Build pillar · attribution-ops agent
How to build multi-vendor receipt joining + offline attribution end-to-end
Stripe + Shopify + WooCommerce + Magento + Square + Toast + Clover + Lightspeed + Aloha POS + Meta Offline Events + Google Offline Conversions + TikTok Offline Events + LinkedIn Offline Conversions + LiveRamp + Salesforce Data Cloud + Adobe RT-CDP ship per-tenant flat receipt + offline-attribution primitives. The Join + Resolve + Attribute + Audit skill bundle on the attribution-ops agent sits above the POS + offline-conversion + identity-graph + CDP + causal-inference substrate and writes a per-receipt + per-attribution canonical record with named regulatory anchors covering Apple ATT iOS 14.5 + Google Privacy Sandbox + per-platform CAPI + per-platform offline-conversion + per-PII hashing + GDPR Article 22 + ECOA Reg B + replication- crisis discipline + EU AI Act Article 22 + SOX 302/404/906 + PCI DSS v4.0 Requirement 3.4.1 + 12.10.
Published December 5, 2026 · 3,200 words
The 4-skill bundle on the attribution-ops agent
One agent. Four coordinated skills. The Join + Resolve + Attribute + Audit bundle runs above the POS + offline- conversion + identity-graph + CDP + causal-inference substrate and writes one canonical per-receipt + per-attribution record.
Join
Per-receipt extraction from Stripe + Shopify + WooCommerce + Magento + Square + Toast + Clover + Lightspeed + Aloha + NCR POS. Per-receipt: transaction + timestamp + amount + line-item + payment-method + PII (email + phone + name + address) + loyalty-ID + anonymous-session-ID. Per-PII hashing (SHA-256 + bcrypt + Argon2 + scrypt + per-platform Identity Match) before upload.
Resolve
Cross-vendor identity-resolution via LiveRamp + Salesforce Data Cloud + Adobe RT-CDP + Twilio Segment + Treasure Data + mParticle + Tealium + RudderStack + Segment Personas + Lytics + Acxiom + Experian + Epsilon + Truthset. Per- vendor identity-match rate attestation (Meta hash-matching + Google Customer Match + TikTok Identity + LinkedIn Matched Audiences + Snapchat Audience Match). Per-receipt cross-channel attribution graph.
Attribute
Per-receipt attribution via PyMC + Stan + NumPyro + bambi Bayesian + CausalML + DoubleML + EconML + Synth + CausalImpact + GeoLift + Differences + Matching + propensity- score + RDD. Method selection (time-decay + position-based + linear + first/last-touch + data-driven). Replication- crisis discipline: power-analysis + pre-registration + Bonferroni + BH FDR + Storey + Rosenbaum + E-value + Brier + ECE.
Audit
Per-receipt + per-attribution WORM record: POS source + PII hash + identity-match attestation + per-platform CAPI + offline-conversion upload + causal-inference method + calibration + pre-registration + multiple-comparisons + Rosenbaum + E-value + per-anchor gate-pass + AI-ML attribution + ECOA retrospective + FRIA. Retention: 7-year FTC + 7-year IRS Section 263 + 7-year SOX + 6-year SEC + 3-year FINRA + 4-year ECOA + 7-year PCI DSS + GDPR Article 30 + EU AI Act Article 12 + SOC 2 CC7/CC8.
The real ecosystem this sits above
Join + Resolve + Attribute + Audit does not replace the POS vendors, offline-conversion APIs, identity-graph platforms, or MMPs. It sits above them and writes one canonical per-receipt + per-attribution record under replication-crisis discipline.
Commerce + POS substrate
- Stripe + Shopify + WooCommerce + Magento + BigCommerce
- Square + Toast + Clover + Lightspeed + Aloha + NCR POS
- Stripe Terminal + Square Terminal + Shopify POS
- Meta Offline Events + Google Offline Conversions
- TikTok + Pinterest + LinkedIn + Snapchat + Microsoft Ads
Identity-graph + CDP + MMP
- LiveRamp + Salesforce Data Cloud + Adobe RT-CDP
- Twilio Segment + Treasure Data + mParticle + Tealium
- RudderStack + Segment Personas + Lytics + Iterable
- Acxiom + Experian + Epsilon Abacus + Truthset
- AppsFlyer + Adjust + Branch + Singular + Kochava MMP
Causal-inference + warehouse
- PyMC + Stan + NumPyro + bambi + brms Bayesian
- CausalML + DoubleML + EconML + Synth + CausalImpact
- GeoLift + Differences + Matching + propensity + RDD
- Snowflake + BigQuery + Databricks + Iceberg + Hudi
- Bonferroni + BH FDR + Brier + ECE + Rosenbaum + COS
Compliance overlay
Five anchors run per-receipt + per-attribution before any commit. The first anchor is operationally distinctive: post- iOS-14.5 attribution collapse + per-platform offline-conversion ingestion + per-PII hashing intersect per-vendor identity-match rate attestation.
Anchor 1: Apple ATT + per-platform CAPI + offline- conversion + per-PII hashing (operationally distinctive)
Apple App Tracking Transparency iOS 14.5 IDFA + Apple App Store Review Guidelines + Google Play Developer Policy + Google Privacy Sandbox. Per-platform Conversions API server-side measurement (Meta CAPI + Google Enhanced Conversions + TikTok Events API + Pinterest CAPI + LinkedIn CAPI + Snapchat CAPI). Per-platform offline- conversion ingestion (Meta Offline Events + Google Ads Offline Conversions + TikTok Offline Events + Pinterest Conversions + LinkedIn Offline Conversions + Snapchat Conversions + Microsoft Ads Offline Conversions). Per-PII hashing (SHA-256 + bcrypt + Argon2 + scrypt + Identity Match per-platform). Per-vendor identity-match rate attestation (Meta hash-matching + Google Customer Match + TikTok Identity + LinkedIn Matched Audiences + Snapchat Audience Match).
Anchor 2: GDPR Article 22 + privacy + biometric
GDPR Article 6 lawful basis + Article 7 consent + Article 22 right not to be subject to automated decision + Article 28 data processor + Article 30 records + Article 32 security + Article 33 72-hour breach + EU-US Data Privacy Framework + SCCs + UK IDTA + Swiss-US DPF. CCPA + CPRA + 18-state + LGPD + DPDP + PIPEDA + Quebec Law 25 + COPPA + Washington MHMDA + Texas SCOPE + state biometric + Illinois BIPA + Texas CUBI + Washington biometric.
Anchor 3: ECOA + replication-crisis discipline
ECOA Reg B 12 CFR 1002 disparate-impact when attribution drives credit/insurance/employment + 4/5ths rule + Title VII + ADA + Fair Housing + EEOC AI Guidance 2024 + NYC Local Law 144 AEDT + FCRA Section 604/615 + GLBA + CFPB Circular 2022-03. Replication-crisis discipline (Ioannidis 2005 + Open Science Collaboration 2015) + Bonferroni + BH FDR + Holm + Storey + Rosenbaum + E-value + ASA p-value 2016/2019 + Brier + ECE.
Anchor 4: EU AI Act Article 22 + DSA + DMA
EU AI Act Article 22 + Article 26 + Article 50 + Article 13/14/15 + Annex III when AI-ML attribution drives consumer-impacting decisions + Article 6/27 FRIA. DSA Article 26 advertising transparency + Article 28 minor + Article 30 + DMA.
Anchor 5: SOX + PCI DSS v4.0 + WORM retention
Sarbanes-Oxley 302/404/906 when public-company attribution material to financial reporting + COSO + Exchange Act 13(b)(2) + FASB ASC 606 revenue recognition + ASC 350 + IRC Section 263 capitalization vs Section 174 R&D + SEC Reg S-K Item 303 + SEC Form 10-K + Auditing Standard 2201 + PCAOB AS 2410. PCI DSS v4.0 Requirement 3.4.1 + 12.10 when payment-card data. FTC Endorsement Guides + Fake Review Rule + Section 5 + Pfizer 1972 + MARS + CFPB UDAAP + state UDTPA + Lanham. NIST AI RMF + ISO 42001 + ISO 27001 + ISO 27701 + SOC 2 Type II. Per-vendor LLM zero- retention + per-source DPA. Storage: AWS S3 Object Lock + Azure Blob immutable + GCS + Wasabi WORM. Retention: 7-year FTC + 7-year IRS Section 263 + 7-year SOX + 6-year SEC + 3-year FINRA + 4-year ECOA + 7-year PCI DSS + GDPR Article 30 + EU AI Act Article 12 + SOC 2 CC7/CC8.
6-workstream reporting cycle
Every two weeks during a Tier 3 Fractional CMO engagement, six workstreams report against the pre-engagement baseline. No forecast accuracy claims. Process commitments only.
- 1. Per-portfolio POS + offline-conversion coverage. POS vendors + per-platform CAPI + ATT + Google PS attestation + offline-conversion ingestion.
- 2. Join receipt-extraction flow. Per-receipt volume + per-PII hashing + per-platform Identity Match + per-vendor identity-match rate.
- 3. Resolve cross-vendor identity-resolution. LiveRamp + Data Cloud + RT-CDP + Treasure Data + identity- graph attestation.
- 4. Attribute causal-inference flow. Bayesian + CausalML + DoubleML + EconML + Synth + CausalImpact + GeoLift + RDD + pre-registration + Bonferroni + BH FDR + Brier + ECE + Rosenbaum.
- 5. Regulatory-defense audit coverage. Apple ATT + per-platform CAPI + offline-conversion + per-PII hashing + GDPR Article 22 + ECOA + EU AI Act + replication- crisis + SOX + PCI DSS v4.0.
- 6. FBC feedback-loop pattern-learning. Per-receipt realized-vs-predicted attribution + per-platform match-rate reconciliation + per-vertical pattern shifts.
FAQ
- What is multi-vendor receipt joining + offline attribution end-to-end — and what is the post-iOS-14.5-attribution-collapse-times-PII-hashing problem distinctive to this skill?
- A DTC ecommerce + multi-location operator processes per-receipt transactions across Stripe + Shopify + WooCommerce + Magento + Square + Toast + Clover + Lightspeed + Aloha POS. Each receipt needs to be joined back to the upstream paid acquisition signal (Meta + TikTok + Snapchat + Pinterest + LinkedIn + YouTube + Google Ads + Microsoft + Apple Search Ads) and the upstream organic / direct / email / SMS signal. The four-skill bundle on the attribution-ops agent — Join, Resolve, Attribute, Audit — sits above the POS + offline-conversion + identity-graph + CDP + causal-inference substrate and writes a per-receipt + per-attribution canonical record. The operationally distinctive anchor: Apple App Tracking Transparency iOS 14.5 IDFA + Google Privacy Sandbox have collapsed deterministic attribution. Per-platform offline-conversion ingestion (Meta Offline Events + Google Ads Offline Conversions + TikTok Offline Events + Pinterest CAPI + LinkedIn Offline Conversions + Snapchat CAPI + Microsoft Ads Offline) requires per-PII hashing (SHA-256 + bcrypt + Argon2 + scrypt + Identity Match per-platform) before upload. Per-platform identity-match rate attestation. Plus replication-crisis discipline (Brier + ECE + Rosenbaum + Bonferroni + BH FDR + Holm + Storey + pre-registration + ASA p-value statement) + GDPR Article 22 + ECOA disparate-impact when attribution drives credit/insurance/employment decision + EU AI Act Article 22 + Annex III + SOX 302/404/906 + PCI DSS v4.0 Requirement 3.4.1 + 12.10 when payment-card data.
- Why do Stripe + Shopify + Square + LiveRamp + Salesforce Data Cloud + Funnel.io + AppsFlyer + Adjust break at multi-vendor receipt-joining-with-offline-attribution scale post-iOS-14.5?
- Each commerce vendor ships per-tenant flat receipt + transaction primitives. Each identity vendor ships flat identity graph. Each offline-conversion API ships flat upload. Each MMP ships flat attribution. None coordinates per-receipt cross-vendor identity-resolution with per-PII hashing (SHA-256 + bcrypt + Argon2 + scrypt + Identity Match per-platform) + per-vendor identity-match rate attestation. None implements causal-inference rigor (PyMC + Stan + NumPyro + bambi Bayesian + CausalML + DoubleML + EconML + Synth + CausalImpact + GeoLift + propensity-score + RDD) with replication-crisis discipline (Brier + ECE + Rosenbaum + Bonferroni + BH FDR + Holm + Storey + pre-registration). None gates per-attribution against Apple ATT iOS 14.5 + Google Privacy Sandbox + per-platform CAPI + per-platform offline-conversion attestation + GDPR Article 22 + ECOA Reg B disparate-impact + EU AI Act Article 22 + SOX + PCI DSS v4.0. None writes a per-receipt + per-attribution audit trail with regulatory-defense retention. The four-skill bundle Join + Resolve + Attribute + Audit sits above the commerce + offline-conversion + identity + CDP + causal-inference substrate — it does not replace it.
- How does Join + Resolve work across multi-vendor receipt + post-iOS-14.5 identity-resolution?
- Join runs per-portfolio per-banner per-location per-receipt extraction from Stripe + Shopify + WooCommerce + Magento + BigCommerce + Square + Toast + Clover + Lightspeed + Aloha + NCR POS + Stripe Terminal + Square Terminal + Shopify POS. Per-receipt: transaction ID + timestamp + amount + per-line-item + per-payment-method + per-tender + customer PII (email + phone + name + address) when available + per-loyalty-ID + per-anonymous-session-ID. Per-receipt PII hashing (SHA-256 + bcrypt + Argon2 + scrypt + per-platform Identity Match algorithm) before any upload to per-platform offline-conversion ingestion (Meta Offline Events + Google Ads Offline Conversions + TikTok Offline Events + Pinterest Conversions API + LinkedIn Offline Conversions + Snapchat Conversions API + Microsoft Ads Offline Conversions). Resolve runs per-portfolio cross-vendor identity-resolution via LiveRamp + Salesforce Data Cloud + Adobe Real-Time CDP + Twilio Segment + Treasure Data + mParticle + Tealium + RudderStack + Segment Personas + Lytics + Iterable Persistence Layer + Acxiom + Experian + Epsilon Abacus + Truthset identity graph. Per-vendor identity-match rate attestation (Meta hash-matching + Google Customer Match + TikTok Identity Resolution + LinkedIn Matched Audiences + Snapchat Audience Match). Per-receipt cross-channel attribution graph: upstream paid acquisition + organic + direct + email + SMS + push + in-app + display + voice + offline.
- What does Attribute + Audit do?
- Attribute runs per-portfolio per-receipt attribution through causal-inference rigor: PyMC + Stan + NumPyro + bambi + brms Bayesian + CausalML + DoubleML + EconML + Synth + CausalImpact + GeoLift + Differences + Matching + propensity-score + regression-discontinuity-design. Per-receipt attribution method selection: time-decay + position-based + linear + first-touch + last-touch + data-driven + custom. Per-attribution replication-crisis discipline: per-test power-analysis + per-test minimum-detectable-effect + per-test pre-registration of analysis plan per Center for Open Science + AsPredicted + protocols.io + OSF + per-test-family multiple-comparisons correction (Bonferroni + BH FDR + Benjamini-Yekutieli + Holm-Bonferroni + Hochberg + Sidak + Storey q-value) + Rosenbaum bounds + E-value + ASA statement on p-values 2016/2019 + Brier + ECE + reliability + isotonic + Platt + Beta calibration. Per-platform Conversions API match-rate attestation. Gate runs 5 anchors per-receipt + per-attribution before any commit. (1) Apple ATT iOS 14.5 + Google Privacy Sandbox + per-platform CAPI + per-platform offline-conversion + per-PII hashing + per-vendor identity-match rate attestation. (2) GDPR Article 6/7/22/28/30 + EU-US DPF + SCCs + UK IDTA + CCPA + CPRA + 18-state + LGPD + DPDP + PIPEDA + Quebec Law 25 + COPPA + Washington MHMDA + Texas SCOPE + state biometric + Illinois BIPA + Texas CUBI + Washington biometric. (3) ECOA Reg B 12 CFR 1002 disparate-impact when attribution drives credit/insurance/employment + 4/5ths rule + Title VII + ADA + Fair Housing + EEOC AI Guidance 2024 + NYC Local Law 144 AEDT + FCRA Section 604/615 + GLBA Safeguards Rule + CFPB Circular 2022-03. (4) Replication-crisis discipline + EU AI Act Article 22 + Article 26 + Article 50 + Article 13/14/15 + Annex III + Article 6/27 FRIA + DSA Article 26 + Article 28 + Article 30 + DMA. (5) SOX 302/404/906 when public-company + COSO + Exchange Act 13(b)(2) + FASB ASC 606 revenue recognition + ASC 350 + IRC Section 263 + SEC Reg S-K + SEC Form 10-K + FTC Endorsement Guides + Fake Review Rule + Section 5 + Pfizer 1972 + MARS + CFPB UDAAP + state UDTPA + Lanham + PCI DSS v4.0 Requirement 3.4.1 + 12.10 when payment-card data. Audit writes a per-receipt + per-attribution WORM canonical record: per-receipt POS source + per-PII hash + per-vendor identity-match attestation + per-platform CAPI attestation + per-platform offline-conversion upload + causal-inference method + calibration metrics + per-test pre-registration + multiple-comparisons applied + Rosenbaum + E-value + per-anchor gate-pass + AI-ML attribution decision + ECOA retrospective + FRIA. Storage: AWS S3 Object Lock + Azure Blob immutable + GCS + Wasabi WORM. Retention: 7-year FTC + 7-year IRS Section 263 + 7-year SOX + 6-year SEC + 3-year FINRA + 4-year ECOA + 7-year PCI DSS + GDPR Article 30 + EU AI Act Article 12 + SOC 2 CC7/CC8.
- What does this skill connect to on the attribution-ops agent and across the swarm?
- On the attribution-ops agent: marketing-mix-modeling + attribution-analysis + customer-journey-tracking (parent commercial pillars) + per-location cross-channel attribution rollup for franchise reporting (sibling build-pillar) + root-cause attribution sketch for multi-location KPI diagnosis (sibling build-pillar). Across the swarm: per-location creative fatigue detection (#581 same post-iOS-14.5 + per-platform CAPI substrate) + buyer-state-aware BANT scoring (#568 same ECOA + EU AI Act Article 22 + replication-crisis substrate) + false-positive suppression (#574 same replication-crisis substrate) + multi-stream severity routing (#578 same SEC 8-K + PCI DSS substrate) + versioned customer history for multi-location DSAR (#584 same GDPR + identity-resolution substrate). Build-pillar siblings: tiered pre-filter deterministic gates for AI content compliance + marketing AI autonomy profile configuration + per-vertical compliance overlay. Commercial-pillar parent: /attribution-analysis.
- What does the 6-workstream pre-engagement-baseline reporting cycle look like for this skill?
- Every two weeks during the Tier 3 Fractional CMO with AI Swarm engagement, six workstreams report against the pre-engagement baseline. Workstream 1: per-portfolio POS + offline-conversion coverage — POS vendors enrolled + per-platform CAPI + Apple ATT + Google PS attestation + per-platform offline-conversion ingestion. Workstream 2: Join receipt-extraction flow — per-receipt volume + per-PII hashing coverage + per-platform Identity Match upload + per-vendor identity-match rate. Workstream 3: Resolve cross-vendor identity-resolution — LiveRamp + Salesforce Data Cloud + Adobe RT-CDP + Treasure Data + identity-graph attestation + per-vendor identity-match rate. Workstream 4: Attribute causal-inference flow — Bayesian + CausalML + DoubleML + EconML + Synth + CausalImpact + GeoLift + RDD applied + per-test pre-registration + Bonferroni + BH FDR + Brier + ECE + Rosenbaum + E-value. Workstream 5: Regulatory-defense audit coverage — Apple ATT + per-platform CAPI + offline-conversion + per-PII hashing + GDPR Article 22 + ECOA + EU AI Act Article 22 + replication-crisis + SOX + PCI DSS v4.0. Workstream 6: FBC feedback-loop pattern-learning — per-receipt realized-vs-predicted attribution + per-platform match-rate reconciliation + per-vertical pattern shifts.
Engage Completions
Two ways to engage. The Tier 1 AI Readiness Assessment maps the POS + offline-conversion + identity-graph + CDP + causal- inference substrate against the Join + Resolve + Attribute + Audit bundle. The Tier 3 Fractional CMO with AI Swarm embeds 1-2 days per week for 6+ months and runs the bundle end-to-end against the attribution-ops agent across the swarm.
Related reading
- Parent commercial pillar: attribution analysis
- Sibling build-pillar: per-location creative fatigue detection (#581 same post-iOS-14.5 substrate)
- Sibling build-pillar: false-positive suppression (#574 same replication-crisis substrate)
- Sibling build-pillar: versioned customer history for DSAR (#584 same GDPR + identity-resolution substrate)
- Fractional CMO with AI Swarm
- AI Readiness Assessment