b2c-app-builder 0.221.39

package/knowledge/process/flow-traceability.md

@@ -0,0 +1,189 @@
+# Launch Flow Traceability And Build Contracts
+
+Use this for any multi-phase B2C app launch, especially before moving from research to 11-star experience, brand/design, or implementation. The goal is to keep evidence, product-experience decisions, visual decisions, security posture, build specs, and verification tied together.
+
+Create `state/business-state.json` first for phase/lane/provider/proof state. Create `state/LAUNCH_TRACE.md` when the launch has more than one serious artifact. Create `engineering/TECH_SPEC.md` when actual app/backend/web implementation is in scope and data, API, state, permissions, integrations, or platform behavior need to be precise.
+
+## Contents
+
+- 1. Traceability Rule
+- 2. `state/business-state.json`
+- 3. `state/LAUNCH_TRACE.md`
+- 4. Flow Gates
+- 5. `engineering/TECH_SPEC.md`
+- 6. Build-Ready Checklist
+- 7. Common Failures
+
+## 1. Traceability Rule
+
+Every major launch decision should answer:
+
+- What evidence caused this decision?
+- Which paid/account-gated tool or confirmed fallback produced the evidence?
+- What 11-star experience moment or complete product experience does it create or reject?
+- What viral/referral/share loop, content format, or growth claim does it create or reject?
+- What product behavior does it create or reject?
+- What brand/design expression carries it?
+- What analytics, security, revenue, privacy, ASO, or legal surface does it affect?
+- What must a builder implement?
+- How will we prove it works?
+
+Do not move a claim, screen, onboarding question, paywall behavior, pricing statement, data collection, or store-console answer forward unless it has a trace row or a clearly documented founder-only decision.
+
+### Lexicon Lock (one vocabulary across every surface)
+
+Pick the canonical product nouns/verbs once (e.g. the core feature name, the unit users act on, the metric names) and use the **same words everywhere**: in-app copy, onboarding, landing page hero/method/FAQ, SEO meta description, JSON-LD/structured data, App Store listing, paywall, and email. Record the locked terms in `DESIGN.md` (or `strategy/BRAND.md`) as the single source of truth.
+
+When a term changes, grep every surface and update them together — including the landing page's component files, `<meta>` description, and JSON-LD `description`/FAQ blocks, which are easy to miss. A term that means one thing in the app and another on the landing page (or a stale value left in one surface) reads as a different, less-trustworthy product and is a recurring drift bug. Treat "eliminate cross-surface inconsistency" as a sweep across all surfaces, not a single-file edit.
+
+## 2. `state/business-state.json`
+
+Use `state/business-state.json` as the current-state index over trace work:
+
+- phase and autonomy mode
+- lane statuses, evidence paths, and blockers
+- provider routes, docs checked date, preflight, validation, fallback, and required secret names
+- active failure cards and LaunchBench/validator proof
+- founder-only gates and approval state
+
+Update it before crossing any flow gate. Report the current evidence and blockers when a provider, store, revenue, legal, or readiness change affects launch risk.
+
+`state/business-state.json` does not replace `state/LAUNCH_TRACE.md`. State tells the agent where the launch stands; trace explains why each decision exists.
+
+## 3. `state/LAUNCH_TRACE.md`
+
+Use this compact table shape:
+
+```text
+ID: EVID-001
+Source: AppKittie competitor reviews, XPOZ TikTok query, Firecrawl pricing crawl, founder transcript, official docs, user export, or approved fallback
+Tool route: paid tool | user export | free fallback | blocked | founder decision
+Research finding: what we learned
+Experience decision: what changes in 11_STAR_EXPERIENCE.md or 11-star-experience.html
+Product decision: what changes in PRODUCT.md or product/ONBOARDING.md
+Brand/design decision: what changes in strategy/BRAND.md, DESIGN.md, PAID_UA.md, VIRAL_GROWTH.md, growth/UGC_PLAYBOOK.md, or HTML proofs
+Build contract: screen/component/API/data/state/task that must exist
+Analytics/security/revenue/privacy/store impact: event, entitlement, threat/abuse control, data disclosure, screenshot, console field, signing/release gate, or legal note
+Verification: test, MobAI path, backend/provider proof, browser proof, dashboard check, or founder approval
+Status: planned | implemented | verified | blocked | rejected
+```
+
+Required sections:
+
+- evidence index: source, date, tool, query/URL, and confidence
+- tool-decision pointer when evidence came from a paid/account-gated tool or approved fallback
+- decision trace table
+- rejected decisions and why
+- founder-only decisions
+- implementation blockers
+- verification map
+
+Small launches can keep this inside `strategy/RESEARCH.md`, but the section must be easy to find and must be copied into builder handoffs.
+
+## 4. Flow Gates
+
+### Research To Spec
+
+Pass only when:
+
+- category, target user, competitor set, user language, pricing posture, and accepted scope and explicit non-goals are evidence-backed
+- 11-star experience ladder, line of feasibility, and complete product experience are created or explicitly blocked
+- unsupported claims are removed or marked founder-only/legal-review
+- each core feature has a reason: demand, differentiation, monetization, retention, compliance, or operational need
+- open product alternatives are resolved through `ce-brainstorm` or documented as explicit assumptions
+- `state/business-state.json` marks research, paid-tool routing, and traceability status honestly
+
+### Spec To Brand And Design
+
+Pass only when:
+
+- brand voice uses actual user/category language instead of founder-only phrasing
+- `11_STAR_EXPERIENCE.md` defines the magical moment, and `11-star-experience.html` visually shows the ladder and line of feasibility
+- core loop, aha moment, onboarding, paywall, support/privacy, settings, and error states have screen implications
+- each public claim has an evidence/proof constraint
+- `DESIGN.md`, `design/design-room.html`, and `product/onboarding.html` cite the trace IDs they express
+- accessibility and localization constraints are visible before screenshots or implementation prompts
+- `state/business-state.json` records the design lane as partial until `DESIGN.md`, and HTML proofs exist
+
+### Design To Build
+
+Pass only when:
+
+- every build-critical screen has states, copy, components, analytics hooks, permissions, and backend/data expectations
+- the complete product experience from `11_STAR_EXPERIENCE.md` is represented as concrete screen/state/data/API/analytics requirements
+- every onboarding question maps to personalization, attribution, lifecycle messaging, privacy, or setup
+- paywall and pricing surfaces match `revenue/REVENUE_OPS.md`, `trust/TERMS.md`, store products, and analytics events
+- account deletion, privacy choices, restore purchases, support, and settings paths are specified
+- `engineering/TECH_SPEC.md` or `engineering/ENGINEERING_PLAN.md` contains data/API/state contracts for every non-static flow
+- failure cards are created for any unresolved attribution, security, revenue, store, privacy, email, or secret-routing risk
+
+### Build To Proof
+
+Pass only when:
+
+- frontend actions are proven against backend/provider state
+- MobAI or browser E2E covers critical user paths
+- analytics, entitlement, email, deletion, restore, and support paths are verified where in scope
+- `engineering/PRODUCTION_READINESS.md` records command outputs, fixtures, evidence paths, blockers, and founder-only gates
+- deterministic validators or LaunchBench scenarios run where they exist, with results recorded in `state/business-state.json`
+
+## 5. `engineering/TECH_SPEC.md`
+
+Create this when the app has backend APIs, database/storage, auth, subscriptions, email, analytics, AI, push, account deletion, or non-trivial platform behavior.
+
+For small builder handoffs, `engineering/TECH_SPEC.md` may be folded into `engineering/ENGINEERING_PLAN.md`, but the same sections must exist.
+
+Must include:
+
+- source docs and trace IDs
+- architecture overview and repo boundaries
+- auth/session model, roles, anonymous-to-known transition, logout/reset behavior
+- data model: entities, fields, ownership, retention, deletion, indexes, migrations, and seed fixtures
+- API/RPC/webhook contracts: route, method, auth, request, response, errors, idempotency, rate limits, and provider retries
+- state machines: onboarding, account, entitlement, subscription, restore, deletion, support, lifecycle messaging, and offline/cache state where relevant
+- permissions and platform capabilities: push, camera/photos, contacts, location, HealthKit/Health Connect, microphone, calendar, files, notifications, ATT/ad IDs, background modes
+- integration contracts: PostHog, RevenueCat, Stripe, Resend, Sentry, Supabase/Firebase/Postgres, Fastlane, App Store/Play server notifications, AI providers, push providers
+- app integrity and abuse posture when backend/paid/sensitive flows exist: Apple App Attest/DeviceCheck decision, Google Play Integrity decision, rate limits, bot defenses, replay/idempotency protection
+- remote config, feature flags, kill switches, and staged/phased rollout controls
+- error taxonomy and user-facing recovery copy
+- logging/observability, alerting, dashboards, and privacy-safe debug data
+- test fixtures and non-production accounts
+
+Acceptance:
+
+- a builder can implement without inventing schema, endpoint, state, permission, or integration behavior
+- backend/provider truth can be tested from a real frontend or device action
+- privacy/store disclosures can be traced to actual data and SDK behavior
+
+## 6. Build-Ready Checklist
+
+Before sending to Rork, Claude, Codex, or another builder:
+
+- `state/business-state.json` exists and matches current artifacts
+- The session update states the current result, blockers, and next action
+- `state/LAUNCH_TRACE.md` exists or equivalent trace section exists in `strategy/RESEARCH.md`
+- `PAID_UA.md` exists when growth depends on paid ads, Apple Search Ads, Meta/TikTok/Google campaigns, custom product pages, paid creative tests, MMP/ad-network SDK decisions, or paid-growth readiness claims
+- `VIRAL_GROWTH.md` exists when growth depends on referral/share loops, creator CTAs, TikTok/Reels/Shorts mechanics, or viral paywall/onboarding behavior
+- `11_STAR_EXPERIENCE.md` and `11-star-experience.html` exist unless the experience lane is explicitly deferred/not needed with a reason
+- `strategy/TOOL_DECISIONS.md` exists when paid/account-gated tools or fallbacks shaped evidence, screenshots, testing, store ops, or growth
+- `PRODUCT.md`, `strategy/BRAND.md`, `DESIGN.md`, `analytics/ANALYTICS.md`, `product/ONBOARDING.md`, `trust/SECURITY.md`, `revenue/REVENUE_OPS.md`, `trust/PRIVACY.md`, `store/APPLE_SIGNING.md`, `APP_STORE_LISTING.md`, and `store/STORE_CONSOLE.md` are internally consistent for in-scope surfaces
+- `engineering/TECH_SPEC.md` exists when data/API/integration/state behavior is non-trivial
+- `engineering/ENGINEERING_PLAN.md` references trace IDs and breaks work into implementation units
+- `AGENTS.md` points builders to trace, design, analytics, technical contracts, and readiness gates
+- `engineering/PRODUCTION_READINESS.md` defines the proof expected before launch-ready is claimed
+- active failure cards are assigned, blocked, or resolved with evidence
+
+## 7. Common Failures
+
+- State says a lane is done, but the artifact/provider/dashboard/proof does not exist.
+- State is not updated after provider setup, app-record creation, signing changes, secret changes, revenue setup, or store-console work.
+- A failure card is marked resolved without command, provider, dashboard, or founder-approval evidence.
+- Research exists, but design and copy do not cite the evidence that shaped them.
+- `design.md` lists screens, but no data model or API contract explains how they work.
+- Analytics events are named, but no screen/API owner emits them.
+- Privacy and store-console answers are traceable to legal copy, not actual SDKs, data tables, and backend behavior.
+- Paywall copy, RevenueCat products, Stripe prices, terms, screenshots, and store metadata drift apart.
+- Paid-tool evidence and free-fallback evidence are mixed together without confidence or limitation notes.
+- MobAI verifies a visual path, but no provider/dashboard/database proof confirms the action landed.
+- XcodeBuildMCP is used as a MobAI fallback without founder confirmation or without recording Apple-only coverage limits.
+- A builder prompt references many docs but does not state the trace IDs or contracts that define done.

package/knowledge/process/launch-coverage.md

@@ -0,0 +1,298 @@
+# B2C Launch Coverage Audit
+
+Use this when auditing whether a B2C mobile app launch is complete. The goal is to find missing launch lanes before they become store rejections, failed payments, weak acquisition, support chaos, or unmeasurable growth.
+
+Classify each lane as `done`, `partial`, `blocked`, `not needed`, or `deferred with reason`. Do not mark a lane done unless there is an artifact, live dashboard, code path, or verification note.
+
+## Contents
+
+- Coverage Matrix
+- Must-Have For Any Real Launch
+- Optional But High-Leverage
+- Common Missing Pieces
+- Handoff Completeness Checklist
+- Audit Output
+
+## Coverage Matrix
+
+| Lane                            | Required Evidence                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Primary Tools                                                                                                                                                                                                                                   |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Project state                   | `state/business-state.json` phase/mode/lanes/providers/proof/failure cards, validator status                                                                                                                                                                                                                                                                                                                                                                                                                                              | `project-state.md`, bundled TS scripts                                                                                                                                                                                                          |
+| Founder-zero operator bootstrap | beginner-assumed guidance, business identity spine, Doppler setup, account/social inventory, delegated access, recovery/2FA ownership, one founder action plus one agent action                                                                                                                                                                                                                                                                                                                                                           | `founder-zero-operator.md`, `operations/BUSINESS_ACCESS.md`, `operations/business-access.json`, `check:founder-operator`                                                                                                                        |
+| Paid-tool routing               | intended paid/account-gated tools, founder confirmation, selected fallback or blocked state, limitations                                                                                                                                                                                                                                                                                                                                                                                                                                  | `strategy/TOOL_DECISIONS.md`, [`paid-tool-routing.md`](../operations/paid-tool-routing.md)                                                                                                                                                      |
+| Secrets/config                  | Doppler or approved provider, `SECRETS.md`, command wrappers, CI/deploy injection, secret scan, public/server-only classification                                                                                                                                                                                                                                                                                                                                                                                                         | Doppler CLI, `SECRETS.md`, platform secret stores                                                                                                                                                                                               |
+| Security architecture/release   | `trust/SECURITY.md`, `trust/security-review.html`, threat model, OWASP MASVS/ASVS basis, paid-security-tool routing, mobile hardening, entitlement/webhook abuse controls, supply-chain checks, monitoring, incident response, accepted risks                                                                                                                                                                                                                                                                                             | `security-release-hardening.md`, local security skills, Sentry skills, MobSF, platform docs                                                                                                                                                     |
+| Market/category selection       | category economics, competitor map, revenue/download ranges, winning wedge                                                                                                                                                                                                                                                                                                                                                                                                                                                                | AppKittie, ASO skills                                                                                                                                                                                                                           |
+| Social/user language            | pain language, creator formats, objections, screenshots/posts summarized                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | XPOZ, reviews, web search                                                                                                                                                                                                                       |
+| Competitor web intelligence     | competitor landing pages, pricing, funnels, claims, policies, changelog                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Firecrawl map/scrape/crawl/extract                                                                                                                                                                                                              |
+| Product contract                | Accepted interpretation, complete scope, core loop, activation, scope exclusions, risks                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `PRODUCT.md`                                                                                                                                                                                                                                    |
+| 11-star experience              | product-specific 1/2/5/6/7/10/11-star ladder, line of feasibility, complete product experience, visual board, surface translation                                                                                                                                                                                                                                                                                                                                                                                                                   | `11_STAR_EXPERIENCE.md`, `11-star-experience.html`, [`eleven-star-experience.md`](../experience/eleven-star-experience.md)                                                                                                                      |
+| Emotional experience system     | Experience Card deck applied to the core loop (Commitment, Variable Reward, Perceived Effort Delay, Intent Mirroring + deck), six-lens review per feature, target emotional curve, PostHog event per card, bright-line ethics attestation + counter-metric for HIGH-risk cards, reduced-motion fallback; for audits, per-journey scoring with a pathway to a better state                                                                                                                                                                 | `EMOTIONAL_DESIGN.md`, `emotional-design.html`, `EMOTIONAL_AUDIT.md`, `emotional-design-system.md`, `experience-cards.md`, `ethics-guardrail.md`, `check:emotional-design`, PostHog                                                             |
+| Evidence-to-build trace         | evidence IDs, decision trace, build contracts, verification map, rejected decisions                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `state/LAUNCH_TRACE.md`, `flow-traceability.md`                                                                                                                                                                                                 |
+| Engineering orchestration       | product brainstorm decision, `operations/ORCHESTRATION.md`, `AGENTS.md`, `CLAUDE.md` when needed, implementation plan, parallel-agent map, serialized resource map, E2E readiness proof                                                                                                                                                                                                                                                                                                                                                   | Compound Engineering, MobAI, `engineering/ENGINEERING_PLAN.md`, `engineering/PRODUCTION_READINESS.md`                                                                                                                                           |
+| Agent operations                | capability inventory, exact approval envelopes, authenticated browser/API/native action ledger, research/media provenance, provider read-back, cross-artifact reconciliation                                                                                                                                                                                                                                                                                                                                                              | `frontier-agent-operations.md`, `operations/AGENT_OPERATIONS.md`, `operations/agent-operations.json`, `check:agent-operations`                                                                                                                  |
+| Technical build contracts       | data model, API/RPC/webhooks, auth/session, app states, permissions, integrations, app integrity, fixtures; `engineering/TECH_SPEC.md` Data Contract (backend selection, authorization model, migrations/environments)                                                                                                                                                                                                                                                                                                                    | `engineering/TECH_SPEC.md`, `engineering/ENGINEERING_PLAN.md`, `backend-data-contract.md`, `check:backend-contract`                                                                                                                             |
+| Brand/design                    | voice, `DESIGN.md` token system, screen spec, rendered HTML proofs, asset rules, accessibility                                                                                                                                                                                                                                                                                                                                                                                                                                            | `strategy/BRAND.md`, `DESIGN.md`, `design/design-room.html`                                                                                                                                                                                     |
+| Onboarding/conversion           | personalization, mascot/demo, attribution, review prompt, paywall timing, closing offer, activation                                                                                                                                                                                                                                                                                                                                                                                                                                       | `product/ONBOARDING.md`, `product/onboarding.html`, `analytics/ANALYTICS.md`                                                                                                                                                                    |
+| ASO/store listing               | metadata, keyword map, App Store listing packet, screenshots, category, localization, custom product pages, In-App Events, review strategy                                                                                                                                                                                                                                                                                                                                                                                                | ASO skills, AppKittie, Higgsfield                                                                                                                                                                                                               |
+| Localization market research    | `LOCALIZATION_MARKET_RESEARCH.md` market opportunity matrix (per-storefront keyword popularity, difficulty, demand), priority tiers (Tier 1 full / Tier 2 metadata-only / Tier 3 defer), native-keyword sourcing, cross-surface rollout, post-launch refresh                                                                                                                                                                                                                                                                              | `localization-market-research.md`, AppKittie, Apple Search Ads, App Store Connect App Analytics, XPOZ                                                                                                                                           |
+| Store-console readiness         | `APP_STORE_LISTING.md`, `store/APPLE_APP_STORE_REQUIREMENTS.md`, `app-store-listing.html`, `app-privacy-questionnaire.html`, `store/STORE_CONSOLE.md`, `store/store-console.html`, `store/GOOGLE_PLAY_RELEASE.md` when Android is in scope (Data Safety reconciliation, Play App Signing, release tracks, closed-testing gate), build/version, IAP/subscriptions, privacy manifests, required reason APIs, SDK manifests/signatures, privacy labels/Data safety, review notes, account deletion, screenshots, optional `asc` CLI dry-runs | App Store Connect, Play Console, App Store Connect CLI, MobAI, Codex Desktop native iOS/XcodeBuildMCP, SnapshotPreviews, serve-sim                                                                                                              |
+| Apple signing/release           | Apple Developer membership, Team ID, bundle ID/App ID, app record, capabilities, certificates/profiles, archive/export/upload/TestFlight status, founder-only gates                                                                                                                                                                                                                                                                                                                                                                       | `store/APPLE_SIGNING.md`, Xcode, XcodeBuildMCP, ASC CLI, App Store Connect                                                                                                                                                                      |
+| Revenue                         | RevenueCat/Stripe/app-store products, entitlement mapping, web checkout, restore, webhooks                                                                                                                                                                                                                                                                                                                                                                                                                                                | `revenue-monetization.md`                                                                                                                                                                                                                       |
+| Funnel                          | landing, waitlist/preorder/checkout, referral, support/privacy email, analytics; landing-page hero/feature visual route in `CONTENT_ASSETS.md`                                                                                                                                                                                                                                                                                                                                                                                            | Cloudflare, Supabase, PostHog, Resend; Higgsfield (hero/feature imagery — see the **Cheap-First Direction (z_image → production model)** and **Seasonal restyle Refresh** recipes in `tool-recipes/visual-and-motion-production.md`)            |
+| Paid user acquisition           | `PAID_UA.md`, one-channel decision, creative cadence, baseline and blended report, RevenueCat LTV/CPA review, store destination, stop/scale rules, founder-only spend gates                                                                                                                                                                                                                                                                                                                                                               | `paid-user-acquisition.md`, PostHog, RevenueCat, ASC/Play, ad-network reports                                                                                                                                                                   |
+| Viral growth loop               | `VIRAL_GROWTH.md`, product-led referral/share loop, format lab, monetization timing, abuse controls, analytics proof, stop/scale rules                                                                                                                                                                                                                                                                                                                                                                                                    | `viral-growth-loops.md`, PostHog, RevenueCat/Stripe, UGC/Fastlane                                                                                                                                                                               |
+| GEO/SEO                         | metadata, schema, robots, sitemap, `llms.txt`, AI crawler access, citability                                                                                                                                                                                                                                                                                                                                                                                                                                                              | GEO skills, Firecrawl                                                                                                                                                                                                                           |
+| Privacy/legal                   | privacy, terms, EULA, data deletion, subscription disclosures, source URLs                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `privacy-terms.md`                                                                                                                                                                                                                              |
+| Analytics/attribution           | current PostHog doc map, identity model, event catalog, attribution matrix, dashboards, experiments, replay/survey posture, QA                                                                                                                                                                                                                                                                                                                                                                                                            | `analytics/ANALYTICS.md`, `analytics/analytics-plan.html`, PostHog, GA4, RevenueCat, ASC                                                                                                                                                        |
+| Crash/performance               | crash reporting, release health, logs, alert routing, performance budget                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Sentry, store crash reports                                                                                                                                                                                                                     |
+| Email/deliverability            | Resend domains, SPF/DKIM/DMARC, API keys, sends, webhooks, contacts/topics, unsubscribe, inbound                                                                                                                                                                                                                                                                                                                                                                                                                                          | `growth/EMAIL_OPS.md`, Resend docs                                                                                                                                                                                                              |
+| Lifecycle messaging             | transactional email, push, onboarding nudges, trial/renewal/win-back, unsubscribe rules; win-back creative route in `CONTENT_ASSETS.md`                                                                                                                                                                                                                                                                                                                                                                                                   | Resend, provider docs, PostHog/Customer.io/Loops/FCM/APNs; Higgsfield (win-back creative — see the **App Store URL → UGC Ad Batch (Click-to-Ad)** and **Soul-Once Founder-Face Ads** recipes in `tool-recipes/visual-and-motion-production.md`) |
+| Support/reputation              | support inbox, refund path, review responses, help docs, incident escalation                                                                                                                                                                                                                                                                                                                                                                                                                                                              | email routing, support tool                                                                                                                                                                                                                     |
+| QA/beta/release                 | TestFlight/internal testing, smoke tests, device matrix, rollback/kill switch                                                                                                                                                                                                                                                                                                                                                                                                                                                             | store consoles, test skills, MobAI, Codex Desktop native iOS/XcodeBuildMCP, SnapshotPreviews, serve-sim                                                                                                                                         |
+| Security/abuse                  | RLS/auth rules, rate limits, secrets, PII minimization, admin access, bot defenses, app integrity, security contact route                                                                                                                                                                                                                                                                                                                                                                                                                 | `trust/SECURITY.md`, `trust/security-review.html`, security validator, repo audit, Supabase/Cloudflare                                                                                                                                          |
+| Organic social growth           | UGC fit/90-day creator plan, Fastlane workspace, connected accounts, campaign angles, media inputs, polished demo videos, schedule, QA, analytics loop                                                                                                                                                                                                                                                                                                                                                                                    | UGC playbook, Fastlane AI, MobAI recorder skills, native iOS proof tools, Higgsfield, PostHog                                                                                                                                                   |
+| Post-launch loop                | `operations/POST_LAUNCH_OPS.md` weekly operating rhythm (crash triage, review responses with SLA, release/hotfix cadence, retention review, support ops) with a dated weekly log carrying real numbers, `lanes.post_launch_ops.live_since` anchoring the clock, `operations/LAUNCH_RETRO.md` checkpoints completed on time with its day-30/day-90 Kill, Hold, Or Scale verdict, weekly ASO/reviews/rankings/conversion/retention/revenue/competitor deltas, `strategy/PORTFOLIO_REGISTRY.md` once a second business exists                | `post-launch-operations.md` sections 9–10, including Portfolio Allocation, AppKittie, ASO skills, RevenueCat, PostHog, Sentry, `check:post-launch`, `check:portfolio-registry`                                                                  |
+| LaunchBench/failure cards       | known failure scenarios checked, active cards tracked, deterministic validators run where available                                                                                                                                                                                                                                                                                                                                                                                                                                       | `failure-cards.md`, `state/business-state.json`, bundled TS scripts                                                                                                                                                                             |
+
+## Must-Have For Any Real Launch
+
+Required unless explicitly marked not applicable:
+
+- `state/business-state.json` for multi-lane launches, handoffs, continuations, or readiness audits; current phase, autonomy mode, lane status, provider state, proof, blockers, and active failure cards must be visible
+- `operations/BUSINESS_ACCESS.md` and its structured ledger at broad-launch orient so the agent assumes a beginner founder, drives setup, secures Doppler and account/social access, and never hands back an unexplained checklist
+- research-backed spec and category choice
+- paid/account-gated tool decisions recorded before free fallbacks are used
+- `SECRETS.md` when any API key, token, OAuth credential, webhook signing secret, store credential, service-account file, CI/deploy env var, or `.env` file is needed; default to Doppler unless the founder approves another provider
+- `trust/SECURITY.md` and `trust/security-review.html` when building, submitting, or launching an app with accounts, payments, backend state, email, analytics, public web surfaces, or store distribution; include threat model, platform hardening, abuse controls, monitoring, incident response, accepted risks, and paid-security-tool routing
+- `state/LAUNCH_TRACE.md` or equivalent trace section for any multi-artifact launch, so research decisions flow into product, brand/design, build, analytics, revenue, privacy, store, and verification work
+- `11_STAR_EXPERIENCE.md` and `11-star-experience.html` before build handoff, so the complete product experience shapes product, onboarding, paywall, ads, screenshots, content, and engineering contracts
+- `EMOTIONAL_DESIGN.md` and `emotional-design.html` before build handoff when the 11-star target is 6-star or higher, so the core loop, onboarding, and paywall carry engineered emotion: a Card Application Map (each magical moment → an Experience Card + PostHog event + bright-line guardrail + reduced-motion fallback), an ethics attestation for every applied card, and a user-control escape hatch + counter-metric + truthfulness proof for every HIGH-risk card (variable reward, streak, scarcity, urgency, social proof); `EMOTIONAL_AUDIT.md` when auditing an existing app, with every journey enumerated, scored through the six-lens review, and given a pathway to a better state; `check:emotional-design` must pass
+- product brainstorm checkpoint after research and before engineering plans when multiple product shapes remain viable
+- canonical `DESIGN.md` and rendered HTML visual proof when visual design, screenshots, or landing UI are in scope
+- `engineering/TECH_SPEC.md` when implementation includes backend APIs, database/storage, auth, subscriptions, email, analytics, AI, push, account deletion, app integrity, or non-trivial platform behavior
+- `AGENTS.md` for any real app build or builder handoff, plus `CLAUDE.md` when Claude/Rork/tooling expects it
+- `engineering/ENGINEERING_PLAN.md` before implementation when actual frontend/backend/app build work is in scope
+- `engineering/PRODUCTION_READINESS.md` with frontend, backend, provider, mobile-device, and release evidence before beta, store submission, or launch is called ready
+- onboarding/paywall flow proof when the app asks setup questions, uses a paywall, or depends on first-session conversion
+- public privacy and terms pages when collecting data or payments
+- support and privacy contact routes tested from external sender
+- upfront analytics/attribution plan rendered for the founder, plus event catalog and at least one verified event when implementation exists
+- self-reported attribution data contract when onboarding/signup/waitlist exists: early visible screen, stable source keys, `other` free text, `attribution_source_selected`, PostHog person property, backend/profile persistence, and anonymous-to-identified reconciliation
+- paid user acquisition contract when the launch depends on paid ads, Apple Search Ads, Meta/TikTok/Google campaigns, custom product pages, paid creative tests, or paid growth claims: `PAID_UA.md`, one-channel focus, creative cadence, baseline/blended report, RevenueCat LTV/CPA economics, store destination, stop/scale rules, and founder spend approval
+- viral growth contract when the launch depends on referrals, share-to-unlock, creator CTAs, social-comment loops, or TikTok/Reels/Shorts acquisition: `VIRAL_GROWTH.md`, fair fallback, abuse controls, analytics proof, and stop/scale rules
+- Resend or equivalent email path verified when the launch sends confirmation, lifecycle, marketing, billing, support, or admin email
+- App Store/Play product and privacy disclosure mapping when submitting
+- copy-paste App Store Connect/Google Play packet with exact click paths, field values, privacy answers, screenshot upload matrix, and founder-only gates when submitting
+- `store/APPLE_SIGNING.md` when Apple distribution, TestFlight, physical-device signing, or first upload readiness is in scope; simulator builds alone are not release proof
+- `store/APPLE_APP_STORE_REQUIREMENTS.md` when iOS App Store Connect upload/submission is in scope; privacy manifest files, required reason APIs, SDK manifests/signatures, Xcode privacy report, App Privacy labels, purpose strings, ATT, account deletion, review notes, and upload warnings must be proved or explicitly blocked
+- RevenueCat/Stripe/store products only if monetization is active, with purchase-to-entitlement validation
+- live domain checks: HTTP 200, HTTPS, metadata, security headers, robots/sitemap/`llms.txt`, schema where public site exists
+- release health: crash/error monitoring or a documented no-Sentry reason
+- support path for account deletion, refunds, restore purchases, and billing issues
+- security validator/scanner/review proof or a founder-approved blocked route before the app is called beta/store/production ready
+- UGC/Fastlane or equivalent post-launch organic content engine when the launch depends on social distribution, marked deferred if not yet needed
+- `growth/DEMO_VIDEO.md` or equivalent when launch/store/social/support work needs app-flow demo videos, with MobAI recorder or desktop recorder artifacts linked
+- LaunchBench or deterministic validator evidence for known failure modes before a launch is described as complete
+
+## Optional But High-Leverage
+
+Add when the launch depends on paid acquisition, creators, web checkout, or rapid iteration:
+
+- Firecrawl crawl of competitor sites, pricing pages, onboarding funnels, policies, and blog/FAQ content
+- XPOZ creator list with handles, platform, proof angle, outreach status, and content format
+- AppKittie app watchlist with keywords, ads, reviews, screenshots, revenue/download deltas
+- RevenueCat Web Purchase Links or Web Funnels for direct web acquisition
+- PostHog feature flags/experiments or RevenueCat experiments for paywall, onboarding, offer, referral, lifecycle, and landing variants
+- `operations/ORCHESTRATION.md` and `state/business-state.json` record the parallel-agent preflight, critical-path split, candidate units, file ownership, serialized resources, spawned agents, collision checks, integration, and validators
+- safe parallel agents/worktrees for independent research, static audits, frontend/backend units, fixtures, and test lanes, with the orchestrator owning integration, git, and full suites
+- `state/business-state.json` updated after each material provider, store, analytics, revenue, email, or readiness change
+- Compound Engineering `ce-proof` or `ce-demo-reel` artifacts for founder/reviewer inspection of shipped app behavior
+- Higgsfield-generated mascot, app icon, demo video, screenshot art, ad creative, and animation clips constrained by `DESIGN.md`
+- Higgsfield-generated landing-page hero and feature-section visuals (product-photoshoot `hero_banner` / `lifestyle_scene` / `ad_creative_pack` modes, DESIGN.md brief required); route recorded in `CONTENT_ASSETS.md` — see the **Cheap-First Direction (z_image → production model)** recipe in `tool-recipes/visual-and-motion-production.md`
+- Higgsfield-generated press/PR imagery (product-photoshoot `lifestyle_scene` or `conceptual_product` mode, or `gpt_image_2` for flat editorial art, DESIGN.md brief required); route recorded in `CONTENT_ASSETS.md` — see the **Cheap-First Direction (z_image → production model)** recipe in `tool-recipes/visual-and-motion-production.md`
+- Higgsfield win-back ad creative for lapsed/cancelled subscribers (marketing_studio_video `ugc` or `product_review` mode, or Soul-Once Founder-Face flow); route recorded in `CONTENT_ASSETS.md` — see the **Soul-Once Founder-Face Ads** and **App Store URL → UGC Ad Batch (Click-to-Ad)** recipes in `tool-recipes/visual-and-motion-production.md`
+- MobAI-backed screenshot capture matrix for real app screens before final store compositions
+- MobAI `mobile-recorder-skill` or `desktop-recorder-skill` for polished reproducible app-flow demos: `.mob` or `screenplay.json`, raw capture, edited export, captions, and upload copy
+- XcodeBuildMCP-backed Apple screenshot/test/video fallback after founder confirmation when MobAI is unavailable
+- UGC Day 0 experiment with 3-5 creators, founder-written scripts, creator contracts, payment model, disclosure rules, tracker, and stop/scale thresholds
+- paid UA weekly operating report with one selected channel, 3-5 asset cadence, RevenueCat LTV/cohort review, ASC/Play/PostHog baseline, and spend approval
+- Fastlane workspace setup with connected social accounts, Blitz angles/preferences, MobAI/Higgsfield media inputs, sanitized API logs, and a 30-day organic content plan
+- Push/email lifecycle plan for onboarding, trial reminders, billing issues, cancellation, win-back, and review prompts
+- Resend Automations for waitlist, welcome, onboarding resume, trial reminders, payment recovery, and win-back when email is the right channel
+- Resend Broadcasts/Contacts/Topics for product updates and launch announcements with preference handling
+- MMP/SKAdNetwork/ASA attribution decision for paid channels
+- TestFlight or closed beta cohort and feedback tracker
+- FAQ/help center seeded from reviews, support questions, and objections
+- Impeccable/Taste/Layers-informed design audit before public screenshots, landing pages, or generated-app handoff
+
+## Common Missing Pieces
+
+Flag these aggressively:
+
+- `state/business-state.json` is missing, stale, or inconsistent with actual docs/provider state.
+- A lane is marked `done` on top of an upstream lane that never locked — design signed off against a still-moving spec, ASO metadata locked before the name, content assets rendered from unlocked design tokens, engineering called ready without a locked `engineering/TECH_SPEC.md`. `check:lane-coverage` catches this; a `dependency_override` still sitting there weeks later is the same miss wearing a reason.
+- The agent assumes the founder knows business tooling, dumps a setup checklist, asks the founder to choose the next lane, or stops after access instructions instead of operating the business.
+- A password, passkey, 2FA/recovery code, cookie, or raw Doppler/social token is requested in chat; Doppler is misrepresented as browser-password storage; or shared personal credentials are used when delegation/OAuth exists.
+- The session update omits current lane status, blockers, proof, or required approvals.
+- Autonomy mode is not recorded, and the agent mutates provider/store/public state without a named approval scope.
+- A known miss happened again but no LaunchBench scenario, validator, or failure card was added.
+- A paid/account-gated tool is missing in the runtime and the agent silently starts the free fallback without founder confirmation.
+- Paid acquisition is marked ready without `PAID_UA.md`, a one-channel decision, creative production cadence, baseline/blended reporting, RevenueCat LTV/CPA review, stop/scale rules, and founder-approved spend.
+- Doppler or the approved secret provider is not selected before API keys, webhook secrets, CI/deploy env vars, service-account files, or local `.env` files appear.
+- Security is treated as a general vibe instead of a lane with `trust/SECURITY.md`, `trust/security-review.html`, threat model, tool routing, release proof, and accepted risks.
+- Claude Security, Codex Security, GitHub Advanced Security, Snyk, Semgrep, Socket, MobSF Cloud, or commercial app-integrity tools are skipped without founder-approved fallback routing.
+- `trust/SECURITY.md` lacks OWASP MASVS/ASVS source basis, platform-specific iOS/Android hardening, revenue/webhook abuse controls, supply-chain checks, monitoring, incident response, or accepted-risk ownership.
+- Public accounts, payments, user content, or sensitive data exist but no `security@domain`, `.well-known/security.txt`, or equivalent vulnerability-reporting route is planned.
+- Doppler setup, service-token, or CI/live secret instructions were copied from memory without refreshing current official docs and local CLI help.
+- A new secret-bearing variable appears in code, CI, mobile build config, provider setup, or docs without a matching `SECRETS.md` entry.
+- Secret-bearing commands run from a developer shell but are not documented through `doppler run --` or the approved provider wrapper.
+- Production uses a personal Doppler/CLI token instead of a service token, provider integration, OIDC, or platform-native secret store.
+- `.env.example` contains real-looking values, or `.env`, service-account JSON, `.p8`, `.p12`, OAuth refresh tokens, provisioning files, or raw keys are committed.
+- A public client variable such as `NEXT_PUBLIC_*`, `PUBLIC_*`, or `EXPO_PUBLIC_*` contains a server secret.
+- AppKittie was used for category only, not competitor reviews, screenshots, ads, creator signals, or keyword batches.
+- XPOZ was skipped, so copy is based on founder language instead of market/user language.
+- Firecrawl was not used to inspect competitor landing pages, pricing, policy pages, or funnel claims.
+- Product research left multiple viable wedges, onboarding shapes, or monetization paths, but no `ce-brainstorm` or equivalent requirements source resolved them before engineering.
+- No `11_STAR_EXPERIENCE.md` or visual ladder exists, so product, design, ads, screenshots, and engineering optimize separate interpretations of the magic.
+- The 11-star board exists but lacks a line of feasibility or complete product experience, so agents either overbuild fantasy or ship a generic 5-star product.
+- The product reaches a 6/7-star target with no `EMOTIONAL_DESIGN.md`, so onboarding, core loop, and paywall ship as functional screens with no engineered emotional curve, no Card Application Map, and no measurable emotional moments.
+- A Variable Reward, Streak, Scarcity, Urgency, or Social Proof mechanic ships without its ethics attestation, user-control escape hatch, counter-metric, and truthfulness proof — an unflagged dark pattern and a compliance veto, not a growth win.
+- An emotional or UX audit returns prose findings with no per-journey card mapping, no star-level, and no concrete pathway to a better state, so nothing can be integrated into the experience contract.
+- No `AGENTS.md` exists, or it fails to point agents to canonical docs, Compound Engineering routing, MobAI rules, analytics, revenue, privacy, and E2E gates.
+- No lightweight app-local agent roster exists for continuing the app after bootstrap, or the roster lacks orchestrator, marketing, engineering, product, design, and customer-success ownership.
+- `CLAUDE.md` duplicates product truth instead of pointing to `AGENTS.md`, causing builder/runtime drift.
+- App-local agents/subagents are used as uncoordinated implementers instead of scoped reviewers or isolated workers under an orchestrator.
+- Parallel subagents were launched without `operations/ORCHESTRATION.md`, a file-overlap check, worktree isolation, forbidden actions, output review, or an orchestrator owning git, integration, and full test suites.
+- MobAI/native iOS/device automation ran in parallel on the same simulator/device or produced screenshots without backend/provider verification.
+- Demo video was recorded by improvising during capture instead of using recorder-skill choreography/screenplay, dry-run, raw capture, final export, captions, and rerenderable artifacts.
+- XcodeBuildMCP was used as a MobAI fallback without founder confirmation, or Android coverage was implied even though XcodeBuildMCP is Apple-only.
+- XcodeBuildMCP commands, MCP tool names, setup snippets, privacy settings, or screenshot/test proof were copied from stale local skills without checking official docs and `xcodebuildmcp --help`/tool listings.
+- Engineering was declared done from unit/widget tests only; no frontend-to-backend, provider, entitlement, analytics, email, or database proof exists.
+- `engineering/PRODUCTION_READINESS.md` is missing, or it lacks command outcomes, fixture/account details, evidence paths, blocked E2E flows, and founder-only gates.
+- `DESIGN.md` is missing, unlinted, or duplicated by conflicting design-token docs.
+- Visual direction exists only as prose, screenshots, or image files; no rendered HTML proof uses the design system.
+- Higgsfield was skipped for visuals/motion, or generated assets ignore the design system.
+- A generated-asset surface (win-back creative, landing-page hero/feature visuals, press/PR imagery) has no recorded Higgsfield route or approved fallback in `CONTENT_ASSETS.md`.
+- Onboarding has questions but no reason matrix, attribution capture, review-prompt gate, paywall timing, closing-offer decision, or activation event.
+- Stripe checkout works but does not grant a RevenueCat entitlement.
+- Store products exist but are not attached to the app version, offering, entitlement, or review notes.
+- App Store Connect or Google Play values exist only in prose; no click paths, field limits, copyable packet, App Store listing packet, privacy worksheet, or HTML mock console exists.
+- App Store listing prep stops at basic metadata and screenshots while skipping Apple pre-ASC requirements, App Privacy, RevenueCat/Stripe/web-funnel pricing, custom product pages, In-App Events, localization, or Higgsfield/design-system marketing assets.
+- ASC CLI automation exists but no `store/store-console.html`, manual click path, dry-run/applied distinction, or founder approval list exists.
+- Simulator build succeeds, but Apple Developer membership, Team ID, `DEVELOPMENT_TEAM`, bundle ID/App ID, app record, distribution signing, certificates/profiles, archive/export/upload, or TestFlight processing are unknown.
+- The local Mac only has an `Apple Development` identity, but the launch is described as App Store/TestFlight-ready without Xcode cloud-managed signing, an Apple Distribution identity/profile, or a CI/cloud signing route.
+- A bundle ID/app record/SKU is created from provisional naming before founder approval, domain ownership, seller-name implications, and RevenueCat/push/OAuth/associated-domain dependencies are considered.
+- ASC CLI auth is missing or interactive, but the agent keeps attempting mutating app-record commands instead of recording the auth blocker and asking for the approved credential path.
+- Apple App Privacy and Google Play Data safety answers are not traceable to the same data inventory.
+- Screenshots are planned but not tied to actual device captures, display wells, final dimensions, locale, and upload status.
+- No app preview video is planned, even though app previews autoplay muted and precede screenshots at the top of the product page — leaving the highest-attention surface (the silent ~5-second autoplay hook) empty.
+- The app preview hook or screenshots are generic and knowledge-free: they do not draw on the Asset Knowledge Brief (target user/problem from `strategy/RESEARCH.md`, the magical moment from `11_STAR_EXPERIENCE.md`, the Emotional North Star and Experience Card from `EMOTIONAL_DESIGN.md`), or they were hand-composed instead of run through the screenshot ASO skill (`ParthJadhav/app-store-screenshots` / `ios-screenshots` / `app-preview-video`).
+- Web pricing mentions an intro offer but omits renewal price or monthly option.
+- Privacy/terms pages exist but contact emails are untested.
+- Resend domain exists but SPF/DKIM/DMARC, API key scope, webhook verification, idempotency keys, or unsubscribe handling are missing.
+- Lifecycle email is implemented as one-off sends with no Contacts/Topics/Broadcasts/Automations decision.
+- Analytics exists but purchase, restore, referral, and onboarding events are missing.
+- Analytics is planned only as PostHog install steps, with no identity model, attribution matrix, dashboard plan, privacy mapping, or founder-visible `analytics/analytics-plan.html`.
+- Technical attribution exists but no self-reported "How did you hear about us?" source is captured early in onboarding/signup.
+- Self-reported attribution exists as UI or a one-off event only, with no stable stored key, no `other` free text, no PostHog person property, no backend/profile persistence, or no anonymous-to-identified reconciliation.
+- Attribution options are persisted as display labels instead of stable keys such as `x_twitter`, `friend`, `app_store_search`, or `creator`.
+- An agent describes attribution as "wired" even though `self_reported_source` is not visible in PostHog person properties or the backend/profile record.
+- PostHog events exist but initial/latest UTM, referrer, click IDs, creator/referral codes, Fastlane content angle, and store/deep-link context are not preserved where possible.
+- Feature flags, experiments, session replay, or surveys are enabled without privacy controls, sampling/consent posture, and store/privacy disclosure mapping.
+- Sentry/crash reporting is absent or not connected to alerts.
+- No `state/LAUNCH_TRACE.md` exists, so research, brand, design, store, privacy, revenue, and implementation decisions drift across docs.
+- `engineering/TECH_SPEC.md` is missing even though the app needs backend schema, API contracts, state machines, permissions, provider webhooks, app integrity, or fixtures.
+- App Store Accessibility Nutrition Labels are ignored, or accessibility support is claimed without testing common tasks on each supported device.
+- Google Play pre-launch report, App content declarations, sensitive permission forms, or reviewer access instructions are not planned before release.
+- App integrity/abuse controls such as Apple App Attest/DeviceCheck, Google Play Integrity, rate limits, idempotency, and replay protections are skipped for paid or backend-mutating flows.
+- No support/refund/delete-account path exists before public users arrive.
+- Fastlane account connections or API keys exist but are undocumented, unverified, or not tied to approved campaign angles and real product media.
+- UGC is planned as generic content ideas instead of a 90-day fit-gated format-discovery experiment with creator sourcing, rights, payment, tracking, and stop/scale rules.
+- Short-form content is scheduled without founder approval, warmup, platform limits, or app-store/legal claim review.
+- No post-launch weekly monitoring loop is assigned.
+
+## Handoff Completeness Checklist
+
+The Coverage Matrix above asks "does this lane have evidence?". This checklist asks the harder question `SKILL.md`'s Deliverable Standard sets: **can a future agent pick this package up without re-deciding the business?** Walk it before any launch-readiness claim or handoff. Every item must be answerable from durable files, not chat memory.
+
+**Business and scope**
+
+- what the app is and who it is for
+- what category it competes in and why
+- what the app must deliver in the accepted product, what is explicitly outside the promise, and what is banned
+- what `project.launchScope` says about confirmed scope, which lanes a essentials scope deferred with dated reasons, and when they revisit
+
+**State and operating record**
+
+- what `state/business-state.json` says about phase, autonomy mode, lane statuses, provider state, orchestration strategy, proof, active failure cards, and current blockers, plus the current result and next action reported to the founder
+- what paid/account-gated tools were intended, whether the founder confirmed paid access or fallback use, and what `strategy/TOOL_DECISIONS.md` says
+- what `SECRETS.md` says about Doppler or approved secret-provider routing, local/staging/production configs, service tokens, command wrappers, and new-secret handling
+- what `operations/AGENT_OPERATIONS.md` and its ledger say about capability inventory, approval envelopes, exact account/environment targeting, before/after proof, and state reconciliation
+- what `operations/BUSINESS_ACCESS.md` and its ledger say about business identity, account ownership, delegated access, recovery/MFA ownership, and the open founder gate
+
+**Product and experience**
+
+- what `11_STAR_EXPERIENCE.md` and `11-star-experience.html` say about the 1/2/5/6/7/10/11-star ladder, line of feasibility, complete product experience, and surface translation
+- what `state/LAUNCH_TRACE.md` says about how research became product, 11-star experience, paid UA, viral growth, brand, design, build, store, legal, revenue, analytics, and verification decisions
+- what product decisions were resolved after research, and whether `ce-brainstorm` produced the requirements source before implementation planning
+- what `EMOTIONAL_DESIGN.md` (or `EMOTIONAL_AUDIT.md`) says about the Emotional North Star, target curve, Card Application Map, per-card events, ethics attestations, HIGH-risk escape hatches, and reduced-motion fallbacks
+- what onboarding sequence sells the value, collects personalization/attribution data, times review prompts, and routes to the right paywall/offer
+
+**Brand and design**
+
+- what the brand sounds and looks like
+- what `DESIGN.md` tokens/components govern the UI, what `UX_PATTERNS.md` says about Refero/fallback research, flow maps, state matrices, and bug traps, and what HTML proofs demonstrate the system in use
+
+**Measurement and growth**
+
+- what analytics and attribution plan is visible to the founder upfront, which current PostHog docs informed it, and what `analytics/analytics-plan.html` shows
+- what self-reported attribution data contract exists: early screen, stable source keys, `other` free text, PostHog person property, backend/profile persistence, anonymous-to-identified reconciliation, and verification evidence
+- what analytics events, identity links, attribution properties, funnels, dashboards, experiments, session replay/survey settings, and QA probes define activation, conversion, retention, and growth
+- what `PAID_UA.md` says about fit, one-channel choice, creative production, tracking baseline, blended report, RevenueCat LTV/CPA review, weekly cadence, stop/scale rules, and founder-only spend gates
+- what `VIRAL_GROWTH.md` says about fit, product loop, content loop, referral/share mechanics, monetization timing, abuse controls, format tests, analytics proof, stop/scale rules, and founder-only gates
+- what `growth/LAUNCH_NARRATIVE.md` says about the feeling-first launch thesis and emotional angle, the tentpole and weekly feature-launch cadence and how they compound into a standing audience, the launch-day run-of-show, post copy that passes the 2026 copy guardrails, measurement, stop/scale rules, and founder-only posting gates
+- what UGC fit decision, 90-day creator plan, creator budget, sourcing approach, script/format loop, disclosure rules, and stop/scale thresholds exist
+- what Fastlane workspace, social connections, content angles, Blitz preferences, approved media inputs, schedule, and analytics loop exist after launch
+
+**Store and release**
+
+- what App Store listing, screenshot, ad, and launch sequence to use
+- what `LOCALIZATION_MARKET_RESEARCH.md` says about the market opportunity matrix, priority tiers (Tier 1 full localize / Tier 2 metadata-only / Tier 3 defer), native-keyword sourcing, which surfaces each market localizes, and the post-launch refresh — so localization follows search demand instead of translating into every language
+- what the App Store listing preparation packet says about default listing fields, App Privacy answers, pricing/subscription setup, RevenueCat/Stripe/web-funnel alignment, in-app events, custom product pages, localization, generated or rendered marketing assets, and founder-only approval gates
+- what `store/APPLE_APP_STORE_REQUIREMENTS.md` says about official Apple source basis, `PrivacyInfo.xcprivacy`, `NSPrivacyCollectedDataTypes`, `NSPrivacyAccessedAPITypes`, required reason API reasons, tracking domains, third-party SDK manifests/signatures, Xcode privacy report, App Privacy labels, protected-resource purpose strings, ATT, account deletion, review notes, archive/upload warnings, and founder approval before ASC upload/submission
+- what Apple Developer account, Team ID, bundle ID/App ID, app record, signing, certificate/profile, archive/export/upload, and TestFlight state exists, including why simulator builds (in-app pane included) do or do not prove distribution readiness
+- what exact App Store Connect and Google Play Console pages the founder must visit, what to paste in each field, which ASC CLI/skill-pack route applies to each ASC task, and which items require founder approval
+- what store-console, screenshot, ASO, ratings/reviews, localization, and post-launch monitoring loops are required
+- what device screenshots must be captured with the in-app iOS Simulator (fixture accounts only), MobAI, Codex Desktop native iOS/XcodeBuildMCP, serve-sim, SnapshotPreviews preview proof, or equivalent tooling; how raw captures become composed iPhone/iPad/Play screenshots through ParthJadhav/app-store-screenshots or equivalent export boards with copy overlays, App Icon/App Preview route, final upload wells, ASC validation, and visual QA; and which screenshots are still blocked
+- what `store/GOOGLE_PLAY_RELEASE.md` says (when Android is in scope) about the developer account type, Data Safety reconciliation with the iOS labels, content rating, Play App Signing/AAB, target API level, release tracks, the closed-testing gate, and the pre-launch report
+
+**Money, legal, and lifecycle**
+
+- what RevenueCat/Stripe/app-store products unlock, how purchases map to entitlements, and how web purchases redeem in app
+- what privacy, terms, account deletion, subscription, and app-store data disclosures say
+- what support/privacy/security email addresses exist, route to, and have been tested
+- what transactional, lifecycle, broadcast, unsubscribe, and inbound/reply email paths exist, how Resend is configured, which starter templates were copied or adapted, and how those templates map to `DESIGN.md`
+- what public pages are crawlable, citeable, schema-marked, and discoverable by AI/search systems
+
+**Build, security, and proof**
+
+- what `trust/SECURITY.md` and `trust/security-review.html` say about threat model, data classification, platform hardening, app integrity, entitlement/webhook abuse controls, supply-chain checks, monitoring, incident response, paid-security-tool routing, accepted risks, and release proof
+- what `engineering/TECH_SPEC.md` says about data model, API contracts, app states, permissions, integrations, feature flags, app integrity, and fixtures when implementation is in scope
+- what the `engineering/TECH_SPEC.md` Data Contract says about backend selection (and its reason), data model, tested authorization model, and migrations/environments — and how archetype prompts were adapted when the route is not Supabase
+- what `operations/ORCHESTRATION.md`, `AGENTS.md`, `CLAUDE.md`, `APP_AGENTS.md`, and `agents/` say, including security-architect ownership, what `engineering/ENGINEERING_PLAN.md` and `engineering/PRODUCTION_READINESS.md` require, what Compound Engineering plan/execution path applies, where parallel agents/worktrees are safe, which shared resources are serialized, and what production-readiness proof is required
+- what MobAI mobile recorder, desktop recorder, or Remotion artifacts exist in `growth/DEMO_VIDEO.md` or `CONTENT_ASSETS.md`: `.mob` or `screenplay.json`, Remotion composition IDs, raw capture, final export, captions, upload copy, and rerender path
+- what repo/docs/assets a builder should read first
+- what LaunchBench scenarios or deterministic validators were run, what failure cards remain active, and why no known miss is being hidden by prose
+- what `operations/POST_LAUNCH_OPS.md` and `operations/LAUNCH_RETRO.md` say about the weekly operating rhythm, crash route and release gate, review-response SLA, retention cohort source, support routing, and which retro findings became failure cards or LaunchBench candidates
+- what is live, what was verified, and what still requires founder action
+
+## Audit Output
+
+Return:
+
+- coverage table with lane, status, evidence path, and blocker
+- top 5 launch blockers
+- top 5 high-leverage optional improvements
+- founder-only decisions
+- exact files/docs to create or patch next