1>
-<p class="lede">Real integrations. No fabricated logos, no aspirational numbers — every claim below is reproducible.</p>
-
-<p><em>New case studies for individual Pro operators coming soon.</em></p>
-
-<footer>
-<p>Want to be the next case study? The product is real, the integration is 30 seconds: <code>npx thumbgate init</code>. If you ship something with ThumbGate and want it documented here, email <a href="mailto:igor.ganapolsky@gmail.com">igor.ganapolsky@gmail.com</a>.</p>
-<p><a href="https://thumbgate.ai">Home</a> · <a href="/pricing">Pricing</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a> · <a href="/support">Support</a></p>
-</footer>
-</body></html>`, {}, {
-        headOnly: isHeadRequest,
-      });
+    // Public case studies — dogfood proof narratives (static HTML; no fabricated logos).
+    if (isGetLikeRequest && (pathname === '/case-studies' || pathname === '/case-studies.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(CASE_STUDIES_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'case_studies' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Case studies page not found' });
+      }
       return;
     }
 
+
         // Public canonical pricing page. The audit flagged "pricing schizophrenia":
     // sales/pricing.json said $49 / $299, COMMERCIAL_TRUTH.md said $19 / $149,
     // and there was no buyer-facing surface to reconcile the two. This is now
@@ -8255,7 +8508,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           });
           return;
         }
-        if (result && result.retryable === true) {
+        if (result?.retryable === true) {
           sendProblem(res, {
             type: PROBLEM_TYPES.INTERNAL,
             title: 'Fulfillment temporarily unavailable',
@@ -8443,14 +8696,15 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         }
 
         const resolvedTraceId = result.traceId || requestedTraceId;
-        const nextSteps = result.apiKey
-          ? {
+        let nextSteps = {};
+        if (result.apiKey) {
+          nextSteps = {
             env: `THUMBGATE_API_KEY=${result.apiKey}\nTHUMBGATE_API_BASE_URL=${hostedConfig.billingApiBaseUrl}`,
             curl: `curl -X POST ${hostedConfig.billingApiBaseUrl}/v1/feedback/capture \\\n+  -H 'Authorization: Bearer ${result.apiKey}' \\\n+  -H 'Content-Type: application/json' \\\n+  -d '{"signal":"down","context":"example","whatWentWrong":"example","whatToChange":"example"}'`,
-          }
-          : result.offerKind === 'workflow_hardening_diagnostic'
-            ? { fulfillment: 'Payment confirmed. Diagnostic fulfillment is processing; an email will arrive when it completes.' }
-            : {};
+          };
+        } else if (result.offerKind === 'workflow_hardening_diagnostic') {
+          nextSteps = { fulfillment: 'Payment confirmed. Diagnostic fulfillment is processing; an email will arrive when it completes.' };
+        }
 
         sendJson(res, 200, {
           ...result,
@@ -8504,6 +8758,25 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       return;
     }
 
+    // Provisioned hosted keys are authenticated identities, not merely valid
+    // booleans. Bind every private data path to a hash of the billing customer
+    // before any endpoint reads or writes feedback, documents, traces, or jobs.
+    // Static admin/local operation retains the existing single-tenant path.
+    const requestDataIdentity = resolveRequestDataIdentity(req, expectedApiKey);
+    if (requestDataIdentity.invalidHostedIdentity) {
+      sendProblem(res, {
+        type: PROBLEM_TYPES.UNAUTHORIZED,
+        title: 'Unauthorized',
+        status: 403,
+        detail: 'The hosted API key is not bound to a customer identity.',
+      });
+      return;
+    }
+    requestFeedbackPaths = partitionFeedbackPaths(requestFeedbackPaths, requestDataIdentity);
+    requestFeedbackDir = requestFeedbackPaths.FEEDBACK_DIR;
+    requestSafeDataDir = path.resolve(requestFeedbackDir);
+    requestDocumentAccessContext = requestDataIdentity.accessContext;
+
     // Usage metering — record request for billing keys (not static THUMBGATE_API_KEY)
     const _token = extractBearerToken(req);
     if (_token && _token !== expectedApiKey) {
@@ -8514,7 +8787,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       if (req.method === 'GET' && pathname === '/v1/feedback/stats') {
         const stats = shouldAggregateFeedback()
           ? computeAggregateFeedbackStats({ feedbackDir: requestFeedbackPaths.FEEDBACK_DIR })
-          : analyzeFeedback(requestFeedbackPaths.FEEDBACK_LOG_PATH);
+          : analyzeFeedback(requestFeedbackPaths.FEEDBACK_LOG_PATH, { humanOnly: true });
         try {
           const { getStatuslineMeta } = require('../../scripts/statusline-meta');
           const meta = getStatuslineMeta({ env: process.env });
@@ -8524,6 +8797,33 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           stats.tier = 'Pro';
         }
 
+        // Active gates for the dashboard hero cards. Connect only fetches
+        // /v1/feedback/stats first; without these fields Active Gates stays
+        // stuck on the HTML placeholder "—" until a later /v1/dashboard call
+        // succeeds (and never updates if that call fails).
+        try {
+          const { computeGateStats } = require('../../scripts/dashboard');
+          const gateStats = computeGateStats();
+          stats.activeGateCount = Number(gateStats.totalGates) || 0;
+          stats.gateStats = {
+            totalGates: Number(gateStats.totalGates) || 0,
+            manualCount: Number(gateStats.manualCount) || 0,
+            autoCount: Number(gateStats.autoCount) || 0,
+            blocked: Number(gateStats.blocked) || 0,
+            warned: Number(gateStats.warned) || 0,
+          };
+        } catch (error) {
+          debugApiFallback('gate stats unavailable for feedback/stats', error);
+          stats.activeGateCount = 0;
+          stats.gateStats = {
+            totalGates: 0,
+            manualCount: 0,
+            autoCount: 0,
+            blocked: 0,
+            warned: 0,
+          };
+        }
+
         const projectChatSettings = readProjectChatSettings(req, parsed);
 
         stats.geminiConfigured = Boolean(
@@ -9034,6 +9334,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           workflowContract: body.workflowContract,
           repoPath: body.repoPath,
           localOnly: body.localOnly === true,
+          ttlMs: body.ttlMs,
           clear: body.clear === true,
         });
         sendJson(res, 200, { scope });
@@ -9116,7 +9417,8 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
 
       if (req.method === 'GET' && pathname === '/v1/task-outcomes/monitor') {
         const outcomes = readTaskOutcomes({ feedbackDir: requestFeedbackDir });
-        sendJson(res, 200, monitorTaskOutcomes(outcomes));
+        const toolKpis = computeToolKpis({ feedbackDir: requestFeedbackDir });
+        sendJson(res, 200, monitorProductionSignals(outcomes, toolKpis));
         return;
       }
 
@@ -9221,13 +9523,19 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         const signal = parsed.searchParams.get('signal') || null;
         let results;
         try {
-          const requestFeedbackPaths = getRequestFeedbackPaths(req, parsed);
-          results = searchThumbgate({
+          results = await searchThumbgateAsync({
             query,
             limit: Number.isFinite(limit) ? limit : 10,
             source,
             signal,
-            feedbackDir: requestFeedbackPaths.FEEDBACK_DIR,
+            feedbackDir: requestFeedbackDir,
+            metadataFilters: {
+              tags: (parsed.searchParams.get('tags') || '').split(',').map((tag) => tag.trim()).filter(Boolean),
+              sourceFormat: parsed.searchParams.get('sourceFormat') || undefined,
+              sourceType: parsed.searchParams.get('sourceType') || undefined,
+            },
+            queryRewrite: parsed.searchParams.get('queryRewrite') !== 'false',
+            accessContext: requestDocumentAccessContext,
           });
         } catch (err) {
           throw createHttpError(400, err.message || 'Invalid ThumbGate search request');
@@ -9245,13 +9553,15 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         const body = await parseJsonBody(req);
         let results;
         try {
-          const requestFeedbackPaths = getRequestFeedbackPaths(req, parsed);
-          results = searchThumbgate({
+          results = await searchThumbgateAsync({
             query: body.query || body.q || '',
             limit: body.limit,
             source: body.source,
             signal: body.signal,
-            feedbackDir: requestFeedbackPaths.FEEDBACK_DIR,
+            feedbackDir: requestFeedbackDir,
+            metadataFilters: body.filters,
+            queryRewrite: body.queryRewrite !== false,
+            accessContext: requestDocumentAccessContext,
           });
         } catch (err) {
           throw createHttpError(400, err.message || 'Invalid ThumbGate search request');
@@ -9269,6 +9579,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           limit: Number.isFinite(limit) ? limit : 20,
           query,
           tag,
+          accessContext: requestDocumentAccessContext,
         });
         sendJson(res, 200, results);
         return;
@@ -9282,6 +9593,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           }
           const document = readImportedDocument(documentId, {
             feedbackDir: requestFeedbackDir,
+            accessContext: requestDocumentAccessContext,
           });
           if (!document) {
             throw createHttpError(404, `Imported document not found: ${escapeHtml(documentId)}`);
@@ -9329,6 +9641,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           guardrails: body.guardrails,
           tags: extractTags(body.tags),
           skill: body.skill,
+          reviewOrigin: 'human',
         });
         const actionIntegration = inferActionIntegration(body, req.headers);
         appendBestEffortTelemetry(requestFeedbackDir, {
@@ -9413,6 +9726,11 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           tags: extractTags(body.tags),
           proposeGates: body.proposeGates !== false,
           feedbackDir: requestFeedbackDir,
+          accessContext: requestDocumentAccessContext,
+          visibility: body.visibility === 'private' ? 'private' : 'tenant',
+          allowedPrincipals: Array.isArray(body.allowedPrincipals)
+            ? body.allowedPrincipals.map((value) => String(value || '').trim()).filter(Boolean)
+            : [],
         });
         sendJson(res, 201, {
           ok: true,
@@ -9463,14 +9781,19 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           fs.writeFileSync(paths.outputPath, result.jsonl);
         }
 
-        sendJson(res, 200, {
+        const response = {
           pairs: result.pairs.length,
+          pairCount: result.pairs.length,
           errors: result.errors.length,
           learnings: result.learnings.length,
           unpairedErrors: result.unpairedErrors.length,
           unpairedLearnings: result.unpairedLearnings.length,
           outputPath: paths.outputPath,
-        });
+        };
+        if (body.includePairs === true) {
+          response.records = result.pairs;
+        }
+        sendJson(res, 200, response);
         return;
       }
 
@@ -10496,6 +10819,8 @@ module.exports = {
     buildLossAnalyticsResponse,
     buildIntakeAlertRateLimitKey,
     sanitizeHtmlUnsafeJsonValue,
+    buildHostedTenantIdentity,
+    partitionFeedbackPaths,
   },
 };