thumbgate 1.34.3 → 1.35.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.34.3",
+  "version": "1.35.0",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.34.3",
+  "version": "1.35.0",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate.ai",
   "transport": "stdio",

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.34.3", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.35.0", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.34.3", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.35.0", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/forge/forge.yaml

@@ -9,12 +9,12 @@ version: "1"
 skills:
   thumbgate-gate-check:
     description: "ThumbGate PreToolUse gate — blocks known-bad tool calls"
-    command: "npx --yes --package thumbgate@1.34.3 thumbgate gate-check"
+    command: "npx --yes --package thumbgate@1.35.0 thumbgate gate-check"
     trigger: pre_tool_use
 
   thumbgate-feedback:
     description: "ThumbGate feedback capture — logs user prompt context"
-    command: "npx --yes --package thumbgate@1.34.3 thumbgate hook-auto-capture"
+    command: "npx --yes --package thumbgate@1.35.0 thumbgate hook-auto-capture"
     trigger: user_prompt
 
 mcp:
@@ -23,6 +23,6 @@ mcp:
     args:
       - "--yes"
       - "--package"
-      - "thumbgate@1.34.3"
+      - "thumbgate@1.35.0"
       - "thumbgate"
       - "serve"

package/adapters/mcp/server-stdio.js

@@ -328,7 +328,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.34.3' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.35.0' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.34.3",
+        "thumbgate@1.35.0",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -1659,13 +1659,18 @@ function compact() {
 
 function cfo() {
   const args = parseArgs(process.argv.slice(3));
+  const { createCliProgress } = require(path.join(PKG_ROOT, 'scripts', 'cli-progress'));
+  const progress = createCliProgress();
   const { getOperationalBillingSummary } = require(path.join(PKG_ROOT, 'scripts', 'operational-summary'));
+  progress.start('Loading CFO billing summary…');
   getOperationalBillingSummary({
     window: args.window,
     timeZone: args.timezone,
     now: args.now,
+    onProgress: (message) => progress.update(message),
   })
     .then(({ source, summary, fallbackReason }) => {
+      progress.succeed(`Billing summary ready (${source})`);
       console.log(JSON.stringify({
         source,
         fallbackReason,
@@ -1674,6 +1679,7 @@ function cfo() {
       process.exit(0);
     })
     .catch((err) => {
+      progress.fail('CFO billing summary failed');
       console.error(err && err.message ? err.message : err);
       process.exit(1);
     });
@@ -1691,14 +1697,19 @@ function repairGithubMarketplace() {
 
 function northStar() {
   const args = parseArgs(process.argv.slice(3));
+  const { createCliProgress } = require(path.join(PKG_ROOT, 'scripts', 'cli-progress'));
+  const progress = createCliProgress();
   const { getOperationalDashboard } = require(path.join(PKG_ROOT, 'scripts', 'operational-dashboard'));
 
+  progress.start('Loading North Star metrics…');
   getOperationalDashboard({
     window: args.window,
     timeZone: args.timezone,
     now: args.now,
+    onProgress: (message) => progress.update(message),
   })
     .then(({ source, data, fallbackReason }) => {
+      progress.succeed(`North Star ready (${source})`);
       const summary = data.analytics.northStar || {};
       const revenue = data.analytics.revenue || {};
 
@@ -1721,6 +1732,7 @@ function northStar() {
       process.exit(0);
     })
     .catch((err) => {
+      progress.fail('North Star failed');
       console.error(err && err.message ? err.message : err);
       process.exit(1);
     });
@@ -3038,21 +3050,35 @@ function installMcp() {
 
 function dashboard() {
   const args = parseArgs(process.argv.slice(3));
+  const { createCliProgress } = require(path.join(PKG_ROOT, 'scripts', 'cli-progress'));
+  const progress = createCliProgress();
+
   if (args.open || args.web) {
     const { resolveProjectDir } = require(path.join(PKG_ROOT, 'scripts', 'feedback-paths'));
     const projectDir = resolveProjectDir({ cwd: process.cwd(), env: process.env });
     const port = process.env.PORT || 3456;
     const url = `http://127.0.0.1:${port}/dashboard?project=${encodeURIComponent(projectDir)}`;
 
+    progress.start(`Starting local dashboard on :${port}…`);
     ensureDash(Number(port))
       .then((server) => {
+        // Keep the stable stdout contract: scripts/tests parse `API <port> pid <n>`.
+        // Progress stays on stderr so humans still see a spinner without breaking parsers.
         if (server.started) {
           console.log(`API ${port} pid ${server.pid}`);
+          progress.update(`Local API listening (pid ${server.pid})…`);
+        } else {
+          progress.update('Local API already running…');
         }
+        progress.update('Opening browser…');
         return openBrowser(url);
       })
-      .then(() => process.exit(0))
+      .then(() => {
+        progress.succeed(`Dashboard open: ${url}`);
+        process.exit(0);
+      })
       .catch((err) => {
+        progress.fail('Failed to open local dashboard');
         console.error(err && err.message ? err.message : err);
         process.exit(1);
       });
@@ -3062,16 +3088,25 @@ function dashboard() {
   const { printDashboard } = require(path.join(PKG_ROOT, 'scripts', 'dashboard'));
   const { getOperationalDashboard } = require(path.join(PKG_ROOT, 'scripts', 'operational-dashboard'));
 
+  progress.start('Loading ThumbGate dashboard…');
   getOperationalDashboard({
     window: args.window,
     timeZone: args.timezone,
     now: args.now,
+    onProgress: (message) => progress.update(message),
   })
-    .then(({ data }) => {
+    .then(({ data, source }) => {
+      const sourceLabel = source === 'hosted'
+        ? 'hosted'
+        : source === 'local-unverified'
+          ? 'local (hosted unavailable)'
+          : 'local';
+      progress.succeed(`Dashboard ready (${sourceLabel})`);
       printDashboard(data);
       process.exit(0);
     })
     .catch((err) => {
+      progress.fail('Dashboard failed');
       console.error(err && err.message ? err.message : err);
       process.exit(1);
     });

package/config/gate-templates.json

@@ -660,6 +660,78 @@
       "problem": "Blocks any file edit or write tool call that is not within a specified active/target directory.",
       "roi": "Restricts agent edits to a controlled workspace, preventing scope drift, accidental modification of configuration or source files, and unwanted global refactors during focused task debugging.",
       "rollout": "Enable dynamically on-demand using /freeze to specify the only path(s) the agent is allowed to write to during the session."
+    },
+    {
+      "id": "block-vlt-install-vulnerable-deps",
+      "name": "Block vlt install of vulnerable dependencies",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(vlt\\s+install|vlt\\s+add).*?(--audit\\s+critical|vuln|cve|high-severity|known-vuln|left-pad|event-stream|colors|unsafe|insecure|deprecated|obsolete|legacy|vulnerable|unresolved-cve)",
+      "problem": "Blocks vlt install/add of packages flagged with --audit critical or known-vulnerable CVE references (e.g. left-pad, event-stream, colors). vlt's hosted registry provides real-time vulnerability scanning; agents must not bypass the audit pipeline.",
+      "roi": "Prevents supply-chain compromise via known-vulnerable dependencies. Direct 1st-order risk: left-pad-style incidents cause cascading production outages. Second-order: agents that install without audit never learn to check. Captured feedback (thumbgate capture --tag supply-chain-security) turns each bypass into a prevention rule.",
+      "rollout": "Require --audit critical on all vlt install/add. Block packages with known CVE references. Auto-capture feedback for each bypass attempt."
+    },
+    {
+      "id": "require-review-vlt-registry-override",
+      "name": "Require review for vlt registry override to non-approved hosts",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(vlt\\s+config\\s+set|vlt\\s+registry\\s+add|vlt\\s+set\\s+registry).*(registry|registry-url|self-host|override|redirect|mirror|vsr)",
+      "problem": "Blocks vlt registry configuration that redirects dependency resolution to non-approved self-hosted VSR or mirror hosts. Agents must only pull from allowlisted registries (vlt.sh, registry.npmjs.org, approved internal VSR).",
+      "roi": "High: Prevents supply-chain attacks via rogue registry configuration. Critical for enterprise on-prem/air-gapped environments where vlt's self-hosted VSR is the approved source. Captured feedback (thumbgate capture --tag registry-override) generates prevention rules for unauthorized redirect patterns.",
+      "rollout": "Block all registry-setting commands for non-allowlisted hosts. Warn (human review) for internal VSR. Allowlist vlt.sh, registry.npmjs.org, and approved internal domains."
+    },
+    {
+      "id": "enforce-vlt-workspace-dep-pinning",
+      "name": "Enforce pinned dependency versions in vlt workspace installs",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(vlt\\s+add|vlt\\s+install).*?(@\\s*(?:\\^|~|>|<|>=|<=|\\*|latest|next))",
+      "problem": "Blocks vlt add/install with unpinned (wildcard, range, latest/next) dependency versions. vlt workspace installs with @*, @^, @~, @>, @<, @>=, @<=, @latest, @next resolve to potentially vulnerable latest versions instead of audited pinned versions.",
+      "roi": "Pinned dependencies are the bedrock of reproducible builds and vulnerability scanning. vlt's hosted registry provides lockfiles by default; agents must respect them. Feedback (thumbgate capture --tag dep-pinning) from each bypass generates a rule for the specific unpinned package pattern.",
+      "rollout": "Enforce exact version pinning in workspace vlt add/install. Block @* ^ ~ > < >= <= latest next. Allow exact versions like @4.18.2."
+    },
+    {
+      "id": "gate-vlt-package-publishing",
+      "name": "Gate vlt package publishing for provenance and scope safety",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(vlt\\s+publish|vlt\\s+pack|npm\\s+publish).*(no-provenance|unsigned|no-2fa|no-attestation|typosquat|squat|unscoped|no-scope)",
+      "problem": "Blocks vlt/npm publish of packages without provenance attestation, 2FA, or proper scope/access controls. vlt's hosted registry supports provenance; agents must not publish unsigned or unscoped packages.",
+      "roi": "Prevents typosquatting and supply-chain attacks via unsigned package publishing. Aligns with vlt's security posture and npm provenance ecosystem. Captures high-value feedback for prevention rules.",
+      "rollout": "Require provenance attestation and 2FA for all vlt publish operations. Block publishes to scopes matching existing packages (typosquatting detection)."
+    },
+    {
+      "id": "block-vlt-private-registry-bypass",
+      "name": "Block vlt private registry bypass via npmrc or env override",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(\\.npmrc|vlt.*config|NPM_CONFIG_REGISTRY|VLT_REGISTRY).*(https?://(?!(?:registry\\.npmjs\\.org|vlt\\.sh|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))[\\w.-]+)",
+      "problem": "Blocks vlt/npm configuration that redirects dependency resolution to unapproved private or external registries via .npmrc, environment variables, or CLI config overrides.",
+      "roi": "High: Prevents data exfil and supply-chain compromise via rogue registry configuration. Critical for enterprise on-prem/air-gapped environments where vlt's self-hosted VSR is used.",
+      "rollout": "Block all registry overrides to non-allowlisted hosts. Allowlist vlt.sh, registry.npmjs.org, and approved internal VSR domains."
+    },
+    {
+      "id": "validate-context-before-codegen",
+      "name": "Validate context freshness and relevance before code generation",
+      "category": "AI Engineering Stack Safety",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(Edit|Write|MultiEdit|StrReplace).*",
+      "problem": "Agents frequently generate code without first ensuring AGENTS.md, CLAUDE.md, test infrastructure, and ownership context are fresh and relevant. Per the Hugging Face Context Course: 'an agent is only as good as the context it has.' Results in style violations, wrong test commands, and rework.",
+      "roi": "Eliminates rework from stale or missing project context. Direct 1st-order improvement to context-engineering workflows (Hugging Face Context Course Units 1-3). Reduces PR churn and review cycles.",
+      "rollout": "Before any Edit/Write/MultiEdit, verify AGENTS.md exists and is fresh (modified within last 7 days). Require explicit context-freshness check before code edits. Capture feedback with 'missing-context' and 'stale-context' tags."
     }
   ]
 }

package/config/gates/default.json

@@ -180,6 +180,19 @@
         "CWE-863"
       ]
     },
+    {
+      "id": "outbound-email-send",
+      "layer": "Execution",
+      "trigger": "any:outbound_email_send",
+      "pattern": "(?:(?:^|[_.])send[_-]?(?:message|mail|email|now|draft)s?\\b|emailer[_-]?messages?[_-]?send|(?:^|[_.])send_draft\\b|users\\/[^/\\s\"\\']+\\/messages\\/send|\\bmessages\\/send\\b|messages\\s*\\(\\s*\\)\\s*\\.\\s*send\\s*\\(|users\\s*\\(\\s*\\)\\s*\\.\\s*messages\\s*\\(\\s*\\)\\s*\\.\\s*send\\b|(?:^|[\\s;/])sendmail\\b|\\bmsmtp\\b|\\bmailx?\\s+-s\\b|(?:import\\s+smtplib|from\\s+smtplib\\b|\\bsmtplib\\.SMTP\\b)|(?:require\\s*\\(\\s*[\\'\"]nodemailer[\\'\"]\\s*\\)|from\\s+[\\'\"]nodemailer[\\'\"]|nodemailer\\.createTransport)|createTransport\\s*\\()",
+      "action": "block",
+      "message": "Outbound email SEND is blocked. Save a draft instead; a human reviews Drafts and sends personally. create_draft / update_draft / list_drafts remain allowed.",
+      "severity": "critical",
+      "compliance": [
+        "SOC2-CC6.1",
+        "CWE-285"
+      ]
+    },
     {
       "id": "git-reset-hard",
       "layer": "Execution",

package/config/merge-quality-checks.json

@@ -20,6 +20,9 @@
     "cancel"
   ],
   "selfReferentialChecks": [
-    "Trunk Merge Queue (main)"
+    "Trunk Merge Queue (main)",
+    "SonarCloud Code Analysis",
+    "SonarCloud",
+    "Merge blob reports"
   ]
 }

package/config/model-candidates.json

@@ -133,6 +133,48 @@
         "medianLatencyMs",
         "costPerEvolutionUsd"
       ]
+    },
+    "js-package-registry-governance": {
+      "label": "JavaScript package registry governance",
+      "summary": "Governance, gating, and supply-chain enforcement for agents consuming and publishing JavaScript packages via npm, vlt registry, and self-hosted VSR (serverless registry). Pre-action checks for dependency installation, registry override, provenance attestation, and workspace dependency pinning.",
+      "desiredStrengths": ["agentic-coding", "tool-use", "supply-chain-security", "reliability", "security", "audit-trail"],
+      "targetContextWindow": 64000,
+      "benchmarkCommands": [
+        "npx thumbgate eval --from-feedback --json --min-score=0",
+        "node scripts/gate-eval.js run",
+        "npx thumbgate bench --json --min-score=90"
+      ],
+      "metrics": [
+        "passRate",
+        "falsePositiveRate",
+        "dependencyAuditRecall",
+        "typosquattingDetectionRate",
+        "registryOverrideBlockRate",
+        "provenanceAttestationRate",
+        "medianLatencyMs",
+        "costPer1kActionsUsd"
+      ]
+    },
+    "context-engineering": {
+      "label": "Context engineering for AI code agents",
+      "summary": "Evaluating models on context structuring, skill synthesis, MCP tool governance, sub-agent coordination, and hook-based lifecycle automation for AI code agent workflows (Claude Code, Codex, OpenCode). Based on the Hugging Face Context Course curriculum.",
+      "desiredStrengths": ["agentic-coding", "tool-use", "context-structuring", "skill-synthesis", "MCP-governance", "reliability", "long-horizon-coding"],
+      "targetContextWindow": 128000,
+      "benchmarkCommands": [
+        "npx thumbgate eval --from-feedback --json --min-score=0",
+        "node scripts/gate-eval.js run",
+        "npx thumbgate bench --json --min-score=90"
+      ],
+      "metrics": [
+        "passRate",
+        "contextFreshnessRate",
+        "skillValidationAccuracy",
+        "mcpToolSafetyRate",
+        "subagentCoordinationCompliance",
+        "falsePositiveRate",
+        "medianLatencyMs",
+        "costPer1kActionsUsd"
+      ]
     }
   },
   "candidates": [
@@ -329,6 +371,39 @@
       "costClass": "medium",
       "strengths": ["agentic-coding", "tool-use", "reliability", "long-context", "data-analysis", "cost-efficiency"],
       "notes": "Google's 3.1 Pro Preview model with 55.5 Coding Index and massive 2M token context window. Strong choice for complex RAG tasks, repository-scale auditing, and long-context trace analysis."
+    },
+    {
+      "id": "vlt/vlt-registry-hosted",
+      "vendor": "vlt",
+      "family": "javascript-package-registry",
+      "provider": "vlt",
+      "model": "hosted-registry",
+      "contextWindow": 10000,
+      "costClass": "low",
+      "strengths": ["supply-chain-security", "package-management", "audit-trail", "reliability", "security"],
+      "notes": "vlt's hosted package registry service (launched Aug 2026) with secure npm mirror, private registries, and VSR (self-hosted serverless registry). ThumbGate gates integrate via preToolUse hooks on vlt install/add/publish and registry config overrides. Pair with require-local-dependency-vulnerability-scan and gate-vlt-package-publishing templates. See adapters/vlt/VLT.md and https://vlt.io/blog/1-0."
+    },
+    {
+      "id": "vlt/vlt-vsr-self-hosted",
+      "vendor": "vlt",
+      "family": "javascript-package-registry",
+      "provider": "vlt",
+      "model": "self-hosted-vsr",
+      "contextWindow": 10000,
+      "costClass": "low",
+      "strengths": ["supply-chain-security", "package-management", "on-prem", "airgap", "audit-trail", "security"],
+      "notes": "vlt's self-hosted VSR (serverless registry) for enterprise on-prem and air-gapped environments. ThumbGate's block-vlt-private-registry-bypass and require-review-vlt-registry-override gate templates enforce approved registry hosts. Critical for enterprises where most data is not cloud-native."
+    },
+    {
+      "id": "huggingface/context-engineering-agent",
+      "vendor": "Hugging Face",
+      "family": "context-engineering",
+      "provider": "huggingface",
+      "model": "context-engineering-agent",
+      "contextWindow": 200000,
+      "costClass": "low",
+      "strengths": ["context-structuring", "skill-synthesis", "MCP-governance", "agentic-coding", "tool-use", "reliability"],
+      "notes": "Model optimized for the Hugging Face Context Course curriculum — context engineering for AI code agents (Claude Code, Codex, OpenCode). Excels at structuring knowledge so agents find context efficiently. Evaluated on MCP tool governance, skill synthesis validation, and hook-based lifecycle automation. See docs/guides/huggingface-context-course-governance.md and adapters/huggingface-context-course/."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.34.3",
+  "version": "1.35.0",
   "description": "ThumbGate Pre-Action Checks self-improve from ranked lessons and repeated failures, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -64,6 +64,7 @@
     "scripts/cli-status.js",
     "scripts/cli-telemetry.js",
     "scripts/cli-test-block.js",
+    "scripts/cli-progress.js",
     "scripts/cloudflare-dynamic-sandbox.js",
     "scripts/code-graph-guardrails.js",
     "scripts/code-mode-mcp-plan.js",
@@ -81,6 +82,7 @@
     "scripts/dashboard-chat.js",
     "scripts/dashboard-render-spec.js",
     "scripts/dashboard.js",
+    "scripts/dashboard-limits.js",
     "scripts/decision-journal.js",
     "scripts/deepseek-v4-runtime-guardrails.js",
     "scripts/docker-sandbox-planner.js",
@@ -463,7 +465,7 @@
     "social:prospect:bluesky": "node scripts/social-bluesky-prospecting.js",
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:proof-pack-cadence && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:canary && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:verification-evidence && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:universal-claim-evaluator && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:glama-mcp && npm run test:prove-glama-mcp && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:rag-pipeline && npm run test:autonomous-reliability && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation && npm run test:retrieval-window && npm run test:risk-quality && npm run test:eval-mining && npm run test:state-backup && npm run test:eval-golden && npm run test:task-scope-lease && npm run test:evaluations-page && npm run test:agent-install-paths && npm run test:mcp-gate-check && npm run test:adapter-pins && npm run test:secret-egress && npm run test:harness-tool-names && npm run test:feedback-reward && npm run test:capability-wiring",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:proof-pack-cadence && npm run test:grafana-revenue-evidence && npm run test:billing && npm run test:billing-setup && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:canary && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:release-window && npm run test:check-congruence && npm run test:tool-registry && npm run test:repeat-metric && npm run test:noop-detect && npm run test:action-receipts && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:mcp-tool-annotations && npm run test:mcp-oauth && npm run test:mcp-oauth-flow && npm run test:plan-gate && npm run test:ai-component-inventory && npm run test:verification-evidence && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:entitlement && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:imperative-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:statusline-cache-aggregate && npm run test:public-repo-hygiene && npm run test:no-internal-orchestration-leaks && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:lesson-semantic-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:predictive-credible-range && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:vlt && npm run test:hf-context && npm run test:proof-common && npm run test:xss-checkout-escape && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:pricing-page-telemetry && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:universal-claim-evaluator && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:stop-hook-json-contract && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:activation-onboarding && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:jsonl-window && npm run test:observability-env && npm run test:glama-mcp && npm run test:prove-glama-mcp && npm run test:public-bundle-ratchet && npm run test:pack-runtime-integrity && npm run test:hook-self-protection && npm run test:self-protect-enforcement && npm run test:never-bypass-branch-protection && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster && npm run test:proof:truth && node --test tests/adaptive-reliability.test.js && npm run test:mcp-oauth-reviewer && npm run test:dfcx-gate && npm run test:dfcx-gate-server && npm run test:vertex-scorer && npm run test:dashboard-chat && npm run test:gitar-integration && npm run test:secret-redaction && npm run test:discoverable-skills && npm run test:discoverable-skill-skills && npm run test:sync-telemetry && npm run test:leak-scanner && npm run test:team-sync && npm run test:rag-pipeline && npm run test:autonomous-reliability && npm run test:eval-rag && npm run test:async-eval-observability && npm run test:letta-adapter && npm run test:policy-engine-adapter && npm run test:tool-contract-validator && npm run test:check-update && npm run test:hermes-gate && npm run test:memory-provider-enforcement-bridge && npm run test:publisher-credential-guards && npm run test:reddit-browser-notification-watch && npm run test:payment-rails && npm run test:service-checkout-price-integrity && npm run test:cursor-marketplace-doctor && npm run test:plugin-hooks-manifest && npm run test:okara-money-promo-automation && npm run test:retrieval-window && npm run test:risk-quality && npm run test:eval-mining && npm run test:state-backup && npm run test:eval-golden && npm run test:task-scope-lease && npm run test:evaluations-page && npm run test:agent-install-paths && npm run test:mcp-gate-check && npm run test:adapter-pins && npm run test:secret-egress && npm run test:harness-tool-names && npm run test:feedback-reward && npm run test:capability-wiring",
     "test:python": "python3 -m pytest tests/*.py",
     "test:check-update": "node --test tests/check-update.test.js",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
@@ -617,7 +619,7 @@
     "test:ops": "node --test tests/qa-scenario-planner.test.js tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/financial-control-plane.test.js tests/financial-spend-attack-matrix.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js tests/auto-promote-regression-gate.test.js tests/install-spend-guard.test.js tests/spend-guard-path-precision.test.js tests/spend-guard-hook-contract.test.js tests/enforcement-provenance.test.js",
     "test:session-analyzer": "node --test tests/session-analyzer.test.js",
     "test:tessl": "node --test tests/tessl-export.test.js",
-    "test:gates": "node --test --test-concurrency=1 tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/universal-claim-evaluator.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js tests/git-pathspec-scope.test.js tests/git-global-option-bypass.test.js tests/gate-evasion-matrix.test.js",
+    "test:gates": "node --test --test-concurrency=1 tests/gate-templates.test.js tests/gates-engine.test.js tests/gates-engine-outbound-email.test.js tests/claim-verification.test.js tests/universal-claim-evaluator.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js tests/git-pathspec-scope.test.js tests/git-global-option-bypass.test.js tests/gate-evasion-matrix.test.js",
     "test:budget": "node --test tests/budget-guard.test.js tests/budget-enforcer.test.js tests/tokenomics-cost-guard.test.js tests/hook-no-budget-lockout.test.js",
     "test:workers": "npm --prefix workers ci && npm --prefix workers test",
     "test:evoskill": "node --test tests/evoskill.test.js",
@@ -803,7 +805,10 @@
     "test:interaction-model": "node --test tests/interaction-model.test.js tests/interaction-model-e2e.test.js",
     "aws-blocks:guardrails": "node scripts/aws-blocks-guardrails.js",
     "test:aws-blocks-guardrails": "node --test tests/aws-blocks-guardrails.test.js",
-    "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js tests/aws-blocks-guardrails.test.js",
+    "test:vlt": "node --test tests/vlt-proof.test.js",
+    "test:hf-context": "node --test tests/hf-context-course.test.js",
+    "test:proof-common": "node --test tests/proof-common.test.js",
+    "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js tests/aws-blocks-guardrails.test.js tests/vlt-proof.test.js tests/hf-context-course.test.js tests/proof-common.test.js",
     "test:public-static-assets": "node --test tests/public-static-assets.test.js tests/public-checkout-intent-gate.test.js tests/public-enterprise-capability-boundary.test.js",
     "test:token-savings": "node --test tests/token-savings.test.js",
     "test:cost-cli": "node --test tests/cost-cli.test.js tests/conversion-receipt.test.js",
@@ -857,7 +862,7 @@
     "test:mcp-oauth-reviewer": "node --test tests/mcp-oauth-reviewer.test.js",
     "test:dashboard-chat": "node --test tests/dashboard-chat.test.js",
     "test:gitar-integration": "node --test tests/gitar-integration.test.js",
-    "test:api": "node --test --test-concurrency=1 tests/api-server.test.js tests/api-events-sse.test.js tests/api-auth-config.test.js tests/mcp-server.test.js tests/adapters.test.js tests/openapi-parity.test.js tests/budget-guard.test.js tests/context-manager.test.js tests/contextfs.test.js tests/job-api.test.js tests/pack-templates.test.js tests/dashboard.test.js tests/dashboard-render-spec.test.js tests/dashboard-html.test.js tests/agent-readiness.test.js tests/mcp-policy.test.js tests/subagent-profiles.test.js tests/intent-router.test.js tests/internal-agent-bootstrap.test.js tests/lesson-search.test.js tests/thumbgate-search.test.js tests/document-intake.test.js tests/rubric-engine.test.js tests/self-healing-check.test.js tests/self-heal.test.js tests/feedback-schema.test.js tests/thompson-sampling.test.js tests/feedback-sequences.test.js tests/diversity-tracking.test.js tests/vector-store.test.js tests/gemini-embedding-policy.test.js tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js tests/loop-closure.test.js tests/code-reasoning.test.js tests/feedback-loop.test.js tests/feedback-inbox-read.test.js tests/feedback-to-memory.test.js tests/test-coverage.test.js tests/version-metadata.test.js tests/claude-mcpb.test.js tests/claude-codex-bridge.test.js tests/cursor-plugin.test.js tests/codex-plugin.test.js tests/ide-marketplace-extensions.test.js tests/telemetry-analytics.test.js tests/public-landing.test.js tests/lessons-page.test.js tests/pro-landing.test.js tests/local-model-profile.test.js tests/risk-scorer.test.js tests/context-compaction.test.js tests/reminder-engine.test.js tests/verification-loop.test.js tests/async-job-runner.test.js tests/commerce-quality.test.js tests/recall-limit.test.js tests/problem-detail.test.js tests/natural-language-harness.test.js tests/settings-hierarchy.test.js tests/classifier-routing.test.js",
+    "test:api": "node --test --test-concurrency=1 tests/api-server.test.js tests/api-events-sse.test.js tests/api-auth-config.test.js tests/mcp-server.test.js tests/adapters.test.js tests/openapi-parity.test.js tests/budget-guard.test.js tests/context-manager.test.js tests/contextfs.test.js tests/job-api.test.js tests/pack-templates.test.js tests/dashboard.test.js tests/dashboard-jsonl-bound.test.js tests/dashboard-limits.test.js tests/cli-progress.test.js tests/dashboard-render-spec.test.js tests/dashboard-html.test.js tests/agent-readiness.test.js tests/mcp-policy.test.js tests/subagent-profiles.test.js tests/intent-router.test.js tests/internal-agent-bootstrap.test.js tests/lesson-search.test.js tests/thumbgate-search.test.js tests/document-intake.test.js tests/rubric-engine.test.js tests/self-healing-check.test.js tests/self-heal.test.js tests/feedback-schema.test.js tests/thompson-sampling.test.js tests/feedback-sequences.test.js tests/diversity-tracking.test.js tests/vector-store.test.js tests/gemini-embedding-policy.test.js tests/feedback-attribution.test.js tests/hybrid-feedback-context.test.js tests/loop-closure.test.js tests/code-reasoning.test.js tests/feedback-loop.test.js tests/feedback-inbox-read.test.js tests/feedback-to-memory.test.js tests/test-coverage.test.js tests/version-metadata.test.js tests/claude-mcpb.test.js tests/claude-codex-bridge.test.js tests/cursor-plugin.test.js tests/codex-plugin.test.js tests/ide-marketplace-extensions.test.js tests/telemetry-analytics.test.js tests/public-landing.test.js tests/lessons-page.test.js tests/pro-landing.test.js tests/local-model-profile.test.js tests/risk-scorer.test.js tests/context-compaction.test.js tests/reminder-engine.test.js tests/verification-loop.test.js tests/async-job-runner.test.js tests/commerce-quality.test.js tests/recall-limit.test.js tests/problem-detail.test.js tests/natural-language-harness.test.js tests/settings-hierarchy.test.js tests/classifier-routing.test.js",
     "test:leak-scanner": "node --test tests/leak-scanner.test.js",
     "test:tool-contract-validator": "node --test tests/tool-contract-validator.test.js",
     "test:letta-adapter": "node --test tests/letta-adapter.test.js",
@@ -912,6 +917,10 @@
     "explore:reliability:ci": "node scripts/prove-reliability.js --seed=42 --iterations=10",
     "test:glama-mcp": "node --test tests/glama-mcp-start-contract.test.js",
     "prove:glama-mcp": "node scripts/prove-glama-mcp-start.js",
+    "prove:vlt-governance": "node --test tests/vlt-proof.test.js",
+    "prove:hf-context-course": "node --test tests/hf-context-course.test.js",
+    "prove:vlt-governance-harness": "node scripts/prove-vlt.js",
+    "prove:hf-context-course-harness": "node scripts/prove-hf-context.js",
     "test:prove-glama-mcp": "node --test tests/prove-glama-mcp-start.test.js",
     "test:agent-install-paths": "node --test tests/agent-install-paths.test.js",
     "test:mcp-gate-check": "node --test tests/mcp-gate-check-tool.test.js",
@@ -919,7 +928,7 @@
     "test:secret-egress": "node --test tests/secret-egress-gate.test.js",
     "test:harness-tool-names": "node --test tests/harness-tool-names.test.js",
     "test:feedback-reward": "node --test tests/feedback-reward-score.test.js",
-    "test:capability-wiring": "node --test tests/capability-wiring-ratchet.test.js",
+    "test:capability-wiring": "node --test tests/capability-wiring-ratchet.test.js && node --test tests/prove-vlt-dogfood.test.js && node --test tests/context-engineering-checklist.test.js",
     "test:llm-gateway": "node --test tests/llm-gateway-provider.test.js",
     "test:request-envelope": "node --test tests/request-envelope.test.js",
     "test:a-plus-evidence": "node --test tests/a-plus-evidence-scorecard.test.js",
@@ -928,7 +937,10 @@
     "verify:claims": "node scripts/universal-claim-evaluator.js",
     "spend-guard:install": "node scripts/install-spend-guard.js",
     "spend-guard:diff": "node docs/guard/spend-guard-decision-diff.js",
-    "enforcement:provenance": "node scripts/enforcement-provenance-check.js"
+    "enforcement:provenance": "node scripts/enforcement-provenance-check.js",
+    "prove:vlt": "node scripts/prove-vlt-dogfood.js",
+    "test:vlt-dogfood": "node --test tests/prove-vlt-dogfood.test.js",
+    "test:context-engineering": "node --test tests/context-engineering-checklist.test.js"
   },
   "keywords": [
     "mcp",
@@ -983,7 +995,7 @@
     "node": ">=18.18.0"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "0.102.0",
+    "@anthropic-ai/sdk": "0.115.0",
     "@google/genai": "2.7.0",
     "@lancedb/lancedb": "^0.30.0",
     "apache-arrow": "^18.1.0",

package/public/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="generator" content="ThumbGate">
   <meta name="author" content="Igor Ganapolsky">
-  <meta name="thumbgate-version" content="1.34.3">
+  <meta name="thumbgate-version" content="1.35.0">
   __GOOGLE_SITE_VERIFICATION_META__
   <link rel="icon" type="image/png" href="/thumbgate-icon.png">
   <link rel="canonical" href="__APP_ORIGIN__/">
@@ -942,7 +942,7 @@ next      decision recorded before execution</pre>
 
   <footer>
     <div class="shell footer-inner">
-      <span>ThumbGate · MIT License · npm v1.34.3</span>
+      <span>ThumbGate · MIT License · npm v1.35.0</span>
       <div class="footer-links">
         <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
         <a href="/guide">Technical setup</a>

package/public/numbers.html

@@ -25,7 +25,7 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.34.3",
+  "softwareVersion": "1.35.0",
   "url": "https://thumbgate-production.up.railway.app/numbers",
   "dateModified": "2026-08-03",
   "creator": {
@@ -202,7 +202,7 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-08-03 · Version 1.34.3</div>
+  <div class="freshness">Updated: 2026-08-03 · Version 1.35.0</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>