Growth: 10,000 downloads + 30 paid subscriptions/packs

[BGMLAI]

Goal

Drive gate.cat to 10,000 verified download-proxy events and 30 paid subscriptions or policy-pack purchases while keeping claims and attribution auditable.

Authoritative baseline — 2026-07-14 09:31 UTC

• PyPI: 2,147 trailing-30-day downloads without known mirrors (download proxy, not unique people).
• Stripe since launch: 0 subscriptions, 0 charges, 0 payment intents.
• GitHub: 0 stars, 0 forks, 0 watchers.
• Public distribution ledger: 74 verified URLs, including measured X, LinkedIn, and Cursor Discord placements; the paced Reddit series remains active.

Current state

• Master, PyPI, and GitHub Release: 0.4.16.
• Public origin: https://gate.cat served from VPS /opt/bgml/static/gatecat.
• Installer CTA: download → inspect → run; no blind pipe-to-shell and no global pip install CTA on the landing.
• Stripe: Solo founding €9/mo, Team €149/mo, Business €399/mo, policy packs €29 one-time; Stripe activation endpoint deployed and healthy.
• Measurement: first-party, cookieless page/installer/checkout/GitHub/PyPI events with UTM and referrer attribution; logs omit client IPs, cookies, email, and payment data.
• Linear mirror: BGM-170.

Completion criteria

• master, GitHub Release, PyPI, and runtime agree on 0.4.16+
• CI, local tests, artifact inspection, and clean-install smoke are green
• landing and public GitHub release use the inspectable installer
• Stripe checkout and activation are live with the €9 founding Solo mapping
• owned-channel and community placements have verified permalinks
• privacy-preserving funnel attribution is live
• PyPI download proxy reaches 10,000
• paid subscriptions + policy-pack purchases reach 30
• measured channel conversion has been reviewed and the next channel mix selected

Active work

• PR Add privacy-preserving funnel analytics #20: funnel instrumentation, Nginx source-of-truth config, report helper, measured-channel ledger.
• Reddit automation continues paced, unique, subreddit-relevant comments and records only rendered direct permalinks.
• New X / LinkedIn / Discord placements use separate UTM sources; optimize from install-copy and checkout-click data, not impression counts.

Safety

No paid acquisition experiment without explicit approval. No secrets or raw sensitive data in GitHub, Linear, logs, or publication records.

[BGMLAI]

Launch-readiness milestone (2026-07-13):

• PR opened with release candidate 0.4.16 and merged product/site history.
• Full local release gate: 1863 passed, 27 skipped, 0 failed.
• Clean wheel install confirmed 0.4.16, 71 defaults, 73 total presets.
• Recall: 43/43 known danger classes neutralized, 0/13 benign false-blocked.
• Bypass suite: 178/178 claimed dangers, with 1 published gap and 1/129 benign false-block.
• PyPI proxy baseline: 2,019 downloads excluding known mirrors in the measured trailing window (downloads, not unique users), so the 100-install proxy threshold is already crossed.
• Blocker: stored Lemon Squeezy API key is test-mode; a live API key/webhook is required before promoting production paid checkout.
• Linear remains unavailable in this environment; this blocker is recorded here as required.

Next: CI/review, safe Cloud deploy + smoke, PyPI/GitHub release, then publish owned/rented/borrowed launch channels once live fulfillment is verified.

[BGMLAI]

Release + deployment milestone (2026-07-13 21:06 UTC):

• PR Release 0.4.16 and complete launch readiness #10 merged (45ca5dd).
• PyPI 0.4.16 is live and a clean no-cache install from the public index returned runtime/distribution 0.4.16, 71 default policies and 73 presets.
• GitHub Release v0.4.16 is live: https://github.com/BGMLAI/gate.cat/releases/tag/v0.4.16
• Cloud lifecycle code deployed after snapshot /opt/bgml/gatecat-cloud/deploy-backups/20260713T205751Z; both scoped services active, public health 200, invalid signature rejected 401, data counts unchanged at accounts=11 / issued=1.
• PR Pin 0.4.16 release evidence and media kit #11 pins post-release evidence and the canonical launch copy.

Exact blockers to broad media publication:

1. gate.cat is routed through a separate Cloudflare Pages/Design Canvas deployment, not this repository's successful GitHub Pages build. The public UI still exposes curl ... | sh. The stored Cloudflare token verifies as active but lacks Pages permission. Required: owner login or a token with Pages Edit for the existing account/project, then deploy the reviewed docs/ site.
2. Stored Lemon Squeezy API access is test-mode. Production checkout URLs work, but live lifecycle fulfillment cannot be verified until a live API key/webhook is created for https://gate.cat/cloud/lemonsqueezy/webhook with order/subscription create, update and expiration events.
3. No authenticated social sessions/API tokens are present, so rented-channel posts are prepared but not yet published.
4. Linear remains unavailable. Telegram notification also cannot be sent because BGML_TELEGRAM_CHAT_ID is absent; recorded here and in local SESSION_LOG.

I am deliberately withholding rented-channel promotion until #1 and #2 are fixed so nobody receives a self-vetoing install instruction or pays without automatic activation.

[BGMLAI]

Distribution milestone (2026-07-13 21:18 UTC):

Public site corrected at the actual VPS origin (/opt/bgml/static/gatecat), with rollback copies at:

• /opt/bgml/static/deploy-backups/gatecat-20260713T211427Z
• /opt/bgml/static/gatecat-predeploy-20260713T211427Z

Verified live:

• reviewed landing is served (not the stale Design Canvas bundle)
• safe two-step installer shown; no curl | sh
• 71 default policy walls and scoped 178/178 bypass-suite wording
• Cloud subscription checkout links hidden until live billing fulfillment is verified
• Cloud health, installer, coverage page and launch article all return 200
• historical coverage page is explicitly labeled as a 38-policy v0.4.11 snapshot rather than current/full coverage

Published channel URLs:

• Owned / GitHub Release: https://github.com/BGMLAI/gate.cat/releases/tag/v0.4.16
• Owned / PyPI: https://pypi.org/project/gate.cat/0.4.16/
• Owned / GitHub Announcement: gate.cat 0.4.16 is live — local vetoes before agent actions run #12
• Owned / launch article: https://gate.cat/blog/1m-agent-commands.html
• Borrowed / technical response on fragile safety hooks (maintainer disclosure included): Hook-creation flow can ship fragile bash-regex security restrictions without catching common bypasses anthropics/claude-code#77177 (comment)

Repository discovery metadata now points to https://gate.cat and includes current agent-safety/Codex/PreToolUse topics.

Still pending for the full rented-channel launch: authenticated HN, Reddit, LinkedIn and X/Bluesky sessions. Lemon Squeezy live lifecycle remains pending; Cloud checkout is intentionally paused meanwhile.

[BGMLAI]

Owned newsletter channel published (2026-07-13): release email sent through the authenticated project Gmail account to the complete current Veto Catches opt-in list (1 subscriber). Message included install command, evidence, honest boundary, Cloud-checkout pause, feedback link and reply-to-unsubscribe instruction. No subscriber address was logged to GitHub or the local launch registry.

[BGMLAI]

Borrowed discovery channel submitted: ProjectRecon/awesome-ai-agents-security PR #73 adds gate.cat to the Agent Firewalls & Gateways (Runtime Protection) section, following the repository contribution format: ProjectRecon/awesome-ai-agents-security#73. The larger Awesome Claude Code list was deliberately not submitted because its current CONTRIBUTING.md disables recommendations and requires a human-created web-form submission.

[BGMLAI]

Launch blocker update — 2026-07-13

• Owner login to Lemon Squeezy verified.
• Store status in dashboard: application received and awaiting review.
• Live/test-mode switch is disabled by Lemon Squeezy while review is pending.
• Existing gate.cat webhook entries are test-mode only; production webhook and production create/revoke lifecycle E2E cannot be completed until store approval.
• No purchase or card charge was attempted.
• Cloud subscription checkout remains intentionally hidden; media launch work continues in parallel.

Next owner action: wait for Lemon Squeezy approval email, then create live webhook for https://gate.cat/cloud/lemonsqueezy/webhook with order_created, subscription_created, subscription_updated, and subscription_expired, followed by signed production lifecycle smoke.

[BGMLAI]

Borrowed-channel launch update — 2026-07-13

Published two maintainer-disclosed, technically scoped contributions where the target audience is actively discussing this exact problem:

• GitHub Community discussion on 2026 AI security headaches/runtime guardrails: What security headaches has AI introduced in your projects lately? (2026 edition) community/community#193727 (comment)
• Fresh Claude Code bug where PreToolUse ask is silently auto-approved under bypass mode; documented the hard-deny/exit-2 pattern used by gate.cat: PreToolUse hook permissionDecision "ask" is silently auto-approved under bypassPermissions (deny works) anthropics/claude-code#77212 (comment)

Discovery also found a high-signal Reddit thread created today about safely using --dangerously-skip-permissions, but Reddit still requires an authenticated owner session. X is authenticated only in the owner’s Mozilla session, outside this automation surface. HN remains blocked from the server IP. No spam/duplicate comments were posted.

[BGMLAI]

Launch correction update (2026-07-13):

• Deleted the first X post because it contained stale bare pip install guidance.
• Published the corrected X post with the canonical safe two-step installer: https://x.com/Bobby_prv/status/2076801206660337897
• Updated docs/LAUNCH_0.4.16.md so HN/X/Reddit launch copy uses the reviewed installer that creates a private venv and works on PEP 668 systems.
• Fix branch/commit: codex/fix-launch-installer-copy / 6bb55b8
• PR: Fix launch installer guidance #13
• Validation: diff whitespace check; stale launch pip install gate.cat==0.4.16 grep returns no matches; commit check clean.

Remaining blockers/owners:

• Lemon Squeezy production lifecycle remains blocked on store review (owner: Lemon Squeezy, then BGMLAI).
• HN remains blocked by current IP 403; Reddit/LinkedIn still need authenticated posting sessions (owner: BGMLAI/user session).
• Linear is unavailable in this environment; GitHub issue Growth: 10,000 downloads + 30 paid subscriptions/packs #9 remains the operational source of truth for this launch handoff.

[BGMLAI]

Correction merged and verified:

• Corrected X post live: https://x.com/Bobby_prv/status/2076801206660337897
• Stale X post with bare pip install guidance was deleted.
• PR Fix launch installer guidance #13 merged: Fix launch installer guidance #13
• Merge commit: 9a03566
• Changed path: docs/LAUNCH_0.4.16.md
• CI: Python 3.11, 3.12 and 3.13 all PASS.
• Post-merge audit: no stale pip install gate.cat==0.4.16 or bare launch Install: pip install remains in the launch packet.

Launch remains open only for external/account blockers already tracked here: Lemon Squeezy store review; HN IP 403; authenticated Reddit/LinkedIn posting sessions. Next owner: BGMLAI after those external states become available. Linear remains unavailable in this environment, so this issue contains the complete handoff.

[BGMLAI]

Reddit launch published and verified (2026-07-13):

• Community: r/AI_Agents
• Placement: stickied Weekly Thread: Project Display, chosen to comply with the subreddit rules limiting self-promotion and requiring links in comments rather than posts.
• Public permalink: https://www.reddit.com/r/AI_Agents/comments/1uqwwus/comment/oxdbmc9/
• Account: u/Sea-Swing2371
• Copy uses the canonical safe two-step installer link at https://gate.cat and does not contain bare pip install guidance.
• Verification: public permalink renders the complete comment, gate.cat link, GitHub source link, and explicit "unmatched means unchecked" boundary.

Reddit is no longer a launch blocker. Remaining channel blockers: HN current-IP 403 and no authenticated LinkedIn session. Lemon Squeezy production lifecycle remains pending store review. Linear is unavailable in this environment; this GitHub issue remains the operational handoff.

[BGMLAI]

Scope change authorized by founder (2026-07-13): temporarily switch paid sales from Lemon Squeezy to Stripe until the Lemon Squeezy store is approved.

Read-only audit before mutation:

• Stripe account acct_1TXMiz2Va7XV3fWY is live and charges/payouts are enabled.
• Existing gate.cat products and live pack Payment Links exist; pack redirect fulfillment is deployed and healthy.
• Public offer is EUR (€29 packs; Cloud €19/€149/€399), while existing Stripe prices are legacy USD ($29 packs; Cloud $9/$199) and there is no Business product.
• cloud_activate.py contains two stale Stripe price IDs that do not exist on the active account.
• No gate.cat Stripe webhook endpoint exists; current Cloud Stripe flow provisions on redirect but cannot revoke on subscription cancellation.

Implementation now in progress:

1. add verified Stripe subscription lifecycle webhook + idempotent revocation tests;
2. create/reuse EUR prices and Payment Links with automatic tax and safe redirects;
3. deploy/stage, add webhook endpoint, production smoke without charging a card;
4. expose Stripe links only after health, invalid-signature, price mapping and redirect checks pass;
5. preserve Lemon Squeezy integration behind the channel selector for later re-enable.

Linear remains unavailable; this issue is the operational source of truth.