Cross-link GBP intake template, execution card, and HTML form in Audit Playbook

docs/agents/audit-playbook-v1.md

@@ -9,6 +9,11 @@
 - `docs/architecture/path-to-poc-sequencing.md`
 - Templates in `docs/templates/`
 
+**GBP-specific tooling:**
+- Intake template: `docs/templates/gbp-snapshot-intake.md`
+- Leonard execution card (minimal reasoning): `docs/agents/leonard-gbp-execution-card.md`
+- HTML form (fill → copy/paste to Leonard): `tools/gbp-snapshot-form.html`
+
 ---
 
 ## Non-Negotiables
@@ -28,7 +33,7 @@
 **Goal:** Record what exists, where it lives, and verification status. Nothing else.
 
 ### Required sources (minimum)
-- Google Business Profile (or clear statement that it is missing/unclear)
+- Google Business Profile / GBP (or clear statement that it is missing/unclear)
 - Website
 - Primary social channel(s)
 - Booking / scheduling system (or explicit “not visible”)
@@ -47,6 +52,7 @@
 - Do not claim “owner access” unless it is confirmed in the current process.
 - Missing sources are documented as gaps, not ignored.
 - Technical findings (404s, schema, NAP conflicts, etc.) require a dated snapshot. Old findings must be marked for re-verification.
+- **GBP without owner access:** use human snapshot via `tools/gbp-snapshot-form.html` (or markdown intake). Leonard maps via the execution card only — no free-form GBP reasoning.
 
 ### Exit criteria (human must confirm)
 - [ ] All accessible sources recorded
@@ -79,6 +85,7 @@
 - Competitor comparisons are secondary context only, never the primary claim.
 - If data is stale, say so in Data Recency or Notes.
 - No recommendations, fixes, or next actions.
+- **GBP-related threats:** only create/update via execution-card trigger rules R1–R3 when ingesting a GBP snapshot.
 
 ### Severity guidance (use conservatively)
 - **Critical:** Directly blocks or severely impairs local discovery / conversion and evidence is clear.
@@ -105,6 +112,12 @@ When unsure, choose the lower severity.
 5. Surface blockers and stale data explicitly.
 6. Stop at the human review gate. Do not self-lock.
 
+### GBP cold-audit pattern
+1. Human fills `tools/gbp-snapshot-form.html` (or markdown intake).
+2. Human pastes output to Leonard with: follow `docs/agents/leonard-gbp-execution-card.md` exactly.
+3. Leonard maps fields and fires only R1–R3.
+4. Human reviews; Director may score against the rubric below.
+
 ---
 
 ## Training / Evaluation Rubric (simple)
@@ -128,7 +141,7 @@ Score a Leonard (or any agent) run 0–2 on each:
 
 - Client: Overcome Fitness
 - Files: `docs/clients/overcome-fitness/data-inventory-v1.md` and `threat-register-v1.md`
-- Status: Draft (Benchmark) — not yet Locked; freshness gaps remain
+- Status: Draft (Benchmark) — not yet Locked; GBP completeness still open
 
 Future Leonard runs should be compared against this package and scored with the rubric above.