thumbgate 1.35.0 → 1.37.2

package/adapters/workos/WORKOS.md

@@ -0,0 +1,52 @@
+# WorkOS + ThumbGate (identity vs pre-action gates)
+
+## Split of responsibility
+
+| Concern | WorkOS AuthKit / MCP Auth | ThumbGate |
+|---------|---------------------------|-----------|
+| Who is the user/org? | SSO, social login, orgs, SCIM (paid) | — |
+| OAuth for MCP servers | AuthKit as OAuth 2.1 AS; scopes → RBAC | Remote MCP OAuth 2.1 PKCE (`scripts/mcp-oauth.js`) |
+| What may this tool call do *now*? | Scope admission only | Pre-action gates, lessons, prevention rules |
+| Agent skill install / auth scaffold | WorkOS CLI / widget skills | Gate: `review-workos-skill-and-auth-installer-actions` |
+
+**One line for buyers:** WorkOS (or any IdP) decides *who* the agent is. ThumbGate decides *which tool calls may run*.
+
+## ThumbGate production policy ($10/mo)
+
+Public `thumbgate.app` auth uses **WorkOS Production AuthKit only**:
+
+- AuthKit host: `progressive-mouse-13.authkit.app`
+- Production client id: `client_01KY0306CYDV6QSXE43QKM2ZXW`
+- Allowed under cap: email + password, **own** social OAuth apps (Google free under AuthKit MAU tier)
+- **Forbidden without budget rewrite:** custom AuthKit domain (~$99/mo), enterprise SSO/SAML connections (~$125/conn), Directory Sync, public traffic on staging AuthKit
+
+Guard (secret-free):
+
+```bash
+node scripts/workos-production-guard.js --json
+npm run prove:workos
+```
+
+## MCP OAuth scopes (hierarchy)
+
+ThumbGate remote MCP supports:
+
+| Scope | Allows |
+|-------|--------|
+| `mcp:read` | Tools with `readOnlyHint: true` |
+| `mcp:gates` | Gate-evaluation tools (+ read) |
+| `mcp:feedback` | Feedback capture tools (+ read) |
+| `mcp:write` | Mutating tools **and** everything above |
+
+`mcp:write` **implies** read/gates/feedback so operator tokens are not fail-closed on read-only tools (WorkOS-style role implication).
+
+## Complementary, not competitive
+
+Do not pitch ThumbGate as “WorkOS for agents.” Pitch as the **runtime prevention layer after identity** — the same gap as claw-style enterprise agents and GDG “dark agent” demos (poisoned specs, secret egress, destructive tool use).
+
+## Related
+
+- `scripts/workos-production-guard.js`
+- `scripts/mcp-oauth.js`
+- `scripts/prove-workos.js`
+- Gate category: **Enterprise Identity & MCP Auth Governance** in `config/gate-templates.json`

package/bin/cli.js

@@ -2627,6 +2627,234 @@ function deepseekV4RuntimeGuardrails() {
   process.stdout.write(formatDeepSeekV4RuntimeGuardrailsPlan(report));
 }
 
+function nvidiaSpecDecodeAlDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildNvidiaSpecDecodeAlDoctorReport,
+    formatNvidiaSpecDecodeAlDoctorReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'nvidia-specdecode-al-doctor'));
+  const report = buildNvidiaSpecDecodeAlDoctorReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatNvidiaSpecDecodeAlDoctorReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+
+
+function intentGovernedExecution() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildIntentGovernedExecutionReport,
+    formatIntentGovernedExecutionReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'intent-governed-execution'));
+  const report = buildIntentGovernedExecutionReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatIntentGovernedExecutionReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function jitHarnessCompose() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildJitHarnessComposeReport,
+    formatJitHarnessComposeReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'jit-harness-compose'));
+  const report = buildJitHarnessComposeReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatJitHarnessComposeReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function tokenShuntHonesty() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildTokenShuntHonestyReport,
+    formatTokenShuntHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'token-shunt-honesty'));
+  const report = buildTokenShuntHonestyReport(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatTokenShuntHonestyReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function typesafeTypedQuestionsDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildTypesafeTypedQuestionsReport,
+    formatTypesafeTypedQuestionsReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'typesafe-typed-questions'));
+  const report = buildTypesafeTypedQuestionsReport(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatTypesafeTypedQuestionsReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function colabComputeHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildColabComputeHonestyReport,
+    formatColabComputeHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'colab-compute-honesty'));
+  const report = buildColabComputeHonestyReport(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatColabComputeHonestyReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function cobbleHotStoreSplit() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildCobbleHotStoreSplitReport,
+    formatCobbleHotStoreSplitReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'cobble-hot-store-split'));
+  const report = buildCobbleHotStoreSplitReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatCobbleHotStoreSplitReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function allowlistBridgeHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildAllowlistBridgeHonestyReport,
+    formatAllowlistBridgeHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'allowlist-bridge-honesty'));
+  const report = buildAllowlistBridgeHonestyReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatAllowlistBridgeHonestyReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function packageManagerHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildPackageManagerHonestyReport,
+    formatPackageManagerHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'package-manager-honesty-doctor'));
+  const report = buildPackageManagerHonestyReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatPackageManagerHonestyReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function openuiCatalogComposeHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildOpenuiCatalogComposeHonestyReport,
+    formatOpenuiCatalogComposeHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'openui-catalog-compose-honesty'));
+  const report = buildOpenuiCatalogComposeHonestyReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatOpenuiCatalogComposeHonestyReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+
+async function workspaceSearchRoute() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildWorkspaceSearchRouteReport,
+    formatWorkspaceSearchRouteReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'workspace-search-route'));
+  const report = await buildWorkspaceSearchRouteReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatWorkspaceSearchRouteReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
 function upstreamContributions() {
   const args = parseArgs(process.argv.slice(3));
   const {
@@ -2865,6 +3093,25 @@ async function gateCheck() {
       return;
     }
 
+    const { evaluatePreToolUse } = require(path.join(PKG_ROOT, 'scripts', 'token-shunt-honesty'));
+    const shunt = evaluatePreToolUse({
+      toolName: input.tool_name || input.toolName,
+      toolInput: input.tool_input || input.toolInput || {},
+      cwd: input.cwd || process.cwd(),
+    });
+    if (shunt && shunt.ok === false) {
+      process.stdout.write(`${JSON.stringify({
+        decision: 'block',
+        reason: `token-shunt: ${shunt.reason}`,
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason: `token-shunt: ${shunt.reason}`,
+        },
+      })}\n`);
+      return;
+    }
+
     const output = await gatesEngine.runAsync(input);
     process.stdout.write(output + '\n');
   } catch (err) {
@@ -3012,6 +3259,24 @@ function sessionStart() {
     }
   } catch (_) { /* non-critical */ }
 
+  // MCP + lessons-store wiring — make unattended RAG-loop gaps loud at boot
+  try {
+    const { wiringReport } = require(path.join(PKG_ROOT, 'scripts', 'mcp-wiring-doctor'));
+    const wiring = wiringReport(CWD);
+    if (wiring && wiring.overall !== 'ok') {
+      if (reminderLines.length > 0) reminderLines.push('');
+      reminderLines.push(`ThumbGate RAG wiring: ${wiring.overall.toUpperCase()}`);
+      reminderLines.push(
+        wiring.unattendedCaptureReady
+          ? '  Capture path available (local and/or hosted).'
+          : '  Capture path BROKEN for unattended runs — wire .mcp.json thumbgate server and set THUMBGATE_FEEDBACK_DIR or THUMBGATE_API_BASE_URL+THUMBGATE_API_KEY.'
+      );
+      (wiring.findings || []).slice(0, 4).forEach((finding) => {
+        reminderLines.push(`  - ${finding}`);
+      });
+    }
+  } catch (_) { /* non-critical */ }
+
   // Top high-risk tags — force agent to see them at session start, not opt-in
   try {
     const { getRiskSummary } = require(path.join(PKG_ROOT, 'scripts', 'risk-scorer'));
@@ -3305,6 +3570,8 @@ function help() {
     console.log('  ai-inventory                                      Scan AI/ML components and export ML-BOM evidence');
     console.log('  verify-claims --claim="..."                     Recheck factual claims against configured sources');
     console.log('  doctor                                            Audit runtime isolation + bootstrap context');
+    console.log('  compass                                           6-axis pipeline: wire, lessons, rules, eval');
+    console.log('  security-central                                  Free Agent Security Central posture report');
     console.log('  break-glass --reason="..."                       Short TTL recovery if gates over-fire');
     console.log('  brain [--write]                                   Build the agent-readable context brain (lessons + rules + gates)');
     console.log('  pro                                               ThumbGate Pro (dashboard, exports, sync)');
@@ -3372,6 +3639,7 @@ function help() {
   console.log('  eval                  Turn feedback into reusable prompt/workflow eval proof');
   console.log('  optimize              [PRO] Prune CLAUDE.md and migrate rules to Pre-Action Checks');
   console.log('  prove [--target=X]    Run proof harness (adapters|automation|...)');
+  console.log('  compass               6-axis pipeline check (wire → lessons → rules → eval)');
   console.log('  watch                 Watch .thumbgate/ for external signals');
   console.log('  status                Approval trend + failure domain dashboard');
   console.log('  funnel                Marketing and revenue conversion funnel analytics');
@@ -3386,8 +3654,21 @@ function help() {
   console.log('  long-running-agent-context-guardrails Map structured-memory gaps to long-running agent gates');
   console.log('  reasoning-efficiency-guardrails Map reasoning compression signals to efficiency gates');
   console.log('  deepseek-v4-runtime-guardrails Map sparse-attention runtime signals to safety gates');
+  console.log('  nvidia-specdecode-al-doctor Check speculative AL/D evidence vs AL/(1+ρD) speedup math');
+  console.log('  package-manager-honesty-doctor Audit lockfile/CI parity; fail-closed manager switches');
+  console.log('  openui-catalog-compose-honesty Catalog-compose-only + repair-before-claim (OpenUI FORMAT)');
+  console.log('  allowlist-bridge-honesty Audit allowlisted registries/proxies as hops, not trust boundaries');
+  console.log('  jit-harness-compose   Compose memory/planning/action/capability onto existing rails (JIT FORMAT)');
+  console.log('  cobble-hot-store-split Split durable/delivery/hot lesson planes (CobbleDB FORMAT)');
+  console.log('  token-shunt-honesty   Intercept untargeted bulk reads (Portal FORMAT; not shunt@portal)');
+  console.log('  typesafe-typed-questions Typed noul/choice/score + code-owned route (TypeSafe FORMAT; not Jev)');
+  console.log('  colab-compute-honesty   Compute-unit honesty from Colab /signup (not a GPU SKU)');
+  console.log('  workspace-search-route     Route query to rg/fts/vector/hybrid/graph (zg FORMAT)');
+  console.log('  intent-governed-execution  NL intent → classify/authorize/gate/HITL/evidence (CyberStrike FORMAT)');
   console.log('  background-governance Background-agent run report and dispatch risk check');
   console.log('  analytics             Unified analytics snapshot (npm, GitHub, landing)');
+  console.log('  inventory             Agent action inventory: tool calls, gate denies, false-deny rate');
+  console.log('  conflict-audit        Find controls that report success but enforce nothing');
   console.log('  start-api             Start the ThumbGate HTTPS API server');
   console.log('');
 
@@ -3420,6 +3701,17 @@ function help() {
   console.log('  npx thumbgate long-running-agent-context-guardrails --request-count=80 --output-mb=3 --raw-chat-only --json');
   console.log('  npx thumbgate reasoning-efficiency-guardrails --baseline-tokens=1200 --compressed-tokens=980 --baseline-accuracy=0.84 --compressed-accuracy=0.85 --verifier --json');
   console.log('  npx thumbgate deepseek-v4-runtime-guardrails --context-tokens=900000 --hybrid-attention --speculative-decoding --accept-length=1.4 --precision-mode=fp8 --json');
+  console.log('  npx thumbgate nvidia-specdecode-al-doctor --speculative-decoding --accept-length=1.4 --draft-length=7 --draft-depth-ratio=0.05 --claimed-speedup=3 --json');
+  console.log('  npx thumbgate package-manager-honesty-doctor --propose-switch=pnpm --json');
+  console.log('  npx thumbgate openui-catalog-compose-honesty --catalog=catalog.json --stream=compose.txt --repair --json');
+  console.log('  npx thumbgate allowlist-bridge-honesty --json');
+  console.log('  npx thumbgate jit-harness-compose --task="implement PreToolUse gate fix" --json');
+  console.log('  npx thumbgate cobble-hot-store-split --json');
+  console.log('  npx thumbgate token-shunt-honesty --json --lines=800');
+  console.log('  npx thumbgate typesafe-typed-questions --json --tool-name=Bash --command="git push --force origin main"');
+  console.log('  npx thumbgate colab-compute-honesty --json --map-only');
+  console.log('  npx thumbgate workspace-search-route --query="how does X connect" --json');
+  console.log('  npx thumbgate intent-governed-execution --intent="railway deploy" --json');
   console.log('  npx thumbgate upstream-contributions --max-repos=10 --write');
   console.log('  npx thumbgate background-governance --json');
   console.log('  npx thumbgate background-governance --check --agent-id=builder --branch=main --files-changed=25 --json');
@@ -3459,6 +3751,8 @@ const SUBCOMMAND_HELP = {
   lessons:       'Usage: npx thumbgate lessons [--query="..."] [--limit=N]\n\nSearch the lesson database (Pro feature).',
   search:        'Usage: npx thumbgate search <query>\n\nSearch ThumbGate knowledge base (Pro feature).',
   'gate-check':  'Usage: npx thumbgate gate-check\n\nPreToolUse hook interface: reads tool call JSON from stdin, outputs gate verdict.',
+  'typesafe-typed-questions': 'Usage: npx thumbgate typesafe-typed-questions [--payload=path] [--tool-name=Bash] [--command="..."] [--json] [--map-only] [--clone-jev]\n\nTypeSafe FORMAT steal: typed noul/choice/score over a PreToolUse payload, code-owned pass/review/block. Does not install typesafe-sdk or call Jev.',
+  'colab-compute-honesty': 'Usage: npx thumbgate colab-compute-honesty [--claim="..."] [--plan-proof=proplus] [--json] [--map-only]\n\nColab /signup FORMAT steal: Compute Units ≠ dedicated GPU; Subscribe ≠ receipt. Does not buy Pro/Pro+.',
   'claim-stop-check': 'Usage: npx thumbgate claim-stop-check\n\nClaude Stop-hook interface: reads the hook payload from stdin and blocks factual claims that disagree with configured sources.',
   'verify-claims': 'Usage: npx thumbgate verify-claims --claim="the row count is 1,284" [--config=.thumbgate/claim-verifiers.json] [--cwd=path] [--json]\n\nRecheck supported factual claims against operator-configured SQLite, filesystem, and JSON sources. Exits non-zero on mismatch, missing verifier, or verifier error.',
   'hermes-gate': 'Usage: npx thumbgate hermes-gate\n\nNous Research Hermes Agent pre_tool_call shell hook: reads Hermes tool-call JSON from stdin, runs the ThumbGate gate pipeline (strict by default), and outputs {"decision":"block","reason":...} to veto or {} to allow. Gates terminal/patch/skill_manage etc. See adapters/hermes/config.yaml.',
@@ -3473,6 +3767,8 @@ const SUBCOMMAND_HELP = {
   compact:       'Usage: npx thumbgate compact\n\nCompact the lesson database and reclaim disk space.',
   'context-packs': 'Usage: npx thumbgate context-packs\n\nGenerate context packs from top failure patterns.',
   suggest:       'Usage: npx thumbgate suggest <gate-id>\n\nSuggest fixes for a specific gate based on lesson history.',
+  inventory:     'Usage: npx thumbgate inventory [--json] [--days=N] [--data-dir=path] [--max-bytes=N]\n\nRead-only inventory of agent activity in this repo\'s ThumbGate store: agents seen, tool calls by tool, allow/deny counts, deny reasons per gate, top gates, per-day activity, and the false-deny rate.\n\nEvery source reports its own status (ok / empty / missing) so an uninstrumented store never looks like a quiet one. falseDenyRate is null with a stated reason whenever a real denominator was not observed; falseDenyNumerator and falseDenyDenominator are always emitted raw.\n\nEach source is read as a bounded tail (default 8 MiB, --max-bytes to change) so a multi-hundred-MB audit log is never loaded whole. If the tail did not reach back to the start of the window, windowFullyCovered is false and the text output says so.',
+  'conflict-audit': 'Usage: npx thumbgate conflict-audit [--json] [--offline] [--repo-root=path] [--github-repo=owner/name] [--branch=main] [--consecutive-failures=N] [--excluded-lines=N] [--commits=N]\n\nDeterministic detector for controls that report success but enforce nothing. Six detectors, no model involved:\n\n  D1 gate configs declaring a `patterns` array when the engine reads `pattern` (the match block is skipped, so the gate fires on every tool in its toolNames)\n  D2 gate patterns that cannot compile (an inline (?i) flag group throws; the engine swallows the throw as "no match")\n  D3 checks required by NEITHER classic branch protection NOR any repository ruleset, which have failed on N or more consecutive recent commits\n  D4 sonar.exclusions / sonar.coverage.exclusions entries that hide non-trivial code inside sonar.sources from scanning\n  D5 modules and entry exports with zero production call sites outside their own tests (for a PUBLISHED package the entry surface is public API whose callers are downstream npm consumers, so those are reported NOT INSPECTED rather than dead)\n  D6 the bare `path.resolve(process.argv[1]) === path.resolve(__filename)` main check, which no-ops under an npm bin shim\n\nEvery detector reports its own status: `ran` (inspected), `partial` (some of the surface was not inspected, and which), or `unavailable` (could not inspect at all). An unavailable detector is NEVER reported as clean. D3 needs the `gh` CLI (resolved from a fixed install location, never through $PATH) plus read access to branch protection and repository rulesets; use --offline to skip it explicitly.',
   cost:          'Usage: npx thumbgate cost [--json] [--stats <path>] [--mix \'{"claude-sonnet-4-5":0.8,...}\']\n\nShow cumulative $ and tokens saved by PreToolUse gate blocks. Reads ~/.thumbgate/gate-stats.json.',
   savings:       'Usage: npx thumbgate savings [--json] [--stats <path>] [--mix \'{"claude-sonnet-4-5":0.8,...}\']\n\nAlias for `thumbgate cost`.',
   'setup-vertex': 'Usage: npx thumbgate setup-vertex [--dry-run]\n\nAuto-enable Vertex AI API on GCP and write local Vertex routing config to .env. With --dry-run, only detect the active account/project and print the planned changes. This does not create or verify a Dialogflow CX agent; use the Dialogflow CX REST API or console for live-agent evidence.',
@@ -3923,14 +4219,66 @@ switch (COMMAND) {
       generateAgentReadinessReport,
       reportToText,
     } = require(path.join(PKG_ROOT, 'scripts', 'agent-readiness'));
+    const { wiringReport, formatReport } = require(path.join(PKG_ROOT, 'scripts', 'mcp-wiring-doctor'));
     const args = parseArgs(process.argv.slice(3));
     const report = generateAgentReadinessReport({ projectRoot: CWD });
+    const wiring = wiringReport(CWD);
     if (args.json) {
-      console.log(JSON.stringify(report, null, 2));
+      console.log(JSON.stringify({ ...report, wiring }, null, 2));
     } else {
       process.stdout.write(reportToText(report));
+      process.stdout.write(`\n${formatReport(wiring)}\n`);
     }
-    process.exit(report.overallStatus === 'ready' ? 0 : 1);
+    const ready = report.overallStatus === 'ready' && wiring.overall !== 'error';
+    process.exit(ready ? 0 : 1);
+    break;
+  }
+  case 'compass':
+  case 'pipeline':
+  case 'pipeline-compass': {
+    const { getPipelineCompass, formatPipelineCompass } = require(path.join(PKG_ROOT, 'src', 'pipeline-compass'));
+    const args = parseArgs(process.argv.slice(3));
+    const report = getPipelineCompass({ projectRoot: CWD });
+    if (args.json) console.log(JSON.stringify(report, null, 2));
+    else console.log(formatPipelineCompass(report));
+    process.exit(report.ready ? 0 : 1);
+    break;
+  }
+  case 'writeguard':
+  case 'mcp-writeguard': {
+    const { main } = require(path.join(PKG_ROOT, 'scripts', 'mcp-writeguard'));
+    main();
+    break;
+  }
+  case 'latency':
+  case 'latency-budget': {
+    const { main } = require(path.join(PKG_ROOT, 'scripts', 'latency-budget'));
+    main();
+    break;
+  }
+  case 'wiring-doctor':
+  case 'mcp-wiring-doctor': {
+    const { wiringReport, formatReport, applyFix } = require(path.join(PKG_ROOT, 'scripts', 'mcp-wiring-doctor'));
+    const args = parseArgs(process.argv.slice(3));
+    if (args.fix) applyFix(CWD);
+    const wiring = wiringReport(CWD);
+    if (args.json) console.log(JSON.stringify(wiring, null, 2));
+    else console.log(formatReport(wiring));
+    process.exit(wiring.overall === 'error' ? 2 : wiring.overall === 'warning' ? 1 : 0);
+    break;
+  }
+  case 'security-central':
+  case 'security:central':
+  case 'agent-security-central': {
+    const {
+      buildSecurityCentralReport,
+      formatSecurityCentralReport,
+    } = require(path.join(PKG_ROOT, 'scripts', 'agent-security-central'));
+    const args = parseArgs(process.argv.slice(3));
+    const report = buildSecurityCentralReport({ projectRoot: CWD });
+    if (args.json) console.log(JSON.stringify(report, null, 2));
+    else console.log(formatSecurityCentralReport(report));
+    process.exit(report.posture.band === 'critical' ? 2 : report.posture.band === 'at_risk' ? 1 : 0);
     break;
   }
   case 'export-dpo':
@@ -3994,6 +4342,73 @@ switch (COMMAND) {
   case 'sparse-attention-runtime-guardrails':
     deepseekV4RuntimeGuardrails();
     break;
+  case 'nvidia-specdecode-al-doctor':
+  case 'specdecode-al-doctor':
+  case 'speculative-decoding-al-doctor':
+  case 'nvidia-speculative-decoding-doctor':
+    nvidiaSpecDecodeAlDoctor();
+    break;
+  case 'package-manager-honesty-doctor':
+  case 'pm-honesty-doctor':
+  case 'pnpm12-honesty-doctor':
+  case 'lockfile-ci-parity-doctor':
+    packageManagerHonestyDoctor();
+    break;
+  case 'openui-catalog-compose-honesty':
+  case 'openui-honesty-doctor':
+  case 'catalog-compose-honesty':
+  case 'repair-before-compose-claim':
+    openuiCatalogComposeHonestyDoctor();
+    break;
+  case 'allowlist-bridge-honesty':
+  case 'gitlab-sandbox-allowlist':
+  case 'allowlist-not-trust':
+  case 'trust-handoff-honesty':
+    allowlistBridgeHonestyDoctor();
+    break;
+  case 'jit-harness-compose':
+  case 'jit-compose':
+  case 'jit-harness':
+  case 'harness-compose':
+    jitHarnessCompose();
+    break;
+  case 'cobble-hot-store-split':
+  case 'cobble-hot-store':
+  case 'cobbledb-split':
+  case 'hot-store-split':
+    cobbleHotStoreSplit();
+    break;
+  case 'token-shunt-honesty':
+  case 'token-shunt':
+  case 'shunt-honesty':
+    tokenShuntHonesty();
+    break;
+  case 'typesafe-typed-questions':
+  case 'typesafe-hook':
+  case 'typed-questions':
+  case 'jev-typed-questions':
+    typesafeTypedQuestionsDoctor();
+    break;
+  case 'colab-compute-honesty':
+  case 'colab-honesty':
+  case 'compute-unit-honesty':
+    colabComputeHonestyDoctor();
+    break;
+  case 'workspace-search-route':
+  case 'zg-search-route':
+  case 'zvec-grep-route':
+  case 'search-route':
+    workspaceSearchRoute().catch((err) => {
+      console.error(err && err.stack ? err.stack : err);
+      process.exitCode = 1;
+    });
+    break;
+  case 'intent-governed-execution':
+  case 'governed-intent':
+  case 'cyberstrike-governed':
+  case 'intent-govern':
+    intentGovernedExecution();
+    break;
   case 'long-running-agent-context-guardrails':
   case 'agent-context-guardrails':
   case 'slack-context-guardrails':
@@ -4327,6 +4742,53 @@ switch (COMMAND) {
     runAnalytics();
     break;
   }
+  case 'inventory': {
+    // Read-only rollup of what agents did in this repo's ThumbGate store:
+    // tool calls, allow/deny counts, deny reasons per gate, per-day activity,
+    // and the false-deny rate (null when it cannot be honestly computed).
+    const inventoryArgs = parseArgs(process.argv.slice(3));
+    const {
+      buildInventory,
+      renderInventoryText,
+    } = require(path.join(PKG_ROOT, 'scripts', 'agent-action-inventory'));
+    const { resolveFeedbackDir } = require(path.join(PKG_ROOT, 'scripts', 'feedback-paths'));
+    const inventory = buildInventory({
+      dataDir: inventoryArgs['data-dir'] || resolveFeedbackDir(),
+      windowDays: inventoryArgs.days,
+      maxBytes: inventoryArgs['max-bytes'] ? Number(inventoryArgs['max-bytes']) : undefined,
+    });
+    if (inventoryArgs.json) {
+      console.log(JSON.stringify(inventory, null, 2));
+    } else {
+      process.stdout.write(renderInventoryText(inventory));
+    }
+    break;
+  }
+  case 'conflict-audit': {
+    // Deterministic sweep for controls that report success but enforce
+    // nothing. Each detector reports its own status, so a surface that could
+    // not be inspected is never rendered as a clean bill of health.
+    const conflictArgs = parseArgs(process.argv.slice(3));
+    const {
+      auditGovernanceConflicts,
+      renderConflictAuditText,
+    } = require(path.join(PKG_ROOT, 'scripts', 'governance-conflict-audit'));
+    const conflictReport = auditGovernanceConflicts({
+      repoRoot: conflictArgs['repo-root'] || process.cwd(),
+      gitHubRepo: conflictArgs['github-repo'],
+      branch: conflictArgs.branch,
+      consecutiveFailureThreshold: conflictArgs['consecutive-failures'],
+      excludedLineThreshold: conflictArgs['excluded-lines'],
+      commitLimit: conflictArgs.commits,
+      offline: Boolean(conflictArgs.offline),
+    });
+    if (conflictArgs.json) {
+      console.log(JSON.stringify(conflictReport, null, 2));
+    } else {
+      process.stdout.write(`${renderConflictAuditText(conflictReport)}\n`);
+    }
+    break;
+  }
   case 'start-api':
     startApi();
     break;
@@ -4408,7 +4870,7 @@ switch (COMMAND) {
     });
     req.on('error', (err) => {
       console.error(`✗ Subscribe failed: ${err.message}`);
-      console.error('  Network issue? Try again, or email igor.ganapolsky@gmail.com directly.');
+      console.error('  Network issue? Try again, or email support@thumbgate.ai directly.');
       process.exit(3);
     });
     req.on('timeout', () => {

package/bin/futureagi-bridge

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+'use strict';
+
+// Requiring the module is not enough: its CLI only self-executes when the
+// module itself is the entry point, so `futureagi-bridge --doctor` used to
+// exit 0 having evaluated nothing.
+const { mainCli } = require('../scripts/future-agi-evaluator.js');
+
+process.exit(mainCli());