Justin's lead ideas, checked

Conflict to fix: file 12-competitor-apps.md, item 6, suggests an "old-estimate revival (NWR's 52 leads)". That breaks Justin's standing rule to never contact past customers/leads. Strike it. Everything below applies to new inbound people only.

A.1 Prototype built and tested (Python/Flask + plain HTML/JS)

Location on the box: /workspace/window-estimator/

• app/detector.py does zero-shot window/door/garage detection with OWLv2 (google/owlv2-base-patch16-ensemble, Apache-2.0, no training). It then runs NMS, drops glass inside doors and garage doors, and drops huge boxes.
• Scale: the front door's box height is taken as 80 in (a standard 6'8" door), giving pixels per inch.
• Sizing: each window's W×H becomes united inches (UI), mapped to a price tier.
• app/app.py (Flask) serves / (a phone-friendly upload page with capture="environment") and POST /api/estimate (1–6 photos → JSON + annotated images).
• Photos are processed in memory and discarded. EXIF is not kept.
• Smoke test passed: 2 photos → 5 windows, $4,000–7,000 ballpark, 5.5 s + 4.8 s on CPU.
• The price book is a placeholder (≤60 UI $450–750; 61–90 $600–1,000; 91–110 $850–1,400; >110 $1,100–2,200). It must be replaced with HOP/NWR's real price sheet before anyone sees a number.
• A side-by-side test of Grounding DINO tiny (IDEA-Research/grounding-dino-tiny, Apache-2.0) is in gdino_test.py.

Test photos (public Wikimedia Commons; ground truth = my count of window units visible in each photo):

Speed on 8 CPU cores: OWLv2 ~5.4 s per photo, Grounding DINO tiny ~18.5 s per photo. Model cost $0.

What the test shows (plain words):

• Off-the-shelf models find about half the windows. What they find is mostly right. They miss windows behind trees, porch windows, narrow side lites, and anything on sides that weren't photographed.
• Sizing only works when a door is visible and roughly in the same plane as the window, and the boxes include trim. Expect ±15–25% on size, which is fine for a tier and not fine for an order.
• So the product is "ballpark range + you confirm the count", never "a quote".

Make it production-grade (build order):

1. Capture guide. Ask for 4 photos (front, back, left, right), straight on, with the door in frame. Add an optional "tape measure on one window" photo.
2. Confirm step (biggest win, $0). Show numbered boxes. The homeowner taps to remove false ones and taps to add missed ones, then picks a type per window (double-hung, slider, picture, casement, bay). This turns 55% recall into close to 100% on count, and makes the homeowner invested in the result.
3. Ensemble. Union OWLv2 + Grounding DINO (DINO had zero false positives in the test). Optionally add an LLM vision cross-check: "count windows; list ones behind trees".
4. Fine-tune (month 2–3). Train a detector on public facade sets + ~300–500 labeled local photos from HOP/NWR's own job photos. Labeling is ~1–2 min per photo with Roboflow/CVAT smart polygons, so ~10–15 hours. - For window type, add a classifier on each crop (5 classes, ~100 crops per class).
5. Keep the in-home measure as the price-setting step. The photo tool books the measure appointment.

Prototype test images

A.2 Model and dataset options

Datasets:

• CMP Facade: 606 rectified facades with a window class. License is research-oriented and not clearly commercial, so treat it as research/eval only.
• ECP / eTRIMS: research-only, citation required.
• Roboflow Universe "window detection" sets (e.g. one with 778 images): each project shows its own license, often CC BY 4.0. Check each project page and keep a license log.
• Your own job photos are the cleanest commercial training data.

A.3 Imagery and measurement vendors (what's allowed)

A.4 The ad claim "Quote in 60 seconds from a photo"

• FTC: objective claims need a reasonable basis before they run (Advertising Substantiation Policy Statement). The prototype undercounts, so "quote" overstates what it does.
• Google Ads Misrepresentation: no unreliable claims. Unavailable offers: the promised thing must be available on the landing page.
• Use: "Get a ballpark price range from photos in about a minute. Exact price after a free in-home measure."
• Don't use: "Instant quote", "exact price from a photo", or any dollar figure that isn't on the landing page.
• WA contractor ads must show the L&I registration number (RCW 18.27.100; see 01).

Cost per estimate: ~$0 on our own server (CPU), plus ~$0.01 if 4 photos get an LLM cross-check. Hover ($39–139) only after a booked appointment, if at all. Risk: an undercount sets a low anchor. Mitigate with the confirm step, a range, and "photographed sides only". Server note: Justin's hapva-1 server has 2 vCPU / 3.7 GB RAM. OWLv2 (~0.6 GB) would fit but run ~15–20 s per photo and compete with Hapva. Run it as a separate small service, or on a $9–16/mo CX33/CX43 (8–16 GB) when there's traffic.

B.1 The flow (new inbound only)

1. The form (with photos) is submitted with the consent box checked.
2. ≤15 s: a confirmation SMS: "Hi {first}, this is Justin's team at {Company}. Got your photos. Your ballpark is $X–$Y. Want a free measure? Reply with a day or call {number}. Reply STOP to opt out."
3. ~2 min: the AI voice call, only if they checked the call/AI box. It discloses AI, asks 4 questions (how many windows, timeline, owner?, best time), offers 2 slots, and books into the CRM calendar. If they say "human", it hands off to Justin's cell, or texts "Justin will call you by {time}".
4. If no answer: one voicemail-free retry at +1 hr. Calls and texts only 8 AM–8 PM local (RCW 80.36.390 for sales calls). Stop on any "stop" or "don't call".
5. Booking writes to the CRM (Hapva Leads / Jobber / GHL) via webhook. Justin gets a push/SMS.

B.2 Costs (per use)

Latency: aim for under ~1 s voice-to-voice. Groq's time-to-first-token (~0.15–0.95 s in third-party tests) helps. Measure your own round trip before launch; vendor "sub-500 ms" claims are marketing.

B.3 The "80% value drop in 5 minutes" stat: misquoted

• The MIT/InsideSales study measured the odds of contacting a lead: they drop ~5× (≈80%) between minute 5 and minute 10. It did not measure lead value.
• HBR (2011) found responding within an hour gave ~7× better odds of qualifying.
• Use instead: "Leads called within 5 minutes are far more likely to be reached than leads called at 10 minutes." See 09 for sources.

B.4 Legal: what must be in place first

• TCPA + AI voice: the FCC's Feb 2024 Declaratory Ruling (FCC 24-17) holds that AI-generated voices are an "artificial or prerecorded voice". Calls to a cell phone need prior express consent, and prior express written consent if the call is telemarketing (a sales call is).
• The FCC's AI-disclosure NPRM (FCC 24-84) is still a proposal as of Oct 2026. Disclose anyway.
• Statutory damages are $500–1,500 per call.
• WA CEMA (RCW 19.190): commercial texts to WA residents need clear, affirmative consent. Since the June 11, 2026 amendment, there is a private right of action with $100 per text in damages (see 08/09).
• Recording: Washington is all-party consent (RCW 9.73.030). The AI says "This call is recorded" at the start, or don't record.
• One-to-one consent: the FCC's rule requiring one-seller consent was vacated (11th Cir., Jan 2025). That's irrelevant here because Justin's form is first-party. Still, name the specific company.

Consent checkbox wording (unchecked by default, not required to submit; put the form's privacy link next to it):

☐ Yes, {Company Name} may text and call me at the number above about my window project, including automated texts and calls that may use an AI-generated or prerecorded voice. Calls may be recorded. Consent isn't required to buy anything. Msg & data rates may apply; message frequency varies. Reply STOP to opt out, HELP for help. [Privacy] [Terms]

If the box is unchecked: show the ballpark on screen, send nothing, and offer a "call me" button or Justin's number.

AI persona script (short):

"Hi {first}, this is Ava, {Company}'s AI assistant. This call is recorded. You sent photos of your windows a couple minutes ago. Is now OK for two quick questions? … About how many windows are you thinking of replacing? … Any timeline: this fall, spring? … Are you the homeowner? … Great. A free in-home measure takes about 45 minutes. I have {Tue 10 AM} or {Wed 4 PM}. Which works? … You're booked; you'll get a text confirmation. Want me to have Justin call you personally too?"

Knowledge-base guardrails:

• Answer only from the approved FAQ:
• WA energy code: the current 2021 WSEC-R (effective Mar 15, 2024) needs vertical-fenestration U-0.30 in WA (Marine 4/Zone 5) (SBCC). The 2024 codes take effect May 3, 2027 per SBCC, and the residential U-factor is proposed to tighten (search reports 0.27; verify in the final text).
• PSE rebates: $50–100 per window, installed by 12/31/2026 (see 08).
• Never quote a final price, financing terms, or promise rebates.

Verdict: build the SMS now. Add AI voice after the consent box has collected ~2 weeks of opt-ins and Justin has listened to 10 test calls. Risk: high if consent isn't captured and stored (keep the timestamp, IP, page version and checkbox text per lead).

Window lifespan check:

• "Seals fail at 20–25 years" is only partly supported.
• InterNACHI's life-expectancy chart gives double-pane (IGU) units 8–20 years and vinyl frames 20–40.
• NAHB (2007) lists aluminum 15–20 and wood 30+, with no vinyl entry.
• ORNL/IGMA field data: ~1% failure at ~15 years for high-quality certified units; older or cheaper designs fail far more.
• Fair targeting copy: "Homes built before ~2005 often have original windows near the end of their life." Never say "your seals have failed".

Legal limits:

• RCW 42.56.070(8): agencies may not hand out lists of individuals for commercial purposes (AGO 2019 No. 3). Permit records by request are OK, but a request "for a mailing list" can be refused. Use the published open-data portals.
• Channel rules: mail is fine. Do not cold call or text people from permit or assessor data (TCPA, DNC, CEMA). Skip-traced phone numbers are out.
• Ads:
• Google Customer Match only accepts first-party data customers gave you directly; purchased or public lists are not allowed (policy). Permit and assessor lists can't be uploaded.
• Meta customer-list audiences require "all necessary rights and permissions" (terms), so they're also a no for public-record lists.
• Use geo targeting (ZIP/radius around permit clusters) instead. Never build audiences from past customers' data for outreach (Justin's rule).
• Meta Special Ad Category:
• Meta's Housing examples cover sale/rental listings, home insurance, mortgages and appraisal, not home improvement. So window ads normally aren't Housing. This corrects the earlier spec's "always Housing" rule.
• Exception: any ad that mentions financing (0% APR, monthly payments) falls under the Financial products and services category: no age/gender/ZIP targeting, a 15-mile minimum radius, no lookalikes.
• When in doubt, declare the category. Under-declaring gets ads and accounts restricted.

Costs per use:

Pipeline:

1. Weekly cron pulls new roof/siding/remodel permits.
2. Join to assessor data (year built ≤ 2005, owner-occupied).
3. Run the suppression list (past customers/leads, opt-outs, DNC requests).
4. Send to the mail queue with Justin's approval.
5. Mail goes 30–60 days after the permit (exterior work is happening; windows are the next project).

D.1 Review requests

• Allowed and recommended: ask every new completed-job customer, with the GBP review link: the g.page/r/…/review link from Business Profile → Read reviews → Get more reviews, or search.google.com/local/writereview?placeid=… (Google help).
• Send by text only if they gave text consent on the contract or form. Otherwise use email or a printed QR card left at the job.
• Automate it: job marked complete → wait 2 days → one ask → one reminder at 7 days → stop.
• Never send to past customers (Justin's rule) or old leads.
• Not allowed:
• incentives of any kind (Google calls it fake engagement; FTC 16 CFR 465)
• asking only happy customers / "review gating" (Google: no "selectively solicit positive reviews"; FTC Endorsement Guides §255.2(d), Ex. 11)
• suggesting wording. Google's Maps UGC policy says merchants should not "request that specific content be included".
• So: drafting the review from invoice line items ("mention our Milgard double-hung windows in Puyallup") is out.
• OK: "If you're up for it, a quick Google review about how the job went helps a small local business a lot." Plain open-ended prompts like "what was the project?" are lower risk, but don't script keywords.
• Do keywords or location in reviews help ranking? The Sterling Sky (2023) test found no ranking lift from keywords in reviews. Review count, recency and replies matter more (Whitespark factors, see 01). So the keyword-prompt idea risks policy for no gain.
• Cost: ~$0.012 per SMS ask; $0 email.

D.2 Neighborhood / city pages

• Google spam policies: scaled content abuse (many pages generated mainly to rank, "no matter how it's created") and doorway abuse ("multiple … pages targeted at specific regions or cities that funnel users to one page").
• 26 near-clone city pages with GPT-4o-mini filler are the textbook case.
• Build instead: project pages. One page per real completed job, e.g. "11 vinyl windows, 1978 split-level, Sumner (Lake Tapps area)", with:
• real before/after photos, window count, product line, U-factor
• what was hard and how long it took
• customer quote (with written permission)
• permit # if public
• Then a few hub pages (Puyallup, Sumner, South Hill, Bonney Lake) that list the real projects there and local facts: home-age mix from assessor data, PSE/Tacoma Power rebates, permit rules.
• A cheap model (GPT-4o mini $0.15/$0.60 per 1M ≈ $0.001 per draft) may only draft from the job record. A human approves each page, and no hub page goes up without ≥3 real projects.

D.3 Photo EXIF / geotags

• Myth. Sterling Sky's Jan 2024 test found geotagging GBP photos had no ranking impact, and that Google strips EXIF/GPS data on GBP uploads. A later 27-location study (Search Engine Land coverage) found no overall effect.
• Websites: EXIF isn't a known ranking factor, and it leaks customer home locations. Strip EXIF before publishing (the prototype already drops it).
• What helps instead:
• real, frequent photos on GBP via the API
• descriptive filenames and alt text on the site
• project pages with the neighborhood named in text
• correct GBP categories and service areas
• reviews over time
• local links (chamber, sponsors)

D.4 GBP automation via API (verified status)

API access needs a verified profile and a GBP API access request (approval-based). Exact prerequisites not re-verified.

Make.com + Strapi photo-to-project-map pipeline:

1. Job photo uploaded.
2. Make webhook fires.
3. EXIF stripped and a GPS-rounded point (to the neighborhood, not the house) is saved.
4. A Strapi "Project" entry is created as a draft.
5. Justin approves.
6. The site map pin and project page publish; the GBP photo and post go up.

Costs:

• Make Free: 1,000 credits/mo, 2 active scenarios, 15-min minimum schedule, 5 MB files, no time limit (pricing). Webhook triggers don't use credits while idle. Fine for <~100 jobs/mo.
• Make Core: ~$9–12/mo for 10,000 credits.
• Strapi Cloud Essential: ~$18/mo (third-party pricing pages). Strapi self-hosted is $0 on the existing server.
• Cheaper still: do it inside Hapva (Flask) with no Make at all.

The lesson for Justin's platform: own the fast photo-to-ballpark-to-booking loop, keep leads exclusive, price simply, and never resell leads.

Reality check:

• Best published scores are still far from reliable on real admin UIs:
• OpenAI Operator: OSWorld 38.1%, WebArena 58.1%
• Anthropic's newest models: OSWorld 2.0 ~40–42% strict / ~75–78% partial
• Failure modes:
• layout changes; popups/modals
• 2FA and CAPTCHA (agents must stop)
• wrong-account edits; hallucinated "done"
• session timeouts; rate limits; long tasks drifting

Tools and cost per task (10–40 steps):

Benchmarks named by Justin:

• Autoblogging.ai: $19–999/mo, $0.20–0.48 per article credit. Content generation, the same scaled-content risk as D.2.
• Expertise AI: enterprise website chat agents, quote-based (~$2,000/mo Business per a third-party review).
• Kimi browser extension: free. Renamed from WebBridge Sep 22, 2026. Drives your local browser via CDP using your logged-in sessions, so it runs on a desktop, not an iPhone.
• Fellou: agentic browser, $19 / $39.90 / $199.90 per month, ~4 tasks per 1,000 "Sparks". It gets stuck on complex layouts and CAPTCHAs (third-party review).
• "Emplebitot": not found. No product by that name turned up. The closest match, "Emebit", is an unrelated Argentine IT firm. Ask Justin where he saw it.

Safe architecture (recommended):

1. Official APIs/OAuth first. They cover ~80% of setup: - Google OAuth for GBP, Search Console, Analytics and Ads (scoped, revocable) - WordPress Application Passwords: per-app, revocable, used over HTTPS with REST Basic auth; the password is shown once (docs) - Shopify app OAuth with minimal scopes - Meta Business OAuth
2. No raw admin passwords stored by default. If a login truly can't be avoided (some directory sites): - keep secrets in an encrypted vault (HashiCorp Vault or cloud KMS envelope encryption), never in the DB or prompts - run each task in a disposable browser container that is destroyed afterward - Justin types or approves the 2FA code himself, live - per-action approval for any write: preview the change, then "Approve" - full screenshot audit log; scoped least-privilege sub-accounts where the platform allows (e.g. a WordPress "Editor" user, a GBP "Manager")
3. Hard rules: never bypass CAPTCHAs or 2FA, never reuse or export session cookies to get past a login, never use a customer's credentials outside the approved task. If a site says no bots in its ToS, do the task by hand or skip it.
4. Legal: - CFAA: after Van Buren v. US (2021), liability turns on accessing areas you're not authorized to enter ("gates up or down"). Logging in with a client's credentials for the client, within their permission is generally authorized. Exceeding the scope, bypassing access controls, or breaking a platform's ToS still risks contract claims, account bans and state-law claims (hiQ v. LinkedIn ended against hiQ on contract grounds). - Get written client authorization that lists sites and actions. - Liability: an agent's wrong edit on a client's site is your fault. Keep backups and preview diffs.

Build first: a Google OAuth connector (GBP + Search Console) + a WordPress Application Password connector + a "checklist with deep links" for everything else. Add a Browser Use or Agents-API agent later, only for the leftover sites, in approval-per-action mode.

Justin has no computer (iPhone/iPad only), so "local" means a server.

Sources: ollama.com/library/llama3.3, ollama.com/library/phi4, localmodel.run.

Dollar comparison:

• Hetzner GEX44 GPU (RTX 4000 Ada, 20 GB VRAM): ~€184–234/mo + €79–114 setup (Hetzner). Runs Phi-4 well, but 20 GB can't hold Llama 3.3 70B at Q4.
• A 96 GB GPU box (GEX131) is ~€1,197+/mo.
• OpenRouter pay-per-use:
• Llama 3.3 70B: $0.10 / $0.32 per 1M tokens
• Phi-4: $0.07 / $0.14 per 1M (OpenRouter)
• A typical lead-processing call (~3k in / 500 out) ≈ $0.0005 on Llama 3.3 70B. $250/mo of GPU ≈ 500,000 such calls. Justin will make perhaps a few thousand a month.
• Verdict: keep using OpenRouter (Hapva already does, with a cap). Browser Use is open source and works with any OpenRouter/OpenAI-compatible model. Small open models are poor at multi-step browser control, so use a strong model per step only where F says to.
• Revisit local hosting only above ~$150/mo of steady LLM spend, or if a privacy rule requires it.

• Google Maps Platform ToS §3.2.3 & Map Tiles policies — cloud.google.com/maps-platform/terms; developers.google.com/maps/documentation/tile/policies
• Google pricing (Street View, Solar, Aerial View, Map Tiles) — developers.google.com/maps/billing-and-pricing/pricing
• EagleView product price list; EagleView Property Data API v2 docs; Hover pricing page & API docs; Renoworks Pro pricing
• Zillow API Terms of Use; Bridge Interactive data terms
• FCC 24-17 Declaratory Ruling (AI voices = artificial voice); FCC 24-84 NPRM
• RCW 19.190 (CEMA), RCW 9.73.030, RCW 80.36.390, RCW 42.56.070(8), RCW 18.27.100 — app.leg.wa.gov
• FTC 16 CFR Part 465; 16 CFR 255; FTC Advertising Substantiation statement
• Google Maps UGC prohibited content & Fake engagement policy; GBP review link help (support.google.com/business/answer/16816815)
• Google Search spam policies (scaled content abuse, doorway abuse) — developers.google.com/search/docs/essentials/spam-policies
• Sterling Sky: geotagging test (Jan 2024); review keyword test (2023)
• GBP API: Q&A deprecation (Nov 3, 2025); Business Messages shutdown (July 31, 2024)
• Google Ads Misrepresentation & Unavailable offers; Customer Match policy; Meta Custom Audience terms; Meta Special Ad Categories help
• SBCC (2021 WSEC effective Mar 15, 2024; 2024 codes effective May 3, 2027) — sbcc.wa.gov
• InterNACHI life-expectancy chart; NAHB/Bank of America "Study of Life Expectancy of Home Components" (2007); ORNL/IGMA IGU field study
• Bland, Retell, Vapi, Twilio, Groq, OpenRouter pricing pages; Browserbase, Browser Use, Skyvern, Fellou pricing; OpenAI computer-use deprecation notice; Anthropic computer-use docs
• Ollama library pages; Hetzner GEX44; Make.com pricing; WordPress Application Passwords; Van Buren v. US, 593 U.S. 374 (2021)
• Prototype photos: Wikimedia Commons "Split-Level Houses in Gang Mills 01/02/03" (CC BY-SA 4.0), "American Foursquare – Danbury, Connecticut" (CC0), "Puyallup, WA – 315 2nd St NE" (CC BY 3.0). The annotated versions are derivatives under the same licenses.

• Aerial View coverage for Puyallup/Sumner addresses (needs an API key)
• EagleView window/door API price
• Shovels Pierce County coverage
• RealEstateAPI pricing and effective-year fields
• Steel.dev cloud pricing
• exact 2024 WSEC-R U-factor in the final rule
• SAM 3 hands-on test (gated weights)
• GBP API access prerequisites
• An LLM-vision accuracy test (no free vision endpoint without signup)