feat: add conversion-tracking skill (2.12.0), with review edits

[coreyhaines31]

Supersedes #597 and #598. Aaron's original commits are preserved as he wrote them, with authorship, and rebased onto main. Our review edits are separate commits on top.

Status: draft, for Aaron to review before merge.

What this ships

The conversion-tracking skill (1.0.0) from @aaronbeashel. It covers setting up, auditing, verifying, and fixing the path from a website conversion to Google Ads, Meta, GA4, LinkedIn, TikTok, and Microsoft Ads, for both lead gen and ecommerce. It includes 9 references, 22 detection snippets, importable GTM recipes with a builder script, and 21 evals.

It also brings in his Converly integration guide (#598). Analytics, attribution, and ads now point to the new skill, and ads/references/conversion-tracking.md is retired. Release 2.12.0 (a new skill is a y bump).

What we changed in review

Neutrality (Converly is a Verified Partner ◆):

• Removed the Converly capability block from SKILL.md and replaced it with a neutral "check the options before saying no path exists" rule.
• Paid options now come up at the delivery decision or when the loss bears on the question. They're no longer appended, with prices, to every ad-platform answer.
• Restored "when server-side matters less": Google Ads only with Enhanced Conversions on, low volume or a testing phase, and Meta with advanced matching already on. Removed the ban on asking about spend.
• Added free and cheap paths to the lead-gen spectrum: browser identity options, Google tag gateway, Meta CAPI Gateway, and tool webhooks via Zapier or Make.
• The Converly row now matches the other rows in length and tone and lists its tradeoffs. The side-by-side table gained a free-tier row, and Tracklution's lead-gen and iframe coverage is described more fairly. The build-vs-subscription paragraph is now neutral.
• Disclosed Attributer, the contributor's other tool, with alternatives. Added ◆ wherever Converly is named. Self-hosted sGTM is no longer denied an agent path.
• Added five neutrality evals (ids 17–21): a happy Stape user stays put, Typeform → Meta, "best tool?", Google-Ads-only lead gen, and Shopify purchases.

Facts an agent would act on:

• Browser tags can send hashed email and phone (Enhanced Conversions for web, Meta advanced matching, TikTok identify). These are now the free first step everywhere.
• Meta dropped the AEM 8-event cap in May 2023, not late 2023.
• Microsoft has a Conversions API pilot.
• LinkedIn dedup needs a shared eventId.
• Added the Meta CAPI-for-CRM gates, the 14 May 2025 shutdown of the standalone Offline Conversions API, and the 62-day window for physical-store events.
• Google: tROAS needs 15 conversions, tCPA has no hard minimum, and conversion adjustments must happen within 54 days (7 days for bidding).
• Added Shopify's 1 Oct 2026 script-tag change. X has a Conversion API. "Required after iOS 14" became "recommended".
• The undercount is stated as a 10–30% range depending on audience, not a universal 30%. EMQ and consent-enforcement figures are labeled as practitioner-reported.

Snippets and recipes:

• Jotform fires on its submission-completed message, not on submit.
• 10 GTM recipes had drifted from their snippets and are regenerated. One of them (Contact Form 7) would have printed its JavaScript onto the page as text. New scripts/check_recipes.py keeps recipes and snippets in sync.
• build_recipe.py validates every ID and substitutes values safely, so a crafted ID can no longer inject JSON or JavaScript. It runs on Python 3.8+.
• Every send tag now requires consent, with a Consent and privacy section in the recipes README.
• Also: the Typeform auto-close false signal is gone, the Elementor jQuery check is tightened, a PII note is on the phone-click snippet, each snippet's success-signal type is documented, and the README explains how to add value and currency for Google Ads.

Repo fit:

• Operative rules are now in the description.
• Added a revops boundary.
• Removed cross-skill relative links, which break on per-skill installs; the audit scoring rules are now inline.
• Restored two checks lost from the retired ads reference: in-app webviews and hardcoded test values.
• ads/SKILL.md is under 500 lines. Analytics lists conversion-tracking.

Integration guide (#598): added a holdout caveat next to the platform stats, removed framing, and aligned the partner blurb (sync-partners).

Checks

• check-versions.mjs --base origin/main: pass (51 skills, 2.12.0).
• check_recipes.py: 22/22 recipes match their snippets.
• All 30 JSON files parse. All 22 snippets pass node --check.
• All 132 tool × destination builds succeed, and injection inputs are rejected.
• Three Codex passes plus four specialist reviews (integrity, technical, facts, repo fit).

For Aaron to confirm

• Whether Converly's Microsoft Ads delivery uses the new CAPI or offline upload.
• ChatGPT Ads and the oppref click ID in the guide.
• The TikTok pixel ID format the builder accepts (10–30 uppercase alphanumerics).
• A test import of one recipe into GTM to confirm the consent-settings shape.
• That the Jotform submission-completed signal matches what Converly sees in production.

🤖 Generated with Claude Code

Version note: #654 (Ploy) also bumps ads to 2.4.2. Whichever PR merges second moves ads to 2.4.3.