# Kibble installation contract: section 5 of 29 (guide version 3)

> This is **one section only**, not the whole contract. Complete document: https://www.usekibble.dev/AI/guide.md

## 5. Inspect the site first {#inspect}

Read the code before you write any. Every answer below goes into your plan and the [installation report](https://www.usekibble.dev/AI#report). Where you cannot find an answer, write "unknown" and ask; do not assume.

| Look at | You need to know | Why it matters |
| --- | --- | --- |
| Framework, rendering and routing | Static HTML, server-rendered, Next.js App/Pages Router, another SPA framework; history or hash routing; the shared layout every page uses | One installation in the shared layout. History navigation is tracked automatically; hash routes are not. |
| Existing Kibble or analytics code | Any existing `kibble.js` snippet, `window.kibble` calls, GTM container with a Kibble tag, GA4 dataLayer pushes | Update an existing install in place. Never install twice (code and GTM). Reuse genuine dataLayer events instead of adding parallel calls. |
| Consent | The banner or consent platform, the category that means analytics, how the choice is stored, whether Google Consent Mode is already used | Kibble must follow the actual analytics grant. No grant, no data. Never bypass or pre-grant. |
| Forms | Each real form, how it submits (native, fetch, redirect, third-party widget), where the server reports success, and the field that proves it | `formAccepted` belongs only in the accepted branch. An attempted submission is never a conversion. |
| Site search | Whether the site has a genuine search UI, where results are rendered, and whether the real result count is known | Search is reported only for a real search. Unknown counts stay unknown; a missing payload is never zero results. |
| Booking | Booking widget forms and their business-id fields; links, redirects or SSO to a booking engine; whether the engine can push dataLayer events or run code | Criteria come from marked fields at submit; availability only from the engine; cross-domain only through website hosts and external connections registered on the property. |
| eCommerce and vendors | Platform (Shopify, BigCommerce, other), checkout host, the event that proves an order | Purchases are confirmed only with an order or booking reference. A hotel engine’s GA4 purchase is reported as a purchase; do not rename it in code. |
| Business entities | The authoritative source of hotels, destinations, rooms or products and their ids as the site sends them (CMS, config file, booking select, product feed) | The [site manifest](https://www.usekibble.dev/AI#site-catalog) is generated from that source, never guessed. |
| CSP, proxies and hosts | Content-Security-Policy `script-src`/`connect-src`, any existing first-party proxy, every host that will run the snippet (with ports in development) | A strict CSP needs the collector origin or a [first-party gateway](https://www.usekibble.dev/AI#gateways). Every host must be registered on the property. |

> **Note:** GTM-only or CMS-only work (no repository): inspect the public page source and the container the person shows you, mark findings as observed, and keep everything you could not confirm as "unverified".

END OF SECTION inspect