Twin My Site
The website exists; the app doesn't. The wrong move is a WebView wrapper
(rejected by Apple as minimum-functionality, and it feels like a website).
The right move is a twin: an app that shares the web product's DNA —
its data, its features, its design language — but lives in a native body
with native idioms. This skill plans that twin, evidence-first.
Division of labor: this skill produces the blueprint (feature matrix, API
contract, design translation, stack decision, roadmap). Each roadmap phase
is then one deep-plan run for implementation detail.
The Prime Directive (family rule)
The web product is the source of truth — and every claim about it needs
file:line. Features come from routes and code, not from memory of the
homepage. Design tokens come from the actual CSS. Platform claims (APNs,
FCM, store rules, framework capabilities) need a docs citation fetched
now — store policies change quarterly and training-data memory of them is
a rejection waiting to happen.
No web access in this session? Degrade honestly: extract everything
local evidence allows (routes, CSS, code), tag every store rule, character
limit, and platform claim UNVERIFIED — needs web check, and mark the
store-compliance and listing sections provisional. Never fill them from
memory.
No codebase, only a live site? The census and design extraction can
run against the deployed product instead: crawl the navigation, sitemap,
and rendered pages; extract computed styles for tokens. Evidence citations
become URLs instead of file:line, the API audit is limited to what the
browser's network traffic reveals, and every gap inherits UNVERIFIED — needs source access. State this ceiling in the report — a blueprint from
the outside is a weaker blueprint.
Progress checklist
Copy this into your response and check items off:
Twin Progress:
- [ ] Step 0: Frame — driver, platforms, scope, team constraints, Twin Questions
- [ ] Step 1: Feature census — every web feature classified for the app
- [ ] Step 2: API audit & contract — existing endpoints, gaps, mobile contract designed
- [ ] Step 3: Design language extraction — web tokens → mobile tokens, translated not transplanted
- [ ] Step 4: Stack decision — one committed choice with rationale, reversibility-tagged
- [ ] Step 5: Mobile-native layer — offline, push, deep links, store requirements
- [ ] Twin Brief Gate — 10–20 line brief confirmed; every ONE-WAY decision resolved
- [ ] Step 6: Store listing & publish kit — name, description, category, legal links, store/ scaffolded
- [ ] Step 7: Blueprint document written; Phase 1 = walking skeleton, spikes placed first
- [ ] Step 8: Self-check + report
Step 0 — Frame
- Driver: why an app at all — push re-engagement, offline reading,
store presence, home-screen habit? The feature scope and stack choice
both hang on this.
- Platforms: iOS / Android / both. Scope: full parity or a subset
(for content products the usual right answer is: reader app first,
admin/publishing stays web — recommend it).
- Team constraints: who maintains the app? Their existing skills weigh
heavily in Step 4 — an app the team can't maintain is a liability with
an icon.
- Monetization: free / ads / subscriptions / paid content. This decides
whether IAP rules apply (Step 5) and shapes the listing (Step 6) — pin it
now, not at submission time.
- Twin Questions: write a numbered list of the questions the blueprint
needs answered (does a consumable API exist? what auth model? do the
fonts license for app embedding? where in the code do push-worthy events
originate? which current store rules touch this product's monetization?).
Steps 1–5 exist to answer this list — each finding cites the question it
answers, questions discovered mid-run are appended, and research ends
when every question is answered with evidence or tagged
UNVERIFIED —
not when every file has been read.
- If a required input is genuinely ambiguous, ask one question at a
time with your recommended answer and a one-line reason attached —
never a wall of questions.
Step 1 — Feature census
Inventory the web product's user-facing features from evidence: routes,
controllers, navigation menus, templates (file:line each — not from
memory of using the site). Classify every feature for the app:
| Verdict |
Meaning |
| include |
Goes to the app as-is (conceptually) |
| adapt |
Goes, but mobile-reshaped (e.g. mega-menu → tab + search) |
| exclude |
Stays web-only (admin, desktop workflows) — with the reason |
| mobile-new |
Doesn't exist on web; the app's reason to exist (push, offline, share sheet, widgets) |
See references/feature-census.md for the
method. Output: the feature matrix — it drives the API contract (Step 2)
and the roadmap (Step 7).
Step 2 — API audit and contract
The make-or-break step. Audit what exists, then design what the app needs —
rules and template in references/api-contract-guide.md:
- Audit: existing endpoints (REST? GraphQL? none — server-rendered
HTML only?), auth model (session cookies do not fly on mobile), data
shapes coupled to HTML rendering. Cite
file:line per finding.
- Gap list: every
include/adapt feature that has no consumable
endpoint — this is server-side work the web team must build, and it goes
on the roadmap explicitly, usually as the longest pole.
- Contract: design API-first (the app is client #1, not the only
client ever): token auth with refresh, versioned paths, cursor
pagination for feeds, mobile-sized media variants, ETags for offline
sync, a push pipeline (device token registry + topics).
Step 3 — Design language extraction
The "same tone" requirement, done with evidence — method in
references/design-translation.md:
- Extract from the actual web codebase: color tokens, typography,
spacing scale, radii, iconography, component inventory, voice of copy
(
file:line — CSS variables, theme files, design tokens).
- Translate, don't transplant: same brand tokens, native interaction
idioms — navbar → tab bar, hover → press states, modals → sheets,
breadcrumbs → navigation stack. A web layout cloned onto a phone reads
as a website in a costume; the twin must feel native while unmistakably
the same brand.
- Output: mobile token set + a component mapping table (web component →
app component, per-platform notes), plus the decisions the web can't
answer (dark mode if the web has none, font licensing for app embedding).
Step 4 — Stack decision
Commit to ONE app stack — native (Swift/Kotlin), Flutter, or React
Native/Expo — weighing: team skills (Step 0), web-stack affinity (a React
web team gets type/logic reuse from RN/Expo — verify the specific sharing
claim, don't assume), feature needs from the census (heavy native features
pull toward native), and hiring/maintenance reality. Cite docs for any
capability the decision leans on. One decision with rationale and rejected
alternatives in one line each — no menus.
Tag every committed decision REVERSIBLE (cheap to undo later) or
ONE-WAY (undo cost rivals do cost). Three decisions in this skill are
always ONE-WAY: the app stack (a swap after the skeleton exists is a
rewrite), the API contract v1 (installed clients can't be forced to
update), and the app name + bundle id (permanent after first store
submission). ONE-WAY decisions are confirmed at the Twin Brief Gate below —
never silently committed.
Step 5 — Mobile-native layer
Design the parts that make it an app rather than a port:
- Offline: what is readable without network (for content products:
downloaded issues/articles + images), the cache/sync strategy (ETags,
timestamps), and the honest storage budget.
- Push: the full pipeline — server event → device tokens → topic
routing → deep link into the right screen. Server side included.
- Deep links: universal links/app links so web URLs open the app on
the same content — the twin behaves as one product with the web.
- Store requirements: verify the CURRENT store rules that apply
(fetch now, cite URL + date): Apple minimum functionality (4.2), IAP
rules if any paid content, account deletion requirement, privacy
labels/data-safety forms. Any rule that reshapes scope goes to the user
immediately, not into a footnote.
Twin Brief Gate — before the expensive artifacts
Before scaffolding store/ (Step 6) or writing the blueprint (Step 7),
present a compact brief in chat — 10–20 lines total, this is the brief,
not the document:
- Scope verdict + census counts (include / adapt / exclude / mobile-new).
- The stack decision, one-line rationale.
- The top 3 API gaps (the real cost center) and who builds them.
- Any store rule that reshapes scope.
- The recommended app name + bundle id (deriving candidates is cheap;
writing the kit around the wrong name is not).
- Every ONE-WAY decision flagged as such.
Ask for confirmation once. Changing a decision here costs one message;
changing it after Step 7 costs a rewrite. If the user cannot respond
(headless run), proceed on REVERSIBLE decisions and carry every ONE-WAY
decision into the blueprint explicitly marked UNCONFIRMED.
Step 6 — Store listing and publish kit
Prepare the launch surface now, from evidence — full method in
references/store-listing-guide.md:
- Listing text: app name candidates (from the web brand, cited),
subtitle/short description (from the
mobile-new value), long
description (hook from the site's own copy; bullets from the census),
keywords, localized to the site's language(s). Character limits verified
from current store docs — never from memory.
- Category: primary + secondary per store, chosen from the CURRENT
category lists (fetched, cited) with one-line rationale.
- Privacy policy link: audit the site for an existing policy
(
file:line); if present, list the app-specific coverage gaps (push
tokens, device IDs, SDKs); if absent, recommend generators (iubenda,
Termly, GetTerms, …) and host the result at the canonical domain
(https://<site>/privacy).
- Account deletion link: fetch current Apple/Google requirements, then
recommend one canonical web route (
https://<site>/account/delete)
reusing web auth, paired with the contract's deletion endpoint.
- Scaffold
store/ in the repo — listing/, legal/ (privacy,
account-deletion, data-safety worksheet mapped from the API contract),
assets/ (icon/screenshot/feature-graphic specs with citations), and a
verifiable pre-submission checklist. Every file drafted with real
content from this run; no empty placeholders.
Step 7 — Blueprint document
Write docs/TWIN_BLUEPRINT.md per
references/blueprint-template.md.
The roadmap's Phase 1 is a walking skeleton: real auth + one content
list + one detail screen, end-to-end through the real API on a real device
— it validates the API contract, the design tokens, and the stack choice
at once, before scale-out. Every phase sized for one deep-plan run.
Two more roadmap non-negotiables:
- Every
UNVERIFIED that survives into the blueprint becomes a named,
timeboxed spike task placed FIRST in the roadmap phase that depends
on it — "prove token auth works from the native client", "push reaches
a test device end-to-end", "font license covers app embedding". No
unknown sits silently under an implementation task.
- The risk register comes from a pre-mortem: assume the app shipped
and failed three months later — rejected in review, uninstalled within
a week, broken on installed devices by an API change — and write the
top three causes. Those are the risks, each with a mitigation. Generic
risks that fit any app ("store review might fail") are a self-check
failure.
Step 8 — Self-check and report
- Every feature verdict traces to a route/controller citation; every API
gap names the server-side work; every design token has a CSS source;
every store-rule claim, character limit, and category has a current
citation fetched this run.
- Every Twin Question from Step 0 is answered with evidence or tagged
UNVERIFIED — and every surviving UNVERIFIED has a named, timeboxed
spike task placed first in the roadmap phase that depends on it.
- Every ONE-WAY decision (stack, API contract v1, app name + bundle id)
was confirmed at the Twin Brief Gate or is marked
UNCONFIRMED.
- Roadmap Phase 1 is the walking skeleton — real auth + one list + one
detail screen, end-to-end on a device. Any other Phase 1 fails this check.
- Every risk in the register names something specific to THIS product;
risks that could appear in any app blueprint fail.
store/ exists with drafted content in every file — zero empty
placeholders — and the privacy/deletion links are either live URLs or
explicit roadmap items.
- The user could hand Phase 1 to deep-plan today.
- Report: scope (include/adapt/exclude/mobile-new counts), the API gap
list (the real cost center), stack decision in one line, the recommended
app name + category, legal-link status, and the top 3 risks.
When things go wrong
| Situation |
Response |
| No API at all (fully server-rendered) |
Not a blocker — the contract IS the gap list; say plainly that server-side work is the longest pole and phase it first |
The census yields zero mobile-new rows |
Flag it: a twin with no mobile-only value is a website in a costume — challenge the driver with the user before writing the blueprint |
| Web design tokens don't exist (ad-hoc CSS) |
Extract the de-facto values (most-used colors/sizes via grep), propose them AS the token set, and note the web debt |
| Font license doesn't cover app embedding |
Name it as a Phase 1 blocker with alternatives (licensed tier, similar open font) — never assume the web license transfers |
| The site is behind auth and can't be crawled |
Ask for credentials or fall back to codebase-only evidence; never invent features from the marketing page |
| User wants a WebView wrapper anyway |
Explain the minimum-functionality rejection risk with a current citation, then respect the decision — document it as an accepted risk |
1---2name: twin-my-site3description: Plans a native mobile companion app for an existing website — a twin, not a wrapper: same brand DNA, data, and features; native body. Censuses the web product's features and classifies each for the app, audits API readiness and designs the mobile API contract (token auth, pagination, media, push pipeline), extracts the web's design language into mobile design tokens translated to native idioms, commits to an app stack, prepares the store listing (app name, description, category, privacy policy and account-deletion links — recommending generators when missing — and a scaffolded store/ publish kit), and writes a phased blueprint starting with a walking skeleton. Use when the user has a website and wants a mobile app version or companion app, needs an API designed for an app, wants the app to match the web's design and tone, asks to prepare an App Store or Play Store listing, or mentions twin-my-site or /twin-my-site.4license: MIT5---67# Twin My Site89The website exists; the app doesn't. The wrong move is a WebView wrapper10(rejected by Apple as minimum-functionality, and it feels like a website).11The right move is a **twin**: an app that shares the web product's DNA —12its data, its features, its design language — but lives in a native body13with native idioms. This skill plans that twin, evidence-first.1415Division of labor: this skill produces the blueprint (feature matrix, API16contract, design translation, stack decision, roadmap). Each roadmap phase17is then one **deep-plan** run for implementation detail.1819## The Prime Directive (family rule)2021> **The web product is the source of truth — and every claim about it needs22> `file:line`.** Features come from routes and code, not from memory of the23> homepage. Design tokens come from the actual CSS. Platform claims (APNs,24> FCM, store rules, framework capabilities) need a docs citation fetched25> now — store policies change quarterly and training-data memory of them is26> a rejection waiting to happen.2728**No web access in this session?** Degrade honestly: extract everything29local evidence allows (routes, CSS, code), tag every store rule, character30limit, and platform claim `UNVERIFIED — needs web check`, and mark the31store-compliance and listing sections provisional. Never fill them from32memory.3334**No codebase, only a live site?** The census and design extraction can35run against the deployed product instead: crawl the navigation, sitemap,36and rendered pages; extract computed styles for tokens. Evidence citations37become URLs instead of `file:line`, the API audit is limited to what the38browser's network traffic reveals, and every gap inherits `UNVERIFIED —39needs source access`. State this ceiling in the report — a blueprint from40the outside is a weaker blueprint.4142## Progress checklist4344Copy this into your response and check items off:4546```47Twin Progress:48- [ ] Step 0: Frame — driver, platforms, scope, team constraints, Twin Questions49- [ ] Step 1: Feature census — every web feature classified for the app50- [ ] Step 2: API audit & contract — existing endpoints, gaps, mobile contract designed51- [ ] Step 3: Design language extraction — web tokens → mobile tokens, translated not transplanted52- [ ] Step 4: Stack decision — one committed choice with rationale, reversibility-tagged53- [ ] Step 5: Mobile-native layer — offline, push, deep links, store requirements54- [ ] Twin Brief Gate — 10–20 line brief confirmed; every ONE-WAY decision resolved55- [ ] Step 6: Store listing & publish kit — name, description, category, legal links, store/ scaffolded56- [ ] Step 7: Blueprint document written; Phase 1 = walking skeleton, spikes placed first57- [ ] Step 8: Self-check + report58```5960## Step 0 — Frame6162- **Driver:** why an app at all — push re-engagement, offline reading,63 store presence, home-screen habit? The feature scope and stack choice64 both hang on this.65- **Platforms:** iOS / Android / both. **Scope:** full parity or a subset66 (for content products the usual right answer is: reader app first,67 admin/publishing stays web — recommend it).68- **Team constraints:** who maintains the app? Their existing skills weigh69 heavily in Step 4 — an app the team can't maintain is a liability with70 an icon.71- **Monetization:** free / ads / subscriptions / paid content. This decides72 whether IAP rules apply (Step 5) and shapes the listing (Step 6) — pin it73 now, not at submission time.74- **Twin Questions:** write a numbered list of the questions the blueprint75 needs answered (does a consumable API exist? what auth model? do the76 fonts license for app embedding? where in the code do push-worthy events77 originate? which current store rules touch this product's monetization?).78 Steps 1–5 exist to answer this list — each finding cites the question it79 answers, questions discovered mid-run are appended, and research ends80 when every question is answered with evidence or tagged `UNVERIFIED` —81 **not** when every file has been read.82- If a required input is genuinely ambiguous, ask **one question at a83 time** with your recommended answer and a one-line reason attached —84 never a wall of questions.8586## Step 1 — Feature census8788Inventory the web product's user-facing features from evidence: routes,89controllers, navigation menus, templates (`file:line` each — not from90memory of using the site). Classify every feature for the app:9192| Verdict | Meaning |93|---------|---------|94| **include** | Goes to the app as-is (conceptually) |95| **adapt** | Goes, but mobile-reshaped (e.g. mega-menu → tab + search) |96| **exclude** | Stays web-only (admin, desktop workflows) — with the reason |97| **mobile-new** | Doesn't exist on web; the app's reason to exist (push, offline, share sheet, widgets) |9899See [references/feature-census.md](references/feature-census.md) for the100method. Output: the feature matrix — it drives the API contract (Step 2)101and the roadmap (Step 7).102103## Step 2 — API audit and contract104105The make-or-break step. Audit what exists, then design what the app needs —106rules and template in [references/api-contract-guide.md](references/api-contract-guide.md):1071081. **Audit:** existing endpoints (REST? GraphQL? none — server-rendered109 HTML only?), auth model (session cookies do not fly on mobile), data110 shapes coupled to HTML rendering. Cite `file:line` per finding.1112. **Gap list:** every `include`/`adapt` feature that has no consumable112 endpoint — this is server-side work the web team must build, and it goes113 on the roadmap explicitly, usually as the longest pole.1143. **Contract:** design API-first (the app is client #1, not the only115 client ever): token auth with refresh, versioned paths, cursor116 pagination for feeds, mobile-sized media variants, ETags for offline117 sync, a push pipeline (device token registry + topics).118119## Step 3 — Design language extraction120121The "same tone" requirement, done with evidence — method in122[references/design-translation.md](references/design-translation.md):1231241. **Extract** from the actual web codebase: color tokens, typography,125 spacing scale, radii, iconography, component inventory, voice of copy126 (`file:line` — CSS variables, theme files, design tokens).1272. **Translate, don't transplant:** same brand tokens, native interaction128 idioms — navbar → tab bar, hover → press states, modals → sheets,129 breadcrumbs → navigation stack. A web layout cloned onto a phone reads130 as a website in a costume; the twin must feel native while unmistakably131 the same brand.1323. Output: mobile token set + a component mapping table (web component →133 app component, per-platform notes), plus the decisions the web can't134 answer (dark mode if the web has none, font licensing for app embedding).135136## Step 4 — Stack decision137138Commit to ONE app stack — native (Swift/Kotlin), Flutter, or React139Native/Expo — weighing: team skills (Step 0), web-stack affinity (a React140web team gets type/logic reuse from RN/Expo — verify the specific sharing141claim, don't assume), feature needs from the census (heavy native features142pull toward native), and hiring/maintenance reality. Cite docs for any143capability the decision leans on. One decision with rationale and rejected144alternatives in one line each — no menus.145146Tag every committed decision **REVERSIBLE** (cheap to undo later) or147**ONE-WAY** (undo cost rivals do cost). Three decisions in this skill are148always ONE-WAY: the **app stack** (a swap after the skeleton exists is a149rewrite), the **API contract v1** (installed clients can't be forced to150update), and the **app name + bundle id** (permanent after first store151submission). ONE-WAY decisions are confirmed at the Twin Brief Gate below —152never silently committed.153154## Step 5 — Mobile-native layer155156Design the parts that make it an app rather than a port:157158- **Offline:** what is readable without network (for content products:159 downloaded issues/articles + images), the cache/sync strategy (ETags,160 timestamps), and the honest storage budget.161- **Push:** the full pipeline — server event → device tokens → topic162 routing → deep link into the right screen. Server side included.163- **Deep links:** universal links/app links so web URLs open the app on164 the same content — the twin behaves as one product with the web.165- **Store requirements:** verify the CURRENT store rules that apply166 (fetch now, cite URL + date): Apple minimum functionality (4.2), IAP167 rules if any paid content, account deletion requirement, privacy168 labels/data-safety forms. Any rule that reshapes scope goes to the user169 immediately, not into a footnote.170171## Twin Brief Gate — before the expensive artifacts172173Before scaffolding `store/` (Step 6) or writing the blueprint (Step 7),174present a compact brief in chat — 10–20 lines total, this is the brief,175not the document:176177- Scope verdict + census counts (include / adapt / exclude / mobile-new).178- The stack decision, one-line rationale.179- The top 3 API gaps (the real cost center) and who builds them.180- Any store rule that reshapes scope.181- The recommended app name + bundle id (deriving candidates is cheap;182 writing the kit around the wrong name is not).183- Every **ONE-WAY** decision flagged as such.184185Ask for confirmation **once**. Changing a decision here costs one message;186changing it after Step 7 costs a rewrite. If the user cannot respond187(headless run), proceed on REVERSIBLE decisions and carry every ONE-WAY188decision into the blueprint explicitly marked `UNCONFIRMED`.189190## Step 6 — Store listing and publish kit191192Prepare the launch surface now, from evidence — full method in193[references/store-listing-guide.md](references/store-listing-guide.md):194195- **Listing text:** app name candidates (from the web brand, cited),196 subtitle/short description (from the `mobile-new` value), long197 description (hook from the site's own copy; bullets from the census),198 keywords, localized to the site's language(s). Character limits verified199 from current store docs — never from memory.200- **Category:** primary + secondary per store, chosen from the CURRENT201 category lists (fetched, cited) with one-line rationale.202- **Privacy policy link:** audit the site for an existing policy203 (`file:line`); if present, list the app-specific coverage gaps (push204 tokens, device IDs, SDKs); if absent, recommend generators (iubenda,205 Termly, GetTerms, …) and host the result at the canonical domain206 (`https://<site>/privacy`).207- **Account deletion link:** fetch current Apple/Google requirements, then208 recommend one canonical web route (`https://<site>/account/delete`)209 reusing web auth, paired with the contract's deletion endpoint.210- **Scaffold `store/`** in the repo — listing/, legal/ (privacy,211 account-deletion, data-safety worksheet mapped from the API contract),212 assets/ (icon/screenshot/feature-graphic specs with citations), and a213 verifiable pre-submission checklist. Every file drafted with real214 content from this run; no empty placeholders.215216## Step 7 — Blueprint document217218Write `docs/TWIN_BLUEPRINT.md` per219[references/blueprint-template.md](references/blueprint-template.md).220The roadmap's **Phase 1 is a walking skeleton**: real auth + one content221list + one detail screen, end-to-end through the real API on a real device222— it validates the API contract, the design tokens, and the stack choice223at once, before scale-out. Every phase sized for one deep-plan run.224225Two more roadmap non-negotiables:226227- Every `UNVERIFIED` that survives into the blueprint becomes a named,228 timeboxed **spike task** placed FIRST in the roadmap phase that depends229 on it — "prove token auth works from the native client", "push reaches230 a test device end-to-end", "font license covers app embedding". No231 unknown sits silently under an implementation task.232- The risk register comes from a **pre-mortem**: assume the app shipped233 and failed three months later — rejected in review, uninstalled within234 a week, broken on installed devices by an API change — and write the235 top three causes. Those are the risks, each with a mitigation. Generic236 risks that fit any app ("store review might fail") are a self-check237 failure.238239## Step 8 — Self-check and report240241- Every feature verdict traces to a route/controller citation; every API242 gap names the server-side work; every design token has a CSS source;243 every store-rule claim, character limit, and category has a current244 citation fetched this run.245- Every Twin Question from Step 0 is answered with evidence or tagged246 `UNVERIFIED` — and every surviving `UNVERIFIED` has a named, timeboxed247 spike task placed first in the roadmap phase that depends on it.248- Every ONE-WAY decision (stack, API contract v1, app name + bundle id)249 was confirmed at the Twin Brief Gate or is marked `UNCONFIRMED`.250- Roadmap Phase 1 is the walking skeleton — real auth + one list + one251 detail screen, end-to-end on a device. Any other Phase 1 fails this check.252- Every risk in the register names something specific to THIS product;253 risks that could appear in any app blueprint fail.254- `store/` exists with drafted content in every file — zero empty255 placeholders — and the privacy/deletion links are either live URLs or256 explicit roadmap items.257- The user could hand Phase 1 to deep-plan today.258- Report: scope (include/adapt/exclude/mobile-new counts), the API gap259 list (the real cost center), stack decision in one line, the recommended260 app name + category, legal-link status, and the top 3 risks.261262## When things go wrong263264| Situation | Response |265|-----------|----------|266| No API at all (fully server-rendered) | Not a blocker — the contract IS the gap list; say plainly that server-side work is the longest pole and phase it first |267| The census yields zero `mobile-new` rows | Flag it: a twin with no mobile-only value is a website in a costume — challenge the driver with the user before writing the blueprint |268| Web design tokens don't exist (ad-hoc CSS) | Extract the de-facto values (most-used colors/sizes via grep), propose them AS the token set, and note the web debt |269| Font license doesn't cover app embedding | Name it as a Phase 1 blocker with alternatives (licensed tier, similar open font) — never assume the web license transfers |270| The site is behind auth and can't be crawled | Ask for credentials or fall back to codebase-only evidence; never invent features from the marketing page |271| User wants a WebView wrapper anyway | Explain the minimum-functionality rejection risk with a current citation, then respect the decision — document it as an accepted risk |