@vextlabs/theron-cli 0.3.0 → 0.4.0

package/skills/content-calendar.md

@@ -0,0 +1,280 @@
+---
+name: content-calendar
+description: Engineer a multi-month content calendar for a digital product or research AI platform — define content pillars, a repeatable series arc, native platform format per channel, engagement metrics to track (saves/shares over vanity), realistic cadence, and sponsorship disclosure; invoke when launching a brand, scaling social presence, or productizing thought leadership at a tech company.
+allowed-tools: Read, Write
+---
+
+═══ HARD RULES ═══
+
+1. NEVER start with "here's our product, what should we post?" — start with the specific job the target audience is trying to do and the one thread that ties all content to that job.
+2. NEVER confuse content pillars with messaging pillars. Pillars are durable archetypes (e.g., "mechanism reveal", "user win", "methodology") that repeat across months; they are NOT the same as positioning statements.
+3. NEVER optimize for vanity metrics (impressions, follower count, likes). Optimize for the ONE metric that proves engagement: saves/bookmarks for thought-leadership, shares for viral, replies/questions for community education. Measure it explicitly in the calendar.
+4. NEVER post the same asset on LinkedIn and Twitter and Instagram as if format does not matter. Rewrite every post for platform norms: LinkedIn = professional context + longer form; Twitter = sharp, controversial-or-novel + quote-threads; Instagram = visual-first + narrative caption; TikTok = movement + personality; YouTube = depth.
+5. NEVER hide sponsorships or affiliate relationships. Disclose in the first sentence with a flag (#ad, "In partnership with…", "Paid by…") even if legal does not require it. Undisclosed partnerships erode audience trust and are a brand landmine.
+6. NEVER build a calendar with a mix of permanent and temporary columns — the calendar must be readable and actionable for whoever executes it (founder, community manager, agency). Lock the structure from month one and reuse it.
+7. NEVER treat cadence as fixed. If the content is genuinely novel weekly, ship it weekly. If it's best executed monthly or biweekly, lock that and communicate it publicly so the audience knows when to expect it. Irregular cadence kills habit-formation.
+8. NEVER write copy in the calendar itself — write only the content blueprint (pillar, hook, evidence type, metric to track) and the lead. The final copy is written on-platform by the executor, not copied-pasted from a doc.
+9. NEVER publish a "series" that is not repeatable at least 3 times with different examples. One-off themed posts are not a series. A series must have a named arc with a replicable template (e.g., "Mechanism Reveal — problem statement → physics proof → one-line application").
+10. NEVER assume all audience members will engage the same way. Segment content by buyer journey stage (awareness = education; consideration = comparison; decision = proof; retained = expansion) and map posts to each stage.
+11. NEVER set absolute engagement targets without anchoring them to your current audience size and baseline. A target of "100 saves" is meaningless for a 300-follower account and insulting for a 200K-follower account. All targets must be expressed as multiples of recent baseline (e.g., "2× your current per-post save average within 8 weeks").
+12. NEVER rely on organic reach alone for seeding a new series or pillar. The first 30–60 minutes of engagement after publication is the window the platform algorithm uses to decide distribution. Plan for seed amplification (internal team engagement, curated DMs to warm contacts, cross-post to relevant community threads) every time.
+
+═══ PHASE A — AUDIENCE SEGMENTATION & JOB-TO-BE-DONE ═══
+
+A1. Define the target audience with specificity — not just "AI practitioners" or "engineers," but:
+   - **Role cluster** (researcher, applied engineer, decision-maker, practitioner learning solo)
+   - **Stage in journey** (exploring the space, evaluating options, building, proving, scaling)
+   - **Success metric they own** (cost per inference, time to deploy, audit trail, accuracy on real data, team velocity)
+   - **Frustration with the status quo** (existing solutions are too expensive, too slow, not auditable, a research dead-end)
+
+A2. For each segment, write the one-sentence job-to-be-done: "I need to [action] so that [outcome]." Example: "I need to understand whether verifiable AI is possible at scale so that I can decide if this is the future I want to work on." Or: "I need to see a working mechanism for multi-step reasoning so that I can trust it in a real application."
+
+A3. Enumerate the channels where each segment is native:
+   - **Researchers**: preprint platforms (arXiv threads, Twitter/X), long-form (Substack, blogs), conferences
+   - **Applied engineers**: GitHub discussions, Discord/Slack communities, Twitter/X code clips
+   - **Decision-makers/CTOs**: LinkedIn (curated, long-form), email (newsletter), webinars
+   - **Practitioners**: YouTube tutorials, TikTok/Instagram (visual learnings), Reddit, Discord communities
+   
+   NEVER assume one channel reaches all. Pick top 2–3 per segment and go deep instead of shallow across 10 channels.
+
+A4. BREAK FLAG: if you cannot name at least 2 concrete segments with different jobs-to-be-done, the calendar is too generic. Stop and interview 5–10 audience members before proceeding.
+
+═══ PHASE B — CONTENT PILLAR ARCHITECTURE ═══
+
+B1. Define the **core pillars** — these are the repeating content archetypes that prove your thesis over time:
+   - **Mechanism reveals**: explain one component of your system or insight, with proof. Format: problem → math/code → application. Not aspirational.
+   - **User/customer wins**: a real person achieved X using your platform/approach. Format: challenge → how they solved it → the number (time saved, cost cut, accuracy gain).
+   - **Methodology deep-dives**: a replicable process or framework. Format: problem it solves → step-by-step walkthrough → when to use it vs. alternatives.
+   - **Research audit trails**: thinking-in-public about a hard problem. Format: hypothesis → experiment → result (pass/fail, with evidence) → next question.
+   - **Anti-hype clarifications**: correct a misconception in the field. Format: "Everyone says X → here's why that's incomplete → here's what actually happens (with proof)."
+   - **Technical artifacts**: code, benchmarks, evaluation datasets, open-source tools released with documentation.
+   - **Founder/team voice**: the human behind the work — motivation, learning, team philosophy (sparingly; 1 per month max).
+
+B2. For each pillar, write the **template** (the repeatable shape):
+   Example (Mechanism Reveals):
+   - **Hook (first 7 words)**: "Here's the one thing most [claim-category] miss" OR "We spent 6 months on this" OR "[Problem] is unsolvable — here's why"
+   - **Context** (1–2 sentences): What makes this mechanism non-obvious or valuable?
+   - **Core content** (mechanism, proof, or framework itself): The substance. Not a sales pitch.
+   - **Application**: One sentence: "This means [outcome for the job-to-be-done]."
+   - **Metric to track**: Saves, shares, replies with technical questions (not comments like "cool post").
+
+B3. Assign a **color or label** to each pillar for calendar visualization (useful for scanning at a glance, regardless of which tool you use to maintain the calendar).
+
+B4. Decide on **pillar distribution**: how many posts per month belong to each pillar? Example:
+   - 40% mechanism reveals (2–3 per month)
+   - 25% user wins (1–2 per month)
+   - 20% methodology / audit trails (1–2 per month)
+   - 10% anti-hype (0–1 per month)
+   - 5% founder voice or technical artifacts (as they ship)
+   
+   These ratios are starting points, not law. Rebalance monthly based on what the metrics tell you (Phase F).
+
+B5. BREAK FLAG: if you have more than 6–7 pillars, the calendar will lack focus. Consolidate or cut.
+
+═══ PHASE C — REPEATABLE SERIES ARCHITECTURE ═══
+
+C1. Design **one signature series** (this is different from pillars; it's a multi-post narrative arc):
+   - **Title**: name it for the audience's job, not your brand. Examples: "First Principles Fridays" (researchers), "Bench Marks" (engineers who trust data over claims), "One Decision" (decision-makers who want the net of a long analysis in 3 minutes).
+   - **Frequency**: weekly, biweekly, or monthly. Lock it.
+   - **Episode structure** (the template for each installment):
+     * Episodic arc example (audit trail): "Bench Marks: [topic] — What vendors claim → what the data says → why the gap exists"
+     * Episodic teaching: "First Principles: [concept] — The naive model most people use → why it breaks → the corrected model with an example"
+   - **How many episodes minimum**: at least 6 confirmed before you announce the series publicly; aim for 12–24 in the pipeline (so you ship twice/month for a year without running dry).
+
+C2. Map the series across your calendar in a visible way (e.g., "Wednesdays at 9am PT = series episode drops").
+
+C3. For each series episode, define:
+   - The specific mechanism/finding/benchmark it covers
+   - The primary audience segment it addresses
+   - The metric to track (e.g., "saves by engineers" vs. "shares by researchers")
+   - The call-to-action (if any): link to full write-up, GitHub repo, discussion thread, or nothing (education-only is fine).
+
+C4. BREAK FLAG: if you cannot commit to the series frequency for 12 months with current resources, do not call it a series. Call it "occasional deep-dives" and post it ad-hoc. A broken series is worse than no series.
+
+═══ PHASE D — PLATFORM-NATIVE FORMATTING ═══
+
+D1. For each channel, lock the **format and copy norms**:
+
+   **Twitter/X:**
+   - Thread format (4–8 tweets max): hook → escalation → proof/artifact → application.
+   - Copy: short sentences. One idea per tweet. Use line breaks for rhythm.
+   - Assets: code snippets (as quoted text or images), charts, one headline quote.
+   - Metric: retweets with comments (questions, corrections) > bookmarks > likes.
+   - Posting: 9am or 5pm PT, Wed–Fri (peak tech audience engagement window; verify against your own analytics after 4 weeks).
+
+   **LinkedIn:**
+   - Format: one long-form post (600–1200 words, or a "document" post with formatted blocks).
+   - Copy: professional but direct. Lead with the insight. Avoid ALL CAPS and emoji spam.
+   - Assets: one high-quality image or chart per post. Video (60–120 sec) if available.
+   - Hook: first-person and specific — "Here's what changed in the last 6 months..." OR "This surprised us in the data..." not "Excited to share..."
+   - Metric: shares (not likes); comments from domain practitioners count more than generic praise.
+   - Posting: 8am–12pm ET, Tue–Thu.
+
+   **YouTube (if included):**
+   - Format: recorded explanation video (6–12 min for technical, 3–5 min for punchy mechanism reveal). Slides + voiceover or visual demo preferred over talking head alone.
+   - Hook (first 10 seconds): "By the end of this video, you'll know why [common belief] is wrong and what actually happens instead."
+   - Metric: watch-through rate (completion %), not subscriber count. Aim for 40%+ completion on technical content; 55%+ on short-form punchy videos.
+   - Call-to-action: "The code is on GitHub. Link in the description." One CTA per video.
+
+   **Substack/Newsletter:**
+   - Format: 1000–2000 words per issue. One deep idea, not a round-up of links.
+   - Tone: thinking-in-public, not fully baked. Include uncertainty — readers forward newsletters that feel honest, not polished.
+   - Metric: reply rate, forward rate (for paid), click-through to related content.
+   - Cadence: weekly or biweekly, lock it. Consistency > frequency.
+
+D2. For each pillar + channel combination, create a **copy template** (not the final copy, but the shape):
+   Example: Mechanism Reveal on Twitter = "Here's [the one thing missed] [proof in 2 tweets] [why it matters] [link to full write-up if >280 chars of context needed]"
+
+D3. Define **asset requirements** per channel:
+   - Twitter: code snippets, 1–2 charts, no embedded video (links OK).
+   - LinkedIn: 1 high-res image or chart. Document carousel (5–10 slides) for methodology posts.
+   - YouTube: slides, screen recording, or animated explainer. Thumbnail with visible text.
+   - Substack: inline charts or equations, link references (no embedded video).
+
+═══ PHASE E — CADENCE & REALISTIC EXECUTION ═══
+
+E1. Map the **monthly posting schedule** (not individual posts, but the pattern):
+   ```
+   Week 1: Mechanism Reveal (Twitter thread + LinkedIn) + seed amplification wave (30-min post-publish)
+   Week 2: Series episode (all channels) + community reply engagement (respond to every substantive comment within 24 hours)
+   Week 3: Methodology or anti-hype post (LinkedIn + Twitter) + share to 2–3 relevant communities
+   Week 4: Audit trail / research update OR founder voice OR month-end retrospective post
+   ```
+   This pattern achieves: 1 series per month + 2–3 mechanism reveals + 1 methodology + 1 user win + community engagement = sustainable for a 1–2 person team.
+
+E2. Calculate **execution overhead** (ranges, not fixed numbers — actual time varies by how much pre-existing research exists):
+   - Mechanism reveal: research (3–10 hours depending on novelty) + writing (2–4 hours) + platform posting and assets (1–2 hours).
+   - Series episode: 2–5 hours (lower end if the mechanism was pre-researched in a previous post).
+   - User win: interview (1–2 hours) + write-up (1 hour) + assets (30 min).
+   - Anti-hype post: research to find the real data (2–4 hours, longer if the claim is poorly documented) + write (1–2 hours) + post (1 hour).
+   
+   Lock a **weekly time budget** and fit the calendar to it — do not build a calendar that assumes a workload you cannot sustain without dropping quality.
+
+E3. Build a **content buffer**:
+   - For repeatable pillars (mechanism reveals, methodology), batch-produce 4 weeks of content every quarter.
+   - For time-sensitive content (user wins, anti-hype responses to breaking field developments), keep a 1–2 week buffer ahead of publication.
+   - For the series, maintain a 3–6 episode lead (so you ship on schedule even if a research result comes back later than expected).
+
+E4. Set a **publication calendar** visible to the team with these columns (spreadsheet, Trello, Airtable, or any kanban tool — format does not matter, consistency does):
+   - Date and time (specific, e.g., "Wednesday 9am PT").
+   - Pillar and series name.
+   - Lead/hook (2–3 words max, just enough to identify the draft).
+   - Responsible person.
+   - Status: backlog / in-research / draft / review / scheduled / published / metric-captured.
+
+E5. Plan the **seed amplification window** for every post:
+   - Identify 3–5 warm contacts (colleagues, engaged followers, community members) who will engage meaningfully within the first hour of publication.
+   - Do not ask for likes — ask specific people to share their actual reaction or a question in the comments. Genuine engagement beats coordinated likes; platforms flag sudden like spikes as manipulation.
+   - Cross-post to 1–2 relevant community channels (Discord, Slack, Reddit) where the content is genuinely on-topic. Never spam; only post where you are an active, recognized participant.
+
+E6. BREAK FLAG: if you cannot sustain the calendar for 6 months with current resources, cut frequency or pillars. A smaller, consistent calendar beats an ambitious, sporadic one. Announce the reduced cadence publicly so your audience adjusts expectations.
+
+═══ PHASE F — METRICS & FEEDBACK LOOPS ═══
+
+F1. Define the **north-star metric per audience segment**, expressed as a multiple of your current baseline (never as an absolute target decoupled from your current scale):
+   - **Researchers/engineers**: saves + technical replies (questions about mechanism, reproducibility, code). Target: 2–3× your current per-post save average within 8 weeks.
+   - **Decision-makers**: shares + profile-view uplift in the 7 days after publication. Target: 2× current share rate; 10%+ profile-view increase in the following week.
+   - **Community**: reply rate + community-initiated discussions. Target: reply rate 2× your current average; 1+ user-initiated thread per post within 48 hours.
+   
+   Do NOT track likes, impressions, or follower growth unless you can demonstrate they correlate to the north-star metric in your own data.
+
+F2. For the series, track:
+   - **Episode-over-episode engagement**: is engagement on series #2 equal to or better than series #1? Decline after episode 3 signals topic saturation or format fatigue.
+   - **Cumulative series effect**: are people who land on a series post first more likely to follow and engage with subsequent content? Track this as a new-follower cohort comparison (series-landing vs. non-series-landing) over 30 days.
+
+F3. Set up a **weekly review** (15 min):
+   - Which post types drove the north-star metric? Celebrate or double down.
+   - Which fell flat? Investigate: was it the pillar, the platform, the timing, the seed amplification, or execution quality?
+   - Any community questions that suggest a content gap? Add to backlog.
+
+F4. Run a **monthly deep-dive** (1 hour):
+   - Aggregate pillar performance: does the 40% mechanism reveal allocation match the actual engagement? Rebalance distribution if the data says to.
+   - Series trend: is it improving, stable, or declining? If declining for 3+ consecutive episodes, ship a 4-week hiatus announcement, regroup, and relaunch with a new angle or merge into another pillar.
+   - Audience feedback: read replies, DMs, and relevant community threads. Did the audience ask for something you are not shipping? Treat that as a pillar proposal, not noise.
+
+F5. BREAK FLAG: if engagement metrics are flat or declining after 4 weeks of consistent posting, do not blame the algorithm as a first resort. Investigate the actual content:
+   - Is the hook strong enough (first 7 words)?
+   - Is the copy platform-appropriate, or is it LinkedIn-speak on Twitter?
+   - Is the evidence real and specific, or is it abstract and hedged?
+   - Was the seed amplification window used? Did you engage with early comments within 1 hour?
+   - Is the audience actually on this platform, or are you talking to the wrong people in the wrong place?
+
+═══ PHASE G — SPONSORSHIPS & DISCLOSURE ═══
+
+G1. Define what can be sponsored (and what cannot):
+   - **Can be sponsored**: a tool, platform, or service that genuinely solves a problem you discuss. Example: "This mechanism reveal is brought to you by [tool], which automates [step]."
+   - **Cannot be sponsored**: audit content, anti-hype posts, or benchmark posts where the sponsor is a competitor or a party to the claim being evaluated. These must remain vendor-neutral.
+   - **Gray zone (requires transparency)**: featuring a partner's research or case study without payment — disclose the relationship even if no money changed hands.
+
+G2. Write the **disclosure template**:
+   "**[This post / this episode] is brought to you by [sponsor name], who [one-line value].** We use [their tool/service] for [specific use case]. [Link to sponsor landing page or CTA.]"
+   
+   Keep it to 1–2 sentences max. Place it at the end of the post for thought-leadership content; at the start for explicitly promotional posts (audiences have been trained to scroll past buried disclosures).
+
+G3. Limit sponsorship to **no more than 1 per 4 posts** (25% max of your calendar is sponsored). More than that, and your audience will assume everything is an ad, including the organic content.
+
+G4. NEVER allow a sponsor to dictate the content shape, the claim, or the conclusion. They own the one-liner disclosure; the research and evidence are yours.
+
+G5. BREAK FLAG: if accepting a sponsorship requires you to soften a criticism, omit a competitor result, or change a benchmark methodology, decline it. Undisclosed bias destroys the trust that makes the content valuable — the same trust the sponsor paid to be adjacent to.
+
+═══ PHASE H — CALENDAR SYNTHESIS & ROLLOUT ═══
+
+H1. Build the **quarterly calendar** (12–16 weeks) with these columns:
+   | Week | Date | Pillar | Series? | Hook (3–5 words) | Platform(s) | Audience Segment | North-Star Metric | Lead/Owner | Status |
+   
+   Fill in all recurring pillars first (mechanism reveals every other week, series on its locked cadence, etc.), then layer in user wins, methodology, and community responses based on your buffer state.
+
+H2. Create a **content pipeline** in five stages (use whatever tracking tool your team already uses — the stages matter, not the software):
+   - **Backlog** (ideas not yet researched): candidate mechanisms, user interview subjects, methodologies to explore, claims to audit.
+   - **In research** (2–4 weeks out): experiments running, data being collected, interviews scheduled.
+   - **Draft** (1–2 weeks out): written, fact-checked, assets created, awaiting approval.
+   - **Scheduled** (published to platform queue): live, awaiting post time.
+   - **Published & metered** (1–2 weeks old): metric capture underway; awaiting the weekly review.
+
+H3. Assign **content owners**:
+   - One person (often founder) = pillars with highest intellectual risk (mechanism reveals, anti-hype, series).
+   - One person (community lead or marketer) = user wins, community engagement, user-initiated content.
+   - One person (optional, seasonal) = guest posts, partnerships, affiliate/sponsored content.
+
+H4. Set a **go-live date** for the calendar. Use a quiet launch:
+   - Week 1: ship the first 2–3 posts. Test seed amplification. Capture metrics.
+   - Week 2: measure response, refine the hook/timing/format based on real data.
+   - Week 3+: publish on cadence.
+   - Do NOT announce the series or calendar publicly until you have proven 4+ consecutive weeks of on-schedule delivery.
+
+H5. Output the **final calendar document**:
+   - Cover page: audience segments + jobs-to-be-done, pillar architecture + distribution, series roadmap.
+   - Quarterly calendar table: all 12–16 weeks populated.
+   - Execution guide: platform-native formatting templates, asset requirements, seed amplification plan, review cadence.
+   - Metrics & review framework: north-star definitions as multiples of baseline, weekly/monthly check-in agenda.
+   - Sponsorship policy & disclosure templates.
+   - Content pipeline board (linked or appended).
+
+═══ PHASE I — HARD STOP RULE: WHEN TO KILL, PIVOT, OR RESET ═══
+
+I1. Kill a pillar if:
+   - The north-star metric is 50%+ below target for 4+ consecutive posts, AND
+   - Feedback suggests the problem is inherent to the pillar type, not execution, AND
+   - You have invested significant time trying to fix it with no improvement trend.
+   → Pivot to a new pillar based on backlog ideas or direct audience requests.
+
+I2. Kill the series if:
+   - Episode engagement drops 40%+ episode-over-episode after 6+ episodes, AND
+   - It is not due to an external event (platform algorithm change, competitor launch, news cycle), AND
+   - Audience feedback suggests the series topic is saturated or tangential to the core job-to-be-done.
+   → Announce a 4-week hiatus ("We're regrouping on this one"), research hard, relaunch with a new angle or merge it into a pillar.
+
+I3. Reduce posting frequency (not kill) if:
+   - You are consistently late shipping on schedule (more than 3 missed posts in a quarter), AND
+   - Content quality is declining (hooks weaker, evidence less rigorous, copy less polished).
+   → Cut cadence by 1 post/month, batch-produce 8 weeks of buffer, and relaunch. Announce the new cadence publicly.
+
+I4. **Reset the entire calendar** (different from killing individual pillars or series) if:
+   - The brand thesis or product positioning has materially changed, OR
+   - The target audience has shifted (e.g., pivoted from individual practitioners to enterprise buyers), OR
+   - The existing calendar was built without data and has produced 8+ weeks of flat metrics across all pillars.
+   → Do not keep publishing on momentum. Stop, run Phase A and Phase B from scratch with current data, and relaunch with an explicit announcement: "We're refocusing on [job-to-be-done]." Audiences respect honest pivots more than content drift.
+
+═══ KEY PRINCIPLE ═══
+
+A content calendar is not a publishing queue — it is a **mechanism for proving a thesis over time**. Every post should ladder to your core job-to-be-done; every pillar should appear in your north-star metric; every series should become more valuable for the audience (not just for you) as it continues. Consistency, platform-native execution, seed amplification, and metric discipline beat virality by an order of magnitude. The calendar that ships every week at 70% quality outlasts the one that ships every month at 100%.

package/skills/contract-review.md

@@ -0,0 +1,155 @@
+---
+name: contract-review
+description: Clause-by-clause contract redline — flags red-flag, missing, and one-sided terms by risk severity, cites governing market norms, and proposes specific replacement language; never invents statutes or cases.
+allowed-tools: Read, WebSearch, WebFetch, Write
+---
+
+## STANCE RULE (non-negotiable)
+
+You are a senior transactional attorney conducting a redline review on behalf of the party who provided the contract. Every clause is adversarial until proven balanced. Assume the drafting party wrote every ambiguity in their favor — because they did. "Looks standard" is not a finding; "standard for whom, and verified against what market data" is. Distinguish **confirmed one-sided** (language unambiguously favors the other party) from **suspected** (ambiguous, requires clarifying intent before accepting). Never fabricate statutes, case citations, or boilerplate figures as if ground truth — cite market norm, note jurisdiction uncertainty, and flag where the user should verify with local counsel.
+
+---
+
+═══ HARD RULES ═══
+
+- Never downgrade a risk because the clause "seems normal." Normal for whom? Cite the market benchmark or say you cannot.
+- Never invent a statute, case name, code section, or regulatory cite you are not certain exists. Write "verify with counsel in [jurisdiction]" instead.
+- Never end a phase with "no issues found" unless you read every clause in that phase category and explicitly confirmed each is balanced.
+- Every finding must quote the exact offending clause text or sub-phrase. No paraphrase-only findings.
+- Every proposed replacement must be complete, paste-ready language — not "consider adding a carve-out."
+- Flag governing law and jurisdiction on first encounter; all downstream risk assessments depend on it.
+- Distinguish what the contract says from what it means in practice (i.e., note if enforcement is theoretically possible but commercially unrealistic).
+- If a clause is missing entirely, say so explicitly — missing terms are findings, not absences.
+- Never accept "industry standard" from the other side without independently verifying against a named benchmark (e.g., NVCA model documents, AIA forms, ISDA, NEC, FIDIC, AIIA, or jurisdiction-specific statutory defaults).
+
+---
+
+═══ PHASE A — CONTRACT ORIENTATION ═══
+
+1. **Identify the instrument type:** Is this an NDA, SaaS subscription, professional services agreement, employment agreement, IP assignment, license, M&A document (APA/SPA), loan agreement, partnership/JV agreement, or other? The risk profile is instrument-specific — confirm before proceeding.
+2. **Extract the parties and their roles:** Identify drafter vs. counterparty, and which role your client occupies. Every asymmetric clause must be evaluated from your client's seat, not in the abstract.
+3. **Note governing law and jurisdiction:** Pull the governing law clause verbatim. Flag if it is in a jurisdiction unfavorable to your client (e.g., seller-friendly Delaware for an IP licensor dispute, or a foreign arbitration seat for a domestic SMB). Note that all downstream risk ratings assume the stated jurisdiction; verify with local counsel where flagged.
+4. **Note effective date, term, and any auto-renewal provisions:** Confirm whether the term is definite or indefinite, whether renewal is automatic or affirmative, and what the notice window for non-renewal is. A 90-day non-renewal notice with auto-renewal = a de facto lock-in clause.
+5. **Identify the economic core:** What is the primary obligation — payment, license grant, service delivery, transfer of assets, IP creation? Every other clause will be assessed relative to how it shifts risk on the economic core.
+
+---
+
+═══ PHASE B — DEFINITIONS ═══
+
+6. Read every defined term. For each, ask: (a) Is the definition broader or narrower than plain meaning in a way that advantages the other party? (b) Are key commercial terms (Confidential Information, Intellectual Property, Derivative Works, Deliverables, Claim, Loss) defined? Undefined commercial terms are findings — courts will fill them by statute or common law, often unpredictably.
+7. **"Confidential Information" scope:** Over-broad definitions (e.g., "all information disclosed in any form") with no carve-outs for publicly available information, independently developed information, or information already known are one-sided. Market norm: four standard carve-outs (public domain, independently developed, already known, received from third party without restriction) are expected in a balanced NDA.
+8. **"Intellectual Property" and "Work Made for Hire":** Flag any definition that sweeps in pre-existing IP, background IP, or IP developed outside the scope of the engagement. Market norm for services agreements: the contract should distinguish (a) pre-existing IP (each party retains); (b) project-specific deliverables (negotiated); (c) general tools/methods (vendor retains with license-back). Any definition that assigns all of category (c) to the client is a red flag for a service provider.
+9. **"Affiliate" and "Subsidiary" definitions:** Broad affiliate definitions in indemnity, non-compete, and license clauses exponentially expand obligation scope. Note every clause where Affiliate scope matters and flag if the definition is unbounded (e.g., no percentage threshold, no exclusion of portfolio companies for PE-backed entities).
+
+---
+
+═══ PHASE C — PAYMENT, FEES, AND FINANCIAL TERMS ═══
+
+10. **Payment terms:** Extract the payment due date, invoice trigger, and late payment consequences. Net 30 is a common SMB default; Net 60-90 favors the payer. Late payment interest rate: statutory rate vs. a specified rate (e.g., 1.5%/month = 18% APR — flag if above usury limits for the governing jurisdiction, which you should verify with local counsel).
+11. **Price adjustment and indexing:** Can the vendor unilaterally increase fees? Flag any clause permitting fee increases without a cap, without notice, or without a termination right for the other party. Market norm for SaaS: CPI-indexed annual increases with a cap (commonly 5-7%) and a 30-60 day pre-increase notice are balanced; uncapped unilateral increases are one-sided.
+12. **Expense reimbursement:** Is there a cap? A pre-approval requirement? A receipts requirement? Uncapped expense reimbursement with no pre-approval is a red-flag opening for abuse.
+13. **Taxes:** Who bears withholding tax, VAT/GST, and sales tax? In cross-border agreements, the absence of a gross-up clause for withholding tax is a finding for the payee party.
+14. **Payment disputes and suspension:** Can the paying party withhold payment for a disputed portion without triggering a default? Flag any clause that treats a good-faith payment dispute as a material breach allowing contract termination — this is one-sided against the payer.
+
+---
+
+═══ PHASE D — INTELLECTUAL PROPERTY OWNERSHIP AND LICENSE ═══
+
+15. **IP ownership waterfall:** Map who owns (a) pre-existing IP, (b) deliverables, (c) improvements to vendor tools, (d) data and training data derived from performance. Any clause that transfers ownership of (c) or (d) to the client without explicit carve-out is a red flag for the vendor.
+16. **License grant scope:** For any license grant, extract: exclusivity, territory, field of use, sublicense rights, revocability, and duration. A perpetual, irrevocable, worldwide, sublicensable license to a vendor's pre-existing IP is a near-total transfer without calling it one. Flag and propose a field-of-use or purpose limitation.
+17. **Work-made-for-hire provisions:** Under U.S. copyright law (17 U.S.C. § 101), the statutory categories of works qualifying as WMFH are limited. A blanket WMFH clause for non-qualifying works (e.g., software not specially ordered or commissioned under the statutory list) is legally ineffective but commercially confusing — flag and propose a parallel assignment clause as backup.
+18. **Non-compete and non-solicitation scope:** Extract duration, geographic scope, and activity scope. Note: enforceability varies dramatically by jurisdiction (e.g., California Business and Professions Code renders most employee non-competes void; other jurisdictions apply reasonableness tests). Flag overly broad non-competes and note that enforceability must be confirmed with local counsel.
+19. **Open source obligations:** Does the contract require delivery of software? Is there a representation that no deliverable incorporates copyleft-licensed open source (GPL, AGPL, LGPL) that could infect proprietary client IP? Absence of an open source representation in a software development agreement is a finding for the client.
+
+---
+
+═══ PHASE E — REPRESENTATIONS, WARRANTIES, AND DISCLAIMERS ═══
+
+20. **Affirmative warranties:** List every warranty the contract contains. Note whether each is: (a) time-limited (common: 90 days post-delivery for software); (b) limited to repair/replacement/refund; (c) subject to a disclaimer of implied warranties. Flag the absence of a basic fitness-for-purpose or workmanlike performance warranty in a services agreement — this is a red flag for the client.
+21. **"AS IS" disclaimers:** An AS IS disclaimer accompanied by no meaningful express warranty is a red flag for any party relying on the other's performance. Note whether the disclaimer complies with the jurisdiction's conspicuousness requirement (many jurisdictions, including those applying UCC Article 2, require disclaimers of implied warranties to be conspicuous).
+22. **Accuracy of representations:** In M&A or financing documents, check the survival period of representations. Market norm for M&A reps: 12-24 months post-closing for general reps; longer (or indefinite) for fundamental reps (title, authority, capitalization, fraud). Survival periods shorter than 12 months for general reps are one-sided for the seller.
+23. **Knowledge qualifiers:** "To Seller's knowledge" or "to the best of Seller's knowledge" qualifiers on reps reduce the rep to near-worthlessness if undefined. Market norm: knowledge should be defined as actual knowledge of specified individuals, or actual knowledge plus knowledge that would be obtained upon reasonable inquiry ("constructive knowledge"). Bare knowledge qualifiers with no definition are a red flag for the buyer.
+
+---
+
+═══ PHASE F — INDEMNIFICATION ═══
+
+24. **Indemnification scope:** Who indemnifies whom, for what categories of claims? Extract the full indemnification clause. One-sided indemnification (only one party indemnifies the other, with no mutual carve-outs) is a finding. Market norm for B2B services: mutual indemnification — each party indemnifies the other for its own IP infringement, gross negligence, and willful misconduct; each party indemnifies for third-party claims arising from its breach.
+25. **Indemnification triggers:** Does the indemnity require a final court judgment, or does it cover costs of defense as incurred? Defense costs as incurred (advance of legal fees) is more favorable to the indemnitee — flag its absence.
+26. **Indemnification carve-outs:** Flag if the indemnifying party can escape indemnity for: (a) modifications made by the indemnitee; (b) use of the deliverable in combination with third-party products; (c) failure to use an available workaround. These are legitimate vendor carve-outs for IP indemnity but should be mutual where modification risk runs both ways.
+27. **Indemnification procedure:** Is there a prompt notice requirement? A tender-of-defense right? A no-settlement-without-consent right for the indemnifying party? Missing procedural terms can inadvertently trigger indemnity forfeiture.
+
+---
+
+═══ PHASE G — LIMITATION OF LIABILITY ═══
+
+28. **Liability cap amount:** Extract the cap. Common market benchmarks by contract type: (a) SaaS/services: fees paid in the 12 months preceding the claim; (b) M&A: 10-20% of purchase price for general breach; (c) employment: statutory maximums; (d) finance: notional amount or facility amount. A cap set at one month's fees in a multi-year agreement is one-sided for the service provider.
+29. **Mutual vs. unilateral cap:** Does the cap apply to both parties equally? A cap on vendor liability with no corresponding cap on client liability (e.g., for payment obligations or IP misuse) is asymmetric — flag.
+30. **Consequential damages waiver:** Is the waiver mutual? Does it carve out: (a) confidentiality breaches; (b) IP infringement; (c) indemnification obligations; (d) fraud/willful misconduct; (e) death/personal injury? The absence of these carve-outs means a party who leaks a trade secret or infringes IP cannot be held for lost profits — a major red flag for the disclosing or IP-owning party.
+31. **Uncapped liabilities:** List every category of claim that is explicitly excluded from the cap. Market norm: fraud, willful misconduct, death/personal injury, and data breach obligations are commonly uncapped. An agreement that caps indemnification for data breaches or GDPR violations at 12 months' fees in a high-volume data processing context is a red flag.
+
+---
+
+═══ PHASE H — CONFIDENTIALITY ═══
+
+32. **Confidentiality term:** Does the confidentiality obligation survive termination? For how long? Market norm: 3-5 years post-termination for commercial agreements; perpetual for trade secrets (and required to preserve trade secret status under the Defend Trade Secrets Act (U.S.) or equivalent). A 1-year post-termination confidentiality period for genuinely proprietary information is a red flag.
+33. **Permitted disclosures:** Are disclosures to advisors, affiliates, and subcontractors permitted, and are they subject to equivalent confidentiality obligations? Unrestricted disclosure to "representatives" without a requirement that those representatives are bound is a gap.
+34. **Return or destruction:** Is there a return-or-destroy obligation upon termination, with a certification requirement? The absence of a destruction certification is a finding for the disclosing party.
+35. **Residuals clause:** Flag any "residuals" clause that permits the receiving party to use Confidential Information retained in unaided memory for any purpose. This is a significant carve-out that effectively licenses trade secrets to employees and should be flagged for negotiation or removal.
+
+---
+
+═══ PHASE I — TERM, TERMINATION, AND EXIT ═══
+
+36. **Termination for convenience:** Can either party terminate without cause, and on what notice? Asymmetric termination-for-convenience rights (only one party can terminate without cause) are one-sided. Market norm: mutual termination for convenience with 30-90 days' notice for services agreements.
+37. **Termination for cause:** What constitutes a material breach triggering termination? Is there a cure period? Market norm: 30 days' written notice and opportunity to cure for remediable breaches. Immediate termination rights for any breach (without a cure period) are one-sided.
+38. **Effects of termination:** What survives? What are the wind-down obligations? Does the vendor owe data portability or a migration period? The absence of a data-return or data-portability obligation upon termination of a SaaS agreement is a red flag for the client.
+39. **Termination for insolvency:** Flag if a termination-for-insolvency clause is present — these may be unenforceable ipso facto clauses under U.S. Bankruptcy Code § 365 or equivalent; verify with local counsel.
+40. **Post-termination obligations:** Are there non-compete, non-solicitation, or no-hire obligations that survive termination? Note duration and scope; flag enforceability concerns by jurisdiction.
+
+---
+
+═══ PHASE J — DISPUTE RESOLUTION ═══
+
+41. **Mandatory arbitration vs. litigation:** Flag mandatory arbitration clauses — note: (a) arbitration can be faster and more confidential, but removes the right to jury trial; (b) class action waivers in consumer or employment contexts have enforceability limitations in some jurisdictions; (c) arbitration clauses that specify a fee-allocation scheme other than each-party-pays-own may affect access.
+42. **Venue and jurisdiction:** Flag forum selection clauses that require disputes to be resolved in a jurisdiction inconvenient or unfavorable to your client. Courts generally enforce forum selection clauses; this is a negotiating point, not a legal defect, but must be flagged.
+43. **Escalation ladder:** Does the contract require negotiation, then mediation, then arbitration/litigation? Mandatory multi-step escalation can delay urgent injunctive relief — confirm the contract preserves the right to seek emergency equitable relief without exhausting the escalation ladder.
+44. **Prevailing party fee-shifting:** Does the contract include fee-shifting to the prevailing party? In the U.S., the American Rule means each party bears its own fees absent a contract or statute. Fee-shifting in a one-sided contract (e.g., fees only if the vendor prevails) is a red flag.
+
+---
+
+═══ PHASE K — DATA, PRIVACY, AND SECURITY (if applicable) ═══
+
+45. **Data processing terms:** If the agreement involves personal data, are there DPA/data processing addendum terms? Absent a DPA, cross-border data transfers under GDPR (EU), UK GDPR, or PIPEDA (Canada) may be non-compliant — flag for jurisdictions involved.
+46. **Security obligations:** Does the vendor commit to specific security standards (e.g., ISO 27001, SOC 2 Type II, NIST CSF)? A generic "reasonable security measures" obligation is nearly unenforceable. Market norm for SaaS handling sensitive data: SOC 2 Type II report obligation + right to audit or receive audit reports on a defined cadence.
+47. **Breach notification:** Is there a breach notification obligation with a defined timeline? GDPR requires 72 hours to the supervisory authority; CCPA/CPRA requires "expedient" notification. Any breach notification timeline longer than 72 hours in a GDPR context is non-compliant on its face.
+48. **Data retention and deletion:** Is there a defined retention period and a post-termination deletion obligation? The absence of a deletion obligation for personal data in a SaaS agreement is a GDPR/CCPA finding.
+
+---
+
+═══ PHASE L — FINDINGS TABLE ═══
+
+For every confirmed or suspected finding, produce one row in this exact format:
+
+| ID | Phase | Risk | Severity | Finding | Offending Clause (quote) | Market Norm / Standard | Proposed Replacement Language |
+|----|-------|------|----------|---------|--------------------------|------------------------|-------------------------------|
+| C1 | G | Liability Cap | HIGH | Cap set at 1 month fees — grossly below market for a multi-year engagement | "Vendor's total liability shall not exceed fees paid in the prior calendar month" | Market norm: 12 months of fees paid | "…shall not exceed the total fees paid by Client in the twelve (12) months immediately preceding the claim giving rise to liability" |
+| C2 | H | Confidentiality | HIGH | No post-termination confidentiality survival period | [clause absent] | Market norm: 3-5 years post-termination; perpetual for trade secrets | Add: "Confidentiality obligations shall survive termination or expiration of this Agreement for a period of five (5) years; provided that obligations with respect to trade secrets shall survive indefinitely." |
+
+Severity scale — **CRITICAL**: clause likely unenforceable, creates regulatory exposure, or could result in complete economic loss of the contract value; **HIGH**: materially one-sided, significant financial or legal risk; **MEDIUM**: below-market, limited exposure, or curable by negotiation; **LOW**: minor asymmetry or drafting ambiguity with minimal practical impact.
+
+---
+
+═══ PHASE M — EXECUTIVE REDLINE SUMMARY ═══
+
+After the table, produce:
+
+1. **Overall Risk Rating:** BLOCKED (one or more CRITICAL findings; do not execute as drafted) / HIGH RISK (multiple HIGH findings; significant renegotiation required) / MODERATE (HIGH or MEDIUM findings addressable in negotiation) / ACCEPTABLE (LOW findings only, proceed with documented acknowledgment).
+2. **Top 5 Issues by Priority:** Numbered list, each with: (a) the clause, (b) why it is one-sided, (c) the single most important fix.
+3. **Missing Clauses:** List every material term absent from the contract (e.g., missing IP ownership clause, missing SLA, missing data breach notification, missing limitation of liability carve-outs).
+4. **Jurisdiction Advisory:** Flag every clause where enforcement depends on the governing jurisdiction and where local counsel review is required before execution.
+5. **Negotiating Posture:** For each HIGH or CRITICAL finding, advise whether to (a) require deletion, (b) require replacement with proposed language, or (c) accept with a documented side letter or comfort letter.
+
+---
+
+KEY PRINCIPLE: A contract's risk is defined not by what it says but by what it will mean to a judge at 2 a.m. after your relationship with the counterparty has collapsed — read every clause in that frame.