Phase 0 is committed. Everything below is not built. The steps are ordered by what unblocks what, not by size.
The outreach domain needs two to three weeks of warmup before it can send at full volume. That runs on calendar time and nothing about the code shortens it.
Buy it today and the first real email goes out in early October. Buy it when the code is finished and you add three weeks to the end instead. Everything else can be built and tested against Gmail drafts while it warms.
five questions and one blocker · about 20 minutes of your time
The plan was to unpark this when an SEO client existed. If there isn't one yet I build against a fake test client, which is what the brief's own tests use, and it works fine. If there is one, I need their target URL, their real budget, and their anchor options so the config is real from day one.
A separate domain, not niloagency.com. Cold outreach spends domain reputation and that cost must not land on your client email. inbox-factory already does this job including the traps it documented, so it should come from there rather than being wired by hand.
Paid links are supposed to carry rel="sponsored". Each client signs off in writing on whether we require dofollow, accept sponsored, or take either.
My read: accept sponsored as the default. Brand mentions correlate with AI citations about three times more strongly than links do, so on an AI-visibility client a sponsored in-content mention on a real site still does the job, and it removes the Google exposure entirely.
The config has these going out as you, personally, asking publishers to sell links. Deal Bolt sends as Nate. Confirm this one is you, because the reputation attached to it is yours and the emails sit in the recipient's archive regardless of what happens to the domain.
Your account is over its monthly request cap. It refused a write yesterday when the audit tool tried. Every import and every poll in this service is an Airtable call, so if it's still capped, Phase 1 fails on its first line. Either it resets, the plan changes, or I write to a local file and sync later.
The brief tells me to read backlink-purchasing-research-2026.md twice. It isn't on your machine. Every number it supports is restated in the brief's own notes so I used those, but if the file exists I'd rather work from the sources.
two to three days · nothing sends, everything is a draft
Checks all seven tables exist before writing a single row, then loads your CSV. Rows without DR or traffic, or below the client's floor, come in marked Below Floor and are never contacted. Roughly 85% of sites selling links are below those floors, so this gate is the main thing stopping us buying nothing.
One-time consent you run in a browser, since I can't. It prints a token, I store it, and the service reads and drafts from that mailbox only.
One command produces five emails as Gmail drafts, each carrying your name, address and an opt-out line added by code rather than written by the model. Sends nothing. You read all five and approve the template once.
Every five minutes: read new mail, work out what each reply means, pull out any price or rate sheet, spot the scams, update Airtable, and write a reply draft into the same thread.
Code decides the price, the anchor and the attribute. The model only writes the sentences around them. If a price ever appears inside a prompt, the thing is built wrong.
two days · the first phase where an email can actually leave
Starts at 10 a day, climbs by 5 until it hits your cap. Refuses to go over, in code rather than in a prompt. Won't run at all without an explicit switch set, so it can't send by accident.
Two follow-ups, four days apart, and never after somebody has replied. A no or an unsubscribe suppresses that address and its whole domain permanently. Nothing follows a decline.
Counts what's already agreed for that client and refuses to stack too many identical anchors or too many links in one month. Both are patterns that attract a manual review, and both are computed from live data rather than assumed.
two to three days · this is the part that protects the money
When a publisher says it's live, it fetches the page and checks seven things: the link is there, its anchor text, whether it's dofollow or sponsored, whether it sits in the article body rather than the footer, whether the page can be indexed at all, how many outbound links it's buried among, and the status code.
A link in a footer on a noindexed page among 90 other links is worth nothing. Only a clean pass counts as verified.
Daily for a week, then monthly for a year. If a link vanishes or quietly becomes nofollow, it records exactly what changed and drafts a message quoting the terms you agreed, but only inside the replacement window. Outside it, it records the loss and drafts nothing, because a demand with no basis is worse than silence.
This is what a marketplace's escrow and guarantee do. Written terms plus a year of checking is the version you get from dealing direct.
Nothing goes to Railway before that. And the first live campaign is one client, watched weekly for a month: reply rate, how many drafts you send without editing, agreed price against the ceiling, and how many links are still live at 90 days.
Eight to thirteen placements per thousand contacts. Cold replies run 3 to 8 percent, half of those are viable, a third of those close.
At 30 sends a day that's about seven weeks for one list cycle, and two to five thousand dollars of placements. If that's too slow, the next step is Instantly plus more domains from inbox-factory, not a faster agent.