rsc-universal 0.1.1

package/skills/cold-outreach/SKILL.md

@@ -0,0 +1,206 @@
+---
+name: cold-outreach
+description: "Use when writing a cold email or DM to someone with no prior relationship, building a follow-up sequence, deciding how fast/how much to send per inbox so it stays out of spam, or rescuing outreach that reads like a template. Covers first-touch copy under a word ceiling, 4-7 step bump sequences, email-vs-LinkedIn variants, per-inbox volume and new-domain warm-up ramps, and the CAN-SPAM/GDPR opt-out footer. Triggers: 'write me a cold email', 'fix my follow-up sequence', 'my cold emails get opened but nobody replies', 'how many emails per inbox per day before I get blacklisted', 'write a LinkedIn connection note + DM', 'this email reads like a template', 'escríbeme una secuencia de cold email en frío', 'missatge en fred a LinkedIn'. NOT the SPF/DKIM/DMARC/tracking-domain setup (that is email-deliverability), NOT sourcing the prospect list (that is lead-gen), NOT what happens after a reply (that is sales-pipeline)."
+tags: [cold-email, outreach, sequences, deliverability, sales]
+recommends: [lead-gen, sales-pipeline, email-deliverability, proposals, marketing]
+origin: risco
+---
+
+# Cold Outreach — The Words and the Cadence of the Cold Touch
+
+*You write the message a stranger actually replies to, and the sending rhythm that keeps the mailbox provider delivering it. You do not set up DNS, source the list, or run the CRM.*
+
+This skill owns two things and only two: the **copy** of an unsolicited 1:1 touch (cold email, LinkedIn note/DM) and the **cadence** around it (step count, spacing, per-inbox volume, warm-up ramp, the compliant footer). Everything upstream and downstream belongs to a sibling — see the route table below and honor it.
+
+## When to use / When NOT
+
+Use when:
+
+- Writing a cold email or its subject line to a recipient with no prior relationship.
+- Building or fixing a multi-step follow-up sequence (the "bump" cadence) — step count and spacing.
+- Writing a LinkedIn connection note or cold DM sequence.
+- Deciding daily/weekly send volume per inbox, or a new-domain warm-up ramp.
+- Writing the CAN-SPAM/GDPR-compliant footer and one-click opt-out line.
+- Rescuing a cold email that "reads like a template" or gets opens but no replies.
+
+Do NOT use when (route to the sibling that owns it):
+
+| The ask | Owner | Why it is not here |
+|---|---|---|
+| Find / scrape / qualify the prospect list or ICP | `lead-gen` | This skill assumes you already have a verified recipient. |
+| Set up SPF, DKIM, DMARC, a tracking domain, or diagnose DNS-level spam landing | `email-deliverability` | This skill *applies* the provider rules to cadence; it does not configure auth. |
+| Manage what happens after a reply — stages, tasks, CRM hygiene, close forecast | `sales-pipeline` | The moment a reply lands the relationship leaves this skill. |
+| Write the proposal / SOW / pricing after a prospect engages | `proposals` | A cold touch earns a conversation, not a contract. |
+| Inbound launch emails, nurture to an opted-in list, marketing-site copy | `marketing` (`../marketing/SKILL.md`) | Opted-in and broadcast copy is a different game from a 1:1 cold touch. |
+| Actually wire the send through Gmail/an ESP API or a scheduler | `email-connector` / `google-workspace` | This skill produces text + a plan; it does not push the send. |
+
+Only `marketing` exists in this catalog today, so it is the only sibling linked as a file. The rest are named by id — route by naming the owner, do not improvise their job.
+
+## The reply-rate reality (calibrate before you write)
+
+Cold email is a low-yield channel by nature, and most "improve my copy" requests are really "stop fighting the math." Set expectations against the 2026 band:
+
+- **Average reply rate ≈ 3.43%.** Top quartile ≈ 5.5%. Elite (top 10%) ≈ 10.7%+. *(Instantly Cold Email Benchmark Report 2026, accessed 2026-06-02.)*
+- So **5-10% is solid, 10%+ is excellent, under 2% means something upstream is broken** — usually the list or the deliverability, not the prose.
+
+The two levers that actually move the number, in order:
+
+1. **Relevance** — the right person, with a real reason you reached out *now*. A perfect email to the wrong list still dies.
+2. **Deliverability** — if it lands in spam, copy is irrelevant. This is why cadence and volume (below) are part of *this* skill's job even though the DNS plumbing is not.
+
+Cleverness ranks a distant third. Do not sell wit; sell relevance, delivered.
+
+## Diagnosing a failing campaign — read the metric, then fix the right lever
+
+Most rescue requests describe a *symptom*, not a cause, and the instinct (theirs and a naive agent's) is to rewrite the prose. Usually the prose is the wrong lever. Diagnose by the **earliest broken metric in the funnel** — fix that one, ignore everything downstream of it, because a downstream number can't be read until the upstream one is healthy.
+
+| Symptom the user reports | The number that's actually broken | Almost never the cause | What to fix, in order |
+|---|---|---|---|
+| "Bounces / lands in spam / domain flagged" | Bounce > 2% or sudden deliverability drop | Copy | List hygiene → `lead-gen`; sending auth + warm-up → `email-deliverability`. Stop sending until fixed. |
+| "Low open rate" (< ~30-40% on a verified list) | Delivery + subject line | Body copy (they never saw it) | First confirm it's not spam-foldering (a deliverability tell). If delivery is fine, the **subject and from-name** are the only things they saw — rewrite those, leave the body alone. |
+| "Good opens, ~zero replies" | The hook + the CTA | Subject (it worked) / volume | The INFER line is generic or the CTA isn't binary. Re-derive the hook (four-line bridge); make the ask one yes/no question. This is the #1 misdiagnosed case. |
+| "Replies but all negative / 'not interested'" | Targeting or timing, not wording | The email itself | You're reaching the wrong role or the wrong moment — a `lead-gen` ICP problem. Polishing the copy won't convert a person with no need. |
+| "First email gets replies, sequence doesn't" | The follow-ups repeat instead of adding an angle | The cadence length | Each step must add ONE new angle (proof → new pain → breakup). Delete any step that restates step 1. Confirm the breakup exists. |
+| "It all works at 20/day, dies when I scale" | Per-inbox volume / reputation | Copy | Don't raise per-inbox volume — add inboxes and hold 20-50/day each. See the cadence table. |
+
+The governing rule: **the prose is the lever only when opens are healthy and replies are absent.** If opens are low, the prose is unread; if replies are negative, the prose found the wrong person. Name the broken metric back to the user before you touch a word — it's the single highest-value thing this skill does that an unaided agent skips.
+
+## Anatomy of a first touch
+
+Hard constraints for the opening email:
+
+- **Under ~80 words.** Elite performers stay below this; brevity plus a single binary CTA beats a long multi-CTA email. *(Instantly Benchmark 2026.)*
+- **One observed hook** — a specific, real signal about *them* (a launch, a job post, a number from their site). Not "I came across your company."
+- **One binary CTA** — a yes/no question they can answer in one tap ("Worth a 15-min look next week?"), not "let me know your thoughts" and not two asks.
+- **Subject line under ~6 words, no clickbait, no "Re:" fakery.** It should read like a colleague wrote it, not a campaign.
+
+Bad → Good rewrite:
+
+```text
+BAD (78 words, no real hook, vague + double CTA, spam-flavored):
+Subject: Quick question + a free guide for you!!
+
+Hi there, I hope this email finds you well! I came across your company
+and was really impressed by what you're doing in the space. We help
+companies like yours grow faster with our cutting-edge platform. I'd
+love to hop on a call to walk you through it, or I can send over a free
+guide — whatever works! Let me know your thoughts. Looking forward to
+hearing from you!
+
+GOOD (49 words, one signal, one binary CTA):
+Subject: your March hiring for 3 SREs
+
+Hi Dana — saw Acme is hiring three SREs this quarter. Usually that means
+on-call pain is outrunning the team. We cut alert noise ~40% for two
+infra teams your size in their first month.
+
+Worth a 15-min look next week — yes or no?
+```
+
+The Good version names a real signal (`{{signal}}`), states one concrete outcome (`{{outcome}}`), and asks one binary question. No greeting filler, no "free", no double ask.
+
+## Deriving the hook — the four-line bridge (this is the hard part)
+
+"Use a real signal" is advice everyone gives and almost nobody executes. The reason a personalized email still reads generic is that the writer names the signal and then jumps straight to a generic pain ("...so you probably want to grow faster"). The skill of a cold open is the **inference chain** from an observable fact to a pain the reader silently agrees with. Build it in four lines, on paper, before you write a word of copy:
+
+1. **OBSERVE** — the raw, checkable fact. ("Acme posted 3 SRE reqs in Q1.") It must be something you could screenshot. If you can't cite where you saw it, it is not a signal.
+2. **INFER** — the operational consequence a person *in that role* feels. ("3 SRE openings unfilled for a quarter = the on-call rotation is thin and the existing team is absorbing the pages.") This is the line bare agents skip. The inference must be specific to the role and non-obvious enough that the reader thinks "how did they know that" — not "everyone says that."
+3. **BRIDGE** — connect the inference to the one thing you do. ("We cut the page volume so a thin rotation survives without the missing hires.") Not your whole value prop — the single slice that maps to *this* inference.
+4. **PROVE** — one comparable, with a number if you have it. ("~40% fewer alerts for two infra teams your size, month one.")
+
+The first-touch body is literally lines 2→3→4 in order; line 1 becomes the subject. If the INFER line is generic, the email is generic no matter how many merge fields you add. **Test the INFER line in isolation: would it be false for a competitor in the same situation? If it is true of everyone, it is a platitude — go back to the OBSERVE step and pick a sharper fact.**
+
+When the user hands you only a company name and no signal, do not invent one. Ask for (or, if you have web access, look up) one of these signal classes, ranked by reply lift: a **hiring/role-change** signal > a **funding/launch/news** signal > a **tech-stack or job-description detail** > a **public number from their own site/report** > a **shared context** (mutual, group, event). A generic industry trend ("AI is changing your space") is not a signal and never clears the INFER test. Worked OBSERVE→INFER→BRIDGE→PROVE chains across six industries live in `references/hook-derivation.md`.
+
+## The sequence — decision table
+
+A first email captures **~58% of replies; steps 2-7 add the remaining ~42%**, and reply rates fall off sharply after the 5th email. *(Instantly Benchmark 2026.)* So the sequence is non-optional, but it is short. **4-7 touches, 2-4 days apart, each adding ONE new angle** — never "just bumping this up."
+
+| Step | Day offset | Angle (one new thing) | CTA |
+|---|---|---|---|
+| 1 | 0 | The observed signal + outcome | Binary yes/no |
+| 2 | +3 | A proof point / mini case study | Same binary ask, reframed |
+| 3 | +7 | A different pain or angle on the value | Lower-friction ask (a resource, not a call) |
+| 4 | +12 | Social proof or a relevant comparison | Binary ask |
+| 5 (breakup) | +18 | Permission to stop — "should I close the file?" | One-question close |
+| 6-7 (optional) | +25 / +35 | New trigger only if one genuinely appeared | Re-open, binary |
+
+Rules that make the table work:
+
+- **Stop at 5 unless a real new trigger appears.** Replies past the 5th email are thin; do not pad to 7 for its own sake.
+- **The breakup (step 5) is the highest-converting follow-up after step 1** — it gives a graceful out and often gets the "actually, yes" reply. Always include it.
+- **One angle per step.** If step 3 just restates step 1, delete step 3.
+- **Keep follow-ups in the same thread** (reply to your own first email) so context travels with the touch.
+
+## Channel adaptation — email vs LinkedIn
+
+| Dimension | Cold email | LinkedIn |
+|---|---|---|
+| First-touch length | ≤ ~80 words | Connection note ≤ ~300 chars; DM ~3-4 sentences |
+| Hook source | A site/news/hiring signal | One specific profile signal (a post, a role change, a shared group) |
+| CTA | Binary yes/no question | Soft — a question or a relevant share, not a pitch in the note |
+| Volume ceiling | 20-50/day per inbox (see below) | ~100 connection requests/week free, **safer under 80**, rolling weekly |
+| Reply benchmark | ~3.43% avg, 10%+ elite | ~6-7% avg, 10%+ excellent |
+
+*(LinkedIn figures: Skylead / Kondo / Expandi 2025-2026 guides, accessed 2026-06-02.)*
+
+On LinkedIn the connection note must **not** pitch — earn the connection on a real signal, then make the ask in the first DM after they accept. Skeletons for both channels live in `references/templates.md`.
+
+## Sending cadence & deliverability guardrails
+
+You own the *cadence* side of deliverability; the DNS/auth side is `email-deliverability`. Apply these limits to the plan you hand the user:
+
+- **Per inbox: 20-50 cold sends/day even after warm-up.** The technical Gmail ceiling is ~100, but cold mail should stay well under it. Need more volume? Add inboxes, do not raise the per-inbox number.
+- **New-domain warm-up ramp** (warm-up mail counts toward the daily cap):
+
+| Week | Sends/day per inbox |
+|---|---|
+| 1 | ~10-20 |
+| 2 | ~20-35 |
+| 3 | ~35-50 |
+| 4+ | ~50-65 (hold cold sends at 20-50) |
+
+- **Bounce rate under 2%.** A higher bounce means the list is stale → that is a `lead-gen` problem, not a copy problem.
+- **Spam-complaint rate under 0.3%; Google advises under 0.1%.** One-click unsubscribe (RFC 8058: `List-Unsubscribe` + `List-Unsubscribe-Post`) is required for bulk senders to Gmail/Yahoo; Outlook applied the same from 2025-05-05, with Gmail/Yahoo enforcement ramping from Nov 2025. *(Google Workspace "Email sender guidelines"; Security Boulevard 2025-11; Proofpoint 2025 — accessed 2026-06-02.)*
+
+If the user asks you to *configure* the `List-Unsubscribe` header, SPF, or DKIM, stop and route to `email-deliverability` — you specify that the opt-out must exist and be one-click; that skill wires the header.
+
+## Compliance footer (every cold send needs one)
+
+| Requirement | CAN-SPAM (US) | GDPR (EU B2B) |
+|---|---|---|
+| Sender identity | Accurate From/Reply-To, honest subject | Same |
+| Postal address | A physical mailing address, required | Recommended; identify the controller |
+| Opt-out | Clear opt-out, honored within 10 business days | Honored without undue delay (treat as 24-48h) |
+| Legal basis | Not consent-based; truthful + opt-out suffices | Art. 6(1)(f) legitimate interest **with a documented LIA** |
+| Penalty | Up to $53,088 per email (Jan 2025) | Up to €20M or 4% of global revenue |
+
+*(Instantly compliance guide / Puzzle Inbox; litemail.ai / complydog GDPR guides 2026 — accessed 2026-06-02.)*
+
+EU enforcement varies — UK ICO and France CNIL are permissive for B2B; Germany and Poland are stricter (Poland often requires prior consent). When the recipient is in the EU, write the footer for the strictest plausible jurisdiction. The full footer wording, the LIA checklist, and the CASL/Australia matrix → `references/compliance-footer.md`.
+
+## Personalization without creepiness
+
+- **One real signal, surfaced plainly.** "Saw you're hiring 3 SREs" is relevant; "Saw you were at the lake house last weekend" is surveillance. Stay on professional, public, business-relevant signals. Then run it through the four-line bridge above — a relevant signal with a generic INFER line still reads like a template.
+- **Do not fake personalization with spintax.** Rotating "{Hi|Hey|Hello}" or `{{first_name}}`-only mail-merge is not personalization — it is a template wearing a name tag, and recipients can smell it. If the only variable is the name, the email is generic; add a real `{{signal}}` or do not send.
+- **Never invent the signal.** A fabricated "I loved your recent post on X" that does not exist destroys trust on contact. If you cannot find a true signal, that is a `lead-gen` targeting gap, not a copy task.
+
+## Anti-patterns
+
+| Anti-pattern | Why it fails | Do instead |
+|---|---|---|
+| Blast 200/day from one new inbox | Trips spam filters; tanks domain reputation in days | Ramp per the table; hold 20-50/day; split across inboxes |
+| Pitch in sentence one | No earned relevance; reads like a billboard | Lead with the observed signal, earn the ask |
+| Two CTAs ("call OR I'll send a guide") | Splits the decision; lowers reply rate | One binary yes/no ask per email |
+| "Just following up" / "circling back" with no new angle | Adds noise, not value; trains them to ignore you | Each step adds one new angle or it is deleted |
+| Name-only mail merge as "personalization" | Recipients see the template underneath | One true `{{signal}}` per first touch or do not send |
+| No opt-out / no postal address | CAN-SPAM/GDPR violation; complaint-rate spike | Always append the compliant footer |
+| Subject like "Quick question!!" or "FREE" | Clickbait + spam-trigger words land you in spam | ≤6 plain words that read like a coworker wrote them |
+| Padding to 7 steps for completeness | Replies past step 5 are thin; you just annoy | Stop at the breakup unless a real new trigger appears |
+| "I hope this email finds you well" opener | The classic AI/template tell; wastes the first line | Open on the signal — your first 6 words are the hook |
+
+## Templates
+
+Reusable skeletons — first-touch + 4-step bump for email and LinkedIn, with every variable slot (`{{signal}}`, `{{outcome}}`, `{{proof}}`) marked — live in `references/templates.md`. Start from a skeleton, then fill every slot with a *real* value before sending. An unfilled slot is a defect, not a placeholder to ship.
+
+To self-check a drafted email or sequence file, run `scripts/verify.sh path/to/draft.md` — it flags missing opt-out, multiple CTAs, over-ceiling word count, and spam/AI-tell phrases (read-only).

package/skills/cold-outreach/evals/README.md

@@ -0,0 +1,3 @@
+# Evals — cold-outreach
+
+These cases are read by the catalog's routing harness (or by hand). There is no bundled runner. `should_trigger` asserts that the SKILL.md description + body are specific enough that the listed prompt would load `cold-outreach`; `should_not_trigger` asserts a near-miss prompt routes to the named real sibling instead (each `route_to` id must exist in the catalog); and `capability` is a rubric — feed the scenario to an agent with this skill loaded and grade the generated sequence against every `must_include` bullet (each is pass/fail). To sanity-check a *generated* draft against the structural rules, run `../scripts/verify.sh path/to/draft.md` from this directory — it is read-only and flags missing opt-out, multiple CTAs, over-ceiling word count, and spam/AI-tell phrases.

package/skills/cold-outreach/evals/cases.yaml

@@ -0,0 +1,60 @@
+skill: cold-outreach
+
+# Prompts that MUST load `cold-outreach`. The skill owns the COPY of an
+# unsolicited 1:1 touch (cold email, LinkedIn note/DM) and the CADENCE around it
+# (step count, spacing, per-inbox volume, warm-up ramp, compliant footer). It
+# does NOT source the list (lead-gen), set up DNS/auth (email-deliverability),
+# run the CRM after a reply (sales-pipeline), or write the proposal (proposals).
+should_trigger:
+  - prompt: "Write me a cold email to a VP of Engineering pitching our CI/CD tool."
+    why: "Core job — a first-touch cold message to a no-prior-relationship recipient, under the word ceiling with one binary CTA."
+
+  - prompt: "My open rate is fine but I get basically zero replies — can you fix my follow-up sequence?"
+    why: "Non-obvious: the user names a symptom (opens, no replies) not the skill. The 58/42 reply split and the 4-7 step bump table exist for exactly this rescue."
+
+  - prompt: "How many cold emails can I send per inbox per day before I get blacklisted, and how do I warm up a new domain?"
+    why: "Cadence/volume is owned here — per-inbox 20-50/day and the new-domain ramp table. The user is asking about sending rhythm, not DNS auth."
+
+  - prompt: "Escríbeme una secuencia de 4 correos en frío para captar agencias de marketing."
+    why: "Spanish phrasing for a 4-step cold email sequence — same skill regardless of language; the sequence decision table and Spanish skeleton apply."
+
+  - prompt: "Draft a LinkedIn connection note plus a DM bump for these 5 prospects."
+    why: "Channel adaptation — LinkedIn note (≤300 chars, no pitch) + DM sequence is an explicit owned variant with its own char caps and weekly limits."
+
+  - prompt: "This email reads like a template — every prospect can tell it's mail-merged. Make it feel one-to-one."
+    why: "Rescuing copy that 'reads like a template' is an explicit trigger; the one-real-signal rule and the spintax/name-only-merge anti-pattern answer it directly."
+
+should_not_trigger:
+  - prompt: "Set up SPF, DKIM and DMARC on our sending domain so we stop landing in spam."
+    route_to: email-deliverability
+    why: "DNS/auth configuration is the deliverability plumbing; cold-outreach only applies the resulting rules to cadence, it never edits DNS records."
+
+  - prompt: "Find me 200 SaaS CTOs with verified work emails I can email."
+    why: "Sourcing/qualifying the prospect list is lead-gen; cold-outreach assumes a verified recipient already exists."
+    route_to: lead-gen
+
+  - prompt: "A prospect just replied 'yes, interested' — move them to the right stage and set my next follow-up tasks."
+    route_to: sales-pipeline
+    why: "The moment a reply lands the relationship leaves this skill; stages, tasks, and CRM hygiene are sales-pipeline."
+
+  - prompt: "They asked for a proposal — write the SOW and pricing for the engagement."
+    route_to: proposals
+    why: "A cold touch earns a conversation, not a contract; the proposal/SOW/pricing document is owned by proposals."
+
+  - prompt: "Write the launch announcement email to our existing opted-in newsletter list."
+    route_to: marketing
+    why: "Broadcast copy to an opted-in list is marketing, not an unsolicited 1:1 cold touch — different legal basis and different playbook."
+
+capability:
+  - scenario: "Write a full 4-step cold email sequence for a DevOps observability tool, sent to a Head of Platform at a 200-person fintech, including sending cadence and a compliant footer."
+    must_include:
+      - "First touch is under ~80 words."
+      - "Exactly one binary (yes/no) CTA in the first touch — no double ask."
+      - "A plain subject line under ~6 words, no clickbait or spam-trigger words."
+      - "One observed, plausible signal as the hook (not 'I came across your company')."
+      - "Four steps with explicit day offsets (e.g. Day 0 / +3 / +7 / +12)."
+      - "Each step adds one new angle (proof, different pain, breakup) — no 'just following up' filler."
+      - "A breakup step that offers a graceful out."
+      - "A compliant footer: a one-click opt-out line AND a physical postal-address placeholder."
+      - "Per-inbox volume guidance noted (20-50/day) and that warm-up precedes high volume."
+      - "Points DNS/auth setup to email-deliverability rather than configuring it inline."

package/skills/cold-outreach/references/compliance-footer.md

@@ -0,0 +1,50 @@
+# Compliance footer — wording, matrix, LIA checklist
+
+Every cold send needs a footer that (a) identifies you truthfully, (b) gives a working opt-out, and (c) satisfies the recipient's jurisdiction. Write for the **strictest plausible jurisdiction** the recipient could be in. All figures accessed 2026-06-02.
+
+## Jurisdiction matrix
+
+| | CAN-SPAM (US) | GDPR (EU B2B) | CASL (Canada) | Spam Act (Australia) |
+|---|---|---|---|---|
+| Legal basis for cold B2B | Truthful + opt-out (no prior consent) | Art. 6(1)(f) legitimate interest **+ documented LIA** | Implied consent (conspicuous publication / existing relationship) — strict | Inferred consent for conspicuously-published business addresses |
+| Postal address | **Required**, physical | Identify the controller; address recommended | **Required** | Sender identification required |
+| Opt-out window | Within **10 business days** | Without undue delay (**treat 24-48h**) | Honored **without delay**, ≤10 business days | Functional unsubscribe, honored ≤5 business days |
+| Penalty | Up to **$53,088 per email** (Jan 2025) | Up to **€20M or 4%** of global revenue | Up to **CA$10M** per violation | Civil penalties per breach |
+
+*(Sources: Instantly compliance guide / Puzzle Inbox; litemail.ai / complydog GDPR cold-email guides 2026; standard CASL / Australian Spam Act 2003 references.)*
+
+## EU country notes (enforcement varies)
+
+- **UK (ICO) / France (CNIL):** relatively permissive for genuine B2B legitimate-interest outreach.
+- **Germany:** strict — UWG often treated as requiring prior consent for B2B email; tread carefully.
+- **Poland:** frequently requires prior consent even B2B.
+- Default: if you cannot confirm the recipient's country, write to the strictest (assume consent-style) and keep the LIA on file.
+
+## Footer wording (drop-in)
+
+```text
+You're receiving this because {{the legitimate-interest reason — e.g. "you lead
+infra at a team we believe we can help"}}. Not relevant? Reply "stop" or use the
+one-click unsubscribe and you won't hear from us again.
+
+{{Company legal name}}
+{{Physical postal address — street, city, country}}
+Unsubscribe: {{one-click opt-out link}}
+```
+
+Notes:
+- The `Unsubscribe:` link must be backed by an RFC 8058 one-click header (`List-Unsubscribe` + `List-Unsubscribe-Post`) for bulk Gmail/Yahoo sending. **You specify it must exist and be one-click; wiring the header is `email-deliverability`'s job.**
+- "Reply stop" is a fallback, not a substitute for the link.
+- Keep the From/Reply-To accurate and the subject honest — a deceptive subject voids CAN-SPAM compliance on its own.
+
+## Legitimate Interest Assessment (LIA) checklist — EU sends
+
+Keep this documented *before* sending to EU recipients:
+
+1. **Purpose test** — is there a genuine business interest (offering a relevant solution to a relevant role)? Name it.
+2. **Necessity test** — is cold email a proportionate way to reach this interest, or is there a less intrusive route?
+3. **Balancing test** — does your interest override the recipient's privacy expectation? B2B role-based address + relevant offer usually passes; consumer address usually does not.
+4. **Data minimization** — you hold only what's needed (name, role, business email, the signal). No scraped personal/sensitive data.
+5. **Opt-out honored fast** — 24-48h, suppression list updated, never re-contacted.
+
+If any test fails, do not send — that is a targeting problem to take back to `lead-gen`, not a wording fix.

package/skills/cold-outreach/references/hook-derivation.md

@@ -0,0 +1,73 @@
+# Hook derivation — worked OBSERVE → INFER → BRIDGE → PROVE chains
+
+The four-line bridge (SKILL.md → "Deriving the hook") is the method. This file shows it executed across industries so you can pattern-match the *shape* of a good INFER line — the one step that separates a one-to-one email from a mail-merge wearing a name tag.
+
+Read these for the INFER line specifically. Notice that in every good example the inference is something the recipient privately knows but didn't expect a stranger to. That recognition — not flattery, not a value prop — is what earns the reply.
+
+## The test every chain must pass
+
+After drafting the INFER line, ask: **"Would this sentence be FALSE for a competitor in the same situation?"**
+- If it's true of everyone in the industry → it's a platitude. Go back, pick a sharper OBSERVE fact.
+- If it's true only because of *this* specific signal → it's a hook. Ship it.
+
+---
+
+## 1. DevOps / infra tooling
+
+- **OBSERVE:** 3 SRE roles open on their careers page for the full quarter.
+- **INFER:** unfilled for a quarter means the current rotation is thin and absorbing the pages — recruiting isn't keeping up with on-call load.
+- **BRIDGE:** we reduce page volume so a short-staffed rotation survives without the missing hires.
+- **PROVE:** ~40% fewer alerts for two infra teams your size, month one.
+- *Why it passes:* a competitor with a fully staffed team wouldn't feel this. The pain is specific to the unfilled-reqs signal.
+
+## 2. B2B SaaS selling to RevOps
+
+- **OBSERVE:** they just announced a Series B and a new VP of Sales on LinkedIn.
+- **INFER:** post-B2 + new sales leader means the number tripled and the existing pipeline reporting won't survive the new board's scrutiny.
+- **BRIDGE:** we make pipeline forecasts the new VP can defend in week one, not month three.
+- **PROVE:** [named comparable] cut forecast variance from 30% to under 10% in a quarter.
+- *Why it passes:* a flat company with a tenured VP doesn't have the "defend the number to a new board" pain. The funding + hire combination creates it.
+
+## 3. E-commerce / DTC brand
+
+- **OBSERVE:** their site runs a specific subscription app you can see in the page source / their checkout flow.
+- **INFER:** that stack has a known involuntary-churn leak at card-expiry — they're losing ~5-8% of subscribers monthly to failed payments, not to cancellations.
+- **BRIDGE:** we recover the failed-payment cohort before it churns.
+- **PROVE:** [comparable DTC brand] recovered 6% of MRR that was bleeding to dunning failures.
+- *Why it passes:* the inference is tied to a *detectable tech detail*, so it's true of them specifically, not "all DTC brands churn."
+
+## 4. Professional services (agency → mid-market CMO)
+
+- **OBSERVE:** they published a case study landing page but their blog hasn't shipped since Q3.
+- **INFER:** the content engine stalled — likely the one person who owned it left or got pulled onto launches, and the pipeline that content fed is now thinning silently.
+- **BRIDGE:** we keep the demand-gen content shipping without the headcount they just lost.
+- **PROVE:** kept [comparable]'s organic pipeline flat through a content-team gap.
+- *Why it passes:* the gap between "has case studies" and "blog stopped" is the specific, observable evidence of a stall — not a guess.
+
+## 5. Fintech / regulated
+
+- **OBSERVE:** a new compliance regulation with a known enforcement date hits their license type in 6 months.
+- **INFER:** their compliance team is now triaging which controls to retrofit first, and the audit-trail gap is usually the one that surfaces late and panics legal.
+- **BRIDGE:** we close the audit-trail gap so the deadline is a checkbox, not a fire drill.
+- **PROVE:** [comparable] passed the equivalent audit with zero findings on first pass.
+- *Why it passes:* the deadline is real and dated; the inference about *which* control bites last is the insider-grade detail that earns trust.
+
+## 6. When the only signal is weak (the honest fallback)
+
+Sometimes you genuinely cannot find a strong signal — the company is quiet, no hiring, no news. Do NOT fabricate. Two legitimate moves:
+
+- **Use a category-level trigger honestly framed as a hypothesis, not a fake observation.** "Most [role]s at [company size] in [industry] are hitting [specific pain] right now — if that's you, [ask]. If not, ignore me." This is weaker than a real signal (expect reply rates at the low end of the band) but it's honest and still binary.
+- **Kick it back to targeting.** If you keep landing on companies with no signal, the list is the problem, not the copy — that's a `lead-gen` ICP/timing gap. The fix is a better-segmented list with built-in triggers (recently funded, recently hiring, recently launched), not a cleverer sentence.
+
+Never close the gap with an invented "I loved your recent post" — a signal the recipient knows is false destroys the contact on the first line.
+
+## Anti-examples — INFER lines that FAIL the test
+
+| Generic INFER (platitude) | Why it fails | Sharper version |
+|---|---|---|
+| "...so you probably want to grow revenue" | True of every company alive | Tie growth to the specific signal (new funding round → "defend a 3x number") |
+| "...so you care about efficiency" | Vacuous; everyone claims this | Name the specific inefficiency the signal implies |
+| "...AI is transforming your industry" | A trend, not a fact about *them* | Drop it; find a fact you can screenshot |
+| "...I imagine scaling is a challenge" | Hedged guess, no observed basis | Only say it if a hiring/funding signal makes it observable |
+
+The pattern: a failing INFER line is true regardless of the OBSERVE fact. A working one is true *because* of it.

package/skills/cold-outreach/references/templates.md

@@ -0,0 +1,88 @@
+# Templates — first-touch + bump skeletons
+
+Fill **every** `{{slot}}` with a real value before sending. An unfilled slot is a defect. The slots:
+
+- `{{signal}}` — the one true, public, business-relevant trigger (a hiring post, a launch, a number from their site, a role change).
+- `{{outcome}}` — one concrete result you delivered for a comparable team (with a number when you have one).
+- `{{proof}}` — a named comparable, a mini case study, or a metric.
+- `{{ask}}` — the binary yes/no CTA.
+- `{{name}}` / `{{company}}` — recipient + their company.
+
+## Email — first touch (≤ ~80 words)
+
+```text
+Subject: {{signal}}   ← ≤6 plain words, no clickbait
+
+Hi {{name}} — {{signal, stated plainly}}. Usually that means {{the pain it
+implies}}.
+
+We {{outcome}} for {{a comparable team}}.
+
+{{ask}} — yes or no?
+
+— {{your name}}, {{your company}}
+{{compliant footer: see references/compliance-footer.md}}
+```
+
+## Email — 4-step bump (same thread, reply to your own send)
+
+```text
+STEP 1 — Day 0   (the first touch above)
+
+STEP 2 — Day +3   (angle: proof)
+Hi {{name}} — following the note below, here's the concrete version:
+{{proof}}. {{ask}} — yes or no?
+
+STEP 3 — Day +7   (angle: different pain, lower-friction ask)
+One more angle: teams like {{company}} also hit {{second pain}}. I wrote a
+2-page teardown on it — want me to send it? (no call required)
+
+STEP 4 — Day +12 (the breakup)
+Hi {{name}} — I'll stop here so I'm not cluttering your inbox. Should I
+close the file, or is {{the value}} worth 15 minutes later this quarter?
+```
+
+The breakup is the highest-converting follow-up after step 1 — never skip it. Extend to step 5-7 only if a genuinely new `{{signal}}` appears.
+
+## LinkedIn — connection note (≤ ~300 chars, NO pitch)
+
+```text
+Hi {{name}} — {{signal, e.g. "your post on cutting on-call toil"}} resonated.
+Working on the same problem for infra teams; would value connecting.
+```
+
+No ask, no product name in the note. Earn the connection on a real signal.
+
+## LinkedIn — DM bump (after they accept, ~3-4 sentences)
+
+```text
+DM 1 — Day 0 (after accept)
+Thanks for connecting, {{name}}. {{signal}} is exactly what we work on — we
+{{outcome}} for {{comparable team}}. Open to a quick look, or not the right
+time?
+
+DM 2 — Day +4
+No worries if the timing's off. If on-call noise is on your radar this
+quarter, happy to share the {{proof}} we used — say the word.
+
+DM 3 — Day +9 (breakup)
+I'll leave it here, {{name}}. If {{the value}} ever moves up your list, my
+door's open. Either way, glad to be connected.
+```
+
+## Spanish — secuencia de cold email (primer toque, ≤ ~80 palabras)
+
+```text
+Asunto: {{signal}}
+
+Hola {{name}} — {{signal}}. Normalmente eso implica {{el dolor}}.
+
+Logramos {{outcome}} para {{un equipo comparable}}.
+
+{{ask}} — ¿sí o no?
+
+— {{tu nombre}}, {{tu empresa}}
+{{pie de página conforme: ver references/compliance-footer.md}}
+```
+
+Keep the same rules in any language: one true signal, one binary ask, ≤ ~80 words, a compliant footer. The breakup step is mandatory in every sequence.