@se-studio/skills 1.7.4 → 1.7.6

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.7.6
+
+### Patch Changes
+
+- Customer production merges require an explicit human ask and a second confirmation (`production-merge.md`). se-core-product `main` stays never-agent.
+
+## 1.7.5
+
+### Patch Changes
+
+- 6b53e51: Document worktree `.env.local` handling: canonical store at `~/source/local-env`, no-clobber seed after `git worktree add`, 1Password as backup only (never overwrite). Seed catalogs the store, never writes through dest symlinks, and is invoked with `pnpm --dir ~/source/se/se-core-product`.
+
 ## 1.7.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/cms-edit-prod-merge.md

@@ -1,11 +1,12 @@
 # cms-edit-only production merge
 
-The **only** agent exception to “no production git”. Marketing site source, core `main`, and Vercel CLI deploys stay human-only.
+Extra path allowlist for hosted cms-edit rollouts. **Still requires** the human-ask + confirm gate in [`production-merge.md`](./production-merge.md). Marketing source, core `main`, and Vercel CLI deploys are not exempt from that confirm.
 
 ## When it applies
 
 All of the following must be true:
 
+0. [`production-merge.md`](./production-merge.md) passed (explicit ask **and** a second confirmation after restating the production merge).
 1. The user asked to ship **hosted cms-edit** (host package bump, editor-pack-only, or continue a cms-edit host rollout).
 2. Any required `@se-studio/contentful-cms` version is **already on npm**.
 3. The merge is **customer** `develop` → that site’s production branch (`main`, HSD **`production`**). Never `se-core-product` `main`.
@@ -32,4 +33,4 @@ Do **not** use HSD `production-hsd-website` (or any `productionPath`) as the wor
 
 Reconnect Grok `/mcps` → `i` is an editor step if OAuth tokens were dead — not a substitute for the health check.
 
-If the diff is not cms-edit-only, **stop and hand off** — no production merge.
+If the diff is not cms-edit-only, still merge **only** if [`production-merge.md`](./production-merge.md) passed (human ask + confirm). Do not skip confirmation because the diff is small.

package/references/agent-session/customer-agents-block.md

@@ -10,8 +10,9 @@ Default mode for this repo: **site-first**.
 
 ### Branch policy
 
-- Agents may commit and push **`develop`** and **`feature/*`**. Customer production (`main`, HSD `production`) only when the **cms-edit-only** gate passes (`se-core-product` `packages/skills/references/agent-session/cms-edit-prod-merge.md`).
-- **Never** merge marketing `src/` to production. **Never** ship from a production checkout (e.g. HSD `production-hsd-website`). Use the develop checkout only.
+- Agents may commit and push **`develop`** and **`feature/*`**.
+- Customer production (`main`, HSD `production`) **only** after the human-ask + confirm gate (`production-merge.md` in `@se-studio/skills`). The human must ask to merge integration → production in this conversation; the agent must restate site, branches, and that it publishes production; then wait for a second **yes**.
+- **Never** treat “deploy”, “ship it”, or “rollout” as permission. **Never** ship from a production checkout (e.g. HSD `production-hsd-website`). Use the develop checkout only. **Never** merge se-core-product `main`.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -53,10 +54,11 @@ Never hand-edit `package.json` dependency versions.
 - **Git worktree required** for all feature work — do not implement on the primary `develop` checkout
   - Path: registry `worktreesRoot` / `<feature-slug>` (see se-core-product `packages/skills/references/agent-session/projects.registry.json`)
   - Create: `git worktree add <worktreesRoot>/<feature-slug> -b feature/<scope>/<slug> origin/develop`
+  - Then seed env: `pnpm --dir ~/source/se/se-core-product local-env seed --project <key>` (no-clobber copy of `.env.local`; never invent a stub or symlink at develop)
   - Manifest must set `worktree:`; opt out only if the user says “work in place” / “no worktree” (`worktree_opt_out: true`)
 - CMS edits: `--session <feature-slug>` (isolate cms-edit sessions)
 - Track in-flight work: manifest at `~/source/se/se-core-product/work/active/<feature>.yaml` (or `work/active/` in this repo if core checkout unavailable)
 
 ### Production handoff
 
-When **marketing** work is ready, agents **stop** and hand off. **cms-edit-only** host rollouts may merge `develop` → production one site at a time (health-check, stop at first failure). No `vercel deploy`. See skill Step 7–8 and `cms-edit-prod-merge.md`.
+When **marketing** work is ready, agents **stop** and hand off. Merge `develop` → production only after ask + confirm (`production-merge.md`). One site at a time. No `vercel deploy`. cms-edit host extra gate: `cms-edit-prod-merge.md`.

package/references/agent-session/customer-production-agents-block.md

@@ -0,0 +1,17 @@
+# No push to `main` or production
+
+Do **not** merge or push production unless a human **asked** in this conversation to merge the integration branch to production **and** you **confirmed** that intent before merging. Canonical gate: skill `site-workflows-agent-session` → `production-merge.md` (in `@se-studio/skills`).
+
+Agents must **not**:
+
+- Run `git push origin main`, `git push origin master`, or push to any production remote branch **without** that ask + confirm
+- Merge because a workflow “must live on default branch”, CI “needs” `main`, or a production PR already exists
+- Treat “deploy”, “roll out”, or “ship it” as permission
+- Treat the first “merge develop to main” as enough — restate **site**, **branches**, and that it **publishes production**, then wait for a second **yes**
+- Use a production checkout or `vercel deploy` / `pnpm cms-edit:deploy`
+
+Agents must:
+
+- Commit and push only to **`develop`** (or another named integration branch) and `feature/*`
+- Stop when work is ready for production unless the confirm gate passed
+- Merge **one repo at a time** via `gh` from the develop checkout after confirmation

package/references/agent-session/local-env.md

@@ -0,0 +1,82 @@
+# Local env files and git worktrees
+
+Gitignored `.env.local` files do **not** copy into a new worktree. Agents then invent a stub file (two keys, missing Contentful, etc.) or symlink at develop and overwrite the canonical secrets.
+
+**Canonical doc** for this workflow. Also indexed from `docs/WORKFLOW.md`, `docs/DEVELOPMENT.md`, `AGENTS.md`, and skill `site-workflows-agent-session`.
+
+## Layout
+
+| Layer | Path | Role |
+|-------|------|------|
+| Canonical | `~/source/local-env/<project-key>/<relative-path>` | Source of truth on disk. Not a git repo. |
+| Develop checkout | registry `path` | Always-on integration branch. `init` copies from here into the store. |
+| Feature worktrees | `worktreesRoot/<slug>` | Independent **copies**. Never a symlink at develop or the store. |
+| 1Password | documents titled `local-env/<project-key>/<relative-path>` | Backup only. Create if missing. Never overwrite an existing item or checkout file. |
+
+`localEnvRoot` is set on `projects.registry.json` (`~/source/local-env`).
+
+Tracked files are whatever `.env.local` / `.env.*.local` exist on the **develop** checkout (`apps/*/.env.local` and `cms-edit/host/.env.local` included). Nested `experiments/` trees are ignored.
+
+The live Highlander repo (`highlander-health-website`, not the 2026 port) is `localEnvExtras` key `highlander-live` in the registry (not the `highlander` 2026 project). `pnpm local-env` catalogs it with the other sites.
+
+## Commands
+
+The script lives in **se-core-product**. From that repo, `pnpm local-env …` is enough. From a customer worktree, always pass `--dir`:
+
+```bash
+pnpm --dir ~/source/se/se-core-product local-env audit
+pnpm --dir ~/source/se/se-core-product local-env init
+pnpm --dir ~/source/se/se-core-product local-env seed
+pnpm --dir ~/source/se/se-core-product local-env seed --repair-subset --replace-symlinks
+pnpm --dir ~/source/se/se-core-product local-env bootstrap
+pnpm --dir ~/source/se/se-core-product local-env backup
+```
+
+`--project pointme` limits to one registry key. `--dry-run` prints actions.
+
+### After `git worktree add`
+
+```bash
+pnpm --dir ~/source/se/se-core-product local-env seed --project <key>
+```
+
+If the worktree file is a **subset** of canonical keys (typical stub), repair:
+
+```bash
+pnpm --dir ~/source/se/se-core-product local-env seed --project <key> --repair-subset --replace-symlinks
+```
+
+Subset repair copies the old file to `~/source/local-env/.bak/<project>/<relative-path>` (not next to the checkout file), then writes canonical. It does **not** touch a file that has extra keys (diverged). Production checkouts (`productionPath`) are audited only — never seeded. Default `seed` prints leftover `symlink` / `stub` / `subset` skips so a develop-symlink is not silent.
+
+### First-time machine (or after cloning develop)
+
+```bash
+pnpm --dir ~/source/se/se-core-product local-env bootstrap
+pnpm --dir ~/source/se/se-core-product local-env backup
+pnpm --dir ~/source/se/se-core-product local-env audit
+```
+
+### Rotate a token
+
+1. Edit the file in `~/source/local-env/<project>/…` (or edit develop, then `pnpm local-env init` — init will not overwrite an existing store file, so delete or rename the store file first if you mean to refresh it).
+2. `pnpm --dir ~/source/se/se-core-product local-env seed --project <key> --repair-subset` for worktrees that are a subset of the new key set.
+3. `pnpm --dir ~/source/se/se-core-product local-env backup` only creates a **new** 1Password title if missing. To refresh the backup, create a new document or edit the existing one in 1Password by hand — the command will not overwrite.
+
+## Agent rules
+
+1. After creating a worktree, seed env. Do not hand-write `.env.local`.
+2. If `.env.local` is missing, copy from `~/source/local-env/...` (or run `seed`). Never generate a two-key stub.
+3. If a file exists, leave it. Report `audit` status (`stub` / `subset` / `diverged` / `symlink`) instead of overwriting unless the user asks for `--repair-subset`.
+4. Do not symlink worktree env at develop or `~/source/local-env`.
+5. Do not `op inject` or `op document get` onto an existing checkout file. Restore to a temp path, `diff`, then copy only if the user confirms.
+6. `git worktree remove` deletes that tree’s copy. Canonical + 1Password remain.
+
+## Restore from 1Password (manual)
+
+```bash
+op document get --vault Private "local-env/pointme/.env.local" --out-file /tmp/pointme.env.local
+diff -u ~/source/local-env/pointme/.env.local /tmp/pointme.env.local
+# copy only if you intend to replace canonical, then seed
+```
+
+Older documents titled `Point.me env.local` (and similar, ~2026-03) are **stale** (fewer keys than develop). Do not restore those onto disk.

package/references/agent-session/production-merge.md

@@ -0,0 +1,61 @@
+# Customer production merge (human ask + confirm)
+
+Agents may merge a **customer** integration branch to that site’s production branch **only** when this gate passes. The point is **no automatic or accidental publishing**.
+
+This is **not** a silent exception. Two human messages in **this conversation** are required: an explicit merge request, then a separate confirmation after the agent restates what will publish.
+
+**se-core-product `main` stays never-agent.** Package releases go `dev` → CI. Do not merge core `main`.
+
+Canonical skill: `site-workflows-agent-session`. Customer `AGENTS.md` copies the short form from `customer-agents-block.md`.
+
+## Production branches
+
+| Repo | Integration | Production (Git-connected Vercel) |
+|------|-------------|-----------------------------------|
+| Customer marketing sites | `develop` (or registry override, e.g. Highlander `port-2026`) | usually `main` |
+| HopSkipDrive | `develop` | **`production`** |
+
+Never ship from a registry `productionPath` checkout. Merge with `gh` from the **develop** checkout.
+
+## Gate (all must hold)
+
+1. **Ask.** In this conversation the human named the **site or repo** and asked to merge **integration → production** (e.g. “merge develop to main”, “merge develop into production for OM1”).
+2. **Confirm.** The agent **stops**, restates the exact merge, and waits for a **second** affirmative reply (`yes` / `confirm` / `do it`) to **that** restatement. The original ask is not confirmation.
+3. **One repo.** Merge one customer repo at a time. Do not fan out “all sites to production”.
+4. **Git only.** `gh pr merge` or equivalent to `origin/<productionBranch>`. **Never** `vercel deploy`, `pnpm cms-edit:deploy`, or Netlify promote.
+
+### Restatement (required before merge)
+
+Send this shape, filled in, then wait:
+
+> You asked to merge **\<display name\>** (`\<repo\>`)  
+> `origin/<integration>` → `origin/<productionBranch>`.  
+> That publishes **production** (Git-connected Vercel).  
+> I will not merge until you reply **yes** to this message.
+
+If they say no, stop. If they name a different repo, restate again.
+
+## Not permission (do not merge)
+
+These are **not** an ask, and never count as confirmation:
+
+- “ship it”, “deploy”, “rollout”, “publish”, “go live”, “it’s ready”
+- Opening or merging a PR to `develop`
+- A production PR already existing
+- “when Vercel is green, merge it” (pre-authorisation)
+- Scheduler / previous-session leftovers
+- CI needing `main`, default-branch workflows
+- cms-edit host “must be on production” without an explicit merge request
+
+## After a confirmed merge
+
+- Wait for that site’s marketing (and cms-edit host, if Git-connected) Vercel **production** Ready.
+- Do not merge a second site until the first is Ready or the human asks again and confirms again.
+
+## cms-edit-only extra gate
+
+Hosted cms-edit rollouts still use [`cms-edit-prod-merge.md`](./cms-edit-prod-merge.md) **in addition** to this confirm gate (path allowlist, npm version, health check). Confirmation is required there too.
+
+## If the gate fails
+
+Do **not** merge. Open a PR targeting production if useful, hand off, and wait.

package/references/agent-session/projects.registry.json

@@ -10,6 +10,16 @@
     "pathPattern": "<worktreesRoot>/<feature-slug>",
     "notes": "Feature work (feature/*) must use a git worktree under the project's worktreesRoot. Primary checkouts stay on integration branches only. Opt out only if the user explicitly says work in place / no worktree in the current conversation."
   },
+  "localEnvRoot": "~/source/local-env",
+  "localEnvExtras": [
+    {
+      "key": "highlander-live",
+      "displayName": "Highlander Health (live Bond/Netlify)",
+      "path": "~/source/customers/highlander/highlander-health-website",
+      "worktreesRoot": "~/source/customers/highlander/worktrees",
+      "notes": "Live highlander-health-website, not the 2026 port. local-env only; agents still use registry key highlander for 2026 feature work."
+    }
+  ],
   "projects": [
     {
       "key": "se-core-product",
@@ -91,6 +101,18 @@
       "hostedMcp": "cms-edit-hsd",
       "validate": "pnpm validate",
       "notes": "Agents work only in path (develop) + feature worktrees under worktreesRoot. productionPath is human-only — never push production from agents."
+    },
+    {
+      "key": "highlander",
+      "displayName": "Highlander Health",
+      "path": "~/source/customers/highlander/highlander-health-website-2026",
+      "worktreesRoot": "~/source/customers/highlander/worktrees",
+      "branch": "port-2026",
+      "type": "customer",
+      "contentfulSpaceId": "bkkox68g99rn",
+      "hostedMcp": "cms-edit-highlander",
+      "validate": "pnpm check && pnpm type-check && pnpm validate:routes",
+      "notes": "New 2026 stack. Integration branch is port-2026 until go-live, then develop/main. Live Bond/Netlify site remains highlander-health-website. cms-edit DNS/OAuth for highlander.content.se.studio is a human gate."
     }
   ]
 }

package/references/deps-update/projects.registry.json

@@ -78,6 +78,16 @@
       "workspace": false,
       "hasPinOverrides": false,
       "notes": "Deps updates run on develop checkout only. Never push production branch; human promotes production-hsd-website."
+    },
+    {
+      "key": "highlander",
+      "displayName": "Highlander Health",
+      "path": "~/source/customers/highlander/highlander-health-website-2026",
+      "branch": "port-2026",
+      "validate": "pnpm check && pnpm type-check && pnpm validate:routes",
+      "workspace": true,
+      "hasPinOverrides": false,
+      "notes": "2026 port. Integration branch port-2026 until live; then develop/main."
     }
   ]
 }

package/skills/contentful-cms-regenerate-editor-pack/SKILL.md

@@ -89,11 +89,11 @@ git commit -m "chore(cms-edit): regenerate editor pack"
 
 ### Customer repo with `cms-edit/host/` (SE Studio, Pedestal, Headwater, Brightline, …)
 
-Commit `editor-pack/` (and any other `cms-edit/**` changes) and push **`develop`**. Hosted MCP Production is the marketing production branch (`main`, HSD `production`) — a **human** merge publishes. `ignoreCommand` skips `develop` and feature refs.
+Commit `editor-pack/` (and any other `cms-edit/**` changes) and push **`develop`**. Hosted MCP Production is the marketing production branch (`main`, HSD `production`). Merge there only after ask + confirm (`production-merge.md`). `ignoreCommand` skips `develop` and feature refs.
 
 ```bash
 git push origin develop
-# then hand off: human merges to main (HSD: production)
+# then production-merge.md: human asks, agent confirms, then merge to main (HSD: production)
 ```
 
 Do **not** run `pnpm cms-edit:deploy` or `vercel deploy` after this step.

package/skills/site-workflows-agent-session/SKILL.md

@@ -5,9 +5,11 @@ description: "Start and manage agent work sessions across se-core-product and cu
 
 # Agent session workflow
 
-Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. **Humans only** merge marketing production and core `main` — except **cms-edit-only** customer merges (reference `cms-edit-prod-merge.md`).
+Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. Customer production merges need a **human ask plus a second confirmation** ([`production-merge.md`](../../references/agent-session/production-merge.md)). **se-core-product `main` is never agent.**
 
-**Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, `worktreesRoot`, `productionPath` / `productionBranch`, integration branches, hosted MCP keys.
+**Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, `worktreesRoot`, `productionPath` / `productionBranch`, integration branches, hosted MCP keys, `localEnvRoot`.
+
+**Local env / worktrees:** [`local-env.md`](../../references/agent-session/local-env.md) — canonical `~/source/local-env`, no-clobber seed, 1Password backup only.
 
 **Manifest template:** [`packages/skills/references/agent-session/manifest.template.yaml`](../../references/agent-session/manifest.template.yaml)
 
@@ -60,7 +62,7 @@ Integration branches (agents push feature branches here via PR or merge — **ne
 | Repo type | Integration branch | Production |
 |-----------|-------------------|------------|
 | `se-core-product` | `dev` | `main` — **never** agent |
-| Customer sites | `develop` (or registry override) | Usually `main`; HSD **`production`**. Marketing: human-only. **cms-edit-only:** agents may merge — see below |
+| Customer sites | `develop` (or registry override) | Usually `main`; HSD **`production`**. Merge only after [`production-merge.md`](../../references/agent-session/production-merge.md) (ask + confirm) |
 
 **Never** work in `productionPath`. Agent work uses `path` (develop checkout) only.
 
@@ -151,9 +153,13 @@ cd <primary_repo>   # registry path — develop/dev checkout
 git fetch origin
 mkdir -p <worktreesRoot>   # from registry, e.g. ~/source/customers/hopskipdrive/worktrees
 git worktree add <worktreesRoot>/<feature-slug> -b <branch> origin/<integration-branch>
+# Script lives in se-core-product — do not run this from a customer worktree
+pnpm --dir ~/source/se/se-core-product local-env seed --project <project_key>
 cd <worktreesRoot>/<feature-slug>
 ```
 
+`.env.local` is gitignored and does **not** appear in a new worktree. Seed with `pnpm --dir ~/source/se/se-core-product local-env` — do not hand-write a stub and do not symlink at develop. Full rules: [`local-env.md`](../../references/agent-session/local-env.md).
+
 | Project key | worktreesRoot |
 |-------------|---------------|
 | `se-core-product` | `~/source/se/worktrees` |
@@ -163,6 +169,7 @@ cd <worktreesRoot>/<feature-slug>
 | `pointme` | `~/source/customers/pointme/worktrees` |
 | `pedestal` | `~/source/customers/pedestal/worktrees` |
 | `hsd` | `~/source/customers/hopskipdrive/worktrees` |
+| `highlander` | `~/source/customers/highlander/worktrees` |
 
 **Manifest gate:** set `worktree:` to the worktree path before coding. Do all edits, installs, tests, and commits from that path. Do not leave the primary checkout on a feature branch.
 
@@ -261,9 +268,9 @@ Agents may push to:
 
 - `dev` / `develop` (via feature branch merge or direct if user prefers)
 - `feature/*` branches
-- Customer production (`main`, HSD `production`) **only** when the [cms-edit-only gate](../../references/agent-session/cms-edit-prod-merge.md) passes
+- Customer production (`main`, HSD `production`) **only** after [`production-merge.md`](../../references/agent-session/production-merge.md): human **asked** in this conversation, agent **restated** the exact merge (site, branches, publishes production), human **confirmed** with a second yes. cms-edit host diffs also need [`cms-edit-prod-merge.md`](../../references/agent-session/cms-edit-prod-merge.md).
 
-Agents must **never** push **se-core-product** `main`, or customer production when the diff is not cms-edit-only. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`).
+Agents must **never** push **se-core-product** `main`. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`). Opening a production PR is not a merge.
 
 **Preferred:** open a **draft PR** targeting the integration branch:
 
@@ -277,7 +284,7 @@ If `gh` is unavailable or user prefers direct push, push `feature/*` and note in
 
 ## Step 8 — Handoff (production-ready)
 
-When **marketing** work is ready for production, **stop** — do not merge to `main` / `production`. **Exception:** cms-edit-only (Step 7 + [`cms-edit-prod-merge.md`](../../references/agent-session/cms-edit-prod-merge.md)) — merge one customer repo at a time, wait for cms-edit host Ready, verify `/api/health`, stop at the first failure.
+When **marketing** work is ready for production, **stop** and hand off. Do **not** merge `develop` → production unless [`production-merge.md`](../../references/agent-session/production-merge.md) passed in this conversation (ask + restatement + second yes). One customer repo at a time. cms-edit host extra gate: [`cms-edit-prod-merge.md`](../../references/agent-session/cms-edit-prod-merge.md).
 
 1. Set manifest `status: ready_for_review`
 2. Deliver handoff using template below
@@ -310,8 +317,7 @@ When **marketing** work is ready for production, **stop** — do not merge to `m
 3. <customer PR>
 
 ### Production
-Marketing: human-only (`main` or site `productionBranch`).
-cms-edit-only: agent may merge per `cms-edit-prod-merge.md` (not `productionPath`, not `vercel deploy`).
+Do not merge until the human asks **and** confirms (`production-merge.md`). Not `productionPath`, not `vercel deploy`. se-core-product `main`: never agent.
 ```
 
 ---
@@ -359,5 +365,6 @@ Agent must load this skill, write manifest (with `worktree` path), run placement
 | `pointme` | `develop` | `main` | customer |
 | `pedestal` | `develop` | `main` | customer monorepo |
 | `hsd` | `develop` (`develop-hsd-website`) | `production` (`production-hsd-website`) | customer |
+| `highlander` | `port-2026` until live, then `develop` | `main` after cutover | customer |
 
 Full paths (`path`, `worktreesRoot`, `productionPath`), MCP keys: `projects.registry.json`.

package/skills/site-workflows-deps-update/SKILL.md

@@ -11,7 +11,7 @@ Update npm dependencies to **latest** in se-core-product and consumer repos that
 
 **Default:** Process **one repo per invocation**. At the end, summarize changes and offer the next project.
 
-**Never:** push to `main`/`master`/`production` or any production branch; promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 17; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). Production promotion is **human-only** for all customer sites. All marketing sites pin `overrides.next` to `^16.3.x`.
+**Never:** push to `main`/`master`/`production` unless `production-merge.md` passed (ask + confirm); promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 17; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). This skill pushes `dev`/`develop` only. All marketing sites pin `overrides.next` to `^16.3.x`.
 
 ---
 
@@ -235,7 +235,7 @@ git push origin <branch>
 
 - se-core-product → `dev`
 - All consumer repos → `develop`
-- **Never** push to `main`/`master`/`production` (or any production branch / production checkout)
+- **Never** push to `main`/`master`/`production` from this skill (deps stay on `dev`/`develop`)
 
 ---
 

package/skills/site-workflows-new-project/SKILL.md

@@ -140,8 +140,8 @@ Default mode for this repo: **site-first**.
 
 ### Branch policy
 
-- Agents may commit and push **`develop`** and **`feature/*`** only.
-- **Never** push to `main`, `master`, `production`, or any production branch — human-only for all customer sites.
+- Agents may commit and push **`develop`** and **`feature/*`**.
+- Customer production only after human **ask + confirm** (`production-merge.md`). Never se-core-product `main`.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -158,7 +158,7 @@ One feature = one `feature/<scope>/<slug>` branch. **Git worktree required** for
 
 ### Production handoff
 
-Agents stop at handoff for **marketing** production. cms-edit-only host merges: see `site-workflows-agent-session` and `cms-edit-prod-merge.md`.
+Agents stop at handoff unless the human asks to merge to production **and** confirms (`production-merge.md`).
 
 ## CMS editing (cms-edit)
 

package/skills/site-workflows-stale-files-cleanup/SKILL.md

@@ -19,7 +19,7 @@ Remove **dead weight** from an SE Studio site repo without changing product beha
 
 **Default:** Plan mode first — present a classified audit table before deleting anything.
 
-**Never:** push marketing production or use production checkouts (cms-edit-only gate is in `cms-edit-prod-merge.md`); delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
+**Never:** merge production without `production-merge.md` (ask + confirm); use production checkouts; delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
 
 ---
 
@@ -153,7 +153,7 @@ pnpm validate   # or repo-specific validate from AGENTS.md
 
 Commit on integration branch only. Suggested message: `chore: remove stale scripts, docs, and tooling`.
 
-Hand off **marketing** production. Do not use production checkouts. cms-edit-only: `cms-edit-prod-merge.md`.
+Hand off marketing production unless `production-merge.md` passed. Do not use production checkouts.
 
 ---