thumbgate 1.34.3 → 1.37.1

package/config/gate-templates.json

@@ -37,6 +37,43 @@
       "roi": "Raises trust in autonomous runs and reduces manual re-checking.",
       "rollout": "Use for every workflow where proof matters more than speed."
     },
+    {
+      "id": "require-catalog-compose-only",
+      "name": "Require catalog-compose-only agent UI",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(generative\\s*ui|compose\\s*ui|openui|@openuidev).*(invent|arbitrary|eval|new Function|dangerouslySetInnerHTML|install\\s+@openuidev|clone\\s+openui)|component\\s+not\\s+in\\s+catalog|unknown\\s+component",
+      "problem": "Blocks agents from inventing UI components outside an allowlisted catalog or running generated code. OpenUI's safe-by-default FORMAT: compose only from your components.",
+      "roi": "Stops generative-UI theater and arbitrary-code compose paths. Keeps agent dashboards/widgets inside a known catalog without cloning OpenUI/Thesys.",
+      "rollout": "Enable for any agent-composed UI, dashboard widget, or tool-result card. Pair with openui-catalog-compose-honesty --catalog --stream --json."
+    },
+    {
+      "id": "require-repair-before-compose-claim",
+      "name": "Require repair-before-claim on composed UI",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(ui|compose|generative\\s*ui|dashboard\\s*widget).*(ready|done|shipped|fixed|live)|claim.*compose.*(ready|done)",
+      "problem": "Blocks claiming composed UI is ready before a line-level validate+repair pass (root present, unknown components dropped, zero arbitrary-code lines).",
+      "roi": "Mirrors OpenUI Gateway's repair-before-users-see-it FORMAT on ThumbGate rails: invalid compose never becomes a completion claim.",
+      "rollout": "Require openui-catalog-compose-honesty --repair --claim-ready evidence before any compose/UI done claim. Does not install OpenUI Gateway."
+    },
+    {
+      "id": "require-broker-signed-execution-receipt",
+      "name": "Require broker-signed execution receipts",
+      "category": "Provider Side-Effect Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "broker[_ -]?signed|provider[_ -]?credential|providerEventId",
+      "problem": "Stops agents from treating self-written receipts as proof of provider side effects. Only a credential-holding broker outside the agent trust boundary may sign.",
+      "roi": "Closes the 'agent rehashed a receipt' integrity hole on payments, messaging, and credentialed APIs.",
+      "rollout": "Set THUMBGATE_BROKER_RECEIPT_MODE=enforce and install broker public keys on the host. Pair with aigate or any external credential broker."
+    },
+
     {
       "id": "protect-production-sql",
       "name": "Protect production SQL",
@@ -169,6 +206,42 @@
       "roi": "Prevents AI agents from introducing vulnerable packages into the workspace. Complements zero-egress local-first scanning toolings (like OWASP CVE Lite CLI) directly at the terminal level.",
       "rollout": "Enable on every repo where agents can install dependencies or modify lockfiles."
     },
+    {
+      "id": "require-package-manager-lockfile-ci-parity",
+      "name": "Require package-manager lockfile and CI parity",
+      "category": "Supply Chain Safety",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(pnpm-lock|yarn\\.lock|bun\\.lock|package-lock).*(and|with|plus).*(package-lock|pnpm-lock|yarn\\.lock)|packageManager.*(mismatch|disagree)|ci.*(pnpm|yarn|bun).*(npm ci|package-lock)",
+      "problem": "Blocks dual lockfiles and CI install commands that disagree with the canonical lockfile manager.",
+      "roi": "Stops agents from introducing pnpm/yarn/bun beside npm (or vice versa) and silently breaking reproducible installs after package-manager rewrites like pnpm 12.",
+      "rollout": "Enable on every repo with agent install rights. Pair with package-manager-honesty-doctor."
+    },
+    {
+      "id": "checkpoint-package-manager-switch",
+      "name": "Checkpoint package-manager switch",
+      "category": "Supply Chain Safety",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(migrate|switch|adopt|move).*(pnpm|yarn|bun|npm)|pnpm self-update|corepack enable.*(pnpm|yarn)|add pnpm-lock",
+      "problem": "Requires an explicit migration plan before switching package managers: single lockfile, packageManager pin, rewrite every CI install, delete the old lockfile, and prove CI green.",
+      "roi": "pnpm 12-style rewrites look cheap until CI still runs npm ci against a deleted lockfile. Fail closed on silent switches; prefer --ignore-scripts honesty on the current manager.",
+      "rollout": "Block agent-proposed manager switches; allow only with package-manager-honesty-doctor --propose-switch evidence attached to the PR."
+    },
+    {
+      "id": "checkpoint-allowlist-bridge-not-trust",
+      "name": "Checkpoint allowlisted registry/proxy as a hop, not a trust boundary",
+      "category": "Supply Chain Safety",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(?=.*(sandbox|allowlist))(?=.*(trusted|safe|secure))(?=.*(npm|pypi|huggingface|package proxy|registry\\.npmjs|verdaccio|nexus)).+",
+      "problem": "Blocks treating an allowlisted package registry, proxy, or Hugging Face host as a sandbox trust boundary. GitLab's 2026-09 analysis showed a permitted package proxy became the escape hop.",
+      "roi": "Keeps deny-network-egress and agent-egress-policy honest: hops stay hops. Pair with allowlist-bridge-honesty. Does not clone GitLab Duo.",
+      "rollout": "Warn when agents claim an allowlisted registry is trusted; require allowlist-bridge-honesty --json evidence before expanding egress allowlists."
+    },
     {
       "id": "require-section-tree-before-multimodal-answer",
       "name": "Require section tree before multimodal answers",
@@ -356,10 +429,10 @@
       "signal": "👎",
       "defaultAction": "warn",
       "severity": "high",
-      "pattern": "(speculative|mtp|eagle).*(accept|rollback|draft).*(low|missing|unstable)",
-      "problem": "Requires acceptance-rate, rollback, and correctness evidence before speculative decoding is treated as a production speedup.",
-      "roi": "Avoids routing traffic to a faster-looking path that collapses acceptance length or hides draft-token correctness failures.",
-      "rollout": "Start in warn mode for lab benchmarks; promote to block when speculation is enabled for customer traffic."
+      "pattern": "(speculative|mtp|eagle|draft.?length|accept.?length).*(accept|rollback|draft|speedup|al\\b).*(low|missing|unstable|overclaim|above.?theory)",
+      "problem": "Requires measured accept length (AL), draft length (D), rollback/coherence evidence, and speedup claims at or below AL/(1+ρD) before speculative decoding is treated as a production speedup.",
+      "roi": "Avoids routing traffic to a faster-looking path that collapses acceptance length, overclaims beyond AL/(1+ρD), or hides draft-token correctness failures.",
+      "rollout": "Start in warn mode for lab benchmarks; promote to block when speculation is enabled for customer traffic. Pair with nvidia-specdecode-al-doctor for AL/D math."
     },
     {
       "id": "require-long-context-kv-offload-capacity-plan",
@@ -577,6 +650,42 @@
       "roi": "Critical for compliance, forensics, and feedback loops. Enables proper capture of agent-specific lessons and prevention rules. Matches industry push (Okta, etc.).",
       "rollout": "Block any claw or autonomous agent action that authenticates as a human user. Require dedicated agent service accounts / identities with scoped permissions."
     },
+    {
+      "id": "block-workos-spend-cap-violations",
+      "name": "Block WorkOS spend-cap violations under $10/mo AuthKit policy",
+      "category": "Enterprise Identity & MCP Auth Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(workos|authkit).*(custom domain|enterprise sso|saml connection|directory sync|scim|radar|audit logs siem|\\$99|\\$125|staging\\.authkit)",
+      "problem": "ThumbGate public auth is WorkOS Production AuthKit under a hard ≤$10/mo spend cap. Enabling custom AuthKit domains (~$99/mo), enterprise SSO/SAML connections (~$125/conn), Directory Sync, or driving public traffic to staging AuthKit blows the cap or regresses login.",
+      "roi": "Protects conversion (thumbgate.app login) and prevents silent monthly burn. Complements WorkOS MCP Auth: identity stays cheap; runtime gates stay ThumbGate.",
+      "rollout": "Run npm run prove:workos. Keep Active SSO connections = 0. Prefer own Google OAuth app under AuthKit free tier. Never buy custom AuthKit domain without written budget rewrite."
+    },
+    {
+      "id": "require-mcp-oauth-scope-for-mutating-tools",
+      "name": "Require MCP OAuth scope for mutating remote tools",
+      "category": "Enterprise Identity & MCP Auth Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(mcp|oauth|bearer|access_token).*(missing scope|insufficient_scope|no auth|unauthenticated).*(write|mutate|capture|gate|tool)",
+      "problem": "Enterprise MCP Auth (WorkOS AuthKit MCP, RFC 8707 audience binding) maps OAuth scopes to tool privileges. Mutating tools without mcp:write (or equivalent) or with audience mismatch leak or mutate shared state.",
+      "roi": "Closes directory-reviewer and multi-tenant MCP holes. Aligns ThumbGate remote MCP with industry MCP OAuth 2.1 patterns while keeping pre-action gates as the enforcement layer after identity.",
+      "rollout": "Hosted MCP: OAuth PKCE required for remote connectors. Reviewer keys stay read-only. Operators use mcp:write (implies read/gates/feedback)."
+    },
+    {
+      "id": "review-workos-skill-and-auth-installer-actions",
+      "name": "Review WorkOS skill install and auth-route mutation by agents",
+      "category": "Enterprise Identity & MCP Auth Governance",
+      "signal": "👎",
+      "defaultAction": "require-approval",
+      "severity": "high",
+      "pattern": "(workos|authkit|npx workos|workos install|auth callback|sso connection|redirect_uri).*(install|scaffold|write|env|secret|client_id|api_key)",
+      "problem": "WorkOS AI CLI installers and agent skills mutate auth routes, env secrets, and SSO configuration. Unreviewed agent edits can reintroduce staging clients, wrong redirect URIs, or paid enterprise SSO connections.",
+      "roi": "Prevents auth regressions that drop Google login or point production at staging — a proven conversion killer. Gates dynamic skill installs (claw-style) on identity infrastructure.",
+      "rollout": "Require human review for WorkOS/AuthKit scaffolding. After changes run scripts/workos-production-guard.js and prove:workos."
+    },
     {
       "id": "gate-claw-file-system-access",
       "name": "Gate claw-style agent file system access",
@@ -589,6 +698,162 @@
       "roi": "Directly supports the hybrid/on-prem reality emphasized in EnterpriseClaw coverage. Prevents broad access from becoming broad exfil or corruption. Ties to ThumbGate's existing path globs and protected files.",
       "rollout": "Use existing protected-paths + new claw-specific rules. Start with read-only for most, explicit approval for writes on sensitive dirs."
     },
+    {
+      "id": "block-stealth-memory-injection-from-external",
+      "name": "Block stealth memory injection from external content",
+      "category": "Claw-Style Enterprise Agent Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(silently|do not tell|do not announce|stealth memory|memghost|imap|smtp|inbox).*(MEMORY\\.md|AGENTS\\.md|SOUL\\.md|USER\\.md|HEARTBEAT\\.md|long-term memory|preference|remember that)",
+      "problem": "Persistent personal agents (OpenClaw, Hermes, NanoClaw) can absorb untrusted email/tool content into durable memory carriers while staying silent in the user-visible reply. MemGhost (WhisperBench, paper 2607.05189) shows 87.5% end-to-end success for one-shot stealth memory injection — delayed sessions then treat poisoned facts/preferences as trusted state.",
+      "roi": "High: closes the durable-memory compromise path that ordinary PreToolUse hijack defenses miss. Direct product fit for OpenClaw/Hermes governance buyers and ThumbGate's Infrastructure Firewall narrative. Blocks fact + preference poisoning before it becomes trusted context.",
+      "rollout": "Enabled as structural gate in gates-engine (scripts/stealth-memory-injection-gate.js). Allow only with explicit operator override (THUMBGATE_ALLOW_STEALTH_MEMORY_INJECTION=1) or stealthMemoryInjectionApproved=true after human review. Capture blocked attempts with tags stealth-memory-injection,whisperbench,memghost."
+    },
+    {
+      "id": "require-claw-observability-before-production",
+      "name": "Require OpenTelemetry observability before claw production rollout",
+      "category": "Claw-Style Enterprise Agent Governance",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(claw|harness agent|hosted agent|production rollout|deploy agent).*(no telemetry|no traces|no otel|observability|token usage|tool calls)",
+      "problem": "A claw that reads files, runs code, and calls tools is a small distributed system. Microsoft Agent Framework's production-readiness guide (2026) makes OpenTelemetry spans for every model turn and tool call, token-usage metrics, and structured logs a launch prerequisite — without them a misfiring skill, looping tool, or 10x cost spike is invisible until a customer reports it.",
+      "roi": "High: observability is the cheapest incident-response accelerator for enterprise claw buyers. ThumbGate's tool KPI telemetry and decision logs become the audit surface; this gate converts 'works on my machine' into 'we can see it run'. Maps directly to the AGENTS.md 20-observed-tool-calls production-monitoring floor.",
+      "rollout": "Warn by default; escalate to block for regulated verticals (finance/healthcare). Require an OTLP/collector endpoint or ThumbGate decision-log sink configured before any hosted or fleet deployment. Capture evidence with tags claw-observability,otel,production-readiness."
+    },
+    {
+      "id": "require-policy-content-screening",
+      "name": "Require prompt/response content-policy screening (Purview-style)",
+      "category": "Claw-Style Enterprise Agent Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(prompt|response|chat client|model call|agent output).*(credit card|pii|confidential|regulated|policy screen|purview|dls|data loss)",
+      "problem": "In regulated settings every prompt must be screened before it reaches the model and every response before it reaches the user, with an audit trail — Microsoft's production claw wraps the chat client in Purview policy middleware for exactly this. Unscreened claw traffic against sensitive documents (finance, healthcare) is a data-loss incident waiting for an audit.",
+      "roi": "High: content-policy screening is the compliance story that unlocks enterprise budgets (SOC 2, HIPAA, DLP). ThumbGate's memory-firewall + secret-leak gates already implement the pattern locally; this gate extends it to bidirectional prompt/response screening and positions ThumbGate as the vendor-neutral alternative to tenant-locked E5-only Purview.",
+      "rollout": "Block unscreened model calls for regulated workloads; allow only when a screening layer (ThumbGate memory firewall, Purview middleware, or equivalent DLP) is configured on the chat path. Opt-in by environment flag so unregulated dev loops stay fast. Capture with tags content-policy,dlp,purview-style."
+    },
+    {
+      "id": "block-hosted-claw-shell-and-fs",
+      "name": "Block shell and container-disk file access on hosted claw agents",
+      "category": "Claw-Style Enterprise Agent Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(hosted|container|shared tenant|multi tenant|foundry|cloud deploy).*(enable shell|shell access|file access|write container|container disk|arbitrary read)",
+      "problem": "Microsoft's hosted claw deliberately sets EnableFileAccess=false and EnableShell=false: in a shared hosted environment, arbitrary container filesystem or shell access is a data-exfiltration, tampering, and persistence vector even behind a deny-list. When file access is genuinely needed the pattern is an external governed file store (e.g., blob-backed AgentFileStore), never the ephemeral container disk.",
+      "roi": "High: the single clearest hosted-claw hardening rule from a first-party production guide. ThumbGate enforces it as a deterministic pre-action gate plus proof artifact, so buyers get the Microsoft-recommended lockdown with an evidence packet instead of trusting config drift.",
+      "rollout": "Block by default for any hosted/shared-tenant agent build. Explicit, reviewed exceptions only, and file access must route through a governed external store, never container disk. Capture with tags hosted-hardening,shell-off,filestore."
+    },
+    {
+      "id": "require-local-evals-on-every-change",
+      "name": "Require local deterministic evals on every claw change",
+      "category": "Claw-Style Enterprise Agent Governance",
+      "signal": "👍",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(claw|agent|prompt|tool|skill).*(regression|eval|golden|quality gate|ci check|passed/total)",
+      "problem": "The production harness pattern runs local deterministic eval checks (plain functions: passed/total over a fixed query set) on every change, always in CI, with model-graded quality scores optional and gated. Without a local eval ratchet, every prompt/tool/skill edit is a blind change — the tuning loop that keeps a deployed agent honest does not exist.",
+      "roi": "High: evals-in-CI is the cheapest regression insurance and directly extends ThumbGate's existing golden-eval discipline (gate-decisions golden, retrieval ranking MRR/recall thresholds, fail-closed RAG gates). Selling point: ThumbGate ships the local-eval layer; hosted model-graded evals stay optional.",
+      "rollout": "Warn when a prompt/tool/skill change ships without a local eval run; block merges on eval regression in CI. Keep checks deterministic, fast, free, and runnable offline; require >= 95% pass on golden cases before widening deployment. Capture with tags local-evals,ratchet,production-readiness."
+    },
+    {
+      "id": "require-double-blind-holdout-eval",
+      "name": "Require double-blind holdout for benchmark tuning",
+      "category": "Eval Integrity",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(benchmark|golden set|eval set|leaderboard|model score|sota).*(leak|contamin|overfit|tune against|memoriz|inflate)",
+      "problem": "Google DeepMind's first double-blind AI evaluation (2026) responds to research finding benchmark leakage in roughly half of 31 models tested; contamination inflates scores, especially for larger models. Tuning prompts, rules, or models against a fully visible benchmark set teaches to the test — the reported score stops measuring generalization. DeepMind's fix seals both sides (weights and questions) in a confidential enclave; the local equivalent is a hash-sealed holdout slice whose questions never enter the tuning loop.",
+      "roi": "High: eval score integrity is the trust product — ThumbGate sells evidence, and inflated benchmark scores are fabricated evidence. Cheap to enforce (deterministic hash partition + sealed manifest, no confidential hardware). Maps to the AGENTS.md production regression gate (>= 6 golden cases, fail-closed) and extends scripts/eval-holdout.js.",
+      "rollout": "Partition every mined benchmark deterministically (sha256 of case identity) into public + holdout (default 1/3). Store holdout as hashes and sealed verdicts only — never raw questions. Re-freeze deliberately with a human decision, like eval:baseline; block releases when the holdout seal is broken or holdout verdicts drift unexplained. Capture with tags eval-integrity,holdout,contamination."
+    },
+    {
+      "id": "require-ai-use-case-inventory",
+      "name": "Require AI use-case inventory (CMDB for AI)",
+      "category": "AI Governance Operating Plan",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(deploy|onboard|introduce|roll ?out|new).*(ai|model|agent|llm|automation).*(no inventory|no register|no cmdb|no owner|untracked)",
+      "problem": "The episode's core governance finding: incomplete AI-use-case inventories are the root problem. Without a register of every model, vendor/API, agent, data source, tool integration, owner, user group, and business purpose — plus a risk tier — you cannot govern what you cannot enumerate.",
+      "roi": "High: the inventory is the prerequisite for every other control (data classification, least privilege, incident routing). A CMDB-for-AI is the cheapest high-leverage deliverable in the first 7 days of any AI governance program.",
+      "rollout": "Maintain a machine-readable register (one row per model/agent/integration: vendor, API, data sources, tools, owner, user group, business purpose, risk tier). Require an entry before any new AI capability ships. Warn by default; block for customer-facing or regulated-data use cases. Capture with tags ai-inventory,cmdb,use-case-register."
+    },
+    {
+      "id": "require-data-classification-before-ai",
+      "name": "Require data classification before AI workflow",
+      "category": "AI Governance Operating Plan",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(ai|model|llm|agent|prompt|rag).*(pii|confidential|financial|credential|secret|customer data|internal).*(no classification|unclassified|unapproved model|unmanaged)",
+      "problem": "Understand your data first: for each AI workflow, label inputs and outputs (public, internal, confidential, PII, financial, customer, credentials/secrets) and explicitly prohibit sensitive data from flowing into unapproved models or unmanaged browser sessions.",
+      "roi": "High: data classification is the single control that prevents the most expensive AI incident class — sensitive-data exfiltration into a third-party model. Cheap to implement, blocks the worst blast radius.",
+      "rollout": "Before enabling any AI workflow, classify its inputs/outputs. Block sensitive-class data from unapproved models and unmanaged sessions. Maintain an approved-model policy keyed by data class. Capture with tags data-classification,pii,approved-model."
+    },
+    {
+      "id": "require-ai-threat-model-blast-radius",
+      "name": "Require AI threat model + blast-radius assessment",
+      "category": "AI Governance Operating Plan",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(agent|ai workflow|automation).*(production|money|customer|privileged|deploy).*(no threat model|no blast radius|unassessed)",
+      "problem": "For each high-value AI workflow, map inputs, model, prompt construction, RAG sources, tools/actions, output recipients, logs, and human approval points — then ask: if this agent is compromised or wrong, what systems, records, money, customer communications, or privileges can it affect? Require explicit approval before external communications, payments, production changes, deletion, permission changes, or code deployment.",
+      "roi": "High: blast-radius assessment turns vague 'AI risk' into a concrete list of gated actions. Every consequential action behind an approval checkpoint is a prevented incident.",
+      "rollout": "Produce a threat model per high-value workflow before launch. Wire the blast-radius actions (external comms, payments, prod changes, deletion, permission changes, deploy) to explicit human approval gates. Capture with tags threat-model,blast-radius,approval-gate."
+    },
+    {
+      "id": "require-nhi-least-privilege",
+      "name": "Require least privilege for non-human identities",
+      "category": "AI Governance Operating Plan",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(agent|service account|api key|oauth|ci token|mcp|tool server).*(broad|birthright|admin|overprivileged|all scopes|wildcard)",
+      "problem": "Overprivileged non-human identities are a material exposure: inventory every API key, OAuth app, service account, CI token, tool credential, and MCP/tool server; eliminate broad birthright permissions; give each agent only the minimum scopes, data access, and action rights it needs; rotate secrets and prefer short-lived credentials; separate read-only research agents from action-capable agents.",
+      "roi": "High: least privilege for machine identities is the cheapest containment for a compromised or prompt-injected agent — it bounds what the agent can do even when the reasoning layer is fully captured.",
+      "rollout": "Inventory all non-human identities. Scope each agent to minimum required permissions, rotate long-lived secrets, prefer short-lived credentials, and split read-only from action-capable agents. Block any new broad-scope credential. Capture with tags nhi,least-privilege,credential-hygiene."
+    },
+    {
+      "id": "require-ai-incident-taxonomy-logging",
+      "name": "Require AI incident taxonomy + centralized logging",
+      "category": "AI Governance Operating Plan",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(ai|agent|model|llm).*(incident|failure|hallucination|injection|leak|drift).*(no taxonomy|no logging|untracked|no owner)",
+      "problem": "Define reportable AI events (hallucinated high-impact output, unsafe tool call, data leakage, prompt injection, unauthorized retrieval, abnormal cost, output drift) and capture model/version, sanitized prompt metadata, retrieved documents, tool calls, action results, approval identity, latency, cost, and failure outcome. Tie each event type to an owner, severity, containment action, and post-incident review.",
+      "roi": "High: an incident taxonomy + centralized log is what turns a single AI failure into a prevented class. Without it, every incident is a novel fire drill; with it, each one becomes a reusable prevention rule.",
+      "rollout": "Stand up a fixed AI event taxonomy and centralized log (ThumbGate's decision journal is the local substrate). Assign owner + severity + containment + review per event type. Run the SOC/CSIRT through a prompt-injection tabletop. Capture with tags incident-taxonomy,ml-secops,ai-logging."
+    },
+    {
+      "id": "require-constrained-ai-pilot",
+      "name": "Require constrained low-risk AI pilot before autonomous agents",
+      "category": "AI Governance Operating Plan",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "medium",
+      "pattern": "(start|pilot|begin|first).*(ai|agent|automation).*(retrieval|extraction|classification|summarization)",
+      "problem": "Start with retrieval, extraction, classification, or summarization — not an autonomous reasoning agent that can modify production systems. Define one success metric (e.g. 'reduce ticket-summary time by 60% while maintaining >= 95% factual accuracy in a reviewed sample'). The episode warns against jumping straight into complex reasoning without foundational maturity.",
+      "roi": "High: a constrained pilot is the cheapest way to prove value, build the eval baseline, and earn the trust needed to expand capability later — without betting the production environment on an unproven autonomous agent.",
+      "rollout": "Approve and route teams toward low-risk read/summarize/extract pilots first; require one measurable KPI and a reviewed accuracy sample before expanding to action-capable agents. Capture with tags ai-pilot,constrained,foundational-maturity."
+    },
+    {
+      "id": "require-workflow-notebook-plan-approval",
+      "name": "Require reviewed plan before agent execution (workflow notebook)",
+      "category": "AI Governance Operating Plan",
+      "signal": "👍",
+      "defaultAction": "warn",
+      "severity": "medium",
+      "pattern": "(agent|codex|automation).*(repetitive|recurring|runbook|workflow).*(no plan|skip approval|execute without review)",
+      "problem": "Automating repetitive work at OpenAI with Codex (2026): the durable pattern is a goal cell, a written plan the human reviews, approval BEFORE execution starts, then captured commands/outputs/decisions/dead-ends and a discoverable index so the next run is cheaper. Skipping the plan-approval boundary lets an agent execute an unreviewed approach.",
+      "roi": "High: plan-then-approve is the cheapest structural control that keeps a human deciding when an approach is ready, while still letting the agent do the repetitive execution and record what happened.",
+      "rollout": "Use scripts/workflow-notebook.js for repetitive agent workflows: create → plan → approve → record steps/decisions → finish (writes *.index.md for discovery). Warn when an agent begins recording execution on an unapproved notebook. Capture with tags workflow-notebook,plan-approval,decision-capture."
+    },
     {
       "id": "block-unauthorized-multi-channel-posts",
       "name": "Block unauthorized multi-channel posts by Hermes Agent",
@@ -660,6 +925,390 @@
       "problem": "Blocks any file edit or write tool call that is not within a specified active/target directory.",
       "roi": "Restricts agent edits to a controlled workspace, preventing scope drift, accidental modification of configuration or source files, and unwanted global refactors during focused task debugging.",
       "rollout": "Enable dynamically on-demand using /freeze to specify the only path(s) the agent is allowed to write to during the session."
+    },
+    {
+      "id": "block-vlt-install-vulnerable-deps",
+      "name": "Block vlt install of vulnerable dependencies",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(vlt\\s+install|vlt\\s+add).*?(--audit\\s+critical|vuln|cve|high-severity|known-vuln|left-pad|event-stream|colors|unsafe|insecure|deprecated|obsolete|legacy|vulnerable|unresolved-cve)",
+      "problem": "Blocks vlt install/add of packages flagged with --audit critical or known-vulnerable CVE references (e.g. left-pad, event-stream, colors). vlt's hosted registry provides real-time vulnerability scanning; agents must not bypass the audit pipeline.",
+      "roi": "Prevents supply-chain compromise via known-vulnerable dependencies. Direct 1st-order risk: left-pad-style incidents cause cascading production outages. Second-order: agents that install without audit never learn to check. Captured feedback (thumbgate capture --tag supply-chain-security) turns each bypass into a prevention rule.",
+      "rollout": "Require --audit critical on all vlt install/add. Block packages with known CVE references. Auto-capture feedback for each bypass attempt."
+    },
+    {
+      "id": "require-review-vlt-registry-override",
+      "name": "Require review for vlt registry override to non-approved hosts",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(vlt\\s+config\\s+set|vlt\\s+registry\\s+add|vlt\\s+set\\s+registry).*(registry|registry-url|self-host|override|redirect|mirror|vsr)",
+      "problem": "Blocks vlt registry configuration that redirects dependency resolution to non-approved self-hosted VSR or mirror hosts. Agents must only pull from allowlisted registries (vlt.sh, registry.npmjs.org, approved internal VSR).",
+      "roi": "High: Prevents supply-chain attacks via rogue registry configuration. Critical for enterprise on-prem/air-gapped environments where vlt's self-hosted VSR is the approved source. Captured feedback (thumbgate capture --tag registry-override) generates prevention rules for unauthorized redirect patterns.",
+      "rollout": "Block all registry-setting commands for non-allowlisted hosts. Warn (human review) for internal VSR. Allowlist vlt.sh, registry.npmjs.org, and approved internal domains."
+    },
+    {
+      "id": "enforce-vlt-workspace-dep-pinning",
+      "name": "Enforce pinned dependency versions in vlt workspace installs",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(vlt\\s+add|vlt\\s+install).*?(@\\s*(?:\\^|~|>|<|>=|<=|\\*|latest|next))",
+      "problem": "Blocks vlt add/install with unpinned (wildcard, range, latest/next) dependency versions. vlt workspace installs with @*, @^, @~, @>, @<, @>=, @<=, @latest, @next resolve to potentially vulnerable latest versions instead of audited pinned versions.",
+      "roi": "Pinned dependencies are the bedrock of reproducible builds and vulnerability scanning. vlt's hosted registry provides lockfiles by default; agents must respect them. Feedback (thumbgate capture --tag dep-pinning) from each bypass generates a rule for the specific unpinned package pattern.",
+      "rollout": "Enforce exact version pinning in workspace vlt add/install. Block @* ^ ~ > < >= <= latest next. Allow exact versions like @4.18.2."
+    },
+    {
+      "id": "gate-vlt-package-publishing",
+      "name": "Gate vlt package publishing for provenance and scope safety",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(vlt\\s+publish|vlt\\s+pack|npm\\s+publish).*(no-provenance|unsigned|no-2fa|no-attestation|typosquat|squat|unscoped|no-scope)",
+      "problem": "Blocks vlt/npm publish of packages without provenance attestation, 2FA, or proper scope/access controls. vlt's hosted registry supports provenance; agents must not publish unsigned or unscoped packages.",
+      "roi": "Prevents typosquatting and supply-chain attacks via unsigned package publishing. Aligns with vlt's security posture and npm provenance ecosystem. Captures high-value feedback for prevention rules.",
+      "rollout": "Require provenance attestation and 2FA for all vlt publish operations. Block publishes to scopes matching existing packages (typosquatting detection)."
+    },
+    {
+      "id": "block-vlt-private-registry-bypass",
+      "name": "Block vlt private registry bypass via npmrc or env override",
+      "category": "JavaScript Package Registry Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(\\.npmrc|vlt.*config|NPM_CONFIG_REGISTRY|VLT_REGISTRY).*(https?://(?!(?:registry\\.npmjs\\.org|vlt\\.sh|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))[\\w.-]+)",
+      "problem": "Blocks vlt/npm configuration that redirects dependency resolution to unapproved private or external registries via .npmrc, environment variables, or CLI config overrides.",
+      "roi": "High: Prevents data exfil and supply-chain compromise via rogue registry configuration. Critical for enterprise on-prem/air-gapped environments where vlt's self-hosted VSR is used.",
+      "rollout": "Block all registry overrides to non-allowlisted hosts. Allowlist vlt.sh, registry.npmjs.org, and approved internal VSR domains."
+    },
+    {
+      "id": "validate-context-before-codegen",
+      "name": "Validate context freshness and relevance before code generation",
+      "category": "AI Engineering Stack Safety",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(Edit|Write|MultiEdit|StrReplace).*",
+      "problem": "Agents frequently generate code without first ensuring AGENTS.md, CLAUDE.md, test infrastructure, and ownership context are fresh and relevant. Per the Hugging Face Context Course: 'an agent is only as good as the context it has.' Results in style violations, wrong test commands, and rework.",
+      "roi": "Eliminates rework from stale or missing project context. Direct 1st-order improvement to context-engineering workflows (Hugging Face Context Course Units 1-3). Reduces PR churn and review cycles.",
+      "rollout": "Before any Edit/Write/MultiEdit, verify AGENTS.md exists and is fresh (modified within last 7 days). Require explicit context-freshness check before code edits. Capture feedback with 'missing-context' and 'stale-context' tags."
+    },
+    {
+      "id": "require-matryoshka-embedding-dimension",
+      "name": "Require Matryoshka-aware embedding dimension selection",
+      "category": "Embedding Quality Gates",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "medium",
+      "pattern": "(embedding\\s*dimension|output.*dimension|embed.*dim).*(not.*tier|not.*matryoshka|unsupported)",
+      "problem": "Embedding dimensions should align with Matryoshka tiers (256, 512, 768, 1024, 1536, 2048, 3072, 4096, 7680) for progressive disclosure retrieval. Non-tier dimensions waste compute or hurt recall.",
+      "roi": "Reduces token spend and improves retrieval quality by using optimal dimension tiers. Enables cost-effective progressive disclosure: query at 256 dims, refine at 768, full precision at 1536+.",
+      "rollout": "Warn when embedding dimension is not a Matryoshka tier. Recommend nearest tier. Track cost savings and recall metrics in feedback loop."
+    },
+    {
+      "id": "block-embedding-recall-below-threshold",
+      "name": "Block embedding pipeline changes with insufficient recall",
+      "category": "Embedding Quality Gates",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(embedding|retrieval).*(recall.*<.*0\\.95|precision.*<.*0\\.15)",
+      "problem": "RAG pipelines require minimum recall@k ≥ 0.95 and precision@k ≥ 0.15. Changes that degrade below these thresholds hide failures from agents. Based on podcast insights: embedding model choice is the #1 underrated RAG decision.",
+      "roi": "Prevents silent RAG pipeline degradation. Ensures every embedding change maintains measurable quality. Aligns with '4 out of 5 teams have metrics but 1 in 5 sees ROI' problem - we catch quality drops before they become failures.",
+      "rollout": "Block any embedding deployment without verified baseline recall ≥ 0.95. Require recall/precision report before threshold changes. Capture feedback with tags 'embedding-quality', 'recall-regression', 'precision-degradation'."
+    },
+    {
+      "id": "require-embedding-baseline-before-tuning",
+      "name": "Require embedding baseline before precision tuning",
+      "category": "RAG Pipeline Safety",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(embedding|vector|retriever).*(tune|fine[- ]?tune|threshold|precision).*\\b(?!.*baseline)(?!.*recall[@\\s]*=?\\s*0\\.?9?5?)",
+      "problem": "Per the podcast 'RAG Mistake Almost Every Team Is Making': tuning embedding thresholds without documented baseline causes silent degradation. 80% of teams have metrics but only 20% see ROI - we prevent the 80% from making tuning mistakes.",
+      "roi": "Catches the #1 RAG pipeline mistake early. Ensures embedding improvements are measured against a preserved baseline recall. Directly addresses the 80/20 ROI gap discussed with Pete Johnson (MongoDB Field CTO).",
+      "rollout": "Block any embedding threshold/optimization without 'recall@baseline: X.XX' in context. Encourage hybrid retrieval patterns for efficient progressive disclosure."
+    },
+    {
+      "id": "enable-hybrid-retrieval-gate",
+      "name": "Enable hybrid retrieval for efficient agentic memory",
+      "category": "RAG Pipeline Optimization",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "medium",
+      "pattern": "(hybrid.*retrieval|progressive.*disclosure|matryoshka.*embed|fast.*query.*rerank)",
+      "problem": "Agentic memory (ThumbGate's pre-action enforcement) benefits from hybrid retrieval: query at 256 dims for speed, refine at 768 dims, full precision at 1536+ only when needed. This is 'better agentic memory' per the podcast.",
+      "roi": "Reduces token burn by 40-60% while maintaining recall. Enables real-time prevention without full embedding cost. Aligns with Matryoshka insights for efficient RAG.",
+      "rollout": "Enable by default for memory retrieval. Log dimension-tier performance. Route based on query complexity and result certainty."
+    },
+    {
+      "id": "require-multi-model-routing-for-complex-tasks",
+      "name": "Require multi-model routing for complex agentic tasks",
+      "category": "Hybrid Inference Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(complex_task|multi-step|agentic_run).*(single.*model|only.*one.*model).*processing",
+      "problem": "Per NVIDIA Nemotron/NeMo Switchyard: AI agents need more than one model. Complex tasks should route steps to specialized models for accuracy, efficiency, customization, and control - not use a single expensive model for everything.",
+      "roi": "Prevents 'expensive model for everything' anti-pattern. 30B MoE models like Nemotron 3.5 Lightning can evaluate routing algorithms across specialized tasks while keeping costs efficient.",
+      "rollout": "Implement model-step routing matrix. Use lightweight model for intent detection, Qwen/Claude for reasoning, specialized model for coding, etc."
+    },
+    {
+      "id": "checkpoint-model-step-routing-decision",
+      "name": "Checkpoint model step routing decision",
+      "category": "Hybrid Inference Governance",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(model_routing|routing_algorithm|step_route).*(missing|no).*(evidence|evaluation|cost_quality_tradeoff)",
+      "problem": "Multi-model routing decisions must be evaluated against cost, quality, latency, and customization requirements before being used in production agents.",
+      "roi": "Ensures routing algorithms like NeMo Switchyard are measured and produce better outcomes than single-model approaches.",
+      "rollout": "Log routing decisions with metric outcomes. Evaluate routing quality via task success rate and cost savings."
+    },
+    {
+      "id": "recommend-specialized-models-by-task",
+      "name": "Recommend specialized models by task type",
+      "category": "Model Routing Optimization",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "medium",
+      "pattern": "(task_type|coding|reasoning|math|code).*(model_recommendation.*missing|no.*specialized.*model)",
+      "problem": "Different tasks benefit from specialized models: coding (Qwen3.8-Max), math (DeepSeek R1), concise reasoning (Gemini Flash). Per Nemotron: route to the right model per step.",
+      "roi": "Maximizes capability-efficiency tradeoff. Uses cheapest capable model for each task instead of hammering expensive generalists.",
+      "rollout": "Maintain task-to-model routing table. Auto-suggest specialized model based on task characteristics and cost-capabilities matrix."
+    },
+    {
+      "id": "require-routing-evidence-for-cost-savings",
+      "name": "Require routing evidence for cost savings claims",
+      "category": "Cost Efficiency",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(cost_savings|multi-model).*(claim|route|switched).*(missing|no).*(evidence|baseline|delta_metrics)",
+      "problem": "Cost savings from multi-model routing must be measured against baseline single-model performance: output quality, latency, and actual USD saved.",
+      "roi": "Prevents routing optimization theater. Ensures multi-model routing delivers real cost savings, not just theory like '30B MoE sounds impressive'.",
+      "rollout": "Capture baseline metrics before enabling multi-model routing. Log actual vs expected savings. Feed to adaptive routing evaluation."
+    },
+    {
+      "id": "route-high-output-tasks-to-qwen-max",
+      "name": "Route high-output tasks to Qwen3.8-Max for cost optimization",
+      "category": "Cost Efficiency",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "high",
+      "pattern": "(agentic_programming|coding_agent|bulk_content|long_reasoning|high_output).*(output_tokens.*>=\\s*100000|estimated_cost.*>=\\s*0.60|claude.*Sonnet)",
+      "problem": "Qwen3.8-Max output pricing ($6/M) is 50-75% cheaper than Claude Sonnet 4.6/5 ($15-$10/M) and Gemini Pro ($10-$15/M). High-output agentic tasks should route to Qwen by default for cost savings.",
+      "roi": "Realizes 50%+ output-token cost savings on bulk automation, long agentic coding runs, and repetitive high-volume tasks. $6/mo Token Plan adds further discount for steady workloads.",
+      "rollout": "Enable cost-routing for all agentic operations. Calculate: output_tokens * $0.000006 (Qwen) vs output_tokens * $0.000010-0.000015 (Claude/Gemini). Auto-route to Qwen when cost_delta > 15%."
+    },
+    {
+      "id": "require-cost-evidence-before-model-upgrade",
+      "name": "Require cost evidence before model upgrade",
+      "category": "Cost Efficiency",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(upgrade|migrate|switch).*(model|provider).*(cost|token|budget).*(without|no).*baseline",
+      "problem": "Blocks model upgrades when baseline cost-per-outcome and ROI are not documented and benchmarked first.",
+      "roi": "Prevents expensive model sprawl by requiring measured cost evidence before adopting new providers like Qwen3.8-Max.",
+      "rollout": "Capture token usage, latency, and quality metrics before any model change. Feed to token-plan optimization."
+    },
+    {
+      "id": "block-claude-sonnet-post-priceincrease",
+      "name": "Block or warn on Claude Sonnet post-August 2026 pricing",
+      "category": "Cost Efficiency",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "high",
+      "pattern": "(model_routing|cost_optimization).*(only.*claude|claude.*Sonnet.*only).*(output_tokens.*>=\\s*50000|estimated_cost.*>=\\s*0.50)",
+      "problem": "Claude Sonnet 5 output pricing increases to $15/M on Sept 1, 2026 (from $10/M). Bulk tasks should NOT use Claude-only routing for cost-sensitive workloads.",
+      "roi": "Prevents $6 savings per 1M output tokens by routing high-volume work to Qwen3.8-Max ($6/M) instead of Claude Sonnet ($15/M).",
+      "rollout": "Warn on any high-output task routed to Claude-only. Suggest Qwen3.8-Max for bulk automation. Update after Sept 1 pricing change."
+    },
+    {
+      "id": "log-token-plan-compliance",
+      "name": "Log token plan compliance for budget protection",
+      "category": "Cost Efficiency",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "medium",
+      "pattern": "token_plan_usage.*>=\\s*(90|95)%",
+      "problem": "The $6/mo Token Plan model works best when we observe usage patterns and adjust quotas before hitting limits.",
+      "roi": "Enables proactive budget management and prevents surprise billing spikes for multimodal video generation.",
+      "rollout": "Log when >90% of token plan used. Trigger approval workflows for quota increases or local fallback mode."
+    },
+    {
+      "id": "track-token-cost-per-agentic-operation",
+      "name": "Track token cost per agentic operation",
+      "category": "Cost Efficiency",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "medium",
+      "pattern": "(token_usage_cost|input_tokens|output_tokens|token_cost).*>=\\s*(10000|50000|100000)",
+      "problem": "Observes expensive agent operations and logs cost signals to the feedback loop for cost-optimization routing decisions.",
+      "roi": "Enables data-driven cost optimization by correlating token burn with task outcomes, routing decisions, and ROI metrics.",
+      "rollout": "Enable on all LLM operations. Feed cost data to hybrid-routing decisions and prompt this insight back to agents."
+    },
+    {
+      "id": "require-usage-quota-for-multimodal-operations",
+      "name": "Require usage quota check for multimodal operations",
+      "category": "Cost Efficiency",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(video|image|audio).*(generation|creation|edit).*(missing|no).*(quota|budget|cost limit)",
+      "problem": "Blocks expensive multimodal generation when usage quota or cost budget would be exceeded, preventing surprise bills.",
+      "roi": "Prevents cloud egress and expensive model operations from blowing through monthly budgets, especially for Qwen-Wan video models.",
+      "rollout": "Set per-project quotas aligned with the Token Plan model ($0.084-$0.18/s for video). Block or warn when approaching limits."
+    },
+    {
+      "id": "checkpoint-hybrid-cost-routing",
+      "name": "Checkpoint hybrid cost-routing decisions",
+      "category": "Cost Efficiency",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "medium",
+      "pattern": "(hybrid|local-cloud|perplexity.*hybrid).*(sensitive|secret|pii|codebase|customer).*(escalat|cloud|send to server)",
+      "problem": "Requires cost-budget approval before expensive cloud escalation for local-sensitive work, balancing privacy and ROI.",
+      "roi": "Enables hybrid cost savings while preventing accidental expensive cloud bills for sensitive data that should stay local.",
+      "rollout": "Start as warn; capture hybrid-route feedback tags and evolve to block for PII-heavy workloads."
+    },
+    {
+      "id": "gate-qwen-model-studio-egress",
+      "name": "Gate Qwen Model Studio egress",
+      "category": "Qwen Agent Governance",
+      "signal": "👎",
+      "defaultAction": "warn",
+      "severity": "medium",
+      "pattern": "dashscope(-intl)?\\.aliyuncs\\.com",
+      "problem": "Audits outbound model service calls to Alibaba Cloud Model Studio endpoints for telemetry & budget compliance.",
+      "roi": "Prevents unmonitored model egress and unexpected API spend.",
+      "rollout": "Enable when using Qwen3.8-Max or Qwen3.7-Plus models in hybrid agent runtimes."
+    },
+    {
+      "id": "block-unverified-qwen-gui-actions",
+      "name": "Block unverified Qwen visual GUI actions",
+      "category": "Qwen Agent Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "qwen_gui_action_without_verification",
+      "problem": "Prevents Qwen visual-agent models from taking destructive GUI desktop or browser actions without prior evidence check.",
+      "roi": "Safeguards computer-use and visual agent automation from unintended clicks.",
+      "rollout": "Enable for Qwen3-VL-Plus and Qwen3.7-Plus agent workflows."
+    },
+    {
+      "id": "require-provider-interoperability-audit",
+      "name": "Require provider interoperability audit trail",
+      "category": "Hybrid Inference Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(provider_switch|model_route|hybrid_route).*(deepseek|kimi|openai|claude|grok).*(no audit|no trace|no routing_log)",
+      "problem": "Hybrid local-cloud routing across multiple providers must leave an audit trail linking input, provider choice, cost, and quality outcome.",
+      "roi": "Enables cost-quality tradeoffs across DeepSeek, Kimi, OpenAI, Claude, Grok, and Qwen - prevents cost-optimized local decisions from being reversed by expensive cloud lookups.",
+      "rollout": "Enable for all hybrid routing decisions. Capture provider, cost, latency, and quality in the audit trail."
+    },
+    {
+      "id": "require-model-studio-readiness-check",
+      "name": "Require Model Studio readiness check before deployment",
+      "category": "Production AI Safety",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(production|deploy|go-live).*(no model.*studio|no readiness|no baseline|no traffic.*test)",
+      "problem": "Your fastest path to production AI (Model Studio) requires baseline traffic tests, error budgets, and rollback plans before rollout.",
+      "roi": "Prevents untested model deployments from reaching production users and damaging trust.",
+      "rollout": "Run traffic shadow tests before any production model switch. Enable for Qwen3.8-Max and other new model deployments."
+    },
+    {
+      "id": "require-multimodal-safety-gate",
+      "name": "Require multimodal safety gate for Qwen-VL and image generation",
+      "category": "Visual Agent Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(multimodal|vision.*model|image.*generation|video.*generation).*(no safety gate|no content filter|no guardrail)",
+      "problem": "Qwen-VL-Plus, Qwen-Image, and video generation models need content safety filters to prevent harmful output.",
+      "roi": "Protects brand and users from inappropriate content while enabling powerful creative generation capabilities.",
+      "rollout": "Enable for Qwen3-VL-Plus, Qwen-Image-3.0-Pro, Wan2.7 series. Filter at input and output stages."
+    },
+    {
+      "id": "recommend-qwen-for-bulk-automation",
+      "name": "Recommend Qwen3.8-Max for bulk automation workflows",
+      "category": "Cost Optimization",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "medium",
+      "pattern": "(bulk_operation|mass_generation|repetitive_task|long_running_agent).*(recommended_model.*!=.*qwen)",
+      "problem": "For bulk, repetitive, or long-running agent workflows, Qwen3.8-Max is the optimal default: 30-60% cheaper output than Claude/Sonnet, with 1M context window for complex reasoning.",
+      "roi": "Directs high-volume workloads to the most cost-effective model. Saves $9 per 1M output tokens vs Claude Sonnet 4.6 ($15/M).",
+      "rollout": "Set Qwen3.8-Max as default for bulk operations. Allow explicit override with cost-delta documentation."
+    },
+    {
+      "id": "github-ruleset-migration-audit",
+      "name": "Audit GitHub Ruleset Migration & Bypass Permissions",
+      "category": "GitHub Ruleset Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(ruleset|branch_protection|bypass_actors)\\s+(delete|bypass|disable|override|admin_force)",
+      "problem": "Prevents agents or un-audited processes from disabling GitHub Rulesets or modifying bypass actors on protected repositories during migration.",
+      "roi": "Protects repository rulesets during branch-protection to rulesets migration; keeps zero-bypass policy enforceable.",
+      "rollout": "Enable on all production repos with layered classic protection + repository rulesets."
+    },
+    {
+      "id": "enforce-ruleset-bypass-actor-scoping",
+      "name": "Enforce strict scoping on Ruleset bypass actors",
+      "category": "GitHub Ruleset Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(ruleset_bypass|bypass_actor)\\s+(add_user|all_admins|wildcard_actor)",
+      "problem": "Requires fine-grained app/bot scoping on Ruleset bypass permissions instead of granting broad user or admin bypass rights.",
+      "roi": "Blocks owner-token / admin soft-bypass of merge governance; keeps agent autonomy inside protection bounds.",
+      "rollout": "Pair with config/main-branch-ruleset.json zero bypass_actors and npm run rulesets:check."
+    },
+    {
+      "id": "require-hypothesis-verify-before-claim",
+      "name": "Require hypothesis → verify before research claims",
+      "category": "Research Agent Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "critical",
+      "pattern": "(claim|progress_claim|research_done).*(without[_ -]?verify|no[_ -]?evidence|skip[_ -]?verify)|CLAIM_WITHOUT_VERIFY",
+      "problem": "Stops research/RSI agents from claiming progress without a completed hypothesis→experiment→verify cycle (EdotEnv operating pattern, ThumbGate enforcement).",
+      "roi": "Prevents false research progress, bad post-training labels, and 'we improved' theater in multi-step agent loops.",
+      "rollout": "Enable on research harnesses, autoresearch, and any agent that writes experiment claims. Wire scripts/research-agent-harness.js."
+    },
+    {
+      "id": "ratchet-difficulty-after-verified-pass",
+      "name": "Ratchet difficulty after verified pass",
+      "category": "Research Agent Governance",
+      "signal": "👍",
+      "defaultAction": "allow",
+      "severity": "medium",
+      "pattern": "(harder[_ -]?next[_ -]?round|difficulty[_ -]?ratchet|curriculum[_ -]?promote)",
+      "problem": "After a full verified research cycle, the next round must get harder so agents cannot farm easy tasks forever (EdotEnv frontier transfer).",
+      "roi": "Keeps evaluation pressure real; surfaces weak gate configs before production RSI-style loops overfit easy cases.",
+      "rollout": "Use scripts/governance-difficulty-curriculum.js and research-agent-harness harderNextRound after CLAIM_ACCEPTED."
+    },
+    {
+      "id": "require-safety-hillclimb-before-rl-post-train",
+      "name": "Require safety hillclimb before RL post-training",
+      "category": "Research Agent Governance",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(post[_ -]?train|grpo|gspo|rlhf|rl_post).*(without[_ -]?hillclimb|skip[_ -]?safety|no[_ -]?eval)",
+      "problem": "Blocks RL / GRPO / GSPO post-training launches that lack a safety hillclimb pass and verified research-cycle evidence.",
+      "roi": "Stops reward-hacking agents from being promoted into production after only train-set wins.",
+      "rollout": "Pair with scripts/post-training-governance.js and scripts/rsi-safety-hillclimb.js on any RL training kickoff."
     }
   ]
 }