thumbgate 1.34.3 → 1.37.1

package/config/gates/actor-critic-audit.json

@@ -0,0 +1,34 @@
+{
+  "version": 1,
+  "harness": "actor-critic-audit",
+  "description": "Enforces Actor-Critic process audits (inspired by Netflix oci-agent). Gating high-consequence data mutations, causal reports, or deployment triggers without an approved critic review receipt.",
+  "gates": [
+    {
+      "id": "actor-critic-missing-process-audit",
+      "layer": "PreAction",
+      "pattern": "^(?!.*(?:critic_rating=(?:fully_satisfactory|satisfactory_with_caveats)|criticReceipt=(?:fully_satisfactory|satisfactory_with_caveats))).*(?:publish_causal_report|deploy_treatment_policy|mutate_production_dataset|dispatch_automated_decision)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "block",
+      "severity": "critical",
+      "message": "Actor-Critic process audit required before high-consequence action. Verify that an approved critic audit receipt (fully_satisfactory or satisfactory_with_caveats) is attached."
+    },
+    {
+      "id": "actor-critic-placebo-test-failure",
+      "layer": "PreAction",
+      "pattern": "(?:placebo_test_failed|failed_counterfactual_balance|unmeasured_confounder_risk)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "block",
+      "severity": "high",
+      "message": "Critic flagged failed placebo test or counterfactual imbalance. Downstream policy mutation blocked until spec tweaks are applied."
+    },
+    {
+      "id": "actor-critic-early-adopter-bias-warning",
+      "layer": "PreAction",
+      "pattern": "(?:early_adopter_bias|selection_hazard|imbalanced_propensity)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "warn",
+      "severity": "medium",
+      "message": "Potential selection bias or early-adopter skew detected by critic. Review sensitivity analysis before finalizing recommendations."
+    }
+  ]
+}

package/config/gates/default.json

@@ -180,6 +180,25 @@
         "CWE-863"
       ]
     },
+    {
+      "id": "outbound-email-send",
+      "layer": "Execution",
+      "trigger": "any:outbound_email_send",
+      "pattern": "(?:(?:^|[_.])send[_-]?(?:message|mail|email|now|draft)s?\\b|emailer[_-]?messages?[_-]?send|(?:^|[_.])send_draft\\b|users\\/[^/\\s\"\\']+\\/messages\\/send|\\bmessages\\/send\\b|messages\\s*\\(\\s*\\)\\s*\\.\\s*send\\s*\\(|users\\s*\\(\\s*\\)\\s*\\.\\s*messages\\s*\\(\\s*\\)\\s*\\.\\s*send\\b|(?:^|[\\s;/])sendmail\\b|\\bmsmtp\\b|\\bmailx?\\s+-s\\b|(?:import\\s+smtplib|from\\s+smtplib\\b|\\bsmtplib\\.SMTP\\b)|(?:require\\s*\\(\\s*[\\'\"]nodemailer[\\'\"]\\s*\\)|from\\s+[\\'\"]nodemailer[\\'\"]|nodemailer\\.createTransport)|createTransport\\s*\\()",
+      "action": "block",
+      "adminOverride": {
+        "required": true,
+        "digestBound": true,
+        "singleUse": true,
+        "ttlMs": 900000
+      },
+      "message": "Outbound email SEND is hard-blocked unless a separately authenticated admin approves this exact action digest. The approval expires after 15 minutes and is consumed once. create_draft / update_draft / list_drafts remain allowed without send approval.",
+      "severity": "critical",
+      "compliance": [
+        "SOC2-CC6.1",
+        "CWE-285"
+      ]
+    },
     {
       "id": "git-reset-hard",
       "layer": "Execution",
@@ -272,7 +291,7 @@
       "toolNames": [
         "Bash"
       ],
-      "pattern": "(?:\\b(?:curl|wget)\\b[^\\n]{0,600}https?://(?!(?:github\\.com|registry\\.npmjs\\.org|api\\.anthropic\\.com|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))[\\w.-]+|\\b(?:curl|wget)\\b\\s+(?:-\\S+\\s+)*(?!(?:https?://)?(?:github\\.com|registry\\.npmjs\\.org|api\\.anthropic\\.com|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))(?:[\\w.-]+\\.)+[a-z]{2,}(?:[:/?#]|\\s|$)|\\bopen\\b[^\\n]{0,240}https?://(?!(?:github\\.com|registry\\.npmjs\\.org|api\\.anthropic\\.com|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))[\\w.-]+|\\bnode\\b[^\\n]{0,240}\\bfetch\\s*\\(|\\bpython3?\\b[^\\n]{0,240}\\b(?:requests\\.(?:get|post)|urllib\\.request))",
+      "pattern": "(?:\\b(?:curl|wget)\\b[^\\n]{0,600}--connect-to\\b|\\b(?:curl|wget)\\b[^\\n]{0,600}https?://[^/\\s\"\\']*@[\\w.-]+)|(?:\\b(?:curl|wget)\\b[^\\n]{0,600}https?://(?!(?:github\\.com|registry\\.npmjs\\.org|api\\.anthropic\\.com|thumbgate\\.ai|thumbgate-production\\.up\\.railway\\.app|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))[\\w.-]+|\\b(?:curl|wget)\\b\\s+(?:-\\S+\\s+)*(?!(?:https?://)?(?:github\\.com|registry\\.npmjs\\.org|api\\.anthropic\\.com|thumbgate\\.ai|thumbgate-production\\.up\\.railway\\.app|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))(?:[\\w.-]+\\.)+[a-z]{2,}(?:[:/?#]|\\s|$)|\\bopen\\b[^\\n]{0,240}https?://(?!(?:github\\.com|registry\\.npmjs\\.org|api\\.anthropic\\.com|thumbgate\\.ai|thumbgate-production\\.up\\.railway\\.app|localhost|127\\.0\\.0\\.1|\\[::1\\]|0\\.0\\.0\\.0)(?:[:/?#]|$))[\\w.-]+|\\bnode\\b[^\\n]{0,240}\\bfetch\\s*\\(|\\bpython3?\\b[^\\n]{0,240}\\b(?:requests\\.(?:get|post)|urllib\\.request))",
       "action": "warn",
       "unless": "egress_approved",
       "message": "Potential unauthorized network egress detected.",
@@ -490,7 +509,7 @@
       "toolNames": [
         "Bash"
       ],
-      "pattern": "(?:kill|pkill|killall)\\s+.*(?:thumbgate|gates-engine|budget-enforcer)",
+      "pattern": "(?:^|[^A-Za-z0-9_])(?:kill|pkill|killall)\\s+.*(?:thumbgate|gates-engine|budget-enforcer)",
       "action": "block",
       "message": "Self-protection: agent cannot terminate ThumbGate processes.",
       "severity": "critical",

package/config/gates/five-walls-governance.json

@@ -0,0 +1,34 @@
+{
+  "version": 1,
+  "harness": "five-walls-governance",
+  "description": "Enforces the 4-layer action safety cascade from InfoWorld: Visibility, Hard Deny, Policy Cascade, and Preconditions.",
+  "gates": [
+    {
+      "id": "five-walls-hard-deny-guardrail-tampering",
+      "layer": "PreAction",
+      "pattern": "(?:config/gates/|\\.thumbgate/rules|\\.github/workflows/main-branch-ruleset)",
+      "toolNames": ["Edit", "Write", "Bash"],
+      "action": "block",
+      "severity": "critical",
+      "message": "Direct tampering with guardrail policies or branch protection configuration is blocked by hard deny-list."
+    },
+    {
+      "id": "five-walls-precondition-prior-read",
+      "layer": "PreAction",
+      "pattern": "^(?!.*(?:read_receipt=verified|schema_introspected=true)).*(?:mutate_database_schema|drop_table|truncate_table)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "block",
+      "severity": "high",
+      "message": "Destructive database mutations require verified prior schema introspection receipt (schema_introspected=true)."
+    },
+    {
+      "id": "five-walls-unverified-credentials-egress",
+      "layer": "PreAction",
+      "pattern": "(?:cat\\s+.*\\.env|printenv|security\\s+find-generic-password.*-w)",
+      "toolNames": ["Bash"],
+      "action": "block",
+      "severity": "critical",
+      "message": "Raw credential extraction is prohibited by the authentication boundary."
+    }
+  ]
+}

package/config/gates/future-agi-guardrails.json

@@ -0,0 +1,34 @@
+{
+  "version": 1,
+  "harness": "future-agi-guardrails",
+  "description": "Enforces Future AGI-inspired self-healing guardrails, adversarial simulation checks, and prompt-injection defense at the pre-action tool call boundary.",
+  "gates": [
+    {
+      "id": "future-agi-unmeasured-prompt-injection",
+      "layer": "PreAction",
+      "pattern": "(?:IGNORE ALL PREVIOUS INSTRUCTIONS|SYSTEM OVERRIDE|DAN MODE|JAILBREAK|bypass_safety_checks|eval\\(atob|unfiltered_developer_mode)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "block",
+      "severity": "critical",
+      "message": "Prompt injection or safety override detected in payload. Action blocked by Future AGI pre-action guardrails."
+    },
+    {
+      "id": "future-agi-failing-simulation-block",
+      "layer": "PreAction",
+      "pattern": "^(?!.*(?:simulation_passed=true|simulationReceipt=approved)).*(?:dispatch_autonomous_agent|deploy_agent_workflow|execute_production_mutation)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "block",
+      "severity": "high",
+      "message": "Autonomous workflow dispatch requires an approved Future AGI adversarial simulation receipt (simulation_passed=true)."
+    },
+    {
+      "id": "future-agi-ungrounded-hallucination-warning",
+      "layer": "PreAction",
+      "pattern": "(?:unverified_citation|hallucinated_schema_column|zero_confidence_retrieval)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "warn",
+      "severity": "medium",
+      "message": "Potential ungrounded generation or retrieval discrepancy detected by evaluation rubric. Verify citations before persisting changes."
+    }
+  ]
+}

package/config/gates/radware-threat-defense-2026.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "harness": "radware-threat-defense-2026",
+  "version": "1.1.0",
+  "description": "Radware/Bot-Manager-inspired PreAction defense: ShadowLeak + ZombieAgent blocks and suspicious-bot challenge. Rate-burst circuit breaker is enforced in gates-engine via persisted call history (not a catch-all pattern gate).",
+  "gates": [
+    {
+      "id": "shadowleak-exfiltration-firewall",
+      "layer": "PreAction",
+      "action": "block",
+      "severity": "critical",
+      "description": "Blocks AI agent data exfiltration via secondary tool calls, hidden markdown images, tracking pixels, or URL parameter stuffing carrying sensitive context.",
+      "toolNames": [
+        "Bash",
+        "Edit",
+        "Write",
+        "Http",
+        "Browser",
+        "Send",
+        "MultiEdit"
+      ],
+      "pattern": "!\\[.*?\\]\\(https?:\\/\\/[^)\\s]+\\?(?:data|token|key|cookie|leak|mem|secret)=[^)\\s]+\\)|curl\\s+[^|\\r\\n]*?(?:-d|--data|-F)\\s+[^|\\r\\n]*?(?:token|secret|password|credential|env|auth)|(?:fetch|axios|request)\\s*\\(\\s*[`'\\\"]https?:\\/\\/[^`'\\\"]*?(?:exfil|leak|webhook|collect)",
+      "message": "Action blocked: ShadowLeak data exfiltration vector detected. Secondary egress channel prohibited."
+    },
+    {
+      "id": "zombieagent-loop-interdiction",
+      "layer": "PreAction",
+      "action": "block",
+      "severity": "critical",
+      "description": "Interdicts Indirect Prompt Injection (IPI) vectors embedded in external web/email/ticket payloads attempting to hijack agent control loops.",
+      "toolNames": [
+        "Bash",
+        "Edit",
+        "Write",
+        "Eval",
+        "Dispatch",
+        "MultiEdit"
+      ],
+      "pattern": "\\b(?:system\\s*override|act\\s*as\\s*zombie|unrestricted\\s*agent|drop\\s*prior\\s*instructions|ignore\\s*all\\s*guardrails)\\b|\\b(?:execute\\s*without\\s*approval|silently\\s*forward\\s*to|covert\\s*execution|bypass\\s*firewall)\\b",
+      "message": "Action blocked: ZombieAgent indirect prompt injection hijacking attempt detected. Execution loop halted."
+    },
+    {
+      "id": "suspicious-bot-challenge",
+      "layer": "PreAction",
+      "action": "warn",
+      "severity": "medium",
+      "description": "Bot Manager\u2013style challenge tier: flag suspicious automation / scrape / ATO spray language for human review without hard-deny of safe work.",
+      "toolNames": [
+        "Bash",
+        "Edit",
+        "Write",
+        "Http",
+        "Browser",
+        "Send",
+        "MultiEdit"
+      ],
+      "pattern": "\\b(?:scrape\\s+all|mass[- ]scrape|credential\\s*stuff|ato\\s*attack|account\\s*takeover\\s*spray)\\b|\\b(?:headless\\s+flood|burst\\s+tool\\s+calls|token\\s*drain\\s*loop)\\b",
+      "message": "Challenge: suspicious automation pattern detected (Bot Manager detect\u2192challenge ladder). Confirm intent before continuing."
+    }
+  ]
+}

package/config/gates/simatree-data-governance.json

@@ -0,0 +1,33 @@
+{
+  "version": 1,
+  "harness": "simatree-data-governance",
+  "name": "Simatree Enterprise Data Lifecycle & BI Governance",
+  "description": "Enforces 'Why Before How' intent validation, destructive SQL interdiction, Bayesian confidence thresholds, and PMO transformation stage audit receipts for enterprise data workflows. Schema note: scripts/gates-engine.js loadGatesConfig() reads ONLY a top-level `gates` array whose rules carry a `pattern` string, and compiles it with new RegExp(pattern) with no flags. A `patterns`/`regex` shape loads zero rules, and an inline (?i) flag throws and is swallowed by the matcher's catch, leaving the gate silently inert. Case-insensitivity is therefore written out as character classes.",
+  "gates": [
+    {
+      "id": "simatree-destructive-sql",
+      "layer": "PreAction",
+      "pattern": "(?:[Dd][Rr][Oo][Pp]\\s+(?:[Tt][Aa][Bb][Ll][Ee]|[Dd][Aa][Tt][Aa][Bb][Aa][Ss][Ee]|[Ss][Cc][Hh][Ee][Mm][Aa])|[Tt][Rr][Uu][Nn][Cc][Aa][Tt][Ee]\\s+[Tt][Aa][Bb][Ll][Ee]|[Aa][Ll][Tt][Ee][Rr]\\s+[Tt][Aa][Bb][Ll][Ee]\\s+.*[Dd][Rr][Oo][Pp]\\s+[Cc][Oo][Ll][Uu][Mm][Nn]|[Dd][Ee][Ll][Ee][Tt][Ee]\\s+[Ff][Rr][Oo][Mm]\\s+(?:[\\w$]+|\"[^\"]+\"|`[^`]+`|\\[[^\\]]+\\])(?:\\s*\\.\\s*(?:[\\w$]+|\"[^\"]+\"|`[^`]+`|\\[[^\\]]+\\]))*\\s*;)",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "block",
+      "severity": "critical",
+      "message": "Destructive data operations require validated business intent and an explicit snapshotId rollback plan. The table matcher accepts schema-, project- and quote-qualified names (analytics.customers, `proj.ds.tbl`, \"s\".\"t\", [dbo].[T]) because those are the forms Snowflake, BigQuery, Databricks and Postgres actually emit; a bare \\w+ matcher let every one of them through."
+    },
+    {
+      "id": "simatree-missing-intent",
+      "layer": "PreAction",
+      "pattern": "[Ii][Nn][Tt][Ee][Nn][Tt]\\s*[:=]\\s*[\"']?(?:[Tt][Ee][Ss][Tt]|[Tt][Ee][Mm][Pp]|[Ff][Ii][Xx]|[Aa][Ss][Aa][Pp]|[Uu][Pp][Dd][Aa][Tt][Ee]|[Mm][Ii][Ss][Cc]|[Tt][Oo][Dd][Oo])[\"']?\\s*(?:$|[,;])",
+      "toolNames": ["Bash", "Edit", "Write"],
+      "action": "block",
+      "severity": "high",
+      "message": "Data modifications require context-grounded business intent of at least 15 characters. Placeholder intents (test, temp, fix, asap, update, misc, todo) do not record why the change is being made."
+    }
+  ],
+  "author": "ThumbGate Security & Simatree Enterprise Systems",
+  "metadata": {
+    "framework": "Simatree Data Lifecycle Architecture",
+    "advisor": "Wesley Flores (Managing Partner, Simatree)",
+    "category": "Enterprise Data & Analytics Governance",
+    "enforcementMode": "ENFORCE"
+  }
+}

package/config/mcp-allowlists.json

@@ -62,8 +62,12 @@
       "prevention_rules",
       "recall",
       "record_action_receipt",
+      "record_broker_execution_receipt",
       "record_task_outcome",
+      "reconcile_broker_receipt_chain",
       "reconcile_purchase_ledger",
+      "get_broker_execution_receipts",
+      "verify_broker_execution_receipt",
       "reflect_on_feedback",
       "register_claim_gate",
       "report_product_issue",

package/config/merge-quality-checks.json

@@ -20,6 +20,15 @@
     "cancel"
   ],
   "selfReferentialChecks": [
-    "Trunk Merge Queue (main)"
+    "Trunk Merge Queue (main)",
+    "SonarCloud Code Analysis",
+    "SonarCloud",
+    "Merge blob reports"
+  ],
+  "optionalChecks": [
+    "Vercel",
+    "Vercel Preview Comments",
+    "Gitar",
+    "Gitar AI"
   ]
 }