docs(clone-app): fidelity-pass, logic-capture, backend-recon rubrics

plugins/clone-app/skills/clone-app/references/backend-recon-guide.md

@@ -0,0 +1,32 @@
+# Backend Recon Guide
+
+The APK is the client. Server-side code is NOT in it. `backend-recon.md` INFERS a
+backend design from the observed API contract so a fresh session can rebuild the
+backend — it is a design target, not recovered server code. Every inference is
+confidence-stamped.
+
+## Input
+
+`$WORK/payloads.json` (deepened to full Tier-2 in the fidelity pass) +
+`$WORK/re-digest.md` (hosts, auth model, BuildConfig).
+
+## `backend-recon.md` sections
+
+```
+# Backend Recon — <pkg>
+## Entities         from request/response bodies: each object → table + fields +
+                    inferred types; mark which are observed vs guessed
+## Relationships    foreign keys / nesting inferred from payload shapes
+## Endpoints        per endpoint: method, path, auth, what it reads/writes,
+                    inferred server-side validation and side effects
+## Auth model       token type, header, refresh flow (from auth payloads)
+## Confidence       high = directly observed in payloads; med = inferred from
+                    naming/shape; low = guessed, needs runtime confirmation
+```
+
+## Rules
+
+- Never present an inference as fact. Tag every entity/rule high/med/low.
+- Prefer "observed in `POST /v1/auth/login` response" citations over assertions.
+- Where the contract is silent (e.g. server-only business rules), say
+  "not observable statically — confirm via dynamic analysis (Phase B)".

plugins/clone-app/skills/clone-app/references/fidelity-pass-guide.md

@@ -0,0 +1,41 @@
+# Fidelity Pass Guide
+
+The fidelity pass is the deep-extraction step that runs **only when the user
+proceeds to build a plan at the Phase 7 gate**. There is no mode flag. Phases
+0–6 already produced the feasibility report (`clone-report-<date>.md`); the
+fidelity pass adds a second standalone report (`fidelity-report-<date>.md`) and
+the build spec. The generated implementation plan references **both** reports.
+
+## What it reuses
+
+The fidelity pass does NOT re-download or re-decompile. It reads what Phase 2
+already wrote to `$WORK/output` (sources, resources). It runs inside a Phase 8
+subagent so deep extraction never floods the orchestrator context.
+
+## Steps (Phase 8 subagent)
+
+1. **Full Tier-2 payloads.** Extend `$WORK/payloads.json` so EVERY first-party
+   endpoint carries request/response/headers — not just auth/payment/core.
+   Third-party endpoints stay Tier-1. This overrides the token-cost non-goal in
+   `re-digest-contract.md`, which governs only the Phase 2 feasibility pass.
+2. **In-app logic.** Run `extract-logic.py "$WORK/output" --out "$WORK/logic-signals.json"`,
+   then distill `$WORK/logic-digest.md` per `logic-capture-guide.md`.
+3. **Navigation graph.** Run `extract-nav-graph.py "$WORK/output" --out "$WORK/nav-graph.json"`.
+4. **Backend recon.** Write `$WORK/backend-recon.md` from the contract per
+   `backend-recon-guide.md` (confidence-stamped; a rebuild target, not stolen code).
+5. **Unity (if applicable).** Deepen `$WORK/unity-digest.md` with game
+   mechanics / formulas per `unity-re-guide.md`.
+
+## Outputs
+
+- `$WORK/logic-digest.md`, `$WORK/nav-graph.json`, `$WORK/backend-recon.md`
+- deepened `$WORK/payloads.json`
+- `$WORK/fidelity-report-<date>.md` (standalone)
+- the fidelity build spec (`clone-build-spec-template.md`, fidelity sections)
+
+## Honest limits
+
+Native Kotlin/Java and Unity-mono yield strong logic extraction; Unity-il2cpp is
+medium; Flutter/React Native fall back to a `limited:` digest (Dart/JS are not in
+the Java decompile). Backend server logic is never in the APK — `backend-recon.md`
+infers a design, it does not recover server code.

plugins/clone-app/skills/clone-app/references/logic-capture-guide.md

@@ -0,0 +1,37 @@
+# Logic Capture Guide
+
+How the Phase 8 subagent turns `extract-logic.py`'s JSON signals (plus the
+sources under `$WORK/output`) into `$WORK/logic-digest.md`.
+
+## Input
+
+`extract-logic.py "$WORK/output" --out "$WORK/logic-signals.json"` emits an
+inventory: `viewmodels`, `usecases`, `validation`, `state_enums`,
+`room_entities`, `room_daos`. Use it as the index of where logic lives; open the
+named files to read the actual rules.
+
+## `logic-digest.md` sections
+
+```
+# Logic Digest — <pkg>
+## Workflows        per user flow (onboarding, core loop, payment): the step
+                    sequence, the screen at each step, the trigger to advance
+## Business rules   validation rules, computed values, formulas (from the
+                    ViewModels / use-cases the signals point at)
+## State model      state_enums + sealed classes → the states and transitions
+## Local data       Room entities + DAOs → tables, columns, queries
+## Confidence       per framework (see below)
+```
+
+## Framework-aware confidence
+
+| Framework | Logic recoverable? | Confidence |
+|---|---|---|
+| Native Kotlin/Java (post R8 name recovery) | ViewModels, use-cases, validation read well | high |
+| Jetpack Compose | logic in Kotlin, readable | high |
+| Unity (mono) | C# near-source — mechanics + formulas | high–med |
+| Unity (il2cpp) | type model + partial method bodies | med |
+| Flutter / React Native | Dart/JS not in Java decompile | low — say so |
+
+When confidence is low, record what little is recoverable (manifest, strings,
+SDK list) and lean on screenshots + the API contract.

plugins/clone-app/tests/test-references-content.sh

@@ -21,5 +21,13 @@ has "$R/re-digest-contract.md" "design-tokens.json"
 has "$R/re-digest-contract.md" "unity-digest.md"
 has "$R/report-template.md" "Design System"
 has "$R/report-template.md" "Game Assets"
+has "$R/fidelity-pass-guide.md" "fidelity-report"
+has "$R/fidelity-pass-guide.md" "logic-digest.md"
+has "$R/fidelity-pass-guide.md" "nav-graph.json"
+has "$R/fidelity-pass-guide.md" "backend-recon.md"
+has "$R/logic-capture-guide.md" "extract-logic.py"
+has "$R/logic-capture-guide.md" "confidence"
+has "$R/backend-recon-guide.md" "rebuild"
+has "$R/backend-recon-guide.md" "confidence"
 
 exit $fail