docs(gtm): Grade A trust announcement — blog, campaign, and assets (#733)

* docs(gtm): Grade A trust announcement — blog post + campaign + assets

Add the "Graded A for Trust" launch: the HVTrust Grade A blog post, a
full multi-channel distribution spec, ready-to-review channel drafts, and
the rendered social cards.

- blog: apps/website/content/blog/2026-06-24-threadplane-earns-grade-a-hvtrust.mdx
  (Brian voice; 82.8/100, #7 of 75, the only Angular framework; honest about
  adoption being the weakest signal; no unprovable "first" claims)
- spec: campaign plan — KPIs (Δ stars + npm downloads), channel sequencing,
  UTM table, guardrails, risks
- drafts: X thread, LinkedIn, Dev.to (canonical), manual-channel paste sheet
  (HN / r/Angular / Discord / newsletter)
- assets: render-grade-a.ts + grade-a-{x,og}-card.png via marketing/assets

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(assets): correct card wordmark to threadplane.ai

brand.wordmark was a stale 'cacheplane.ai' — it had drifted from its
documented source of truth (apps/website/src/app/opengraph-image.tsx),
which uses threadplane.ai, as does the rest of the site. Re-sync and
re-render the Grade A campaign cards.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(readme): add HVTrust badge to the trust-signal row

Links to the public HVTrust listing (Grade A, 82.8/100). Sits alongside
the existing OpenSSF Scorecard + Best Practices badges. Repo homepage is
already threadplane.ai, so no website-field change is needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: blove

README.md

@@ -26,6 +26,9 @@
   <a href="https://www.bestpractices.dev/projects/13316">
     <img alt="OpenSSF Best Practices" src="https://www.bestpractices.dev/projects/13316/badge" />
   </a>
+  <a href="https://hvtracker.net/agents/threadplane">
+    <img alt="HVTrust" src="https://hvtracker.net/badge/threadplane.svg" />
+  </a>
 </p>
 
 ---

apps/website/content/blog/2026-06-24-threadplane-earns-grade-a-hvtrust.mdx

@@ -0,0 +1,102 @@
+---
+title: "Threadplane Earns a Grade A for Trust"
+description: "An independent tracker scored Threadplane's supply-chain trust at 82.8/100 — a Grade A, #7 of 75 agent frameworks, and the only Angular agent framework on the board. Here's the work behind the grade, and why it matters for agent frameworks specifically."
+date: 2026-06-24
+tags: [announcement, security, supply-chain, open-source, trust]
+author: brian
+featured: true
+---
+
+Every agent framework asks you to trust it. I'd rather you measure it.
+
+[HVTracker](https://hvtracker.net/agents/threadplane/) is an independent trust tracker for AI agent software. It just scored Threadplane at **82.8/100 — a Grade A**.
+
+In the Agent Frameworks category, that's #7 of 75. And it's the #1 — really the *only* — Angular agent framework on the list.
+
+I didn't fill out a questionnaire or pay for a badge. HVTracker scores from public signals only: the GitHub API, the npm and PyPI registries, and the OpenSSF Scorecard CLI, refreshed daily. The grade is what their analysis says about us, not what we say about ourselves.
+
+For me, that's the whole point. A trust claim you make about yourself isn't worth much.
+
+## Who else is on the list?
+
+This is the part I keep coming back to. Let's look at the company we're keeping.
+
+| Rank | Framework | Trust | Stars |
+| --- | --- | --- | --- |
+| 1 | Haystack | 95.5 | 25.7k |
+| 2 | Vercel AI SDK | 95.1 | 25.1k |
+| 3 | LangGraph | 93.0 | 35.6k |
+| 6 | OpenAI Agents SDK | 85.8 | 27.4k |
+| **7** | **Threadplane** | **82.8** | **99** |
+| 8 | CrewAI | 80.6 | 54.3k |
+| 11 | LangChain | 76.6 | 140.1k |
+
+Look at the stars column.
+
+Threadplane ranks *above* CrewAI, AutoGen, and LangChain on trust — with 99 GitHub stars against their tens of thousands.
+
+That isn't a glitch. HVTrust is weighted toward supply-chain integrity and provenance, not popularity. A package can be downloaded millions of times a week and still have thin security signals. A smaller one can have every signal in place. The grade rewards the second kind, which is the whole reason a tracker like this exists.
+
+And I'll be just as honest about where we're weak. Our lowest signal is adoption. With 99 stars, that's the part of the profile we have the most room to grow, and it's the one place the big projects above us are genuinely ahead. I'm not going to dress that up.
+
+## What does a Grade A actually mean?
+
+HVTracker is careful about its own claims, and I want to be too. Right on the listing, they print this:
+
+> Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.
+
+That caveat is exactly why the grade is worth anything.
+
+It's not a sticker that says "trust us." It's a measurement across five dimensions:
+
+- **Safety / Integrity** — OSSF Scorecard, provenance, signatures.
+- **Identity / Provenance** — a verifiable link between the published package and the source that built it. This is our *strongest* signal.
+- **Transparency** — a declared, OSI-approved license and public checks.
+- **Maintenance** — commit freshness and cadence.
+- **Adoption** — stars and downloads.
+
+Grade A just means the score lands in the top band (A is 80 and up). It doesn't mean anyone audited your threat model for you. It means the public evidence is strong, and you can go verify every piece of it yourself.
+
+## Why this matters more for agent frameworks
+
+Most software you install does one job in one place. An agent framework is different.
+
+It runs models. It executes tool calls. It reaches for credentials and acts on behalf of your users, often with real authority over real systems.
+
+So the blast radius of a compromised dependency underneath an agent is bigger than almost anything else in your stack. That's what makes "is this thing's supply chain in order" a real question and not a checkbox.
+
+It's also the gap the tooling exists to close. The OpenSSF Scorecard — the engine behind a big part of HVTrust — checks the parts of the chain attackers actually go after: source, build, dependencies, signing, and maintenance. As [OpenSSF puts it](https://openssf.org/projects/scorecard/), a lot of open source is run by small teams with limited resources, which is exactly the soft target supply-chain attacks look for. And a [Sonatype analysis](https://github.com/ossf/scorecard) found a project's Scorecard score was one of the best available predictors of whether it carried known vulnerabilities.
+
+From my experience, that's the question worth asking before you install anything an agent will run: how much of your app are you handing to code you didn't write, and can you prove where it came from?
+
+## The work behind the grade
+
+The grade is the output. Here's the input — the boring, unglamorous hygiene that earns it.
+
+- **OSSF Scorecard 7.7/10** — branch protection, signed releases, dependency review, code review, run continuously.
+- **MIT licensed** — a declared, OSI-approved, permissive license. No ambiguity about what you can do with it.
+- **82% of recent commits cryptographically signed** — so you can confirm code came from who the commit claims.
+- **Verifiable provenance** — a traceable line from the npm package back to the build that produced it.
+- **Active maintenance** — the repo was pushed to within the last day when it was scored.
+
+None of these are exotic. Doing all of them, and keeping them done, is what moves a project from "probably fine" to "you can check."
+
+## Open by default
+
+Threadplane is MIT-licensed open source. The framework — the LangGraph and AG-UI adapters, the generative-UI runtime, the protocol types — is free, and it stays free.
+
+One library, `@threadplane/chat`, carries a commercial license. That's the single piece that funds keeping everything else open and maintained.
+
+For me, that's the honest version of sustainable open source. The trust signals above aren't marketing paint on a closed product. They're what I hold the whole codebase to, and almost all of that codebase is MIT and sitting right there for you to read.
+
+<Callout type="info" title="Don't take my word for it">
+The full breakdown — every dimension, the Scorecard checks, and the raw JSON — is public on the [Threadplane HVTracker listing](https://hvtracker.net/agents/threadplane/). Take their word, then go verify it.
+</Callout>
+
+## Conclusion
+
+A trust grade is a starting point, not a finish line. The real way to evaluate a framework is to build something with it.
+
+So if you're curious: read the [listing](https://hvtracker.net/agents/threadplane/) and the [Agent Frameworks leaderboard](https://hvtracker.net/categories/agent-frameworks/), browse the [source on GitHub](https://github.com/cacheplane/angular-agent-framework) (all of it — it's almost all open), and ship your first streaming agent UI with the [quickstart](/docs/chat/getting-started/quickstart).
+
+We'll keep the signals fresh, keep the framework open, and keep working on the one number I'm not proud of yet. The rest, you can verify. 💚

docs/superpowers/specs/gtm/2026-06-24-grade-a-trust-campaign-design.md

@@ -0,0 +1,111 @@
+# Campaign Spec — "Graded A for Trust"
+
+> GTM distribution plan for the HVTrust Grade A announcement. Source content: the blog post
+> `apps/website/content/blog/2026-06-24-threadplane-earns-grade-a-hvtrust.mdx`.
+> Voice/messaging source of truth: `docs/gtm/voice.md`, `docs/gtm/messaging.md`, `docs/gtm/icp.md`.
+> Tracking taxonomy: `docs/gtm/taxonomy.md`.
+
+## 1. Objective & KPIs
+
+Primary objective: **awareness that converts to adoption.** The blog post itself names adoption as
+our weakest trust signal, so the campaign turns that candor into the ask.
+
+| KPI | Baseline (Day 0) | Window | Source |
+| --- | --- | --- | --- |
+| GitHub stars | 99 | 14 days | github.com/cacheplane/angular-agent-framework |
+| npm weekly downloads (`@threadplane/*`) | snapshot Day 0 | 14 days | npmjs + `ngaf:postinstall` (PostHog) |
+| Referral sessions → blog + listing | 0 | 14 days | PostHog `$pageview` UTMs, `marketing:external_link_click` |
+| Earned mentions | 0 | 14 days | manual (HN, Reddit, reposts, newsletters) |
+
+**Measurement method:** snapshot stars + npm weekly downloads on Day 0 and Day 14. Every outbound
+link carries `utm_campaign=grade-a-trust`. Honest caveat: stars/downloads are noisy and attribution
+is fuzzy — read directionally.
+
+## 2. Core narrative & guardrails
+
+**The shareable paradox:** Threadplane ranks #7 of 75 agent frameworks on trust — above CrewAI,
+AutoGen, and LangChain — with 99 stars against their tens of thousands. Independently graded, and we
+name our own weak spot. This hook is credible (third-party) *and* earns the adoption ask.
+
+**Guardrails:**
+- **Do not claim "first OSSF product" or "first MIT-licensed framework."** Unprovable superlative;
+  violates messaging.md's Avoid list and voice.md's no-hype rule. Use "OSSF-first / security-first
+  posture." Decision (2026-06-24): the "first" framing is dropped entirely.
+- Keep HVTracker's "not a safety endorsement" caveat visible on long-form channels — it is what makes
+  the grade credible.
+- Brian's voice on every post (voice.md): one thought per line, contractions, opinions flagged, no
+  "blazing/game-changing/revolutionary."
+- No logo walls, no progressive lead forms (messaging.md).
+
+## 3. Assets (build once, reuse)
+
+- [x] Blog post — `2026-06-24-threadplane-earns-grade-a-hvtrust.mdx`.
+- [ ] HVTrust badge in repo README — `[![HVTrust](https://hvtracker.net/badge/threadplane.svg)](https://hvtracker.net/agents/threadplane)`.
+- [ ] Repo "Website" field → `threadplane.ai` (backlink fix; HVTracker scrapes repo metadata).
+- [ ] One branded social/OG card — leaderboard + "Grade A · 82.8" — via `marketing/assets`. Reused on X, LinkedIn, blog OG.
+- [x] Canonical UTM link set (§6).
+
+## 4. Channel plan & sequencing (~2-week drip)
+
+| Day | Channel | Track | Angle | Mechanism |
+| --- | --- | --- | --- | --- |
+| 0 | Blog publish | both | Full story | Merge + deploy |
+| 0 | X thread (Brian) | developer | The 99-stars-vs-trust paradox + card | Adapter (DRY_RUN → post) |
+| 0 | LinkedIn (Brian) | enterprise | "Code you didn't write" supply-chain framing | Manual paste |
+| 2 | Dev.to | developer | Full post, `canonicalUrl` → blog | Adapter (DRY_RUN → post) |
+| 2 | Discord | developer | Casual honest breakdown | Manual |
+| 4 | Hacker News (Brian) | developer | Technical supply-chain framing, NOT "look at our grade" | Manual |
+| 4 | r/Angular + LangChain/AG-UI communities | developer | Value-first lesson, grade as evidence | Manual |
+| 6–7 | Newsletter pitches (Angular Weekly, etc.) | developer | Short pitch + link | Manual |
+| 7 | X follow-up (Brian) | developer | Amplify earned discussion / re-drive adoption ask | Adapter |
+| 8–14 | Monitor, reply, repost top performer | — | — | — |
+
+## 5. Per-channel angle briefs
+
+- **X thread:** hook = paradox + card; middle = what HVTrust measures / why agent frameworks are
+  higher-stakes / the honest weak signal; close = links + "help us close the gap."
+- **LinkedIn:** architect voice; the verifiable credentials (MIT, signed commits, provenance); one CTA
+  to the listing.
+- **HN:** neutral technical title; Brian posts and stays in comments; honest caveat up front.
+- **Reddit:** lead with the supply-chain lesson, grade as proof; respect r/angular self-promo norms.
+- **Discord/newsletter:** short, warm, linked.
+
+## 6. Tracking — canonical UTM link set
+
+Blog slug: `threadplane-earns-grade-a-hvtrust`. Base: `https://threadplane.ai/blog/threadplane-earns-grade-a-hvtrust`.
+
+| Channel | utm_source | utm_medium | Link |
+| --- | --- | --- | --- |
+| X | `x` | `social` | `…?utm_source=x&utm_medium=social&utm_campaign=grade-a-trust` |
+| LinkedIn | `linkedin` | `social` | `…?utm_source=linkedin&utm_medium=social&utm_campaign=grade-a-trust` |
+| Dev.to | `devto` | `referral` | canonicalUrl = bare blog URL (no UTM on canonical) |
+| Hacker News | `hackernews` | `community` | `…?utm_source=hackernews&utm_medium=community&utm_campaign=grade-a-trust` |
+| Reddit | `reddit` | `community` | `…?utm_source=reddit&utm_medium=community&utm_campaign=grade-a-trust` |
+| Discord | `discord` | `community` | `…?utm_source=discord&utm_medium=community&utm_campaign=grade-a-trust` |
+| Newsletter | `newsletter` | `referral` | `…?utm_source=newsletter&utm_medium=referral&utm_campaign=grade-a-trust` |
+
+External targets (no PostHog UTM benefit, link plainly): listing
+`https://hvtracker.net/agents/threadplane/`, leaderboard
+`https://hvtracker.net/categories/agent-frameworks/`.
+
+## 7. Execution mechanics
+
+- Each social draft → `marketing/cowork/inbox/2026-06-24-grade-a-<channel>.json`, matching the `Draft`
+  interface (`marketing/channels/src/types.ts`). Human-readable `_meta` keys carry campaign context.
+- **X + Dev.to:** `DRY_RUN=1` smoke first → review → real post via adapter.
+- **LinkedIn / Reddit / HN / Discord / newsletter:** adapters not built → ready-to-paste copy, posted
+  by hand.
+- Brian approves every draft before anything ships.
+
+## 8. Risks
+
+- HN promo backlash → technical framing, real human, honest caveat.
+- Reddit self-promo rules → value-first, not headline-first.
+- "First" overclaim → cut (see §2).
+- Vanity-metric trap → stars aren't revenue; chosen because the goal is adoption and the post owns it.
+  Enterprise leads are a watched secondary, not the goal.
+
+## 9. Out of scope / follow-ups
+
+- Building the LinkedIn + Reddit channel adapters (manual is fine for one campaign).
+- Wiring the `/marketing` Cowork dispatch loop (still a stub).

marketing/assets/scripts/render-grade-a.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: MIT
+//
+// Renders the "Graded A for Trust" campaign cards (x-card + og-card) to PNG.
+// Usage: npx tsx marketing/assets/scripts/render-grade-a.ts
+// Output: marketing/cowork/inbox/assets/grade-a-{x,og}-card.png
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { renderCard } from '../src/index';
+import type { CardInput } from '../src/types';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const outDir = join(here, '..', '..', 'cowork', 'inbox', 'assets');
+
+const shared = {
+  eyebrow: 'Independently graded',
+  title: 'Grade A for trust.',
+  subtitle: '82.8/100 · #7 of 75 agent frameworks · the only Angular one.',
+} as const;
+
+const cards: { name: string; input: CardInput }[] = [
+  { name: 'grade-a-x-card.png', input: { template: 'x-card', ...shared } },
+  { name: 'grade-a-og-card.png', input: { template: 'og-card', ...shared } },
+];
+
+async function main() {
+  await mkdir(outDir, { recursive: true });
+  for (const { name, input } of cards) {
+    const { png, width, height } = await renderCard(input);
+    const path = join(outDir, name);
+    await writeFile(path, png);
+    console.log(`rendered ${name} (${width}x${height}, ${png.length} bytes) -> ${path}`);
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

marketing/assets/src/brand.ts

@@ -9,7 +9,7 @@ export const brand = {
   inkSoft: '#555770',
   accent: '#004090',
   angular: '#DD0031',
-  wordmark: 'cacheplane.ai',
+  wordmark: 'threadplane.ai',
   serif: 'EB Garamond, Georgia, serif',
   sans: 'Inter, sans-serif',
   defaultEyebrow: 'Agent UI for Angular · MIT',

marketing/cowork/inbox/2026-06-24-grade-a-linkedin.json

@@ -0,0 +1,16 @@
+{
+  "_meta": {
+    "campaign": "grade-a-trust",
+    "channel_note": "Day 0. Brian's account. LinkedIn adapter is NOT built — post by hand. Enterprise/architect track. Attach the branded social card. No hashwall.",
+    "card_alt": "HVTrust leaderboard card: Threadplane ranked #7 of 75 agent frameworks, trust score 82.8 out of 100, Grade A, shown above CrewAI and LangChain.",
+    "review_status": "awaiting-brian"
+  },
+  "draft": {
+    "channel": "linkedin",
+    "text": "How much of your app are you willing to hand to code you didn't write?\n\nFor an agent framework, that isn't rhetorical. It runs models, calls tools, reaches for credentials, and acts on behalf of your users. The supply chain underneath it matters more than almost anything else you install.\n\nSo we had Threadplane independently evaluated. HVTracker graded it A — 82.8/100, #7 of 75 agent frameworks, and the only Angular one on the board. Ranked above CrewAI, AutoGen, and LangChain on trust.\n\nWhat earned it is unglamorous and, more to the point, verifiable: OSSF Scorecard 7.7/10, an MIT license, 82% of recent commits cryptographically signed, traceable npm provenance, active maintenance. Things you can check rather than take on faith.\n\nIt isn't a safety endorsement, and HVTracker says so plainly — it measures public signals, not whether a project fits your use case. That honesty is exactly why the grade is worth anything.\n\nIf you're evaluating an agent framework for an Angular app in a regulated or design-system-heavy environment, the full breakdown is public. Take their word, then verify it.\n\nListing → https://hvtracker.net/agents/threadplane/\nThe story → https://threadplane.ai/blog/threadplane-earns-grade-a-hvtrust?utm_source=linkedin&utm_medium=social&utm_campaign=grade-a-trust",
+    "link": {
+      "url": "https://threadplane.ai/blog/threadplane-earns-grade-a-hvtrust?utm_source=linkedin&utm_medium=social&utm_campaign=grade-a-trust",
+      "previewTitle": "Threadplane Earns a Grade A for Trust"
+    }
+  }
+}