thumbgate 1.35.0 → 1.37.1

package/public/compare.html

@@ -273,6 +273,27 @@
   <p><a href="/compare/rein" class="cta">Read ThumbGate vs Rein</a></p>
 </div>
 
+<div class="card">
+  <h3>Evaluating Agoragentic?</h3>
+  <p>Agoragentic is an agent OS plus marketplace (mandate, budget, receipts). ThumbGate is the coding-agent PreToolUse firewall. Adjacent layers. A receipt is not world-state proof.</p>
+  <p><a href="/compare/agoragentic" class="cta">Read ThumbGate vs Agoragentic</a></p>
+  <h3>Evaluating Dirac?</h3>
+  <p>Dirac is a token-efficient coding agent (hash-anchored edits, AST batching). ThumbGate is the PreToolUse firewall. Adjacent layers. Their 64.8% cheaper figure is their eval table, not ours.</p>
+  <p><a href="/compare/dirac" class="cta">Read ThumbGate vs Dirac</a></p>
+</div>
+
+<div class="card">
+  <h3>Rolling out Tailscale Aperture?</h3>
+  <p>Aperture is Tailscale&rsquo;s identity-aware AI gateway: model access over the tailnet without distributing API keys, with project tool permissions and audit. ThumbGate is the PreToolUse gate on the tool calls those agents emit. Adjacent layers that compose.</p>
+  <p><a href="/compare/aperture" class="cta">Read ThumbGate vs Tailscale Aperture</a></p>
+</div>
+
+<div class="card">
+  <h3>Running OpenMono’s local agent?</h3>
+  <p>OpenMono already has a Docker sandbox, a 12-step pipeline, and a fixed 3× doom-loop abort. Those controls are static and per-run. ThumbGate is the learning layer so Monday’s failure becomes Tuesday’s block — complementary, not a substitute.</p>
+  <p><a href="/compare/openmono" class="cta">Read ThumbGate vs OpenMono</a></p>
+</div>
+
 <h2>All ThumbGate comparisons</h2>
 <p style="color:var(--muted);">Every head-to-head in one place. ThumbGate is the local-first, learning enforcement layer at the tool-call boundary — most of these tools sit at a different layer and are complementary.</p>
 <ul class="compare-index">
@@ -283,9 +304,14 @@
   <li><a href="/compare/bumblebee">ThumbGate vs Bumblebee</a> — runtime enforcement pairs with static inventory</li>
   <li><a href="/compare/anthropic-containment">ThumbGate vs Anthropic's Claude Containment</a> — an IDE-agent extension of Anthropic's published architecture</li>
   <li><a href="/compare/oak-and-sparrow-gatekeeper">ThumbGate vs Gatekeeper (Oak &amp; Sparrow)</a> — agent-action gate pairs with a workforce-input gate</li>
+  <li><a href="/compare/cloudflare-writeguard">ThumbGate vs Cloudflare WriteGuard</a> — runtime tool-call gate pairs with a portal MCP gate</li>
   <li><a href="/compare/fallow">ThumbGate vs Fallow</a> — static analysis vs agent-action enforcement</li>
   <li><a href="/compare/heidi">ThumbGate vs HEIDI</a> — behavior enforcement vs supply-chain scanning</li>
   <li><a href="/compare/rein">ThumbGate vs Rein</a> — coding-agent governance vs generic decorator governance</li>
+  <li><a href="/compare/openmono">ThumbGate vs OpenMono</a> — learning firewall vs static local-agent sandbox</li>
+  <li><a href="/compare/agoragentic">ThumbGate vs Agoragentic</a> — coding-agent PreToolUse gate vs agent OS + marketplace</li>
+  <li><a href="/compare/dirac">ThumbGate vs Dirac</a> — coding-agent PreToolUse gate vs token-efficient coding agent</li>
+  <li><a href="/compare/aperture">ThumbGate vs Tailscale Aperture</a> — tool-call gate vs identity-aware AI gateway on the tailnet</li>
   <li><a href="/compare/anthropic-claude-for-legal">ThumbGate vs Claude for Legal</a> — runtime gate pairs with Anthropic's practice-area plugins</li>
   <li><a href="/compare/mem0">ThumbGate vs Mem0</a> — enforcement vs memory for AI agents</li>
   <li><a href="/compare/speclock">ThumbGate vs SpecLock</a> — thumbs-feedback enforcement vs manual specs</li>
@@ -297,6 +323,8 @@
   <li><a href="/compare/databricks-unity-ai-gateway">ThumbGate vs Databricks Unity AI Gateway</a> — enterprise gateway vs local pre-action gates</li>
   <li><a href="/compare/hermes-everos-memory">ThumbGate vs Hermes and EverOS</a> — local-first behavior gates vs passive agent memory stores</li>
   <li><a href="/compare/far-ai">ThumbGate vs FAR.AI</a> — runtime agent enforcement vs frontier safety research and evaluation</li>
+  <li><a href="/compare/edotenv">ThumbGate vs EdotEnv</a> — runtime research-cycle gates vs RSI RL environments (harder-next-round transfer)</li>
+  <li><a href="/compare/langfuse-langsmith-observability">ThumbGate vs Langfuse / LangSmith / Braintrust / Arize</a> — pre-action enforcement vs LLM observability and eval platforms</li>
 </ul>
 
 <h2>How It Works</h2>

package/public/diagnostic.html

@@ -182,10 +182,72 @@ section {
 }
 .box h3 { margin: 0 0 8px; }
 .box p { margin: 0; color: var(--muted); }
+.pain-grid, .steps {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 14px;
+}
+.pain, .step {
+  min-height: 140px;
+  padding: 18px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  background: var(--panel-2);
+}
+.pain h3, .step h3 { margin: 0 0 8px; font-size: 17px; }
+.pain p, .step p { margin: 0; color: var(--muted); font-size: 14px; }
+.step-num { color: var(--cyan); font-weight: 900; font-size: 12px; letter-spacing: .08em; text-transform: uppercase; }
+.table-wrap {
+  overflow-x: auto;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  background: var(--panel);
+}
+table.compare {
+  width: 100%;
+  border-collapse: collapse;
+  min-width: 640px;
+  font-size: 14px;
+}
+table.compare th, table.compare td {
+  padding: 12px 14px;
+  border-bottom: 1px solid var(--line);
+  text-align: left;
+  vertical-align: top;
+}
+table.compare th { background: #0b1114; color: var(--cyan); }
+table.compare td:last-child { color: var(--green); font-weight: 800; }
+.faq-item { border-bottom: 1px solid var(--line); }
+.faq-q {
+  width: 100%;
+  border: 0;
+  background: transparent;
+  color: var(--text);
+  text-align: left;
+  padding: 16px 0;
+  font: inherit;
+  font-weight: 800;
+  cursor: pointer;
+}
+.faq-a { display: none; padding: 0 0 16px; color: var(--muted); }
+.faq-item.open .faq-a { display: block; }
+.cta-band {
+  margin-top: 22px;
+  padding: 20px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  background: var(--panel);
+  display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
+  align-items: center;
+  justify-content: space-between;
+}
+.cta-band p { margin: 0; color: var(--muted); }
 footer { padding: 32px 0 44px; color: var(--muted); }
 @media (max-width: 860px) {
   header { align-items: flex-start; flex-direction: column; }
-  .hero, .grid, .proof-strip { grid-template-columns: 1fr; }
+  .hero, .grid, .proof-strip, .pain-grid, .steps { grid-template-columns: 1fr; }
   h1 { font-size: 42px; }
 }
 </style>
@@ -210,7 +272,7 @@ footer { padding: 32px 0 44px; color: var(--muted); }
 }
 </script>
 </head>
-<body>
+<body id="top">
 <header>
   <a class="brand" href="/">
     <img class="mark" src="/assets/brand/thumbgate-mark-inline-v3.svg" alt="ThumbGate" width="28" height="28" />
@@ -218,6 +280,7 @@ footer { padding: 32px 0 44px; color: var(--muted); }
   </a>
   <nav aria-label="Primary">
     <a href="/">Home</a>
+    <a href="/founders">Founders</a>
     <a href="/pricing">Pricing</a>
     <a href="/llm-context.md">LLM Context</a>
   </nav>
@@ -226,8 +289,8 @@ footer { padding: 32px 0 44px; color: var(--muted); }
   <div class="hero">
     <div>
       <div class="eyebrow">Enterprise Workflow Gate · $499 entry offer</div>
-      <h1>Turn one repeated AI-agent failure into a gate you can prove.</h1>
-      <p class="lede">Send the workflow that keeps failing. ThumbGate configures what should allow, warn, or deny before an agent writes, sends, deploys, or spends—and adds the regression proof.</p>
+      <h1>Your agents did the wrong thing again, and you found out afterward.</h1>
+      <p class="lede">Wrong customer email sent. Branch force-pushed. Deploy shipped past approval. You run agents across lead gen, content, sales, and ops, and every one of them is one bad tool call from work you undo by hand. Your agent team needs a firewall: ThumbGate configures what should allow, warn, or deny before the agent writes, sends, deploys, or spends—and adds the regression proof.</p>
       <div class="actions">
         <form class="diagnostic-pay-form" action="/go/diagnostic-pay" method="POST" data-diagnostic-pay-form>
           <input type="hidden" name="utm_source" value="diagnostic_page">
@@ -277,6 +340,58 @@ footer { padding: 32px 0 44px; color: var(--muted); }
       <p class="hint" data-diagnostic-payment-hint>Ready to pay now? Use the $499 managed-gate checkout above. If the workflow is not a supported fit, we refund the order instead of opening a larger consulting scope.</p>
     </form>
   </div>
+  <section data-oceans-pain>
+    <h2>You didn't hire AI agents to manage calendars of incidents.</h2>
+    <p class="lede" style="font-size:17px;">Every repeat costs you twice: once when the agent gets it wrong, and again when you stop your own work to find it, undo it, and re-explain the rule that was already written down.</p>
+    <div class="pain-grid">
+      <div class="pain">
+        <h3>Drowning in operational agent tasks</h3>
+        <p>Repeat failures eat strategic time: bad diffs, wrong sends, unsafe deploys, spend without proof.</p>
+      </div>
+      <div class="pain">
+        <h3>Tried prompts before — quality drifts</h3>
+        <p>Rules in markdown get skipped when the agent looks competent. You need a check before the tool runs.</p>
+      </div>
+      <div class="pain">
+        <h3>US hires and GRC suites are slow capital</h3>
+        <p>Months of process for a dashboard. The $__SPRINT_DIAGNOSTIC_PRICE_DOLLARS__ offer hardens one concrete workflow in two business days after access.</p>
+      </div>
+    </div>
+  </section>
+  <section data-oceans-process>
+    <h2>From first call to a proved gate</h2>
+    <p class="lede" style="font-size:17px;">We'll tell you if ThumbGate is the wrong fit. If you already paid and it is not a supported gate, we refund.</p>
+    <div class="steps">
+      <div class="step">
+        <div class="step-num">01 · Discovery</div>
+        <h3>Fit check (15–60 min)</h3>
+        <p>Map the repeated failure to a PreToolUse boundary. Submit the form above if you want fit before checkout.</p>
+      </div>
+      <div class="step">
+        <div class="step-num">02 · Install</div>
+        <h3>Configure ALLOW / WARN / DENY</h3>
+        <p>One local gate on the agreed workflow — not a multi-system rewrite.</p>
+      </div>
+      <div class="step">
+        <div class="step-num">03 · Proof</div>
+        <h3>Two business days after access</h3>
+        <p>Regression test plus rollout and rollback evidence for the next similar action.</p>
+      </div>
+    </div>
+  </section>
+  <section data-diagnostic-qualification>
+    <h2>Before you go further, check whether this is actually yours.</h2>
+    <div class="grid">
+      <div class="box">
+        <h3>This is for you if</h3>
+        <p>You run one or more AI agents that take real actions — writing code, sending mail, updating records, deploying, spending. One specific action has gone wrong more than once. You can name the command, tool call, repo, or destination involved. You want the boundary enforced at the tool call, not restated in a prompt. You want to delegate more to your agents, not less, and you need a check you can point at before you do.</p>
+      </div>
+      <div class="box">
+        <h3>This is not for you if</h3>
+        <p>The failure is a one-off you cannot reproduce. The problem is model quality rather than a risky action — a gate blocks a bad send, it does not make the draft better. You want an org-wide hosted policy, SSO, a shared audit dashboard, or a compliance certificate; those are separate scope and hosted Enterprise capabilities are not generally available. You want someone to run the workflow for you. ThumbGate constrains agents, it does not replace them.</p>
+      </div>
+    </div>
+  </section>
   <section>
     <h2>Exactly what the $499 Enterprise Workflow Gate includes</h2>
     <p class="lede" style="font-size:17px;">One workflow, one 60-minute working review, one configured local gate and regression test, plus rollout and rollback proof within two business days after access and the agreed workflow materials are available.</p>
@@ -296,8 +411,8 @@ footer { padding: 32px 0 44px; color: var(--muted); }
     </div>
     <div class="intake-card" style="margin-top:16px;" data-diagnostic-fit-terms>
       <h3 style="margin-top:0;">Fit and refund boundary</h3>
-      <p>If the repeated failure cannot be reduced to one supported ThumbGate gate, the $__SPRINT_DIAGNOSTIC_PRICE_DOLLARS__ order is refunded instead of being silently converted into a larger service.</p>
-      <p class="hint">This is the enterprise entry offer for one workflow. Multi-workflow rollout, ongoing monitoring, shared hosting, compliance work, and hosted Enterprise capabilities are not included or generally available.</p>
+      <p>If the repeated failure cannot be reduced to one supported ThumbGate gate, the $__SPRINT_DIAGNOSTIC_PRICE_DOLLARS__ order is refunded instead of being silently converted into a larger service. This fence matches the <a href="/terms">Terms of Service</a> Module B deliverable and refund language exactly.</p>
+      <p class="hint">This is the enterprise entry offer for one workflow. Multi-workflow rollout, ongoing monitoring, shared hosting, compliance work, and hosted Enterprise capabilities are not included or generally available. Legal summaries: <a href="/privacy">Privacy</a> · <a href="/security">Security</a> · <a href="/legal">Legal index</a>.</p>
     </div>
   </section>
   <section>
@@ -333,11 +448,94 @@ footer { padding: 32px 0 44px; color: var(--muted); }
       </div>
     </div>
   </section>
+  <section data-oceans-compare>
+    <h2>How ThumbGate stacks up</h2>
+    <p class="lede" style="font-size:17px;">Same problem, four ways to pay for it. Compare on what you spend before the first hard boundary exists.</p>
+    <div class="table-wrap">
+      <table class="compare">
+        <thead>
+          <tr>
+            <th></th>
+            <th>DIY prompts</th>
+            <th>US full-time platform hire</th>
+            <th>Typical VA / freelance ops</th>
+            <th>ThumbGate diagnostic</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr>
+            <td>Starting cost</td>
+            <td>Model + review time</td>
+            <td>$5,500–7,000+/mo loaded</td>
+            <td>$2,500–5,000/mo</td>
+            <td>$__SPRINT_DIAGNOSTIC_PRICE_DOLLARS__ once</td>
+          </tr>
+          <tr>
+            <td>Time to first hard boundary</td>
+            <td>Manual upkeep</td>
+            <td>2–4 months</td>
+            <td>1–5 weeks (varies)</td>
+            <td>2 business days after access</td>
+          </tr>
+          <tr>
+            <td>If the match is wrong</td>
+            <td>You keep thrashing</td>
+            <td>Costly to replace</td>
+            <td>Restart search</td>
+            <td>Refund if not a supported fit</td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+  <section data-oceans-faq>
+    <h2>Questions before you book checkout</h2>
+    <div class="faq">
+      <div class="faq-item">
+        <button class="faq-q" type="button" aria-expanded="false">How fast can I get started?</button>
+        <div class="faq-a">Checkout or fit form today. Managed delivery is two business days after access and agreed workflow materials. Free evaluate: <code>npx thumbgate init</code>.</div>
+      </div>
+      <div class="faq-item">
+        <button class="faq-q" type="button" aria-expanded="false">What if the workflow is not the right fit?</button>
+        <div class="faq-a">We refund the $__SPRINT_DIAGNOSTIC_PRICE_DOLLARS__ order instead of expanding into open consulting. Bad matches stay rare because the fence is one supported local gate.</div>
+      </div>
+      <div class="faq-item">
+        <button class="faq-q" type="button" aria-expanded="false">Is this a long-term contract?</button>
+        <div class="faq-a">No. Diagnostic is one-time. Pro is $19/mo optional. Multi-workflow enterprise scope is separate after proof.</div>
+      </div>
+      <div class="faq-item">
+        <button class="faq-q" type="button" aria-expanded="false">How is this different from Upwork or hiring ops talent?</button>
+        <div class="faq-a">Those add humans. ThumbGate hardens the agents you already run with a pre-action gate, regression test, and written proof. Humans stay for exceptions.</div>
+      </div>
+    </div>
+    <div class="cta-band">
+      <div>
+        <p><strong>Two paths from here.</strong></p>
+        <p><strong>Path one:</strong> close this tab and keep paying for the same repeat — you find it after it lands, you undo it by hand, and the rule stays written in a file the agent can skip.<br>
+        <strong>Path two:</strong> send the one workflow that keeps failing and get it back as a configured gate with a regression test and written rollout and rollback proof, two business days after access.</p>
+        <p class="hint" style="margin-top:10px;">Refunded if the failure cannot be reduced to one supported ThumbGate gate. Runs locally on your machine. Want the free path first? <code>npx thumbgate init</code> — no account, nothing sent to us. See the <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">verification evidence</a>.</p>
+      </div>
+      <div class="actions">
+        <a class="button primary" href="#top" data-revenue-cta data-cta-id="diagnostic_bottom_buy" data-cta-placement="bottom_band">Harden my workflow — $__SPRINT_DIAGNOSTIC_PRICE_DOLLARS__</a>
+      </div>
+    </div>
+  </section>
 </main>
 <footer>
-  ThumbGate is local-first agent governance. <a href="/pricing">Buy the managed workflow gate</a> or submit one workflow above for a fit check.
+  ThumbGate is local-first agent governance. <a href="/pricing">Buy the managed workflow gate</a>, see the <a href="/founders">founders conversion page</a>, or submit one workflow above for a fit check.
+  · <a href="/terms">Terms</a> · <a href="/privacy">Privacy</a> · <a href="/security">Security</a> · <a href="/legal">Legal</a>
 </footer>
 <script>
+'use strict';
+document.querySelectorAll('.faq-q').forEach((button) => {
+  button.addEventListener('click', () => {
+    const item = button.closest('.faq-item');
+    const open = item.classList.toggle('open');
+    button.setAttribute('aria-expanded', open ? 'true' : 'false');
+  });
+});
+</script>
+<script>
 (function () {
   const search = new URLSearchParams(window.location.search);
   const paidForm = document.querySelector('[data-diagnostic-pay-form]');
@@ -382,7 +580,18 @@ footer { padding: 32px 0 44px; color: var(--muted); }
     }
   }
 
+  function privacySignalOptOut() {
+    try {
+      return navigator.globalPrivacyControl === true
+        || navigator.doNotTrack === '1'
+        || window.doNotTrack === '1';
+    } catch (_) {
+      return false;
+    }
+  }
+
   function telemetry(eventName, props) {
+    if (privacySignalOptOut()) return;
     try {
       navigator.sendBeacon && navigator.sendBeacon('/v1/telemetry/ping', JSON.stringify({
         event: eventName,

package/public/docs/connectors.html

@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Remote MCP Connector Documentation — ThumbGate</title>
+  <meta name="description" content="Remote MCP Connector documentation for ThumbGate, OAuth 2.1 PKCE flow, and read-only reviewer credentials.">
+  <link rel="canonical" href="https://thumbgate.ai/docs/connectors">
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; max-width: 800px; margin: 40px auto; padding: 0 20px; color: #111; }
+    h1 { color: #000; font-size: 2rem; border-bottom: 2px solid #eaeaea; padding-bottom: 12px; }
+    code { background: #f4f4f4; padding: 2px 6px; border-radius: 4px; font-size: 0.9em; }
+    pre { background: #f4f4f4; padding: 16px; border-radius: 6px; overflow-x: auto; }
+    footer { margin-top: 40px; border-top: 1px solid #eaeaea; padding-top: 20px; font-size: 0.9em; color: #666; }
+  </style>
+</head>
+<body>
+  <header>
+    <a href="/">ThumbGate Home</a> · <a href="/pricing">Pricing</a> · <a href="/support">Support</a>
+  </header>
+  <main>
+    <h1>Remote MCP Connector Documentation</h1>
+    <p>ThumbGate provides secure, direct remote Model Context Protocol (MCP) connectivity for autonomous AI agents, enterprise IDEs, and agentic workflows.</p>
+    
+    <h2>Connector Endpoint & Connection URL</h2>
+    <p>Connect your MCP-compliant client or agent harness to the canonical endpoint at <code>/mcp</code>:</p>
+    <pre><code>https://thumbgate-production.up.railway.app/mcp</code></pre>
+
+    <h2>Authentication & OAuth 2.1 PKCE Flow</h2>
+    <p>Remote connections require authentication via <strong>OAuth 2.1 PKCE</strong> (Proof Key for Code Exchange) to ensure state-integrity and prevent authorization-code interception attacks. Interactive sessions redirect to authorize scopes before materializing transient bearer tokens.</p>
+
+    <h2>Reviewer Credential Policy</h2>
+    <p>For automated evaluation, security audits, and zero-trust verification loops, ThumbGate provides a read-only <strong>reviewer credential</strong>. The reviewer credential permits diagnostic evaluation (<code>SELECT</code>, <code>DESCRIBE</code>, gate telemetry readout) without granting mutation or admin access.</p>
+  </main>
+  <footer>
+    <p><a href="/">ThumbGate</a> · <a href="/terms">Terms of Service</a> · <a href="/privacy">Privacy Policy</a> · <a href="/support">Support</a> · Contact: <a href="mailto:support@thumbgate.ai">support@thumbgate.ai</a></p>
+  </footer>
+</body>
+</html>

package/public/federal.html

@@ -200,7 +200,7 @@ __GA_BOOTSTRAP__
       Every gate decision is logged with timestamp, actor, action, policy, and evidence — the artifact OMB M-24-10 and EO 14110 ask for, generated continuously. Agency-owned policy. Vendor-neutral across Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode. On-prem or government cloud deployment via ThumbGate-Core gov mode.
     </p>
     <div class="cta-row">
-      <a class="btn-primary" href="mailto:iganapolsky@gmail.com?subject=ThumbGate%20federal%20pilot%20scoping">Start a 30-minute scoping call →</a>
+      <a class="btn-primary" href="mailto:support@thumbgate.ai?subject=ThumbGate%20federal%20pilot%20scoping">Start a 30-minute scoping call →</a>
       <a class="btn-secondary" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/FEDERAL.md">Read the technical brief</a>
     </div>
   </div>
@@ -352,7 +352,7 @@ __GA_BOOTSTRAP__
     </div>
 
     <div style="margin-top:32px;display:flex;gap:12px;flex-wrap:wrap">
-      <a class="btn-primary" href="mailto:iganapolsky@gmail.com?subject=ThumbGate%20federal%20pilot%20scoping">Email for a scoping call →</a>
+      <a class="btn-primary" href="mailto:support@thumbgate.ai?subject=ThumbGate%20federal%20pilot%20scoping">Email for a scoping call →</a>
       <a class="btn-secondary" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/FEDERAL.md">Read the full technical brief</a>
     </div>
   </div>