# From `git init` to v1.17.0 in 70 days: an honest ThumbGate build log

Igor Ganapolsky · May 12, 2026 · 8 min read

On March 3, the first commit on this repo was three words: `chore: initialize repository`. Today the live build at thumbgate.ai/health reports `"version":"1.17.0"`. In between, 70 days, 112 commits on the visible branch, 60+ tagged releases, ~6,000 npm downloads, and one expensive lesson: shipping is not the same as selling.

This is the unedited build log — the architecture choices that held, the ones that didn't, and the part where revenue is still zero.

70
days, init → production
112+
commits, this branch
17
minor releases (v1.0 → v1.17)
~6k
npm downloads, last 30d
15
live products in Stripe
$0
cold-traffic revenue

## The hypothesis

AI coding agents (Claude Code, Cursor, Codex, Aider, Cline) burn money making the same mistake twice. Force-pushing to `main`. Editing `.env` without checking what's already in it. Claiming "deployed" without curling the health endpoint. Calling shell with un-escaped user input.

If you've watched an agent retry the same broken patch four times in a row, you know exactly what I mean.

The hypothesis: capture the moment of failure, distill it into a rule, and gate the next attempt before the tool call fires. Not a linter (those run too late). Not a post-action review (the damage is done). A pre-action gate with an opinion.

## The timeline

2026-03-03
Repo init. First commit: `bootstrap OSS RLHF feedback system`.

The original framing was "RLHF for coding agents." It was wrong — what I was actually building was context engineering plus enforcement. The pivot took weeks.

2026-03-06
First release: v0.6.8. The version starts at 0.6 because there's a private prototype that predates the public repo.
2026-03-09 → 2026-04-02
~40 patch releases. The architecture stabilizes.

SQLite + FTS5 for the lesson database (because it ships in the npm package and survives no-network installs). LanceDB for vectors. Thompson Sampling for which gates to fire when. ContextFS for context assembly. The agent harness pattern as the mental model.

2026-04-08
v1.0.0 cut. The OSS package ships on npm as `thumbgate`.

The same day, v1.1.0 lands the HuggingFace export. The cadence is "release on green CI, don't wait."

2026-04-20
npm downloads peak at 1,334 in a single day.

That spike was a Reddit post, not paid traffic. Organic interest exists. Conversion to paid does not, yet.

2026-04-21
X/Twitter retired from active distribution.

Active outbound moved to Reddit, LinkedIn, Threads, Bluesky, Instagram, YouTube. All routed through one social-publishing layer (Zernio) so I'm not maintaining six token rotations.

2026-05-11
v1.17.0 ships. Free tier opens up: unlimited feedback captures, 5 active prevention rules (was 3 lifetime + 1 rule).

The hard wall on the free tier was killing habit formation. Daily-use lane is now open; Pro gates the dashboard, recall, lesson search, and DPO export.

2026-05-12 (today)
Stripe surface fully reconciled. 15 active products, 14 customer-facing payment links, zero duplicates, every product carries the correct tier logo. Dashboard live.

## What's running in production

- npm package `thumbgate` — the public shell. CLI, hook installer, adapter configs, JSON schemas. Node ≥18.18, MIT.
- Railway-hosted API at `thumbgate.ai` — health, dashboard, checkout intent, billing summary. Docker rebuild on every push to `main` (2–5 min). Verified post-deploy by curling `/health` and grepping the version string.
- Stripe — 15 active products (Pro $19/mo + $149/yr; Team $49/seat/mo; plus 13 funnel/diagnostic SKUs from $1 to $1,500). All carry the canonical ThumbGate logo. Checkout sessions verified to mint live `cs_live_` IDs.
- SQLite + FTS5 lesson DB — ships in the package, runs on-device, never phones home.
- LanceDB vector index — for semantic lesson recall.
- Plausible analytics — privacy-respecting, no cookie banner, no IP logging.
- Two-repo split: public `ThumbGate` (this) is the thin shell; `ThumbGate-Core` (private) holds the ranking, synthesis, billing intelligence, and org-wide telemetry. Wire protocol between them, never `require()`.

## Five lessons I'd give my March-3 self

1. A deployment-verification gate beats a memory note. I told myself "always curl `/health` after merge" for weeks. It didn't stick. The fix was a hard rule in `CLAUDE.md` that blocks the words "done", "deployed", "live", or "shipped" until two grep commands return non-empty output. The day that gate landed was the day I stopped lying to myself about ship status.
2. Behavioral rules only work at ZERO/ALWAYS thresholds. "1 in 5 social posts should mention the product" silently degrades to "every post mentions the product" because the LLM can't count across sessions. Write absolutes: never auto-post replies, always show `gh pr view` output before claiming done. The middle ground does not exist.
3. Memory and instructions decay together. When you change a rule in `CLAUDE.md`, also update the lesson DB entry or prevention rule that contradicts it. Otherwise the agent follows stale memory over the new instruction. Memory always wins ties.
4. Fix-on-fix commits are a systemic-failure signal. If a bug takes 3+ commit attempts to land, stop pushing. Read the platform docs. The five-commit CSS chase that turned out to be one line of `scroll-snap-type: none` on mobile cost me a full afternoon of CI minutes and trust.
5. The shape of "production" is fractal. "Production" was running by week 2 (Railway, dashboard, npm). "Production-ready for paying customers" took until week 10 (clean Stripe, verified deploy gate, kill-stale-payment-links pass, logo on every product). The first one ships in a weekend. The second one is the actual job.

## The part that's still broken

Real customer revenue is $0. Excluding test transactions, no cold-traffic visitor has ever paid for ThumbGate Pro or Team. The npm download trend is real (6k in 30 days), the landing page conversion is not. 50 recent Stripe Checkout sessions started; zero completed.

This is honest because pretending otherwise would be the exact kind of "live revenue claim" the deploy-verification gate exists to stop. The product works. The funnel doesn't yet. That's a distribution problem, not a product-doesn't-work problem — but it's still a problem.

The next 30 days are about three things:

1. Friction-free first-gate-fires. If `npx thumbgate init` doesn't surface a real, named gate inside 60 seconds on a real codebase, install-to-aha is broken. Measuring this with anonymous telemetry on the install flow.
2. Story-driven distribution. Build logs (like this one) and gate-of-the-week posts. Specific war stories beat feature lists. Verified by Plausible referrer reports, not vibes.
3. Refund-rate triage on the funnel SKUs. The $1, $5, $19, $49 quick-read tier exists to validate willingness-to-pay at low friction. If those convert, the $1,500 Workflow Hardening Sprint becomes a real consulting funnel.

## The tools I shipped this on

Solo founder, no team. Stack: Claude Code as the primary engineer (CTO mode, autonomous PR/merge/deploy when CI is green); Cursor for ad-hoc edits; Railway for hosting; Stripe for billing; Resend for transactional email; Plausible for analytics; Zernio for cross-platform social publishing.

The single highest-ROI choice was treating Claude Code as a CTO with a strict `CLAUDE.md` contract — branch from `main`, push, PR, wait for green CI, merge, verify, deploy. The model handles the work; the gate file handles the discipline.

## Try it

One-line install:

    npx thumbgate init

You'll have a working pre-action gate in your AI coding agent inside 60 seconds, or the install is broken and I want to hear about it.

If you've been burned by an AI agent doing something it shouldn't have, the Pro tier is $19/mo and adds the dashboard, recall, and lesson search. Or just install the free version, get a feel for it, and decide later. The whole thing is MIT.

I'll write the next build log at v2.0.0 — or when the first cold-traffic customer pays, whichever comes first.

— Igor

More build logs: The agent harness pattern · MCP pre-action checks explained · Stop AI agents from force-pushing · A safety net for vibe-coding