thumbgate 1.4.3 → 1.4.4

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate-marketplace",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "owner": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com"
@@ -13,7 +13,7 @@
         "source": "npm",
         "package": "thumbgate"
       },
-      "version": "1.4.3",
+      "version": "1.4.4",
       "author": {
         "name": "Igor Ganapolsky"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "Type 👍 or 👎 on any agent action. ThumbGate captures it, distills a lesson, and blocks the pattern from repeating. One thumbs-down = the agent physically cannot make that mistake again. 33 pre-action gates, budget enforcement, self-protection, and NIST/SOC2 compliance tags.",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "author": {
     "name": "Igor Ganapolsky"
   },

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://github.com/IgorGanapolsky/thumbgate",
   "transport": "stdio",

package/adapters/README.md

@@ -3,7 +3,7 @@
 - `chatgpt/openapi.yaml`: import into GPT Actions.
 - `gemini/function-declarations.json`: Gemini function-calling definitions.
 - `mcp/server-stdio.js`: underlying local MCP stdio server implementation.
-- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@1.4.3 thumbgate serve`.
+- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@1.4.4 thumbgate serve`.
 - `codex/config.toml`: example Codex MCP profile section using the same version-pinned portable launcher.
 - `amp/skills/thumbgate-feedback/SKILL.md`: Amp skill template.
 - `opencode/opencode.json`: portable OpenCode MCP profile using the same version-pinned portable launcher.

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.4.3", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.4.3", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/codex/config.toml

@@ -1,9 +1,9 @@
 # Codex MCP profile (copy into ~/.codex/config.toml or merge section)
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.4.3", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "serve"]
 
 # Hard PreToolUse hook for Codex
 [hooks.pre_tool_use]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.4.3", "thumbgate", "gate-check"]
+args = ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "gate-check"]

package/adapters/mcp/server-stdio.js

@@ -124,7 +124,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.4.3' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.4.4' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.4.3",
+        "thumbgate@1.4.4",
         "thumbgate",
         "serve"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "Self-improving agent governance: type thumbs-up or thumbs-down on any AI agent action. ThumbGate turns every mistake into a prevention rule and blocks the pattern from repeating. One thumbs-down, never again. 33 pre-action gates, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "repository": {
@@ -10,24 +10,172 @@
   "bugs": {
     "url": "https://github.com/IgorGanapolsky/ThumbGate/issues"
   },
-  "main": "scripts/feedback-loop.js",
+  "main": "src/index.js",
   "bin": {
     "thumbgate": "bin/cli.js"
   },
   "files": [
-    "bin/",
+    "bin/cli.js",
+    "bin/postinstall.js",
     "src/",
-    "scripts/",
-    "adapters/",
+    "adapters/mcp/server-stdio.js",
+    "adapters/chatgpt/openapi.yaml",
+    "adapters/gemini/function-declarations.json",
+    "adapters/claude/.mcp.json",
+    "adapters/codex/config.toml",
+    "adapters/opencode/opencode.json",
+    "adapters/amp/skills/thumbgate-feedback/SKILL.md",
+    "adapters/forge/forge.yaml",
     "config/",
-    "plugins/",
     "skills/",
     "openapi/",
-    "public/",
     ".well-known/",
-    ".claude-plugin/",
+    ".claude-plugin/plugin.json",
+    ".claude-plugin/marketplace.json",
+    ".claude-plugin/README.md",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "scripts/agent-readiness.js",
+    "scripts/access-anomaly-detector.js",
+    "scripts/agentic-data-pipeline.js",
+    "scripts/analytics-report.js",
+    "scripts/analytics-window.js",
+    "scripts/async-job-runner.js",
+    "scripts/audit-trail.js",
+    "scripts/auto-promote-gates.js",
+    "scripts/auto-wire-hooks.js",
+    "scripts/belief-update.js",
+    "scripts/billing-setup.js",
+    "scripts/billing.js",
+    "scripts/bot-detector.js",
+    "scripts/build-metadata.js",
+    "scripts/claude-feedback-sync.js",
+    "scripts/cli-demo.js",
+    "scripts/cli-feedback.js",
+    "scripts/cli-schema.js",
+    "scripts/cli-status.js",
+    "scripts/cli-telemetry.js",
+    "scripts/cloudflare-dynamic-sandbox.js",
+    "scripts/code-reasoning.js",
+    "scripts/codegraph-context.js",
+    "scripts/commercial-offer.js",
+    "scripts/context-manager.js",
+    "scripts/contextfs.js",
+    "scripts/conversation-context.js",
+    "scripts/creator-campaigns.js",
+    "scripts/cross-encoder-reranker.js",
+    "scripts/daemon-manager.js",
+    "scripts/dashboard-render-spec.js",
+    "scripts/dashboard.js",
+    "scripts/decision-journal.js",
+    "scripts/delegation-runtime.js",
+    "scripts/dispatch-brief.js",
+    "scripts/distribution-surfaces.js",
+    "scripts/docker-sandbox-planner.js",
+    "scripts/document-intake.js",
+    "scripts/evolution-state.js",
+    "scripts/experiment-tracker.js",
+    "scripts/explore-subcommands.js",
+    "scripts/explore.js",
+    "scripts/export-databricks-bundle.js",
+    "scripts/export-dpo-pairs.js",
+    "scripts/export-hf-dataset.js",
+    "scripts/failure-diagnostics.js",
+    "scripts/feedback-attribution.js",
+    "scripts/feedback-history-distiller.js",
+    "scripts/feedback-loop.js",
+    "scripts/feedback-paths.js",
+    "scripts/feedback-quality.js",
+    "scripts/feedback-schema.js",
+    "scripts/feedback-session.js",
+    "scripts/feedback-to-rules.js",
+    "scripts/filesystem-search.js",
+    "scripts/fs-utils.js",
+    "scripts/funnel-analytics.js",
+    "scripts/gate-stats.js",
+    "scripts/gate-templates.js",
+    "scripts/gates-engine.js",
+    "scripts/harness-selector.js",
+    "scripts/history-distiller.js",
+    "scripts/hook-runtime.js",
+    "scripts/hook-thumbgate-cache-updater.js",
+    "scripts/hosted-config.js",
+    "scripts/hosted-job-launcher.js",
+    "scripts/hybrid-feedback-context.js",
+    "scripts/install-mcp.js",
+    "scripts/intent-router.js",
+    "scripts/internal-agent-bootstrap.js",
+    "scripts/intervention-policy.js",
+    "scripts/jsonl-watcher.js",
+    "scripts/lesson-db.js",
+    "scripts/lesson-inference.js",
+    "scripts/lesson-reranker.js",
+    "scripts/lesson-retrieval.js",
+    "scripts/lesson-rotation.js",
+    "scripts/lesson-search.js",
+    "scripts/lesson-synthesis.js",
+    "scripts/license.js",
+    "scripts/llm-client.js",
+    "scripts/local-model-profile.js",
+    "scripts/managed-lesson-agent.js",
+    "scripts/mcp-config.js",
+    "scripts/mcp-policy.js",
+    "scripts/memory-firewall.js",
+    "scripts/meta-agent-loop.js",
+    "scripts/natural-language-harness.js",
+    "scripts/obsidian-export.js",
+    "scripts/operational-dashboard.js",
+    "scripts/operational-integrity.js",
+    "scripts/operational-summary.js",
+    "scripts/optimize-context.js",
+    "scripts/org-dashboard.js",
+    "scripts/partner-orchestration.js",
+    "scripts/perplexity-client.js",
+    "scripts/predictive-insights.js",
+    "scripts/pro-local-dashboard.js",
+    "scripts/problem-detail.js",
+    "scripts/product-feedback.js",
+    "scripts/profile-router.js",
+    "scripts/prompt-guard.js",
+    "scripts/published-cli.js",
+    "scripts/pulse.js",
+    "scripts/rate-limiter.js",
+    "scripts/reflector-agent.js",
+    "scripts/risk-scorer.js",
+    "scripts/rlaif-self-audit.js",
+    "scripts/rubric-engine.js",
+    "scripts/secret-scanner.js",
+    "scripts/security-scanner.js",
+    "scripts/self-distill-agent.js",
+    "scripts/self-heal.js",
+    "scripts/semantic-dedup.js",
+    "scripts/semantic-layer.js",
+    "scripts/seo-gsd.js",
+    "scripts/settings-hierarchy.js",
+    "scripts/skill-generator.js",
+    "scripts/slo-alert-engine.js",
+    "scripts/statusline-cache-path.js",
+    "scripts/statusline-lesson.js",
+    "scripts/statusline-links.js",
+    "scripts/statusline-local-stats.js",
+    "scripts/statusline-meta.js",
+    "scripts/statusline.sh",
+    "scripts/statusline-tower.js",
+    "scripts/telemetry-analytics.js",
+    "scripts/thompson-sampling.js",
+    "scripts/thumbgate-search.js",
+    "scripts/tool-registry.js",
+    "scripts/tool-kpi-tracker.js",
+    "scripts/user-profile.js",
+    "scripts/validate-workflow-contract.js",
+    "scripts/vector-store.js",
+    "scripts/verification-loop.js",
+    "scripts/webhook-delivery.js",
+    "scripts/workflow-runs.js",
+    "scripts/workflow-sentinel.js",
+    "scripts/workflow-sprint-intake.js",
+    "scripts/workspace-evolver.js",
+    "scripts/xmemory-lite.js"
   ],
   "scripts": {
     "postinstall": "node bin/postinstall.js || true",

package/scripts/statusline.sh

@@ -155,6 +155,7 @@ osc_link() {
     *localhost*|*127.0.0.1*|"") printf '%s' "$label" ;;
     *) printf '\033]8;;%s\007%s\033]8;;\007' "$url" "$label" ;;
   esac
+  return 0
 }
 
 UP_ICON="👍"

package/src/api/server.js

@@ -1063,38 +1063,131 @@ function loadProPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(PRO_PAGE_PATH, runtimeConfig, pageContext);
 }
 
-function loadDashboardPageHtml(req, expectedApiKey) {
-  const template = fs.readFileSync(DASHBOARD_PAGE_PATH, 'utf-8');
+function readOptionalPublicTemplate(filePath) {
+  try {
+    return fs.readFileSync(filePath, 'utf-8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function resolveLocalPageBootstrap(req, expectedApiKey) {
   const forwardedHost = req.headers['x-forwarded-host'];
   const hostHeader = Array.isArray(forwardedHost)
     ? forwardedHost[0]
     : forwardedHost || req.headers.host || '';
   const localProBootstrap = process.env.THUMBGATE_PRO_MODE === '1' && Boolean(expectedApiKey) && isLoopbackHost(hostHeader);
-  // Developer override: auth is disabled (expectedApiKey===null), auto-connect with dummy key
   const devOverride = expectedApiKey === null && isLoopbackHost(hostHeader);
   const bootstrapActive = localProBootstrap || devOverride;
   const serializedBootstrapKey = JSON.stringify(localProBootstrap ? expectedApiKey : devOverride ? 'dev-override' : '').replace(/</g, '\\u003c');
 
+  return {
+    bootstrapActive,
+    serializedBootstrapKey,
+  };
+}
+
+function renderPackagedDashboardHtml({ bootstrapActive, serializedBootstrapKey }) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ThumbGate Dashboard</title>
+<style>
+:root { color-scheme: light dark; --bg:#0f172a; --panel:#111827; --text:#f8fafc; --muted:#94a3b8; --line:#334155; --accent:#22c55e; }
+body { margin:0; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background:linear-gradient(135deg,#020617,#111827); color:var(--text); }
+main { max-width:920px; margin:0 auto; padding:48px 20px; }
+.panel { border:1px solid var(--line); border-radius:20px; background:rgba(15,23,42,.86); padding:28px; box-shadow:0 24px 80px rgba(0,0,0,.32); }
+.eyebrow { color:var(--accent); font-size:13px; font-weight:700; letter-spacing:.12em; text-transform:uppercase; }
+h1 { font-size:clamp(32px,5vw,54px); line-height:1; margin:14px 0; }
+p { color:var(--muted); font-size:18px; line-height:1.6; }
+.grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:14px; margin-top:26px; }
+a { color:var(--text); text-decoration:none; }
+.card { display:block; border:1px solid var(--line); border-radius:16px; padding:18px; background:rgba(30,41,59,.7); }
+.card strong { display:block; margin-bottom:8px; }
+.card span { color:var(--muted); font-size:14px; line-height:1.5; }
+</style>
+<script>
+window.THUMBGATE_DASHBOARD_BOOTSTRAP = { enabled: ${bootstrapActive ? 'true' : 'false'}, apiKey: ${serializedBootstrapKey} };
+</script>
+</head>
+<body>
+<main>
+<section class="panel">
+<div class="eyebrow">Packaged runtime</div>
+<h1>ThumbGate is running locally.</h1>
+<p>This lightweight npm dashboard is bundled without marketing assets, so installs stay small while core feedback, lessons, and API routes remain available.</p>
+<div class="grid">
+<a class="card" href="/v1/dashboard"><strong>Dashboard JSON</strong><span>Inspect feedback totals, lesson counts, and Reliability Gateway health.</span></a>
+<a class="card" href="/lessons"><strong>Lessons</strong><span>Review remembered thumbs-up/down lessons and enforcement context.</span></a>
+<a class="card" href="/health"><strong>Health</strong><span>Verify the installed package version and runtime status.</span></a>
+</div>
+</section>
+</main>
+</body>
+</html>`;
+}
+
+function renderPackagedLessonsHtml({ bootstrapActive, serializedBootstrapKey }) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ThumbGate Lessons</title>
+<style>
+:root { color-scheme: light dark; --bg:#0f172a; --panel:#111827; --text:#f8fafc; --muted:#94a3b8; --line:#334155; --accent:#38bdf8; }
+body { margin:0; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background:linear-gradient(135deg,#020617,#0f172a); color:var(--text); }
+main { max-width:920px; margin:0 auto; padding:48px 20px; }
+.panel { border:1px solid var(--line); border-radius:20px; background:rgba(15,23,42,.86); padding:28px; box-shadow:0 24px 80px rgba(0,0,0,.32); }
+.eyebrow { color:var(--accent); font-size:13px; font-weight:700; letter-spacing:.12em; text-transform:uppercase; }
+h1 { font-size:clamp(32px,5vw,54px); line-height:1; margin:14px 0; }
+p { color:var(--muted); font-size:18px; line-height:1.6; }
+.actions { display:flex; flex-wrap:wrap; gap:12px; margin-top:26px; }
+a { color:var(--text); text-decoration:none; border:1px solid var(--line); border-radius:999px; padding:12px 16px; background:rgba(30,41,59,.7); }
+</style>
+<script>
+window.THUMBGATE_LESSONS_BOOTSTRAP = { enabled: ${bootstrapActive ? 'true' : 'false'}, apiKey: ${serializedBootstrapKey} };
+</script>
+</head>
+<body>
+<main>
+<section class="panel">
+<div class="eyebrow">Packaged runtime</div>
+<h1>ThumbGate lessons are available.</h1>
+<p>The full hosted lessons UI is excluded from the npm tarball, but installed packages still expose the lesson APIs and detail pages needed for local agent feedback loops.</p>
+<div class="actions">
+<a href="/v1/lessons/search">Search lessons JSON</a>
+<a href="/v1/feedback/stats">Feedback stats JSON</a>
+<a href="/dashboard">Back to dashboard</a>
+</div>
+</section>
+</main>
+</body>
+</html>`;
+}
+
+function loadDashboardPageHtml(req, expectedApiKey) {
+  const bootstrap = resolveLocalPageBootstrap(req, expectedApiKey);
+  const template = readOptionalPublicTemplate(DASHBOARD_PAGE_PATH);
+  if (!template) return renderPackagedDashboardHtml(bootstrap);
+
   return fillTemplate(template, {
-    '__DASHBOARD_BOOTSTRAP_KEY__': serializedBootstrapKey,
-    '__DASHBOARD_BOOTSTRAP_ENABLED__': bootstrapActive ? 'true' : 'false',
+    '__DASHBOARD_BOOTSTRAP_KEY__': bootstrap.serializedBootstrapKey,
+    '__DASHBOARD_BOOTSTRAP_ENABLED__': bootstrap.bootstrapActive ? 'true' : 'false',
   });
 }
 
 function loadLessonsPageHtml(req, expectedApiKey) {
-  const template = fs.readFileSync(LESSONS_PAGE_PATH, 'utf-8');
-  const forwardedHost = req.headers['x-forwarded-host'];
-  const hostHeader = Array.isArray(forwardedHost)
-    ? forwardedHost[0]
-    : forwardedHost || req.headers.host || '';
-  const localProBootstrap = process.env.THUMBGATE_PRO_MODE === '1' && Boolean(expectedApiKey) && isLoopbackHost(hostHeader);
-  const devOverride = expectedApiKey === null && isLoopbackHost(hostHeader);
-  const bootstrapActive = localProBootstrap || devOverride;
-  const serializedBootstrapKey = JSON.stringify(localProBootstrap ? expectedApiKey : devOverride ? 'dev-override' : '').replace(/</g, '\\u003c');
+  const bootstrap = resolveLocalPageBootstrap(req, expectedApiKey);
+  const template = readOptionalPublicTemplate(LESSONS_PAGE_PATH);
+  if (!template) return renderPackagedLessonsHtml(bootstrap);
 
   return fillTemplate(template, {
-    '__LESSONS_BOOTSTRAP_KEY__': serializedBootstrapKey,
-    '__LESSONS_BOOTSTRAP_ENABLED__': bootstrapActive ? 'true' : 'false',
+    '__LESSONS_BOOTSTRAP_KEY__': bootstrap.serializedBootstrapKey,
+    '__LESSONS_BOOTSTRAP_ENABLED__': bootstrap.bootstrapActive ? 'true' : 'false',
   });
 }
 
@@ -5079,6 +5172,10 @@ module.exports = {
     getPosthogProxyPath,
     isAllowedPosthogProxyPath,
     renderSitemapXml,
+    renderPackagedDashboardHtml,
+    renderPackagedLessonsHtml,
+    readOptionalPublicTemplate,
+    resolveLocalPageBootstrap,
   },
 };
 

package/src/index.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('../scripts/feedback-loop');

package/.claude-plugin/bundle/icon.svg

@@ -1,18 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-labelledby="title desc">
-  <title>ThumbGate</title>
-  <desc>Gateway icon for the Claude Desktop workflow hardening extension.</desc>
-  <defs>
-    <linearGradient id="bg" x1="0%" x2="100%" y1="0%" y2="100%">
-      <stop offset="0%" stop-color="#111827"/>
-      <stop offset="100%" stop-color="#1f2937"/>
-    </linearGradient>
-    <linearGradient id="gate" x1="0%" x2="100%" y1="0%" y2="100%">
-      <stop offset="0%" stop-color="#f97316"/>
-      <stop offset="100%" stop-color="#fb7185"/>
-    </linearGradient>
-  </defs>
-  <rect width="512" height="512" rx="96" fill="url(#bg)"/>
-  <path fill="url(#gate)" d="M152 128h208c17.7 0 32 14.3 32 32v64h-64v-32H184v128h144v-32h64v64c0 17.7-14.3 32-32 32H152c-17.7 0-32-14.3-32-32V160c0-17.7 14.3-32 32-32Z"/>
-  <path fill="#fff4ed" d="M248 180h96v48h-48v56h48v48h-96z"/>
-  <circle cx="196" cy="256" r="26" fill="#fef3c7"/>
-</svg>

package/.claude-plugin/bundle/server/index.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-const path = require('path');
-const { spawn } = require('child_process');
-
-const cliPath = path.join(__dirname, '..', '..', 'bin', 'cli.js');
-const child = spawn(process.execPath, [cliPath, 'serve'], {
-  stdio: 'inherit',
-  env: process.env,
-});
-
-child.on('exit', (code, signal) => {
-  if (signal) {
-    process.kill(process.pid, signal);
-    return;
-  }
-  process.exit(code ?? 1);
-});
-
-child.on('error', (error) => {
-  console.error(`[thumbgate] Failed to launch Claude Desktop bundle runtime: ${error.message}`);
-  process.exit(1);
-});

package/adapters/chatgpt/INSTALL.md

@@ -1,158 +0,0 @@
-# ChatGPT GPT Actions: ThumbGate Install
-
-Open the published ThumbGate GPT directly:
-
-https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate
-
-Use the GPT as the public front door: paste an AI action to check, save a thumbs-up/down lesson, write a Pre-Action Gate, install ThumbGate for an agent, or export proof.
-
-Users do **not** have to keep chatting inside the ThumbGate GPT for enforcement. The GPT is the fast demo, guided setup path, and ChatGPT memory surface. Real enforcement for coding agents still runs locally through ThumbGate hooks after `npx thumbgate init`.
-
-Marketing rule: every landing page, README, social post, and plugin listing should point to the live GPT before asking a cold user to read OpenAPI docs.
-
-## GPT Store path
-
-1. Open the direct GPT URL: https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate
-2. If ChatGPT does not open it for your account, open **Explore GPTs**.
-3. Search for `ThumbGate`.
-4. Choose the GPT by **Igor Ganapolsky** in the **Programming** category.
-
-## 30-second user flow
-
-1. Paste a proposed AI action, command, merge, deploy, file edit, email, payment, or API call.
-2. ThumbGate evaluates whether to allow, block, or require a checkpoint before the action runs.
-3. After any answer or agent run, reply with `thumbs up:` or `thumbs down:` plus one concrete sentence.
-4. ThumbGate saves the lesson, refreshes prevention rules when patterns repeat, and can show what it remembers.
-5. When the user is ready to enforce outside ChatGPT, send them to `npx thumbgate init` for Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, or another MCP-compatible agent.
-
-Regular users should never need to know MCP, OpenAPI, Actions, DPO, Thompson Sampling, or schema validation. The GPT should explain the loop as: "One signal becomes one remembered rule."
-
-## GPT profile card
-
-Use this copy in GPT Builder instead of the generic "AI safety gate" framing:
-
-Short description:
-
-```text
-Turn thumbs-down into prevention gates
-```
-
-Full description:
-
-```text
-Paste a proposed AI action or reply thumbs up/down after an answer. ThumbGate captures the lesson, searches prior mistakes, writes Pre-Action Gates, and tells you when to allow, block, or checkpoint. Built for developers using AI agents and proof-backed Reliability Gateway workflows.
-```
-
-Conversation starters:
-
-1. `Check this agent action before it runs: git push --force --tags`
-2. `Turn this mistake into a ThumbGate rule: the agent edited generated files again.`
-3. `Install ThumbGate for Claude Code or Codex in this repo.`
-4. `Search my saved lessons before you answer.`
-
-Use typed chat replies. ChatGPT's native feedback buttons may send feedback to OpenAI, but they should not be described as the ThumbGate capture path unless OpenAI exposes them to GPT Actions.
-
-## Pre-action gate flow
-
-Use this when the user asks whether an AI agent should run a proposed action, command, file edit, deployment, merge, or publish step:
-
-1. The GPT calls `evaluateDecision` (`POST /v1/decisions/evaluate`) before answering.
-2. If the response has `decisionControl.executionMode: "blocked"`, the GPT says the action is blocked and explains the returned reason.
-3. If the response has `decisionControl.executionMode: "checkpoint_required"`, the GPT asks for explicit confirmation before proceeding.
-4. If the response has `decisionControl.executionMode: "auto_execute"`, the GPT can say the action is allowed and summarize why.
-
-Plain thumbs-up/down feedback is the memory loop. The decision endpoint is the gate loop. Do not claim hard blocking unless the decision endpoint, a saved lesson, or a prevention rule was actually applied.
-
-## Best first GPT message
-
-Use this as the first response:
-
-```text
-Paste an AI action to check, or tell me what went right/wrong. I can block risky actions, save the lesson, write a prevention gate, or show what ThumbGate already remembers.
-```
-
-## Prerequisites
-
-- A ChatGPT Plus or Team account (Custom GPTs require a paid plan)
-- ThumbGate API running at `https://thumbgate-production.up.railway.app`
-- Privacy policy URL: `https://thumbgate-production.up.railway.app/privacy`
-- Owner-managed `THUMBGATE_API_KEY` for one-time GPT Builder Actions auth
-
-Regular GPT users should not need an API key, JSON payload, OpenAPI knowledge, or developer setup. They should only see the thumbs-up/down memory loop.
-
-## Step 1 — Open GPT Builder
-
-1. Go to [https://chat.openai.com/gpts/editor](https://chat.openai.com/gpts/editor)
-2. Click **Create a GPT**
-3. Switch to the **Configure** tab
-
-## Step 2 — Add Actions
-
-1. Scroll to the **Actions** section
-2. Click **Create new action**
-3. Click **Import from URL** — paste your hosted spec URL:
-   ```
-   https://thumbgate-production.up.railway.app/openapi.yaml
-   ```
-   Or click **Upload file** and select:
-   ```
-   adapters/chatgpt/openapi.yaml
-   ```
-
-## Step 3 — Set Authentication
-
-In the Actions panel:
-
-1. Select **Authentication type: API Key**
-2. **Auth type**: Bearer
-3. **API Key**: paste your `THUMBGATE_API_KEY` value
-
-This is an owner setup field. Do not ask regular GPT users to provide an API key.
-
-## Step 4 — Update the Server URL
-
-In the imported spec, confirm the `servers.url` points to your deployed API:
-
-```yaml
-servers:
-  - url: https://thumbgate-production.up.railway.app
-```
-
-If you uploaded the file, edit the server URL in the GPT Actions editor.
-
-## Step 5 — Verify
-
-Click **Test** on the `captureFeedback` action:
-
-```json
-{
-  "signal": "up",
-  "context": "GPT Actions install verified with a successful test call",
-  "whatWorked": "The hosted action returned accepted=true and a promoted status"
-}
-```
-
-Expected response: `200 OK` with `{ "accepted": true, "status": "promoted" }`.
-
-If you only send a bare `thumbs up/down` style payload, expect `422` with `status: "clarification_required"` and a follow-up `prompt`.
-
-## Available Actions
-
-| Action | Method | Path | Description |
-|---|---|---|---|
-| `captureFeedback` | POST | `/v1/feedback/capture` | Capture up/down signal plus one-line why |
-| `getFeedbackStats` | GET | `/v1/feedback/stats` | Aggregated feedback statistics |
-| `getFeedbackSummary` | GET | `/v1/feedback/summary` | Recent feedback summary |
-| `generatePreventionRules` | POST | `/v1/feedback/rules` | Generate prevention rules |
-| `exportDpoPairs` | POST | `/v1/dpo/export` | Export DPO preference pairs |
-| `listIntentCatalog` | GET | `/v1/intents/catalog` | List available intents |
-| `planIntent` | POST | `/v1/intents/plan` | Generate policy-scoped plan |
-| `constructContextPack` | POST | `/v1/context/construct` | Build context pack |
-
-Full spec: `adapters/chatgpt/openapi.yaml`
-
-## Troubleshooting
-
-- **401 Unauthorized**: Verify `THUMBGATE_API_KEY` is set and matches the Bearer token
-- **Connection refused**: Confirm Railway deployment is live (`curl https://<domain>/health`)
-- **Schema errors**: Ensure you are using the latest `openapi.yaml` (version 1.1.0+)