thumbgate 1.37.1 → 1.37.3

package/.agents/skills/typesafe-typed-questions-not-clone/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: typesafe-typed-questions-not-clone
+description: >
+  TypeSafe (console.typesafe.ai/hook, Jev System One) is a calibrated decision
+  model, not a ThumbGate clone. Steal typed noul/choice/score + code-owned
+  route() + confidence-as-second-axis onto existing PreToolUse rails. Never
+  install typesafe-sdk, call api.typesafe.ai, clone Jev, or unpark the LLM
+  adjudicator (#3690/#3687). Slash: /typesafe-typed-questions-not-clone.
+---
+
+# TypeSafe typed questions — compare, do not clone
+
+## Goal
+
+Produce fail-closed typed-question composition for whom: ThumbGate PreToolUse
+— so a tool-call state is scored with independent noul/choice/score questions
+and **code** routes pass|review|block. TypeSafe/Jev stays a neighbor FORMAT,
+not a SKU, not an LLM adjudicator.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Install `typesafe-sdk` / wire Jev as the PreToolUse gate | `npx thumbgate typesafe-typed-questions --json` |
+| `--use-typesafe-api` (gate) | `--live` shadow vs `POST /v1/systemone`; code still owns `route()` |
+| Clone Jev / System One as the gate | Deterministic matchers answer the battery |
+| Unpark LLM adjudicator (#3690/#3687) | Code owns `route()`; model does not emit the verdict |
+| One free-form "should we allow this?" judge | Atomic noul per hazard + score for severity |
+| Dual-edit untracked `llm-adjudicator` theater | Map onto existing `gate-check` rails |
+| N HTTP calls (one question each) | One POST with the whole battery (`parallel_questions`) |
+
+HARD fail closed. REFUSE SKU clones. ECI: no net-new governance product.
+Do NOT install `typesafe-sdk`. Do NOT let Jev emit `permissionDecision`. `--live` is a shadow scorer (grok-fleet key), not the gate.
+
+Complementary to trading `/typesafe-system-one-not-clone` (AGENT-651 claim gate). Do **not** dual-edit `IgorGanapolsky/trading` `scripts/typesafe_claim_gate.py`. This skill is ThumbGate PreToolUse only.
+
+## Reference
+
+- https://console.typesafe.ai/hook (signed-in intro / Replay intro)
+- https://docs.typesafe.ai/cookbooks/llm_guardrails.md
+- https://docs.typesafe.ai/cookbooks/parallel_questions
+- https://docs.typesafe.ai/patterns/confidence-routing.md
+- Playground "Support agent audit" (noul battery + choice + score over one state)
+- `scripts/typesafe-typed-questions.js`
+- `/high-roi-steal-and-finish` · `/eci-thumbgate-ip-wall`
+
+## Examples (show, don't tell)
+
+Weak: Summarize Jev and `npm install typesafe-sdk` as the new PreToolUse hook.
+
+Gold:
+
+```bash
+$ npx thumbgate typesafe-typed-questions --json --map-only
+codeOwnsRoute: true
+$ npx thumbgate typesafe-typed-questions --json --tool-name=Bash --command='git push --force origin main'
+{"route":"block","answers":{"destructive":{"noul":1,"source":"deterministic"}}}
+$ node --test tests/typesafe-typed-questions.test.js
+# --clone-jev / --use-typesafe-api / --llm-adjudicate → fail
+```
+
+## Procedures
+
+```bash
+npx thumbgate typesafe-typed-questions --json --map-only
+npx thumbgate typesafe-typed-questions --json --tool-name=Bash --command='git push --force origin main'
+npx thumbgate typesafe-typed-questions --json --clone-jev
+npm run test:typesafe-typed-questions
+```
+
+1. Put the PreToolUse payload in `state`.
+2. Ask independent typed questions (noul per hazard, choice for family, score for severity).
+3. Answer them with deterministic matchers — never Jev.
+4. `route()` in code: action threshold → block, review threshold → review, severity ≥ 2 promotes review to block.
+5. Refuse `--clone-jev`, `--use-typesafe-api` (gate), `--llm-adjudicate`, and model-emitted verdicts.
+6. Optional `--live` shadows the same battery against Jev in **one** POST. `--fan-out-questions` fails. Receipt is estimated N× input tokens, not the cookbook's 12.2×.
+
+## Rubric
+
+- empty / ordinary Read → `route=pass`, `ok=true`
+- `git push --force` → `route=block`, `destructive.noul=1`
+- `git add -A` → `route=review` (warn-level noul=0.55)
+- `--clone-jev` / `--use-typesafe-api` / `--llm-adjudicate` → `ok=false`
+- playground-shaped noul without a matcher → `unevaluated_question` (do not call Jev)
+- doctor: `npm run test:typesafe-typed-questions` PASS
+- evidence: command output in the same turn

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.37.1",
+  "version": "1.37.3",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.37.1",
+  "version": "1.37.3",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate.ai",
   "transport": "stdio",

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.1", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.1", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/forge/forge.yaml

@@ -9,12 +9,12 @@ version: "1"
 skills:
   thumbgate-gate-check:
     description: "ThumbGate PreToolUse gate — blocks known-bad tool calls"
-    command: "npx --yes --package thumbgate@1.37.1 thumbgate gate-check"
+    command: "npx --yes --package thumbgate@1.37.3 thumbgate gate-check"
     trigger: pre_tool_use
 
   thumbgate-feedback:
     description: "ThumbGate feedback capture — logs user prompt context"
-    command: "npx --yes --package thumbgate@1.37.1 thumbgate hook-auto-capture"
+    command: "npx --yes --package thumbgate@1.37.3 thumbgate hook-auto-capture"
     trigger: user_prompt
 
 mcp:
@@ -23,6 +23,6 @@ mcp:
     args:
       - "--yes"
       - "--package"
-      - "thumbgate@1.37.1"
+      - "thumbgate@1.37.3"
       - "thumbgate"
       - "serve"

package/adapters/future-agi/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.1", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
     }
   }
 }

package/adapters/future-agi/config.toml

@@ -1,3 +1,3 @@
 [mcp.servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.37.1", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]

package/adapters/future-agi/opencode.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.1", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
     }
   }
 }

package/adapters/herdr/herdr-plugin.toml

@@ -1,7 +1,7 @@
 [plugin]
 id = "thumbgate-approvals"
 name = "ThumbGate Approvals"
-version = "1.37.1"
+version = "1.37.3"
 minHerdrVersion = "0.7.0"
 description = "Pre-action governance, spend guard, and safety approval gates for multi-agent terminal sessions in Herdr."
 platforms = ["linux", "macos", "windows"]
@@ -12,7 +12,7 @@ category = "Security & Governance"
 
 [mcp_server]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.37.1", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
 
 [mcp_server.env]
 THUMBGATE_ENFORCE_ENTITLEMENTS = "1"

package/adapters/mcp/server-stdio.js

@@ -334,7 +334,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.37.1' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.37.3' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.37.1",
+        "thumbgate@1.37.3",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -2692,6 +2692,175 @@ function jitHarnessCompose() {
   if (report.status === 'fail') process.exitCode = 1;
 }
 
+function tokenShuntHonesty() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildTokenShuntHonestyReport,
+    formatTokenShuntHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'token-shunt-honesty'));
+  const report = buildTokenShuntHonestyReport(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatTokenShuntHonestyReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+async function typesafeTypedQuestionsDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildTypesafeTypedQuestionsReportAsync,
+    formatTypesafeTypedQuestionsReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'typesafe-typed-questions'));
+  const report = await buildTypesafeTypedQuestionsReportAsync(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatTypesafeTypedQuestionsReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function ciGhaBuildkitePatternsDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildCiGhaBuildkitePatternsReport,
+    formatCiGhaBuildkitePatternsReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'ci-gha-buildkite-patterns'));
+  const report = args['map-only']
+    ? buildCiGhaBuildkitePatternsReport({ ...args, mapOnly: true })
+    : buildCiGhaBuildkitePatternsReport({
+      json: Boolean(args.json),
+      strict: Boolean(args.strict),
+      mapOnly: Boolean(args['map-only']),
+      annotate: Boolean(args.annotate),
+      cloneBuildkite: Boolean(args['clone-buildkite']),
+      migrate: Boolean(args.migrate),
+      rerunQueued: Boolean(args['rerun-queued']),
+      quarantine: Boolean(args.quarantine),
+      jobsJson: args['jobs-json'] || '',
+      workflow: args.workflow || '',
+    });
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatCiGhaBuildkitePatternsReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function deeppatternDisciplineHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildDeeppatternDisciplineHonestyReport,
+    formatDeeppatternDisciplineHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'deeppattern-discipline-honesty'));
+  const report = buildDeeppatternDisciplineHonestyReport(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatDeeppatternDisciplineHonestyReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+
+function thumbgateBoardLoop() {
+  const args = parseArgs(process.argv.slice(3));
+  const { buildReport, formatReport } = require(path.join(PKG_ROOT, 'scripts', 'thumbgate-board-loop'));
+  const truthy = (value) => value === true || /^(1|true|yes|on)$/i.test(String(value || '').trim());
+  const report = buildReport({
+    json: truthy(args.json),
+    apply: truthy(args.apply),
+    maxUpdateBranch: Number(args['max-update-branch'] ?? 1),
+    maxPrManage: Number(args['max-pr-manage'] ?? 1),
+    maxComments: Number(args['max-comments'] ?? 4),
+    skipPr: args['skip-pr'] ? Number(args['skip-pr']) : null,
+  });
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatReport(report));
+  }
+}
+
+function colabComputeHonestyDoctor() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildColabComputeHonestyReport,
+    formatColabComputeHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'colab-compute-honesty'));
+  const report = buildColabComputeHonestyReport(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatColabComputeHonestyReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function llmObsHonesty() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildLlmObsHonestyReport,
+    formatLlmObsHonestyReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'llm-obs-honesty'));
+  const report = buildLlmObsHonestyReport(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatLlmObsHonestyReport(report));
+  }
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
+function cobbleHotStoreSplit() {
+  const args = parseArgs(process.argv.slice(3));
+  const {
+    buildCobbleHotStoreSplitReport,
+    formatCobbleHotStoreSplitReport,
+  } = require(path.join(PKG_ROOT, 'scripts', 'cobble-hot-store-split'));
+  const report = buildCobbleHotStoreSplitReport(args);
+
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(formatCobbleHotStoreSplitReport(report));
+  }
+
+  if (args.strict && report.status !== 'ready') {
+    process.exitCode = 1;
+    return;
+  }
+  if (report.status === 'fail') process.exitCode = 1;
+}
+
 function allowlistBridgeHonestyDoctor() {
   const args = parseArgs(process.argv.slice(3));
   const {
@@ -3015,6 +3184,25 @@ async function gateCheck() {
       return;
     }
 
+    const { evaluatePreToolUse } = require(path.join(PKG_ROOT, 'scripts', 'token-shunt-honesty'));
+    const shunt = evaluatePreToolUse({
+      toolName: input.tool_name || input.toolName,
+      toolInput: input.tool_input || input.toolInput || {},
+      cwd: input.cwd || process.cwd(),
+    });
+    if (shunt && shunt.ok === false) {
+      process.stdout.write(`${JSON.stringify({
+        decision: 'block',
+        reason: `token-shunt: ${shunt.reason}`,
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason: `token-shunt: ${shunt.reason}`,
+        },
+      })}\n`);
+      return;
+    }
+
     const output = await gatesEngine.runAsync(input);
     process.stdout.write(output + '\n');
   } catch (err) {
@@ -3562,6 +3750,14 @@ function help() {
   console.log('  openui-catalog-compose-honesty Catalog-compose-only + repair-before-claim (OpenUI FORMAT)');
   console.log('  allowlist-bridge-honesty Audit allowlisted registries/proxies as hops, not trust boundaries');
   console.log('  jit-harness-compose   Compose memory/planning/action/capability onto existing rails (JIT FORMAT)');
+  console.log('  cobble-hot-store-split Split durable/delivery/hot lesson planes (CobbleDB FORMAT)');
+  console.log('  token-shunt-honesty   Intercept untargeted bulk reads (Portal FORMAT; not shunt@portal)');
+  console.log('  typesafe-typed-questions Typed noul/choice/score + code-owned route (TypeSafe FORMAT; not Jev)');
+  console.log('  ci-gha-buildkite-patterns First-fail + PR fail-fast on GitHub Actions (Buildkite FORMAT; not Buildkite)');
+  console.log('  deeppattern-discipline-honesty Layer-check + evidence-closeout (DeepPattern FORMAT; not AQG/DE)');
+  console.log('  colab-compute-honesty   Compute-unit honesty from Colab /signup (not a GPU SKU)');
+  console.log('  llm-obs-honesty       Four LLM-obs practices on existing rails (Datadog FORMAT, not a clone)');
+  console.log('  board-loop            Classify+drain Issues/PR wall (BEHIND Dependabot, never approve)');
   console.log('  workspace-search-route     Route query to rg/fts/vector/hybrid/graph (zg FORMAT)');
   console.log('  intent-governed-execution  NL intent → classify/authorize/gate/HITL/evidence (CyberStrike FORMAT)');
   console.log('  background-governance Background-agent run report and dispatch risk check');
@@ -3605,6 +3801,14 @@ function help() {
   console.log('  npx thumbgate openui-catalog-compose-honesty --catalog=catalog.json --stream=compose.txt --repair --json');
   console.log('  npx thumbgate allowlist-bridge-honesty --json');
   console.log('  npx thumbgate jit-harness-compose --task="implement PreToolUse gate fix" --json');
+  console.log('  npx thumbgate cobble-hot-store-split --json');
+  console.log('  npx thumbgate token-shunt-honesty --json --lines=800');
+  console.log('  npx thumbgate typesafe-typed-questions --json --tool-name=Bash --command="git push --force origin main"');
+  console.log('  npx thumbgate ci-gha-buildkite-patterns --json --map-only');
+  console.log('  npx thumbgate deeppattern-discipline-honesty --json --map-only');
+  console.log('  npx thumbgate colab-compute-honesty --json --map-only');
+  console.log('  npx thumbgate llm-obs-honesty --json');
+  console.log('  npx thumbgate board-loop --json');
   console.log('  npx thumbgate workspace-search-route --query="how does X connect" --json');
   console.log('  npx thumbgate intent-governed-execution --intent="railway deploy" --json');
   console.log('  npx thumbgate upstream-contributions --max-repos=10 --write');
@@ -3646,6 +3850,11 @@ const SUBCOMMAND_HELP = {
   lessons:       'Usage: npx thumbgate lessons [--query="..."] [--limit=N]\n\nSearch the lesson database (Pro feature).',
   search:        'Usage: npx thumbgate search <query>\n\nSearch ThumbGate knowledge base (Pro feature).',
   'gate-check':  'Usage: npx thumbgate gate-check\n\nPreToolUse hook interface: reads tool call JSON from stdin, outputs gate verdict.',
+  'typesafe-typed-questions': 'Usage: npx thumbgate typesafe-typed-questions [--payload=path] [--tool-name=Bash] [--command="..."] [--json] [--map-only] [--clone-jev]\n\nTypeSafe FORMAT steal: typed noul/choice/score over a PreToolUse payload, code-owned pass/review/block. Does not install typesafe-sdk or call Jev.',
+  'ci-gha-buildkite-patterns': 'Usage: npx thumbgate ci-gha-buildkite-patterns [--jobs-json=path] [--workflow=path] [--json] [--map-only]\n\nBuildkite pipeline FORMAT on GitHub Actions: first-fail step, PR fail-fast, needs:/skip/annotations. Does not add Buildkite.',
+  'deeppattern-discipline-honesty': 'Usage: npx thumbgate deeppattern-discipline-honesty [--claim="..."] [--closeout=path.md] [--json] [--map-only]\n\nDeepPattern FORMAT steal: layer-check + evidence-closeout. Does not install AQG/Decision Engine.',
+  'board-loop': 'Usage: npx thumbgate board-loop [--apply] [--json] [--max-update-branch=1] [--max-pr-manage=1] [--max-comments=4] [--skip-pr=N]\n\nClassify Issues+PR wall: update-branch BEHIND green Dependabot, pr:manage READY, comment DIRTY/ECI. Never approve.',
+  'colab-compute-honesty': 'Usage: npx thumbgate colab-compute-honesty [--claim="..."] [--plan-proof=proplus] [--json] [--map-only]\n\nColab /signup FORMAT steal: Compute Units ≠ dedicated GPU; Subscribe ≠ receipt. Does not buy Pro/Pro+.',
   'claim-stop-check': 'Usage: npx thumbgate claim-stop-check\n\nClaude Stop-hook interface: reads the hook payload from stdin and blocks factual claims that disagree with configured sources.',
   'verify-claims': 'Usage: npx thumbgate verify-claims --claim="the row count is 1,284" [--config=.thumbgate/claim-verifiers.json] [--cwd=path] [--json]\n\nRecheck supported factual claims against operator-configured SQLite, filesystem, and JSON sources. Exits non-zero on mismatch, missing verifier, or verifier error.',
   'hermes-gate': 'Usage: npx thumbgate hermes-gate\n\nNous Research Hermes Agent pre_tool_call shell hook: reads Hermes tool-call JSON from stdin, runs the ThumbGate gate pipeline (strict by default), and outputs {"decision":"block","reason":...} to veto or {} to allow. Gates terminal/patch/skill_manage etc. See adapters/hermes/config.yaml.',
@@ -4265,6 +4474,54 @@ switch (COMMAND) {
   case 'harness-compose':
     jitHarnessCompose();
     break;
+  case 'cobble-hot-store-split':
+  case 'cobble-hot-store':
+  case 'cobbledb-split':
+  case 'hot-store-split':
+    cobbleHotStoreSplit();
+    break;
+  case 'token-shunt-honesty':
+  case 'token-shunt':
+  case 'shunt-honesty':
+    tokenShuntHonesty();
+    break;
+  case 'typesafe-typed-questions':
+  case 'typesafe-hook':
+  case 'typed-questions':
+  case 'jev-typed-questions':
+    typesafeTypedQuestionsDoctor().catch((err) => {
+      console.error(err && err.stack ? err.stack : err);
+      process.exitCode = 1;
+    });
+    break;
+  case 'board-loop':
+  case 'thumbgate-board-loop':
+  case 'pr-issue-loop':
+    thumbgateBoardLoop();
+    break;
+  case 'colab-compute-honesty':
+  case 'colab-honesty':
+  case 'compute-unit-honesty':
+    colabComputeHonestyDoctor();
+    break;
+  case 'llm-obs-honesty':
+  case 'datadog-llm-obs':
+  case 'llm-observability-honesty':
+    llmObsHonesty();
+    break;
+  case 'ci-gha-buildkite-patterns':
+  case 'ci-buildkite-patterns':
+  case 'gha-buildkite-honesty':
+  case 'first-fail-gha':
+    ciGhaBuildkitePatternsDoctor();
+    break;
+  case 'deeppattern-discipline-honesty':
+  case 'deeppattern-honesty':
+  case 'layer-check-honesty':
+  case 'evidence-closeout-honesty':
+  case 'aqg-de-honesty':
+    deeppatternDisciplineHonestyDoctor();
+    break;
   case 'workspace-search-route':
   case 'zg-search-route':
   case 'zvec-grep-route':

package/config/gate-templates.json

@@ -61,6 +61,102 @@
       "roi": "Mirrors OpenUI Gateway's repair-before-users-see-it FORMAT on ThumbGate rails: invalid compose never becomes a completion claim.",
       "rollout": "Require openui-catalog-compose-honesty --repair --claim-ready evidence before any compose/UI done claim. Does not install OpenUI Gateway."
     },
+    {
+      "id": "require-typed-pretool-questions",
+      "name": "Require typed noul/choice/score PreToolUse questions",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(?=[\\s\\S]*(should we allow this tool call|free-?form judge|llm[- ]adjudicat|typesafe-sdk|api\\.typesafe\\.ai|clone\\s+jev|jev-latest))(?=[\\s\\S]*(pretooluse|gate-check))|question type (prompt|text|chat)",
+      "problem": "Blocks free-form LLM judges and TypeSafe/Jev SKU clones as the PreToolUse gate. TypeSafe FORMAT: atomic noul/choice/score questions over one tool-call state, answered deterministically.",
+      "roi": "Keeps PreToolUse as typed, inspectable questions instead of a prompt-and-parse adjudicator. Does not install typesafe-sdk.",
+      "rollout": "Pair with typesafe-typed-questions --json. Enable wherever an agent wants to add a second-model judge in front of gate-check."
+    },
+    {
+      "id": "require-code-owned-route",
+      "name": "Require code-owned pass/review/block route",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(?=[\\s\\S]*(model-emitted verdict|wire jev as the gate|use-typesafe-api|llm[- ]adjudicat|clone jev))(?=[\\s\\S]*(route|verdict|pretooluse))|permissionDecision[\\s\\S]*(allow|deny)[\\s\\S]*from[\\s\\S]*(jev|llm)",
+      "problem": "Blocks letting Jev, an LLM adjudicator, or any model emit the PreToolUse verdict. TypeSafe FORMAT: code owns route(); confidence is a second axis.",
+      "roi": "Same probabilities, different policies. Thresholds live in code, not in a prompt. LLM adjudicator #3690/#3687 stays parked.",
+      "rollout": "Require typesafe-typed-questions --claim-ready evidence before claiming a typed-question hook is ready. Does not call api.typesafe.ai."
+    },
+    {
+      "id": "require-compute-unit-proof",
+      "name": "Require Compute Unit / plan receipt before Colab GPU claims",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(?=[\\s\\S]*(colab pro\\+|proplus|a100|v100|background execution|24 hours?|compute units?))(?=[\\s\\S]*(eval|offload|gpu|notebook|colab))",
+      "problem": "Blocks treating a Colab Subscribe button or CU pack as a dedicated GPU. Live /signup: paid SKUs sell Compute Units; Subscribe visible is not a receipt.",
+      "roi": "Stops A100/Pro+ offload theater. ThumbGate evals stay on GitHub Actions.",
+      "rollout": "Pair with colab-compute-honesty --json. Require --plan-proof from a Current-plan receipt."
+    },
+    {
+      "id": "refuse-colab-sku-clone",
+      "name": "Refuse Colab-runner SKU clones and surprise Pro spend",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "colab-cli|google-colab-pro-runner|ngrok.{0,40}colab|colab.{0,40}ssh|zero-cost a100|buy.{0,20}colab pro",
+      "problem": "Blocks cloning Colab as a ThumbGate GPU harness or buying Pro/Pro+/CU from an agent session.",
+      "roi": "No surprise $9.99/$49.99 spend. No fake colab-cli.",
+      "rollout": "Enable wherever an agent proposes Colab offload. Does not purchase a plan."
+    },
+    {
+      "id": "require-same-layer-comparison",
+      "name": "Require same-layer product comparisons (DeepPattern layer-check)",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(?=[\\s\\S]*(openrouter|litellm|token aggregat|api gateway|raw (model )?api|foundation model))(?=[\\s\\S]*(replace[sd]?|substitut|commoditiz|competes? with|instead of)[\\s\\S]*(thumbgate|pretooluse))",
+      "problem": "Blocks treating L4 transport / L2 models as substitutes for L7 ThumbGate PreToolUse governance (DeepPattern layer-check FORMAT).",
+      "roi": "Stops category-error competitive analysis. Gateways are inputs; hosted multi-model panels are complements.",
+      "rollout": "Pair with deeppattern-discipline-honesty --json. Tag L1–L8 before competitor claims."
+    },
+    {
+      "id": "require-evidence-closeout-items",
+      "name": "Require evidence-closeout items before done claims",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "(?=[\\s\\S]*(done|shipped|fixed|complete|merged))(?![\\s\\S]*(scope completed|verification run|production boundary))",
+      "problem": "Blocks summary-without-evidence closeouts. AQG evidence-closeout FORMAT: six required items under an Evidence heading.",
+      "roi": "Aligns with Completion Claim Contract. Fresh verification before the word done.",
+      "rollout": "Pair with deeppattern-discipline-honesty --closeout=path.md --strict."
+    },
+    {
+      "id": "refuse-buildkite-vendor-migration",
+      "name": "Refuse Buildkite vendor migration on public GitHub Actions",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "migrate.{0,40}buildkite|replace github actions with buildkite|add buildkite as.{0,20}required|buildkite-agent|test engine auto-?quarantine",
+      "problem": "Blocks adding Buildkite Pipelines/agents/Test Engine as a second CI vendor. Steal first-fail + fail-fast onto existing GHA.",
+      "roi": "Public repo GHA minutes stay $0. No second required check. Diagnosis stays the first failed step.",
+      "rollout": "Pair with ci-gha-buildkite-patterns --json. Keep ubuntu-latest required contexts."
+    },
+    {
+      "id": "refuse-deeppattern-sku-clone",
+      "name": "Refuse DeepPattern AQG/Decision-Engine SKU clones",
+      "category": "Agent Honesty",
+      "signal": "👎",
+      "defaultAction": "block",
+      "severity": "high",
+      "pattern": "dp-install|install_aqg|agent-quality-gates|decision-engine.{0,40}(clone|install|sku)|clone.{0,20}(aqg|decision.engine|deeppattern)",
+      "problem": "Blocks cloning Agent Quality Gates or Decision Engine as a ThumbGate product surface.",
+      "roi": "FORMAT steal only (layer-check + evidence-closeout). No hosted cross-vendor audit SKU.",
+      "rollout": "Enable on competitive-steal and install prompts. Does not vendor DeepPattern."
+    },
     {
       "id": "require-broker-signed-execution-receipt",
       "name": "Require broker-signed execution receipts",