thumbgate 1.34.3 → 1.37.1

package/src/api/server.js

@@ -16,6 +16,10 @@ const {
   buildIntakeDiscoveryPacket,
   buildIntakeQualificationCard,
 } = require('../../scripts/revenue-offer-system');
+const {
+  getSecurityQuestionnaire,
+  renderSecurityOverviewHtml,
+} = require('../security-questionnaire');
 
 const POSTHOG_API_PATHS = new Set(['/capture', '/batch', '/decide', '/e', '/engage']);
 const POSTHOG_INGEST_HOST = 'us.i.posthog.com';
@@ -139,6 +143,10 @@ const {
   getBillingSummaryLive,
   getBillingSummariesLive,
 } = require('../../scripts/billing');
+const {
+  ensureProductionSearchCorpus,
+  shouldEnsureProductionSearchCorpus,
+} = require('../../scripts/ensure-production-search-corpus');
 const {
   DEFAULT_PUBLIC_APP_ORIGIN,
   resolveHostedBillingConfig,
@@ -188,6 +196,49 @@ const {
   recordDecisionOutcome,
   computeDecisionMetrics,
 } = require('../../scripts/decision-journal');
+const {
+  HermesPlatformProtocol,
+} = require('../hermes-platform-protocol');
+const {
+  HermesSyncPlane,
+} = require('../hermes-sync-plane');
+
+// Partition Hermes protocol/sync state by hosted tenant so one customer's
+// connection/thread/approval maps cannot be read or mutated by another.
+const hostedHermesByTenant = new Map();
+
+function resolveHermesTenantKey(requestDataIdentity) {
+  return requestDataIdentity?.partition || '__default__';
+}
+
+function getHostedHermes(requestDataIdentity) {
+  const key = resolveHermesTenantKey(requestDataIdentity);
+  let entry = hostedHermesByTenant.get(key);
+  if (!entry) {
+    entry = {
+      protocol: new HermesPlatformProtocol(),
+      syncPlane: new HermesSyncPlane(),
+    };
+    hostedHermesByTenant.set(key, entry);
+  }
+  return entry;
+}
+
+function resolveHermesApproverId(req, humanReviewerConfig, requestDataIdentity) {
+  if (humanReviewerConfig?.key && humanReviewerConfig?.id) {
+    const header = req.headers['x-thumbgate-human-reviewer-key'];
+    const presented = Array.isArray(header) ? header[0] : header;
+    if (safeKeyEqual(presented, humanReviewerConfig.key)) {
+      return humanReviewerConfig.id;
+    }
+  }
+  if (requestDataIdentity?.accessContext?.principalId) {
+    return requestDataIdentity.accessContext.principalId;
+  }
+  const role = resolveKeyRole(extractApiKey(req));
+  if (role) return `thumbgate:${role}`;
+  return null;
+}
 const {
   generateDashboard,
   buildReviewSnapshot,
@@ -195,6 +246,10 @@ const {
   writeDashboardReviewState,
   collectAllFeedbackEntries,
 } = require('../../scripts/dashboard');
+const {
+  isDashboardDataLimitError,
+  formatDashboardLimitDetail,
+} = require('../../scripts/dashboard-limits');
 const {
   collectAggregateLogEntries,
   computeAggregateFeedbackStats,
@@ -214,6 +269,7 @@ const {
 } = require('../../scripts/thumbgate-search');
 const {
   appendTelemetryPing,
+  headerHasPrivacyOptOut,
 } = require('../../scripts/telemetry-analytics');
 const {
   buildProductIssueTitle,
@@ -274,10 +330,13 @@ const EVAL_SCORECARD_PAGE_PATH = path.resolve(__dirname, '../../public/eval-scor
 const EVALUATIONS_PAGE_PATH = path.resolve(__dirname, '../../public/evaluations.html');
 const CASE_STUDIES_PAGE_PATH = path.resolve(__dirname, '../../public/case-studies.html');
 const FEDERAL_PAGE_PATH = path.resolve(__dirname, '../../public/federal.html');
+const YT_PAGE_PATH = path.resolve(__dirname, '../../public/yt.html');
 const PRICING_PAGE_PATH = path.resolve(__dirname, '../../public/pricing.html');
 const ABOUT_PAGE_PATH = path.resolve(__dirname, '../../public/about.html');
 const DIAGNOSTIC_PAGE_PATH = path.resolve(__dirname, '../../public/diagnostic.html');
+const FOUNDERS_PAGE_PATH = path.resolve(__dirname, '../../public/founders.html');
 const PARTNER_INTAKE_PAGE_PATH = path.resolve(__dirname, '../../public/partner-intake.html');
+const PETER_PAGE_PATH = path.resolve(__dirname, '../../public/peter.html');
 const INSTALL_PAGE_PATH = path.resolve(__dirname, '../../public/install.html');
 const LEARN_DIR = path.resolve(__dirname, '../../public/learn');
 const GUIDES_DIR = path.resolve(__dirname, '../../public/guides');
@@ -292,6 +351,7 @@ const COMPARE_PAGE_PATHS_BY_SLUG = buildPublicHtmlFileMap(COMPARE_DIR);
 const USE_CASE_PAGE_PATHS_BY_SLUG = buildPublicHtmlFileMap(USE_CASES_DIR);
 const BLOG_PAGE_PATHS_BY_SLUG = buildPublicHtmlFileMap(BLOG_DIR);
 const BUYER_INTENT_SCRIPT_PATH = path.resolve(__dirname, '../../public/js/buyer-intent.js');
+const WEBMCP_SCRIPT_PATH = path.resolve(__dirname, '../../public/js/webmcp.js');
 const STATIC_MIME_BY_EXT = Object.freeze({
   '.png': 'image/png',
   '.jpg': 'image/jpeg',
@@ -640,6 +700,30 @@ const TRACKED_LINK_TARGETS = Object.freeze({
       utm_campaign: 'github_repo',
     },
   },
+  npm: {
+    href: 'https://www.npmjs.com/package/thumbgate',
+    external: true,
+    ctaId: 'go_npm',
+    ctaPlacement: 'link_router',
+    eventType: 'cta_click',
+    defaults: {
+      utm_source: 'website',
+      utm_medium: 'link_router',
+      utm_campaign: 'npm_package',
+    },
+  },
+  marketplace: {
+    href: 'https://github.com/marketplace/actions/thumbgate-agent-governance',
+    external: true,
+    ctaId: 'go_marketplace',
+    ctaPlacement: 'link_router',
+    eventType: 'cta_click',
+    defaults: {
+      utm_source: 'website',
+      utm_medium: 'link_router',
+      utm_campaign: 'github_marketplace_action',
+    },
+  },
 });
 
 // ---------------------------------------------------------------------------
@@ -883,7 +967,7 @@ function hashDataIdentity(prefix, value) {
 }
 
 function buildHostedTenantIdentity(validation = {}) {
-  if (!validation || validation.valid !== true || !validation.customerId) return null;
+  if (validation?.valid !== true || !validation.customerId) return null;
   const tenantSeed = validation.customerId;
   const principalSeed = validation.installId || tenantSeed;
   const tenantId = hashDataIdentity('tenant', tenantSeed);
@@ -1820,11 +1904,20 @@ function buildWorkflowIntakeQueue(parsed, workflowSprintIntake, feedbackDir, opt
 }
 
 function sendInvalidAnalyticsWindowProblem(res, title, err) {
+  if (isDashboardDataLimitError(err)) {
+    sendProblem(res, {
+      type: PROBLEM_TYPES.INTERNAL,
+      title: 'Dashboard data too large',
+      status: 503,
+      detail: formatDashboardLimitDetail(err, { phase: 'assembly' }),
+    });
+    return;
+  }
   sendProblem(res, {
     type: PROBLEM_TYPES.INVALID_REQUEST,
     title,
     status: 400,
-    detail: err?.message ? err.message : 'Invalid analytics window request.',
+    detail: err?.message || 'Invalid analytics window request.',
   });
 }
 
@@ -1851,19 +1944,103 @@ function resolveBillingSummaryOptionsOrRespondProblem(res, parsed, invalidTitle)
 
 async function buildLiveDashboardData(parsed, feedbackDir) {
   const summaryOptions = resolveBillingSummaryOptions(parsed);
-  const billingSummary = await getBillingSummaryLive(summaryOptions);
+  // Stripe/live billing can hang longer than the authenticated deploy proof
+  // timeout (12s). Prefer live, but fail closed to local summary so /v1/dashboard
+  // remains usable for operational proof.
+  const liveTimeoutMs = Number(process.env.THUMBGATE_DASHBOARD_BILLING_TIMEOUT_MS || 4000);
+  let billingSummary;
+  let billingSource = 'live';
+  try {
+    billingSummary = await Promise.race([
+      getBillingSummaryLive(summaryOptions),
+      new Promise((_, reject) => {
+        const timer = setTimeout(() => reject(new Error('billing_summary_timeout')), liveTimeoutMs);
+        if (typeof timer.unref === 'function') timer.unref();
+      }),
+    ]);
+  } catch {
+    billingSummary = getBillingSummary(summaryOptions);
+    billingSource = 'local';
+  }
   const data = generateDashboard(feedbackDir, {
     analyticsWindow: summaryOptions,
     billingSummary,
-    billingSource: 'live',
+    billingSource,
     authContext: { tier: 'pro' },
   });
   return { summaryOptions, data };
 }
 
+const DEFAULT_DASHBOARD_CACHE_TTL_MS = 30_000;
+const DEFAULT_DASHBOARD_CACHE_MAX_ENTRIES = 32;
+const liveDashboardCache = new Map();
+
+function parseNonNegativeInteger(value, fallback) {
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+
+function buildLiveDashboardCacheKey(parsed, feedbackDir) {
+  const query = new URLSearchParams(parsed.searchParams);
+  query.sort();
+  return `${path.resolve(feedbackDir)}?${query.toString()}`;
+}
+
+async function loadCachedLiveDashboardData(parsed, feedbackDir, options = {}) {
+  const now = options.now || Date.now;
+  const build = options.build || buildLiveDashboardData;
+  const cache = options.cache || liveDashboardCache;
+  const ttlMs = parseNonNegativeInteger(
+    options.ttlMs ?? process.env.THUMBGATE_DASHBOARD_CACHE_TTL_MS,
+    DEFAULT_DASHBOARD_CACHE_TTL_MS,
+  );
+  const maxEntries = parseNonNegativeInteger(
+    options.maxEntries ?? process.env.THUMBGATE_DASHBOARD_CACHE_MAX_ENTRIES,
+    DEFAULT_DASHBOARD_CACHE_MAX_ENTRIES,
+  );
+  const key = buildLiveDashboardCacheKey(parsed, feedbackDir);
+  const currentTime = now();
+  const cached = cache.get(key);
+  if (cached && (cached.promise || cached.expiresAt > currentTime)) {
+    return cached.promise || cached.value;
+  }
+
+  if (maxEntries === 0) {
+    return build(parsed, feedbackDir);
+  }
+
+  if (cached) cache.delete(key);
+  for (const [cacheKey, entry] of cache) {
+    if (!entry.promise && entry.expiresAt <= currentTime) cache.delete(cacheKey);
+  }
+  while (cache.size >= maxEntries) {
+    const evictableKey = [...cache].find(([, entry]) => !entry.promise)?.[0];
+    if (!evictableKey) {
+      const error = new Error('Live dashboard cache is at concurrent build capacity.');
+      error.code = 'DASHBOARD_BUILD_CAPACITY';
+      throw error;
+    }
+    cache.delete(evictableKey);
+  }
+
+  const promise = Promise.resolve().then(() => build(parsed, feedbackDir));
+  cache.set(key, { promise, expiresAt: 0, value: null });
+  try {
+    const value = await promise;
+    cache.set(key, { promise: null, expiresAt: now() + ttlMs, value });
+    while (cache.size > maxEntries && cache.size > 0) {
+      cache.delete(cache.keys().next().value);
+    }
+    return value;
+  } catch (error) {
+    cache.delete(key);
+    throw error;
+  }
+}
+
 async function loadLiveDashboardDataOrRespondProblem(res, parsed, feedbackDir, invalidTitle) {
   try {
-    return await buildLiveDashboardData(parsed, feedbackDir);
+    return await loadCachedLiveDashboardData(parsed, feedbackDir);
   } catch (err) {
     sendInvalidAnalyticsWindowProblem(res, invalidTitle, err);
     return null;
@@ -1980,14 +2157,22 @@ function readRecentFeedbackEntries(feedbackDir, signal, windowMs, limit = 5, opt
   try {
     if (!feedbackDir) return [];
     const rows = shouldAggregateFeedback()
-      ? collectAggregateLogEntries('feedback-log.jsonl', { feedbackDir }).entries
+      ? collectAggregateLogEntries('feedback-log.jsonl', {
+          feedbackDir,
+          maxLines: 20_000,
+          maxBytes: 4 * 1024 * 1024,
+        }).entries
       : (() => {
           const fsLocal = require('node:fs');
           const pathLocal = require('node:path');
           const logPath = pathLocal.join(feedbackDir, 'feedback-log.jsonl');
           if (!fsLocal.existsSync(logPath)) return [];
           const { readJsonl } = require('../../scripts/fs-utils');
-          return readJsonl(logPath) || [];
+          return readJsonl(logPath, {
+            maxLines: 20_000,
+            maxBytes: 4 * 1024 * 1024,
+            tail: true,
+          }) || [];
         })();
     const cutoff = windowMs ? Date.now() - windowMs : 0;
     const filtered = rows
@@ -2775,32 +2960,37 @@ function getTrackedLinkTarget(slug) {
     : null;
 }
 
-function appendTrackedLinkQueryParams(destinationUrl, parsed, target) {
-  const params = parsed.searchParams;
+function applyTrackedLinkDefaults(destinationUrl, target) {
   for (const [key, value] of Object.entries(target.defaults || {})) {
     if (!destinationUrl.searchParams.has(key)) {
       appendQueryParam(destinationUrl, key, value);
     }
   }
+}
+
+function applyTrackedLinkQueryKeys(destinationUrl, params) {
   for (const key of TRACKED_LINK_QUERY_KEYS) {
     const value = params.get(key);
-    if (value && value.trim()) {
-      const normalizedValue = key === 'utm_campaign'
-        ? normalizeCampaignId(value)
-        : value.trim();
-      destinationUrl.searchParams.set(key, normalizedValue);
-    }
-  }
-  if (target.allowCustomerEmail) {
-    const customerEmail = normalizeCheckoutCustomerEmail(params.get('customer_email'));
-    if (customerEmail) {
-      appendQueryParam(
-        destinationUrl,
-        target.prefillStripeEmail ? 'prefilled_email' : 'customer_email',
-        customerEmail
-      );
-    }
+    if (!value?.trim()) continue;
+    const normalizedValue = key === 'utm_campaign'
+      ? normalizeCampaignId(value)
+      : value.trim();
+    destinationUrl.searchParams.set(key, normalizedValue);
   }
+}
+
+function applyTrackedLinkCustomerEmail(destinationUrl, params, target) {
+  if (!target.allowCustomerEmail) return;
+  const customerEmail = normalizeCheckoutCustomerEmail(params.get('customer_email'));
+  if (!customerEmail) return;
+  appendQueryParam(
+    destinationUrl,
+    target.prefillStripeEmail ? 'prefilled_email' : 'customer_email',
+    customerEmail,
+  );
+}
+
+function applyTrackedLinkCtaDefaults(destinationUrl, target) {
   if (!destinationUrl.searchParams.has('cta_id')) {
     appendQueryParam(destinationUrl, 'cta_id', target.ctaId);
   }
@@ -2812,6 +3002,14 @@ function appendTrackedLinkQueryParams(destinationUrl, parsed, target) {
   }
 }
 
+function appendTrackedLinkQueryParams(destinationUrl, parsed, target) {
+  const params = parsed.searchParams;
+  applyTrackedLinkDefaults(destinationUrl, target);
+  applyTrackedLinkQueryKeys(destinationUrl, params);
+  applyTrackedLinkCustomerEmail(destinationUrl, params, target);
+  applyTrackedLinkCtaDefaults(destinationUrl, target);
+}
+
 function buildTrackedLinkDestination(target, hostedConfig, parsed) {
   const configuredHref = target.configUrlKey ? hostedConfig[target.configUrlKey] : null;
   const href = target.href || configuredHref || target.fallbackHref;
@@ -3006,7 +3204,21 @@ function resolveCheckoutOfferSummary(metadata = {}) {
 
 function sendJson(res, statusCode, payload, extraHeaders = {}, options = {}) {
   const { headOnly = false } = options;
-  const body = JSON.stringify(payload);
+  let body;
+  try {
+    body = JSON.stringify(payload);
+  } catch (err) {
+    if (isDashboardDataLimitError(err)) {
+      sendProblem(res, {
+        type: PROBLEM_TYPES.INTERNAL,
+        title: 'Dashboard response too large',
+        status: 503,
+        detail: formatDashboardLimitDetail(err, { phase: 'stringify' }),
+      });
+      return;
+    }
+    throw err;
+  }
   res.writeHead(statusCode, {
     'Content-Type': 'application/json; charset=utf-8',
     'X-Content-Type-Options': 'nosniff',
@@ -3060,8 +3272,8 @@ function sendPublicBillingPreflight(res) {
 
 function appendBestEffortTelemetry(feedbackDir, payload, headers, context) {
   try {
-    appendTelemetryPing(feedbackDir, payload, headers);
-    return true;
+    const written = appendTelemetryPing(feedbackDir, payload, headers);
+    return Boolean(written);
   } catch (err) {
     try {
       appendDiagnosticRecord({
@@ -3248,7 +3460,8 @@ function loadPublicMarketingTemplateHtml(templatePath, runtimeConfig, pageContex
   const googleSiteVerificationMeta = runtimeConfig.googleSiteVerification
     ? `  <meta name="google-site-verification" content="${escapeHtmlAttribute(runtimeConfig.googleSiteVerification)}" />`
     : '';
-  const gaBootstrap = runtimeConfig.gaMeasurementId
+  const privacyOptOut = Boolean(pageContext.privacyOptOut);
+  const gaBootstrap = (!privacyOptOut && runtimeConfig.gaMeasurementId)
     ? [
       `  <script async src="https://www.googletagmanager.com/gtag/js?id=${runtimeConfig.gaMeasurementId}"></script>`,
       '  <script>',
@@ -3259,7 +3472,7 @@ function loadPublicMarketingTemplateHtml(templatePath, runtimeConfig, pageContex
       '  </script>',
     ].join('\n')
     : '';
-  return normalizePublicMarketingHtml(fillTemplate(template, {
+  let rendered = fillTemplate(template, {
     '__PACKAGE_VERSION__': pkg.version,
     '__APP_ORIGIN__': runtimeConfig.appOrigin,
     '__CHECKOUT_ENDPOINT__': runtimeConfig.checkoutEndpoint,
@@ -3288,7 +3501,34 @@ function loadPublicMarketingTemplateHtml(templatePath, runtimeConfig, pageContex
     '__GTM_PLAN_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/GO_TO_MARKET_REVENUE_WEDGE_2026-03.md',
     '__GITHUB_URL__': 'https://github.com/IgorGanapolsky/ThumbGate',
     '__POSTHOG_API_KEY__': runtimeConfig.posthogApiKey || '',
-  }), runtimeConfig, pageContext.requestHost);
+  });
+  const normalized = normalizePublicMarketingHtml(rendered, runtimeConfig, pageContext.requestHost);
+  if (!privacyOptOut) return normalized;
+  let rewrittenDomain = '';
+  try {
+    rewrittenDomain = normalizePublicRequestHost(pageContext.requestHost)
+      || new URL(runtimeConfig.appOrigin).host;
+  } catch {
+    rewrittenDomain = '';
+  }
+  return removeKnownPlausibleScriptTags(normalized, rewrittenDomain);
+}
+
+function removeKnownPlausibleScriptTags(html, extraDomain) {
+  const domains = ['thumbgate.ai', 'thumbgate-production.up.railway.app'];
+  if (extraDomain) domains.push(extraDomain);
+  const sources = [
+    'https://plausible.io/js/script.tagged-events.js',
+    'https://plausible.io/js/script.js',
+  ];
+  let out = html;
+  for (const domain of domains) {
+    for (const src of sources) {
+      const tag = `<script defer data-domain="${domain}" src="${src}"></script>`;
+      if (out.includes(tag)) out = out.split(tag).join('');
+    }
+  }
+  return out;
 }
 
 function loadLandingPageHtml(runtimeConfig, pageContext = {}) {
@@ -3303,10 +3543,18 @@ function loadDiagnosticPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(DIAGNOSTIC_PAGE_PATH, runtimeConfig, pageContext);
 }
 
+function loadFoundersPageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(FOUNDERS_PAGE_PATH, runtimeConfig, pageContext);
+}
+
 function loadPartnerIntakePageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(PARTNER_INTAKE_PAGE_PATH, runtimeConfig, pageContext);
 }
 
+function loadPeterPageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(PETER_PAGE_PATH, runtimeConfig, pageContext);
+}
+
 function loadInstallPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(INSTALL_PAGE_PATH, runtimeConfig, pageContext);
 }
@@ -3945,8 +4193,20 @@ function renderSitemapXml(runtimeConfig) {
     { path: '/', changefreq: 'weekly', priority: '1.0' },
     { path: '/pro', changefreq: 'weekly', priority: '0.9' },
     { path: '/diagnostic', changefreq: 'weekly', priority: '0.9' },
+    { path: '/founders', changefreq: 'weekly', priority: '0.95' },
+    { path: '/peter', changefreq: 'weekly', priority: '0.9' },
     { path: '/workflow-hardening-sprint', changefreq: 'weekly', priority: '0.9' },
     { path: '/install', changefreq: 'weekly', priority: '0.9' },
+    { path: '/terms', changefreq: 'monthly', priority: '0.7' },
+    { path: '/privacy', changefreq: 'monthly', priority: '0.7' },
+    { path: '/support', changefreq: 'monthly', priority: '0.7' },
+    { path: '/legal', changefreq: 'monthly', priority: '0.7' },
+    { path: '/security', changefreq: 'monthly', priority: '0.65' },
+    { path: '/trust', changefreq: 'monthly', priority: '0.65' },
+    { path: '/security.json', changefreq: 'monthly', priority: '0.55' },
+    { path: '/legal/data-flow', changefreq: 'monthly', priority: '0.7' },
+    { path: '/legal/licensing', changefreq: 'monthly', priority: '0.65' },
+    { path: '/legal/msa-sow', changefreq: 'monthly', priority: '0.6' },
     { path: '/agent-manager', changefreq: 'weekly', priority: '0.9' },
     { path: '/llm-context.md', changefreq: 'weekly', priority: '0.8' },
     { path: '/chatgpt-app', changefreq: 'weekly', priority: '0.85' },
@@ -3960,6 +4220,7 @@ function renderSitemapXml(runtimeConfig) {
     { path: '/evaluations', changefreq: 'weekly', priority: '0.85' },
     { path: '/case-studies', changefreq: 'weekly', priority: '0.9' },
     { path: '/numbers', changefreq: 'weekly', priority: '0.8' },
+    { path: '/yt', changefreq: 'weekly', priority: '0.8' },
     { path: '/learn/background-agent-control-layer', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/ac-dc-runtime-enforcement', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/feedback-loop-vs-decision-layer', changefreq: 'weekly', priority: '0.9' },
@@ -3969,10 +4230,14 @@ function renderSitemapXml(runtimeConfig) {
     { path: '/learn/agentic-os-team-governance', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/cost-aware-agent-gate-routing', changefreq: 'weekly', priority: '0.85' },
     { path: '/learn/pretix-stripe-connect-marketplaces', changefreq: 'weekly', priority: '0.9' },
+    { path: '/learn/netflix-oci-actor-critic-process-audits', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/future-agi-self-healing-agent-firewall', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/five-walls-enterprise-agent-deployment', changefreq: 'weekly', priority: '0.85' },
     { path: '/compare/claude-code-hooks', changefreq: 'weekly', priority: '0.85' },
     { path: '/compare/bumblebee', changefreq: 'weekly', priority: '0.85' },
     { path: '/compare/anthropic-containment', changefreq: 'weekly', priority: '0.85' },
     { path: '/compare/oak-and-sparrow-gatekeeper', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/cloudflare-writeguard', changefreq: 'weekly', priority: '0.85' },
     { path: '/compare/arcjet', changefreq: 'weekly', priority: '0.85' },
     { path: '/compare/anthropic-claude-for-legal', changefreq: 'weekly', priority: '0.9' },
     ...THUMBGATE_SEO_SITEMAP_ENTRIES,
@@ -4141,6 +4406,7 @@ function servePublicMarketingPage({
     serverUtmCampaign: landingAttribution.utmCampaign,
     serverUtmContent: landingAttribution.utmContent,
     requestHost,
+    privacyOptOut: headerHasPrivacyOptOut(req.headers),
   });
 
   sendHtml(
@@ -5131,6 +5397,7 @@ function authenticateHumanReviewer(req, reviewerConfig) {
   return {
     id: reviewerConfig.id,
     kind: 'human',
+    role: 'admin',
   };
 }
 
@@ -5169,6 +5436,23 @@ function isBillingSummaryAuthorized(req, expectedAdminKey, expectedOperatorKey)
   return false;
 }
 
+/** Read-only paths the operator key may access (CLI dashboard / CFO / north-star). */
+const OPERATOR_READONLY_GET_PATHS = new Set([
+  '/v1/billing/summary',
+  '/v1/dashboard',
+  '/v1/dashboard/render-spec',
+  '/v1/dashboard/ai-inventory',
+  '/v1/dashboard/review-state',
+  '/v1/intake/workflow-sprint/queue',
+  '/v1/task-outcomes/monitor',
+]);
+
+function isOperatorReadonlyGet(req, expectedOperatorKey, pathname) {
+  if (!expectedOperatorKey || req.method !== 'GET') return false;
+  if (!OPERATOR_READONLY_GET_PATHS.has(pathname)) return false;
+  return safeKeyEqual(extractApiKey(req), expectedOperatorKey);
+}
+
 function extractTags(input) {
   if (Array.isArray(input)) return input;
   if (typeof input === 'string') {
@@ -5412,13 +5696,22 @@ function createApiServer() {
                 ? mcpOauth.tokenAudienceValid(oauthSession, resourceUrl)
                 : rawKeyValid;
               if (!authed) {
+                const deniedName = msg.params?.name || 'unknown';
+                const deniedTool = MCP_TOOLS.find((t) => t.name === deniedName);
                 recordToolCall({
-                  toolName: msg.params?.name || 'unknown',
+                  toolName: deniedName,
                   serverName: 'mcp-http',
                   latencyMs: 0,
                   success: false,
+                  outcome: 'blocked',
+                  blocked: true,
                   agentId: 'unauthenticated',
-                  metadata: { denied: true, deniedReason: 'authentication_required' },
+                  writeRiskTier: deniedTool?.annotations?.writeRiskTier || null,
+                  metadata: {
+                    denied: true,
+                    deniedReason: 'authentication_required',
+                    writeRiskTier: deniedTool?.annotations?.writeRiskTier || null,
+                  },
                 });
                 res.writeHead(401, {
                   'Content-Type': 'application/json',
@@ -5447,8 +5740,15 @@ function createApiServer() {
                     serverName: 'mcp-http',
                     latencyMs: 0,
                     success: false,
+                    outcome: 'blocked',
+                    blocked: true,
                     agentId: 'reviewer',
-                    metadata: { denied: true, deniedReason: 'reviewer_read_only' },
+                    writeRiskTier: tool?.annotations?.writeRiskTier || null,
+                    metadata: {
+                      denied: true,
+                      deniedReason: 'reviewer_read_only',
+                      writeRiskTier: tool?.annotations?.writeRiskTier || null,
+                    },
                   });
                   sendJson(res, 200, {
                     jsonrpc: '2.0', id: msg.id,
@@ -5460,18 +5760,25 @@ function createApiServer() {
               if (oauthSession) {
                 const name = msg.params && msg.params.name;
                 const tool = MCP_TOOLS.find((candidate) => candidate.name === name);
-                const requiredScope = tool?.annotations?.readOnlyHint === true ? 'mcp:read' : 'mcp:write';
+                // Hierarchy: mcp:write implies read/gates/feedback (WorkOS MCP Auth style).
+                const requiredScope = mcpOauth.requiredScopeForTool(tool || {});
                 if (!mcpOauth.scopeAllows(oauthSession, requiredScope)) {
                   recordToolCall({
                     toolName: name || 'unknown',
                     serverName: 'mcp-http',
                     latencyMs: 0,
                     success: false,
+                    outcome: 'blocked',
+                    blocked: true,
                     agentId: oauthSession.clientId || 'oauth-client',
+                    clientId: oauthSession.clientId || null,
+                    sessionId: oauthSession.sessionId || oauthSession.id || null,
+                    writeRiskTier: tool?.annotations?.writeRiskTier || null,
                     metadata: {
                       denied: true,
                       deniedReason: 'insufficient_scope',
                       requiredScope,
+                      writeRiskTier: tool?.annotations?.writeRiskTier || null,
                     },
                   });
                   sendJson(res, 200, {
@@ -5486,7 +5793,14 @@ function createApiServer() {
                   const { callTool } = require('../../adapters/mcp/server-stdio');
                   const name = msg.params?.name;
                   const args = (msg.params && msg.params.arguments) || {};
-                  const result = await callTool(name, args);
+                  // Attribution rides as callTool options (not tool args) so KPI
+                  // can bind human OAuth client/session without polluting schemas.
+                  const result = await callTool(name, args, {
+                    clientId: oauthSession?.clientId || null,
+                    sessionId: oauthSession?.sessionId || oauthSession?.id || null,
+                    agentId: oauthSession?.clientId || (isReviewer ? 'reviewer' : 'mcp-http'),
+                    serverName: 'mcp-http',
+                  });
                   sendJson(res, 200, {
                     jsonrpc: '2.0', id: msg.id,
                     result,
@@ -5569,6 +5883,27 @@ function createApiServer() {
       return;
     }
 
+    // WebMCP read-only agent tools for the product pages. Absent from the
+    // packaged npm runtime by design (tarball exclusion) — the route then
+    // 404s and the deferred script tag degrades to a no-op.
+    if (isGetLikeRequest && pathname === '/js/webmcp.js') {
+      try {
+        const script = fs.readFileSync(WEBMCP_SCRIPT_PATH, 'utf-8');
+        res.writeHead(200, {
+          'Content-Type': 'application/javascript; charset=utf-8',
+          'Cache-Control': 'public, max-age=86400',
+        });
+        if (!isHeadRequest) {
+          res.end(script);
+        } else {
+          res.end();
+        }
+      } catch {
+        sendJson(res, 404, { error: 'WebMCP script not found' });
+      }
+      return;
+    }
+
 
     // User feedback → GitHub Issues
     if (req.method === 'POST' && pathname === '/api/feedback/submit') {
@@ -6336,6 +6671,57 @@ async function addContext(){
       return;
     }
 
+
+    // Partner co-branded case study (Peter Yang / high-ROI acquisition landing).
+    if (isGetLikeRequest && (pathname === '/peter' || pathname === '/peter.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadPeterPageHtml,
+          extraTelemetry: {
+            pageType: 'partner_case_study',
+            partner: 'peter-yang',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Partner case study page unavailable');
+      }
+      return;
+    }
+
+    // Oceans-style founder conversion landing (high-ROI cash path).
+    // Mirrors personal operator pages (/peter): pain triad, timed process,
+    // comparison table, refund fence, sticky diagnostic checkout.
+    if (isGetLikeRequest && (
+      pathname === '/founders'
+      || pathname === '/founders.html'
+      || pathname === '/operators'
+      || pathname === '/operators.html'
+      || pathname === '/agent-operators'
+      || pathname === '/agent-operators.html'
+    )) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadFoundersPageHtml,
+          extraTelemetry: {
+            pageType: 'founders',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Founders page unavailable');
+      }
+      return;
+    }
+
     // Natural marketing URLs for the Workflow Hardening Diagnostic/Sprint.
     // High-intent outreach refers to "the diagnostic", "the sprint", or
     // "workflow hardening"; serve a focused buyer page instead of sending
@@ -6482,6 +6868,35 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (
+      pathname === '/yt'
+      || pathname === '/yt.html'
+      || pathname === '/aias-registration-yt'
+    )) {
+      // Dedicated YouTube/CPC destination (FORMAT steal from AIAS registration
+      // landings). /aias-registration-yt is an alias so ad paths that copy the
+      // summit slug still hit ThumbGate. Canonical is /yt. Free GitHub/npm/
+      // Marketplace CTAs only — not a $499 hero, not a 6-agent OS SKU.
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: (runtimeConfig, pageContext) => loadPublicMarketingTemplateHtml(
+            YT_PAGE_PATH,
+            runtimeConfig,
+            pageContext
+          ),
+          extraTelemetry: { pageType: 'yt' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'YouTube landing page not found' });
+      }
+      return;
+    }
+
     if (isGetLikeRequest && (pathname === '/agent-manager' || pathname === '/agent-manager.html')) {
       // ICP landing page for the role Anthropic named (Agent Manager —
       // hybrid PM/engineer DRI who owns CLAUDE.md hierarchy, plugin
@@ -8306,35 +8721,168 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
     // Public terms of service — required by Stripe / Stripe Checkout for the
     // "Terms of service URL" field in Business → Public details. Mirrors the
     // /privacy + /support pages: thin HTML, no external deps, no DB hit.
-    if (isGetLikeRequest && pathname === '/terms') {
-      sendHtml(res, 200, `<!DOCTYPE html><html><head><title>Terms of Service — ThumbGate</title></head><body>
-<h1>Terms of Service</h1>
-<p><strong>ThumbGate</strong> (npm: thumbgate)</p>
-<p>Last updated: 2026-05-12</p>
-<h2>The Service</h2>
-<p>ThumbGate provides pre-action gates for AI coding agents: a local CLI (MIT-licensed) and an optional hosted tier at thumbgate-production.up.railway.app. By installing the CLI or paying for a subscription, you agree to these terms.</p>
-<h2>Payment</h2>
-<p>Paid tiers are billed through Stripe. Subscriptions auto-renew until cancelled. One-off purchases (Sprint Diagnostic, Workflow Sprint, Quick Read, Workflow Teardown, First Failure Rule) are charged once.</p>
-<h2>Refunds</h2>
-<p>Pro and Team subscriptions: cancel anytime; we issue a full refund within 7 days of the first charge, prorated thereafter. One-off purchases: refund on request if we cannot deliver the scoped artifact.</p>
-<h2>Acceptable Use</h2>
-<p>You may not use ThumbGate to (a) circumvent the safety controls of other AI providers, (b) generate malware or content that violates third-party terms, or (c) resell the hosted tier without written permission.</p>
-<h2>Disclaimer of Warranty</h2>
-<p>The service is provided "as is", without warranty of any kind. ThumbGate is a guard rail, not a guarantee. We do not warrant that every AI-agent mistake will be prevented.</p>
-<h2>Limitation of Liability</h2>
-<p>Total liability for any claim is limited to the amount you paid in the 12 months preceding the claim.</p>
-<h2>Governing Law</h2>
-<p>These terms are governed by the laws of the State of New York, United States.</p>
-<h2>Changes</h2>
-<p>We may update these terms; material changes will be announced via the email on file at least 14 days before they take effect.</p>
-<h2>Contact</h2><p>igor.ganapolsky@gmail.com</p>
-<p><a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> · <a href="/privacy">Privacy</a> · <a href="/support">Support</a></p>
-</body></html>`, {}, {
-        headOnly: isHeadRequest,
-      });
+    if (isGetLikeRequest && (pathname === '/terms' || pathname === '/terms.html' || pathname === '/eula' || pathname === '/eula.html')) {
+      try {
+        const termsHtml = fs.readFileSync(path.join(PUBLIC_DIR, 'terms.html'), 'utf-8');
+        sendHtml(res, 200, termsHtml, {}, { headOnly: isHeadRequest });
+      } catch {
+        sendHtml(res, 200, `<!DOCTYPE html><html><head><title>Terms of Service — ThumbGate</title></head><body><h1>Terms of Service</h1><p>Contact: <a href="mailto:legal@thumbgate.ai">legal@thumbgate.ai</a></p></body></html>`, {}, { headOnly: isHeadRequest });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/privacy' || pathname === '/privacy.html')) {
+      try {
+        const privacyHtml = fs.readFileSync(path.join(PUBLIC_DIR, 'privacy.html'), 'utf-8');
+        sendHtml(res, 200, privacyHtml, {}, { headOnly: isHeadRequest });
+      } catch {
+        sendHtml(res, 200, `<!DOCTYPE html><html><head><title>Privacy Policy — ThumbGate</title></head><body><h1>Privacy Policy</h1><p>Contact: <a href="mailto:privacy@thumbgate.ai">privacy@thumbgate.ai</a></p></body></html>`, {}, { headOnly: isHeadRequest });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/support' || pathname === '/support.html')) {
+      try {
+        const supportHtml = fs.readFileSync(path.join(PUBLIC_DIR, 'support.html'), 'utf-8');
+        sendHtml(res, 200, supportHtml, {}, { headOnly: isHeadRequest });
+      } catch {
+        sendHtml(res, 200, `<!DOCTYPE html><html><head><title>Support — ThumbGate</title></head><body><h1>Support</h1><p>Contact: <a href="mailto:support@thumbgate.ai">support@thumbgate.ai</a></p></body></html>`, {}, { headOnly: isHeadRequest });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/third-party-notices' || pathname === '/third-party-notices.html' || pathname === '/third-party-notices.md')) {
+      try {
+        const noticesHtml = fs.readFileSync(path.join(PUBLIC_DIR, 'third-party-notices.html'), 'utf-8');
+        sendHtml(res, 200, noticesHtml, {}, { headOnly: isHeadRequest });
+      } catch {
+        sendHtml(res, 200, `<!DOCTYPE html><html><head><title>Third-Party Notices — ThumbGate</title></head><body><h1>Third-Party Notices</h1><p>See <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/THIRD_PARTY_NOTICES.md">THIRD_PARTY_NOTICES.md</a>.</p></body></html>`, {}, { headOnly: isHeadRequest });
+      }
+      return;
+    }
+
+    // Public security overview + copy-paste questionnaire (not a certification).
+    if (isGetLikeRequest && (pathname === '/security.json' || pathname === '/v1/security-questionnaire')) {
+      sendJson(res, 200, getSecurityQuestionnaire(), {
+        'Cache-Control': 'public, max-age=300',
+      }, { headOnly: isHeadRequest });
+      return;
+    }
+    if (isGetLikeRequest && (
+      pathname === '/security'
+      || pathname === '/security.html'
+      || pathname === '/trust'
+      || pathname === '/trust.html'
+    )) {
+      sendHtml(res, 200, renderSecurityOverviewHtml(), {}, { headOnly: isHeadRequest });
+      return;
+    }
+
+    // Legal index — entry point for counsel package + public legal URLs.
+    if (isGetLikeRequest && (pathname === '/legal' || pathname === '/legal/')) {
+      sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Legal — ThumbGate</title>
+<meta name="description" content="ThumbGate legal index: Terms, Privacy, Security, licensing, data-flow, MSA/SOW.">
+<style>body{font-family:system-ui,-apple-system,sans-serif;max-width:820px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}
+h1{font-size:28px;margin:0 0 8px}h2{font-size:18px;margin:28px 0 8px}p,li{font-size:15px}.meta{color:#6b7280;font-size:14px;margin:0 0 24px}
+.draft{border-left:3px solid #f59e0b;background:#fffbeb;padding:10px 14px;border-radius:0 8px 8px 0;margin:16px 0}
+ul{padding-left:22px}li{margin:6px 0}a{color:#0066cc}
+footer{margin-top:40px;padding-top:20px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
+<h1>Legal</h1>
+<p class="meta">Public legal surfaces for ThumbGate paid and hosted paths.</p>
+<div class="draft"><strong>Highest-value first pass:</strong> short data-flow map + subscription terms + privacy policy + open-source boundary. Markdown counsel package lives in <code>docs/legal/</code>.</div>
+<ul>
+<li><a href="/terms">Terms of Service</a></li>
+<li><a href="/privacy">Privacy Policy</a></li>
+<li><a href="/support">Support</a> — <a href="mailto:support@thumbgate.ai">support@thumbgate.ai</a></li>
+<li><a href="/security">Security questionnaire</a> — <a href="/security.json">JSON</a></li>
+<li><a href="/legal/licensing">MIT vs paid licensing boundary</a></li>
+<li><a href="/legal/data-flow">Data-flow map</a></li>
+<li><a href="/legal/msa-sow">MSA / SOW template</a></li>
+<li><a href="https://github.com/IgorGanapolsky/ThumbGate/tree/main/docs/legal">docs/legal on GitHub</a></li>
+<li><a href="/third-party-notices">Third-party notices</a></li>
+</ul>
+<footer><a href="/">Home</a> · <a href="/pricing">Pricing</a> · <a href="mailto:legal@thumbgate.ai">legal@thumbgate.ai</a></footer>
+</body></html>`, {}, { headOnly: isHeadRequest });
       return;
     }
 
+    if (isGetLikeRequest && (pathname === '/legal/licensing' || pathname === '/legal/licensing/')) {
+      sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Licensing — ThumbGate</title>
+<style>body{font-family:system-ui,-apple-system,sans-serif;max-width:820px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}
+h1{font-size:28px;margin:0 0 8px}h2{font-size:18px;margin:28px 0 8px}p,li{font-size:15px}ul{padding-left:22px}a{color:#0066cc}
+footer{margin-top:40px;padding-top:20px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
+<h1>Commercial licensing boundary</h1>
+<p class="meta">MIT vs paid · Last updated 2026-08-12</p>
+<h2>What is MIT</h2>
+<p>Unless a file states otherwise, the public repository and published npm package <code>thumbgate</code> are offered under the <strong>MIT</strong> License: local CLI, hooks, public MCP tooling, docs, and tests shipped in that package.</p>
+<h2>What is not MIT</h2>
+<ul>
+<li>Hosted API / production cloud service — proprietary hosted service</li>
+<li>thumbgate.app pairing, mobile, and cloud runners as offered — proprietary product</li>
+<li><strong>Pro</strong> subscription entitlement, license keys, hosted dashboard state — subscription license, not transfer of ThumbGate IP</li>
+<li>Brand and marks — trademark, not MIT code rights to imply endorsement</li>
+<li>Managed services under an SOW — governed by MSA/SOW</li>
+</ul>
+<h2>Customer-specific rules</h2>
+<p><strong>Customer-specific rules</strong> and configs produced under a paid engagement are owned by the customer as deliverables under the SOW, except that ThumbGate retains pre-existing IP and may reuse generalized non-confidential know-how. <strong>Production approvals</strong> remain the customer’s responsibility; ThumbGate does not assume production change-control ownership by default.</p>
+<p>Questions: <a href="mailto:legal@thumbgate.ai">legal@thumbgate.ai</a>. Full text: <code>docs/legal/COMMERCIAL_LICENSING_BOUNDARY.md</code>.</p>
+<footer><a href="/legal">Legal index</a> · <a href="/terms">Terms</a></footer>
+</body></html>`, {}, { headOnly: isHeadRequest });
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/legal/data-flow' || pathname === '/legal/data-flow/')) {
+      sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Data-flow map — ThumbGate</title>
+<style>body{font-family:system-ui,-apple-system,sans-serif;max-width:820px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}
+h1{font-size:28px;margin:0 0 8px}h2{font-size:18px;margin:28px 0 8px}p,li{font-size:15px}ul{padding-left:22px}a{color:#0066cc}
+footer{margin-top:40px;padding-top:20px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
+<h1>Data-flow map</h1>
+<p>First-pass counsel input: what stays local vs what may leave the machine.</p>
+<h2>Local MIT CLI</h2>
+<p><strong>Local MIT CLI</strong> and engine: workspace source, local prevention rules, context packs, and lesson DB stay on disk under paths such as <code>~/.thumbgate/</code> and project <code>.claude/</code>. Workspace source does not leave the machine by default.</p>
+<h2>What may leave the machine</h2>
+<ul>
+<li>Account registration and license checks for Pro / hosted features</li>
+<li><strong>Stripe</strong> payment tokens and billing metadata when you check out</li>
+<li>Device pairing identifiers for thumbgate.app</li>
+<li>Cloud-runner operational logs (timestamps, success/fail, error summaries)</li>
+<li>Optional CLI telemetry (disable with THUMBGATE_NO_TELEMETRY=1)</li>
+<li>Support email content you voluntarily send</li>
+</ul>
+<p>Full map: <code>docs/legal/DATA_FLOW_MAP.md</code> · <a href="/privacy">Privacy Policy</a></p>
+<footer><a href="/legal">Legal index</a> · <a href="/privacy">Privacy</a></footer>
+</body></html>`, {}, { headOnly: isHeadRequest });
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/legal/msa-sow' || pathname === '/legal/msa-sow/')) {
+      sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>MSA / SOW — ThumbGate</title>
+<style>body{font-family:system-ui,-apple-system,sans-serif;max-width:820px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}
+h1{font-size:28px;margin:0 0 8px}h2{font-size:18px;margin:28px 0 8px}p,li{font-size:15px}ul{padding-left:22px}a{color:#0066cc}
+footer{margin-top:40px;padding-top:20px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
+<h1>Master Services Agreement + Statement of Work</h1>
+<p>Template for counsel/product use. Not a signed contract. Self-serve Pro is covered by <a href="/terms">Terms</a> + checkout, not this SOW.</p>
+<h2>Master Services Agreement (summary)</h2>
+<ul>
+<li>Services only as described in an executed Statement of Work</li>
+<li>Fees and taxes as in the SOW; payment via Stripe or invoice</li>
+<li>Pre-existing ThumbGate IP remains ThumbGate’s; customer owns customer-specific configs under the SOW</li>
+<li>No guarantee all unsafe agent actions will be blocked</li>
+<li>Liability capped at fees paid under the applicable SOW in the prior 12 months</li>
+</ul>
+<h2>Statement of Work fields</h2>
+<p>Typical SOW fields: title, supported workflow, access/materials, acceptance criteria, deliverables, exclusions, change requests, approvals, fees, timeline, termination.</p>
+<p>Contact: <a href="mailto:legal@thumbgate.ai">legal@thumbgate.ai</a>. Full template: <code>docs/legal/MSA_SOW_TEMPLATE.md</code>.</p>
+<footer><a href="/legal">Legal index</a> · <a href="/terms">Terms</a></footer>
+</body></html>`, {}, { headOnly: isHeadRequest });
+      return;
+    }
+
+
     // Public case studies — dogfood proof narratives (static HTML; no fabricated logos).
     if (isGetLikeRequest && (pathname === '/case-studies' || pathname === '/case-studies.html')) {
       try {
@@ -8353,14 +8901,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       return;
     }
 
-
-        // Public canonical pricing page. The audit flagged "pricing schizophrenia":
-    // sales/pricing.json said $49 / $299, COMMERCIAL_TRUTH.md said $19 / $149,
-    // and there was no buyer-facing surface to reconcile the two. This is now
-    // the single source of truth for what ThumbGate sells, in priority order:
-    // Sprint (proof-pack, sales-led) → Pro (self-serve recurring) → Team
-    // (after qualification). Every paid CTA across the site should funnel
-    // here OR directly into Stripe checkout — never a different price.
+    // Public canonical pricing page.
     if (isGetLikeRequest && (pathname === '/pricing' || pathname === '/pricing.html')) {
       try {
         servePublicMarketingPage({
@@ -8380,100 +8921,14 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       return;
     }
 
-
-    // Remote MCP connector documentation — the `resource_documentation` target
-    // advertised by /.well-known/oauth-protected-resource. The Claude Connectors
-    // Directory requires this URL to resolve (200) for submission review.
-    if (isGetLikeRequest && (pathname === '/docs/connectors' || pathname === '/docs/connectors/')) {
-      const mcpUrl = buildPublicUrl(hostedConfig, '/mcp');
-      const cardUrl = buildPublicUrl(hostedConfig, '/.well-known/mcp/server-card.json');
-      const prmUrl = buildPublicUrl(hostedConfig, '/.well-known/oauth-protected-resource');
-      sendHtml(res, 200, `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Remote MCP Connector — ThumbGate</title><meta name="description" content="Connect ThumbGate to Claude as a remote MCP server: OAuth 2.1 (PKCE) authorization, available tools, and the read-only reviewer credential."><style>body{font-family:system-ui,-apple-system,sans-serif;max-width:780px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}h1{font-size:30px;margin:0 0 8px}.lede{color:#6b7280;font-size:18px;margin:0 0 28px}h2{font-size:20px;margin:28px 0 8px}code{background:#f3f4f6;padding:1px 6px;border-radius:4px;font-size:13.5px}pre{background:#0f172a;color:#e2e8f0;padding:14px 16px;border-radius:8px;overflow:auto;font-size:13px}a{color:#0066cc}ol,ul{padding-left:22px}li{margin:6px 0}.note{border-left:3px solid #22d3ee;background:#ecfeff;padding:10px 14px;border-radius:0 8px 8px 0;margin:16px 0}footer{margin-top:40px;padding-top:20px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
-<h1>ThumbGate — Remote MCP Connector</h1>
-<p class="lede">ThumbGate is a remote Model Context Protocol (MCP) server. Add it as a connector in Claude to give an agent governed access to ThumbGate's feedback capture, lesson retrieval, context assembly, and pre-action gate tools — over HTTP, authenticated with OAuth 2.1.</p>
-
-<h2>Connect URL</h2>
-<pre>${esc(mcpUrl)}</pre>
-<p>In Claude, add a custom connector and paste the URL above. Claude discovers the authorization server automatically via the protected-resource metadata at <a href="${esc(prmUrl)}">${esc(prmUrl)}</a>.</p>
-
-<h2>Authorization (OAuth 2.1 + PKCE)</h2>
-<ol>
-  <li>Claude reads the <code>resource</code> and <code>authorization_servers</code> from the protected-resource metadata.</li>
-  <li>It runs the standard OAuth 2.1 authorization-code flow with PKCE (<code>S256</code> only — <code>plain</code> is rejected).</li>
-  <li>The issued access token is audience-bound to the <code>${esc(mcpUrl)}</code> resource (RFC 8707); a token for any other audience is rejected.</li>
-  <li>The bearer token is then sent on the <code>Authorization</code> header for every <code>tools/call</code>.</li>
-</ol>
-
-<h2>Available tools</h2>
-<p>The full, machine-readable tool registry — names, input schemas, and the <code>readOnlyHint</code> / <code>destructiveHint</code> annotations — is published at <a href="${esc(cardUrl)}">${esc(cardUrl)}</a>. Tools fall into these groups:</p>
-<ul>
-  <li><strong>Feedback &amp; lessons</strong> — <code>capture_feedback</code>, <code>feedback_summary</code>, <code>search_lessons</code>, <code>retrieve_lessons</code>, <code>prevention_rules</code>.</li>
-  <li><strong>Context engineering</strong> — <code>construct_context_pack</code>, <code>evaluate_context_pack</code>, <code>unified_context</code>, <code>recall</code>.</li>
-  <li><strong>Pre-action gates &amp; governance</strong> — <code>satisfy_gate</code>, <code>track_action</code>, <code>approve_protected_action</code>, <code>verify_claim</code>, <code>enforcement_matrix</code>.</li>
-  <li><strong>Diagnostics &amp; planning</strong> — <code>diagnose_failure</code>, <code>suggest_fix</code>, <code>security_scan</code>, and the <code>plan_*</code> advisory tools.</li>
-</ul>
-
-<h2>Reviewer credential (read-only)</h2>
-<div class="note">For directory reviewers: ThumbGate issues a dedicated <strong>read-only</strong> reviewer credential. A token bound to that credential may invoke only tools annotated <code>readOnlyHint: true</code>; any write or mutating tool call is rejected. This makes the credential safe to share for review without granting the ability to mutate shared server state. Request it from the contact below.</div>
-
-<h2>Source &amp; contact</h2>
-<p>Open-source CLI and server: <a href="https://github.com/IgorGanapolsky/ThumbGate">github.com/IgorGanapolsky/ThumbGate</a>. Questions or reviewer-credential requests: <a href="mailto:igor.ganapolsky@gmail.com">igor.ganapolsky@gmail.com</a>.</p>
-
-<footer><a href="/">ThumbGate</a> · <a href="/support">Support</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a></footer>
-</body></html>`, {}, { headOnly: isHeadRequest });
-      return;
-    }
-
-    // Public support / contact page — required for Stripe Business → Public
-    // details "Customer support URL" field. Single source of truth for how
-    // customers reach us (email, GitHub issues, status page).
-    if (isGetLikeRequest && pathname === '/support') {
-      sendHtml(res, 200, `<!DOCTYPE html><html><head><title>Support — ThumbGate</title></head><body>
-<h1>Support</h1>
-<p><strong>ThumbGate</strong> support, billing, and contact paths.</p>
-<h2>Email</h2>
-<p>For billing questions, refunds, subscription changes, or technical issues with the hosted tier: <a href="mailto:igor.ganapolsky@gmail.com">igor.ganapolsky@gmail.com</a>. We reply within one business day.</p>
-<h2>GitHub Issues</h2>
-<p>For bugs, CLI questions, and feature requests in the open-source CLI: <a href="https://github.com/IgorGanapolsky/ThumbGate/issues">github.com/IgorGanapolsky/ThumbGate/issues</a>.</p>
-<h2>Status</h2>
-<p>Hosted-tier status: check <a href="https://thumbgate-production.up.railway.app/health">/health</a> for current health. Railway-hosted; rebuilds take 2-5 minutes.</p>
-<h2>Refunds</h2>
-<p>Pro / Team subscriptions: 7-day full refund window from first charge. One-off purchases: refund on request if we cannot deliver. Email the address above.</p>
-<h2>Security</h2>
-<p>Disclose vulnerabilities by email; please do not post to public GitHub issues. We acknowledge within 48 hours.</p>
-<p><a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a></p>
-</body></html>`, {}, {
-        headOnly: isHeadRequest,
-      });
-      return;
-    }
-
-    // Public privacy policy — required for GPT Store and marketplace listings
-    if (isGetLikeRequest && pathname === '/privacy') {
-      sendHtml(res, 200, `<!DOCTYPE html><html><head><title>Privacy Policy — ThumbGate</title></head><body>
-<h1>Privacy Policy</h1>
-<p><strong>ThumbGate</strong> (npm: thumbgate)</p>
-<p>Last updated: 2026-03-11</p>
-<h2>Data Collection</h2>
-<p>The self-hosted version stores workflow data locally on your machine. Local feedback, memory entries, proof artifacts, and context packs stay in your project files unless you explicitly point the system at a hosted endpoint.</p>
-<p>The hosted tier (thumbgate-production.up.railway.app) stores feedback signals, memory entries, and related workflow metadata associated with your API key.</p>
-<p>Optional CLI telemetry is best-effort and covers install or usage metadata needed to understand adoption and failures. You can disable it with <code>THUMBGATE_NO_TELEMETRY=1</code>.</p>
-<h2>Data Stored</h2><ul>
-<li>Feedback signals (thumbs up/down) with context you provide</li>
-<li>Promoted memory entries</li>
-<li>Prevention rules generated from your feedback</li>
-</ul>
-<h2>Data Sharing</h2>
-<p>We do not sell customer data. Hosted data is used to operate the service and is not shared with third parties except for infrastructure providers needed to run the product.</p>
-<h2>Data Retention</h2>
-<p>Local data is retained until you delete the files. Hosted data is retained while your account or API key remains active, or until you request deletion, subject to operational or legal retention requirements.</p>
-<h2>Data Deletion</h2>
-<p>Contact igor.ganapolsky@gmail.com to request deletion of hosted data.</p>
-<h2>Contact</h2><p>igor.ganapolsky@gmail.com</p>
-<p><a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a></p>
-</body></html>`, {}, {
-        headOnly: isHeadRequest,
-      });
+    // Public Remote MCP Connector Documentation.
+    if (isGetLikeRequest && (pathname === '/docs/connectors' || pathname === '/docs/connectors/' || pathname === '/docs/connectors.html')) {
+      try {
+        const connectorsHtml = fs.readFileSync(path.join(PUBLIC_DIR, 'docs', 'connectors.html'), 'utf-8');
+        sendHtml(res, 200, connectorsHtml, {}, { headOnly: isHeadRequest });
+      } catch {
+        sendJson(res, 404, { error: 'Connectors documentation not found' });
+      }
       return;
     }
 
@@ -8736,19 +9191,8 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
       return;
     }
 
-    // Operator key is allowed to bypass the general admin gate for dedicated
-    // read-only operational endpoints.
-    const _reqToken = extractApiKey(req);
-    const isOperatorReadRequest = Boolean(expectedOperatorKey)
-      && safeKeyEqual(_reqToken, expectedOperatorKey)
-      && req.method === 'GET'
-      && [
-        '/v1/billing/summary',
-        '/v1/intake/workflow-sprint/queue',
-        '/v1/task-outcomes/monitor',
-      ].includes(pathname);
-
-    if (!isOperatorReadRequest && !isAuthorized(req, expectedApiKey)) {
+    // Operator key: read-only operational endpoints only (see OPERATOR_READONLY_GET_PATHS).
+    if (!isOperatorReadonlyGet(req, expectedOperatorKey, pathname) && !isAuthorized(req, expectedApiKey)) {
       sendProblem(res, {
         type: PROBLEM_TYPES.UNAUTHORIZED,
         title: 'Unauthorized',
@@ -9642,6 +10086,13 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           guardrails: body.guardrails,
           tags: extractTags(body.tags),
           skill: body.skill,
+          memorySource: body.memorySource && typeof body.memorySource === 'object'
+            ? {
+              type: body.memorySource.type,
+              identifier: body.memorySource.identifier,
+              trust: body.memorySource.trust,
+            }
+            : undefined,
           reviewOrigin: 'human',
         });
         const actionIntegration = inferActionIntegration(body, req.headers);
@@ -9980,12 +10431,23 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         } catch (err) {
           throw createHttpError(400, err.message || 'Invalid namespaces');
         }
-        const pack = constructContextPack({
-          query: body.query || '',
-          maxItems: Number(body.maxItems || 8),
-          maxChars: Number(body.maxChars || 6000),
-          namespaces,
-        });
+        let pack;
+        try {
+          pack = constructContextPack({
+            query: body.query || '',
+            maxItems: Number(body.maxItems || 8),
+            maxChars: Number(body.maxChars || 6000),
+            namespaces,
+            strategy: body.strategy || null,
+            contextEnvelope: body.contextEnvelope || null,
+          });
+        } catch (err) {
+          if (err.code === 'INVALID_CONTEXT_ENVELOPE'
+            || err.code === 'CONTEXT_BUDGET_EXCEEDED') {
+            throw createHttpError(400, err.message);
+          }
+          throw err;
+        }
         sendJson(res, 200, pack);
         return;
       }
@@ -10698,11 +11160,151 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           });
           return;
         }
-        const entry = satisfyCondition(body.gateId, body.evidence);
+        // Attribute the override to the API surface. Without an explicit
+        // source the record defaults to 'cli' and the audit summary cannot
+        // tell an HTTP unlock from a local one.
+        const entry = satisfyCondition(body.gateId, body.evidence, null, {
+          source: 'api',
+          actor: body.actor || 'api-client',
+        });
         sendJson(res, 200, { satisfied: true, gateId: body.gateId, ...entry });
         return;
       }
 
+      // POST /v1/hermes/initialize — Bind a connectionId before turn start/end
+      if (req.method === 'POST' && pathname === '/v1/hermes/initialize') {
+        const body = await parseJsonBody(req);
+        const { protocol } = getHostedHermes(requestDataIdentity);
+        const result = protocol.initialize({
+          connectionId: body.connectionId,
+        });
+        if (!result.ok) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.BAD_REQUEST,
+            title: 'Hermes Initialize Rejected',
+            status: 400,
+            detail: result.reason,
+            ...result,
+          });
+          return;
+        }
+        sendJson(res, 200, result);
+        return;
+      }
+
+      // POST /v1/hermes/turn/start — Start turn under Hermes Platform Protocol
+      // Fail closed until POST /v1/hermes/initialize registers the connectionId.
+      if (req.method === 'POST' && pathname === '/v1/hermes/turn/start') {
+        const body = await parseJsonBody(req);
+        const { protocol } = getHostedHermes(requestDataIdentity);
+        const result = protocol.startTurn(body);
+        if (!result.ok) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.BAD_REQUEST,
+            title: 'Hermes Turn Rejected',
+            status: 400,
+            detail: result.reason,
+            ...result,
+          });
+          return;
+        }
+        sendJson(res, 200, result);
+        return;
+      }
+
+      // POST /v1/hermes/turn/end — End active turn under Hermes Platform Protocol
+      if (req.method === 'POST' && pathname === '/v1/hermes/turn/end') {
+        const body = await parseJsonBody(req);
+        const { protocol } = getHostedHermes(requestDataIdentity);
+        const result = protocol.endTurn(body);
+        if (!result.ok) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.BAD_REQUEST,
+            title: 'Hermes End Turn Rejected',
+            status: 400,
+            detail: result.reason,
+            ...result,
+          });
+          return;
+        }
+        sendJson(res, 200, result);
+        return;
+      }
+
+      // POST /v1/hermes/action/approve — Record human/operator approval for consequential action
+      if (req.method === 'POST' && pathname === '/v1/hermes/action/approve') {
+        const body = await parseJsonBody(req);
+        const boundApproverId = resolveHermesApproverId(
+          req,
+          humanReviewerConfig,
+          requestDataIdentity,
+        );
+        if (!boundApproverId) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.UNAUTHORIZED,
+            title: 'Hermes Approval Rejected',
+            status: 401,
+            detail: 'Authenticated reviewer identity is required for Hermes approvals.',
+          });
+          return;
+        }
+        const { protocol } = getHostedHermes(requestDataIdentity);
+        const result = protocol.approve({
+          ...body,
+          approverId: boundApproverId,
+        });
+        if (!result.ok) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.BAD_REQUEST,
+            title: 'Hermes Approval Rejected',
+            status: 400,
+            detail: result.reason,
+            ...result,
+          });
+          return;
+        }
+        sendJson(res, 200, result);
+        return;
+      }
+
+      // GET /v1/hermes/sync/read — Reactive read path with cursor + offset
+      if (req.method === 'GET' && pathname === '/v1/hermes/sync/read') {
+        const rawOffset = parsed.searchParams.get('offset');
+        const offset = rawOffset !== null ? Number(rawOffset) : undefined;
+        const cursor = parsed.searchParams.get('cursor') || undefined;
+        const threadId = parsed.searchParams.get('threadId') || undefined;
+        const recordId = parsed.searchParams.get('recordId') || undefined;
+        const mode = parsed.searchParams.get('mode') || undefined;
+        // Prefer the authenticated principal over a client-supplied userId so
+        // hosted tenants cannot probe another identity's sync shapes.
+        const authUserId = requestDataIdentity?.accessContext?.principalId
+          || parsed.searchParams.get('userId')
+          || undefined;
+
+        const { syncPlane } = getHostedHermes(requestDataIdentity);
+        const result = syncPlane.readStatus({
+          offset,
+          cursor,
+          auth: authUserId ? { userId: authUserId } : null,
+          threadId,
+          recordId,
+          mode,
+        });
+
+        if (!result.ok) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.BAD_REQUEST,
+            title: 'Hermes Sync Read Rejected',
+            status: 400,
+            detail: result.reason,
+            ...result,
+          });
+          return;
+        }
+        sendJson(res, 200, result);
+        return;
+      }
+
       // GET /api/conversions — Conversion stats derived from the Stripe event log
       if (req.method === 'GET' && pathname === '/api/conversions') {
         try {
@@ -10740,7 +11342,20 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
 function startServer({ port, host } = {}) {
   const listenPort = Number(port ?? process.env.PORT ?? 8787);
   const listenHost = String(host ?? process.env.HOST ?? '0.0.0.0').trim() || '0.0.0.0';
-  fs.mkdirSync(getFeedbackPaths().FEEDBACK_DIR, { recursive: true });
+  const feedbackPaths = getFeedbackPaths();
+  fs.mkdirSync(feedbackPaths.FEEDBACK_DIR, { recursive: true });
+  // Hosted volumes often start empty (Docker does not ship .claude/memory).
+  // Seed a durable "thumbgate" corpus so authenticated deploy proof can verify retrieval.
+  if (shouldEnsureProductionSearchCorpus(process.env)) {
+    try {
+      const seedResult = ensureProductionSearchCorpus({ feedbackDir: feedbackPaths.FEEDBACK_DIR });
+      if (seedResult.wrote.memory || seedResult.wrote.feedback || seedResult.wrote.rules) {
+        console.log('[startup] ensured production search corpus seed', JSON.stringify(seedResult.wrote));
+      }
+    } catch (err) {
+      console.warn('[startup] ensure production search corpus failed:', err?.message || err);
+    }
+  }
   const server = createApiServer();
   registerGracefulShutdown(server);
   return new Promise((resolve) => {
@@ -10823,6 +11438,8 @@ module.exports = {
     sanitizeHtmlUnsafeJsonValue,
     buildHostedTenantIdentity,
     partitionFeedbackPaths,
+    buildLiveDashboardCacheKey,
+    loadCachedLiveDashboardData,
   },
 };