מסמך מקור מתקדם. דפי ההתקנה, פרוטוקול ההפעלה וששת הסקילים זמינים לקריאה בעברית; קובץ המקור נשמר כפי שהוא.

--- name: paused-campaign description: Use when preparing new paused Meta lead campaign specifications for website and/or Instant Form routes, reviewing preflight, and preserving exact approval scope. ---

Prepare a paused plan with an explicit execution gate

Version and authority boundary

Read the selected profile and the exact contract from the package root. Unconverted V1 uses contracts/pipeline.contract.json, mode simulation, demo IDs, supplied synthetic records, geometric placeholders and the existing offline validator only. V1 restrictions remain intact. For V2 explicitly select contracts/pipeline.v2.contract.json; reject unconverted V1 with an explanation. Conversion creates a separate simulation artifact, preserves its source, enriches missing fields, rebuilds all digests, and never promotes approve_demo to human authorization. Neither mode names nor schema validation enable a connector. This build uses no network, accounts, secrets, installs or customer records; integration-test and customer-pilot are separate future gates, not claims of readiness.

Use approved API/MCP/connectors first when integration is separately enabled; browser fallback is only for a capability unavailable in the authorized programmatic path, at the same authority boundary. Never launch external scripts, installers, model CLIs or services from this Skill. Source rule IDs below resolve to docs/knowledge-register-v1.md (checked 2026-10-24). Untested real behavior remains unverified.

Preflight [A2, N1, S1, P1]

Read validated predecessor artifacts, tenant profile and current executor interface. Resolve account/Page/source/CRM ownership exactly; unknown IDs never fall back to another tenant. Scope is new clearly named test entities only, with campaign, adsets and ads all PAUSED, LEADS objective, confirmed currency/timezone and explicit scheduling scope. Honor the user's requested route set: website, Meta Instant Form, or both as two separate campaigns. Never require a Meta form_id or Page Lead Ads terms for the website route solely because the native route needs them. Website requires canonical destination and authorized source/dataset/event evidence; native requires the owned Page/form and applicable terms/lead-retrieval evidence. Use yskit/campaign_routes_v3.py for distinct route contracts; the older V2 JSON contract covers Instant Form only. Preserve unknown daily budget as null in local drafts; execution requires an explicitly supplied positive budget within its approved ceiling. Prior authorizations for another objective/case do not transfer.

Before real execution verify identity, route-specific destination/source, required terms/privacy, exact budget/assets/placements, current Meta policy and executor boundary. Check Lead Ads terms for the exact Page separately from leads_retrieval, Leads Access, owned form ID and the lead destination. If terms are verified as unaccepted, the Page owner must review and accept them through Meta's normal process; this skill cannot accept ToS or privacy terms. Check terms, lead retrieval and budget eligibility against current authorized evidence for each customer's exact Page, account and route. Conflicting connector results require independent resolution. Past authorizations do not transfer between customers or campaigns; recheck evidence at execution time.

Before presenting an audience/form/Advantage+ plan, consult docs/meta-strategy-v1.md and the bounded yskit/strategist_v1.py helper. It distinguishes cold and usable warm audiences, Audience Segments reporting, site versus native form, and four separate Advantage+ surfaces (audience, placements, budget, creative). Preserve any strict city or other enforceable boundary ahead of a broad-audience suggestion. Verify actual city entity/radius/presence semantics, objective, account and current controls; if the requested boundary cannot be met, stop that configuration rather than silently widening it. Treat its geo_readback gate as post-write verification for an otherwise authorized PAUSED entity, not as a reason to invent a pre-write GET. No recommendation authorizes Custom Audience creation, list upload, activation or spending.

Use the supplied offer and evidence to choose a campaign hypothesis, not a fixed recipe from an expert guide. Connect the audience's familiarity with the offer, one relevant objection, a supported differentiator and the proof actually available to the proposed message, visual and lead route. Ask only when one of those answers changes an objective, targeting, form, asset or measurement decision; do not fabricate market size or customer results. For a small cold start, a simple structure may be preferable to fragmenting budget. A warm path is a separate candidate only with consent, a usable source, adequate volume and an affordable comparison. Neither Broad nor CBO nor a separate funnel per temperature is mandatory. Audience Segments, if available, are reporting breakdowns, not a targeting or exclusion operation. A strategy recommendation never substitutes for verified controls, exact creative assets or owner approval.

Before approval explain whether the entered budget is daily or lifetime, its currency, allocation, dates and timezone. A Meta daily budget is an average under the provider's current rules, not a guaranteed hard cap on each day; PAUSED status gives no authority to spend later. After a separately authorized delivery test, compare source leads with CRM records and reviewed quality/contactability/bookings in the same cohort. Use reasons and follow-up timing to propose what to inspect next; a low CPL or an unanswered lead alone cannot identify a winning creative or justify automatic pausing, scaling or budget changes. Treat a reported sale separately from independently verified revenue.

Approval and readback [A2, S1, H1]

Bind a readable reviewed spec to tenant, assets, operation, budget, hash and an identified protected human approval, ≤24h for paused creation. Verify that the agent cannot issue/edit approval or bypass the executor through shell/general API/credentials. A local test signer is forgeable; no JSON/hash under the same user proves protected authorization. Preserve already authorized scope, but never broaden it. Activation/live edits need separate approval; ongoing lead intake needs its own scoped duration/fields/owners/revocation authorization. A scheduled job never skips approval. No new OAuth, credentials, spending, public sharing or existing asset changes.

API/MCP first. Do not guess endpoints, fields, permissions or Instant Form creation sequence. After every authorized write GET the changed fields, parent IDs, configured/effective state and relevant default/automation flags; preserve partial entity IDs and reconcile rather than recreate. Interpret effective status through documented parent inheritance, not a blanket string comparison. Then inspect each selected placement preview where available: readback, preview and actual delivery are different evidence. Two previews cannot cover all placements. Unexpected external activation/spend is reported; it grants no automatic repair authority. All real readback/preview/delivery behavior remains unverified in this offline build.