@se-studio/skills 1.5.7 → 1.5.10

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @se-studio/skills
 
+## 1.5.10
+
+### Patch Changes
+
+- Document lockfile sync enforcement (scripts, CI snippet, deps-update and smoke-test skill updates).
+- 2359f69: Add `site-workflows-stale-files-cleanup` skill and `references/stale-files-cleanup/` for repository hygiene audits on SE Studio marketing sites.
+
+## 1.5.8
+
+### Patch Changes
+
+- Add `site-workflows-stale-files-cleanup` skill and `references/stale-files-cleanup/` (checklist, false positives, monorepo/single-app layouts, Brightline case study) for repository hygiene audits on SE Studio marketing sites.
+
 ## 1.5.7
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.5.7",
+  "version": "1.5.10",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/projects.registry.json

@@ -13,13 +13,7 @@
       "branch": "dev",
       "type": "core",
       "validate": "pnpm validate",
-      "exampleApps": [
-        "example-om1",
-        "example-se2026",
-        "example-brightline",
-        "example-brightlifekids",
-        "example-empty"
-      ]
+      "exampleApps": ["example-empty", "cms-edit-host"]
     },
     {
       "key": "se2026",

package/references/contentful-cms-cms-guidelines/README.md

@@ -70,7 +70,7 @@ Invoke the skill with:
 **Example: merge only**
 
 ```bash
-cms-merge-guidelines --app-dir apps/example-om1
+cms-merge-guidelines --app-dir apps/example-empty
 ```
 
 ---

package/references/contentful-cms-cms-guidelines/variant-loop.md

@@ -51,7 +51,7 @@ or manually follow the steps below.
 ## Cursor agent task
 
 **Assign this task to a Cursor subagent.** Provide:
-- `apps/example-brightline/src/project/components/<TypeName>.tsx` (component source)
+- `<app-dir>/src/project/components/<TypeName>.tsx` (e.g. `apps/example-empty` or a customer app path)
 - `generated/cms-discovery/field-list.json` (field metadata including enum values)
 - `generated/cms-discovery/theme-context.md` (palette + typography — authoritative colour names)
 - `scripts/guidelines/variant-proposal-prompt.md` (variant proposal instructions)
@@ -121,7 +121,7 @@ Example for Hero:
 ### 2 — Capture screenshots
 
 ```bash
-# From apps/example-brightline
+# From the target app directory (e.g. apps/example-empty)
 node scripts/guidelines/capture-screenshots.mjs --variants /tmp/hero-variants.json
 ```
 

package/references/lockfile-sync/README.md

@@ -0,0 +1,54 @@
+# Lockfile sync enforcement
+
+Keep `pnpm-lock.yaml` aligned with every `package.json` and `pnpm-workspace.yaml` change.
+
+## Layers
+
+| Layer | What it catches |
+|-------|-----------------|
+| **Pre-commit** | Manifest changed without staged lockfile; default frozen install drift |
+| **CI validate** | Frozen install on integration branch (`develop` / `dev`) and PRs |
+| **CI hoisted job** | cms-edit Vercel path (`--config.node-linker=hoisted`) — platform optional deps |
+| **Vercel installCommand** | `--frozen-lockfile` on marketing sites; hoisted + frozen on cms-edit host |
+
+## Scripts (copy from se-core-product `scripts/`)
+
+- `check-lockfile-sync.sh` — full (`default` + `hoisted`) or `--quick` (default only)
+- `pre-commit-lockfile.sh` — wire into `.husky/pre-commit` before lint-staged
+
+## CI snippet
+
+See [`validate-workflow-snippet.yml`](validate-workflow-snippet.yml). Customer monorepos should:
+
+1. Run validate on **`develop`** (or your integration branch), not only `main`.
+2. Add a parallel `lockfile-hoisted` job when `cms-edit/host/.npmrc` has `node-linker=hoisted`.
+
+## Vercel
+
+| Project type | installCommand |
+|--------------|----------------|
+| Marketing app (monorepo root install) | `cd ../.. && pnpm install --frozen-lockfile` |
+| cms-edit host | `cd ../.. && pnpm install --frozen-lockfile --config.node-linker=hoisted` |
+
+## After dependency changes
+
+```bash
+pnpm install                    # repo root — never pnpm install -r for lockfile refresh
+git add package.json pnpm-lock.yaml pnpm-workspace.yaml
+```
+
+Use `pnpm install --no-frozen-lockfile` only when intentionally repairing the lockfile.
+
+## Rollout status (customer repos)
+
+Apply the full stack when touching deps or CI in each repo:
+
+| Repo | Pre-commit | CI develop/dev | CI hoisted | Vercel frozen (marketing) |
+|------|------------|----------------|------------|---------------------------|
+| brightline-sites | yes | yes | yes | yes |
+| pedestal-sites | — | partial | — | no |
+| om1-website | — | — | — | — |
+| se-website-2026 | — | — | — | — |
+| pointme | — | — | — | — |
+
+Update this table as repos adopt the pattern.

package/references/lockfile-sync/validate-workflow-snippet.yml

@@ -0,0 +1,32 @@
+# Append to .github/workflows/validate.yml (or equivalent CI workflow).
+# Run on the integration branch (develop / dev), not only main.
+
+on:
+  push:
+    branches: [main, develop] # or [main, dev] for se-core-product consumers
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm validate
+
+  # Required when cms-edit/host (or apps/cms-edit-host) uses node-linker=hoisted.
+  lockfile-hoisted:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --config.node-linker=hoisted

package/references/stale-files-cleanup/BRIGHTLINE_RUNBOOK.md

@@ -0,0 +1,90 @@
+# Case study — Brightline Sites stale-files cleanup (Jul 2026)
+
+Reference implementation for `site-workflows-stale-files-cleanup`. Repo: `brightline-sites` on `develop`.
+
+---
+
+## User choices
+
+| Decision | Choice |
+|----------|--------|
+| Doc disposition | Hard delete (git history as backup) |
+| BLK Contentful migration | Complete — migration scripts safe to remove |
+| Dependabot | Investigate only; fix when asked separately |
+
+---
+
+## Commits
+
+| SHA | Summary | Scale |
+|-----|---------|-------|
+| `783a329` | Remove stale scripts, docs, migration tooling | ~58 files, ~57k lines |
+| `558fc56` | Fix A/B test, cms-guidelines paths, `.env.example` | 11 files |
+| `e09da45` | Remove orphan `xlsx` devDependency | 2 files; cleared 4 Dependabot alerts |
+
+---
+
+## Removed categories (783a329)
+
+**Broken npm scripts** (missing targets):
+
+- `docs:screenshots`, `docs:pdf` (Brightline)
+- `setup:footer-nav`, `audit:site` (BLK)
+
+**Orphan scripts:**
+
+- `update-leadership-linkedin.mjs`, Vercel env ops scripts, media workbook builder, pilot batch scripts, `run-cms-screenshots-all.mjs` (both apps), unreferenced schema patch scripts
+
+**BLK migration (confirmed complete):**
+
+- `migrate-blk.ts`, `blk-master-schema.json`, `enable-locales-migration.js`
+
+**Stale docs:**
+
+- `REPO_ORIENTATION.md`, app `AGENTS.md`, "Moved" stubs, Mar 2026 audit reports, migration runbooks, schema audit snapshots, dated xlsx/json deliverables
+
+**Infra:**
+
+- Per-app `.husky/` + `husky` devDependencies
+
+---
+
+## Follow-up fixes (558fc56)
+
+- `ab-test-page.test.ts` — assert against active `home-parents` test in `abTests.ts`, not removed Long Island test
+- cms-guidelines: `example-brightline` → `brightline` filter + `apps/brightline-website` paths
+- `.env.example`: `CTM_ENABLED`, `STICKY_PHONE_ENABLED` (BL); `PREVIEW_SECRET` (BLK)
+
+---
+
+## Dependency hygiene (e09da45)
+
+- `xlsx@0.18.5` root devDep — zero imports after workbook script removal
+- `pnpm why xlsx` confirmed orphan; removed from `package.json` + lockfile
+
+---
+
+## Reference updates required
+
+Deleting without grep caught stragglers in:
+
+- `ACTION-PLAN.md`, `VERCEL-ENV-INVENTORY.md` (deleted script names)
+- `docs/media/CUSTOMER-REVIEW-BRIEF.md`, `BLK-PILOT-REVIEW-PACKET.md`
+- `MKTG-4804-fbp-explanation.md` (superseded Formstack audit link)
+- `AGENTS.md` (non-existent `deploy-cms-edit-host.sh`)
+
+---
+
+## Kept intentionally
+
+See [`FALSE_POSITIVES.md`](./FALSE_POSITIVES.md) — cms-editor, editor-pack, env-inventory, Formstack playbooks, wired schema scripts, screaming-frog configs.
+
+---
+
+## Lessons for future runs
+
+1. **Plan mode + AskQuestion** before bulk doc deletes
+2. **Grep after each phase** — playbook and action-plan refs linger
+3. **Revert validate side-effects** — `validate:routes` regenerated `abTests.ts`
+4. **Doc drift** can remain after file deletes (BLK README "standalone app" wording)
+5. **Dependabot investigate** separate from cleanup unless user conflates them

package/references/stale-files-cleanup/CHECKLIST.md

@@ -0,0 +1,145 @@
+# Stale files cleanup — discovery checklist
+
+Run these checks in parallel at the start of every hygiene audit. Adapt paths for monorepo vs single-app (see `MONOREPO.md` / `SINGLE_APP.md`).
+
+---
+
+## 1. Broken npm scripts
+
+For each `package.json` with a `scripts` section (root + `apps/*/` in monorepos):
+
+1. Extract script commands that invoke local files (`tsx scripts/…`, `node scripts/…`, `bash scripts/…`).
+2. Verify each target file exists on disk.
+3. Flag scripts pointing at missing files — **High** risk.
+
+```bash
+# Quick scan: list script files referenced from package.json
+rg '"(tsx|node|bash) scripts/' package.json apps/*/package.json
+```
+
+---
+
+## 2. Orphan scripts
+
+List runnable files under:
+
+- `scripts/` (repo root)
+- `apps/*/scripts/`
+- `docs/*/scripts/`
+
+For each file not referenced in any `package.json` script:
+
+```bash
+rg -l '<basename>' --glob '!node_modules' --glob '!.next'
+```
+
+Zero inbound refs → candidate for removal (**Low**), unless cited as an active re-run playbook in docs.
+
+---
+
+## 3. Stale documentation
+
+Search for:
+
+| Pattern | Typical meaning |
+|---------|-----------------|
+| `REPO_ORIENTATION`, `implementation-checklist-*` | Pre-monorepo or historical checklists |
+| `# Moved`, `Moved to monorepo` | Stub redirects — safe to delete if canonical doc exists |
+| `*-REPORT.md`, `*-audit.md` (dated) | Point-in-time reports |
+| `example-brightline`, `apps/example-*` | Legacy template paths — update, not always delete |
+| `deploy-cms-edit-host.sh` | Often referenced in AGENTS.md but file never existed |
+
+```bash
+rg -l 'example-brightline|apps/example-|REPO_ORIENTATION|# Moved' docs apps
+```
+
+---
+
+## 4. Audit artifacts and deliverables
+
+| Pattern | Notes |
+|---------|-------|
+| `docs/media-review-*.xlsx`, `media-review-*.json` | Regenerable via media-review playbooks |
+| `docs/schema/audit/` | Point-in-time schema audit outputs |
+| `docs/archive/` | Superseded snapshots — ask disposition |
+| `*.xlsx` under `docs/` | Source spreadsheets when templates exist elsewhere |
+
+Cross-check `.gitignore`: gitignored generated reports under `docs/seo/*-screaming-frog-*` are **local only** — do not treat as tracked stale files.
+
+```bash
+git ls-files 'docs/**/*.xlsx' 'docs/**/*-audit*' 'docs/archive/'
+```
+
+---
+
+## 5. Duplicate infrastructure (monorepo)
+
+```bash
+ls -la .husky/pre-commit apps/*/.husky/pre-commit 2>/dev/null
+rg '"husky"' package.json apps/*/package.json
+```
+
+Flag when root hook runs typecheck but app hooks only run `lint-staged`.
+
+---
+
+## 6. Orphan npm dependencies
+
+Root and app `devDependencies` with no imports:
+
+```bash
+# For each suspicious package name from package.json:
+pnpm why <package>
+rg "from '<package>'|require\\('<package>'\\)|import.*'<package>'" . \
+  --glob '!node_modules' --glob '!pnpm-lock.yaml'
+```
+
+Common orphans after script removal: `xlsx`, one-off CLI helpers.
+
+---
+
+## 7. Env template drift
+
+Compare README tables and `docs/VERCEL-ENV-VARS.md` against `.env.example` (root or per-app):
+
+```bash
+rg '^\| `[A-Z_]+`' apps/*/README.md docs/VERCEL-ENV-VARS.md
+rg '^[A-Z_]+=' apps/*/.env.example .env.example 2>/dev/null
+```
+
+Flag vars documented for humans but missing from `.env.example`.
+
+---
+
+## 8. Fragile tests tied to generated CMS state
+
+After cleanup touching A/B tests or generated files:
+
+- `src/generated/abTests.ts` — regenerated on `prebuild` / `generate:ab-tests`
+- Tests importing `generatedTestsByPath` must assert against **current** CMS entries, not removed page tests
+
+```bash
+pnpm --filter <app> test
+```
+
+Revert unrelated codegen diffs before commit (`git diff src/generated/`).
+
+---
+
+## 9. Untracked files
+
+```bash
+git status --short
+```
+
+Orphan untracked audits (e.g. `docs/*-setup-audit.md`) — ask commit vs delete.
+
+---
+
+## Output format
+
+Present findings as a table:
+
+| Path | Why stale | Evidence | Risk | Proposed action |
+
+Then proceed to user confirmation before any `git rm`.

package/references/stale-files-cleanup/FALSE_POSITIVES.md

@@ -0,0 +1,88 @@
+# Stale files cleanup — false positives (do not delete)
+
+Agents routinely mistake these for clutter. **Keep** unless the user explicitly requests removal.
+
+---
+
+## CMS editor and hosted MCP
+
+| Path | Why keep |
+|------|----------|
+| `docs/cms-editor/**` | Source playbooks for `cms-edit editor-pack generate` |
+| `cms-edit/<site>/editor-pack/**` | Committed MCP resources deployed via git push |
+| `cms-edit/host/` staging (gitignored `.env.*`) | Local cms-edit host dev |
+
+Overlap between `docs/cms-editor` and `editor-pack` is pipeline duplication, not accidental redundancy.
+
+---
+
+## Active operations documentation
+
+| Path | Why keep |
+|------|----------|
+| `docs/STATUS.md`, `docs/ACTION-PLAN.md` | Live workload docs (customer monorepos) |
+| `docs/env-inventory/`, `docs/VERCEL-ENV-*.md` | Env documentation pipeline |
+| `docs/PAGE_VARIANTS_AND_TESTS.md` | A/B test runbooks |
+| `docs/media/*.md` (briefs, not dated xlsx) | Active media-review workflow |
+
+---
+
+## Schema and SEO tooling (wired)
+
+| Path | Why keep |
+|------|----------|
+| `docs/schema/templates/` | Mustache templates for schema.org |
+| `docs/schema/page-inventory.json`, `PAGE-INVENTORY.md` | Referenced by schema recommendations |
+| `docs/schema/scripts/validate-json-ld.mjs` | Wired in root `schema:validate` |
+| `docs/schema/scripts/audit-localhost-schema.mjs` | Wired in `schema:audit:localhost*` |
+| `apps/*/seo/screaming-frog.json` | Crawl manifest config (not generated crawl reports) |
+
+---
+
+## Re-run playbooks and audit baselines
+
+| Path | Why keep |
+|------|----------|
+| `apps/*/scripts/formstack-spike.ts` (+ paired embed `.js`) | Cited by Formstack audit docs for re-runs |
+| `packages/*/docs/*-audit.md` (current, not superseded) | Active audit baselines |
+| `docs/alt-drafts/*.json` | Active pilot content batches |
+
+---
+
+## Agent skills and references
+
+| Path | Why keep |
+|------|----------|
+| `.agents/skills/`, `.cursor/skills/` (symlinks) | Synced from `@se-studio/skills` / `skills-npm` |
+| `.agents/references/` | Support docs for skills |
+| Customer-specific skills (e.g. `brightline-status-refresh`) | Site-local workflows |
+
+---
+
+## CI and deployment config
+
+| Path | Why keep |
+|------|----------|
+| `.github/workflows/*.yml` | Active CI (validate, deployment-smoke) |
+| `apps/*/scripts/vercel-deployment-smoke-check.json` | Vercel Deployment Checks registration |
+| Root `cms-edit:deploy:*` scripts | Emergency manual deploy (discouraged but intentional) |
+
+---
+
+## Generated outputs (regenerate, do not delete source)
+
+| Path | Notes |
+|------|-------|
+| `src/generated/abTests.ts` | CMS-generated — update tests, do not hand-delete |
+| `src/generated/cms-discovery/` | Regenerated by codegen scripts |
+| `docs/cms-guidelines/COMPONENT_GUIDELINES_FOR_LLM.md` | Merged output — regenerate via merge script |
+
+---
+
+## Package names vs folder names
+
+| Pattern | Notes |
+|---------|-------|
+| `example-brightlifekids` filter name | May differ from `apps/brightlife-kids-website/` — intentional for `pnpm --filter`; update **docs**, do not rename package without user request |
+
+When in doubt, grep for inbound references before proposing deletion.

package/references/stale-files-cleanup/MONOREPO.md

@@ -0,0 +1,85 @@
+# Stale files cleanup — monorepo layout
+
+For repos like `brightline-sites` with multiple apps under `apps/` and shared `packages/`.
+
+---
+
+## Detection
+
+| Signal | Monorepo |
+|--------|----------|
+| Root `pnpm-workspace.yaml` | Yes |
+| `apps/*/` with separate `package.json` | Yes |
+| Root `AGENTS.md` + optional per-app docs | Common |
+
+---
+
+## package.json scripts
+
+Audit **both**:
+
+- Root `package.json` — monorepo-wide (`validate`, `cms-edit:*`, `schema:*`)
+- Each `apps/<site>/package.json` — app dev/build/test scripts
+
+Broken script entries in **either** file fail when invoked from that package context.
+
+---
+
+## Husky duplication
+
+Canonical pattern (Brightline):
+
+- **Root** `.husky/pre-commit` → `lint-staged` + `scripts/pre-commit-typecheck.sh`
+- **App** `.husky/pre-commit` → only `lint-staged` (legacy)
+
+Cleanup: remove `apps/*/.husky/` and `husky` from app `devDependencies` when root `prepare` owns hooks.
+
+---
+
+## AGENTS.md
+
+| File | Role |
+|------|------|
+| Root `AGENTS.md` | Canonical agent rules |
+| `apps/*/AGENTS.md` | Often generic template leftovers — candidate for deletion if root doc exists |
+
+---
+
+## Filter names vs directory names
+
+| Folder | Package name (filter) |
+|--------|----------------------|
+| `apps/brightline-website` | `brightline` |
+| `apps/brightlife-kids-website` | `example-brightlifekids` |
+
+Docs may still say `example-brightline` or `apps/example-brightline` — update paths to real folder names and correct `pnpm --filter` names.
+
+---
+
+## Shared packages
+
+`packages/<shared>/` — do not delete shared docs/scripts referenced by both apps. Audit imports from apps before removing shared tooling.
+
+---
+
+## cms-edit multi-site
+
+| Path | Site |
+|------|------|
+| `cms-edit/brightline/project.json` | Brightline |
+| `cms-edit/brightlifekids/project.json` | BrightLife Kids |
+| `docs/cms-editor/<site>/` | Playbook source per site |
+
+Never delete one site's editor-pack thinking the other is redundant.
+
+---
+
+## Validate command
+
+Typically root:
+
+```bash
+pnpm validate
+```
+
+Runs `pnpm -r validate` across workspace packages. Pre-commit typecheck may only touch affected apps when paths are staged.

package/references/stale-files-cleanup/SINGLE_APP.md

@@ -0,0 +1,66 @@
+# Stale files cleanup — single-app layout
+
+For standalone SE Studio customer sites (one Next.js app at repo root or under a single `apps/` entry).
+
+---
+
+## Detection
+
+| Signal | Single-app |
+|--------|------------|
+| One primary `package.json` for the site | Yes |
+| No `apps/` sibling sites | Typical |
+| `cms-edit/project.json` at `cms-edit/` (not `cms-edit/<site>/`) | Common |
+
+---
+
+## Script locations
+
+| Location | Scope |
+|----------|-------|
+| `scripts/` | App tooling |
+| `docs/schema/scripts/` | Schema validation (if present) |
+
+Same orphan/broken-script rules as monorepos — only one `package.json` to audit.
+
+---
+
+## Husky
+
+Single `.husky/pre-commit` at repo root. No app-level duplicate to remove.
+
+---
+
+## Documentation paths
+
+| Path | Notes |
+|------|-------|
+| `docs/cms-guidelines/` | Per-component guidelines |
+| `docs/cms-editor/` | Editor playbooks (if hosted MCP enabled) |
+| `REPO_ORIENTATION.md` | Sometimes accurate — verify against current layout before deleting |
+
+Legacy `example-*` naming is less common in mature single-app repos but may persist in cms-guidelines from template copy.
+
+---
+
+## cms-edit
+
+| Path | Role |
+|------|------|
+| `cms-edit/project.json` | Project config |
+| `cms-edit/editor-pack/` | Generated MCP pack |
+| `docs/cms-editor/` | Playbook source |
+
+See [`FALSE_POSITIVES.md`](./FALSE_POSITIVES.md).
+
+---
+
+## Validate
+
+Usually from repo root:
+
+```bash
+pnpm validate
+```
+
+Or `pnpm check && pnpm type-check` per project `package.json`.

package/skills/contentful-cms-generate-cms-guidelines/SKILL.md

@@ -48,7 +48,7 @@ Guidelines are only meaningful when the showcase is populated with realistic dat
 
 | Input | Description |
 |---|---|
-| **App directory** | Repo-relative path, e.g. `apps/example-om1` or `apps/example-se2026` |
+| **App directory** | Repo-relative path, e.g. `apps/example-empty` in this monorepo, or an app path in a customer repo (see `docs/RELATED_PROJECTS.md`) |
 | **Mode** | `full` \| `single` \| `merge-only` |
 | **Type name** | Required for `single` mode — the exact type name from discovery, e.g. `"Hero"` or `"Cards Grid"` |
 | **Discovery URL** | `http://localhost:<PORT>/api/cms/discovery/` — `<PORT>` from the running dev server (`pnpm dev`) |

package/skills/performance-audit/SKILL.md

@@ -94,7 +94,7 @@ mkdir -p scripts
 cp node_modules/@se-studio/skills/skills/performance-audit/lighthouse.ts scripts/lighthouse.ts
 ```
 
-Or copy from `apps/example-se2026/scripts/lighthouse.ts` in the se-core-product monorepo if you have it available.
+Or copy from a customer site repo if available (e.g. `se-website-2026/scripts/lighthouse.ts`). This monorepo only ships `apps/example-empty`.
 
 **Customise `PAGES` for the project** — edit the `PAGES` array near the top of the script. Choose representative pages: homepage, a list/index page, and a detail page. Use the sitemap to identify good candidates:
 

package/skills/se-marketing-sites-cms-routes-and-appshared/SKILL.md

@@ -5,7 +5,7 @@ description: "Guide for the (cms-routes) route group and appShared pattern. Use
 
 # CMS Routes and appShared Pattern
 
-Reference apps: **example-se2026**, **example-brightline**, **example-om1**. (example-om1 uses `resources/`, `team/`, `topics/` instead of `articles/`, `people/`, `tags/`.)
+Reference app: **example-empty** (this monorepo). Customer sites with fuller route sets: see `docs/RELATED_PROJECTS.md` (e.g. OM1 uses `resources/`, `team/`, `topics/` instead of `articles/`, `people/`, `tags/`).
 
 ## Route Group: (cms-routes)
 

package/skills/se-marketing-sites-create-page/SKILL.md

@@ -7,7 +7,7 @@ description: "Guide for creating new Next.js App Router pages and dynamic routes
 
 This guide explains how to create new pages and handle routing in the SE Core Product Next.js framework. The system uses Next.js App Router with Contentful-driven dynamic routing.
 
-Reference apps: **example-se2026**, **example-brightline**, **example-om1**.
+Reference app: **example-empty** (this monorepo). Customer implementations: see `docs/RELATED_PROJECTS.md`.
 
 ## Page Architecture
 

package/skills/se-marketing-sites-lib-cms-structure/SKILL.md

@@ -5,7 +5,7 @@ description: "Guide for the lib directory structure in SE Core Product CMS apps.
 
 # Lib Directory Structure
 
-Reference apps: **example-se2026**, **example-brightline**, **example-om1**.
+Reference app: **example-empty** (this monorepo). Customer implementations: see `docs/RELATED_PROJECTS.md`.
 
 ## File Responsibilities
 

package/skills/se-marketing-sites-smoke-test-setup/SKILL.md

@@ -52,6 +52,8 @@ Example `package.json` entries:
 }
 ```
 
+**Lockfile CI** — before deployment smoke, ensure `.github/workflows/validate.yml` runs `pnpm install --frozen-lockfile` on the integration branch (`develop` / `dev`) and PRs, plus a parallel `lockfile-hoisted` job when cms-edit uses `node-linker=hoisted`. Copy scripts and workflow snippet from [`references/lockfile-sync/`](../../references/lockfile-sync/README.md). Marketing `vercel.json` install commands must use `--frozen-lockfile`.
+
 **Vercel Deployment Check (live URL)** — GitHub Action on `vercel.deployment.ready` tests `client_payload.url` before production domains alias. Workflow must live on the repo **default branch**. Register the status `name` in Vercel → Settings → Build and Deployment → Deployment Checks.
 
 Filter on `client_payload.environment == 'production'` when Deployment Checks target production only. Vercel also dispatches for preview and custom environments (`preview`, `develop`, etc.); skip those to avoid duplicate CI runs. Use `workflow_dispatch` without an environment filter for manual smoke against any URL.

package/skills/site-workflows-deps-update/SKILL.md

@@ -37,6 +37,8 @@ pnpm install --frozen-lockfile --config.node-linker=hoisted
 
 Run that locally **before push** whenever `package.json`, lockfile, or overrides change. A mismatch surfaces as `ERR_PNPM_OUTDATED_LOCKFILE` (manifest vs lockfile specifiers).
 
+**Lockfile enforcement stack** — copy `scripts/check-lockfile-sync.sh` and `scripts/pre-commit-lockfile.sh` from se-core-product; wire pre-commit before lint-staged; add CI jobs from [`references/lockfile-sync/`](../../references/lockfile-sync/README.md). Marketing Vercel projects: `installCommand` must include `--frozen-lockfile`. Integration branch (`develop` / `dev`) must be in CI `push.branches`, not only `main`.
+
 ---
 
 ## Projects
@@ -234,6 +236,17 @@ After a successful update, you may add the patches check to the root `validate`
 
 This is optional follow-up — the skill workflow always runs the check regardless.
 
+## Optional: lockfile enforcement rollout
+
+When updating deps in a customer repo, adopt the full lockfile stack if missing:
+
+1. Copy `scripts/check-lockfile-sync.sh` and `scripts/pre-commit-lockfile.sh` from se-core-product.
+2. Add `bash scripts/pre-commit-lockfile.sh` to `.husky/pre-commit` (before lint-staged).
+3. Extend `.github/workflows/validate.yml`: integration branch in `push.branches`, parallel `lockfile-hoisted` job when cms-edit uses hoisted linker.
+4. Set marketing `vercel.json` `installCommand` to `cd ../.. && pnpm install --frozen-lockfile`.
+
+See [`references/lockfile-sync/README.md`](../../references/lockfile-sync/README.md) for the rollout table and workflow snippet.
+
 ---
 
 ## Troubleshooting

package/skills/site-workflows-stale-files-cleanup/SKILL.md

@@ -0,0 +1,165 @@
+---
+name: site-workflows-stale-files-cleanup
+description: "Audit and remove stale scripts, broken package.json entries, orphan docs, and duplicate tooling on SE Studio marketing sites. Supports single-app and monorepo layouts. Use for repo cleanup, stale files audit, hygiene audit, or pruning dead code. Always ask before deleting historical docs or deliverables."
+---
+
+# Stale files cleanup (repository hygiene)
+
+Remove **dead weight** from an SE Studio site repo without changing product behavior. This is **not** [`site-workflows-project-cleanup`](../site-workflows-project-cleanup/SKILL.md) (which strips a site to a bare template).
+
+**References:**
+
+| File | Purpose |
+|------|---------|
+| [`CHECKLIST.md`](../../references/stale-files-cleanup/CHECKLIST.md) | Discovery commands and grep patterns |
+| [`FALSE_POSITIVES.md`](../../references/stale-files-cleanup/FALSE_POSITIVES.md) | Paths agents must not delete |
+| [`MONOREPO.md`](../../references/stale-files-cleanup/MONOREPO.md) | Multi-app layout rules |
+| [`SINGLE_APP.md`](../../references/stale-files-cleanup/SINGLE_APP.md) | Single-app layout rules |
+| [`BRIGHTLINE_RUNBOOK.md`](../../references/stale-files-cleanup/BRIGHTLINE_RUNBOOK.md) | Case study (Jul 2026) |
+
+**Default:** Plan mode first — present a classified audit table before deleting anything.
+
+**Never:** push to `main`/`master`; delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
+
+---
+
+## When to use
+
+| Situation | Action |
+|-----------|--------|
+| User asks for repo cleanup, stale files, orphan scripts, dead docs | Run full workflow |
+| Broken `pnpm` scripts fail with missing file paths | Phase 1 only (broken tooling) |
+| Post-migration or post-monorepo consolidation | Phases 2–4 with migration confirmation |
+| Dependabot noise | Optional investigate phase only |
+
+## When not to use
+
+- Stripping a customer site to a reusable template → **`site-workflows-project-cleanup`**
+- CMS content edits → **`contentful-cms-*`** skills
+- Dependency version bumps → **`site-workflows-deps-update`**
+
+---
+
+## Step 1 — Preflight
+
+1. Read repo `AGENTS.md`, root `README.md`, and `.gitignore`.
+2. Detect layout — see [`MONOREPO.md`](../../references/stale-files-cleanup/MONOREPO.md) vs [`SINGLE_APP.md`](../../references/stale-files-cleanup/SINGLE_APP.md).
+3. Confirm integration branch (`develop` for customer sites, `dev` for se-core-product). Working tree clean or user approves.
+4. Run parallel discovery per [`CHECKLIST.md`](../../references/stale-files-cleanup/CHECKLIST.md).
+
+---
+
+## Step 2 — Classify findings
+
+Group every candidate into a table for the user:
+
+| Risk | Examples | Default action |
+|------|----------|----------------|
+| **High** | `package.json` script → missing file; doc links to non-existent path | Fix script entry or restore file; fix doc |
+| **Medium** | Completed migration scripts; dated audit deliverables; duplicate Husky | Delete after user confirms |
+| **Low** | Orphan scripts with zero refs; stub "Moved" docs; legacy path names in docs | Delete or update refs |
+
+Cross-check [`FALSE_POSITIVES.md`](../../references/stale-files-cleanup/FALSE_POSITIVES.md) before listing any path as deletable.
+
+---
+
+## Step 3 — Confirm with user
+
+Use `AskQuestion` (or equivalent) before bulk deletes:
+
+1. **Historical docs and deliverables** — archive vs hard delete vs keep (default: **ask**; do not assume).
+2. **Migration / one-off ops scripts** — only remove when user confirms work is complete (e.g. Contentful locale migration, Vercel env rotation runbooks marked done).
+3. **Dependabot** — offer investigation summary; do not bump packages unless user explicitly asks.
+
+---
+
+## Step 4 — Execute (ordered phases)
+
+### Phase 1 — Broken tooling
+
+- Remove or fix `package.json` script entries whose target files do not exist (root + `apps/*/package.json` in monorepos).
+- Highest signal — these fail when invoked.
+
+### Phase 2 — Orphan scripts
+
+- Delete scripts under `scripts/`, `apps/*/scripts/`, `docs/*/scripts/` with no `package.json` wiring and no inbound references.
+- Keep scripts cited as re-run playbooks in active docs (e.g. Formstack audit spikes).
+
+### Phase 3 — Completed one-offs
+
+- Migration tooling (`migrate-*.ts`, `enable-*-migration.js`, schema dumps) after user confirms migration done.
+- Ops runbooks marked complete in `ACTION-PLAN.md` / env inventory docs.
+
+### Phase 4 — Stale docs and artifacts
+
+- Pre-monorepo orientation docs, "Moved" stubs, one-off session reports, dated `.xlsx`/`.json` audit outputs.
+- Untracked orphan audits at repo root — delete or commit per user choice.
+
+### Phase 5 — Duplicate infrastructure (monorepo)
+
+- Per-app `.husky/` when root `.husky/pre-commit` runs `lint-staged` + typecheck.
+- Remove `husky` from app `devDependencies` when root `prepare` owns hooks.
+
+### Phase 6 — Doc drift and env templates
+
+- Legacy package/filter names (`example-brightline` → `apps/<app>/` paths and real filter name).
+- Broken references in `AGENTS.md`, README, playbooks, `ACTION-PLAN.md`.
+- Vars documented in README / `VERCEL-ENV-VARS.md` but missing from `.env.example`.
+
+### Phase 7 — Orphan npm dependencies (optional)
+
+```bash
+pnpm why <package>
+rg "from '<pkg>'|require\\('<pkg>'\\)" .
+```
+
+Remove root or app devDependencies with zero imports (e.g. leftover `xlsx` after workbook script removal).
+
+---
+
+## Step 5 — Reference repair
+
+After each deletion phase, grep for deleted basenames:
+
+```bash
+rg '<basename-or-path>' --glob '!node_modules' --glob '!.next'
+```
+
+Update inbound links in README, `AGENTS.md`, media briefs, editor playbooks, and superseded-doc cross-references.
+
+---
+
+## Step 6 — Optional Dependabot investigate
+
+When the repo is on GitHub and `gh` is available:
+
+```bash
+gh api repos/<org>/<repo>/dependabot/alerts --jq \
+  '.[] | select(.state=="open") | {number, package: .security_vulnerability.package.name, severity: .security_advisory.severity, manifest: .dependency.manifest_path, summary: .security_advisory.summary}'
+```
+
+For each alert: `pnpm why <package>` — classify as direct vs transitive, runtime vs dev-only. Summarize fix paths; **do not** bump unless user asks.
+
+---
+
+## Step 7 — Validate and commit
+
+```bash
+pnpm validate   # or repo-specific validate from AGENTS.md
+```
+
+- Revert unrelated diffs from validate side-effects (e.g. regenerated `abTests.ts`, biome trailing-newline fixes) before commit.
+- Pre-existing test failures: call out explicitly; do not blame cleanup.
+
+Commit on integration branch only. Suggested message: `chore: remove stale scripts, docs, and tooling`.
+
+Hand off production promotion to the human — never push `main`.
+
+---
+
+## Success criteria
+
+- Classified audit presented before deletes
+- No false-positive paths from [`FALSE_POSITIVES.md`](../../references/stale-files-cleanup/FALSE_POSITIVES.md) removed
+- `rg` pass clean for deleted paths (or intentional stubs updated)
+- `pnpm validate` passes or pre-existing failures documented