# Reusable assistant handoff — website analytics on all viewing platforms

Use this with an assistant that has authorized access to your website source, browser and hosting tools. If those tools are not available, the assistant should state the limitation and guide the manual steps. Do not promise automatic account authentication or physical phone verification.

Replace every placeholder before submitting:

```text
Implement and verify Google Analytics 4 for <WEBSITE_URL>, using the existing
project at <PROJECT_FOLDER> and its current GoDaddy deployment process.
Property/stream name: <PROPERTY_NAME>.
Measurement ID, if already created: G-XXXXXXXXXX.
Required viewers: browser, official Analytics Android app, official Analytics iPhone app.
Save owner records to <PRIVATE_RECORD_FOLDER> and a separate redacted tutorial
with placeholders to <PUBLIC_TUTORIAL_FOLDER>.

Inspect first: read applicable project instructions, identify framework/version,
router, build/export process, document root, existing tags and consent controls.
Do not redesign the site or introduce duplicate tags/pageviews. Preserve existing
hosting rules, PHP handlers, media, WordPress data and unrelated behavior.

Create/use one GA4 Web stream for the website. Android and iPhone are viewers;
do not create native app/Firebase streams unless I separately ask to instrument
an actual native app. I will perform account login, MFA and legal acceptance
when required; never ask me to paste passwords/cookies/recovery codes into chat.
Use saved credentials only through authorized tools and without exposing them.

Install the tag at the shared root so future pages inherit it. Prefer the
framework-supported integration; explain any use of next/script instead.
Manage the public Measurement ID through existing environment configuration.
Static exports require rebuilding after public environment changes.

Use exactly one pageview mechanism. If explicit route tracking is required,
disable config-generated and Enhanced Measurement history pageviews. Keep
supported enhanced interactions enabled and document reasons for any exception.
Verify correct current page context on interaction events after SPA navigation.
Preserve Google's actual gtag queue contract. Do not replace protocol-required
behavior merely to satisfy a stylistic preference.

Respect visitor choices and existing privacy controls. Never send form contents,
personal identifiers, credentials or private query parameters to GA4. Use fixed
allowlisted custom-event labels. Distinguish clicks, attempted submits, confirmed
server acceptance and real delivery. Do not invent elements or conversions.

Run actual quality gates without suppressing real errors. Serve and test the
production export. Test no-consent/rejection/revocation, tag count, direct page
load, A-to-B-to-C, back, forward, reload, page titles, correct interaction context,
real CTA behavior, and synthetic privacy fixtures. Keep local traffic out of the
production property. Test form success/failure locally without sending email.
Repair defects at their architectural cause and retain regression coverage.

Prepare the exact deploy artifact and change manifest, preserve a live backup,
and use the existing authorized hosting workflow. Do not expose secrets in
source, logs, screenshots or documentation. Make rollback concrete.

After deployment, generate controlled real traffic and inspect Google tag/network
requests. Then observe page_view and an interaction in GA4 Realtime. Network
requests or a successful build alone are insufficient. Have me open the same
property in Android and iPhone and confirm live activity separately on both.
Mark each unobserved capability honestly, including delayed detailed reports.

Save timestamped evidence, owner configuration, changed files/diff, architecture,
event definitions, build/deploy results, production URL, network/GA4/phone proof,
limitations and rollback steps. The public tutorial must remove my site name,
Measurement ID, account names, host paths, personal data and screenshots with
private information. Use example.com and placeholders instead. Do not publish
a blog post, newsletter or video until I request that publication.

Return overall VERIFIED PASS only when the complete required production and
phone evidence exists. Otherwise return BLOCKED and the exact remaining blocker.
```

## Multi-application domain coverage

Inventory and cover the main domain, blog subdomain, newsletter pages, waitlist and other public applications. One Web stream serves all viewers. React root tracking does not cover separate PHP or WordPress pages. Use shared consent and event logic with the appropriate application adapters. Preserve live WordPress files AND database backups before deploying. Test provider-accepted newsletter events and first-confirmation waitlist events without sending test emails; distinguish accepted, confirmed and delivered. Save and reload Google settings to prove they persisted. Test generic search titles and no private search terms. Record production network and Realtime proof for each application, plus separate Android and iPhone observations.