agent-bober 0.17.1 → 0.19.0

package/skills/bober.seo-technical-audit/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: bober.seo-technical-audit
+description: "Per-workflow SEO signature library for the technical-audit workflow. A data file of discrete, cited SEO tactics read by SeoPlaybookParser (src/seo/parser.ts), not a workflow skill. Encodes leak-grounded ranking-mechanics signals (NavBoost click quality, contentEffort, hostAge sandbox, date consistency, named demotions) and GSC URL Inspection health-check practice for the technical-audit workflow."
+---
+
+# bober.seo-technical-audit — Technical Audit Signature Library
+
+This skill is a **signature-library** file for the `technical-audit` workflow, not a
+workflow skill in its own right. It is read (as raw markdown text) by
+`SeoPlaybookParser.parse()` (`src/seo/parser.ts`) and turned into typed
+`SeoSignature[]` records consumed by the SEO agent team's retriever
+(`SeoPlaybookRetriever`). It follows the identical block format defined and
+documented in `skills/bober.seo-generic/SKILL.md` ("Signature Block Format") --
+the two files are one executable spec; a block missing `Title` or
+`PrimarySourceUrl`, or tagged `PolicyClass: never-encode`, is DROPPED by the
+parser at load time -- see `.bober/research/research-20260715-ultimate-seo-agents-skills-research.md`
+for the underlying evidence.
+
+The signatures below encode the leaked Google Content Warehouse API's
+ranking-mechanics attributes (`siteAuthority`, NavBoost click signals,
+`contentEffort`, `hostAge`, named demotions, byline/syntactic/semantic date
+consistency) plus Google Search Console's URL Inspection API as a
+programmatic health-check surface. Every signature here is a **read-only
+audit**: inspecting or reporting on an existing signal, never mutating the
+site -- consistent with research §6's "safely automatable" audit category.
+
+## Signatures
+
+### siteauthority-domain-quality
+- **Title:** siteAuthority is a real, leaked, site-wide quality score -- audit domain-level authority signals
+- **Workflows:** technical-audit
+- **Tactic:** Include a domain-level authority read in every technical audit: check for signals of site-wide quality erosion (thin/duplicate sections, low-value subdomains) that could depress the whole site's ranking potential, not just the audited URL.
+- **Invariant:** The leaked Google Content Warehouse API documents siteAuthority as a real site-wide quality score inside Compressed Quality Signals (Q*), contradicting years of public denial that such a score exists; related attributes nsrDataProto and homepagePagerankNs reinforce that site-wide quality and homepage-anchored PageRank both influence every page's ranking potential.
+- **PrimarySourceUrl:** https://ipullrank.com/google-algo-leak
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** siteauthority, leak, domain-quality, compressed-quality-signals
+
+### navboost-click-quality-audit
+- **Title:** NavBoost re-ranks on rolling click history -- audit click quality and on-site UX, not just rank
+- **Workflows:** technical-audit
+- **Tactic:** Pull and review click-quality proxies (bounce-back behavior, dwell/engagement signals, navigation-friction points) for audited URLs as a distinct audit line item from raw ranking position; a page can rank yet be accumulating badClicks that will erode its position over the NavBoost window.
+- **Invariant:** The leak documents NavBoost as a click-based re-ranking system operating over a rolling 13-month window, tracking goodClicks, badClicks, lastLongestClicks, and unsquashedClicks at the URL, subdomain, and root-domain level, and distinguishing navDemotion (on-site UX causes) from serpDemotion (SERP-behavior causes).
+- **PrimarySourceUrl:** https://ipullrank.com/google-algo-leak
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** navboost, click-quality, goodclicks, badclicks, ux-audit
+
+### contenteffort-low-effort-flag
+- **Title:** contentEffort is an LLM effort score -- flag low-effort/scaled pages before they get demoted
+- **Workflows:** technical-audit
+- **Tactic:** Screen audited pages for low-effort/scaled-output characteristics (thin substantiation, templated boilerplate, no original analysis) and flag them for human content review; treat a low contentEffort read as an early-warning audit finding, not a wait-and-see.
+- **Invariant:** The leak documents contentEffort as an LLM-based "effort estimation" Google runs on article pages; low-effort scaled output is algorithmically flagged as not people-first, which is the mechanical reason low-effort AI-generated content underperforms.
+- **PrimarySourceUrl:** https://ipullrank.com/google-algo-leak
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** contenteffort, low-effort, scaled-content, people-first
+
+### hostage-sandbox-new-domain
+- **Title:** hostAge sandboxes fresh domains -- calibrate audit expectations for new sites in adversarial verticals
+- **Workflows:** technical-audit
+- **Tactic:** For newly-registered domains (especially in adversarial/competitive verticals such as iGaming, crypto/DeFi), set index-velocity and ranking-timeline expectations in the audit report around a documented sandbox period rather than treating slow early performance as a technical fault to fix.
+- **Invariant:** The leak documents a hostAge attribute used "to sandbox fresh spam in serving time"; new domains in adversarial verticals start handicapped by this sandbox mechanism regardless of on-page technical quality.
+- **PrimarySourceUrl:** https://www.hobo-web.co.uk/evidence-based-mapping-of-google-updates-to-leaked-internal-ranking-signals/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** hostage, hostage-sandbox, new-domain, adversarial-vertical
+
+### date-consistency-audit
+- **Title:** Byline/syntactic/semantic date consistency is a leak-grounded audit line item
+- **Workflows:** technical-audit
+- **Tactic:** Audit every content page for date drift: compare the visible byline date against the page's syntactic date signals (structured data, title, meta) and its semantic/inferred date, and flag any page where they disagree.
+- **Invariant:** Mike King's technical analysis of the leak states the tactical implication that bylineDate, syntacticDate, and semanticDate should be kept consistent across structured data, titles, and URLs; date drift across these three signals is an identifiable ranking-risk audit finding.
+- **PrimarySourceUrl:** https://ipullrank.com/google-algo-leak
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** date-consistency, bylinedate, syntacticdate, semanticdate
+
+### gsc-url-inspection-health
+- **Title:** Run GSC URL Inspection as a bulk index-health check, scaled across properties within the daily cap
+- **Workflows:** technical-audit
+- **Tactic:** Use the Search Console URL Inspection API as the primary programmatic index-health check in technical audits; when a site's inventory exceeds a single property's daily cap, verify additional properties (e.g. subdirectories or subdomains registered separately) to scale coverage rather than exceeding the per-property quota.
+- **Invariant:** The Search Console API's URL Inspection method is capped at 2,000 queries per day per property and 600 queries per minute -- a hard ceiling on bulk index auditing that a technical-audit workflow must respect and, when necessary, work around via multiple verified properties.
+- **PrimarySourceUrl:** https://developers.google.com/webmaster-tools/limits
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** primary-unverified
+- **Keywords:** gsc, url-inspection, index-health, quota, search-console-api
+
+### named-demotions-audit
+- **Title:** Audit for leak-documented named demotions (EMD, anchor-mismatch, scamness)
+- **Workflows:** technical-audit
+- **Tactic:** Check audited domains and pages against the leak's documented demotion triggers: exact-match-domain patterns, internal/external anchor text that mismatches the linked page's topic, and (for iGaming/crypto verticals) fraud-likelihood signals -- and report any match as a named-demotion risk finding, not a generic "low quality" note.
+- **Invariant:** The leak documents persistent named demotions: exactMatchDomainDemotion (2012-era EMD), anchorMismatchDemotion combined with IsAnchorBayesSpam (Penguin-era anchor-text classification), and scamness, a 0-1023 fraud-likelihood score directly relevant to iGaming and crypto verticals.
+- **PrimarySourceUrl:** https://www.hobo-web.co.uk/evidence-based-mapping-of-google-updates-to-leaked-internal-ranking-signals/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** named-demotion, exact-match-domain, anchor-mismatch, scamness, igaming
+
+### gsc-url-inspection-api-method
+- **Title:** Use the URL Inspection index.inspect method for structured, per-URL index-status audit output
+- **Workflows:** technical-audit
+- **Tactic:** Call the Search Console URL Inspection API's index.inspect method directly (rather than only reading the GSC UI) so per-URL index-status results feed structured audit output that can be diffed run-over-run.
+- **Invariant:** Google's Search Console API documents index.inspect as the URL Inspection method that returns per-URL index-status data programmatically, the same capability exposed in the GSC UI's URL Inspection tool, making it the correct integration point for an automated technical-audit health check.
+- **PrimarySourceUrl:** https://developers.google.com/webmaster-tools/v1/urlInspection.index/inspect
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** primary-unverified
+- **Keywords:** gsc, url-inspection, index-inspect, api-method

package/skills/bober.seo-topical-map/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: bober.seo-topical-map
+description: "Per-workflow SEO signature library for the topical-map workflow. A data file of discrete, cited SEO tactics read by SeoPlaybookParser (src/seo/parser.ts), not a workflow skill. Encodes the leak's siteFocusScore/siteRadius topical-authority mechanism and AI Overview query-fan-out coverage for the topical-map workflow."
+---
+
+# bober.seo-topical-map — Topical Map Signature Library
+
+This skill is a **signature-library** file for the `topical-map` workflow, not a
+workflow skill in its own right. It is read (as raw markdown text) by
+`SeoPlaybookParser.parse()` (`src/seo/parser.ts`) and turned into typed
+`SeoSignature[]` records consumed by the SEO agent team's retriever
+(`SeoPlaybookRetriever`). It follows the identical block format defined and
+documented in `skills/bober.seo-generic/SKILL.md` ("Signature Block Format") --
+the two files are one executable spec; a block missing `Title` or
+`PrimarySourceUrl`, or tagged `PolicyClass: never-encode`, is DROPPED by the
+parser at load time -- see
+`.bober/research/research-20260715-ultimate-seo-agents-skills-research.md`
+for the underlying evidence.
+
+The signatures below encode the leaked Google Content Warehouse API's
+`siteFocusScore` (site-wide dedication to one topic) and `siteRadius`
+(per-page deviation from the site's central theme) topical-authority
+mechanism, plus Ahrefs' finding that AI Overviews retrieve via query
+fan-out, so a topical map must cover the fan-out set of sub-questions, not
+just the head keyword. Most signatures here are **read-only map generation
+and fan-out analysis** (auto-safe); the one signature that would publish the
+full map at scale is `human-approve` -- consistent with research §6's
+automation boundary.
+
+## Signatures
+
+### sitefocusscore-topical-dedication
+- **Title:** Build the map to maximize siteFocusScore -- concentrate coverage on one dedicated topic
+- **Workflows:** topical-map
+- **Tactic:** Structure the topical map so new and existing pages reinforce dedication to a single central topic; when mapping candidate nodes, prefer additions that deepen the existing topical cluster over additions that diversify into unrelated subject areas.
+- **Invariant:** The leaked Google Content Warehouse API documents siteFocusScore as a site-wide score that rewards a site's dedication to one topic; a topical map that maximizes coverage within a single dedicated topic is directly reinforcing a signal the leak shows Google mechanically scores.
+- **PrimarySourceUrl:** https://sparktoro.com/blog/an-anonymous-source-shared-thousands-of-leaked-google-search-api-documents-with-me-everyone-in-seo-should-see-them/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **Keywords:** sitefocusscore, topical-dedication, topical-map, leak
+
+### siteradius-deviation-outlier-map
+- **Title:** Flag high-siteRadius off-topic nodes as ranking outliers to isolate, not map targets to add
+- **Workflows:** topical-map
+- **Tactic:** When candidate map nodes deviate sharply from the site's established central theme, flag them as ranking-outlier risk in the map report and deliberately isolate them from the core cluster rather than adding them as easy incremental-traffic nodes.
+- **Invariant:** The leak documents siteRadius as a per-page score of deviation from the site's central theme, and identifies high-deviation pages as documented ranking outliers; a topical map that adds high-siteRadius nodes without flagging them is building against the leak's own mechanism.
+- **PrimarySourceUrl:** https://sparktoro.com/blog/an-anonymous-source-shared-thousands-of-leaked-google-search-api-documents-with-me-everyone-in-seo-should-see-them/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **Keywords:** siteradius, deviation, ranking-outlier, topical-map
+
+### query-fan-out-coverage-map
+- **Title:** Cover the AI Overview query fan-out set, not just the head keyword
+- **Workflows:** topical-map
+- **Tactic:** Build map nodes for the fan-out query set around a topic -- related sub-questions, comparisons, and specifications -- rather than optimizing a single page for one head keyword; treat fan-out coverage as a first-class map-completeness dimension.
+- **Invariant:** Ahrefs' analysis of 863K SERPs / 4M AIO URLs documents that AI Overviews retrieve results via query fan-out, generating and retrieving against a broadened set of related sub-queries; a topical map scoped only to head keywords under-covers what AIO actually retrieves against.
+- **PrimarySourceUrl:** https://ahrefs.com/blog/ai-overview-citations-top-10/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **Keywords:** fan-out, query-expansion, aio, topical-map
+
+### topical-authority-cluster-completeness
+- **Title:** Map the whole cluster -- comprehensive sub-topic coverage is mechanically scored
+- **Workflows:** topical-map
+- **Tactic:** Evaluate map completeness against the full sub-topic cluster rather than a handful of isolated high-value posts; report gaps in cluster coverage as map-quality findings, since comprehensive coverage of a topic is what the underlying authority mechanism rewards.
+- **Invariant:** The leak's siteFocusScore mechanism operationalizes topical authority as a function of a site's dedication to one topic; comprehensive sub-topic coverage, not isolated high-value posts, is what mechanically reinforces that score.
+- **PrimarySourceUrl:** https://ipullrank.com/google-algo-leak
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **Keywords:** topical-authority, cluster-completeness, sitefocusscore, coverage-gap
+
+### commercial-intent-map-priority
+- **Title:** Prioritize commercial/transactional fan-out nodes given the AIO intent-mix shift to money queries
+- **Workflows:** topical-map
+- **Tactic:** When ranking candidate map nodes for build priority, weight commercial and transactional fan-out queries higher than the historical default of purely informational sub-topics, reflecting where AIO trigger volume has moved.
+- **Invariant:** A Semrush 10M+ keyword panel documents the AIO intent mix shifting Jan-Oct 2025: informational share fell from 91.3% to 57.1% of triggers while commercial rose to 18.57% and transactional to 13.94%; a topical map that still prioritizes informational nodes by default is misaligned with the current trigger mix.
+- **PrimarySourceUrl:** https://www.semrush.com/blog/semrush-ai-overviews-study/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** verified
+- **Keywords:** commercial-intent, transactional, aio-intent-shift, map-priority
+
+### new-node-central-theme-alignment
+- **Title:** Keep every newly-mapped node aligned to the site's central theme (low siteRadius)
+- **Workflows:** topical-map
+- **Tactic:** Before adding a new node to the map, check its alignment against the site's established central theme; reject or flag proposed nodes that would push the map toward a higher average siteRadius rather than accepting any topically-adjacent traffic opportunity.
+- **Invariant:** The leak documents siteRadius as a per-page score of deviation from the site's central theme, with high-deviation pages identified as documented ranking outliers; keeping new nodes low-siteRadius by design is the map-generation-time application of that same mechanism.
+- **PrimarySourceUrl:** https://sparktoro.com/blog/an-anonymous-source-shared-thousands-of-leaked-google-search-api-documents-with-me-everyone-in-seo-should-see-them/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **Keywords:** siteradius, central-theme, node-alignment, topical-map
+
+### map-buildout-at-scale-approval
+- **Title:** Publishing the full map at scale changes the live site -- requires human sign-off
+- **Workflows:** topical-map
+- **Tactic:** When a topical-map analysis recommends bulk-publishing a large batch of new pages to fill fan-out or cluster-completeness gaps at scale, propose the buildout plan as a report but do not execute the mass publish without explicit human approval, since scaled content production at once is a structural site change with abuse-policy exposure.
+- **Invariant:** The 522-site/64%-decayed HCU baseline and the leak's contentEffort signal both associate scaled, low-effort content production with downstream decline risk; a topical-map recommendation to publish new nodes at scale therefore requires a human-owned execution decision rather than automatic publication.
+- **PrimarySourceUrl:** https://detailed.com/q3/
+- **PolicyClass:** human-approve
+- **EvidenceGrade:** single-source
+- **Keywords:** map-buildout, scaled-content, human-approve, live-site-change

package/skills/bober.seo-verticals/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: bober.seo-verticals
+description: "Cross-workflow SEO signature library for competitive/regulated verticals (iGaming, crypto/DeFi, SaaS). A data file of discrete, cited SEO tactics read by SeoPlaybookParser (src/seo/parser.ts), not a workflow skill. Encodes iGaming parasite-SEO detection and regulatory-disclosure guidance, the crypto/DeFi YMYL authority-gap case (Atlendis 538% uplift), and SaaS programmatic-SEO per-page-utility guidance bounded by Google's scaled-content-abuse policy."
+---
+
+# bober.seo-verticals — Vertical Playbooks (iGaming / Crypto-DeFi / SaaS) Signature Library
+
+This skill is a **signature-library** file covering three competitive/regulated
+verticals -- iGaming, crypto/DeFi, and SaaS -- not a workflow skill in its own
+right. It is read (as raw markdown text) by `SeoPlaybookParser.parse()`
+(`src/seo/parser.ts`) and turned into typed `SeoSignature[]` records consumed
+by the SEO agent team's retriever (`SeoPlaybookRetriever`). It follows the
+identical block format defined and documented in
+`skills/bober.seo-generic/SKILL.md` ("Signature Block Format") -- the two
+files are one executable spec; a block missing `Title` or `PrimarySourceUrl`,
+or tagged `PolicyClass: never-encode`, is DROPPED by the parser at load time.
+
+Note: `verticals` is not itself a member of `SeoWorkflow`
+(`src/seo/parser.ts:36-45`), so every block below tags `Workflows` with a real
+workflow member it feeds (`technical-audit`, `parasite-watch`, `ai-visibility`,
+`internal-linking`, `topical-map`) rather than `verticals`, which would be
+silently filtered to `[]`. iGaming and crypto/DeFi are adversarial/YMYL
+verticals where the leaked ranking-mechanics `scamness` signal and Google's
+scaled-content-abuse and site-reputation-abuse policies apply directly; SaaS
+programmatic SEO (pSEO) is bounded by the same scaled-content-abuse policy.
+Every risk-touching tactic below is `human-approve`; the one policy-violating
+tactic (mass unedited AI page generation) is a `never-encode` block the parser
+drops. See `.bober/research/research-20260715-ultimate-seo-agents-skills-research.md`
+§2/§3/§5 for the underlying evidence.
+
+## Signatures
+
+### igaming-scamness-demotion-awareness
+- **Title:** Audit iGaming/crypto domains against the leak's scamness fraud-likelihood score
+- **Workflows:** technical-audit, parasite-watch
+- **Tactic:** Include a scamness-risk read in every iGaming/crypto technical audit: check the audited domain and its content for fraud-likelihood signals (e.g. thin licensing disclosure, unverifiable payout claims, spoofed-brand patterns) that the leak documents as directly scored, and report any match as a named-demotion risk finding rather than a generic quality note.
+- **Invariant:** The leaked Google Content Warehouse API documents scamness, a 0-1023 fraud-likelihood score, as a ranking-mechanics attribute directly relevant to iGaming and crypto verticals -- these verticals are algorithmically screened for fraud signals in a way most verticals are not.
+- **PrimarySourceUrl:** https://ipullrank.com/google-algo-leak
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** igaming, crypto, scamness, leak, named-demotion
+
+### igaming-parasite-detection
+- **Title:** Detect competitor parasite-SEO placements specifically within iGaming/affiliate SERPs
+- **Workflows:** parasite-watch
+- **Tactic:** Run vertical-scoped SERP monitoring for iGaming/affiliate target keywords, watching for competitor "best casino"/"top betting site" listicles placed on high-authority third-party hosts; flag new parasite entrants for the human operator. This is READ-ONLY SERP monitoring, never a placement action, and is a vertical-specific instance of the general parasite-watch detection pattern.
+- **Invariant:** Reporting on iGaming affiliate SERPs documents parasite SEO as a persistent, industry-specific problem -- affiliates report material organic-traffic decline attributable to parasite competitors, with enforcement against violators inconsistent -- making vertical-scoped continuous monitoring the practical defensive baseline.
+- **PrimarySourceUrl:** https://www.affiversemedia.com/parasite-seo-is-thriving-in-igaming-and-its-costing-affiliates/
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** primary-unverified
+- **Keywords:** igaming, parasite-seo, detection, serp-monitoring
+
+### igaming-regulatory-disclosure
+- **Title:** Route iGaming regulatory disclosure (ASA / Gambling Commission-adjacent) claims through human approval
+- **Workflows:** technical-audit
+- **Tactic:** Treat any content change that touches gambling-advertising disclosure, responsible-gambling messaging, or licensing claims as YMYL content requiring human legal/compliance sign-off before publication; never auto-publish or auto-edit disclosure-adjacent copy as part of an automated audit remediation.
+- **Invariant:** iGaming affiliate-marketing reporting documents disclosure and regulatory compliance (advertising-standards and gambling-commission-adjacent obligations) as a live, actively-enforced constraint on iGaming SEO/content operations, distinct from and in addition to ordinary search-spam policy.
+- **PrimarySourceUrl:** https://www.businessofigaming.com/parasite-seo-affiliate-marketing/
+- **PolicyClass:** human-approve
+- **EvidenceGrade:** primary-unverified
+- **Keywords:** igaming, regulatory-disclosure, ymyl, compliance, human-approve
+
+### defi-authority-gap-beatable
+- **Title:** A DeFi authority gap is beatable with structural work -- the Atlendis case (538% uplift)
+- **Workflows:** internal-linking, technical-audit
+- **Tactic:** For DeFi/crypto clients facing an authority gap against larger incumbents, recommend (human-approval-gated -- this is structural site work) a combined domain-authority-building and content-migration plan modeled on the Atlendis case: consolidate content onto the root domain rather than a hosted subdomain, and pursue targeted authority-building rather than assuming the gap is unbeatable.
+- **Invariant:** Atlendis achieved a 538% organic-traffic uplift in roughly 9 months while starting from a domain authority of 12 against competitors at 38-50, with migrating content from a hosted Medium subdomain to the root domain contributing a further 218% increase -- a documented case that a large authority gap in the DeFi vertical is structurally beatable.
+- **PrimarySourceUrl:** https://victoriaolsina.com/case-studies/defi-seo/
+- **PolicyClass:** human-approve
+- **EvidenceGrade:** single-source
+- **Keywords:** defi, crypto, authority-gap, migration, case-study
+
+### crypto-ymyl-editorial-override
+- **Title:** Route crypto/DeFi YMYL content changes through editorial human approval, not auto-publish
+- **Workflows:** technical-audit, ai-visibility
+- **Tactic:** For crypto/DeFi content (investment claims, protocol-risk disclosures, financial-advice-adjacent copy), require human editorial sign-off before any audit-driven content change ships; do not auto-apply content edits in this vertical even when the underlying finding (e.g. a contentEffort or scamness flag) is high-confidence.
+- **Invariant:** The leak's scamness scoring and documented manual-whitelist mechanisms for sensitive verticals indicate Google applies extra editorial scrutiny to YMYL-adjacent content in financial verticals; crypto/DeFi content changes carry outsized ranking and trust risk if published without human review.
+- **PrimarySourceUrl:** https://ipullrank.com/google-algo-leak
+- **PolicyClass:** human-approve
+- **EvidenceGrade:** single-source
+- **LiveWeightStatus:** documented-only
+- **Keywords:** crypto, defi, ymyl, editorial-review, scamness
+
+### saas-pseo-per-page-utility
+- **Title:** Programmatic SEO for SaaS works only with genuine per-page utility -- audit for the scaled-content-abuse boundary
+- **Workflows:** topical-map, technical-audit
+- **Tactic:** Before approving a programmatic-SEO (pSEO) page-generation plan for a SaaS client, require each templated page to demonstrate genuine per-page utility (real underlying data, a distinct user need, non-boilerplate content) as a human-approval gate; audit existing pSEO inventory for pages that are templated-but-empty of unique value, which is the scaled-content-abuse risk signal, not the page-generation approach itself.
+- **Invariant:** Google's scaled-content-abuse policy targets mass-produced content lacking genuine per-page value, not programmatic content generation per se -- pSEO succeeds at scale specifically when each page carries real utility, which is the boundary a human-approval gate must enforce before mass publication.
+- **PrimarySourceUrl:** https://developers.google.com/search/blog/2024/03/core-update-spam-policies
+- **PolicyClass:** human-approve
+- **EvidenceGrade:** primary-unverified
+- **Keywords:** saas, pseo, programmatic-seo, scaled-content-abuse, per-page-utility
+
+### igaming-ads-certification-compliance
+- **Title:** Google Ads gambling certification + per-country licensing is a hard paid-ads compliance gate for iGaming
+- **Workflows:** technical-audit
+- **Tactic:** Before any iGaming paid-search campaign passes a technical/compliance audit, verify the advertiser holds current Google Ads gambling certification and a valid license or registration in each individually targeted country; confirm the campaign only targets approved countries, that no targeting reaches minors, and that every landing page displays responsible-gambling information -- flag any gap as a compliance-blocking finding, not a nice-to-have.
+- **Invariant:** Google's gambling advertising policy requires advertisers to hold certification plus a valid license/registration per targeted country (a separate certification per country -- e.g. the UK requires Gambling Commission registration and a license number), restricts targeting to approved countries only, forbids targeting minors, and requires landing pages to show responsible-gambling information; this policy governs paid ads, not organic ranking.
+- **PrimarySourceUrl:** https://support.google.com/adspolicy/answer/15132179
+- **PolicyClass:** human-approve
+- **EvidenceGrade:** verified
+- **Keywords:** igaming, google-ads, certification, licensing, responsible-gambling, compliance
+
+### crypto-igaming-site-reputation-abuse-audit
+- **Title:** Site-reputation-abuse policy closed the first-party-oversight loophole -- audit crypto/iGaming properties for undisclosed third-party placements
+- **Workflows:** technical-audit, parasite-watch
+- **Tactic:** Audit crypto/DeFi and iGaming content properties for third-party-authored sections (sponsored "best casino"/"top token" guides, licensed review content) published under the brand's own domain, and flag any section lacking genuine first-party editorial oversight; do not accept a claimed licensing, white-label, or partial-ownership arrangement as evidence of compliance -- the Nov 2024 policy update removed that exemption.
+- **Invariant:** Google's Nov 19 2024 site-reputation-abuse policy update closed the first-party-oversight loophole: no amount of white-labelling, licensing, partial ownership, or claimed editorial oversight exempts third-party content hosted to exploit a domain's ranking signals; Google explicitly states it does not take a site's claims about content production at face value -- directly relevant to crypto/DeFi and iGaming verticals where sponsored/affiliate content is common.
+- **PrimarySourceUrl:** https://developers.google.com/search/blog/2024/11/site-reputation-abuse
+- **PolicyClass:** human-approve
+- **EvidenceGrade:** verified
+- **Keywords:** site-reputation-abuse, parasite-seo, crypto, igaming, editorial-oversight
+
+### saas-scaled-content-intent-audit
+- **Title:** Scaled-content-abuse is judged by intent, not production method -- audit SaaS pSEO output regardless of AI/human/hybrid authorship
+- **Workflows:** topical-map, technical-audit
+- **Tactic:** When auditing a SaaS programmatic-SEO template set, evaluate pages against manipulative-intent and user-value signals (duplicate boilerplate, near-identical pages, absence of unique underlying data) rather than by whether the content was AI-generated, human-written, or hybrid; do not treat human involvement alone as a safety exemption from the scaled-content-abuse review.
+- **Invariant:** Google's scaled-content-abuse policy is explicitly method-agnostic -- content "no matter how it's created" (AI, human, or hybrid) is judged by whether it was produced primarily to manipulate rankings with little or no user value, not by production method; a documented case of a 50,000-page near-duplicate programmatic travel site saw it roughly 98% deindexed within three months.
+- **PrimarySourceUrl:** https://developers.google.com/search/docs/essentials/spam-policies
+- **PolicyClass:** auto-safe
+- **EvidenceGrade:** verified
+- **Keywords:** saas, pseo, scaled-content-abuse, method-agnostic, intent-test
+
+### mass-ai-page-generation-boundary
+- **Title:** Mass unedited AI page generation -- NEVER encode as a tactic
+- **Workflows:** topical-map, technical-audit
+- **Tactic:** NEVER encode as actionable. Generating large volumes of AI-written pages without meaningful human editing or genuine per-page utility, purely to scale up indexed page count, is a NAMED Google scaled-content-abuse violation. Documented here only to mark the automation boundary; the parser DROPS this block so it can never reach an analyzer prompt.
+- **Invariant:** Scaled-content abuse (mass-produced, unedited or minimally-edited content generated primarily to manipulate search rankings) is a named spam policy -- must never be surfaced as an option, even human-approval-gated, regardless of vertical.
+- **PrimarySourceUrl:** https://developers.google.com/search/docs/essentials/spam-policies
+- **PolicyClass:** never-encode
+- **EvidenceGrade:** primary-unverified
+- **Keywords:** mass-ai-pages, scaled-content-abuse, never-encode, policy-violation

package/skills/bober.using-bober/SKILL.md

@@ -117,6 +117,7 @@ The following skills are available in this repo but are domain-specific, not par
 
 - `bober.anchor` — project anchoring and context establishment
 - `bober.brownfield` — brownfield (existing codebase) conventions and anti-patterns
+- `bober.design` — frontend design team: premium, non-generic landing pages/UI via intake → art direction → build → screenshot critique → polish (agents: bober-art-director, bober-frontend-builder, bober-design-critic)
 - `bober.graph` — knowledge graph queries and code review using code-review-graph MCP
 - `bober.impact` — change impact analysis
 - `bober.onboard` — project onboarding