thumbgate 1.37.1 → 1.37.3

package/.agents/skills/article-syndication-pipeline/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: article-syndication-pipeline
+description: Technical article syndication pipeline for cross-posting Dev.to articles to CoderLegion and other developer platforms with canonical URL preservation, UTM parameter attribution, and contributor onboarding compliance.
+---
+
+# ✍️ Article Syndication & Contributor Pipeline
+
+This skill guides the autonomous syndication of ThumbGate technical discoveries, security postmortems, and engineering deep dives across developer platforms (Dev.to, CoderLegion, Hashnode, Medium).
+
+---
+
+## 🎯 Architecture & Operating Directives
+
+1. **Canonical SEO Integrity:**
+   - Always preserve the primary origin as the canonical URL (e.g. `https://dev.to/igorganapolsky/...`).
+   - Syndicated copies on CoderLegion or elsewhere must link back to avoid search engine duplicate-content penalties.
+2. **First-Party Revenue Attribution:**
+   - All inbound links to `thumbgate.ai` must include UTM campaign tags (`utm_source=coderlegion`, `utm_medium=community`, `utm_campaign=guest-post`).
+   - Conversion links (Pro license checkout) must route through `/go/pro` (`https://thumbgate.ai/go/pro?utm_source=...`) to ensure server-side redirect logging.
+3. **CoderLegion Contributor Compliance:**
+   - URL import endpoint: `https://coderlegion.com/import-post`.
+   - Supports 2 imported Dev.to articles with full attribution.
+   - Contributor checklist: `https://coderlegion.com/guest-blog-checklists`.
+   - All imported posts undergo editorial review before appearing on the main feed.
+
+---
+
+## 🛠️ Step-by-Step Workflow
+
+1. **Verify Original Article:**
+   Verify original URL exists, returns HTTP 200, and has correct canonical tags.
+2. **Fetch via Platform Parser:**
+   Submit `import_url` to `https://coderlegion.com/import-post`.
+3. **Review & Confirm Metadata:**
+   Confirm title, tags (`ai`, `security`, `architecture`, `opensource`), and backlink to canonical source.
+4. **Publish & Track:**
+   Submit publication step and record post URL in session log and Comet browser tab.

package/.agents/skills/ci-gha-buildkite-patterns-not-clone/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: ci-gha-buildkite-patterns-not-clone
+description: >
+  Buildkite pipeline architecture is FORMAT, not a ThumbGate CI vendor.
+  Steal first-fail step identity, PR fail-fast, needs:/wait honesty, skip
+  conditions, and GITHUB_STEP_SUMMARY annotations onto existing GitHub
+  Actions. Never add Buildkite Pipelines, agents, Test Engine, or a second
+  required check. Slash: /ci-gha-buildkite-patterns-not-clone.
+---
+
+# CI GHA Buildkite patterns — compare, do not clone
+
+## Goal
+
+Fail-closed GitHub Actions diagnosis for whom: ThumbGate public CI — so a
+red PR names the **first failed step**, cancels leftover PR runs, and never
+grows a Buildkite bill.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Migrate this public repo to Buildkite | Keep the required GHA contexts on `ubuntu-latest` |
+| Dump `--log-failed` first | `npx thumbgate ci-gha-buildkite-patterns --jobs-json=…` |
+| `gh run rerun` a queued job | Wait for Actions to drain |
+| Test Engine auto-quarantine | First fail is a regression until proven otherwise |
+| `cancel-in-progress: true` on `main` | Cancel PR reruns only |
+
+HARD fail closed. REFUSE SKU clones. This is **not a Buildkite clone**.
+Never migrate this public repo to Buildkite.
+
+## Reference
+
+- https://buildkite.com/docs/pipelines/best-practices/pipeline-design-and-structure
+- https://buildkite.com/docs/pipelines/configure/annotations
+- `scripts/ci-gha-buildkite-patterns.js`
+- Complements `/ci-first-fail` (same FORMAT, global copy)
+
+## Examples (show, don't tell)
+
+Weak: "Buildkite is faster, add it as a required check."
+
+Gold:
+
+```bash
+$ npx thumbgate ci-gha-buildkite-patterns --json --map-only
+ok: true
+$ npx thumbgate ci-gha-buildkite-patterns --json --migrate
+ok: false  # migrate_vendor
+```
+
+## Procedures
+
+```bash
+npx thumbgate ci-gha-buildkite-patterns --json --map-only
+npx thumbgate ci-gha-buildkite-patterns --json --workflow=.github/workflows/ci.yml
+npx thumbgate ci-gha-buildkite-patterns --json --jobs-json=jobs.json
+npm run test:ci-gha-buildkite-patterns
+```
+
+1. Name `first_fail.step` before opening logs.
+2. Absent required contexts → githubstatus.com, not a code blame.
+3. E2E shards stay `fail-fast: false` so merge-reports can still annotate (Buildkite `wait` + `continue_on_failure`).
+4. Do not vendor `buildkite-agent`.
+
+## Rubric
+
+- `--map-only` → `ok=true`
+- `--clone-buildkite` / `--migrate` / `--quarantine` / `--rerun-queued` → fail
+- live `ci.yml` concurrency excludes `main`
+- doctor tests PASS
+- evidence: `--json` in the same turn

package/.agents/skills/cobble-hot-store-compare-not-clone/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: cobble-hot-store-compare-not-clone
+description: >
+  CobbleDB (Perplexity 2026-09) is a batch-read hot store, not a ThumbGate
+  clone. Steal the three-plane FORMAT (durable state / batched delivery /
+  query-time MultiGet + hedge + hot subset) onto existing lesson rails; never
+  vendor RocksDB, YTsaurus, Pillar, or Lorry. Slash: /cobble-hot-store-compare-not-clone.
+---
+
+# CobbleDB — compare, do not clone
+
+## Goal
+
+Produce fail-closed honesty for whom: ThumbGate agents writing feedback or
+serving lessons — so processing never contends with PreToolUse reads, batch
+lookups hedge slow sources, and only promoted/matchable records occupy the
+hot path.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Clone CobbleDB / Pillar / Lorry / RocksDB / YTsaurus | Map planes onto existing lesson rails |
+| Write processing output onto `hybrid-feedback-context` | Durable log → `feedback-to-memory` → retrieval |
+| Sequential per-key hot reads of a batch | `batchGetPrepared` (partition + hedge) |
+| Dump raw `feedback-log.jsonl` into retrieval | `promoted_matchable` (or `fresh_high_value`) subset |
+| Overwrite embedding/chunk versions | Coexist representations |
+| Dual-edit DIRTY lesson-graph PR #3650 | Leave graph layer alone |
+| Quote Perplexity 5× / 20% as ours | Measure ThumbGate rails with `perf-budget-check` |
+| Hero Continuity / net-new storage SKU | ECI: existing retrieval rails only |
+
+HARD fail closed. REFUSE SKU clones.
+
+## Reference
+
+- https://www.perplexity.ai/hub/blog/cobbledb
+- `scripts/cobble-hot-store-split.js`
+- `scripts/lesson-retrieval.js` · `scripts/feedback-to-memory.js` · `scripts/memory-vs-rag-route.js`
+- `docs/agents/cobble-hot-store-split.md`
+- `/high-roi-steal-and-finish` · `/eci-thumbgate-ip-wall`
+
+## Examples (show, don't tell)
+
+Weak: Summarize CobbleDB and add a RocksDB cluster class.
+
+Gold:
+
+```bash
+$ npx thumbgate cobble-hot-store-split --json
+ok: true
+status: ready
+$ node --test tests/cobble-hot-store-split.test.js
+# processing → hot write → coupled_processing_hot_write deny
+```
+
+## Procedures
+
+```bash
+npx thumbgate cobble-hot-store-split --json
+npx thumbgate cobble-hot-store-split --map-only
+npx thumbgate cobble-hot-store-split --trace=tests/fixtures/cobble-hot-store-split-coupled.json --json
+npx thumbgate cobble-hot-store-split --keys=lesson-1,lesson-2 --json
+npm run test:cobble-hot-store-split
+```
+
+1. Classify every write as `durable`, `delivery`, or `hot`.
+2. Deny processing → hot coupling.
+3. Require batched MultiGet (+ hedge) for ≥3 serving keys.
+4. Keep the hot subset to promoted/matchable records.
+5. Refuse `--clone-cobbledb`.
+
+## Rubric
+
+- gold default (this repo) → `ok=true`, `status=ready`
+- `--trace` coupled fixture → `ok=false`, `coupled_processing_hot_write`
+- `--clone-cobbledb` → `ok=false`, `cobble_clone_refused`
+- sequential ≥3-key hot read → `sequential_hot_batch`
+- unbounded hot subset → `unbounded_hot_subset`
+- doctor: `npm run test:cobble-hot-store-split` PASS
+- evidence: command output in the same turn

package/.agents/skills/colab-compute-honesty-not-clone/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: colab-compute-honesty-not-clone
+description: >
+  Google Colab /signup is a compute-unit storefront, not a ThumbGate GPU SKU.
+  Steal CU-pack honesty (subscribe≠receipt, CU≠dedicated GPU, 24h background
+  is Pro+). Never buy Pro/Pro+/PAYG from an agent session. Never clone
+  colab-cli. Slash: /colab-compute-honesty-not-clone.
+---
+
+# Colab compute honesty — compare, do not clone
+
+## Goal
+
+Fail-closed compute claims for whom: ThumbGate evals and fleet offload talk —
+so "Colab Pro+ A100" cannot pass without a live Current-plan receipt.
+Colab stays a neighbor notebook host, not a product.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Buy Colab Pro / Pro+ / Compute Units | `npx thumbgate colab-compute-honesty --json` |
+| Claim Pro+ because Subscribe is on /signup | `--plan-proof` from a Current-plan receipt |
+| colab-cli / ngrok SSH / zero-cost A100 | GitHub Actions remains the eval runner |
+| Dual-edit unverified `google-colab-pro-runner` theater | Treat that skill as a claim to audit |
+
+HARD fail closed. REFUSE SKU clones. Do NOT spend.
+
+## Reference
+
+- https://colab.research.google.com/signup (live 2026-09-17, `iganapolsky@gmail.com`)
+- PAYG $9.99/100 CU and $49.99/500 CU (buttons disabled on that account)
+- Pro $9.99/mo and Pro+ $49.99/mo still showed Subscribe
+- `scripts/colab-compute-honesty.js`
+
+## Examples (show, don't tell)
+
+Weak: Subscribe to Pro+ and offload gate-eval to A100 via colab-cli.
+
+Gold:
+
+```bash
+$ npx thumbgate colab-compute-honesty --json --map-only
+ok: true
+$ npx thumbgate colab-compute-honesty --json --claim='Colab Pro+ A100 eval sweep'
+ok: false  # paid_feature_without_plan_proof
+```
+
+## Procedures
+
+```bash
+npx thumbgate colab-compute-honesty --json --map-only
+npx thumbgate colab-compute-honesty --json --claim='offload to Colab A100'
+npx thumbgate colab-compute-honesty --json --clone-colab
+npm run test:colab-compute-honesty
+```
+
+1. Open /signup signed in. Subscribe visible ⇒ not a receipt.
+2. Do not click Buy / Subscribe.
+3. Run the doctor on any Colab/GPU offload claim.
+4. Keep ThumbGate tests on GitHub Actions.
+
+## Rubric
+
+- `--map-only` → `ok=true`
+- Pro+/A100/24h without `--plan-proof` → fail
+- live snapshot with Subscribe + `--plan-proof=proplus` → `subscribe_button_is_not_receipt`
+- `--buy-pro` / `colab-cli` → fail
+- doctor tests PASS
+- evidence: `--json` in the same turn

package/.agents/skills/comet-session-logger/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: comet-session-logger
+description: Live session logger and observability dashboard driver for Comet browser. Ensures every PR, deployment status check, CoderLegion/Dev.to publication, and Railway production health metric is actively logged and visualized in Comet tabs.
+---
+
+# ☄️ Comet Session Logger & Visual HUD
+
+This skill governs the automated logging, tab orchestration, and visual tracking of all ThumbGate agentic tasks inside the **Comet** browser on macOS.
+
+---
+
+## 🎯 Purpose & Directives
+
+1. **CEO Visual Observability:** The CEO monitors agent progress via open tabs in Comet. Every major milestone must be reflected in Comet tabs without disrupting existing work.
+2. **Deterministic Tab Management:** Uses macOS AppleScript (`osascript`) to inspect, activate, create, or update Comet tabs.
+3. **Fail-Safe & Non-Destructive:** Never closes existing tabs; always reuses matching URLs or opens clean dedicated monitoring tabs.
+
+---
+
+## 🧭 Standard Tab Targets
+
+| Surface | Target URL | Trigger Milestone |
+|---------|------------|-------------------|
+| **Pull Requests** | `https://github.com/IgorGanapolsky/ThumbGate/pull/<NUM>` | After creating or advancing a PR |
+| **CI / Checks** | `https://github.com/IgorGanapolsky/ThumbGate/actions` | During workflow verification |
+| **Production Health** | `https://thumbgate-production.up.railway.app/health` | After deployment gate verification |
+| **Railway Console** | `https://railway.com/project/thumbgate-production` | When inspecting infrastructure |
+| **CoderLegion** | `https://coderlegion.com/import-post` | When onboarding or syndicating articles |
+| **Dev.to Dashboard** | `https://dev.to/dashboard` | When tracking article reach & analytics |
+
+---
+
+## 🛠️ AppleScript Orchestration Helpers
+
+```bash
+# Check existing Comet tabs
+osascript -e '
+tell application "Comet"
+    set outList to ""
+    repeat with w in windows
+        repeat with t in tabs of w
+            set outList to outList & (URL of t) & " | " & (title of t) & linefeed
+        end repeat
+    end repeat
+    return outList
+end tell'
+
+# Open or focus a specific URL in Comet
+open_comet_url() {
+  local target_url="$1"
+  osascript -e "
+  tell application \"Comet\"
+      activate
+      tell front window
+          make new tab with properties {URL:\"${target_url}\"}
+      end tell
+  end tell"
+}
+```

package/.agents/skills/datadog-llm-obs-compare-not-clone/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: datadog-llm-obs-compare-not-clone
+description: >
+  Datadog LLM Observability eBook is FORMAT, not a ThumbGate clone. Steal four
+  practices (operational metrics, injection+PII scrub, quality evals, e2e
+  parented spans) onto existing receipts/redaction/feedback/audit-trace.
+  Never vendor dd-trace, DatadogAgentObservability, or OTLP. Never dual-edit
+  PR #3881. Slash: /datadog-llm-obs-compare-not-clone.
+---
+
+# Datadog LLM-obs — compare, do not clone
+
+## Goal
+
+Produce fail-closed honesty for whom: ThumbGate agents claiming an LLM/agent
+run is observed — so errors, latency, tokens, injection/PII, quality, and
+parented spans exist on **existing** rails before any "we have observability" claim.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Clone Datadog Agent Observability / SDS / Clusters | Map 4 practices onto existing rails |
+| `npm install dd-trace` / `DD_API_KEY` LLM obs | `scripts/secret-redaction.js` + `agent-audit-trace.js` |
+| Dual-edit PR #3881 Datadog-style engine | Complement; orchestrator overlap is board-loop #3883 |
+| Dual-edit PR #3883 board-loop | Leave PR drain there |
+| OTLP-export prompt traces | Local receipts + redaction |
+| Quote Datadog MTTR as ours | Measure ThumbGate latency-budget / task-outcomes |
+| Hero Continuity / net-new obs SKU | ECI: maintenance of existing surfaces |
+
+HARD fail closed. REFUSE SKU clones.
+
+## Reference
+
+- https://lp.datadoghq.com/rs/875-UVY-685/images/eBook-LLMObservabilityBestPractices.pdf
+- `scripts/llm-obs-honesty.js`
+- `scripts/latency-budget.js` · `action-receipts.js` · `secret-redaction.js` · `agent-audit-trace.js` · `task-outcomes.js`
+- `/high-roi-steal-and-finish` · `/eci-thumbgate-ip-wall`
+
+## Examples (show, don't tell)
+
+Weak: Summarize the eBook and add a DatadogAgentObservability class.
+
+Gold:
+
+```bash
+$ npx thumbgate llm-obs-honesty --json
+ok: true
+status: ready
+$ npx thumbgate llm-obs-honesty --clone-datadog --json
+datadog_clone_refused
+```
+
+## Procedures
+
+```bash
+npx thumbgate llm-obs-honesty --json
+npx thumbgate llm-obs-honesty --map-only
+npx thumbgate llm-obs-honesty --trace=tests/fixtures/llm-obs-honesty-blind.json --json
+npm run test:llm-obs-honesty
+```
+
+1. Require operational counts + latency + tokens + budget alert.
+2. Require prompt-injection check + `secret-redaction.js` scrub.
+3. Require failure-to-answer, topic relevancy, toxicity (+ thumbs).
+4. Require parented retrieve/llm/tool spans with evidenceIds.
+5. Refuse `--clone-datadog`.
+
+## Rubric
+
+- gold default → `ok=true`
+- empty `{}` or blind fixture → `ok=false`
+- `--clone-datadog` → `datadog_clone_refused`
+- doctor: `npm run test:llm-obs-honesty` PASS
+- evidence: command output in the same turn

package/.agents/skills/deeppattern-discipline-honesty-not-clone/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: deeppattern-discipline-honesty-not-clone
+description: >
+  DeepPattern Agent Quality Gates + Decision Engine are neighbors, not a
+  ThumbGate clone. Steal layer-check (same-layer substitutes only) and
+  evidence-closeout (six required items before "done") onto existing rails.
+  Never install AQG/DE/dp-install or unpark a cross-vendor audit SKU.
+  Slash: /deeppattern-discipline-honesty-not-clone.
+---
+
+# DeepPattern discipline honesty — compare, do not clone
+
+## Goal
+
+Fail-closed comparative analysis and completion claims for whom: ThumbGate
+FORMAT steals and Completion Claim Contract — so L4 API gateways / hosted
+multi-model panels cannot be treated as PreToolUse substitutes, and "done"
+cannot pass without six evidence items.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Install AQG, Decision Engine, `dp-install` | `npx thumbgate deeppattern-discipline-honesty --json` |
+| Treat OpenRouter / LiteLLM / token pools as ThumbGate competitors | Tag L1–L8; same job-to-be-done only |
+| Claim done without evidence heading + six items | `--closeout=path.md --strict` |
+| Unpark LLM adjudicator / cross-vendor panel SKU | Deterministic local gates; hosted panel stays external |
+
+HARD fail closed. REFUSE SKU clones.
+
+## Reference
+
+- https://github.com/deeppatternai/agent-quality-gates (evidence-closeout)
+- https://github.com/deeppatternai/decision-engine (`/layer-check`)
+- ThumbGate Completion Claim Contract in `AGENTS.md` / `CLAUDE.md`
+- `scripts/deeppattern-discipline-honesty.js`
+
+## Examples (show, don't tell)
+
+Weak: "LiteLLM commoditizes ThumbGate because both route models."
+
+Gold:
+
+```bash
+$ npx thumbgate deeppattern-discipline-honesty --json --map-only
+ok: true
+$ npx thumbgate deeppattern-discipline-honesty --json \
+    --claim='LiteLLM replaces ThumbGate PreToolUse'
+ok: false  # cross_layer_substitute
+```
+
+## Procedures
+
+```bash
+npx thumbgate deeppattern-discipline-honesty --json --map-only
+npx thumbgate deeppattern-discipline-honesty --json --claim='DE replaces ThumbGate'
+npx thumbgate deeppattern-discipline-honesty --json --closeout=pr-body.md --strict
+npm run test:deeppattern-discipline-honesty
+```
+
+1. Tag subject + every cited product L1–L8 before competitive claims.
+2. Drop cross-layer substitutes; keep dependency language when honest.
+3. Before saying done/fixed/shipped: Evidence/Closeout heading + six items.
+4. Do not vendor AQG/DE.
+
+## Rubric
+
+- `--map-only` → `ok=true`
+- substitute claim naming L4/L2/L5 vs ThumbGate → `cross_layer_substitute`
+- `--clone-deeppattern` / `dp-install` → fail
+- closeout missing heading or item / placeholder → fail
+- doctor tests PASS
+- evidence: `--json` in the same turn

package/.agents/skills/thumbgate-board-loop/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: thumbgate-board-loop
+description: >
+  Autonomous ThumbGate Issues+PR wall loop. Classifies every open Issue and PR,
+  update-branches BEHIND green Dependabot, submits READY via pr:manage/Trunk,
+  comments DIRTY and ECI/umbrella issues. Never approve. Never --admin.
+  Auto-invoke on holdup screenshots, 18 open PRs, 4 open issues, 4/4 green
+  Dependabot wall, "what's the holdup". Slash: /thumbgate-board-loop.
+---
+
+# ThumbGate board loop
+
+## Goal
+
+Drain the GitHub Issues + PR wall without a CEO screenshot. The list-view
+**4/4** badge is not mergeable — those Dependabot PRs are usually `SUCCESS` +
+`BEHIND` after a Trunk land.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Approve a PR / `--admin` / `gh pr merge --auto` | `npx thumbgate board-loop --apply --json` |
+| Treat 4/4 as READY | Classify `mss` + required checks (`test`, CodeQL, changeset, Socket, GitGuardian) |
+| Re-`pr:manage` a live `trunk-merge/pr-N` | Skip; that PR is already queued |
+| Close DIRTY <30d | Comment needs-rebase once (marker `<!-- thumbgate-board-loop -->`) |
+| Implement #3690/#3687 LLM adjudicator | ECI pause |
+| Dual-edit DIRTY #3650 graph layer | Leave it DIRTY |
+| GHA `schedule:` | Event-driven `workflow_run` + local LaunchAgent (CodeQL-only schedule policy) |
+
+## Reference
+
+- `scripts/thumbgate-board-loop.js`
+- `scripts/pr-manager.js`
+- `.github/workflows/agent-automerge.yml` (must resolve `workflow_run.head_sha` + `dependabot/*`)
+- `/thumbgate-pr-queue-autopilot` · `/thumbgate-issues-board-hygiene` · `/eci-thumbgate-ip-wall`
+
+## Examples (show, don't tell)
+
+Weak: Paste the 18-open screenshot and ask which PR to merge.
+
+Gold:
+
+```bash
+$ npx thumbgate board-loop --json
+counts.behind=8 counts.dirty=8 trunkQueued=[3874]
+$ npx thumbgate board-loop --apply --max-update-branch=1 --json
+# gh pr update-branch 3873
+```
+
+## Procedures
+
+```bash
+npx thumbgate board-loop --json
+npx thumbgate board-loop --apply --json
+npm run test:board-loop
+```
+
+1. Inventory open PRs + Issues.
+2. Skip trunk-merge drafts.
+3. One BEHIND green `update-branch` per tick (serial — each land re-BEHINDs siblings).
+4. One READY `pr-manager` / Trunk submit per tick.
+5. Comment Issues: ECI pause vs IMPLEMENT residual vs umbrella.
+6. Never approve.
+
+## Rubric
+
+- gold classify: SUCCESS+BEHIND → `update_branch`
+- trunk-merge draft → `skip`
+- `--apply` never emits `APPROVE` / `--admin` / `--auto`
+- doctor: `npm run test:board-loop` PASS
+- evidence: command output in the same turn

package/.agents/skills/thumbgate-daily-discoveries/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: thumbgate-daily-discoveries
+description: Autonomous daily publishing engine and monitoring skill for ThumbGate news and technical discoveries. Generates high-density engineering posts with full UTM attribution, synchronizes to Obsidian, schedules dual cron/launchd runs at 9:00 AM EST, and tracks publication ledgers.
+---
+
+# 📰 ThumbGate Daily Technical Discoveries & News Engine
+
+This skill automates the daily harvesting, synthesis, UTM attribution, and multi-channel publication of ThumbGate engineering discoveries and release news.
+
+---
+
+## 🎯 Architecture & Operating Principles
+
+1. **Daily Cadence (9:00 AM EST):** Runs once per calendar day. Avoids spam while establishing consistent technical authority.
+2. **Dual Scheduling Redundancy:**
+   - Primary: macOS crontab (`0 9 * * * /bin/bash scripts/thumbgate-daily-discoveries-publish.sh ...`)
+   - Fallback: macOS LaunchAgent (`~/Library/LaunchAgents/com.thumbgate.daily-publish.plist`)
+   - Note: GitHub Actions `schedule:` is strictly limited to `codeql.yml` per repo hygiene tests.
+3. **Full UTM Attribution & Tracked Redirects:**
+   - All outbound links to `thumbgate.ai` must use `buildUTMLink` from `scripts/social-analytics/utm.js`.
+   - Outbound pro/checkout links must route through `/go/pro` (`serveTrackedLinkRedirect` in `src/api/server.js`) to capture first-party funnel telemetry.
+4. **Multi-Surface Staging & Sync:**
+   - Staged locally at `docs/marketing/daily-discoveries/YYYY-MM-DD-<slug>.md`.
+   - Synchronized to the CEO's Obsidian Vault at `~/Documents/Igor/Research/Daily-Discoveries/`.
+   - Logged idempotently to `.thumbgate/daily-discoveries-ledger.jsonl`.
+   - Dispatches to Dev.to / Zernio if API keys are configured.
+
+---
+
+## 🛠️ CLI Commands & Usage
+
+```bash
+# Preview today's technical discovery without making mutations or network calls
+node scripts/thumbgate-daily-discoveries-publish.js --dry-run
+
+# Output structured JSON report
+node scripts/thumbgate-daily-discoveries-publish.js --json
+
+# Force publish/restage today's discovery even if already logged in ledger
+node scripts/thumbgate-daily-discoveries-publish.js --force
+
+# Shell wrapper (used by crontab / launchd)
+./scripts/thumbgate-daily-discoveries-publish.sh
+
+# Run test suite
+node --test tests/thumbgate-daily-discoveries-publish.test.js
+```
+
+---
+
+## 📋 Pre-Flight Verification Checklist
+
+- [ ] Verify `node --test tests/thumbgate-daily-discoveries-publish.test.js` passes.
+- [ ] Verify outbound links contain valid UTM parameters (`utm_source=daily_discoveries`, `utm_campaign=daily_technical_discoveries`).
+- [ ] Verify `launchctl list | grep thumbgate` reports exit code 0.
+- [ ] Verify `crontab -l | grep thumbgate` contains the 9:00 AM daily trigger.
+- [ ] Check `.thumbgate/daily-discoveries-ledger.jsonl` for recent execution receipts.

package/.agents/skills/token-shunt-honesty-not-clone/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: token-shunt-honesty-not-clone
+description: >
+  Steal Spotify Portal/shunt FORMAT: PreToolUse blocks untargeted Read above
+  350 lines, bare cat of large files, and full-file dumps. Do NOT install
+  shunt@portal, buy Portal, or claim 90% savings from GitHub App 162279530.
+  Slash: /token-shunt-honesty-not-clone.
+---
+
+# Token shunt FORMAT — intercept, don't clone Portal
+
+## Goal
+
+Produce fail-closed bulk-read intercepts for whom: ThumbGate agents — so
+untargeted Read/cat of large files never dump into the frontier context, and
+Spotify Portal stays a compare-not-clone neighbor, not a SKU or cash rail.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Install `shunt@portal` / `@spotify/portal-cli` | `npx thumbgate token-shunt-honesty --json` |
+| Buy Spotify Portal / Contact Sales as "make money" | Local slice (`offset`/`limit`, `cat \| grep`) |
+| Claim 90% token savings from App 162279530 | Measure `--lines` + `--returned-lines` |
+| Delegate architecture to Flash/Portal/AiKA | Frontier for reasoning; `local_slice` for boilerplate |
+| Spam buy links via All-repositories write | ECI: no ThumbGate paid outreach through Portal |
+
+## Reference
+
+- https://github.com/spotify/portal-ai-plugins (Apache-2.0 shunt plugin — we do not vendor it)
+- GitHub App install 162279530 = catalog connector, not revenue
+- Marketplace (free cite only): https://github.com/marketplace/actions/thumbgate-agent-governance
+
+```bash
+npx thumbgate token-shunt-honesty --json --lines=800
+npx thumbgate token-shunt-honesty --json --lines=800 --targeted
+npx thumbgate token-shunt-honesty --json --clone-portal
+```
+
+## Examples (show, don't tell)
+
+Weak: "Install Portal, we will save 90% and make money."
+
+Gold:
+
+```bash
+$ npx thumbgate token-shunt-honesty --json --lines=800
+{"ok":false,"findings":[{"id":"untargeted_bulk_read"}]}
+$ npx thumbgate token-shunt-honesty --json --lines=800 --targeted
+{"ok":true}
+```
+
+## Procedures
+
+1. Block untargeted Read above 350 lines.
+2. Block bare `cat`/`head`/`tail`/`less`/`more` of large files; allow pipes to grep/rg.
+3. Block returning the whole file to the frontier model.
+4. Refuse Portal/AiKA/Flash for architecture/debug.
+5. Treat GitHub App all-repos write as a warn, not a payout.
+
+## Rubric
+
+- `--lines=800` → `untargeted_bulk_read`
+- `--targeted` → `ok=true`
+- `--clone-portal` → `portal_clone_refused`
+- doctor: `npm run test:token-shunt-honesty` PASS
+- evidence: command output in the same turn