veripath/docs/operations/owner-onboarding-sop.md

Owner Onboarding SOP — 15-Minute Authority Transfer

Status: Locked v1.0 · 2026-08-16 Applies to: Every VeriPath client, after first audit delivery, before monitoring/remediation loop starts. Operator: VeriPath (Leonard or Tony). Owner is a participant, not a student — she does 2 things: confirms facts, grants access.

The three outcomes (definition of done)

1. Ground truth locked — owner confirms hours + critical facts verbatim; canonical record updated and version-bumped.
2. Minimum access granted — GBP: VeriPath account added as manager, role Edit business info only. Apple: owner claims + verifies her listing via Apple Business Connect (screen-shared) and sets canonical hours. No credentials ever requested.
3. Operating agreement established — owner understands: from today VeriPath monitors all surfaces against the canonical record and fixes drift. She does not check or maintain listings. Every grant is revocable in one click.

If all three are done, the monitoring loop may start. If any is incomplete, log the gap in the receipt and the loop starts in read-only mode for that surface.

---

P0 — Pre-work (before the call, not part of 15 min)

• Latest audit report + findings on hand (Gitea, docs/validation/... or run dir).
• Canonical record current (docs/clients/{client}/canonical-business-record-*.json); draft values ready to read back.
• VeriPath GBP account created/ready to receive the manager invite.
• Call booked, 15 min, screen share available (needed for Apple step).
• Print/pull the owner's exact canonical values (hours per day, phone, address, primary category) so nothing is "looked up" mid-call.

P1 — Frame (0:00–2:00)

Say, roughly verbatim:

"Fifteen minutes, then you're done. Two things: I read you the facts we hold for your business — you tell me where they're wrong, and that's the official record from now on. Then you hand me the keys — Google in about two minutes, Apple in about three, on screen share. After that, if something drifts, that's our problem, not yours. You'll only hear from us when you should." Confirm she has ~15 min and her phone (Apple verification may text/call).

P2 — Lock ground truth (2:00–7:00)

Read back, one at a time, and get a yes/correction:

1. Hours — every day of week, stated as "Monday 9 to 6 … Sunday closed." (This is the field that caused the audit findings; read it slowly.)
2. Phone — the number customers should call.
3. Address — street, suite, city, ZIP.
4. Primary category + top services — what the business is, in her words.
5. Anything seasonal/irregular — holidays, half-day Saturdays, "we close early on Fridays in summer." Capture as notes.

Rules:

• Her correction wins, always. Never argue from scrape data.
• Log each confirmation as spoken: field → confirmed value → timestamp.
• Update the canonical record before moving on (see Update Protocol). If hours changed, the Apple step in P3 uses the new values — not the old ones.

P3 — Grant access (7:00–12:00)

3a. Google Business Profile — manager invite (~2 min, she does it)

She, signed into her own Google account at business.google.com:

1. Select the business (e.g. Phoenix Salon + Spa).
2. Pencil icon → Edit business information (left sidebar) → People and permissions.
3. Add people → type the VeriPath account email (hand it to her, don't make her type it).
4. Role: Edit business info — explicitly not "Manage." Say: "You keep full ownership. I get the smallest key that opens the door I need — edit info only, and you can pull it anytime."
5. Send. VeriPath accepts the invite from the email (or it appears under People and permissions as pending) — operator confirms acceptance on screen if she wants to see it.

Reversibility line (say it): "To revoke: same page, click your account, Remove. One click, no phone call to Google."

3b. Apple — owner claims & verifies (screen share, ~3 min)

We cannot do this for her — Apple gates it on identity. Keep it honest and fast:

1. Screen share. She opens abc.apple.com (Apple Business Connect), signs in with her Apple ID (or creates one — 1 min).
2. Claim a business → search "{Business Name}" → select the listing.
3. Verify ownership — prefer video verification (fastest); phone-call code is the fallback. Postcard = slow path, log as pending.
4. Once claimed, the listing opens in ABC. She sets hours from the canonical values you hand her (read them: "Mon–Fri 9 to 6, Saturday 9 to 6, Sunday closed") — operator watches each field, confirms each day.
5. Done. Say: "That was the one thing only you could do. It's done. Apple Maps will reflect this; if Apple's review lags a day or two, that's Apple, and we'll watch it."

UI labels in ABC drift occasionally — follow the flow, not the exact wording. If the claim fails or the listing isn't found: fallback = Suggest an edit from Apple Maps on her listing (Apple reviews it, takes days) → log as pending, loop runs read-only on Apple until it lands.

P4 — Operating agreement + close (12:00–15:00)

Say, roughly:

"Here's where we are. The record we just locked is the source of truth. We check Google, Apple, Bing, and your website against it on a schedule. When something drifts, we fix it — Google directly, Apple through your listing, website through you or whoever runs it — and you get a short note saying what we found and what we did. You don't check anything. If you ever want out, you remove us from Google in one click and close Apple Business Connect. Nothing here is a trap door." Then:

• Hand her the trust receipt (file, emailed) — what was confirmed, what access was granted, how to revoke each.
• State the first monitoring cycle date.
• Close. No upsell, no tutorial.

---

Update Protocol — canonical record (after P2)

For every owner-confirmed field:

• status: "verified", evidence_tier: "tier_1", verified_at: <now>, fresh_until: <now + 30d>
• sources: append "owner-confirmed YYYY-MM-DD (onboarding)"
• record_version bump (0.1.x → 0.2.0 on first onboarding lock), system.updated_at = now, system.status → "active" when all P2 fields are verified (otherwise stays draft)
• Commit to Gitea Tony_tech/veripath with message: onboarding: owner-confirmed ground truth for {client} ({date})

Trust receipt (evidence of the transfer)

Written to docs/clients/{client}/ops/onboarding-receipt-YYYY-MM-DD.json, committed with the canonical update, and emailed to the owner:

{
  "client_id": "VP-001",
  "date": "YYYY-MM-DDT..Z",
  "operator": "name",
  "confirmed_fields": { "hours": {"monday": "09:00-18:00", "...": "..."}, "phone": "...", "address": "...", "category": "..." },
  "access": {
    "google_business_profile": { "granted_to": "veripath@...com", "role": "edit_business_info", "granted_at": "..." },
    "apple": { "claimed_by": "owner", "verified_via": "video", "hours_set": true }
  },
  "revocation": {
    "google_business_profile": "business.google.com → business → Edit business information → People and permissions → Remove",
    "apple": "abc.apple.com → remove team members / close Apple Business Connect"
  },
  "gaps": [ "apple verification pending — postcard sent" ]
}

Any incomplete outcome must appear in gaps. No silent partial access.

Edge cases

• She is not the GBP owner → stop 3a. Note in gaps. Either the real owner does 3a, or loop runs read-only on Google until it happens. Never work around ownership.
• Apple verification pending (postcard) → log in gaps; set hours as soon as claimed; loop read-only on Apple meanwhile.
• Hours corrected in P2 → canonical updated first; Apple step uses corrected values (P2→P3 order is load-bearing).
• Website JSON-LD drift → not an onboarding item. We don't take website admin by default; route the fix to whoever runs the site (for Phoenix: the redesign owner) and track as a finding.
• Owner pushes back on access → that's a trust conversation, not a checklist. Drop to read-only loop for the withheld surface, log the gap, and do not pressure. The loop still adds value on the surfaces she does grant.

Pattern notes (for the next client)

Everything client-specific is a placeholder: {business}, {client_id}, {veripath_email}, canonical values pulled from that client's record. The only surface-specific branches are the Apple claim (identity-gated, always owner-done) and GBP invite (always owner-done). If a future surface requires a new access type, add a 3c step + a revocation line + a receipt field. Nothing else changes.

Appendix — Phoenix Salon + Spa (first run)

• Canonical values to read back: Mon–Sat 9 AM–6 PM, Sun closed; phone (530) 350-9197; 3460 Robin Ln, Ste 4, Cameron Park, CA 95682; category: beauty salon/spa.
• Known drift to fix in the loop after onboarding: Apple Maps shows 10 AM–6 PM all 7 days incl. Sunday (owner sets correct hours during 3b); website JSON-LD closes at 7 PM Mon–Fri, 5 PM Sat/Sun, open Sunday (route to site owner).
• GBP already clean per 2026-08-16 audit — 3a is grant-only, no data fix.