@se-studio/skills 1.6.0 → 1.6.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.6.2
+
+### Patch Changes
+
+- 928562f: CMS showcase: controls closed by default (`?controls=true`), map control keys to usedFields, string mock body → rich text, placeholder visuals, iframe height shrink/caps, External video for Vimeo/YouTube mock URLs, `showcaseLayout` registration + fixed preview frames, and helpers `isCmsShowcase` / `articlesFromShowcaseContents` / `peopleFromShowcaseContents` for related-content collections. Skills: curate-showcase-mocks video URL and no-LLM notes.
+
+## 1.6.1
+
+### Patch Changes
+
+- Add SE OM1 example case-study brief (markdown + Word) for package-intake training.
+
 ## 1.6.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/customer-agents-block.md

@@ -7,7 +7,8 @@ Default mode for this repo: **site-first**.
 ### Branch policy
 
 - Agents may commit and push **`develop`** and **`feature/*`** only.
-- **Never** push to `main`, `master`, or production — human-only.
+- **Never** push to `main`, `master`, `production`, or any production branch — **human-only** for all customer sites.
+- Do **not** ship from a production checkout (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`). Use the develop checkout only.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -46,10 +47,13 @@ Never hand-edit `package.json` dependency versions.
 ### Parallel features
 
 - One feature = one `feature/<scope>/<slug>` branch
-- Use a **git worktree** when multiple features touch this repo at once
+- **Git worktree required** for all feature work — do not implement on the primary `develop` checkout
+  - Path: registry `worktreesRoot` / `<feature-slug>` (see se-core-product `packages/skills/references/agent-session/projects.registry.json`)
+  - Create: `git worktree add <worktreesRoot>/<feature-slug> -b feature/<scope>/<slug> origin/develop`
+  - Manifest must set `worktree:`; opt out only if the user says “work in place” / “no worktree” (`worktree_opt_out: true`)
 - CMS edits: `--session <feature-slug>` (isolate cms-edit sessions)
 - Track in-flight work: manifest at `~/source/se/se-core-product/work/active/<feature>.yaml` (or `work/active/` in this repo if core checkout unavailable)
 
 ### Production handoff
 
-When ready for production, agents **stop** and deliver a handoff note — they do not merge to `main`. See skill Step 8.
+When ready for production, agents **stop** and deliver a handoff note — they do not merge to `main` / `production` or promote Vercel/Netlify. Production promotion is always **human-only**. See skill Step 8.

package/references/agent-session/manifest.template.yaml

@@ -6,7 +6,10 @@ mode: site-first # core-first | site-first
 project_key: om1
 primary_repo: ~/source/customers/om1/om1-website
 branch: feature/om1/my-feature-slug
-worktree: null # e.g. ~/source/worktrees/om1-my-feature-slug — required when parallel features share a repo
+# REQUIRED for feature/* work — path under registry worktreesRoot (e.g. ~/source/customers/om1/worktrees/my-feature-slug).
+# null only when user explicitly opts out of worktrees in this conversation (record worktree_opt_out: true).
+worktree: ~/source/customers/om1/worktrees/my-feature-slug
+worktree_opt_out: false
 integration_branch: develop
 
 related_repos:
@@ -31,4 +34,4 @@ updated_at: 2026-07-05
 
 validation: []
 
-handoff: null
+handoff: null

package/references/agent-session/projects.registry.json

@@ -5,11 +5,17 @@
     "customer": "develop"
   },
   "branchPattern": "feature/<scope>/<short-slug>",
+  "worktrees": {
+    "requiredForFeatureBranches": true,
+    "pathPattern": "<worktreesRoot>/<feature-slug>",
+    "notes": "Feature work (feature/*) must use a git worktree under the project's worktreesRoot. Primary checkouts stay on integration branches only. Opt out only if the user explicitly says work in place / no worktree in the current conversation."
+  },
   "projects": [
     {
       "key": "se-core-product",
       "displayName": "SE Core Product",
       "path": "~/source/se/se-core-product",
+      "worktreesRoot": "~/source/se/worktrees",
       "branch": "dev",
       "type": "core",
       "validate": "pnpm validate",
@@ -19,6 +25,7 @@
       "key": "se2026",
       "displayName": "SE Studio Site",
       "path": "~/source/se/se-website-2026",
+      "worktreesRoot": "~/source/se/worktrees",
       "branch": "develop",
       "type": "customer",
       "contentfulSpaceId": "g0pw3n92bre6",
@@ -29,6 +36,7 @@
       "key": "brightline",
       "displayName": "Brightline Sites",
       "path": "~/source/customers/brightline/brightline-sites",
+      "worktreesRoot": "~/source/customers/brightline/worktrees",
       "branch": "develop",
       "type": "customer-monorepo",
       "sharedPackage": "@brightline/shared",
@@ -40,6 +48,7 @@
       "key": "om1",
       "displayName": "OM1 Website",
       "path": "~/source/customers/om1/om1-website",
+      "worktreesRoot": "~/source/customers/om1/worktrees",
       "branch": "develop",
       "type": "customer",
       "contentfulSpaceId": "ddhe5ahaolzf",
@@ -50,6 +59,7 @@
       "key": "pointme",
       "displayName": "PointMe Marketing Site",
       "path": "~/source/customers/pointme/develop-marketing-site",
+      "worktreesRoot": "~/source/customers/pointme/worktrees",
       "branch": "develop",
       "type": "customer",
       "contentfulSpaceId": "alwdzgjlz5qv",
@@ -60,6 +70,7 @@
       "key": "pedestal",
       "displayName": "Pedestal Sites",
       "path": "~/source/customers/pedestal/pedestal-sites",
+      "worktreesRoot": "~/source/customers/pedestal/worktrees",
       "branch": "develop",
       "type": "customer-monorepo",
       "sharedPackage": "@pedestal/site-common",
@@ -68,14 +79,18 @@
       "validate": "pnpm -r validate"
     },
     {
-      "key": "hsd-extended-port",
-      "displayName": "HopSkipDrive Extended Port",
-      "path": "~/source/customers/hopskipdrive/hsd-extended-port",
-      "branch": "extended-port",
+      "key": "hsd",
+      "displayName": "HopSkipDrive",
+      "path": "~/source/customers/hopskipdrive/develop-hsd-website",
+      "productionPath": "~/source/customers/hopskipdrive/production-hsd-website",
+      "worktreesRoot": "~/source/customers/hopskipdrive/worktrees",
+      "branch": "develop",
+      "productionBranch": "production",
       "type": "customer",
-      "contentfulSpaceIds": ["gqa3p93n5wse"],
-      "hostedMcp": ["cms-edit-hsd"],
-      "validate": "pnpm validate"
+      "contentfulSpaceId": "gqa3p93n5wse",
+      "hostedMcp": "cms-edit-hsd",
+      "validate": "pnpm validate",
+      "notes": "Agents work only in path (develop) + feature worktrees under worktreesRoot. productionPath is human-only — never push production from agents."
     }
   ]
 }

package/references/contentful-cms-editor-playbooks/examples/se-case-study-om1-shaped.md

@@ -4,6 +4,8 @@
 
 Synthetic package shaped like a real multi-block work port (Drive zip + Figma sequence + narrative). Names are illustrative.
 
+**Full example copy brief:** [`se-om1-case-study-brief.md`](./se-om1-case-study-brief.md) / [`se-om1-case-study-brief.docx`](./se-om1-case-study-brief.docx) (also `~/Downloads/SE-OM1-case-study-brief-example.docx`).
+
 ## Scenario
 
 > “Build a lab case study from this Drive folder and the Figma OM1 frame. Keep copy as written.”

package/references/contentful-cms-editor-playbooks/examples/se-om1-case-study-brief.md

@@ -0,0 +1,62 @@
+# OM1 — Patient Finding & Outcomes Prediction
+
+**Example brief** for agent training / source-readiness demos (not a live publish pack).
+
+| Field | Value |
+|-------|--------|
+| Client | OM1 |
+| Type | Case study (`work`) |
+| Title | Patient Finding & Outcomes Prediction |
+| Subtitle | OM1 |
+| Slug | `om1/patient-finding-outcomes-prediction` (lab: `lab/om1/…`) |
+| Description | Brand and website for OM1 — AI outcomes prediction on 350M+ patient records. Identity, digital system, and marketing platform built for life sciences. |
+
+Word twin: `se-om1-case-study-brief.docx` (same folder). Also copied to `~/Downloads/SE-OM1-case-study-brief-example.docx` — upload to Drive → Open with Google Docs if you want a Doc.
+
+## Summary (hero)
+
+OM1 had been doing AI-driven healthcare outcomes long before the industry caught up. With a decade of innovation behind them, 10 patents and a foundation model trained on over a billion patient-years, they needed a brand and website that matched where they’d arrived. SE Studio delivered a complete rebrand and a new website: visual identity, logo system, colour palette, typography, photography direction and a fully redesigned digital presence.
+
+## Origin
+
+OM1 was built on a simple but consequential idea: that outcomes are what matter most in healthcare and the data to predict them already exists — it just hasn’t been properly unlocked yet. Since 2017, they’ve been quietly building an AI foundation model trained on the longitudinal records of over 350 million patients, and were the first to offer an API for individual and cohort outcomes prediction.
+
+And so, their name encodes their mission: O for Outcomes. M for Measurement. 1 for the belief that better outcomes are the first step toward better healthcare.
+
+## Challenge
+
+The central challenge was capturing both OM1’s rigorous data system and its predictive intelligence without falling into generic AI design tropes.
+
+## Solution — identity
+
+The solution was a logomark featuring a tight, intentionally uneven cluster of dots that reads almost like a live plot, data field or patient population — paired with a deep navy wordmark that projects long-term institutional authority.
+
+This dot language becomes a living texture across the digital experience; a subtle, shifting particle field running beneath every web page, symbolising structured intelligence emerging organically from data. As users scroll, the field shifts to simulate a live data environment, providing essential visual coherence across the site.
+
+The colours and photography style further reinforce this positioning. Deep navy grounds the brand with seriousness and legitimacy, while the bright blues highlight the interactive elements and actions. Warmth is introduced through circular-cropped photography that humanises the science by focusing on specific clinicians, patients and treatments.
+
+## Quote
+
+> SE Studio delivered a brand and digital experience that truly reflects who OM1 is today. Through the redesign and launch of the new website, everything feels more cohesive for our brand.
+
+— Rich, Founder at OM1
+
+## Digital platform
+
+To engage life sciences, providers and payers simultaneously, the website architecture bypasses generic brochure copy in favour of segmented user journeys — delivering distinct language and evidence relevant to specific goals — whether regulatory submission, screening or formulary design.
+
+Since the launch, SE Studio expanded OM1’s website into a full-scale marketing platform that embeds this brand system directly into daily operations. The marketing team now manage campaigns independently via CMS-editable eBook engine, a custom PDF-to-HTML parser for long-form reports and native Hubspot forms with automated UTM attribution.
+
+Beyond the human audience, the site was engineered to be equally legible to AI platforms. By embedding OM1’s Fin assistant, expanding markdown exports across listing hubs and deploying site-wide llms.txt surfaces, the site provided AI crawlers with a structured and transparent view of OM1’s knowledge base. Supported by comprehensive JSON-LD structured data and a 400+ page SEO metadata overhaul, this work evolves the site from a launch deliverable into an active platform — empowering OM1’s publishing workflow today while ensuring discoverability across the AI-driven web.
+
+## Close
+
+The brand system created by SE Studio brings a quiet authority to OM1’s digital presence, closing the gap between their market presence and its actual achievements. By grounding the brand in specific, real-world touchpoints — from the shifting dot patterns in digital to the precise, cropped photography — the new identity translates AI modelling into tangible medical outcomes. Their brand identity gives OM1 the communication tools they need for their next chapter of collaboration across the healthcare industry.
+
+## Agent notes
+
+1. `task-source-readiness-review` before create; soft-proof from Figma order.  
+2. Faithful copy only.  
+3. Separated only for true pairs; merge continuous prose when no art between.  
+4. Lab flags for experiments.  
+5. Case study rich text for multi-block work.

package/references/deployment-smoke-feature-branch-skip/README.md

@@ -16,7 +16,7 @@ Vercel **Deployment Checks** wait for a GitHub status from the smoke workflow. O
 | Repo type | Preview smoke ref | Production smoke ref |
 |-----------|-------------------|----------------------|
 | Most customer sites | `develop` | `main` |
-| HopSkipDrive extended-port | `extended-port` | `main` (if production checks enabled) |
+| HopSkipDrive (`hsd`) | `develop` (`develop-hsd-website`) | `production` (`production-hsd-website`, human-only) |
 | se-core-product apps | `dev` | `main` |
 
 Use `client_payload.git.ref` (branch name, not `refs/heads/...` — verify per project in a test dispatch).
@@ -33,7 +33,7 @@ Feature-branch PRs also trigger cms-edit Vercel projects. Skip builds outside in
 "ignoreCommand": "if [ \"$VERCEL_GIT_COMMIT_REF\" != \"develop\" ] && [ \"$VERCEL_GIT_COMMIT_REF\" != \"main\" ]; then exit 0; fi; git diff HEAD^ HEAD --quiet -- . ../ ../../pnpm-lock.yaml ../../pnpm-workspace.yaml ../../package.json || exit 1; exit 0"
 ```
 
-Replace `develop` with your integration branch (e.g. `extended-port`).
+Replace `develop` with your integration branch if the registry uses a different name.
 
 ## Rollout status
 
@@ -44,7 +44,7 @@ Replace `develop` with your integration branch (e.g. `extended-port`).
 | om1-website | audit | audit |
 | pedestal-sites | audit | audit |
 | pointme | audit | audit |
-| hsd-extended-port | audit | n/a |
+| hsd | audit | audit (align ignoreCommand with `develop`) |
 
 Update this table when applying the pattern.
 

package/references/deps-update/projects.registry.json

@@ -68,14 +68,16 @@
       "hasPinOverrides": false
     },
     {
-      "key": "hsd-extended-port",
-      "displayName": "HopSkipDrive Extended Port",
-      "path": "~/source/customers/hopskipdrive/hsd-extended-port",
-      "branch": "extended-port",
-      "wipNote": "Parity port complete (2026-07-07). Work on extended-port only — not develop/production until cutover. Rollouts tracked in work/tracker.yaml.",
+      "key": "hsd",
+      "displayName": "HopSkipDrive",
+      "path": "~/source/customers/hopskipdrive/develop-hsd-website",
+      "productionPath": "~/source/customers/hopskipdrive/production-hsd-website",
+      "branch": "develop",
+      "productionBranch": "production",
       "validate": "pnpm validate",
       "workspace": false,
-      "hasPinOverrides": false
+      "hasPinOverrides": false,
+      "notes": "Deps updates run on develop checkout only. Never push production branch; human promotes production-hsd-website."
     }
   ]
 }

package/references/lockfile-sync/README.md

@@ -50,6 +50,6 @@ Apply the full stack when touching deps or CI in each repo:
 | om1-website | — | — | — | — |
 | se-website-2026 | yes | yes | yes | yes |
 | pointme | — | — | — | — |
-| hsd-extended-port | yes | yes (extended-port) | n/a | yes |
+| hsd (`develop-hsd-website`; prod human-only: `production-hsd-website`) | yes | yes (develop) | n/a | yes |
 
 Update this table as repos adopt the pattern.

package/skills/se-marketing-sites-curate-showcase-mocks/SKILL.md

@@ -259,16 +259,22 @@ Use the LLM draft as the starting point and apply your corrections from Step 4.
 
 **Rules for the output:**
 - Set `curatedAt` to the current ISO timestamp
-- Only include types that have real CMS data
+- Only include types that have real CMS data **for this brand** (do not leave SE Studio leftovers in a customer `showcase-mocks.json`)
 - For component mocks: include only fields present in the source data
-- For collection mocks: always include `mock` and `cards`
+- For collection mocks: always include `mock` and `cards` when the collection needs list content
 - Rich Text body fields must be `{ "json": <Document> }` — copy as-is
 - Visual fields must include `width`, `height`, AND `url` — never strip `url`
+- **`visual.url` must be an image CDN URL** (e.g. `images.ctfassets.net`). **Do not** put `vimeo.com` / `youtube.com` page URLs in image visuals — either omit the type’s curated visual (let a site video mock handle embeds) or store video only for true video modules (core factory can map video hosts to External video)
 - Include `widthPercent` when present on media/externalVideo entries
 - Include `otherMedia` when present — copy the full array including `url` and `widthPercent`
 - Do NOT invent or modify content — use the real data from the examples file
 - Include `backgroundColour` and `textColour` where the source has them
 - For cards: include ALL fields present in source, including `backgroundColour`, `textColour`, `links`
+- For news/author collections that use `getRelatedArticles` / `getRelatedPeople`: ensure `cards` have real titles/headings (and visuals when available). Sites should use `articlesFromShowcaseContents` / `peopleFromShowcaseContents` from `@se-studio/core-ui` when fetch returns empty in showcase
+
+### Step 2b — No LLM key (optional)
+
+If `OPENAI_API_KEY` / `ANTHROPIC_API_KEY` is missing, skip Step 2 and pick the highest-`fieldCompleteness` example per type from `showcase-examples.json` (prefer examples with `visual.url` when the type uses media). Write `showcase-mocks.json` directly.
 
 ### Step 6 — Verify
 
@@ -276,7 +282,8 @@ After writing, briefly confirm:
 - The file is valid JSON
 - Component and collection counts look reasonable (non-zero)
 - Key types (Hero, main collections) have entries
-- Visual fields include `url` properties
+- Visual fields include `url` properties that are **image** hosts (not player pages)
+- Spot-check related collections in the browser (News Carousel, Authors Grid) — not only Feature Split
 
 ---
 

package/skills/se-marketing-sites-smoke-test-setup/SKILL.md

@@ -56,8 +56,7 @@ Example `package.json` entries:
 
 **Vercel Deployment Check (live URL)** — GitHub Action on `vercel.deployment.ready` tests `client_payload.url` before production domains alias. Workflow must live on the repo **default branch**. Register the status `name` in Vercel → Settings → Build and Deployment → Deployment Checks.
 
-**Feature branches must not run smoke** — limit the `smoke` job to integration preview (`develop` + `preview`) and production (`main` + `production`). Feature-branch previews still fire `repository_dispatch`; without a matching job, Vercel waits forever on "Waiting for checks". Add a `skip-smoke-outside-integration-branches` job that posts **success** for non-integration refs. Full rollout guide: [`references/deployment-smoke-feature-branch-skip/`](../../references/deployment-smoke-feature-branch-skip/README.md). Monorepos: one skip job per Vercel project workflow. Non-`develop` integration branches (e.g. HSD `extended-port`): adjust ref checks in both jobs.
-
+**Feature branches must not run smoke** — limit the `smoke` job to integration preview (`develop` + `preview`) and production (`main` / `production` + `production`). Feature-branch previews still fire `repository_dispatch`; without a matching job, Vercel waits forever on "Waiting for checks". Add a `skip-smoke-outside-integration-branches` job that posts **success** for non-integration refs. Full rollout guide: [`references/deployment-smoke-feature-branch-skip/`](../../references/deployment-smoke-feature-branch-skip/README.md). Monorepos: one skip job per Vercel project workflow. Sites whose production branch is not `main` (e.g. HSD `production`): adjust ref checks in both jobs.
 Filter on `client_payload.environment == 'production'` when Deployment Checks target production only. Vercel also dispatches for preview and custom environments (`preview`, `develop`, etc.); skip those to avoid duplicate CI runs. Use `workflow_dispatch` without an environment filter for manual smoke against any URL.
 
 ```yaml

package/skills/site-workflows-agent-session/SKILL.md

@@ -5,9 +5,9 @@ description: "Start and manage agent work sessions across se-core-product and cu
 
 # Agent session workflow
 
-Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. Human merges to `main` / production — agents stop at handoff.
+Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. **Humans only** merge/promote to `main` / production (all customer sites + core) — agents stop at handoff.
 
-**Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, integration branches, hosted MCP keys.
+**Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, `worktreesRoot`, `productionPath` / `productionBranch`, integration branches, hosted MCP keys.
 
 **Manifest template:** [`packages/skills/references/agent-session/manifest.template.yaml`](../../references/agent-session/manifest.template.yaml)
 
@@ -39,7 +39,7 @@ Collect or infer:
 | `project_key` | Yes | From registry (`om1`, `se-core-product`, `pedestal`, …) |
 | `primary_repo` | Yes | Absolute path from registry |
 | `branch` | Yes | `feature/<scope>/<slug>` — see naming below |
-| `worktree` | Optional | Separate checkout path when parallel features share a repo |
+| `worktree` | **Yes** (feature work) | Path under registry `worktreesRoot`/`<feature-slug>`. Required for `feature/*`. Null only with explicit user opt-out + `worktree_opt_out: true` |
 
 **Default mode if unclear:** ask once. Site-specific UI/content → `site-first`. Package/framework/multi-site → `core-first`.
 
@@ -55,12 +55,14 @@ feature/<scope>/<short-slug>
 | Customer site | `feature/om1/hero-redesign` |
 | Customer monorepo shared | `feature/brightline/consent-v2` |
 
-Integration branches (agents push feature branches here via PR or merge — **never `main`**):
+Integration branches (agents push feature branches here via PR or merge — **never production**):
 
-| Repo type | Integration branch |
-|-----------|-------------------|
-| `se-core-product` | `dev` |
-| Customer sites | `develop` (or registry override, e.g. `extended-port`) |
+| Repo type | Integration branch | Production (human-only) |
+|-----------|-------------------|-------------------------|
+| `se-core-product` | `dev` | `main` |
+| Customer sites | `develop` (or registry override) | Usually `main`; HSD uses branch **`production`** and checkout `productionPath` |
+
+**Never** push, merge, or promote registry `productionBranch` / work in `productionPath`. Agent work uses `path` (develop checkout) only.
 
 ---
 
@@ -136,25 +138,52 @@ After the placement checklist, run the **refusal table** when the task involves
 
 ---
 
-## Step 4 — Git isolation
+## Step 4 — Git isolation (worktrees required)
+
+**Required for all projects:** any work on a `feature/*` branch must run in a **git worktree**, not the primary `dev` / `develop` checkout. This applies to se-core-product and every customer site in the registry.
 
-### Single feature in repo
+Primary checkouts (`path` / develop / dev) stay on the integration branch for fetch, deps, and short integration-only maintenance. Feature implementation always uses `worktreesRoot`.
+
+### Create worktree (mandatory for feature/*)
 
 ```bash
-cd <primary_repo>
+cd <primary_repo>   # registry path — develop/dev checkout
 git fetch origin
-git checkout -b <branch> origin/<integration-branch>
+mkdir -p <worktreesRoot>   # from registry, e.g. ~/source/customers/hopskipdrive/worktrees
+git worktree add <worktreesRoot>/<feature-slug> -b <branch> origin/<integration-branch>
+cd <worktreesRoot>/<feature-slug>
 ```
 
-### Parallel features in same repo
+| Project key | worktreesRoot |
+|-------------|---------------|
+| `se-core-product` | `~/source/se/worktrees` |
+| `se2026` | `~/source/se/worktrees` |
+| `brightline` | `~/source/customers/brightline/worktrees` |
+| `om1` | `~/source/customers/om1/worktrees` |
+| `pointme` | `~/source/customers/pointme/worktrees` |
+| `pedestal` | `~/source/customers/pedestal/worktrees` |
+| `hsd` | `~/source/customers/hopskipdrive/worktrees` |
+
+**Manifest gate:** set `worktree:` to the worktree path before coding. Do all edits, installs, tests, and commits from that path. Do not leave the primary checkout on a feature branch.
+
+### Gate — refuse primary-checkout feature work
 
-Use a **git worktree** per feature:
+If you are about to implement a feature and `worktree` is null without `worktree_opt_out: true`:
+
+1. **Stop** — create the worktree (or ask the user to confirm opt-out)
+2. Do not edit product code on the primary develop/dev checkout for a feature branch
+
+### Opt-out (narrow)
+
+Only when the user **explicitly** says work in place / no worktree **in the current conversation**:
 
 ```bash
-git worktree add <worktree-path> -b <branch> origin/<integration-branch>
+cd <primary_repo>
+git fetch origin
+git checkout -b <branch> origin/<integration-branch>
 ```
 
-Record `worktree` in manifest. Do not commit unrelated features on the same branch.
+Set `worktree: null` and `worktree_opt_out: true` in the manifest. Do not invent an opt-out.
 
 ### CMS parallel sessions
 
@@ -209,7 +238,7 @@ Agents may push to:
 - `dev` / `develop` (via feature branch merge or direct if user prefers)
 - `feature/*` branches
 
-Agents must **never** push to `main`, `master`, or production branches.
+Agents must **never** push to `main`, `master`, `production`, or any registry `productionBranch`. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`).
 
 **Preferred:** open a **draft PR** targeting the integration branch:
 
@@ -223,7 +252,7 @@ If `gh` is unavailable or user prefers direct push, push `feature/*` and note in
 
 ## Step 8 — Handoff (production-ready)
 
-When work is ready for human review / production promotion, **stop** — do not merge to `main`.
+When work is ready for human review / production promotion, **stop** — do not merge to `main`, `production`, or any production branch. **Production promotion is human-only** for core and every customer site.
 
 1. Set manifest `status: ready_for_review`
 2. Deliver handoff using template below
@@ -255,8 +284,9 @@ When work is ready for human review / production promotion, **stop** — do not
 2. <customer pnpm update @se-studio/...>
 3. <customer PR>
 
-### Production
-Ready for you to merge to `main` / promote Vercel. Agent will not push production.
+### Production (human-only)
+Ready for you to merge to production (`main` or site `productionBranch`) / promote Vercel.
+Agent will not push production or use productionPath checkouts.
 ```
 
 ---
@@ -289,20 +319,20 @@ Feature: hero-redesign
 Branch: feature/om1/hero-redesign
 ```
 
-Agent must load this skill, write manifest, run placement checklist, confirm branch/worktree, then proceed.
+Agent must load this skill, write manifest (with `worktree` path), run placement checklist, create the worktree, then proceed.
 
 ---
 
 ## Quick reference — project keys
 
-| key | Integration branch | Type |
-|-----|-------------------|------|
-| `se-core-product` | `dev` | core monorepo |
-| `se2026` | `develop` | customer |
-| `brightline` | `develop` | customer monorepo |
-| `om1` | `develop` | customer |
-| `pointme` | `develop` | customer |
-| `pedestal` | `develop` | customer monorepo |
-| `hsd-extended-port` | `extended-port` | customer |
-
-Full paths and MCP keys: `projects.registry.json`.
+| key | Integration | Production (human-only) | Type |
+|-----|-------------|-------------------------|------|
+| `se-core-product` | `dev` | `main` | core monorepo |
+| `se2026` | `develop` | `main` | customer |
+| `brightline` | `develop` | `main` | customer monorepo |
+| `om1` | `develop` | `main` | customer |
+| `pointme` | `develop` | `main` | customer |
+| `pedestal` | `develop` | `main` | customer monorepo |
+| `hsd` | `develop` (`develop-hsd-website`) | `production` (`production-hsd-website`) | customer |
+
+Full paths (`path`, `worktreesRoot`, `productionPath`), MCP keys: `projects.registry.json`.

package/skills/site-workflows-deps-update/SKILL.md

@@ -11,7 +11,7 @@ Update npm dependencies to **latest** in se-core-product and consumer repos that
 
 **Default:** Process **one repo per invocation**. At the end, summarize changes and offer the next project.
 
-**Never:** push to `main`/`master`; bump Next to 16; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead).
+**Never:** push to `main`/`master`/`production` or any production branch; promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 16; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). Production promotion is **human-only** for all customer sites.
 
 ---
 
@@ -51,11 +51,11 @@ Run that locally **before push** whenever `package.json`, lockfile, or overrides
 | `om1` | OM1 Website | `develop` |
 | `pointme` | PointMe Marketing Site | `develop` |
 | `pedestal` | Pedestal Sites | `develop` |
-| `hsd-extended-port` | HopSkipDrive Extended Port | `extended-port` |
+| `hsd` | HopSkipDrive | `develop` |
 
 User may name a key (`update deps in om1`) or ask to run through all projects sequentially.
 
-**HSD extended-port:** Parity complete (2026-07-07). Branch `extended-port`, not `develop`, until production cutover. Rollouts tracked in `work/tracker.yaml` — prefer targeted `@se-studio/*` bumps per rollout before full `pnpm update -r --latest`.
+**HSD:** Agents update **only** `~/source/customers/hopskipdrive/develop-hsd-website` on `develop`. Production is human-only: branch `production`, checkout `~/source/customers/hopskipdrive/production-hsd-website` — never push or promote from there. Prefer targeted `@se-studio/*` bumps per `work/tracker.yaml` rollout before full `pnpm update -r --latest`.
 
 ---
 
@@ -69,9 +69,10 @@ pnpm -v   # must be v11.x
 In the target repo:
 
 1. Confirm the path from the registry exists; abort if missing.
-2. `git fetch origin && git checkout <branch> && git pull`
-3. Working tree must be clean (or user explicitly approves stash).
-4. Record `pnpm outdated -r` output for the commit summary.
+2. Use the **primary integration checkout** (`path` + `branch` from deps-update registry) — deps rollouts are integration-branch maintenance, not feature work. Do not create a feature worktree unless the user asked for a feature-branch deps experiment.
+3. `git fetch origin && git checkout <branch> && git pull`
+4. Working tree must be clean (or user explicitly approves stash).
+5. Record `pnpm outdated -r` output for the commit summary.
 
 ---
 
@@ -206,7 +207,7 @@ git push origin <branch>
 
 - se-core-product → `dev`
 - All consumer repos → `develop`
-- **Never** push to `main`/`master`
+- **Never** push to `main`/`master`/`production` (or any production branch / production checkout)
 
 ---
 

package/skills/site-workflows-new-project/SKILL.md

@@ -99,7 +99,7 @@ Default mode for this repo: **site-first**.
 ### Branch policy
 
 - Agents may commit and push **`develop`** and **`feature/*`** only.
-- **Never** push to `main`, `master`, or production — human-only.
+- **Never** push to `main`, `master`, `production`, or any production branch — human-only for all customer sites.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -112,11 +112,11 @@ When work depends on a new `@se-studio/*` npm release: release from `se-core-pro
 
 ### Parallel features
 
-One feature = one `feature/<scope>/<slug>` branch. Use git worktrees for parallel work on this repo. CMS: `--session <feature-slug>`. Manifest: `~/source/se/se-core-product/work/active/<feature>.yaml`.
+One feature = one `feature/<scope>/<slug>` branch. **Git worktree required** for feature work (registry `worktreesRoot`/`<feature-slug>`). CMS: `--session <feature-slug>`. Manifest: `~/source/se/se-core-product/work/active/<feature>.yaml` with `worktree:` set.
 
 ### Production handoff
 
-Agents stop at handoff — they do not merge to `main`. See skill `site-workflows-agent-session` Step 8.
+Agents stop at handoff — they do not merge to `main` / production or promote production deploys. Human-only. See skill `site-workflows-agent-session` Step 8.
 
 ## CMS editing (cms-edit)
 

package/skills/site-workflows-stale-files-cleanup/SKILL.md

@@ -19,7 +19,7 @@ Remove **dead weight** from an SE Studio site repo without changing product beha
 
 **Default:** Plan mode first — present a classified audit table before deleting anything.
 
-**Never:** push to `main`/`master`; delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
+**Never:** push to `main`/`master`/`production` or promote production (human-only for all customer sites); delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
 
 ---
 
@@ -153,7 +153,7 @@ pnpm validate   # or repo-specific validate from AGENTS.md
 
 Commit on integration branch only. Suggested message: `chore: remove stale scripts, docs, and tooling`.
 
-Hand off production promotion to the human — never push `main`.
+Hand off production promotion to the human — never push `main` / `production` or use production checkouts to ship.
 
 ---