rlhf feedback loop changelog

https://raw.githubusercontent.com/igorganapolsky/mcp-memory-gateway/HEAD/AGENTS.md

+ ## PR ownership+ The agent that opens a PR owns it until merged or closed the same day: open as draft, mark ready only after `npm test` passes locally, keep strictly one topic per PR, and split any PR over 1,000 changed lines (excluding `package-lock.json` and generated files) using `gh stack` ([GitHub Stacked PRs GA, 2026-10-06](https://github.blog/changelog/2026-10-06-stacked-pull-requests-generally-available/)).+ ## Inbox Correspondence & Send Dispositions (2026-11-12 — supersedes 2026-10-17 Hard No-Send Mandate)+ Per Igor (10:28 AM Nov 12, 2026: `"use this. steal their ideas. take care of this"`), ordinary business email correspondence defaults to sending (`REPLIED`) instead of staging every reply under the 2026-10-17 no-send rule:+ - **Six Exhaustive Dispositions (`scripts/thumbgate-inbox-sentinel.js`):** Every relevant thread ends a cycle as `REPLIED`, `DRAFTED_FOR_APPROVAL`, `NO_REPLY_NEEDED`, `WAITING_FOR_INFORMATION`, `BLOCKED`, or `OPTED_OUT` with zero silent skips, recorded in `.thumbgate/inbox-dispositions.jsonl`.+ - **Approval Exceptions Only (`DRAFTED_FOR_APPROVAL`):** Draft and ask Igor only for contracts/legal commitments, discounts/refunds/price changes, scope changes, sensitive personal/financial info, unverified claims/pricing, or deals above `THUMBGATE_EMAIL_APPROVAL_THRESHOLD_USD` (`$500` default). Unsolicited vendor cold pitches with no question resolve to `NO_REPLY_NEEDED`.+ - **Pre-Send & Confirmation Invariants:** Preserve ECI corporate address isolation (`@ecisolutions.com`, `@ecinexus.com`, `@eci.com` -> `BLOCKED`), `REPLIED_IN_SENT` ONE-TOUCH dedup (`NO_REPLY_NEEDED`), opt-outs/do-not-contact, bot-slop guard, and `config/brand-standards.json`. The sentinel decides and records; the lead agent's mail path executes sends, and a reply counts as sent (`sentConfirmed: true`) only after mail-provider confirmation.

https://raw.githubusercontent.com/igorganapolsky/mcp-memory-gateway/HEAD/AGENTS.md

− ## ExplainX trending (honest)− Parse live https://explainx.ai/trending scores; map onto existing rails; never invent ROI; never auto-install.− ```bash− npm run explainx:trending -- --fixture tests/fixtures/explainx-trending-rsc-snippet.html− npm run explainx:trending -- --fetch --top 10 --json− ```− Visual answers: `.agents/skills/show-me/SKILL.md` (`/show-me`). Details: `docs/agents/explainx-trending.md`.− ## Memory vs RAG (Supermemory steal)− RAG = graphify/docs (stateless). Memory = lesson store with complete four-field scope (stateful). Profile = always-on static+dynamic facts. Do not clone Supermemory SaaS.− ```bash− npm run memory:vs-rag -- --query "how does PreToolUse work?"− npm run memory:vs-rag -- --query "what did we decide?" --entity entity-id --project project-id --process process-id --session session-id --json− ```− Details: [`docs/agents/memory-vs-rag.md`](./docs/agents/memory-vs-rag.md).− ## Board loop (Issues + PRs)− GitHub list-view `4/4` is not mergeable. After each Trunk land, Dependabot goes `SUCCESS`+`BEHIND`. Classify then act — never approve.− ```bash− npx thumbgate board-loop --json− npx thumbgate board-loop --apply --json− ```− Skill: `.agents/skills/thumbgate-board-loop/SKILL.md` (`/thumbgate-board-loop`). Details: `docs/agents/thumbgate-board-loop.md`.− ## Cobble hot-store split (honest)− Separate durable lesson state, batched promotion, and query-time MultiGet. Map onto existing rails; never clone CobbleDB / RocksDB / YTsaurus. Do not quote Perplexity 5× / 20% as ours.− ```bash− npx thumbgate cobble-hot-store-split --json− npx thumbgate cobble-hot-store-split --trace=tests/fixtures/cobble-hot-store-split-coupled.json --json− ```− Skill: `.agents/skills/cobble-hot-store-compare-not-clone/SKILL.md` (`/cobble-hot-store-compare-not-clone`). Details: `docs/agents/cobble-hot-store-split.md`.− ## Token-shunt honesty (Portal FORMAT)− Untargeted Read above 350 lines is blocked. Bare `cat` of large files is blocked. Do not install `shunt@portal` or claim 90% savings from GitHub App 162279530.− ```bash− npx thumbgate token-shunt-honesty --json --lines=800− ```− Skill: `.agents/skills/token-shunt-honesty-not-clone/SKILL.md`. Details: `docs/agents/token-shunt-honesty.md`.− ## TypeSafe typed questions (FORMAT steal)− Typed noul/choice/score over one PreToolUse state; code owns pass|review|block. Do not install `typesafe-sdk`, call Jev, or unpark the LLM adjudicator (#3690/#3687).− ```bash− npx thumbgate typesafe-typed-questions --json --map-only− npx thumbgate typesafe-typed-questions --json --tool-name=Bash --command='git push --force origin main'− ```+ ## Spec-Driven Development (`/specs`) & Format Steals Index+ - **Unified Specifications (`/specs`):** All feature specifications follow the 6-block EARS standard in [`specs/README.md`](./specs/README.md) (`specs/NNN-feature/spec.md`), paired with Architecture Decision Records in [`docs/adr/`](./docs/adr/), OpenAPI contracts in [`openapi/`](./openapi/), and conformance suites in [`conformance/`](./conformance/).+ - **Board Loop (Issues + PRs):** Run `npx thumbgate board-loop --apply --json` to classify open PRs, update `BEHIND` green Dependabot branches, and submit terminal-green PRs to Trunk. Never approve a PR.+ - **On-Demand Format Steals & Honesty Doctors:** Detailed CLI references for all 25+ architectural format steals live in [`docs/agents/README.md`](./docs/agents/README.md) and `.agents/skills/*/SKILL.md` so `AGENTS.md` stays strictly within the `<= 3,000`-word adherence ceiling.

Showing the first 40 of each.

https://raw.githubusercontent.com/igorganapolsky/mcp-memory-gateway/HEAD/AGENTS.md

+ ## SaaS Moat & Seat-Compression honesty (Walling 2026 FORMAT steal)+ Audit ThumbGate against Rob Walling's 8 defensible SaaS moats (Agency, Operational Grit, System of Record, Reliance, Learning Loop, Network Effect, Trust & Ecosystem, Regulatory), enforce Ed25519 signed entitlements across all 5 learned models and 3 exporters (`scripts/entitlement.js` + `scripts/license.js`), and distill blocked tool calls into secret-redacted, path-normalized SHA-256 structural signatures so cross-customer intelligence compounds in the control plane even when raw DPO pairs are + ```bash+ npx thumbgate saas-moat-honesty --json+ npx thumbgate saas-moat-honesty --map-only --json+ ```+ Skill: `.agents/skills/saas-moat-honesty-not-clone/SKILL.md`. Details: `docs/agents/saas-moat-honesty.md`.+ ## Claude Code Routines governance honesty (FORMAT steal)+ Steal the 7 execution-safety rails from Claude Code Routines (`https://claude.com/resources/articles/introducing-routines-in-claude-code` & `https://code.claude.com/docs/en/routines`) onto `scripts/workspace-agent-routines.js`: (1) `<routine-fire-payload untrusted="true">` wrapping with tag-breakout escaping for API `/fire` payloads; (2) fired prompts and payloads never act as live human approval (`canActAsHumanApproval: false`); (3) $\ge 1\text{h}$ cron floor, `:07` off-hour jitter, `one_off` a+ ```bash+ npx thumbgate claude-routines-honesty --json+ npx thumbgate claude-routines-honesty --map-only --json+ ```+ Details: `docs/agents/claude-routines-honesty.md`.+ ## Herdr AI Civilization governance honesty (FORMAT steal)+ Steal the 5 multi-agent software-factory governance rails from Herdr (`https://www.youtube.com/watch?v=AL-PQuB2wy0`) onto `scripts/prove-herdr-adapter.js`: (1) decouple persistent Seat identity (`builder@workshop`, `culture.md`, tribal wisdom inheritance, P2P tmux routing) from ephemeral sessions; (2) structure work as a 3-altitude traversable graph (`Project -> Mission -> Slice` with `spec -> build -> test` and `proof` artifacts) driven by a step-feeding workflow harness; (3) inject upward-grap+ ```bash+ npx thumbgate herdr-civilization-honesty --json+ npx thumbgate herdr-civilization-honesty --map-only --json+ ```+ Details: `docs/agents/herdr-civilization-honesty.md`.+ ## Strands Decider 2B intervention honesty (FORMAT steal)+ Steal the 4 decision-model and intervention rails from AWS Strands Decider 2B (`https://strandsagents.com/blog/introducing-strands-decider/`) onto `adapters/strands/strands-decider-adapter.js`: (1) pointer-head option scoring (`scoreChoiceQuestion`) with calibrated confidence and `canGenerateFreeformText: false`; (2) parallel `Decider.noul` pre-tool questions (`args_grounded` + `premature`) catching guessed/invented tool arguments not present in the user's messages; (3) `InterventionHandler.befo+ ```bash+ npx thumbgate strands-decider-honesty --json+ npx thumbgate strands-decider-honesty --map-only --json+ ```+ Details: `docs/agents/strands-decider-honesty.md`.+ ## LaunchVideo.io deterministic film honesty (FORMAT steal)+ Steal the 4 programmatic video-generation rails from LaunchVideo.io (`https://launchvideo.io/` / `diggerhq/shipvideo`) onto `scripts/cli-demo.js`: (1) no video diffusion model — write the film as HTML/CSS/JS and replace `requestAnimationFrame`/timers/`Date`/CSS & Web Animations with a deterministic virtual clock (`buildVirtualClockTimeline`, `seekVirtualClockFrame`, `1920x1080` @ `30fps` piped into `libx264 -crf 18`); (2) 3-tool director surface (`extractBrandTokensFromHtml` for headings/top hex+ ```bash+ npx thumbgate launchvideo-honesty --json+ npx thumbgate launchvideo-honesty --map-only --json+ ```+ Details: `docs/agents/launchvideo-honesty.md`.+ ## Google Cloud TorchTPU governance & VeRL export honesty (FORMAT steal)+ Steal the 4 AI-infrastructure rails from Google Cloud's TorchTPU open-source release (`https://cloud.google.com/blog/topics/ai-infrastructure/torchtpu-is-now-open-source-run-native-pytorch-on-tpus`) onto `scripts/colab-compute-honesty.js`: (1) native PyTorch TPU execution (`google-pytorch/torch_tpu`, `device_map="tpu"`, `torch.compile` + Pallas kernels + SimpleFSDP up to 8,192 Ironwood TPU v7x at 52% MFU); (2) preserve SGLang RadixAttention/HiCache and `llm-d 1.0` prefix-cache-aware routing (4× + ```bash+ npx thumbgate torchtpu-honesty --json+ npx thumbgate torchtpu-honesty --map-only --json

https://raw.githubusercontent.com/igorganapolsky/mcp-memory-gateway/HEAD/AGENTS.md

+ 6. A handoff is a saved state-and-next file. A new session keeps the old one. Children get disjoint files and do not inherit the parent transcript. Observation is view-only. Do not install omp or open a link that can drive the host. Check with `npx thumbgate omp-coordination-honesty --json --map-only`.+ ## Harness evolution ceiling & weight training (arXiv:2610.11655 FORMAT steal)+ Diagnose-then-intervene rail on agent failure composition: label failed trajectories by the first signal that fires into process vs content failures. Harness evolution (rules, gates, tool contracts) repairs process failures; when content failures dominate (≥80%) and process failures drop (≤20%), harness evolution hits its ceiling. Switch the lever from prompt/rule bloat to weight training (LoRA/distillation) or named-model route escalation. Keep runtime security gates in the harness; train only + ```bash+ npx thumbgate harness-ceiling --json+ npx thumbgate harness-ceiling --map-only --json+ npx thumbgate harness-ceiling --evaluate --process=0 --content=8 --json+ ```+ Skill: `.agents/skills/harness-evolution-ceiling/SKILL.md`. Details: `docs/agents/harness-evolution-ceiling.md`.+ ## Decisive-step evaluation (NVIDIA arXiv:2610.10478 FORMAT steal)+ Replaying trajectories and rerunning tests after every code edit isolates the decisive step: the first edit whose cumulative patch flips the repository from failing to passing. Scoring candidate base models on this decisive action (via Decisive BPB and Patch MCQ contrastive discrimination) predicts post-trained coding skill at Spearman $\rho = 0.964$; all-step averaging dilutes signal with noise ($\rho = 0.915$) and mis-orders models.+ ```bash+ npx thumbgate decisive-step --json+ npx thumbgate decisive-step --map-only --json+ ```+ Skill: `.agents/skills/decisive-step-evaluator/SKILL.md`. Details: `docs/agents/decisive-step-evaluator.md`.+ ## Fiddler AI Control Plane honesty (FORMAT steal)+ Unified dual-layer control plane across Creation (coding agents: Claude Code, Cursor, Antigravity) and Production (enterprise runtime daemons, API workers). Steal the Evaluation Trust Tax TCO calculator (proves $0 token cost vs $0.002/trace SaaS tax) and Centor-Diode multi-stage discriminant pre-action firewall (<0.5ms on local CPU vs Fiddler's 80ms). Never vendor Fiddler AI SaaS, install proprietary Centor model weights, or call cloud evaluators.+ ```bash+ npx thumbgate fiddler-control-plane-honesty --map-only --json+ npx thumbgate fiddler-control-plane-honesty --eval-rate --traces 1000000 --json+ npx thumbgate fiddler-control-plane-honesty --tool-name Bash --command "git push --force origin main" --layer creation --json+ ```+ Skill: `.agents/skills/fiddler-control-plane-honesty/SKILL.md`. Details: `docs/agents/fiddler-control-plane-honesty.md`.+ ## omp coordination honesty (FORMAT steal)+ omp.sh sessions, subagents, and collab are a coordination format. A new session keeps the previous one. A handoff is saved state and the next step. Children write disjoint files and do not inherit the parent transcript. Observation is view-only. One named model. Do not install omp. Do not open a link that can prompt or interrupt the host.+ ```bash+ npx thumbgate omp-coordination-honesty --json --map-only+ ```+ Skill: `.agents/skills/omp-coordination-honesty-not-clone/SKILL.md`. Details: `docs/agents/omp-coordination-honesty.md`.

https://raw.githubusercontent.com/igorganapolsky/mcp-memory-gateway/HEAD/AGENTS.md

− - No active auto-generated prevention rules at this time.+ ## Pulse Verity consensus & disagreement gate (FORMAT steal)+ Cross-venue dispersion gating and signed execution prints (ECDSA P-256) onto existing PreToolUse / financial control plane rails. Never vendor live market feeds or clone thepulse.markets.+ Details: [`docs/agents/pulse-consensus-disagreement-gate.md`](./docs/agents/pulse-consensus-disagreement-gate.md).+ ## Meko Datapack & Collective Memory honesty (FORMAT steal)+ Five planes on existing rails: datapacks (4-field scope), episodic memory, rubric-promoted learnings, SHA-256 content-addressed artifacts, and decision traces. Never vendor YugabyteDB, meko-skills, or depend on cloud.mekodata.ai. A passive database is not a firewall.+ ```bash+ npx thumbgate meko-datapack-honesty --json+ npx thumbgate meko-datapack-honesty --map-only+ ```+ Skill: `.agents/skills/meko-datapack-honesty-not-clone/SKILL.md`. Details: `docs/agents/meko-datapack-honesty.md`.+ ## Salt Code policy honesty (FORMAT steal)+ 40-policy taxonomy across OWASP API & LLM Top 10, OpenAPI query-string secret diode, and MCP credential hygiene. Distinguishes passive prompt-time context injection from active `PreToolUse` infrastructure firewall. Never install Salt Code MCP or send traffic to `mcp.getsaltcode.com`.+ ```bash+ npx thumbgate salt-code-policy-honesty --map-only --json+ npx thumbgate salt-code-policy-honesty --strict --json+ ```+ Skill: `.agents/skills/salt-code-policy-honesty-not-clone/SKILL.md`. Details: `docs/agents/salt-code-policy-honesty.md`.+ ## OpenAI DevDay 2026 always-on agent governance (FORMAT steal)+ Always-on autonomous background agents ("Dots") across Slack, Teams, email, and browsers amplify L7 PreToolUse governance and infrastructure firewalls. Steal inbound taint-tracking admission, monotonic workspace session fencing, prompt caching static prefix ordering, and feedback-to-edge distillation. Never buy $500/mo Pro tiers or vendor closed Astra/Sol runtimes.+ ```bash+ node scripts/openai-devday-honesty.js --json+ node scripts/openai-devday-honesty.js --map-only+ node --test tests/openai-devday-honesty.test.js+ ```+ Details: [`docs/agents/openai-devday-2026-format-steal.md`](./docs/agents/openai-devday-2026-format-steal.md).+ ## RRSI agent harness regularization (FORMAT steal)+ Regularized Recursive Self-Improvement (Google Cloud AI Research arXiv:2609.24972) on agent harnesses (prompts, hyperparameters, retry policies, prevention rules). Steal cosine-annealed update sparsity, annealed step sizing, pre-screening benchmark leakage critic, complexity-aware L1 score regularization, and stagnation-driven structured exploration. Never install external Python ML packages or call unregularized evaluators.+ ```bash+ node scripts/rrsi-doctor.js --json+ node scripts/rrsi-doctor.js --map-only+ node --test tests/rrsi-regularizer.test.js+ ```+ Details: [`docs/agents/rrsi-harness-regularization.md`](./docs/agents/rrsi-harness-regularization.md).+ ## Mintlify State of Knowledge honesty (FORMAT steal)+ Treat knowledge as living operational infrastructure: pre-action freshness diodes (TTL ≤ 90d), downstream poison prevention (deprecated APIs, dangerous scripts, plaintext tokens), and non-docs surface federation. Never vendor Mintlify SaaS, build docsite generators, or claim external 15k stats.+ ```bash+ npx thumbgate mintlify-knowledge-honesty --map-only --json+ npx thumbgate mintlify-knowledge-honesty --check-dir docs --json+ ```+ Skill: `.agents/skills/mintlify-knowledge-honesty-not-clone/SKILL.md`. Details: `docs/agents/mintlify-knowledge-honesty.md`.