@se-studio/skills 1.6.1 → 1.6.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @se-studio/skills
 
+## 1.6.2
+
+### Patch Changes
+
+- 928562f: CMS showcase: controls closed by default (`?controls=true`), map control keys to usedFields, string mock body → rich text, placeholder visuals, iframe height shrink/caps, External video for Vimeo/YouTube mock URLs, `showcaseLayout` registration + fixed preview frames, and helpers `isCmsShowcase` / `articlesFromShowcaseContents` / `peopleFromShowcaseContents` for related-content collections. Skills: curate-showcase-mocks video URL and no-LLM notes.
+
 ## 1.6.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/customer-agents-block.md

@@ -7,7 +7,8 @@ Default mode for this repo: **site-first**.
 ### Branch policy
 
 - Agents may commit and push **`develop`** and **`feature/*`** only.
-- **Never** push to `main`, `master`, or production — human-only.
+- **Never** push to `main`, `master`, `production`, or any production branch — **human-only** for all customer sites.
+- Do **not** ship from a production checkout (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`). Use the develop checkout only.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -46,10 +47,13 @@ Never hand-edit `package.json` dependency versions.
 ### Parallel features
 
 - One feature = one `feature/<scope>/<slug>` branch
-- Use a **git worktree** when multiple features touch this repo at once
+- **Git worktree required** for all feature work — do not implement on the primary `develop` checkout
+  - Path: registry `worktreesRoot` / `<feature-slug>` (see se-core-product `packages/skills/references/agent-session/projects.registry.json`)
+  - Create: `git worktree add <worktreesRoot>/<feature-slug> -b feature/<scope>/<slug> origin/develop`
+  - Manifest must set `worktree:`; opt out only if the user says “work in place” / “no worktree” (`worktree_opt_out: true`)
 - CMS edits: `--session <feature-slug>` (isolate cms-edit sessions)
 - Track in-flight work: manifest at `~/source/se/se-core-product/work/active/<feature>.yaml` (or `work/active/` in this repo if core checkout unavailable)
 
 ### Production handoff
 
-When ready for production, agents **stop** and deliver a handoff note — they do not merge to `main`. See skill Step 8.
+When ready for production, agents **stop** and deliver a handoff note — they do not merge to `main` / `production` or promote Vercel/Netlify. Production promotion is always **human-only**. See skill Step 8.

package/references/agent-session/manifest.template.yaml

@@ -6,7 +6,10 @@ mode: site-first # core-first | site-first
 project_key: om1
 primary_repo: ~/source/customers/om1/om1-website
 branch: feature/om1/my-feature-slug
-worktree: null # e.g. ~/source/worktrees/om1-my-feature-slug — required when parallel features share a repo
+# REQUIRED for feature/* work — path under registry worktreesRoot (e.g. ~/source/customers/om1/worktrees/my-feature-slug).
+# null only when user explicitly opts out of worktrees in this conversation (record worktree_opt_out: true).
+worktree: ~/source/customers/om1/worktrees/my-feature-slug
+worktree_opt_out: false
 integration_branch: develop
 
 related_repos:
@@ -31,4 +34,4 @@ updated_at: 2026-07-05
 
 validation: []
 
-handoff: null
+handoff: null

package/references/agent-session/projects.registry.json

@@ -5,11 +5,17 @@
     "customer": "develop"
   },
   "branchPattern": "feature/<scope>/<short-slug>",
+  "worktrees": {
+    "requiredForFeatureBranches": true,
+    "pathPattern": "<worktreesRoot>/<feature-slug>",
+    "notes": "Feature work (feature/*) must use a git worktree under the project's worktreesRoot. Primary checkouts stay on integration branches only. Opt out only if the user explicitly says work in place / no worktree in the current conversation."
+  },
   "projects": [
     {
       "key": "se-core-product",
       "displayName": "SE Core Product",
       "path": "~/source/se/se-core-product",
+      "worktreesRoot": "~/source/se/worktrees",
       "branch": "dev",
       "type": "core",
       "validate": "pnpm validate",
@@ -19,6 +25,7 @@
       "key": "se2026",
       "displayName": "SE Studio Site",
       "path": "~/source/se/se-website-2026",
+      "worktreesRoot": "~/source/se/worktrees",
       "branch": "develop",
       "type": "customer",
       "contentfulSpaceId": "g0pw3n92bre6",
@@ -29,6 +36,7 @@
       "key": "brightline",
       "displayName": "Brightline Sites",
       "path": "~/source/customers/brightline/brightline-sites",
+      "worktreesRoot": "~/source/customers/brightline/worktrees",
       "branch": "develop",
       "type": "customer-monorepo",
       "sharedPackage": "@brightline/shared",
@@ -40,6 +48,7 @@
       "key": "om1",
       "displayName": "OM1 Website",
       "path": "~/source/customers/om1/om1-website",
+      "worktreesRoot": "~/source/customers/om1/worktrees",
       "branch": "develop",
       "type": "customer",
       "contentfulSpaceId": "ddhe5ahaolzf",
@@ -50,6 +59,7 @@
       "key": "pointme",
       "displayName": "PointMe Marketing Site",
       "path": "~/source/customers/pointme/develop-marketing-site",
+      "worktreesRoot": "~/source/customers/pointme/worktrees",
       "branch": "develop",
       "type": "customer",
       "contentfulSpaceId": "alwdzgjlz5qv",
@@ -60,6 +70,7 @@
       "key": "pedestal",
       "displayName": "Pedestal Sites",
       "path": "~/source/customers/pedestal/pedestal-sites",
+      "worktreesRoot": "~/source/customers/pedestal/worktrees",
       "branch": "develop",
       "type": "customer-monorepo",
       "sharedPackage": "@pedestal/site-common",
@@ -68,14 +79,18 @@
       "validate": "pnpm -r validate"
     },
     {
-      "key": "hsd-extended-port",
-      "displayName": "HopSkipDrive Extended Port",
-      "path": "~/source/customers/hopskipdrive/hsd-extended-port",
-      "branch": "extended-port",
+      "key": "hsd",
+      "displayName": "HopSkipDrive",
+      "path": "~/source/customers/hopskipdrive/develop-hsd-website",
+      "productionPath": "~/source/customers/hopskipdrive/production-hsd-website",
+      "worktreesRoot": "~/source/customers/hopskipdrive/worktrees",
+      "branch": "develop",
+      "productionBranch": "production",
       "type": "customer",
-      "contentfulSpaceIds": ["gqa3p93n5wse"],
-      "hostedMcp": ["cms-edit-hsd"],
-      "validate": "pnpm validate"
+      "contentfulSpaceId": "gqa3p93n5wse",
+      "hostedMcp": "cms-edit-hsd",
+      "validate": "pnpm validate",
+      "notes": "Agents work only in path (develop) + feature worktrees under worktreesRoot. productionPath is human-only — never push production from agents."
     }
   ]
 }

package/references/deployment-smoke-feature-branch-skip/README.md

@@ -16,7 +16,7 @@ Vercel **Deployment Checks** wait for a GitHub status from the smoke workflow. O
 | Repo type | Preview smoke ref | Production smoke ref |
 |-----------|-------------------|----------------------|
 | Most customer sites | `develop` | `main` |
-| HopSkipDrive extended-port | `extended-port` | `main` (if production checks enabled) |
+| HopSkipDrive (`hsd`) | `develop` (`develop-hsd-website`) | `production` (`production-hsd-website`, human-only) |
 | se-core-product apps | `dev` | `main` |
 
 Use `client_payload.git.ref` (branch name, not `refs/heads/...` — verify per project in a test dispatch).
@@ -33,7 +33,7 @@ Feature-branch PRs also trigger cms-edit Vercel projects. Skip builds outside in
 "ignoreCommand": "if [ \"$VERCEL_GIT_COMMIT_REF\" != \"develop\" ] && [ \"$VERCEL_GIT_COMMIT_REF\" != \"main\" ]; then exit 0; fi; git diff HEAD^ HEAD --quiet -- . ../ ../../pnpm-lock.yaml ../../pnpm-workspace.yaml ../../package.json || exit 1; exit 0"
 ```
 
-Replace `develop` with your integration branch (e.g. `extended-port`).
+Replace `develop` with your integration branch if the registry uses a different name.
 
 ## Rollout status
 
@@ -44,7 +44,7 @@ Replace `develop` with your integration branch (e.g. `extended-port`).
 | om1-website | audit | audit |
 | pedestal-sites | audit | audit |
 | pointme | audit | audit |
-| hsd-extended-port | audit | n/a |
+| hsd | audit | audit (align ignoreCommand with `develop`) |
 
 Update this table when applying the pattern.
 

package/references/deps-update/projects.registry.json

@@ -68,14 +68,16 @@
       "hasPinOverrides": false
     },
     {
-      "key": "hsd-extended-port",
-      "displayName": "HopSkipDrive Extended Port",
-      "path": "~/source/customers/hopskipdrive/hsd-extended-port",
-      "branch": "extended-port",
-      "wipNote": "Parity port complete (2026-07-07). Work on extended-port only — not develop/production until cutover. Rollouts tracked in work/tracker.yaml.",
+      "key": "hsd",
+      "displayName": "HopSkipDrive",
+      "path": "~/source/customers/hopskipdrive/develop-hsd-website",
+      "productionPath": "~/source/customers/hopskipdrive/production-hsd-website",
+      "branch": "develop",
+      "productionBranch": "production",
       "validate": "pnpm validate",
       "workspace": false,
-      "hasPinOverrides": false
+      "hasPinOverrides": false,
+      "notes": "Deps updates run on develop checkout only. Never push production branch; human promotes production-hsd-website."
     }
   ]
 }

package/references/lockfile-sync/README.md

@@ -50,6 +50,6 @@ Apply the full stack when touching deps or CI in each repo:
 | om1-website | — | — | — | — |
 | se-website-2026 | yes | yes | yes | yes |
 | pointme | — | — | — | — |
-| hsd-extended-port | yes | yes (extended-port) | n/a | yes |
+| hsd (`develop-hsd-website`; prod human-only: `production-hsd-website`) | yes | yes (develop) | n/a | yes |
 
 Update this table as repos adopt the pattern.

package/skills/se-marketing-sites-curate-showcase-mocks/SKILL.md

@@ -259,16 +259,22 @@ Use the LLM draft as the starting point and apply your corrections from Step 4.
 
 **Rules for the output:**
 - Set `curatedAt` to the current ISO timestamp
-- Only include types that have real CMS data
+- Only include types that have real CMS data **for this brand** (do not leave SE Studio leftovers in a customer `showcase-mocks.json`)
 - For component mocks: include only fields present in the source data
-- For collection mocks: always include `mock` and `cards`
+- For collection mocks: always include `mock` and `cards` when the collection needs list content
 - Rich Text body fields must be `{ "json": <Document> }` — copy as-is
 - Visual fields must include `width`, `height`, AND `url` — never strip `url`
+- **`visual.url` must be an image CDN URL** (e.g. `images.ctfassets.net`). **Do not** put `vimeo.com` / `youtube.com` page URLs in image visuals — either omit the type’s curated visual (let a site video mock handle embeds) or store video only for true video modules (core factory can map video hosts to External video)
 - Include `widthPercent` when present on media/externalVideo entries
 - Include `otherMedia` when present — copy the full array including `url` and `widthPercent`
 - Do NOT invent or modify content — use the real data from the examples file
 - Include `backgroundColour` and `textColour` where the source has them
 - For cards: include ALL fields present in source, including `backgroundColour`, `textColour`, `links`
+- For news/author collections that use `getRelatedArticles` / `getRelatedPeople`: ensure `cards` have real titles/headings (and visuals when available). Sites should use `articlesFromShowcaseContents` / `peopleFromShowcaseContents` from `@se-studio/core-ui` when fetch returns empty in showcase
+
+### Step 2b — No LLM key (optional)
+
+If `OPENAI_API_KEY` / `ANTHROPIC_API_KEY` is missing, skip Step 2 and pick the highest-`fieldCompleteness` example per type from `showcase-examples.json` (prefer examples with `visual.url` when the type uses media). Write `showcase-mocks.json` directly.
 
 ### Step 6 — Verify
 
@@ -276,7 +282,8 @@ After writing, briefly confirm:
 - The file is valid JSON
 - Component and collection counts look reasonable (non-zero)
 - Key types (Hero, main collections) have entries
-- Visual fields include `url` properties
+- Visual fields include `url` properties that are **image** hosts (not player pages)
+- Spot-check related collections in the browser (News Carousel, Authors Grid) — not only Feature Split
 
 ---
 

package/skills/se-marketing-sites-smoke-test-setup/SKILL.md

@@ -56,8 +56,7 @@ Example `package.json` entries:
 
 **Vercel Deployment Check (live URL)** — GitHub Action on `vercel.deployment.ready` tests `client_payload.url` before production domains alias. Workflow must live on the repo **default branch**. Register the status `name` in Vercel → Settings → Build and Deployment → Deployment Checks.
 
-**Feature branches must not run smoke** — limit the `smoke` job to integration preview (`develop` + `preview`) and production (`main` + `production`). Feature-branch previews still fire `repository_dispatch`; without a matching job, Vercel waits forever on "Waiting for checks". Add a `skip-smoke-outside-integration-branches` job that posts **success** for non-integration refs. Full rollout guide: [`references/deployment-smoke-feature-branch-skip/`](../../references/deployment-smoke-feature-branch-skip/README.md). Monorepos: one skip job per Vercel project workflow. Non-`develop` integration branches (e.g. HSD `extended-port`): adjust ref checks in both jobs.
-
+**Feature branches must not run smoke** — limit the `smoke` job to integration preview (`develop` + `preview`) and production (`main` / `production` + `production`). Feature-branch previews still fire `repository_dispatch`; without a matching job, Vercel waits forever on "Waiting for checks". Add a `skip-smoke-outside-integration-branches` job that posts **success** for non-integration refs. Full rollout guide: [`references/deployment-smoke-feature-branch-skip/`](../../references/deployment-smoke-feature-branch-skip/README.md). Monorepos: one skip job per Vercel project workflow. Sites whose production branch is not `main` (e.g. HSD `production`): adjust ref checks in both jobs.
 Filter on `client_payload.environment == 'production'` when Deployment Checks target production only. Vercel also dispatches for preview and custom environments (`preview`, `develop`, etc.); skip those to avoid duplicate CI runs. Use `workflow_dispatch` without an environment filter for manual smoke against any URL.
 
 ```yaml

package/skills/site-workflows-agent-session/SKILL.md

@@ -5,9 +5,9 @@ description: "Start and manage agent work sessions across se-core-product and cu
 
 # Agent session workflow
 
-Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. Human merges to `main` / production — agents stop at handoff.
+Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. **Humans only** merge/promote to `main` / production (all customer sites + core) — agents stop at handoff.
 
-**Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, integration branches, hosted MCP keys.
+**Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, `worktreesRoot`, `productionPath` / `productionBranch`, integration branches, hosted MCP keys.
 
 **Manifest template:** [`packages/skills/references/agent-session/manifest.template.yaml`](../../references/agent-session/manifest.template.yaml)
 
@@ -39,7 +39,7 @@ Collect or infer:
 | `project_key` | Yes | From registry (`om1`, `se-core-product`, `pedestal`, …) |
 | `primary_repo` | Yes | Absolute path from registry |
 | `branch` | Yes | `feature/<scope>/<slug>` — see naming below |
-| `worktree` | Optional | Separate checkout path when parallel features share a repo |
+| `worktree` | **Yes** (feature work) | Path under registry `worktreesRoot`/`<feature-slug>`. Required for `feature/*`. Null only with explicit user opt-out + `worktree_opt_out: true` |
 
 **Default mode if unclear:** ask once. Site-specific UI/content → `site-first`. Package/framework/multi-site → `core-first`.
 
@@ -55,12 +55,14 @@ feature/<scope>/<short-slug>
 | Customer site | `feature/om1/hero-redesign` |
 | Customer monorepo shared | `feature/brightline/consent-v2` |
 
-Integration branches (agents push feature branches here via PR or merge — **never `main`**):
+Integration branches (agents push feature branches here via PR or merge — **never production**):
 
-| Repo type | Integration branch |
-|-----------|-------------------|
-| `se-core-product` | `dev` |
-| Customer sites | `develop` (or registry override, e.g. `extended-port`) |
+| Repo type | Integration branch | Production (human-only) |
+|-----------|-------------------|-------------------------|
+| `se-core-product` | `dev` | `main` |
+| Customer sites | `develop` (or registry override) | Usually `main`; HSD uses branch **`production`** and checkout `productionPath` |
+
+**Never** push, merge, or promote registry `productionBranch` / work in `productionPath`. Agent work uses `path` (develop checkout) only.
 
 ---
 
@@ -136,25 +138,52 @@ After the placement checklist, run the **refusal table** when the task involves
 
 ---
 
-## Step 4 — Git isolation
+## Step 4 — Git isolation (worktrees required)
+
+**Required for all projects:** any work on a `feature/*` branch must run in a **git worktree**, not the primary `dev` / `develop` checkout. This applies to se-core-product and every customer site in the registry.
 
-### Single feature in repo
+Primary checkouts (`path` / develop / dev) stay on the integration branch for fetch, deps, and short integration-only maintenance. Feature implementation always uses `worktreesRoot`.
+
+### Create worktree (mandatory for feature/*)
 
 ```bash
-cd <primary_repo>
+cd <primary_repo>   # registry path — develop/dev checkout
 git fetch origin
-git checkout -b <branch> origin/<integration-branch>
+mkdir -p <worktreesRoot>   # from registry, e.g. ~/source/customers/hopskipdrive/worktrees
+git worktree add <worktreesRoot>/<feature-slug> -b <branch> origin/<integration-branch>
+cd <worktreesRoot>/<feature-slug>
 ```
 
-### Parallel features in same repo
+| Project key | worktreesRoot |
+|-------------|---------------|
+| `se-core-product` | `~/source/se/worktrees` |
+| `se2026` | `~/source/se/worktrees` |
+| `brightline` | `~/source/customers/brightline/worktrees` |
+| `om1` | `~/source/customers/om1/worktrees` |
+| `pointme` | `~/source/customers/pointme/worktrees` |
+| `pedestal` | `~/source/customers/pedestal/worktrees` |
+| `hsd` | `~/source/customers/hopskipdrive/worktrees` |
+
+**Manifest gate:** set `worktree:` to the worktree path before coding. Do all edits, installs, tests, and commits from that path. Do not leave the primary checkout on a feature branch.
+
+### Gate — refuse primary-checkout feature work
 
-Use a **git worktree** per feature:
+If you are about to implement a feature and `worktree` is null without `worktree_opt_out: true`:
+
+1. **Stop** — create the worktree (or ask the user to confirm opt-out)
+2. Do not edit product code on the primary develop/dev checkout for a feature branch
+
+### Opt-out (narrow)
+
+Only when the user **explicitly** says work in place / no worktree **in the current conversation**:
 
 ```bash
-git worktree add <worktree-path> -b <branch> origin/<integration-branch>
+cd <primary_repo>
+git fetch origin
+git checkout -b <branch> origin/<integration-branch>
 ```
 
-Record `worktree` in manifest. Do not commit unrelated features on the same branch.
+Set `worktree: null` and `worktree_opt_out: true` in the manifest. Do not invent an opt-out.
 
 ### CMS parallel sessions
 
@@ -209,7 +238,7 @@ Agents may push to:
 - `dev` / `develop` (via feature branch merge or direct if user prefers)
 - `feature/*` branches
 
-Agents must **never** push to `main`, `master`, or production branches.
+Agents must **never** push to `main`, `master`, `production`, or any registry `productionBranch`. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`).
 
 **Preferred:** open a **draft PR** targeting the integration branch:
 
@@ -223,7 +252,7 @@ If `gh` is unavailable or user prefers direct push, push `feature/*` and note in
 
 ## Step 8 — Handoff (production-ready)
 
-When work is ready for human review / production promotion, **stop** — do not merge to `main`.
+When work is ready for human review / production promotion, **stop** — do not merge to `main`, `production`, or any production branch. **Production promotion is human-only** for core and every customer site.
 
 1. Set manifest `status: ready_for_review`
 2. Deliver handoff using template below
@@ -255,8 +284,9 @@ When work is ready for human review / production promotion, **stop** — do not
 2. <customer pnpm update @se-studio/...>
 3. <customer PR>
 
-### Production
-Ready for you to merge to `main` / promote Vercel. Agent will not push production.
+### Production (human-only)
+Ready for you to merge to production (`main` or site `productionBranch`) / promote Vercel.
+Agent will not push production or use productionPath checkouts.
 ```
 
 ---
@@ -289,20 +319,20 @@ Feature: hero-redesign
 Branch: feature/om1/hero-redesign
 ```
 
-Agent must load this skill, write manifest, run placement checklist, confirm branch/worktree, then proceed.
+Agent must load this skill, write manifest (with `worktree` path), run placement checklist, create the worktree, then proceed.
 
 ---
 
 ## Quick reference — project keys
 
-| key | Integration branch | Type |
-|-----|-------------------|------|
-| `se-core-product` | `dev` | core monorepo |
-| `se2026` | `develop` | customer |
-| `brightline` | `develop` | customer monorepo |
-| `om1` | `develop` | customer |
-| `pointme` | `develop` | customer |
-| `pedestal` | `develop` | customer monorepo |
-| `hsd-extended-port` | `extended-port` | customer |
-
-Full paths and MCP keys: `projects.registry.json`.
+| key | Integration | Production (human-only) | Type |
+|-----|-------------|-------------------------|------|
+| `se-core-product` | `dev` | `main` | core monorepo |
+| `se2026` | `develop` | `main` | customer |
+| `brightline` | `develop` | `main` | customer monorepo |
+| `om1` | `develop` | `main` | customer |
+| `pointme` | `develop` | `main` | customer |
+| `pedestal` | `develop` | `main` | customer monorepo |
+| `hsd` | `develop` (`develop-hsd-website`) | `production` (`production-hsd-website`) | customer |
+
+Full paths (`path`, `worktreesRoot`, `productionPath`), MCP keys: `projects.registry.json`.

package/skills/site-workflows-deps-update/SKILL.md

@@ -11,7 +11,7 @@ Update npm dependencies to **latest** in se-core-product and consumer repos that
 
 **Default:** Process **one repo per invocation**. At the end, summarize changes and offer the next project.
 
-**Never:** push to `main`/`master`; bump Next to 16; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead).
+**Never:** push to `main`/`master`/`production` or any production branch; promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 16; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). Production promotion is **human-only** for all customer sites.
 
 ---
 
@@ -51,11 +51,11 @@ Run that locally **before push** whenever `package.json`, lockfile, or overrides
 | `om1` | OM1 Website | `develop` |
 | `pointme` | PointMe Marketing Site | `develop` |
 | `pedestal` | Pedestal Sites | `develop` |
-| `hsd-extended-port` | HopSkipDrive Extended Port | `extended-port` |
+| `hsd` | HopSkipDrive | `develop` |
 
 User may name a key (`update deps in om1`) or ask to run through all projects sequentially.
 
-**HSD extended-port:** Parity complete (2026-07-07). Branch `extended-port`, not `develop`, until production cutover. Rollouts tracked in `work/tracker.yaml` — prefer targeted `@se-studio/*` bumps per rollout before full `pnpm update -r --latest`.
+**HSD:** Agents update **only** `~/source/customers/hopskipdrive/develop-hsd-website` on `develop`. Production is human-only: branch `production`, checkout `~/source/customers/hopskipdrive/production-hsd-website` — never push or promote from there. Prefer targeted `@se-studio/*` bumps per `work/tracker.yaml` rollout before full `pnpm update -r --latest`.
 
 ---
 
@@ -69,9 +69,10 @@ pnpm -v   # must be v11.x
 In the target repo:
 
 1. Confirm the path from the registry exists; abort if missing.
-2. `git fetch origin && git checkout <branch> && git pull`
-3. Working tree must be clean (or user explicitly approves stash).
-4. Record `pnpm outdated -r` output for the commit summary.
+2. Use the **primary integration checkout** (`path` + `branch` from deps-update registry) — deps rollouts are integration-branch maintenance, not feature work. Do not create a feature worktree unless the user asked for a feature-branch deps experiment.
+3. `git fetch origin && git checkout <branch> && git pull`
+4. Working tree must be clean (or user explicitly approves stash).
+5. Record `pnpm outdated -r` output for the commit summary.
 
 ---
 
@@ -206,7 +207,7 @@ git push origin <branch>
 
 - se-core-product → `dev`
 - All consumer repos → `develop`
-- **Never** push to `main`/`master`
+- **Never** push to `main`/`master`/`production` (or any production branch / production checkout)
 
 ---
 

package/skills/site-workflows-new-project/SKILL.md

@@ -99,7 +99,7 @@ Default mode for this repo: **site-first**.
 ### Branch policy
 
 - Agents may commit and push **`develop`** and **`feature/*`** only.
-- **Never** push to `main`, `master`, or production — human-only.
+- **Never** push to `main`, `master`, `production`, or any production branch — human-only for all customer sites.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -112,11 +112,11 @@ When work depends on a new `@se-studio/*` npm release: release from `se-core-pro
 
 ### Parallel features
 
-One feature = one `feature/<scope>/<slug>` branch. Use git worktrees for parallel work on this repo. CMS: `--session <feature-slug>`. Manifest: `~/source/se/se-core-product/work/active/<feature>.yaml`.
+One feature = one `feature/<scope>/<slug>` branch. **Git worktree required** for feature work (registry `worktreesRoot`/`<feature-slug>`). CMS: `--session <feature-slug>`. Manifest: `~/source/se/se-core-product/work/active/<feature>.yaml` with `worktree:` set.
 
 ### Production handoff
 
-Agents stop at handoff — they do not merge to `main`. See skill `site-workflows-agent-session` Step 8.
+Agents stop at handoff — they do not merge to `main` / production or promote production deploys. Human-only. See skill `site-workflows-agent-session` Step 8.
 
 ## CMS editing (cms-edit)
 

package/skills/site-workflows-stale-files-cleanup/SKILL.md

@@ -19,7 +19,7 @@ Remove **dead weight** from an SE Studio site repo without changing product beha
 
 **Default:** Plan mode first — present a classified audit table before deleting anything.
 
-**Never:** push to `main`/`master`; delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
+**Never:** push to `main`/`master`/`production` or promote production (human-only for all customer sites); delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
 
 ---
 
@@ -153,7 +153,7 @@ pnpm validate   # or repo-specific validate from AGENTS.md
 
 Commit on integration branch only. Suggested message: `chore: remove stale scripts, docs, and tooling`.
 
-Hand off production promotion to the human — never push `main`.
+Hand off production promotion to the human — never push `main` / `production` or use production checkouts to ship.
 
 ---