Phase 1 — Wire only
Hooks exist. No expectation that a gate fires yet.
npx thumbgate init npx thumbgate doctor
Verify: doctor exits 0. Empty is success.
Install · Progressive wiring
Same onboarding pattern as a local NVR: get an empty dashboard first. Do not enable matching until doctor is green. Numbered configs live in config/progressive/.
Hidden metric: if nothing fires, check whether the PreToolUse hook is installed — not how many rules you have. Rule count is the bandwidth number. Hook install is the retry-rate number.
| Phase | Matching | Verify |
|---|---|---|
| 1 Wire only | off | npx thumbgate doctor |
| 2 Dashboard | off | page loads, empty OK |
| 3 One lesson | off | npx thumbgate stats |
| 4 Warn fires | warn | hook log / gate-stats |
| 5 Strict | optional deny | only after 1–4 |
Hooks exist. No expectation that a gate fires yet.
npx thumbgate init npx thumbgate doctor
Verify: doctor exits 0. Empty is success.
npx thumbgate dashboard --open
Verify: HTML loads. Zero interdictions is not a failed install.
npx thumbgate capture --feedback=down \ --context="Never run DROP on production tables" \ --what-went-wrong="agent proposed DROP" \ --what-to-change="require review for DROP"
Default is flag + log. Secret-exfil floors already deny. Do not jump to strict because “nothing blocked.”
npx thumbgate gate-stats
export THUMBGATE_STRICT_ENFORCEMENT=1
Only after phases 1–4. Learned matches can hard-deny.