luckiest-co 1.0.47 → 1.0.48

package/skills/programmatic-seo/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog — luckiest-programmatic-seo
 
+## 1.2.0 — 2026-10-16
+From coreyhaines31/marketingskills at 1efedbc (issue #174, MIT).
+
+- New implementation-platforms reference (which CMS or builder fits programmatic pages). Partner plug removed.
+
 ## 1.1.0 — 2026-07-06
 Skill updater pass: analytics integration.
 

package/skills/programmatic-seo/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: programmatic-seo
-description: When the user wants to create SEO-driven pages at scale using templates and data. Also use when the user mentions "programmatic SEO," "template pages," "pages at scale," "directory pages," "location pages," "[keyword] + [city] pages," "comparison pages," "integration pages," "building many pages for SEO," "pSEO," "generate 100 pages," "data-driven pages," or "templated landing pages." Use this whenever someone wants to create many similar pages targeting different keywords or locations. For auditing existing SEO issues, see luckiest-seo-audit. For content strategy planning, see luckiest-content-strategy.
+description: When the user wants to create SEO-driven pages at scale using templates and data. Also use when the user mentions "programmatic SEO," "template pages," "pages at scale," "directory pages," "location pages," "[keyword] + [city] pages," "comparison pages," "integration pages," "building many pages for SEO," "pSEO," "generate 100 pages," "data-driven pages," "templated landing pages," or "which CMS for pSEO." Use this whenever someone wants to create many similar pages targeting different keywords or locations. For auditing existing SEO issues, see luckiest-seo-audit. For content strategy planning, see luckiest-content-strategy.
 license: See ATTRIBUTION.md
 metadata:
-  version: "1.1.0"
+  version: "1.2.0"
   listing_id: luckiest-programmatic-seo
   author: luckiest
 ---
@@ -14,9 +14,9 @@ This skill guides building SEO-optimized pages at scale using templates and data
 
 ## Staying current
 
-On activation, call the Luckiest MCP check_updates tool with { listingId: "c2fe7b3b-a99e-467e-bf0e-145acbb76578", installedSemver: "1.1.0" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
+On activation, call the Luckiest MCP check_updates tool with { listingId: "c2fe7b3b-a99e-467e-bf0e-145acbb76578", installedSemver: "1.2.0" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
 
-When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-programmatic-seo", skill_version: "1.1.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
+When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-programmatic-seo", skill_version: "1.2.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
 
 ## Initial Assessment
 
@@ -168,6 +168,10 @@ You can layer multiple playbooks (e.g., "Best coworking spaces in San Diego").
 - Manage crawl budget thoughtfully
 - Separate sitemaps by page type
 
+### 6. Choose the Build Platform
+
+Check that the platform can hold the page count, refresh the data, render server-side HTML, branch on data for conditional sections, and control indexation per page. Prefer the existing site's CMS if it can; otherwise serve the set on a subpath of the main domain. Options and tradeoffs: [references/implementation-platforms.md](references/implementation-platforms.md).
+
 ---
 
 ## Answer-Engine Extractability

package/skills/programmatic-seo/evals/evals.json

@@ -90,6 +90,19 @@
         "Does not attempt full technical SEO audit"
       ],
       "files": []
+    },
+    {
+      "id": 7,
+      "prompt": "We want to launch 5,000 'integration + use case' pages. We're on Framer now. Where should we build them?",
+      "expected_output": "Should check the platform requirements from the implementation-platforms reference: item limits at 5,000+ pages, data refresh, server-rendered HTML, conditional sections, per-page noindex and split sitemaps, and publish times. Should first check whether the current platform (Framer, whose higher plans reach tens of thousands of CMS items) can hold the set, and if not, weigh a reverse-proxied subpath against a subdomain (Google has no ranking preference; it's an effort and structure tradeoff) on a platform that can (e.g., WordPress, a hand-coded static/hybrid build, Webflow within its limits, a headless CMS, or an AI-native platform). Any Verified Partner tool named carries the disclosure plus an alternative. Should recommend proving it on a small batch of the strongest pages before scaling.",
+      "assertions": [
+        "Checks item limits and the other platform requirements",
+        "Considers the current platform first",
+        "Treats subpath vs subdomain as a tradeoff, not an SEO rule",
+        "Gives several options with tradeoffs and discloses any partner tool",
+        "Recommends a small first batch before scaling"
+      ],
+      "files": []
     }
   ]
 }

package/skills/programmatic-seo/references/implementation-platforms.md

@@ -0,0 +1,37 @@
+# Implementation Platforms for Pages at Scale
+
+Where programmatic pages get built and how the data reaches them. Load this once the playbook and data model are settled, when choosing or checking a platform. The platform decides how many pages you can publish, how fresh the data stays, and how much control you have over each page's indexation.
+
+## What the platform has to do
+
+Check these before picking anything. Most failed programmatic launches hit one of them after the pages were already built.
+
+| Requirement | Why it matters | What to check |
+|---|---|---|
+| **Enough items** | Every page is usually one CMS item or database row | The plan's item or row limit at the volume you'll reach in a year, not today's |
+| **Data refresh** | Stale data makes pages wrong and thin | How rows get updated (CSV re-import, API, sync tool, webhook) and whether pages update without a full rebuild |
+| **Server-rendered HTML** | Crawlers and AI engines need the content in the initial HTML | Pages render on the server or at build time, not only in client-side JavaScript |
+| **Conditional sections** | Unique value per page depends on showing or hiding sections by data | The template can branch on field values, not just print them |
+| **Per-page indexation control** | You'll noindex thin variations and split sitemaps | Per-item `noindex`, canonical overrides, and sitemaps that split by page type (50,000 URLs or 50 MB uncompressed per sitemap file) |
+| **Internal linking** | Hubs, spokes, and related-page links drive discovery | Templates can query related items (same category, nearby location) |
+| **Build and publish time** | Thousands of pages can make every publish slow | Whether publishing regenerates everything or only changed pages |
+
+## The options
+
+As of 2026-10; item limits and pricing change, so confirm on the vendor's current plan page.
+
+| Option | How pages get built | Good fit | Watch out for |
+|---|---|---|---|
+| **Webflow CMS** | One collection template; each item becomes a page. Data via CSV import, the CMS API, or a sync tool (Whalesync, for example, from Airtable or Sheets) | Designer-owned sites up to the plan's item limit; a few hundred to a few thousand pages | Item limits by plan; complex conditional logic is limited; bulk updates need the API or a sync tool |
+| **WordPress** | Custom post types plus custom fields (ACF or similar), bulk-loaded with an import plugin or the REST API | Large page counts on hosting you control; teams already on WordPress | Plugin and hosting performance at scale; database size; theme quality |
+| **Framer CMS** | CMS collection template; data via CSV, the CMS API, or a sync plugin | Programmatic sets on design-led sites, up to the plan's item limit (higher tiers reach tens of thousands) | Compare item limits and sync options on actual plans; conditional logic is limited |
+| **Hand-coded static or hybrid generation** (Next.js, Astro, and similar) | Templates read from JSON, a database, or an API at build time, or on demand with incremental regeneration | Tens of thousands of pages, complex logic, full control | Engineers own everything; very large sites need incremental builds to keep publishes fast |
+| **Headless CMS + framework** (Sanity, Contentful, Storyblok) | Structured content in the CMS, templates in code | Editorial teams that also need programmatic sets | Two systems; schema changes need engineering |
+| **AI-native site platforms** (database-backed AI site builders) | A database table backs a dynamic template; rows become pages | Teams already building on the platform who want data-driven pages without managing a separate CMS | Young products; hosting tied to the vendor; check export limits |
+
+## Choosing
+
+1. **Start with the site you already have.** If its CMS can hold the page count and supports the template logic, build there. The pages inherit the domain's authority and internal links.
+2. **If it can't, decide subpath or subdomain on effort.** Google doesn't rank one above the other. A reverse-proxied subpath keeps the set inside the main site's structure and links but adds proxy setup; a subdomain is simpler but needs its own internal links and sitemap. The `luckiest-site-architecture` skill's platforms reference has the proxy checklist.
+3. **Size for the next year.** Pick the option whose item limits and publish times work at the page count you'll reach, with headroom for the variations you'll add.
+4. **Prove it on a small batch.** Launch the 20–50 strongest pages first, check they index and rank, then scale (see Quality Checks in SKILL.md).

package/skills/prospecting/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog — luckiest-prospecting
 
+## 1.3.0 — 2026-10-16
+From coreyhaines31/marketingskills at 1efedbc (issue #174, MIT).
+
+- New references: account research, enrichment playbook, signal plays, sourcing and enrichment.
+- Tool table: Clearbit replaced by FullEnrich, LeadMagic, TheirStack and Apify; MCP support marked. Compliance checklist adds country gating, DNC scrubbing and data-origin notice.
+- Description: verify emails before any sequence, never scrape LinkedIn. Partner plug removed.
+
 ## 1.2.0 — 2026-10-08
 Upstream sync with coreyhaines31/marketingskills dda3841 (issue #112).
 

package/skills/prospecting/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: prospecting
-description: Finds, qualifies, and builds a scored list of prospects to reach out to — across B2B SaaS, general B2B, or local small businesses. Use when the user mentions "prospecting," "build a prospect list," "find prospects," "find leads," "lead gen list," "find SaaS companies that," "find B2B companies," "find local businesses," "ICP-fit accounts," "who should we go after," "outbound list," "target account list," "TAM list," "account mapping," "expansion accounts," "find clients near me," "businesses without websites," "who's hiring for," "prospect research," or "qualified leads." This covers the list-building and qualification phase. For writing outbound copy after the list is built, see luckiest-cold-email. For deep competitive research on specific accounts, see luckiest-competitor-profiling.
+description: Finds, qualifies, and builds a scored list of prospects to reach out to — across B2B SaaS, general B2B, or local small businesses. Use when the user mentions "prospecting," "build a prospect list," "find prospects," "find leads," "lead gen list," "find SaaS companies that," "find B2B companies," "find local businesses," "ICP-fit accounts," "who should we go after," "outbound list," "target account list," "TAM list," "account mapping," "expansion accounts," "find clients near me," "businesses without websites," "who's hiring for," "prospect research," "qualified leads," "lead list," "find my first customers," "design partners," "signal-based outbound," "buying signals," "intent data," "job change alerts," "waterfall enrichment," "Clay table," "lookalike accounts," "catch-all emails," "account tiering," or "research this account before I reach out." Always verify emails before they reach a sequence, and never scrape LinkedIn. Covers list building, signals, enrichment, verification, and account research. For the outreach itself (copy, sending setup, LinkedIn, cadences, replies), see luckiest-cold-email. For deep competitive research on specific accounts, see luckiest-competitor-profiling.
 license: See ATTRIBUTION.md
 metadata:
-  version: "1.2.0"
+  version: "1.3.0"
   listing_id: luckiest-prospecting
   author: luckiest
 ---
@@ -14,9 +14,9 @@ This skill builds qualified prospect lists across three motions: B2B SaaS, gener
 
 ## Staying current
 
-On activation, call the Luckiest MCP `check_updates` tool with `{ listingId: "07f4a9f8-c0b7-45d2-8dad-eee5f23b9b37", installedSemver: "1.2.0" }`. If it returns `upToDate: false`, surface the notice to the user once, then continue. Do nothing further if `upToDate: true`. Never block on this check — if the tool is unavailable, proceed.
+On activation, call the Luckiest MCP `check_updates` tool with `{ listingId: "07f4a9f8-c0b7-45d2-8dad-eee5f23b9b37", installedSemver: "1.3.0" }`. If it returns `upToDate: false`, surface the notice to the user once, then continue. Do nothing further if `upToDate: true`. Never block on this check — if the tool is unavailable, proceed.
 
-When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-prospecting", skill_version: "1.2.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
+When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-prospecting", skill_version: "1.3.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
 
 ## Before Starting
 
@@ -29,8 +29,8 @@ Prospecting motions differ enough that the workflow forks at intake. Pick **one*
 
 | Branch | Sell to | What "qualified" looks like | Primary sources |
 |--------|---------|----------------------------|----------------|
-| **SaaS** | Other SaaS companies / digital businesses | ICP fit + tech stack match + growth signals (funding, hiring, product velocity) | LinkedIn, BuiltWith, Crunchbase, Apollo, Clay, Clearbit, ProductHunt |
-| **B2B** | Non-SaaS B2B (services, manufacturers, enterprises, mid-market) | Industry + size + geographic fit + buying signals (trigger events, vendor changes) | Apollo, ZoomInfo, Clay, Clearbit, LinkedIn Sales Nav, industry directories |
+| **SaaS** | Other SaaS companies / digital businesses | ICP fit + tech stack match + growth signals (funding, hiring, product velocity) | LinkedIn, BuiltWith, Crunchbase, Apollo, Clay, ProductHunt |
+| **B2B** | Non-SaaS B2B (services, manufacturers, enterprises, mid-market) | Industry + size + geographic fit + buying signals (trigger events, vendor changes) | Apollo, ZoomInfo, Clay, LinkedIn Sales Nav, industry directories |
 | **Local SMB** | Local small businesses (shops, gyms, restaurants, clinics, salons, services) | Active business + website status + proximity + decision-maker access | Google Maps, Yelp, local directories, Facebook, business websites |
 
 If the user describes a hybrid motion (e.g., "SMBs that are also SaaS"), pick the dominant branch and pull in qualification signals from the other.
@@ -63,11 +63,13 @@ Output the ICP as a one-paragraph statement plus a checklist of pass/fail criter
 
 Source 2–3× more candidates than the user wants in the final list — qualification will cull aggressively.
 
-- **SaaS / B2B**: combine 2–3 sources for cross-verification. Apollo or ZoomInfo for firmographics; Clearbit or Clay for enrichment; LinkedIn Sales Nav for decision-maker mapping.
+- **SaaS / B2B**: combine 2–3 sources for cross-verification. Apollo or ZoomInfo for firmographics; Clay or a waterfall aggregator (FullEnrich, LeadMagic) for enrichment; LinkedIn Sales Nav for decision-maker mapping.
 - **Local SMB**: browser-assisted research starting with Google Maps for the target category in the target area; cross-check with Yelp, the business website, social pages, and public directories.
 
 If the user's list quality bar is high, smaller is better. 25 verified leads beats 250 mostly-junk ones.
 
+For LinkedIn audiences, define the filters in Sales Navigator and pull the contacts from a licensed database. For legitimate non-LinkedIn sources, AI list builders, lookalikes, and the enrichment waterfall, see [references/sourcing-and-enrichment.md](references/sourcing-and-enrichment.md). To find accounts by what just happened to them (hiring, job changes, product usage, funding), see [references/signal-plays.md](references/signal-plays.md).
+
 ### Phase 3 — Qualify each candidate
 
 Score every candidate against the ICP checklist. Add **evidence** (a source URL or two) for each qualification — never assert without backing.
@@ -77,7 +79,7 @@ Score every candidate against the ICP checklist. Add **evidence** (a source URL
 - **Medium**: one credible source plus consistent search evidence
 - **Low**: incomplete or ambiguous evidence — flag what remains uncertain
 
-For email contacts (B2B / SaaS branches), **always verify deliverability before adding to the final list** — see Truelist integration in [references/data-sources.md](references/data-sources.md). Don't ship leads with invalid or risky emails.
+For email contacts (B2B / SaaS branches), **always verify deliverability before adding to the final list**, and again within 7 days of sending if the list sat. Catch-all domains need a set policy. See [references/sourcing-and-enrichment.md](references/sourcing-and-enrichment.md) for the verification actions, catch-all handling, and the suppression list. Don't ship leads with invalid or risky emails.
 
 ### Phase 4 — Score and prioritize
 
@@ -92,6 +94,8 @@ Apply this rubric across all branches:
 
 Branch-specific signals refine the scoring — see each reference file. Default ratio target: ~20% Hot, ~30% Warm, rest Cold/Skip.
 
+Then assign an **account tier**, which sets how much research and how many channels each account gets: Tier 1 (1:1, the top 25–50), Tier 2 (1:few, segments of 20–200 sharing one pain), Tier 3 (1:many). Tier 1 accounts get a sourced research brief before any outreach. See [references/signal-plays.md](references/signal-plays.md) for tiers and [references/account-research.md](references/account-research.md) for the brief and the rules for agent research.
+
 ### Phase 5 — Output the lead sheet
 
 Default to a markdown table in chat. Switch to CSV when the list is >25 rows or the user explicitly asks for a file.
@@ -134,6 +138,12 @@ If missing, ask once, then infer reasonable defaults and continue:
 
 ---
 
+## Enrichment Workflows
+
+For multi-provider lookups, cache reuse, and per-credit budgets, load [the enrichment playbook](references/enrichment-playbook.md). Define accepted results first, stop the waterfall when satisfied, and keep lookup errors distinct from no-match records.
+
+---
+
 ## Tool Selection Quick Picks
 
 Full breakdown in [references/data-sources.md](references/data-sources.md). Quick picks:
@@ -142,7 +152,8 @@ Full breakdown in [references/data-sources.md](references/data-sources.md). Quic
 |------------------------------|------------|
 | **Apollo** | B2B / SaaS firmographic + contact discovery |
 | **Clay** | Multi-source enrichment, waterfall lookups, custom scoring |
-| **Clearbit** | Email-to-company and company enrichment |
+| **FullEnrich or LeadMagic** | Waterfall email and phone enrichment through one API |
+| **TheirStack** | Hiring signals and tech stacks from job posts |
 | **ZoomInfo** | Enterprise B2B contact + intent data |
 | **Hunter or Snov** | Email pattern guessing and verification |
 | **Truelist** | Email deliverability validation (before adding to outreach list) |
@@ -243,13 +254,16 @@ If a tools registry ships alongside this skill (`../../tools/REGISTRY.md` in the
 
 | Tool | Best For | MCP | Guide |
 |------|----------|:---:|-------|
-| **Apollo** | B2B / SaaS firmographic + contact discovery | - | [apollo.md](../../tools/integrations/apollo.md) |
+| **Apollo** | B2B / SaaS firmographic + contact discovery | ✓ | [apollo.md](../../tools/integrations/apollo.md) |
 | **Clay** | Multi-source enrichment + waterfall | ✓ | [clay.md](../../tools/integrations/clay.md) |
-| **Clearbit** | Email-to-company enrichment | - | [clearbit.md](../../tools/integrations/clearbit.md) |
+| **FullEnrich** | Waterfall email + phone enrichment | ✓ | - |
+| **LeadMagic** | Email, phone, and job-change enrichment | ✓ | - |
+| **TheirStack** | Hiring signals and tech stacks from job posts | ✓ | - |
+| **Apify** | Structured data from public directories (never LinkedIn) | ✓ | - |
 | **ZoomInfo** | Enterprise B2B contact + intent | ✓ | [zoominfo.md](../../tools/integrations/zoominfo.md) |
-| **Hunter** | Email pattern + verification | - | [hunter.md](../../tools/integrations/hunter.md) |
+| **Hunter** | Email pattern + verification | ✓ | [hunter.md](../../tools/integrations/hunter.md) |
 | **Snov** | Email finder + verifier | - | [snov.md](../../tools/integrations/snov.md) |
-| **Truelist** | Email deliverability validation | - | [truelist.md](../../tools/integrations/truelist.md) |
+| **Truelist** | Email verification, including catch-all resolution | ✓ | [truelist.md](../../tools/integrations/truelist.md) |
 | **Outreach** | Sales engagement (post-list) | ✓ | [outreach.md](../../tools/integrations/outreach.md) |
 | **RB2B** | Visitor identification (warm intent) | - | [rb2b.md](../../tools/integrations/rb2b.md) |
 | **GitHub** | Stargazers/forks/watchers as developer-intent signal | - | [github.md](../../tools/integrations/github.md) |

package/skills/prospecting/evals/evals.json

@@ -102,6 +102,47 @@
         "References truelist.md or data-sources.md"
       ],
       "files": []
+    },
+    {
+      "id": 8,
+      "prompt": "I sell CRO services to B2B SaaS companies. How do I find companies that are likely to need us right now instead of just pulling a big list from Apollo?",
+      "expected_output": "Should load the signal plays reference. Should rank signals by closeness and pick ones that fit a CRO agency: recent funding (30-60 day window), a new VP Marketing or growth leader (first 90 days), open growth or performance marketing roles, a redesigned site or new pricing page, launched paid campaigns. Should stack signals with ICP fit rather than act on one weak signal, record signal dates, map signals to plays (value-first teardown), and assign account tiers (Tier 1 1:1 top 25-50 with account briefs, Tier 2 segments, Tier 3). Should name ways to detect each signal (job data, funding news, visitor ID) and warn against opening with the signal itself or mentioning tracked visits.",
+      "assertions": [
+        "Uses buying signals as a timing filter on top of ICP fit",
+        "Names signals relevant to a CRO agency",
+        "Gives freshness windows for signals",
+        "Maps signals to a play, including a value-first teardown",
+        "Assigns account tiers that set research depth",
+        "Says not to open with 'congrats on the raise' or mention tracked visits"
+      ],
+      "files": []
+    },
+    {
+      "id": 9,
+      "prompt": "About a fifth of the emails in my list come back as catch-all from our verifier. Should I send to them or drop them?",
+      "expected_output": "Should load the sourcing and enrichment reference and explain that catch-all domains accept any address, so basic SMTP verification can't confirm the person. Should recommend a policy: resolve catch-alls with a verifier that goes beyond SMTP checks; send resolved-valid ones from separate lower-volume mailboxes; send unresolved ones only to Tier 1 accounts while watching bounces; keep campaign bounces under 2% with automatic pause; re-verify within 7 days of sending. Should not recommend sending all of them blind or dropping all of them without considering account value.",
+      "assertions": [
+        "Explains why catch-all addresses can't be confirmed by basic verification",
+        "Recommends resolving catch-alls with a specialist verifier",
+        "Recommends separate lower-volume mailboxes for resolved catch-alls",
+        "Limits unresolved catch-alls to Tier 1",
+        "Keeps bounce rate under 2% with a pause rule",
+        "Neither sends all blindly nor drops all by default"
+      ],
+      "files": []
+    },
+    {
+      "id": 10,
+      "prompt": "We have 200 B2B prospects and several connected enrichment providers. Some records are fresh in our cache, some caches are expired, one API says429 and another finds a same-name company in the wrong country. Design a cost-bounded waterfall without overwriting verified CRM contacts.",
+      "expected_output": "Defines identity and accepted-field criteria, exact account/provider/input cache matching, differentiated expiry/no-match/error handling, and conditional ordered lookups. Preserves stronger CRM evidence, contact verification, and unresolved reasons.",
+      "assertions": [
+        "Reuses only applicable fresh cache entries",
+        "Does not treat429 or timeout as no-match",
+        "Rejects a wrong-entity result instead of counting any nonempty response as success",
+        "Stops when an accepted field is found instead of running every provider",
+        "Preserves stronger verified CRM fields and separate contact verification"
+      ],
+      "files": []
     }
   ]
 }

package/skills/prospecting/references/account-research.md

@@ -0,0 +1,59 @@
+# Account Research for Outreach
+
+Research before outreach has one job: find a true, specific reason this account should care right now, and the person who owns that problem. Dossiers on companies you compete with belong to the competitor-profiling skill.
+
+## How much research each tier gets
+
+| Tier | Time per account | Output |
+|------|------------------|--------|
+| Tier 1 | 10–20 minutes, or an agent run reviewed by a human | Full brief (below) |
+| Tier 2 | 2–3 minutes per account, plus shared segment research | One sourced hook per contact + the segment brief |
+| Tier 3 | None per account | The segment brief only |
+
+Tiers are defined in [signal-plays.md](signal-plays.md).
+
+## Where the useful facts are
+
+In rough order of usefulness:
+1. **Their job posts.** They describe the problem in their own words, list the tools they use, and reveal priorities ("own our experimentation roadmap").
+2. **Their own pages.** Pricing, landing pages, changelog, careers, case studies. For a services pitch, the page you'd improve is the research.
+3. **What leaders say publicly.** LinkedIn posts, podcast appearances, conference talks, interviews.
+4. **Company news.** Funding, launches, acquisitions, leadership changes, new markets.
+5. **Filings and reports.** For public companies, the 10-K risk factors and earnings calls name priorities explicitly.
+6. **Reviews of their product.** What their customers complain about can show what they're under pressure to fix.
+
+## The brief (Tier 1)
+
+```markdown
+## [Company] — account brief
+**Fit:** [ICP criteria met, with any gaps]
+**Signal:** [what happened, date, source URL]
+**Likely priority:** [the problem the signal implies, in their words where possible]
+**Evidence:** [2–4 facts, each with a source URL]
+**Who owns it:** [name, title, why them; a second contact if multi-threading]
+**Angle:** [one sentence connecting their situation to what you offer]
+**Proof to use:** [the closest case study or result]
+**Don't mention:** [anything sensitive, stale, or creepy, e.g. tracked website visits]
+**Hook found:** yes / no
+```
+
+## Rules for agent research
+
+AI makes research cheap, and it also makes invented hooks cheap. These rules keep the research honest:
+
+1. **Facts first, angle second.** Run research as two steps. Step one collects facts, each with a source URL and date. Step two writes the angle using only those facts. Never let one step do both.
+2. **"No hook found" is a valid result.** If the sources don't support a specific angle, say so and drop the account to the segment-level message. A generic hook dressed up as personal research is worse than an honest segment message.
+3. **Bound the angles.** Give the agent your 3–5 value propositions and require the angle to map to one of them. Unbounded creativity produces promises you can't keep.
+4. **Date everything.** A fact without a date can't be judged for staleness. Discard anything older than its freshness window.
+5. **Quote, don't paraphrase, when it matters.** If the hook rests on something a leader said, keep the exact quote and link.
+6. **Never use sensitive traits** (health, finances, politics, religion, family) even when public. See [compliance.md](compliance.md).
+
+## Segment briefs (Tier 2 and 3)
+
+For a segment, research the shared situation instead of each account:
+- What the accounts have in common (the segment definition)
+- The pain that commonality creates, with 2–3 public examples
+- The proof that speaks to it
+- The one-line opener each contact will get, plus the slot for a per-contact detail (Tier 2)
+
+A tight segment does the personalization work. "Series A SaaS companies that just posted their first growth marketer role" needs little per-account research, because the segment already explains why you're writing.

package/skills/prospecting/references/b2b-prospecting.md

@@ -38,7 +38,7 @@ For when the user sells to non-SaaS B2B — services, agencies, manufacturers, m
 - **Apollo**: best general B2B firmographic + contact discovery
 - **ZoomInfo**: enterprise B2B + intent signals (mid-market+)
 - **LinkedIn Sales Navigator**: industry + role + signal search; the gold standard for decision-maker mapping (manual)
-- **Clay**: when you need custom waterfall lookups (e.g., enrich Apollo records with Hunter + Clearbit)
+- **Clay**: when you need custom waterfall lookups (e.g., enrich Apollo records with Hunter, then a waterfall aggregator)
 
 ### Tier 2 — industry-specific directories
 

package/skills/prospecting/references/compliance.md

@@ -13,6 +13,7 @@ CAN-SPAM regulates the cold email **send**, not the list build. But the list bui
 - You must be able to identify the source of every email address you contact (required if challenged)
 - The "from" line and email content rules apply at send time — but you can't lie about how you got the contact
 - Opt-out requests must be honored within 10 business days and tracked
+- Every commercial email needs a working opt-out and the sender's valid physical postal address, so plan both before the first send
 
 **For prospecting specifically**: capture and retain the source URL + date for every contact you add to a list. CAN-SPAM doesn't require it explicitly, but defending your sender practices does.
 
@@ -46,6 +47,13 @@ You have three credible options:
 - Include a privacy notice / opt-out in the first outreach
 - Don't store personal data longer than necessary for the legitimate interest
 
+### EU specifics
+
+- **Commercial interest counts.** The CJEU's KNLTB ruling (October 2024) confirmed that a purely commercial interest can be a legitimate interest. You still need the balancing test in writing (a legitimate interests assessment).
+- **Tell people where you got their data.** When the data didn't come from the person directly (Article 14), say so within a month, and at the latest in the first message. One line works: "I found your email on [source]; reply 'remove' and I'll delete it."
+- **Germany is different.** Germany's unfair competition law (UWG §7) requires prior consent for advertising email, B2B included, and competitors enforce it through lawsuits. Exclude German contacts from cold email; use LinkedIn or phone (B2B calls need presumed consent, meaning a concrete reason to believe they'd welcome the call).
+- **National rules sit on top of GDPR.** Several countries apply stricter ePrivacy rules to email. When a campaign targets one EU country heavily, check that country's rules.
+
 ### What disqualifies a list
 
 - Bulk-scraped LinkedIn data — explicit ToS violation + GDPR risk
@@ -54,6 +62,22 @@ You have three credible options:
 
 ---
 
+## UK — PECR
+
+PECR sets the email rules on top of UK GDPR:
+
+- **Corporate subscribers** (limited companies, LLPs, public bodies) can be cold-emailed at their work address without consent, as long as you identify yourself and offer an opt-out.
+- **Sole traders and partnerships** are treated like individuals and need consent. Many small agencies and consultancies fall in this group, so check the entity type before sending.
+- **Fines rose sharply.** The Data (Use and Access) Act 2025 raised the PECR maximum from £500,000 to £17.5 million or 4% of global turnover, and wrote direct marketing into UK GDPR as a recognised legitimate interest.
+
+---
+
+## Australia — Spam Act
+
+Australia is consent-based. Inferred consent can come from a conspicuously published business address with no "no unsolicited messages" notice, where the message relates to the person's role. Address-harvesting software is prohibited outright. Every message needs sender identification and a working unsubscribe.
+
+---
+
 ## Canada — CASL
 
 Stricter than CAN-SPAM. Cold B2B outreach requires:
@@ -69,19 +93,22 @@ Stricter than CAN-SPAM. Cold B2B outreach requires:
 
 ### LinkedIn
 
-- **Sales Navigator** as a research tool: fine
+- **Sales Navigator** as a research tool: fine. Use it to define account and persona filters, then pull contacts from a licensed database. Sales Navigator has no native export, caps searches at 2,500 results, and syncs to a CRM only on Advanced plans.
 - **Scraping LinkedIn at any scale**: explicit ToS violation. Banned accounts are permanent. Don't.
+- **LinkedIn enforces against vendors as well as users.** It sued Proxycurl (which shut down in July 2025 under a permanent injunction) and ProAPIs (October 2025) over fake-account scraping, and removed company pages for Apollo, Seamless, and HeyReach. Any data or automation vendor that depends on LinkedIn can disappear overnight; keep an alternative.
+- **Logged-out vs logged-in.** Courts have treated scraping public, logged-out pages differently from scraping behind a login or with fake accounts, which breaches the User Agreement. Under GDPR, "publicly visible" still doesn't mean free to use: France's regulator fined Kaspr €240,000 (December 2024) for collecting contact details from LinkedIn that users had chosen to hide.
 - **Apollo, Clay, and ZoomInfo** claim LinkedIn-overlap data through various legitimate channels — verify their data sources before assuming compliance
-- **InMail and Connection Requests**: governed by LinkedIn's own messaging rules, not by CAN-SPAM/GDPR (because LinkedIn-internal)
+- **Messages, InMail, and connection requests** are still processing of personal data, so GDPR, PECR, and similar laws apply exactly as they do to email: lawful basis, an opt-out on request, and source records. LinkedIn's own rules apply on top, and third-party automation tools violate its User Agreement.
 
 ### Google Maps
 
 - ToS prohibits bulk extraction or productizing Maps data
 - Browser-assisted research as a discovery aid: acceptable
-- Storing Place IDs or large structured Maps data in your CRM: explicit ToS prohibition
+- Place IDs are exempt from Google's caching limits, so storing them to re-look up a business is fine. Other Maps content (reviews, ratings, photos, and bulk-copied listing details) can't be cached beyond the terms or rebuilt into your own database
+- The Places API is the compliant way to pull business data programmatically, within its terms
 - Use Maps to **find** local businesses, then cross-source from the business's own site for the data you retain
 
-### Apollo / ZoomInfo / Clearbit
+### Apollo / ZoomInfo / other licensed data providers
 
 - All have their own ToS limiting reselling, downstream sharing, and use cases
 - Read your contract — typically you can use the data for your own outreach but not productize it
@@ -95,6 +122,15 @@ Stricter than CAN-SPAM. Cold B2B outreach requires:
 
 ---
 
+## Phone and SMS (US)
+
+- **Do Not Call.** Scrub numbers against the National DNC Registry and your internal DNC list before calling. B2B calls to business lines are lower risk, but mobile numbers enriched from data providers are often personal cell phones, which the rules protect.
+- **AI voice counts as an artificial voice.** The FCC's February 2024 ruling puts AI-generated voices under the TCPA's artificial or prerecorded voice rules. AI-voiced calls to cell phones need prior express consent, and written consent for marketing. Damages run $500–$1,500 per call. Use AI voice only for inbound calls and requested callbacks.
+- **Opt-outs by any reasonable means.** Since April 2025, a consumer can revoke consent by any reasonable means (a reply of "stop," a spoken request), and you have 10 business days to honor it.
+- **Cold SMS** to US mobiles needs consent plus 10DLC registration. Treat SMS as a channel for people who've already engaged.
+
+---
+
 ## Anti-Patterns (Don't Do These)
 
 1. **Bulk-scraping LinkedIn / Google Maps / Yelp**. Browser-assisted research is OK; automated scrapers pointed at these platforms are not. **Firecrawl and Browserbase are fine for an individual prospect's own website** (the URL you found through manual discovery) — not for the platforms hosting prospects.
@@ -114,10 +150,12 @@ Before shipping a list to the user (or downstream to luckiest-cold-email):
 
 - [ ] Every contact has a source URL + collection date
 - [ ] No contacts sourced from scraped LinkedIn data
-- [ ] No Google Maps Place IDs or large Maps-structured data retained
+- [ ] No bulk Maps content (reviews, ratings, listing copies) retained beyond Google's terms
+- [ ] Country gating applied: Germany excluded from cold email, UK sole traders and partnerships excluded without consent, CASL and Spam Act requirements met for Canada and Australia
+- [ ] Phone numbers scrubbed against DNC; no AI-voice calls to mobiles without consent
 - [ ] Lawful basis documented (legitimate interest test for B2B, or relevant alternative)
 - [ ] Email addresses validated (deliverability check before outreach)
 - [ ] Personal addresses (Gmail, etc.) flagged or excluded
 - [ ] Source provider contracts permit the intended use case
 - [ ] Retention plan documented (when to delete)
-- [ ] First outreach will include unsubscribe + privacy notice (downstream concern for luckiest-cold-email skill, but mention it now)
+- [ ] First outreach will include an opt-out, a postal address, and (for EU/UK) where the data came from (downstream concern for luckiest-cold-email skill, but mention it now)

package/skills/prospecting/references/data-sources.md

@@ -14,7 +14,7 @@ Tool selection guide for prospecting across all three branches.
 | **Funding signals (SaaS)** | Crunchbase, Pitchbook | Crunchbase free tier sufficient for early signals; Pitchbook for deeper investor data |
 | **Email pattern discovery** | Hunter, Snov, Apollo | Pattern guessing — followed by verification |
 | **Email deliverability verification** | Truelist, Hunter, NeverBounce, ZeroBounce | Always verify before adding to outreach lists |
-| **Visitor identification (warm intent)** | RB2B, Clearbit Reveal | Anonymous traffic → company identification |
+| **Visitor identification (warm intent)** | RB2B, Warmly, Vector | Anonymous traffic → company or person identification |
 | **Intent data** | ZoomInfo Intent, 6sense, Bombora | Pre-warmed signals; mid-market+ pricing |
 | **Trigger event monitoring** | Google Alerts, Feedly, LinkedIn Sales Nav alerts | Free options are sufficient for most |
 | **Local business discovery** | Google Maps (manual), Yelp, Facebook Pages | Browser-assisted, not bulk-extracted |
@@ -45,7 +45,7 @@ Tool selection guide for prospecting across all three branches.
 **Use for**: Multi-source enrichment, waterfall lookups, custom scoring logic. When list quality matters more than list size.
 
 **Strengths**:
-- Waterfall logic: try Apollo first → fallback to ZoomInfo → fallback to Clearbit
+- Waterfall logic: query providers in order and stop at the first verified result (see [sourcing-and-enrichment.md](sourcing-and-enrichment.md) for ordering and the bake-off)
 - 100+ data provider integrations
 - AI-powered enrichment (LLM-driven extraction from URLs)
 - Custom columns + scoring formulas
@@ -78,19 +78,19 @@ Tool selection guide for prospecting across all three branches.
 
 ---
 
-## Clearbit
+## Waterfall aggregators (FullEnrich, LeadMagic)
 
-**Use for**: Email → company enrichment, anonymous visitor identification (Clearbit Reveal).
-
-**Strengths**:
-- Strong company enrichment (industry, size, funding, tech stack)
-- Email lookup by domain
-- Reveal: identify anonymous site visitors at company level
-- API-first
+**Use for**: Email and phone enrichment through one API call that queries several providers in sequence. The simpler alternative to building a waterfall in Clay.
 
 **Watch out for**:
-- HubSpot acquisition (2023) — bundled into HubSpot Breeze Intelligence now
-- Standalone API still available but pricing/access depends on tier
+- Coverage and false-positive rates vary by ICP; run the bake-off in [sourcing-and-enrichment.md](sourcing-and-enrichment.md) before committing
+- Verify results anyway; finding an address isn't the same as confirming it
+
+---
+
+## Clearbit (legacy)
+
+Clearbit was absorbed into HubSpot (Breeze Intelligence). Its free tools ended in 2025, and new standalone API access is no longer generally available. Use HubSpot's enrichment if you're on HubSpot; otherwise use the providers above.
 
 **Integration**: see [clearbit.md](../../../tools/integrations/clearbit.md)
 
@@ -238,7 +238,7 @@ Discovery happens on platforms (manual browser-assisted research). Extraction ha
 
 ---
 
-## RB2B / Clearbit Reveal
+## Visitor identification (RB2B, Warmly, Vector)
 
 **Use for**: Identifying anonymous site visitors as warm intent signals.
 
@@ -253,8 +253,6 @@ Discovery happens on platforms (manual browser-assisted research). Extraction ha
 
 **Integration**: see [rb2b.md](../../../tools/integrations/rb2b.md)
 
----
-
 ## Free / browser-only fallbacks
 
 When the user has no paid tools, lean on:

package/skills/prospecting/references/enrichment-playbook.md

@@ -0,0 +1,61 @@
+# Waterfall Enrichment and Cache Reuse
+
+Load this when a prospect list needs multiple data providers, repeated lookups, or a credit budget. Keep the luckiest-prospecting skill's ICP, source lineage, contact verification, and compliance rules. This is a workflow design, not a new API or a promise of coverage.
+
+## Define the Success Condition Before Calling Providers
+
+For each missing field, specify the required input, acceptable output, freshness, and maximum cost. A nonempty response is insufficient: a guessed address, a wrong-company match, or an old job title may fail the acceptance rule.
+
+Example: find a published business contact for an ICP-fit account, then verify deliverability separately. A provider returning a name alone has not completed that task. Do not expand to personal emails simply because work-email providers found nothing.
+
+Order providers by fit for this field, observed coverage, cost, and latency. There is no universal Hunter/Apollo/FullEnrich order. Use the user's existing connected tools; a manual public-source lookup is also a valid step.
+
+## Run a Waterfall, Not Every Provider
+
+1. Normalize the inputs and check existing verified CRM fields.
+2. Read the exact cache entry for the first provider lookup.
+3. If no reusable entry exists, perform that lookup within the authorized budget.
+4. Validate the returned identity and field; record source and retrieval time.
+5. Stop when the acceptance rule is satisfied. Otherwise advance to the next suitable provider.
+6. If all steps return no acceptable result, retain the row as unresolved with a reason. Do not fill blanks with invented values.
+
+| Lookup outcome | Next action |
+|---|---|
+| Fresh, accepted result | Reuse it; stop this field's waterfall |
+| Genuine no-match | Advance; optionally cache the no-match briefly |
+| Wrong entity or invalid output | Record rejection; advance if another source can resolve it |
+| Authentication/permission error | Repair the connection; do not label the contact nonexistent |
+| Rate limit, timeout, provider outage | Respect provider retry guidance and budget; defer or use an authorized independent source |
+| Missing required input | Resolve identity first; another identical empty-input call will not help |
+
+Apply conditions per row. An already verified contact should not spend credits discovering the same field again. Dependent steps wait for the preceding result; independent missing fields may run concurrently within provider limits.
+
+For Clay, configure the provider sequence, inputs, and run conditions using its [waterfall documentation](https://university.clay.com/docs/building-a-data-waterfall). Its [workflow guidance](https://university.clay.com/docs/enrichment-in-workflows) distinguishes publishing a setup from running it and spending credits. Other tools need their own documented execution semantics.
+
+## Exact Cache Keys
+
+Use a structured key with these dimensions:
+
+```text
+workspace/account + provider + endpoint/version + normalized inputs + requested fields/options
+```
+
+Keep account scope separate even when two customers query the same domain. Normalize domains consistently (case, URL host, trailing dot); remove URL paths only for domain-based lookups. Preserve distinctions a provider treats as meaningful: person versus company, subdomain, country, filters, and email local-part rules. A company-name fuzzy match is not an exact cache hit.
+
+Store status, accepted fields, entity identifiers, source, fetched time, expiry, and validation outcome. Never store API keys in keys or result logs. Restrict access to contact data and honor deletion/retention requirements.
+
+- **Fresh accepted hit:** reuse without another charged call.
+- **Expired hit:** refresh fields that require current evidence; label any provisional stale data explicitly.
+- **Miss:** fetch the provider; a cache endpoint's documented 404 may mean only that the cache has no entry, not that the provider found no company.
+- **Negative hit:** apply a separate, usually shorter expiry; changing inputs invalidates the match.
+- **Error:** keep operational failures distinct from no-match records.
+
+Merge accepted fields with provenance instead of overwriting verified CRM data with nulls or weaker matches. For concurrent duplicate lookups, reuse one in-flight request where supported; guard the final write so a late weaker result cannot replace a newer verified one.
+
+## Deliverable and Pilot
+
+Return a table with row identity, missing field, provider order, acceptance rule, cache decision, source/date, result, verification status, cost, and unresolved reason. Track cost per accepted field and verified contact, cache reuse, no-match rate, invalid-match rate, and sampled accuracy. Report actual measured savings; a cache does not guarantee a particular reduction.
+
+Pilot on representative rows before a broad run: fresh hit, expired hit, true no-match, ambiguous company, provider failure, and duplicate input. Compare with a single-provider control under the same acceptance rule and budget. Pass qualified rows to cold-email only after contact verification; use the revops inbound-routing playbook for live form submissions.
+
+Patterns adapted from eliasstravik's MIT-licensed GTM engineering toolkit. This playbook works with existing providers or manual research.

package/skills/prospecting/references/saas-prospecting.md

@@ -55,7 +55,7 @@ Combine 2+ sources for cross-verification.
 ### Tier 3 — buying signals
 
 - **Job boards** (LinkedIn Jobs, Indeed, AngelList): role openings as signals
-- **RB2B / Clearbit Reveal**: visitor identification (warm anonymous traffic)
+- **RB2B, Warmly, or Vector**: visitor identification (warm anonymous traffic)
 - **GitHub stars/forks of competitor or adjacent repos**: developer-level intent signal (see `tools/integrations/github.md` and the `github-prospects.js` CLI). Especially strong for dev-tool SaaS — a developer who starred `vercel/next.js` last week is in-market for adjacent Next.js infrastructure.
 - **Recent blog posts / changelog**: product direction signals
 - **G2 reviews mentioning competitor switches**: explicit dissatisfaction signal