@monoes/monomindcli 2.15.3 → 2.15.4

package/org-skills/sales-prospecting/references/compliance.md

@@ -0,0 +1,123 @@
+# Prospecting Compliance Reference
+
+The legal and platform-ToS constraints that apply to prospect list building. Read first, every engagement.
+
+> Operational guidance, not legal advice. For high-volume programs or programs touching EU/UK residents, run your setup past a privacy attorney.
+
+---
+
+## United States — CAN-SPAM (downstream)
+
+CAN-SPAM regulates the cold email **send**, not the list build. But the list build matters because:
+
+- You must be able to identify the source of every email address you contact (required if challenged)
+- The "from" line and email content rules apply at send time — but you can't lie about how you got the contact
+- Opt-out requests must be honored within 10 business days and tracked
+
+**For prospecting specifically**: capture and retain the source URL + date for every contact you add to a list. CAN-SPAM doesn't require it explicitly, but defending your sender practices does.
+
+---
+
+## EU / UK — GDPR
+
+The strictest applicable framework. Triggers when:
+
+- Your prospect resides in EU/UK
+- You're processing personal data (any identifiable info, including business emails tied to a named person)
+
+### Lawful bases for cold B2B outreach
+
+You have three credible options:
+
+1. **Legitimate interest** (most common for B2B). Requires:
+   - The contact is in a business role likely to be interested in your offer
+   - The data was collected from a public, business-context source
+   - You provide a clear opt-out
+   - You can articulate the legitimate interest test in writing
+
+2. **Consent** — typically not feasible for cold outreach (you don't have consent before first contact)
+
+3. **Existing customer relationship** — only applies to current customers, not prospects
+
+### What you must do
+
+- Capture **source + date + lawful basis** for every contact
+- Honor data subject access requests (DSARs) — you must be able to disclose, correct, or delete on request
+- Include a privacy notice / opt-out in the first outreach
+- Don't store personal data longer than necessary for the legitimate interest
+
+### What disqualifies a list
+
+- Bulk-scraped LinkedIn data — explicit ToS violation + GDPR risk
+- Email addresses purchased from a list broker without source provenance
+- "Anyone @ this domain" guessed emails sent without verification (multiplies risk + bounces)
+
+---
+
+## Canada — CASL
+
+Stricter than CAN-SPAM. Cold B2B outreach requires:
+
+- **Express consent** (explicit opt-in) — typically not present for cold prospecting
+- **OR implied consent** — existing business relationship within 24 months, OR business address publicly published on the company's own site for the purpose of receiving such communications
+
+**Practical implication for Canadian prospects**: relying on the publicly-published-address exception is the most defensible cold prospecting basis in Canada. You must include sender identification, mailing address, and an unsubscribe mechanism in every message.
+
+---
+
+## Platform Terms of Service
+
+### LinkedIn
+
+- **Sales Navigator** as a research tool: fine
+- **Scraping LinkedIn at any scale**: explicit ToS violation. Banned accounts are permanent. Don't.
+- **Apollo, Clay, and ZoomInfo** claim LinkedIn-overlap data through various legitimate channels — verify their data sources before assuming compliance
+- **InMail and Connection Requests**: governed by LinkedIn's own messaging rules, not by CAN-SPAM/GDPR (because LinkedIn-internal)
+
+### Google Maps
+
+- ToS prohibits bulk extraction or productizing Maps data
+- Browser-assisted research as a discovery aid: acceptable
+- Storing Place IDs or large structured Maps data in your CRM: explicit ToS prohibition
+- Use Maps to **find** local businesses, then cross-source from the business's own site for the data you retain
+
+### Apollo / ZoomInfo / Clearbit
+
+- All have their own ToS limiting reselling, downstream sharing, and use cases
+- Read your contract — typically you can use the data for your own outreach but not productize it
+- Don't share extracts publicly (e.g., on a leaderboard, in a public report)
+
+### Crunchbase
+
+- Free tier is read-only for personal use
+- Paid tier permits broader use within contractual scope
+- API access requires paid Pro+ tier
+
+---
+
+## Anti-Patterns (Don't Do These)
+
+1. **Bulk-scraping LinkedIn / Google Maps / Yelp**. Browser-assisted research is OK; automated scrapers pointed at these platforms are not. **Firecrawl and Browserbase are fine for an individual prospect's own website** (the URL you found through manual discovery) — not for the platforms hosting prospects.
+2. **Buying lists from random vendors** without source provenance. You inherit their legal exposure.
+3. **Guessing emails and sending unverified**. Bounce rates over 2% destroy sender reputation; legally, you can't claim a "legitimate interest" basis for an email you fabricated.
+4. **Harvesting personal email addresses** (Gmail, personal Outlook, etc.) from public profiles. Personal addresses raise GDPR risk significantly.
+5. **Storing data you don't need**. Minimize retention. Don't keep prospect lists forever — GDPR right to deletion applies.
+6. **Skipping the lawful basis documentation**. If challenged, you need to show your work. Capture source URL + collection date for every contact.
+7. **Reselling prospect lists**. You may not have the right to share them downstream. Read your data provider contracts.
+8. **CAPTCHA bypass / login wall bypass**. Even if technically possible, this signals bot behavior and violates virtually every ToS.
+
+---
+
+## Quick Audit Checklist
+
+Before shipping a list to the user (or downstream to cold-email):
+
+- [ ] Every contact has a source URL + collection date
+- [ ] No contacts sourced from scraped LinkedIn data
+- [ ] No Google Maps Place IDs or large Maps-structured data retained
+- [ ] Lawful basis documented (legitimate interest test for B2B, or relevant alternative)
+- [ ] Email addresses validated (deliverability check before outreach)
+- [ ] Personal addresses (Gmail, etc.) flagged or excluded
+- [ ] Source provider contracts permit the intended use case
+- [ ] Retention plan documented (when to delete)
+- [ ] First outreach will include unsubscribe + privacy notice (downstream concern for cold-email skill, but mention it now)

package/org-skills/sales-prospecting/references/data-sources.md

@@ -0,0 +1,287 @@
+# Prospecting Data Sources
+
+Tool selection guide for prospecting across all three branches.
+
+---
+
+## Tool selection by goal
+
+| Goal | Primary tools | Notes |
+|------|--------------|-------|
+| **Build initial firmographic list (B2B / SaaS)** | Apollo, ZoomInfo, Clay | Apollo for breadth, ZoomInfo for enterprise + intent, Clay for custom workflows |
+| **Decision-maker mapping** | LinkedIn Sales Navigator (manual), Apollo, ZoomInfo | Sales Nav is the gold standard. Never bulk scrape it. |
+| **Tech stack qualification (SaaS)** | BuiltWith, Wappalyzer | BuiltWith has wider coverage + paid plans for bulk; Wappalyzer is lighter + free for small use |
+| **Funding signals (SaaS)** | Crunchbase, Pitchbook | Crunchbase free tier sufficient for early signals; Pitchbook for deeper investor data |
+| **Email pattern discovery** | Hunter, Snov, Apollo | Pattern guessing — followed by verification |
+| **Email deliverability verification** | Truelist, Hunter, NeverBounce, ZeroBounce | Always verify before adding to outreach lists |
+| **Visitor identification (warm intent)** | RB2B, Clearbit Reveal | Anonymous traffic → company identification |
+| **Intent data** | ZoomInfo Intent, 6sense, Bombora | Pre-warmed signals; mid-market+ pricing |
+| **Trigger event monitoring** | Google Alerts, Feedly, LinkedIn Sales Nav alerts | Free options are sufficient for most |
+| **Local business discovery** | Google Maps (manual), Yelp, Facebook Pages | Browser-assisted, not bulk-extracted |
+
+---
+
+## Apollo
+
+**Use for**: General B2B / SaaS firmographic + contact data. Best starting point if you don't already have a list.
+
+**Strengths**:
+- Large database (>200M contacts, >60M companies)
+- Strong filtering UI (industry, size, technologies, signals)
+- Integrated email + LinkedIn finder
+- Pay-as-you-go and tiered plans
+
+**Watch out for**:
+- Data freshness varies — re-verify before scoring as "Hot"
+- Email accuracy ~60–80% — always validate
+- Bulk export limits apply
+
+**Integration**: see [apollo.md](../../../tools/integrations/apollo.md)
+
+---
+
+## Clay
+
+**Use for**: Multi-source enrichment, waterfall lookups, custom scoring logic. When list quality matters more than list size.
+
+**Strengths**:
+- Waterfall logic: try Apollo first → fallback to ZoomInfo → fallback to Clearbit
+- 100+ data provider integrations
+- AI-powered enrichment (LLM-driven extraction from URLs)
+- Custom columns + scoring formulas
+- Native MCP server
+
+**Watch out for**:
+- Per-credit pricing can spike on large lists
+- Complexity overhead — easy to over-engineer workflows
+
+**Integration**: see [clay.md](../../../tools/integrations/clay.md)
+
+---
+
+## ZoomInfo
+
+**Use for**: Enterprise B2B + intent data. Mid-market+ buyer profiles.
+
+**Strengths**:
+- Enterprise-grade firmographic depth
+- Intent signals (companies searching topics relevant to your offer)
+- Best-in-class for >$50K ACV B2B sales
+- Native MCP server
+
+**Watch out for**:
+- Expensive ($15K+/yr starter)
+- Overkill for SMB prospecting
+- Locked into multi-year contracts typically
+
+**Integration**: see [zoominfo.md](../../../tools/integrations/zoominfo.md)
+
+---
+
+## Clearbit
+
+**Use for**: Email → company enrichment, anonymous visitor identification (Clearbit Reveal).
+
+**Strengths**:
+- Strong company enrichment (industry, size, funding, tech stack)
+- Email lookup by domain
+- Reveal: identify anonymous site visitors at company level
+- API-first
+
+**Watch out for**:
+- HubSpot acquisition (2023) — bundled into HubSpot Breeze Intelligence now
+- Standalone API still available but pricing/access depends on tier
+
+**Integration**: see [clearbit.md](../../../tools/integrations/clearbit.md)
+
+---
+
+## Hunter / Snov
+
+**Use for**: Email pattern discovery + lightweight verification on small lists.
+
+**Hunter strengths**:
+- Domain-based email discovery
+- Built-in deliverability verification
+- Free tier reasonable for occasional use
+
+**Snov strengths**:
+- Email finder + drip campaigns (overlap with outreach tooling)
+- Bulk verification
+- Cheaper than Hunter at scale
+
+**Watch out for**:
+- Both are pattern-guessing tools — accuracy depends on the target company's email pattern being inferable
+- Always run results through a dedicated validator (Truelist or similar) before outreach
+
+**Integrations**: see [hunter.md](../../../tools/integrations/hunter.md), [snov.md](../../../tools/integrations/snov.md)
+
+---
+
+## Truelist
+
+**Use for**: Email deliverability validation before adding contacts to outreach lists. Critical safety step.
+
+**Strengths**:
+- Single-email sync verification (`/api/v1/verify_inline`) + bulk async (`/api/v1/verify`)
+- Returns `email_state` (ok / email_invalid / risky / unknown / accept_all) + `email_sub_state` (email_ok / is_disposable / is_role / unknown_error / failed_smtp_check) + did-you-mean typo suggestions
+- Catches catch-all domains, role accounts, spam traps, disposable providers
+- Official MCP server for agent-driven workflows (Claude, Cursor, VS Code)
+- Official SDKs in 7 languages + framework integrations (Django, Laravel, Next.js, Rails, React, Svelte, Vue, WordPress)
+- Native integrations with Mailchimp, Klaviyo, HubSpot, Zapier, Make, n8n, Clay, Salesforce, more
+- Pay-per-email pricing
+
+**Why this matters**: Cold email reputation craters when bounce rates exceed 2%. Validating before sending is non-negotiable. Apollo/ZoomInfo/Hunter data is often 60–80% accurate — Truelist catches the rest.
+
+**Integration**: see [truelist.md](../../../tools/integrations/truelist.md)
+
+---
+
+## LinkedIn Sales Navigator
+
+**Use for**: Manual decision-maker discovery. The gold standard for B2B / SaaS prospecting but only when used as a research tool.
+
+**Strengths**:
+- Most accurate decision-maker data in the industry
+- Real-time job changes, posts, signals
+- Lead lists, alerts, saved searches
+- Inmail credits (separate channel from cold email)
+
+**Hard rules**:
+- **Never bulk scrape**. LinkedIn aggressively bans scrapers. Account ban risk is real and permanent.
+- Use Sales Nav as a research interface — open profiles, read, take notes, capture key data manually.
+- Apollo and other tools claim LinkedIn data via partnerships / public mirroring — verify the source legitimacy before assuming compliance.
+
+**Integration**: no MCP or API access at consumer level. Manual research only.
+
+---
+
+## BuiltWith / Wappalyzer
+
+**Use for**: Tech stack qualification (SaaS branch).
+
+**BuiltWith**:
+- ~50K+ technologies tracked
+- API + bulk lookups (paid)
+- Historical data (when stack changed)
+
+**Wappalyzer**:
+- Free browser extension; paid API
+- Lighter coverage than BuiltWith
+- Faster for one-off lookups
+
+Cross-reference both for high-confidence tech stack signals.
+
+---
+
+## Crunchbase
+
+**Use for**: Funding signals (SaaS branch).
+
+**Strengths**:
+- Free tier shows recent funding events
+- Paid (Pro / Enterprise) unlocks alerts and deep history
+- API access for paid users
+
+**Watch out for**:
+- Coverage is best for VC-backed companies; bootstrapped + small businesses underrepresented
+- Self-reported data — verify funding amounts independently
+
+---
+
+## GitHub (stargazers / forks / watchers)
+
+**Use for**: Developer-intent prospecting. Especially powerful for dev-tool SaaS — stargazers of competitor or category-defining repos are in-market signal.
+
+**Strengths**:
+- Public API, no scraping concerns
+- High signal quality (a starred repo = explicit interest)
+- Forks are an even stronger signal (intent to modify, not just bookmark)
+- Bundled `github-prospects.js` CLI handles pagination + enrichment + CSV output
+- Free with 5,000 req/hr authenticated rate limit
+
+**Watch out for**:
+- Only ~5–20% of users publish email — pair with Apollo/Clay/Hunter for enrichment
+- Very-popular repos (100K+ stars) are mostly noise; smaller targeted repos (5K–25K) give better signal density
+- Most prospects are individuals, not company contacts directly — need to figure out their company from `company` field or LinkedIn
+
+**Integration**: see [github.md](../../../tools/integrations/github.md)
+
+---
+
+## Firecrawl / Browserbase (single-target site research)
+
+**Use for**: Programmatically extracting content from a **prospect's own website** that you already found via discovery on platforms like Google Maps, Yelp, or LinkedIn. Not for scraping those platforms themselves.
+
+### Firecrawl
+
+- **Best for**: "Just give me the page as markdown" — Local SMB website status checks, B2B company about/team page extraction, structured field extraction
+- **Strengths**: Low overhead, returns clean LLM-ready markdown, handles most JS-rendered sites, has an MCP server
+- **API + MCP + SDKs**: Node, Python, Go, Rust
+
+### Browserbase
+
+- **Best for**: When you need real Chromium — JS-heavy pages, cookie consent dialogs, form submission to reach a contact page, session state
+- **Strengths**: Full browser control via Playwright/Puppeteer; Stagehand provides AI-friendly natural-language extraction; session recordings for debugging
+- **API + MCP (Stagehand) + SDKs**: Node, Python
+
+### Critical compliance line
+
+Both tools can technically point at any URL. The hard rule:
+
+- ✓ **OK**: extracting content from a single business's own website (`joescoffeeshop.com`) that you found through manual discovery
+- ✗ **NOT OK**: pointing them at `google.com/maps`, LinkedIn search results, Yelp listings, or any platform whose ToS prohibits bulk extraction
+
+Discovery happens on platforms (manual browser-assisted research). Extraction happens on individual public business sites.
+
+**Integrations**: see [firecrawl.md](../../../tools/integrations/firecrawl.md), [browserbase.md](../../../tools/integrations/browserbase.md)
+
+---
+
+## RB2B / Clearbit Reveal
+
+**Use for**: Identifying anonymous site visitors as warm intent signals.
+
+**Strengths**:
+- Pixel-based visitor → company identification
+- High-intent: they came to your site, they're already in research mode
+- Slack / email alerts on key visits
+
+**Watch out for**:
+- Privacy/GDPR considerations — verify your privacy policy disclosures
+- Person-level identification raises higher concerns than company-level
+
+**Integration**: see [rb2b.md](../../../tools/integrations/rb2b.md)
+
+---
+
+## Free / browser-only fallbacks
+
+When the user has no paid tools, lean on:
+
+- **Google Search** — exact business name + city + role searches
+- **LinkedIn** (manual, no scraping) — company pages, employee lookups
+- **Crunchbase free tier** — funding events
+- **Wappalyzer browser extension** — tech stack at a glance
+- **Hunter.io free tier** — 25 lookups/month
+- **Google Maps** — for Local SMB discovery
+- **Business websites + About pages** — primary source for any claim
+- **News sites + press releases** — trigger event monitoring via Google Alerts
+
+Slower than tooled-up workflows, but produces high-quality smaller lists if the user is willing to do the work.
+
+---
+
+## Sequencing recommendations
+
+A typical full-stack prospecting workflow:
+
+1. **Define ICP** from product-marketing context (no tools needed)
+2. **Initial list** from Apollo or ZoomInfo (firmographic filter)
+3. **Enrich** with Clay (waterfall: tech stack, funding, trigger events)
+4. **Decision-maker mapping** in LinkedIn Sales Nav (manual)
+5. **Email pattern discovery** with Hunter or Apollo's built-in
+6. **Email validation** with Truelist before final list
+7. **Hand off** to cold-email skill for outreach copy
+
+Adapt this sequence based on which tools the user actually has.

package/org-skills/sales-prospecting/references/demand-signals.md

@@ -0,0 +1,129 @@
+# Demand-Signal Discovery (Find Your First Customers)
+
+The other three branches build a list from who *fits* (firmographics, technographics, proximity). This branch builds a list from who is *already showing the pain* — the early-stage motion where you have a product and a hunch but no customer base yet, and you need your first ten real conversations. You are not filtering a database; you are mining recent public discourse for people describing the exact problem you solve, then linking every prospect to the evidence.
+
+Use this branch when the user is pre-product-market-fit, launching something new, or looking for **design partners, beta users, or first customers** rather than a scaled outbound list. It reuses the shared five phases and every compliance guardrail in SKILL.md; what changes is where you look, how you score, and what you ship.
+
+Pattern credit: the framework here is re-expressed from the open-source `first-customer-finder` Codex skill (Kappaemme, MIT), extended with our live-recency tooling.
+
+## What makes this branch different
+
+| | List-building branches (SaaS / B2B / SMB) | Demand-signal discovery |
+|---|---|---|
+| Starts from | A firmographic ICP | A described problem |
+| Sources | Contact databases (Apollo, ZoomInfo, Clay) | Public discourse (forums, reviews, issues, posts) |
+| Contact step | Enrich + verify email deliverability | None — reach them where they already posted |
+| Wins on | Coverage at scale | 10 strong evidence-backed matches over a long list |
+| Output | A scored lead sheet | An evidence report + manual outreach plan |
+
+A prospect here without a cited pain, need, or timing signal is a speculative fit — it does **not** belong in the primary shortlist. Evidence is the entry ticket.
+
+## Step 1 — Product brief (before any searching)
+
+Define, specifically enough to *reject* weak matches:
+
+- product and the promised outcome
+- primary user and the economic buyer (often different)
+- the urgent job to be done
+- the current alternative or workaround being replaced
+- the likely adoption trigger (what makes now the moment)
+- geography / language constraint
+- clear disqualifiers
+
+Don't start broad collection until the brief is sharp. Pull from `.agents/product-marketing.md` if it exists.
+
+## Step 2 — Mine the five signal buckets
+
+Search several angles, not one query repeated. Adapt wording to how the audience actually talks (mine their vocabulary from organic content first — see the ad-creative hook-system's organic-language note for the same idea).
+
+1. **Explicit demand** — "looking for," "recommend a tool for," "alternative to [X]," "does anything exist that," "how do you all handle."
+2. **Pain** — "takes hours," "so manual," "hate that," "keeps breaking," "biggest frustration with," "why is there no."
+3. **Workaround** — spreadsheets, copy-paste, a VA, a Zapier chain, a script, a template, any repeated manual step that your product would replace.
+4. **Switching** — cancellation, migration, "moving off [competitor]," a missing feature, a pricing complaint, competitor frustration.
+5. **Timing** — a public launch, a new hire for the relevant function, expansion, a new workflow or regulation, an integration announcement — a *current* event that makes the product relevant now.
+
+**Use our live-recency edge.** A generic skill relies on whatever a web search surfaces; you have better:
+- **last30days** — Reddit, Hacker News, X, YouTube, and web signals from the last 30 days. This is the single highest-value tool for this branch: recency *is* the timing signal.
+- **social-fetch** — pull the full content of a specific post/thread you find, normalized.
+- **scraping** / **Firecrawl** / **Browserbase** — read the original public page (a forum thread, a GitHub issue, a review), never qualify from a search snippet alone.
+- **deep-research** — for a multi-source sweep with adversarial verification when the wedge is broad.
+- **competitor-profiling** / **customer-research** — competitor switching signals and review-mining for the pain language.
+
+## Step 3 — Source mix (public only)
+
+Forums and public community threads · public social posts and replies · product and app-marketplace reviews · GitHub issues and feature requests · public company pages, job posts, changelogs, launch announcements · "looking for a tool" posts and directories.
+
+Avoid private groups, gated communities, data brokers, leaked datasets, and any source whose terms prohibit access — the same compliance guardrails as every other branch (see SKILL.md), including the no-sensitive-traits rule.
+
+**Business/professional context only.** Qualify and reach out only where someone is posting in a professional or business capacity about a work problem (a founder in an indie-hackers thread, a developer in a GitHub issue, an ops lead in a subreddit for their role). Exclude personal-distress contexts entirely — health, financial hardship, addiction, grief, or any consumer support forum where people are venting personal problems, even if your product is tangentially relevant. When the motion is genuinely consumer (B2C), a public pain post is not on its own a lawful basis for cold outreach — reach people through the channel's own norms (reply publicly where replying is expected) and never DM a stranger off a personal post.
+
+Quote minimally, paraphrase by default, and link every material pain or timing signal.
+
+## Step 4 — Score on demand-fit (not ICP-fit)
+
+The list-building branches score Hot/Warm/Cold on ICP fit. This branch scores 0–100 on **demand fit** — how strongly the evidence says this specific prospect wants this specific thing now. Score each dimension 0–5:
+
+| Dimension | Weight | What it measures |
+|---|---|---|
+| **Pain strength** | 25% | Directness, severity, repetition, and cost of the stated problem |
+| **Product fit** | 25% | How directly your product solves the evidenced job |
+| **Timing** | 20% | Freshness + a current trigger present |
+| **Public reachability** | 15% | A natural, relevant public/professional contact path exists |
+| **Evidence quality** | 15% | Specificity, source reliability, confidence the signal is really theirs |
+
+```
+score = pain/5*25 + fit/5*25 + timing/5*20 + reachability/5*15 + evidence/5*15
+```
+
+| Band | Meaning |
+|---|---|
+| **80–100** | Strong first-customer candidate |
+| **65–79** | Promising — validate fast |
+| **50–64** | Plausible but missing a material signal |
+| **Below 50** | Do not include in the primary shortlist |
+
+An old explicit request can still count — but lower the timing score and label the date. A company that merely matches the industry with no evidenced trigger is *not* a qualified prospect here.
+
+### Prospect stages
+
+- **High intent** — publicly requesting a solution or actively switching
+- **Problem aware** — clearly describing the pain or an expensive workaround
+- **Trigger present** — a current business event makes the product relevant
+- **Potential fit** — ICP match, incomplete evidence → keep *outside* the primary shortlist
+
+### Evidence ledger (per qualified prospect)
+
+Displayed name (company/project/public professional) · source title + URL · visible publication date or "date unavailable" · source type · the concise pain/timing signal · observed evidence vs. inference (label which) · score breakdown · freshness warning when the signal is stale.
+
+## Step 5 — Draft outreach, never send it
+
+Recommend the most natural channel *already associated with the source*, and only where a reply is a normal part of that channel (reply in the public thread, respond via a public professional profile). Don't turn a public post into a private DM the poster didn't invite, and never contact someone off a personal-distress post. Draft one opener, under ~90 words, in this shape:
+
+1. mention the public context naturally
+2. connect it to the exact problem
+3. explain the product in one sentence
+4. ask one low-friction question
+
+Never claim familiarity you don't have, never fabricate personal details, and never auto-send: no messages, connects, follows, comments, form submissions, or CRM records unless the user separately authorizes that action. This is the manual/gated posture from the marketing-loops guardrails.
+
+## Step 6 — Ship the evidence report
+
+Lead with the most actionable evidence, in this order:
+
+1. **Verdict** — does the product have reachable early-customer signal, or not yet? (An honest "not yet, here's why" is a valid answer.)
+2. **ICP** — buyer, job, trigger, disqualifiers.
+3. **Top prospect** — the single strongest evidence-backed candidate and why now.
+4. **Prospect shortlist** — per prospect: source, pain signal, demand-fit score, stage, why-now, channel, opener.
+5. **Repeated patterns** — pains and triggers recurring across prospects (these are your positioning and messaging gold).
+6. **Seven-day manual outreach plan** — a low-volume validation sequence (e.g., contact the top 3 with one source-based question; share a mockup only after they confirm the pain; target three conversations and one design-partner commitment).
+7. **Limits** — what evidence is missing and what must be confirmed through real conversations.
+
+For a shareable standalone HTML version of this report, the JSON→HTML generator pattern in ad-creative's [creative-review-page.md](../../ad-creative/references/creative-review-page.md) is the model (escape every value; keep it self-contained).
+
+## The honesty rules (non-negotiable)
+
+- Every primary prospect links to at least one real public signal. No signal, no shortlist.
+- Label the output **"potential customer based on public signals"** — never "interested," "will buy," or "has consented."
+- Prefer ten strong matches over a long generic list. Make uncertainty and stale evidence visible.
+- Personalize from the cited source, not from invented assumptions.
+- Treat the shortlist as a research hypothesis to validate through conversations, not a customer database.