thumbgate 1.34.3 → 1.37.1

package/adapters/workos/WORKOS.md

@@ -0,0 +1,52 @@
+# WorkOS + ThumbGate (identity vs pre-action gates)
+
+## Split of responsibility
+
+| Concern | WorkOS AuthKit / MCP Auth | ThumbGate |
+|---------|---------------------------|-----------|
+| Who is the user/org? | SSO, social login, orgs, SCIM (paid) | — |
+| OAuth for MCP servers | AuthKit as OAuth 2.1 AS; scopes → RBAC | Remote MCP OAuth 2.1 PKCE (`scripts/mcp-oauth.js`) |
+| What may this tool call do *now*? | Scope admission only | Pre-action gates, lessons, prevention rules |
+| Agent skill install / auth scaffold | WorkOS CLI / widget skills | Gate: `review-workos-skill-and-auth-installer-actions` |
+
+**One line for buyers:** WorkOS (or any IdP) decides *who* the agent is. ThumbGate decides *which tool calls may run*.
+
+## ThumbGate production policy ($10/mo)
+
+Public `thumbgate.app` auth uses **WorkOS Production AuthKit only**:
+
+- AuthKit host: `progressive-mouse-13.authkit.app`
+- Production client id: `client_01KY0306CYDV6QSXE43QKM2ZXW`
+- Allowed under cap: email + password, **own** social OAuth apps (Google free under AuthKit MAU tier)
+- **Forbidden without budget rewrite:** custom AuthKit domain (~$99/mo), enterprise SSO/SAML connections (~$125/conn), Directory Sync, public traffic on staging AuthKit
+
+Guard (secret-free):
+
+```bash
+node scripts/workos-production-guard.js --json
+npm run prove:workos
+```
+
+## MCP OAuth scopes (hierarchy)
+
+ThumbGate remote MCP supports:
+
+| Scope | Allows |
+|-------|--------|
+| `mcp:read` | Tools with `readOnlyHint: true` |
+| `mcp:gates` | Gate-evaluation tools (+ read) |
+| `mcp:feedback` | Feedback capture tools (+ read) |
+| `mcp:write` | Mutating tools **and** everything above |
+
+`mcp:write` **implies** read/gates/feedback so operator tokens are not fail-closed on read-only tools (WorkOS-style role implication).
+
+## Complementary, not competitive
+
+Do not pitch ThumbGate as “WorkOS for agents.” Pitch as the **runtime prevention layer after identity** — the same gap as claw-style enterprise agents and GDG “dark agent” demos (poisoned specs, secret egress, destructive tool use).
+
+## Related
+
+- `scripts/workos-production-guard.js`
+- `scripts/mcp-oauth.js`
+- `scripts/prove-workos.js`
+- Gate category: **Enterprise Identity & MCP Auth Governance** in `config/gate-templates.json`

package/bin/cli.js

@@ -1659,13 +1659,18 @@ function compact() {
 
 function cfo() {
   const args = parseArgs(process.argv.slice(3));
+  const { createCliProgress } = require(path.join(PKG_ROOT, 'scripts', 'cli-progress'));
+  const progress = createCliProgress();
   const { getOperationalBillingSummary } = require(path.join(PKG_ROOT, 'scripts', 'operational-summary'));
+  progress.start('Loading CFO billing summary…');
   getOperationalBillingSummary({
     window: args.window,
     timeZone: args.timezone,
     now: args.now,
+    onProgress: (message) => progress.update(message),
   })
     .then(({ source, summary, fallbackReason }) => {
+      progress.succeed(`Billing summary ready (${source})`);
       console.log(JSON.stringify({
         source,
         fallbackReason,
@@ -1674,6 +1679,7 @@ function cfo() {
       process.exit(0);
     })
     .catch((err) => {
+      progress.fail('CFO billing summary failed');
       console.error(err && err.message ? err.message : err);
       process.exit(1);
     });
@@ -1691,14 +1697,19 @@ function repairGithubMarketplace() {
 
 function northStar() {
   const args = parseArgs(process.argv.slice(3));
+  const { createCliProgress } = require(path.join(PKG_ROOT, 'scripts', 'cli-progress'));
+  const progress = createCliProgress();
   const { getOperationalDashboard } = require(path.join(PKG_ROOT, 'scripts', 'operational-dashboard'));
 
+  progress.start('Loading North Star metrics…');
   getOperationalDashboard({
     window: args.window,
     timeZone: args.timezone,
     now: args.now,
+    onProgress: (message) => progress.update(message),
   })
     .then(({ source, data, fallbackReason }) => {
+      progress.succeed(`North Star ready (${source})`);
       const summary = data.analytics.northStar || {};
       const revenue = data.analytics.revenue || {};
 
@@ -1721,6 +1732,7 @@ function northStar() {
       process.exit(0);
     })
     .catch((err) => {
+      progress.fail('North Star failed');
       console.error(err && err.message ? err.message : err);
       process.exit(1);
     });
@@ -2615,6 +2627,156 @@ function deepseekV4RuntimeGuardrails() {
   process.stdout.write(formatDeepSeekV4RuntimeGuardrailsPlan(report));
 }
 
+function nvidiaSpecDecodeAlDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildNvidiaSpecDecodeAlDoctorReport,
+    formatNvidiaSpecDecodeAlDoctorReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'nvidia-specdecode-al-doctor'));
+  const report = buildNvidiaSpecDecodeAlDoctorReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatNvidiaSpecDecodeAlDoctorReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+
+
+function intentGovernedExecution() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildIntentGovernedExecutionReport,
+    formatIntentGovernedExecutionReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'intent-governed-execution'));
+  const report = buildIntentGovernedExecutionReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatIntentGovernedExecutionReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function jitHarnessCompose() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildJitHarnessComposeReport,
+    formatJitHarnessComposeReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'jit-harness-compose'));
+  const report = buildJitHarnessComposeReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatJitHarnessComposeReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function allowlistBridgeHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildAllowlistBridgeHonestyReport,
+    formatAllowlistBridgeHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'allowlist-bridge-honesty'));
+  const report = buildAllowlistBridgeHonestyReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatAllowlistBridgeHonestyReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function packageManagerHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildPackageManagerHonestyReport,
+    formatPackageManagerHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'package-manager-honesty-doctor'));
+  const report = buildPackageManagerHonestyReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatPackageManagerHonestyReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function openuiCatalogComposeHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildOpenuiCatalogComposeHonestyReport,
+    formatOpenuiCatalogComposeHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'openui-catalog-compose-honesty'));
+  const report = buildOpenuiCatalogComposeHonestyReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatOpenuiCatalogComposeHonestyReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+
+async function workspaceSearchRoute() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildWorkspaceSearchRouteReport,
+    formatWorkspaceSearchRouteReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'workspace-search-route'));
+  const report = await buildWorkspaceSearchRouteReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatWorkspaceSearchRouteReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
 function upstreamContributions() {
   const args = parseArgs(process.argv.slice(3));
   const {
@@ -3000,6 +3162,24 @@ function sessionStart() {
     }
   } catch (_) { /* non-critical */ }
 
+  // MCP + lessons-store wiring — make unattended RAG-loop gaps loud at boot
+  try {
+    const { wiringReport } = require(path.join(PKG_ROOT, 'scripts', 'mcp-wiring-doctor'));
+    const wiring = wiringReport(CWD);
+    if (wiring && wiring.overall !== 'ok') {
+      if (reminderLines.length > 0) reminderLines.push('');
+      reminderLines.push(`ThumbGate RAG wiring: ${wiring.overall.toUpperCase()}`);
+      reminderLines.push(
+        wiring.unattendedCaptureReady
+          ? '  Capture path available (local and/or hosted).'
+          : '  Capture path BROKEN for unattended runs — wire .mcp.json thumbgate server and set THUMBGATE_FEEDBACK_DIR or THUMBGATE_API_BASE_URL+THUMBGATE_API_KEY.'
+      );
+      (wiring.findings || []).slice(0, 4).forEach((finding) => {
+        reminderLines.push(`  - ${finding}`);
+      });
+    }
+  } catch (_) { /* non-critical */ }
+
   // Top high-risk tags — force agent to see them at session start, not opt-in
   try {
     const { getRiskSummary } = require(path.join(PKG_ROOT, 'scripts', 'risk-scorer'));
@@ -3038,21 +3218,35 @@ function installMcp() {
 
 function dashboard() {
   const args = parseArgs(process.argv.slice(3));
+  const { createCliProgress } = require(path.join(PKG_ROOT, 'scripts', 'cli-progress'));
+  const progress = createCliProgress();
+
   if (args.open || args.web) {
     const { resolveProjectDir } = require(path.join(PKG_ROOT, 'scripts', 'feedback-paths'));
     const projectDir = resolveProjectDir({ cwd: process.cwd(), env: process.env });
     const port = process.env.PORT || 3456;
     const url = `http://127.0.0.1:${port}/dashboard?project=${encodeURIComponent(projectDir)}`;
 
+    progress.start(`Starting local dashboard on :${port}…`);
     ensureDash(Number(port))
       .then((server) => {
+        // Keep the stable stdout contract: scripts/tests parse `API <port> pid <n>`.
+        // Progress stays on stderr so humans still see a spinner without breaking parsers.
         if (server.started) {
           console.log(`API ${port} pid ${server.pid}`);
+          progress.update(`Local API listening (pid ${server.pid})…`);
+        } else {
+          progress.update('Local API already running…');
         }
+        progress.update('Opening browser…');
         return openBrowser(url);
       })
-      .then(() => process.exit(0))
+      .then(() => {
+        progress.succeed(`Dashboard open: ${url}`);
+        process.exit(0);
+      })
       .catch((err) => {
+        progress.fail('Failed to open local dashboard');
         console.error(err && err.message ? err.message : err);
         process.exit(1);
       });
@@ -3062,16 +3256,25 @@ function dashboard() {
   const { printDashboard } = require(path.join(PKG_ROOT, 'scripts', 'dashboard'));
   const { getOperationalDashboard } = require(path.join(PKG_ROOT, 'scripts', 'operational-dashboard'));
 
+  progress.start('Loading ThumbGate dashboard…');
   getOperationalDashboard({
     window: args.window,
     timeZone: args.timezone,
     now: args.now,
+    onProgress: (message) => progress.update(message),
   })
-    .then(({ data }) => {
+    .then(({ data, source }) => {
+      const sourceLabel = source === 'hosted'
+        ? 'hosted'
+        : source === 'local-unverified'
+          ? 'local (hosted unavailable)'
+          : 'local';
+      progress.succeed(`Dashboard ready (${sourceLabel})`);
       printDashboard(data);
       process.exit(0);
     })
     .catch((err) => {
+      progress.fail('Dashboard failed');
       console.error(err && err.message ? err.message : err);
       process.exit(1);
     });
@@ -3270,6 +3473,8 @@ function help() {
     console.log('  ai-inventory                                      Scan AI/ML components and export ML-BOM evidence');
     console.log('  verify-claims --claim="..."                     Recheck factual claims against configured sources');
     console.log('  doctor                                            Audit runtime isolation + bootstrap context');
+    console.log('  compass                                           6-axis pipeline: wire, lessons, rules, eval');
+    console.log('  security-central                                  Free Agent Security Central posture report');
     console.log('  break-glass --reason="..."                       Short TTL recovery if gates over-fire');
     console.log('  brain [--write]                                   Build the agent-readable context brain (lessons + rules + gates)');
     console.log('  pro                                               ThumbGate Pro (dashboard, exports, sync)');
@@ -3337,6 +3542,7 @@ function help() {
   console.log('  eval                  Turn feedback into reusable prompt/workflow eval proof');
   console.log('  optimize              [PRO] Prune CLAUDE.md and migrate rules to Pre-Action Checks');
   console.log('  prove [--target=X]    Run proof harness (adapters|automation|...)');
+  console.log('  compass               6-axis pipeline check (wire → lessons → rules → eval)');
   console.log('  watch                 Watch .thumbgate/ for external signals');
   console.log('  status                Approval trend + failure domain dashboard');
   console.log('  funnel                Marketing and revenue conversion funnel analytics');
@@ -3351,8 +3557,17 @@ function help() {
   console.log('  long-running-agent-context-guardrails Map structured-memory gaps to long-running agent gates');
   console.log('  reasoning-efficiency-guardrails Map reasoning compression signals to efficiency gates');
   console.log('  deepseek-v4-runtime-guardrails Map sparse-attention runtime signals to safety gates');
+  console.log('  nvidia-specdecode-al-doctor Check speculative AL/D evidence vs AL/(1+ρD) speedup math');
+  console.log('  package-manager-honesty-doctor Audit lockfile/CI parity; fail-closed manager switches');
+  console.log('  openui-catalog-compose-honesty Catalog-compose-only + repair-before-claim (OpenUI FORMAT)');
+  console.log('  allowlist-bridge-honesty Audit allowlisted registries/proxies as hops, not trust boundaries');
+  console.log('  jit-harness-compose   Compose memory/planning/action/capability onto existing rails (JIT FORMAT)');
+  console.log('  workspace-search-route     Route query to rg/fts/vector/hybrid/graph (zg FORMAT)');
+  console.log('  intent-governed-execution  NL intent → classify/authorize/gate/HITL/evidence (CyberStrike FORMAT)');
   console.log('  background-governance Background-agent run report and dispatch risk check');
   console.log('  analytics             Unified analytics snapshot (npm, GitHub, landing)');
+  console.log('  inventory             Agent action inventory: tool calls, gate denies, false-deny rate');
+  console.log('  conflict-audit        Find controls that report success but enforce nothing');
   console.log('  start-api             Start the ThumbGate HTTPS API server');
   console.log('');
 
@@ -3385,6 +3600,13 @@ function help() {
   console.log('  npx thumbgate long-running-agent-context-guardrails --request-count=80 --output-mb=3 --raw-chat-only --json');
   console.log('  npx thumbgate reasoning-efficiency-guardrails --baseline-tokens=1200 --compressed-tokens=980 --baseline-accuracy=0.84 --compressed-accuracy=0.85 --verifier --json');
   console.log('  npx thumbgate deepseek-v4-runtime-guardrails --context-tokens=900000 --hybrid-attention --speculative-decoding --accept-length=1.4 --precision-mode=fp8 --json');
+  console.log('  npx thumbgate nvidia-specdecode-al-doctor --speculative-decoding --accept-length=1.4 --draft-length=7 --draft-depth-ratio=0.05 --claimed-speedup=3 --json');
+  console.log('  npx thumbgate package-manager-honesty-doctor --propose-switch=pnpm --json');
+  console.log('  npx thumbgate openui-catalog-compose-honesty --catalog=catalog.json --stream=compose.txt --repair --json');
+  console.log('  npx thumbgate allowlist-bridge-honesty --json');
+  console.log('  npx thumbgate jit-harness-compose --task="implement PreToolUse gate fix" --json');
+  console.log('  npx thumbgate workspace-search-route --query="how does X connect" --json');
+  console.log('  npx thumbgate intent-governed-execution --intent="railway deploy" --json');
   console.log('  npx thumbgate upstream-contributions --max-repos=10 --write');
   console.log('  npx thumbgate background-governance --json');
   console.log('  npx thumbgate background-governance --check --agent-id=builder --branch=main --files-changed=25 --json');
@@ -3438,6 +3660,8 @@ const SUBCOMMAND_HELP = {
   compact:       'Usage: npx thumbgate compact\n\nCompact the lesson database and reclaim disk space.',
   'context-packs': 'Usage: npx thumbgate context-packs\n\nGenerate context packs from top failure patterns.',
   suggest:       'Usage: npx thumbgate suggest <gate-id>\n\nSuggest fixes for a specific gate based on lesson history.',
+  inventory:     'Usage: npx thumbgate inventory [--json] [--days=N] [--data-dir=path] [--max-bytes=N]\n\nRead-only inventory of agent activity in this repo\'s ThumbGate store: agents seen, tool calls by tool, allow/deny counts, deny reasons per gate, top gates, per-day activity, and the false-deny rate.\n\nEvery source reports its own status (ok / empty / missing) so an uninstrumented store never looks like a quiet one. falseDenyRate is null with a stated reason whenever a real denominator was not observed; falseDenyNumerator and falseDenyDenominator are always emitted raw.\n\nEach source is read as a bounded tail (default 8 MiB, --max-bytes to change) so a multi-hundred-MB audit log is never loaded whole. If the tail did not reach back to the start of the window, windowFullyCovered is false and the text output says so.',
+  'conflict-audit': 'Usage: npx thumbgate conflict-audit [--json] [--offline] [--repo-root=path] [--github-repo=owner/name] [--branch=main] [--consecutive-failures=N] [--excluded-lines=N] [--commits=N]\n\nDeterministic detector for controls that report success but enforce nothing. Six detectors, no model involved:\n\n  D1 gate configs declaring a `patterns` array when the engine reads `pattern` (the match block is skipped, so the gate fires on every tool in its toolNames)\n  D2 gate patterns that cannot compile (an inline (?i) flag group throws; the engine swallows the throw as "no match")\n  D3 checks required by NEITHER classic branch protection NOR any repository ruleset, which have failed on N or more consecutive recent commits\n  D4 sonar.exclusions / sonar.coverage.exclusions entries that hide non-trivial code inside sonar.sources from scanning\n  D5 modules and entry exports with zero production call sites outside their own tests (for a PUBLISHED package the entry surface is public API whose callers are downstream npm consumers, so those are reported NOT INSPECTED rather than dead)\n  D6 the bare `path.resolve(process.argv[1]) === path.resolve(__filename)` main check, which no-ops under an npm bin shim\n\nEvery detector reports its own status: `ran` (inspected), `partial` (some of the surface was not inspected, and which), or `unavailable` (could not inspect at all). An unavailable detector is NEVER reported as clean. D3 needs the `gh` CLI (resolved from a fixed install location, never through $PATH) plus read access to branch protection and repository rulesets; use --offline to skip it explicitly.',
   cost:          'Usage: npx thumbgate cost [--json] [--stats <path>] [--mix \'{"claude-sonnet-4-5":0.8,...}\']\n\nShow cumulative $ and tokens saved by PreToolUse gate blocks. Reads ~/.thumbgate/gate-stats.json.',
   savings:       'Usage: npx thumbgate savings [--json] [--stats <path>] [--mix \'{"claude-sonnet-4-5":0.8,...}\']\n\nAlias for `thumbgate cost`.',
   'setup-vertex': 'Usage: npx thumbgate setup-vertex [--dry-run]\n\nAuto-enable Vertex AI API on GCP and write local Vertex routing config to .env. With --dry-run, only detect the active account/project and print the planned changes. This does not create or verify a Dialogflow CX agent; use the Dialogflow CX REST API or console for live-agent evidence.',
@@ -3888,14 +4112,66 @@ switch (COMMAND) {
       generateAgentReadinessReport,
       reportToText,
     } = require(path.join(PKG_ROOT, 'scripts', 'agent-readiness'));
+    const { wiringReport, formatReport } = require(path.join(PKG_ROOT, 'scripts', 'mcp-wiring-doctor'));
     const args = parseArgs(process.argv.slice(3));
     const report = generateAgentReadinessReport({ projectRoot: CWD });
+    const wiring = wiringReport(CWD);
     if (args.json) {
-      console.log(JSON.stringify(report, null, 2));
+      console.log(JSON.stringify({ ...report, wiring }, null, 2));
     } else {
       process.stdout.write(reportToText(report));
+      process.stdout.write(`\n${formatReport(wiring)}\n`);
     }
-    process.exit(report.overallStatus === 'ready' ? 0 : 1);
+    const ready = report.overallStatus === 'ready' && wiring.overall !== 'error';
+    process.exit(ready ? 0 : 1);
+    break;
+  }
+  case 'compass':
+  case 'pipeline':
+  case 'pipeline-compass': {
+    const { getPipelineCompass, formatPipelineCompass } = require(path.join(PKG_ROOT, 'src', 'pipeline-compass'));
+    const args = parseArgs(process.argv.slice(3));
+    const report = getPipelineCompass({ projectRoot: CWD });
+    if (args.json) console.log(JSON.stringify(report, null, 2));
+    else console.log(formatPipelineCompass(report));
+    process.exit(report.ready ? 0 : 1);
+    break;
+  }
+  case 'writeguard':
+  case 'mcp-writeguard': {
+    const { main } = require(path.join(PKG_ROOT, 'scripts', 'mcp-writeguard'));
+    main();
+    break;
+  }
+  case 'latency':
+  case 'latency-budget': {
+    const { main } = require(path.join(PKG_ROOT, 'scripts', 'latency-budget'));
+    main();
+    break;
+  }
+  case 'wiring-doctor':
+  case 'mcp-wiring-doctor': {
+    const { wiringReport, formatReport, applyFix } = require(path.join(PKG_ROOT, 'scripts', 'mcp-wiring-doctor'));
+    const args = parseArgs(process.argv.slice(3));
+    if (args.fix) applyFix(CWD);
+    const wiring = wiringReport(CWD);
+    if (args.json) console.log(JSON.stringify(wiring, null, 2));
+    else console.log(formatReport(wiring));
+    process.exit(wiring.overall === 'error' ? 2 : wiring.overall === 'warning' ? 1 : 0);
+    break;
+  }
+  case 'security-central':
+  case 'security:central':
+  case 'agent-security-central': {
+    const {
+      buildSecurityCentralReport,
+      formatSecurityCentralReport,
+    } = require(path.join(PKG_ROOT, 'scripts', 'agent-security-central'));
+    const args = parseArgs(process.argv.slice(3));
+    const report = buildSecurityCentralReport({ projectRoot: CWD });
+    if (args.json) console.log(JSON.stringify(report, null, 2));
+    else console.log(formatSecurityCentralReport(report));
+    process.exit(report.posture.band === 'critical' ? 2 : report.posture.band === 'at_risk' ? 1 : 0);
     break;
   }
   case 'export-dpo':
@@ -3959,6 +4235,51 @@ switch (COMMAND) {
   case 'sparse-attention-runtime-guardrails':
     deepseekV4RuntimeGuardrails();
     break;
+  case 'nvidia-specdecode-al-doctor':
+  case 'specdecode-al-doctor':
+  case 'speculative-decoding-al-doctor':
+  case 'nvidia-speculative-decoding-doctor':
+    nvidiaSpecDecodeAlDoctor();
+    break;
+  case 'package-manager-honesty-doctor':
+  case 'pm-honesty-doctor':
+  case 'pnpm12-honesty-doctor':
+  case 'lockfile-ci-parity-doctor':
+    packageManagerHonestyDoctor();
+    break;
+  case 'openui-catalog-compose-honesty':
+  case 'openui-honesty-doctor':
+  case 'catalog-compose-honesty':
+  case 'repair-before-compose-claim':
+    openuiCatalogComposeHonestyDoctor();
+    break;
+  case 'allowlist-bridge-honesty':
+  case 'gitlab-sandbox-allowlist':
+  case 'allowlist-not-trust':
+  case 'trust-handoff-honesty':
+    allowlistBridgeHonestyDoctor();
+    break;
+  case 'jit-harness-compose':
+  case 'jit-compose':
+  case 'jit-harness':
+  case 'harness-compose':
+    jitHarnessCompose();
+    break;
+  case 'workspace-search-route':
+  case 'zg-search-route':
+  case 'zvec-grep-route':
+  case 'search-route':
+    workspaceSearchRoute().catch((err) => {
+      console.error(err && err.stack ? err.stack : err);
+      process.exitCode = 1;
+    });
+    break;
+  case 'intent-governed-execution':
+  case 'governed-intent':
+  case 'cyberstrike-governed':
+  case 'intent-govern':
+    intentGovernedExecution();
+    break;
   case 'long-running-agent-context-guardrails':
   case 'agent-context-guardrails':
   case 'slack-context-guardrails':
@@ -4292,6 +4613,53 @@ switch (COMMAND) {
     runAnalytics();
     break;
   }
+  case 'inventory': {
+    // Read-only rollup of what agents did in this repo's ThumbGate store:
+    // tool calls, allow/deny counts, deny reasons per gate, per-day activity,
+    // and the false-deny rate (null when it cannot be honestly computed).
+    const inventoryArgs = parseArgs(process.argv.slice(3));
+    const {
+      buildInventory,
+      renderInventoryText,
+    } = require(path.join(PKG_ROOT, 'scripts', 'agent-action-inventory'));
+    const { resolveFeedbackDir } = require(path.join(PKG_ROOT, 'scripts', 'feedback-paths'));
+    const inventory = buildInventory({
+      dataDir: inventoryArgs['data-dir'] || resolveFeedbackDir(),
+      windowDays: inventoryArgs.days,
+      maxBytes: inventoryArgs['max-bytes'] ? Number(inventoryArgs['max-bytes']) : undefined,
+    });
+    if (inventoryArgs.json) {
+      console.log(JSON.stringify(inventory, null, 2));
+    } else {
+      process.stdout.write(renderInventoryText(inventory));
+    }
+    break;
+  }
+  case 'conflict-audit': {
+    // Deterministic sweep for controls that report success but enforce
+    // nothing. Each detector reports its own status, so a surface that could
+    // not be inspected is never rendered as a clean bill of health.
+    const conflictArgs = parseArgs(process.argv.slice(3));
+    const {
+      auditGovernanceConflicts,
+      renderConflictAuditText,
+    } = require(path.join(PKG_ROOT, 'scripts', 'governance-conflict-audit'));
+    const conflictReport = auditGovernanceConflicts({
+      repoRoot: conflictArgs['repo-root'] || process.cwd(),
+      gitHubRepo: conflictArgs['github-repo'],
+      branch: conflictArgs.branch,
+      consecutiveFailureThreshold: conflictArgs['consecutive-failures'],
+      excludedLineThreshold: conflictArgs['excluded-lines'],
+      commitLimit: conflictArgs.commits,
+      offline: Boolean(conflictArgs.offline),
+    });
+    if (conflictArgs.json) {
+      console.log(JSON.stringify(conflictReport, null, 2));
+    } else {
+      process.stdout.write(`${renderConflictAuditText(conflictReport)}\n`);
+    }
+    break;
+  }
   case 'start-api':
     startApi();
     break;
@@ -4373,7 +4741,7 @@ switch (COMMAND) {
     });
     req.on('error', (err) => {
       console.error(`✗ Subscribe failed: ${err.message}`);
-      console.error('  Network issue? Try again, or email igor.ganapolsky@gmail.com directly.');
+      console.error('  Network issue? Try again, or email support@thumbgate.ai directly.');
       process.exit(3);
     });
     req.on('timeout', () => {

package/bin/futureagi-bridge

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+'use strict';
+
+// Requiring the module is not enough: its CLI only self-executes when the
+// module itself is the entry point, so `futureagi-bridge --doctor` used to
+// exit 0 having evaluated nothing.
+const { mainCli } = require('../scripts/future-agi-evaluator.js');
+
+process.exit(mainCli());