Superstar Sale · Instagram Affiliate

Protocol Environments & data A · Bridge pages B · Kit & content C · IG account & publish D · Offer rail & slots E · Compliance probes Results & issue log

How this session works

Agent executes a step (browser / curl / repo checks), posts screenshots to the #instagram-affiliate thread, and states pass/fail.
Mike repeats the same step with his own accounts, phone, and data, posting his screenshots to the thread.
Compare. Same result → tick the log row. Different result → both re-run once, then file an issue.
File a GitHub issue for every wanted change (conventions below) and link it in the log row.
Move to the next step. Flows are ordered so data feeds forward: A proves the public pages, B proves the content machine behind them, C puts the account + first reel live, D wires the money rail into the page's empty slots, E probes the compliance walls around all of it.

Issue conventions

Title: [pair-test FLOW<STEP>] short summary — e.g. [pair-test C4] trigger-word comment produces no DM before ManyChat connect.
Body: environment (live page / repo branch / IG), expected vs actual, screenshot links, tester (agent / Mike / both).
Label pair-test; file in microspaces/superstarsale.
One behavior per issue — no mega-issues.

Evidence conventions

Agent screenshots: posted in the thread via MEDIA:; committed under docs/projects/shots/ in headquarters (the superstarsale repo gitignores test-screenshots/ — don't force-add there).
Every step has an Agent row and a Mike row. Both = same action, different account/device/data.
Agent limits are part of the design: the agent cannot create the IG account, sign up as a network publisher (payee/tax info), or connect ManyChat. Those rows are Mike's; the agent verifies from the outside (logged-out views, dashboards he screenshots, repo/Pages checks).

Environments & test data

Thing	Value
Live bridge pages (read-only surface)	affiliate/home-security and affiliate/boring-digital-products — verified HTTP 200 2026-10-13. Pages serves repo `docs/X` at `/X` (no `docs/` prefix; checking the repo path shape 404s and looks like a failed deploy).
Page-edit staging	Local server + branch: `cd ~/Repos/superstarsale/docs && python -m http.server`, edits on an `agent/…` branch → PR → merge. No page edit goes straight to main — the PR is the staging for anything public.
Instagram (no staging exists)	The account is brand-new with zero followers, so the first posts and comments are the test. All test comments come from a designated second (throwaway) account, never from real prospects' posts.
Money rails	Home Security: DOPPCALL pay-per-call application (Mike submits — payee/tax). Boring Digital Products: Payhip store (Mike creates — Payhip free-forever, 5%/sale, pricing verified 2026-09-30 vs Gumroad's 10%+50¢).
Private products repo	`~/Repos/superstarsale-products` — the 5 paid files + free pack. Paid deliverables must never appear in the public repo or on Pages (E4 checks).
Repo	microspaces/superstarsale — kits in `docs/research/`, pages in `docs/affiliate/`, slots as `AFFILIATE_SLOT_n` / `STORE_SLOT_n` comment + `href="#…SLOT_n"` pairs (greppable on purpose).

Test data markers

IG test comments: from the designated throwaway account only; comment text is the campaign trigger word (SAFE / CHECKLIST) — that IS the mechanism under test, so no fake text gets invented.
Store/listing data: anything created while testing uses PairTest <step> … names or pairtest-<date>-<slug> slugs so it's filterable and cleanable.
One trigger per campaign: Home Security = SAFE, Boring Digital Products = CHECKLIST. A page mixing triggers is a B2 failure.
Cleanup: every marker starts with PairTest / pairtest- / the throwaway handle — see the checklist at the bottom.

The IG account and the store/network accounts are real business assets, not throwaways. Nothing in this plan requires deleting them at session end — cleanup targets test comments, test listings, and any unfilled slot advertised in a live bio.

Flow A · Bridge pages — the public surface (no account)

Persona: an Instagram viewer who tapped the bio link. Read-only on the live Pages URLs. Produces: nothing — this is the baseline everything else is compared against. Both pages, both testers.

A1BothOpen https://microspaces.github.io/superstarsale/affiliate/home-security/ fresh (hard reload), desktop.

Expected: HTTP 200, mobile-first layout renders, free Home Security Checklist is the on-page value, FTC affiliate disclosure present, "not professional advice" box present, and no clickable outbound offer link (offer buttons are on-page #AFFILIATE_SLOT_n anchors until Flow D fills them).

A2BothSame for https://microspaces.github.io/superstarsale/affiliate/boring-digital-products/.

Expected: 200, renders, free starter checklist pack on-page, disclosure present, store buttons are #STORE_SLOT_n anchors (no live store links until D2). Content is digital-products-only — no home-security content bleeding in (cross-check with E3).

A3AgentServe integrity check: curl -s both live URLs; compare grep -c "AFFILIATE_SLOT\|STORE_SLOT" on the served HTML vs the source files in the repo; confirm the disclosure text is in the served HTML, not just the source. MikeSpot-check one number your agent reports (view-source in your browser, Ctrl+F the slot marker).

Expected: served count equals source count for each page; every slot has both the  comment and its href="#…SLOT_n" anchor. A count mismatch means Pages is serving stale content — stop and reconcile before C/D depend on these pages.

A4MikeOpen both pages on your phone (the way an IG viewer actually arrives — from the bio link). Scroll the whole page.

Expected: no horizontal scroll, text readable without zooming, checklist CTA visible without endless scrolling, buttons tappable. This is the device the whole rail is built for.

Flow B · Campaign kit & content integrity (the content machine)

Persona: QA on the factory that produces the reels. Feed data: none. Produces: confidence that everything Flow C publishes comes from a verified kit. Repo-level — no writes.

B1BothOpen both kits (docs/research/home-security-campaign-kit_2026-09-29.md, docs/research/boring-digital-products-campaign-kit_2026-09-30.md).

Expected: each kit has all sections: buyer identity, 8 content buckets with numbered hooks, 10 fully scripted reels (Hook → Value → Tease → CTA), DM flow, compliance guardrails, 30-day calendar, Mike steps, metrics. Verified offer terms (payout/GEO/cap/fees) with source URLs at the top.

B2AgentTrigger-word consistency: grep each kit + its bridge page + the 10 scripted reels for the trigger word. Home Security must be SAFE everywhere; BDP must be CHECKLIST everywhere; count occurrences and look for the other campaign's word.

Expected: exactly one trigger word per campaign, identical on page, kit, and every scripted reel CTA. Zero cross-campaign leakage. A viewer commenting the wrong word should be handled by the DM flow's fallback — note what the kit says that is.

B3AgentCompliance pre-pass over the first week's hooks: flag any income claim ("make $X/day"), any guaranteed-prevention claim (home security must say "deters / reduces risk"), and every statistic used — check it has a source or is struck before the reel posts.

Expected: zero income claims; prevention language is "deters/reduces"; every surviving stat has a named source recorded in the kit. Anything failing here is fixed in the kit BEFORE C3 posts it — this step gates publishing.

B4AgentSlot inventory: list every AFFILIATE_SLOT_n / STORE_SLOT_n in both pages with its on-page label, and map each to the step that fills it in Flow D.

Expected: a complete map (page → slot → filler step → source of the URL). No orphan slots, no duplicated numbers. This map is what D2 executes.

Flow C · IG account & first publish (Mike-led; agent verifies from outside)

Persona: the business going live. Feed data: kits from Flow B. Produces: a real account, bio, and the first scripted reel — the assets Flows D and E probe. These are Mike-only actions; the agent cannot create accounts.

C1MikeCreate the IG account(s) per the kits' page identity (Home Security: "HomeSecurityDaily"-style handle; BDP: "Boring Business Club"-style). Also create the throwaway test account that will do trigger-word comments. AgentRecord the handles in the thread; verify each profile resolves logged-out (incognito) — public, not private.

Expected: accounts live and public; handles match the kit identity; business account type selected so insights exist later. Private-by-default is a fail — the rail needs public content.

C2MikeSet the bio exactly per the kit (identity line + free-checklist line) and the link = the campaign's bridge page. AgentLogged-out check: open the profile, follow the bio link, confirm it lands on the right bridge page (A1/A2 URLs — the bridge, never a direct offer or store link).

Expected: bio link → bridge page on both campaigns. A direct offer/store link in bio is a guardrail violation (E1) — fix before any reel posts.

C3MikePost scripted reel #1 for one campaign (your pick which goes first), caption straight from the kit script. AgentLogged-out: confirm the reel is public, caption matches the script (no improvised claims — B3 already gated the language), and the profile still shows the bridge bio link.

Expected: reel public and caption-faithful; CTA in the caption is the trigger word. Note the first-impression metrics (views in first hour) as the baseline row for the kit's metrics section.

C4BothTrigger-word test: from the throwaway account, comment the trigger word (SAFE or CHECKLIST) on the C3 reel. Agent watches logged-out; Mike watches from the business account.

Expected-failure pinned: ManyChat is not connected yet, so no automated DM arrives — record exactly what happens (nothing? manual DM attempted?). This is the documented-baseline step; the wanted behavior (auto-DM with checklist + bridge link) becomes the issue that D5 closes after ManyChat is connected.

Flow D · Offer rail, slots & tracking (the money leg)

Persona: a viewer who bit — the click must reach the offer/store and be counted. Feed data: B4's slot map, C's live account. Produces: filled slots, a tracked click, and (after ManyChat) the closed DM loop.

D1MikeRail signups: submit the DOPPCALL publisher application for Home Security using the kit's traffic description ("organic Instagram reels → bridge page → click-to-call"); create the Payhip store for BDP and upload the 5 files + free pack from ~/Repos/superstarsale-products at the kit's price points ($7–12). AgentRecord application/store status in the thread; sanity-check the uploaded product pages' prices and names vs the kit.

Expected: network application submitted (approval may take days — record the wait), store live with all 6 deliverables correctly priced. Payee/tax steps are Mike-only by design; the agent never touches them.

D2BothFill the slots per B4's map: Mike sends the tracking URL(s) / Payhip product URLs; the agent replaces each href="#…SLOT_n" placeholder on a branch → PR → merge; verify Pages picked it up (A3's count check flips: zero remaining placeholder anchors on filled slots, disclosure intact).

Expected: every filled slot keeps its  marker comment (traceability) but now carries the real link; unfilled slots (network still pending) stay as anchors. Live page matches the branch exactly after merge.

D3BothClick-through: from the live bridge page, click a filled slot — agent on desktop, Mike on his phone.

Expected: lands on the offer page (Home Security) or the Payhip product page (BDP); nothing intermediate 404s. Within the rail's reporting lag, the network dashboard / Payhip shows the click — record how long the lag actually is (Payhip is near-instant; call networks can batch).

D4AgentUnfilled-slot probe: click every still-anchored #…SLOT_n placeholder on both live pages.

Expected: anchor jump on-page, no external navigation, no 404, no console error. An unfilled slot must fail closed — it must never send a viewer to a dead or wrong destination.

D5BothClose the DM loop: Mike connects ManyChat to the business account(s) (Mike-only), then repeat C4's trigger-word comment from the throwaway account.

Expected: automated DM arrives on the throwaway account within the kit's promised window, containing the free checklist and the bridge page link — no direct offer/store link in the DM either (bridge-only holds in DMs). This closes the issue filed at C4.

Flow E · Compliance & isolation probes (agent-led)

Persona: the platform reviewer / an adversarial audit. Mike observes and re-runs the UI-only ones. These steps are expected to pass silently — any hit is a content or repo fix before more reels post.

E1AgentBridge-only rule on the live IG: inspect the bio and every caption on both accounts — zero direct affiliate/store links anywhere; every road leads to the bridge page. MikeRe-check from the phone app (the agent sees the logged-out web view; app embeds and stickers can differ).

Expected: no offer/store URL in any bio, caption, comment reply, or story link. Everything routes through the bridge page where the FTC disclosure lives.

E2AgentPublished-content sweep: every posted caption + the bridge pages — no income claims, no guaranteed-prevention claims, every stat sourced (B3's gate held in practice).

Expected: clean. One hit means a reel ships with an unvetted claim — pull or edit the caption the same day and file the process miss.

E3AgentCross-campaign isolation: home-security page/account contains no digital-products content; BDP page/account contains no home-security content; no page links to the other campaign.

Expected: one niche per page/account, zero crossover — the one-offer rule from the kits holds in both directions.

E4AgentPaid-file leak check: search the public superstarsale repo and the live Pages site for the paid deliverable filenames from ~/Repos/superstarsale-products (and for pairtest- strays).

Expected: zero hits — paid files exist only in the private repo; the public site carries the free checklist only. Any hit is a same-session takedown.

E5BothSession cleanliness: the only IG interactions this session are from the throwaway account; the DM inbox shows no real prospects touched; the store shows no test purchases.

Expected: zero real-customer contact, zero test orders to refund. Any PairTest marker on a live surface is listed for cleanup in the checklist below.

Results & issue log

Fill in during the session. "Match" = agent and Mike saw the same behavior. Every ⚠/✖ row needs an issue link.

Step	Agent	Mike	Match	Issue	Notes
A1					home-security page, read-only
A2					BDP page, read-only
A3					served vs source slot counts
A4					phone = the real device
B1					kit section completeness
B2					SAFE / CHECKLIST consistency
B3					claims gate — blocks C3
B4					slot map → feeds D2
C1					Mike-only; agent verifies public
C2					bio link = bridge, never direct
C3					first reel, caption-faithful
C4					expected-fail: no ManyChat yet
D1					DOPPCALL app + Payhip store
D2					slot fill via PR, markers kept
D3					tracked click + dashboard lag
D4					unfilled slots fail closed
D5					ManyChat closes the C4 issue
E1					bridge-only on live IG
E2					claims/stat sweep
E3					one niche per page/account
E4					no paid-file leak
E5					no real prospects touched

Suggested rounds

Round 1: A1–A4, B1–B4 (surfaces + the content machine — cheap, no accounts needed, gates everything after).
Round 2: C1–C4, D1 (go live: account, bio, first reel, trigger test, rail signups).
Round 3: D2–D5, E1–E5 + session cleanup (money leg, then the walls, teardown).

Session cleanup

IG: throwaway account's comments are the record — leave the trigger-word comments on our own reels (they demo the mechanism) but unfollow/clean anything outside our two accounts.
Pages: confirm no unfilled slot is advertised in a live bio (if the network is still pending, the bio stays on the checklist value, not a half-wired page).
Store: no test listings left public — anything PairTest-named gets unpublished.
Commit the results log's final state (PR to headquarters) + agent screenshots under docs/projects/shots/; file any still-open issues from the log; close out in the #instagram-affiliate thread with the round summary.