A receipt is not world-state
Cursor’s blog is the publishing surface we wanted: first-party HTML, a research tag, a named author, a read time, a table of contents, and related posts at the bottom. No clapbait. No third-party writing platform as the canonical URL. We are not affiliated with Cursor. We stole that format for thumbgate.ai/blog.
The substance is the product at that same domain. thumbgate.ai is an Infrastructure Firewall for AI coding agents: evaluate the proposed tool call, block the unsafe ones, leave evidence. Agents keep treating the evidence artifact as the world. That is the failure this post names.
# The three-word product
ThumbGate is not a training stack and it is not a hosted digital worker. It sits on the PreToolUse boundary every capable harness already exposes — Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode — after the model has chosen a tool and before the tool runs.
Three verbs, in order:
- Evaluate the fully resolved action (command, path, URL, MCP call) against a deterministic rule set.
- Block (or warn, or allow) before the side effect. Secret-exfiltration is a hard floor. Destructive git and filesystem classes escalate under STRICT.
- Leave evidence — a receipt with verdict, gate identity, and the action that was judged.
Local start is npx thumbgate init. The npm package is thumbgate. Public code is MIT on purpose. Hosted operation, adapter coverage, and the dashboard are the paid surfaces; they are not a second intelligence repo pretending the public shell is empty. See VERIFICATION_EVIDENCE.md.
# What a receipt is
A receipt is the durable record of one decision at the tool-call boundary. It is useful because it is small, local, and inspectable:
- verdict: allow, warn, or deny
- which gate fired, and whether the source was committed policy or a promoted lesson
- the tool name plus resolved arguments — the action, not the agent’s narration of the action
- a timestamp you can put next to a session, a worktree, and a git SHA
MCP attempts, including denied and failed calls, must emit tool KPI telemetry. Task completion claims require an idempotent task-outcome receipt and verification evidence. Those are two different objects. Mixing them is how “we gated it” becomes “it shipped.”
allow | warn | deny gateId, source, toolName resolvedArgs (command | path | url) ts, sessionId, worktree
# What a receipt is not
Adjacent agent OS and marketplace products learned this the expensive way: a signed receipt is not proof the world moved. We apply the same honesty to our own control plane.
| Artifact | Proves | Does not prove |
|---|---|---|
| Gate receipt | This tool call was evaluated and this verdict returned | The command ran, the file landed, production rebuilt |
| MCP listing | A catalog row exists for a name | The active profile can invoke it |
| public-proof.json | The fields the contract actually emits | A count you inferred because the filename sounded quantitative |
| “CI green” | Required checks on some SHA | Required checks on the SHA you are claiming |
| Agent “done” | The model emitted a completion sentence | Tests, merge, or /health |
This is not pedantry. On 2026-07-30 a completion claim without the matching evidence class was a thumbs-down. The contract stayed: never say done, shipped, live, or fixed without the artifact that is authoritative for that claim.
# The completion claim contract
When the claim is about ThumbGate itself, the evidence class is closed:
| Claim | Required evidence before the word |
|---|---|
Code on main |
Merge commit SHA is tip (or ancestor) of origin/main |
| Production live | GET /health buildSha equals that SHA (and version when versioned) |
| CI green | Terminal required checks on that exact SHA, not an older branch run |
Partial stays partial. A mid-flight Railway rebuild is not “deployed.” A dashboard screenshot is not /health. An empty grep is not “no matches” unless you named the surface you searched.
# Listing is not invocable
MCP discovery must equal the tools callable by the active profile and the packaged runtime. Side-effect annotations must be truthful. Declared structured outputs must validate. A compare page that ranks a vendor is not an adapter. An adapter file that is not in SUPPORTED_AGENTS is not support.
The same rule applies to this blog. A hub card is not a live URL until public/blog/<slug>.html exists, the server maps /blog/* from that directory, and /sitemap.xml auto-includes the file. Tests in tests/blog-hub.test.js pin the contract so a future agent cannot add JSON-LD for a post that is not on disk.
# Why first-party HTML
Cursor’s research posts are crawlable, canonical, and owned. That is the GEO surface that actually compounds: JSON-LD BlogPosting plus FAQPage, a stable slug, related posts that keep the reader on thumbgate.ai, linguistic struts an LLM parser can quote (Infrastructure Firewall, Reliability Gateway, Thompson Sampling, DPO, PreToolUse).
What we did not steal:
- Cursor Origin / Continuity Git hosting. Client-side pack hygiene is a different lane.
- A writing-platform canonical URL. This page is the canonical URL.
- Invented traction. A research post is not a paid-pilot announcement.
If you want the gate on a repo you actually run agents against:
Read the setup guide → npx thumbgate init
Source: github.com/IgorGanapolsky/ThumbGate. Evidence index: VERIFICATION_EVIDENCE.md.
# FAQ
What does thumbgate.ai actually do?
It evaluates a proposed AI coding-agent tool call before the harness runs it, can block unsafe actions, and writes a receipt for the decision. It does not retrain a model.
Does a ThumbGate receipt prove production is live?
No. A receipt proves the gate ran on that tool call. Production live requires GET /health buildSha equal to the claimed main SHA.
Is a listed MCP tool the same as an invocable tool?
No. Discovery must equal the tools the active profile and packaged runtime can actually call.