@se-studio/skills 1.7.8 → 1.7.10

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.7.10
+
+### Patch Changes
+
+- 9dd8d68: Drop the work/active yaml session ledger. In-flight work is open PRs (including cloud) and local git worktrees. Customer-only work must not write files in se-core-product; shared behaviour still belongs in packages, not a one-site fork.
+
+## 1.7.9
+
+### Patch Changes
+
+- Stop applying 2px video overscan by default (`edgeOverscan` opt-in). Remove ImageKit/HLS. CMS local files are mute-loop packs only (click-to-play is YouTube/Vimeo). Raise mute-loop max duration to 2 minutes. Drop `videoPrefix`.
+
 ## 1.7.8
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.7.8",
+  "version": "1.7.10",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/customer-agents-block.md

@@ -27,7 +27,7 @@ Before non-trivial code, run the placement checklist (in the skill). Summary:
 | **Customer shared package** (if monorepo) | Consent/analytics shared across sites in this customer |
 | **`se-core-product`** (`@se-studio/*`) | Fixes/features needed by 2+ sites, CMS infrastructure |
 
-If the checklist says **core**, stop and switch to core-first mode — do not patch `@se-studio` behaviour in this repo.
+If the checklist says **core**, stop and switch to core-first mode — do not patch `@se-studio` behaviour in this repo. Shared converters, Visual/video delivery, cms-edit runtime, sitemap helpers, and site-check assertions belong in core, not a one-site fork.
 
 ### Deploy smoke failed?
 
@@ -37,7 +37,7 @@ Do **not** change `baseUrl`, discovery routes, or add `getRequestBaseUrl()` to u
 2. Bump `@se-studio/site-check@2.9.4+` after npm publish (`discovery.urlOrigin: auto`)
 3. Customer-only: curate new URLs in `smoke.cases.json` when CMS routes go live — not package assertion hacks
 
-Record `placement.decision` in `work/active/<feature>.yaml` before smoke/server-config commits aimed at deploy smoke.
+State placement in chat (and the PR) before smoke/server-config commits aimed at deploy smoke. Do not write files in se-core-product for customer-only work.
 
 ### Core release order
 
@@ -53,13 +53,14 @@ Never hand-edit `package.json` dependency versions.
 ### Parallel features
 
 - One feature = one `feature/<scope>/<slug>` branch
-- **Git worktree required** for all feature work — do not implement on the primary `develop` checkout
+- **Local git worktree** for feature work — do not implement on the primary `develop` checkout
   - Path: registry `worktreesRoot` / `<feature-slug>` (see se-core-product `packages/skills/references/agent-session/projects.registry.json`)
   - Create: `git worktree add <worktreesRoot>/<feature-slug> -b feature/<scope>/<slug> origin/develop`
   - Then seed env: `pnpm --dir ~/source/se/se-core-product local-env seed --project <key>` (no-clobber copy of `.env.local`; never invent a stub or symlink at develop)
-  - Manifest must set `worktree:`; opt out only if the user says “work in place” / “no worktree” (`worktree_opt_out: true`)
+  - Opt out only if the user says “work in place” / “no worktree”
+- **Cloud agents:** draft PR to `develop` (that is the ledger; do not write yaml in se-core-product)
 - CMS edits: `--session <feature-slug>` (isolate cms-edit sessions)
-- Track in-flight work: manifest at `~/source/se/se-core-product/work/active/<feature>.yaml` (or `work/active/` in this repo if core checkout unavailable)
+- In-flight work: open PRs + local `git worktree list`
 
 ### Production handoff
 

package/references/agent-session/production-merge.md

@@ -12,7 +12,7 @@ Canonical skill: `site-workflows-agent-session`. Customer `AGENTS.md` copies the
 
 | Repo | Integration | Production (Git-connected Vercel) |
 |------|-------------|-----------------------------------|
-| Customer marketing sites | `develop` (or registry override, e.g. Highlander `port-2026`) | usually `main` |
+| Customer marketing sites | `develop` | usually `main` |
 | HopSkipDrive | `develop` | **`production`** |
 
 Never ship from a registry `productionPath` checkout. Merge with `gh` from the **develop** checkout.

package/references/agent-session/projects.registry.json

@@ -1,14 +1,14 @@
 {
-  "manifestPath": "work/active/<feature>.yaml",
   "integrationBranches": {
     "core": "dev",
     "customer": "develop"
   },
   "branchPattern": "feature/<scope>/<short-slug>",
+  "ledger": "Open PRs to dev/develop (all machines, including cloud) plus local git worktrees. No work/active yaml.",
   "worktrees": {
-    "requiredForFeatureBranches": true,
+    "requiredForLocalFeatureBranches": true,
     "pathPattern": "<worktreesRoot>/<feature-slug>",
-    "notes": "Feature work (feature/*) must use a git worktree under the project's worktreesRoot. Primary checkouts stay on integration branches only. Opt out only if the user explicitly says work in place / no worktree in the current conversation."
+    "notes": "Local feature/* work uses a git worktree under the project's worktreesRoot. Cloud agents use their VM checkout and a draft PR. Primary checkouts stay on integration branches. Opt out of local worktrees only if the user explicitly says work in place / no worktree in the current conversation."
   },
   "localEnvRoot": "~/source/local-env",
   "localEnvExtras": [
@@ -107,12 +107,13 @@
       "displayName": "Highlander Health",
       "path": "~/source/customers/highlander/highlander-health-website-2026",
       "worktreesRoot": "~/source/customers/highlander/worktrees",
-      "branch": "port-2026",
+      "branch": "develop",
+      "productionBranch": "main",
       "type": "customer",
       "contentfulSpaceId": "bkkox68g99rn",
       "hostedMcp": "cms-edit-highlander",
       "validate": "pnpm check && pnpm type-check && pnpm validate:routes",
-      "notes": "New 2026 stack. Integration branch is port-2026 until go-live, then develop/main. Live Bond/Netlify site remains highlander-health-website. cms-edit DNS/OAuth for highlander.content.se.studio is a human gate."
+      "notes": "2026 stack is live on Vercel (develop preview, main production alias). Public DNS is still Bond/Netlify highlanderhealth.com until cutover. cms-edit DNS/OAuth for highlander.content.se.studio is a human gate."
     }
   ]
 }

package/references/agent-session/refuse-customer-patches.md

@@ -1,17 +1,19 @@
 # Refuse customer patches (site-first guardrails)
 
-Agents in **site-first** mode must **refuse** customer-repo changes that belong in **`se-core-product`** (`@se-studio/*`), unless the user explicitly approves **`defer-extract`** in the manifest with `extract_to_core: pending` and a dated extraction plan.
+Agents in **site-first** mode must **refuse** customer-repo changes that belong in **`se-core-product`** (`@se-studio/*`), unless the user explicitly approves **`defer-extract`** in chat with a dated extraction plan in the PR.
 
 Run this table **in addition to** the placement checklist (`site-workflows-agent-session` Step 3) when the task touches smoke, deploy checks, shared packages, or infra.
 
+Customer-only work must **not** add files in se-core-product.
+
 ## Refusal triggers
 
 | Symptom, file, or request | Correct owner | Agent action (site-first) |
 |---------------------------|---------------|---------------------------|
-| Deploy / `smoke-test:live` failure after bumping `@se-studio/*` | **core** — fix package behaviour | **Stop.** Switch to core-first or set `blocked_on: "@se-studio/<pkg>@<version>"`. Customer only bumps after npm publish. |
+| Deploy / `smoke-test:live` failure after bumping `@se-studio/*` | **core** — fix package behaviour | **Stop.** Switch to core-first. Customer only bumps after npm publish. |
 | Discovery smoke (`llms.txt`, `markdown-index.txt`, `cms.txt`, `site-info.md`) origin mismatch on `*.vercel.app` | **core** — `@se-studio/site-check` (`discovery.urlOrigin`) | **Refuse** per-request origin hacks (`getRequestBaseUrl`, `headers()` for `baseUrl`). Bump `site-check@2.9.4+`. |
 | Patching `@se-studio/site-check` expectations in app code | **core** `site-check` | **Refuse.** Open core PR + changeset. |
-| Forking converter / link logic already in `contentful-rest-api` | **core** | **Refuse.** Fix converter or API in core. |
+| Forking converter / link / media / sitemap / Visual behaviour already in `@se-studio/*` | **core** | **Refuse.** Fix the package, then bump the customer. |
 | `pnpm patch`, `patchedDependencies`, or overrides to fork `@se-studio/*` | **forbidden** | **Refuse** (see root `AGENTS.md`). |
 | New smoke assertion that should apply to all marketing sites | **core** `site-check` | **Refuse** site-only assertion helpers; extend site-check. |
 | `route-build-policy.json` change to hide a core regression (e.g. allow new `ƒ` on CMS routes) | **core** + site routing fix | **Refuse** policy-only workaround; fix why route went dynamic. |
@@ -29,12 +31,12 @@ Run this table **in addition to** the placement checklist (`site-workflows-agent
 
 Use only when the user **explicitly** accepts short-term customer code with a core extraction ticket:
 
-1. Manifest `placement.decision: defer-extract`
-2. `extract_to_core: pending` + `extract_rationale` (what moves to which package)
-3. Add `work/tracker.yaml` rollout or `attention` item if multi-site
-4. **Do not** merge to customer `develop` if it blocks other sites on a shared package fix
+1. Placement decision `defer-extract` stated in chat and the customer PR
+2. Name the target `@se-studio/*` package and what moves
+3. **Do not** merge to customer `develop` if it blocks other sites on a shared package fix
+4. **Do not** write a yaml tracker in se-core-product
 
-## Manifest gate
+## Commit gate (no yaml)
 
 Before committing customer changes to any of:
 
@@ -44,7 +46,7 @@ Before committing customer changes to any of:
 
 …when the **stated goal** is “fix deploy smoke” or “fix site-check failure”:
 
-1. Record `placement.decision` and `placement.rationale` in `work/active/<feature>.yaml`
+1. State placement in chat (`core` | `customer` | `defer-extract`)
 2. If decision is `core`: **do not commit customer workaround** — switch mode
 3. If decision is `customer`: user must confirm in chat (legitimate site-only URL curation)
 4. If decision is `defer-extract`: user must confirm extraction plan in chat
@@ -55,4 +57,4 @@ Before committing customer changes to any of:
 - `workflow_dispatch` deployment smoke against a known-good URL
 - Skip Vercel Deployment Check with **human** approval
 
-Never treat emergency bypass as permission to land a permanent customer patch for `@se-studio/*` behaviour.
+Never treat emergency bypass as permission to land a permanent customer patch for `@se-studio/*` behaviour.

package/references/agent-session/smoke-deploy-failure-playbook.md

@@ -18,11 +18,10 @@ Read the failing step and package:
 
 ## 2. If `@se-studio/*` behaviour is wrong → core-first
 
-1. Set manifest `mode: core-first` (or stop and ask user to switch).
+1. Switch to **core-first** (or stop and ask the user).
 2. Fix in `packages/<pkg>/`, add **changeset**, run package tests.
-3. Push `dev` → wait for CI npm publish.
-4. Add/update `work/tracker.yaml` **rollout** for customer bumps.
-5. Set customer manifest `blocked_on: "@se-studio/<pkg>@<version>"` until npm confirms.
+3. Push `dev` → wait for CI npm publish. The core PR is the rollout record.
+4. Do not push customer `develop` until npm confirms; then `pnpm update` and a customer PR.
 
 **Customer repo during wait:** only dependency bump via `pnpm update` — no `baseUrl` / origin / assertion hacks.
 
@@ -47,14 +46,14 @@ Examples: wrong slug in `smoke.cases.json`, page unpublished, new article type n
 
 1. Core: `@se-studio/site-check@2.9.4+` with `discovery.urlOrigin: auto` (default in smoke runner).
 2. Customer: `pnpm update @se-studio/site-check@2.9.4 -r`, keep canonical `baseUrl` in app config.
-3. Tracker rollout: `site-check-discovery-canonical` in `work/tracker.yaml`.
+3. Core PR + npm bump; customer `pnpm update @se-studio/site-check@2.9.4+`.
 
 ## 5. Emergency unblock (human or agent with explicit approval)
 
 | Action | Use when |
 |--------|----------|
 | `workflow_dispatch` deployment smoke | Re-test after core fix + customer bump |
-| `SMOKE_TEST_IGNORE=true` | One-off deploy; document in manifest notes |
+| `SMOKE_TEST_IGNORE=true` | One-off deploy; say so in the PR |
 | Human approves blocked Deployment Check | Production promotion already reviewed |
 
 Record what was bypassed and the real fix still required (core PR / npm bump).
@@ -72,9 +71,8 @@ Deployment checks stay **HTTP-only** — never enable `cmsIntegrity` on Vercel l
 
 ## 7. Handoff
 
-Include in manifest / handoff:
+Include in the PR / handoff:
 
 - Root cause (core vs customer)
 - Published package versions required
-- Tracker rollout id
 - Whether any emergency bypass was used

package/references/deps-update/projects.registry.json

@@ -83,11 +83,12 @@
       "key": "highlander",
       "displayName": "Highlander Health",
       "path": "~/source/customers/highlander/highlander-health-website-2026",
-      "branch": "port-2026",
+      "branch": "develop",
+      "productionBranch": "main",
       "validate": "pnpm check && pnpm type-check && pnpm validate:routes",
       "workspace": true,
       "hasPinOverrides": false,
-      "notes": "2026 port. Integration branch port-2026 until live; then develop/main."
+      "notes": "2026 stack. Integration develop; Vercel production tracks main. Public DNS still Bond/Netlify until cutover."
     }
   ]
 }

package/skills/contentful-cms-core/SKILL.md

@@ -13,14 +13,13 @@ Use this skill when you need to read or edit content in Contentful using **hoste
 
 ## Overview
 
-`cms-edit` lets you read and edit Contentful draft content without publishing. It uses a **snapshot → ref → edit → save** workflow:
+`cms-edit` lets you read and edit Contentful draft content without publishing.
 
-1. `open` a page to load the content tree into a session
-2. `snapshot` to see the tree with `@ref` labels
-3. `read` an entry to inspect its fields
-4. `set` / `rtf` to modify fields
-5. `diff` to review changes
-6. `save` to write drafts to Contentful (NEVER publishes)
+**New page/article:** `schema` for this space → `create from-json --dry-run --strict` → `create from-json` (`--json` or `--json-base64`). Nested tree key is `components`; discriminator is `type`.
+
+**Edit a tree:** `open` → `export from-json` → edit JSON → `apply from-json`. Tiny patches: `set` / `rtf` / `add` then `diff` → `save`.
+
+**Never publish.** Hosted MCP cannot see your disk — send JSON in the tool call.
 
 ## Safety Rules
 
@@ -159,15 +158,10 @@ Markdown support:
 - `` `inline code` ``
 - `---` for horizontal rule
 
-For any content with multiple paragraphs or newlines, use `printf` piped to stdin — `\n` in a double-quoted shell string is **not** interpreted as a newline by bash:
+For multi-paragraph Markdown, pass `--content` or `--base64` on MCP (no stdin, no `--file`):
 
-```bash
-# Correct — printf interprets \n properly
-printf '## Why it matters\n\nOur platform helps teams **move faster**.\n\n- Instant setup\n- No code required\n' | cms-edit rtf @c1 body --markdown -
-
-# Also correct — file input
-cms-edit rtf @c1 body --markdown --content "# Heading\n\nBody."
-cms-edit rtf @c1 body --markdown - < path/to/file.md
+```
+cms_edit ["rtf", "@c1", "body", "--content", "## Why it matters\n\nOur platform helps teams **move faster**."]
 ```
 
 Single-line content (no newlines) can be passed as a quoted argument directly:
@@ -679,12 +673,11 @@ cms-edit peek --id <entryId>         # Look up by entry ID
 
 ## Batch Operations (batch run)
 
-Run a sequence of operations from a JSON file or stdin.
+Run a sequence of operations from `--json` or `--json-base64` (hosted MCP).
 
-```bash
-cms-edit batch run --json '[...]'            # Run batch ops from inline JSON
-echo '[...]' | cms-edit batch run             # Pipe from stdin
-cms-edit batch run --json '[...]' --dry-run  # Validate without saving
+```
+cms_edit ["batch", "run", "--json", "[...]"]
+cms_edit ["batch", "run", "--json-base64", "<b64>", "--dry-run"]
 ```
 
 Supported ops: `open`, `set`, `rtf`, `rtf-replace`, `save`, `add`, `links-add`.
@@ -715,13 +708,17 @@ Example `ops.json` — update an existing page with a new CTA that has two butto
 
 ## Create Page or Article from JSON
 
-Create a complete page or article — including all components, fields, and CTA links — from a single declarative JSON file. This is the recommended approach for creating multiple pages or articles in bulk.
+Create a complete page or article from `--json` or `--json-base64`. Dry-run is local (no CMA) once the index is warm.
 
-```bash
-cms-edit create from-json --json '{...}'            # Create from inline JSON
-cms-edit create from-json --json '{...}' --dry-run  # Preview without writing
-cat page.json | cms-edit create from-json             # Pipe from stdin
 ```
+cms_edit ["help", "create-from-json"]
+cms_edit ["create", "from-json", "--json", "{...}", "--dry-run", "--strict"]
+cms_edit ["create", "from-json", "--json-base64", "<b64>"]
+cms_edit ["export", "from-json"]
+cms_edit ["apply", "from-json", "--json-base64", "<b64>"]
+```
+
+Use `"components"` not `"content"`. Nested discriminator is `"type"` not `"componentType"`. Empty `components` fails. `schema <contentType>` for this space’s field ids.
 
 **Page JSON schema:**
 

package/skills/se-marketing-sites-handling-media/SKILL.md

@@ -165,7 +165,7 @@ Pass `componentLabel` (usually `cmsLabel`) and `analyticsContext` to enable clic
 The `IResponsiveVisual` type (from `@se-studio/core-data-types`) supports:
 
 1.  **Image**: Standard Contentful image asset.
-2.  **Video**: Hosted video file (mp4/webm). The component handles `<video>` tag rendering with autoplay/loop/muted attributes suitable for background videos.
+2.  **Video**: Mute autoplay-loop local files via the hero pipeline (`HERO_VIDEO_*`, R2 / `video.se.studio`). Click-to-play is YouTube or Vimeo — do not play Contentful MP4s. Cover/fill does not overscan unless you pass `edgeOverscan` (parent must clip; `HeroLoopVideo` does not self-clip). Mute-loops may be up to 2 minutes.
 3.  **Animation**: Lottie motion file. Player is chosen by **file extension**:
     *   **`.json`** (or `application/json`) → `@lottiefiles/lottie-player` (classic Lottie).
     *   **`.lottie`** → `@lottiefiles/dotlottie-react` (ThorVG / WASM). Wrong extension ⇒ wrong player.

package/skills/se-marketing-sites-lib-cms-structure/SKILL.md

@@ -14,7 +14,7 @@ Reference app: **example-empty** (this monorepo). Customer implementations: see
 | `cms.ts` | Yes | Types, buildComponentRecord / buildCollectionRecord / buildExternalRecord (array → Record), then build*Maps from those Records, createConverterContext |
 | `cms-server.ts` | No (server-only) | createAppHelpers, buildOptions, getContentfulConfig, projectRendererConfig |
 | `config.ts` | Yes | isProduction, isDevelopment |
-| `server-config.ts` | No | draftOnly, videoPrefix, baseUrl, revalidationSecret |
+| `server-config.ts` | No | draftOnly, baseUrl, revalidationSecret |
 | `constants.ts` | Yes | ARTICLES_BASE, TAGS_BASE, PEOPLE_BASE, enable flags, customer name |
 | `registrations.ts` | Yes | componentRegistrationsList, collectionRegistrationsList, externalComponentRegistrationsList (arrays) |
 | `SizingInformation.ts` | Yes | getSizingInformation for dynamic heading sizes |

package/skills/se-marketing-sites-smoke-test-setup/SKILL.md

@@ -423,12 +423,12 @@ When **`pnpm smoke-test:live`**, Vercel Deployment Checks, or preview smoke fail
 Quick sequence:
 
 1. **Classify** — discovery/origin → `site-check`; broken slug → customer `smoke.cases.json`; new `ƒ` route → fix dynamic APIs.
-2. **Core-first** if package behaviour is wrong — changeset, push `dev`, tracker rollout, customer `blocked_on` until npm.
+2. **Core-first** if package behaviour is wrong — changeset, push `dev`, customer bump after npm.
 3. **Customer-only** if curating URLs — refresh from sitemap; one case per **enabled** article-type segment.
-4. **Discovery canonical origin** — bump `site-check@2.9.4+`; never add `getRequestBaseUrl()` (tracker rollout `site-check-discovery-canonical`).
+4. **Discovery canonical origin** — bump `site-check@2.9.4+`; never add `getRequestBaseUrl()`.
 5. **Emergency** — `SMOKE_TEST_IGNORE` or `workflow_dispatch` smoke; not a permanent site patch.
 
-Record `placement.decision` in manifest before smoke/server-config commits aimed at unblocking deploy.
+State placement in chat before smoke/server-config commits aimed at unblocking deploy. Do not write se-core-product yaml.
 
 ## Reference
 

package/skills/site-workflows-agent-session/SKILL.md

@@ -11,10 +11,10 @@ Orchestrates **where** to work, **where code belongs**, and **how to isolate par
 
 **Local env / worktrees:** [`local-env.md`](../../references/agent-session/local-env.md) — canonical `~/source/local-env`, no-clobber seed, 1Password backup only.
 
-**Manifest template:** [`packages/skills/references/agent-session/manifest.template.yaml`](../../references/agent-session/manifest.template.yaml)
-
 **Human guide:** `docs/WORKFLOW.md` in se-core-product.
 
+**Do not write yaml ledgers.** No `work/active/<feature>.yaml`, no session manifests in se-core-product for customer work. In-flight work is **open PRs** (local and cloud) plus **local git worktrees** on this machine.
+
 ---
 
 ## When to load this skill
@@ -25,14 +25,14 @@ Triggers:
 
 - User pastes a session opener (`Mode: site-first`, `Feature: …`)
 - User asks to work on a customer site or core package
-- User starts parallel work on another feature (new manifest, new branch)
+- User starts parallel work on another feature (new branch)
 - User asks "where should this live?" (run placement checklist)
 
 ---
 
 ## Step 1 — Resolve session context
 
-Collect or infer:
+Collect or infer (say them in chat; do not file them in se-core-product):
 
 | Field | Required | Notes |
 |-------|----------|-------|
@@ -41,7 +41,7 @@ Collect or infer:
 | `project_key` | Yes | From registry (`om1`, `se-core-product`, `pedestal`, …) |
 | `primary_repo` | Yes | Absolute path from registry |
 | `branch` | Yes | `feature/<scope>/<slug>` — see naming below |
-| `worktree` | **Yes** (feature work) | Path under registry `worktreesRoot`/`<feature-slug>`. Required for `feature/*`. Null only with explicit user opt-out + `worktree_opt_out: true` |
+| `worktree` | Local `feature/*` | Path under registry `worktreesRoot`/`<feature-slug>`. Required for **local** laptop feature work. Cloud / Cursor cloud agents work on a branch in their VM — the **PR** is the record; do not also write files in se-core-product. |
 
 **Default mode if unclear:** ask once. Site-specific UI/content → `site-first`. Package/framework/multi-site → `core-first`.
 
@@ -68,35 +68,22 @@ Integration branches (agents push feature branches here via PR or merge — **ne
 
 ---
 
-## Step 2 — Write or update manifest
-
-Path in **se-core-product** (canonical ledger for cross-repo visibility):
-
-```
-work/active/<feature>.yaml
-```
-
-Copy from `manifest.template.yaml`, fill all fields, set `status: in_progress`, `started_at` to today (ISO date).
+## Step 2 — Ledger: PRs and worktrees (not yaml)
 
-If the user works only in a customer repo with no core checkout, still create/update the manifest in se-core-product when that repo is available; otherwise create `work/active/<feature>.yaml` in the customer repo and note `manifest_location: customer` in the file.
+Customer-only work **must not** create or update files in `se-core-product`. Cross-machine and cloud work will not appear in a laptop `git worktree list`.
 
-**One feature = one manifest.** Do not append unrelated work to an existing manifest.
+**What's in flight** (when the user asks, or before a tidy-up):
 
-### Cross-site tracker (`work/tracker.yaml`)
+1. **Open PRs** targeting `dev` (core) or `develop` (customer) — `gh pr list --base <integration> --state open`. This includes Cursor cloud / other machines.
+2. **This machine:** `git fetch --prune` then `git worktree list` on the registry primary checkout.
 
-For work that spans repos (core npm rollouts, deployment gates, “bump on all sites”):
-
-1. Add or update a `rollouts` entry in `work/tracker.yaml` when a `@se-studio/*` release needs customer adoption
-2. Add `attention` items for human-only gates (blocked Vercel deploy, hosted MCP smoke, merge decisions)
-3. Run `pnpm work:tracker` from se-core-product to refresh `work/TRACKER.md`
-
-Humans glance at **`work/TRACKER.md`** for the dashboard; agents edit `tracker.yaml` + manifests.
+Do not invent a second ledger in git. Stale local trees vs merged PRs are a prune problem, not a yaml problem.
 
 ---
 
 ## Step 3 — Placement checklist (before non-trivial code)
 
-Run before implementing anything beyond a one-line fix. Record results in manifest `placement:`.
+Run before implementing anything beyond a one-line fix. State the decision in chat (and in the PR body). **Do not** record it in se-core-product yaml.
 
 | Question | If yes → lean |
 |----------|----------------|
@@ -106,24 +93,35 @@ Run before implementing anything beyond a one-line fix. Record results in manife
 | Shared only within **one customer monorepo** (e.g. `@brightline/shared`)? | **customer-shared** |
 | Bug in published `@se-studio/*` behaviour? | **core** — never fork in customer |
 
-**Outcomes** — set `placement.decision`:
-
 | Decision | Action |
 |----------|--------|
 | `core` | Edit `se-core-product` only; changeset before push to `dev`; customer waits for npm |
-| `customer` | Edit customer repo only; do not touch core |
-| `customer-shared` | Edit customer's shared package; not `@se-studio/*` |
-| `defer-extract` | Implement in customer now; set `extract_to_core: pending` + `extract_rationale` |
+| `customer` | Edit **that customer repo only**. Do not touch se-core-product (no docs, no skills, no `work/` files) |
+| `customer-shared` | Edit that customer's shared package; not `@se-studio/*` |
+| `defer-extract` | Implement in customer now **only** if the user explicitly approves in chat; PR must say what will move to which package |
+
+**Site-first guard:** If the checklist says **core**, **stop**. Ask to switch to core-first. Do not implement shared behaviour in the customer repo.
+
+**Core-first guard:** If the checklist says **customer**, implement in the customer repo only (read-only probe in core example apps if useful).
+
+### Shared work must not land in one customer
 
-**Site-first guard:** If checklist says `core` but mode is `site-first`, **stop** and ask whether to switch mode or record `defer-extract`.
+These are **core** (or customer-shared inside one monorepo). Doing them only in OM1 / HSD / etc. isolates a fleet fix:
 
-**Core-first guard:** If checklist says `customer`, implement in customer repo (read-only probe in core example apps only if useful).
+- Converters, link/media resolution, cache tags, sitemap Route Handler helpers
+- `Visual` / video delivery, mute-loop, overscan, ImageKit/HLS behaviour
+- cms-edit host/runtime, search webhooks, site-check / smoke assertion helpers
+- Copying a `@se-studio/*` workaround into `src/` instead of a package fix
+
+If you catch yourself duplicating package behaviour: **stop**, switch to core-first, changeset, then bump the customer after npm.
+
+Reviews (PR + `CODE_REVIEW_PROMPT.md` on core; this checklist on customer PRs) must flag those smells. See [`refuse-customer-patches.md`](../../references/agent-session/refuse-customer-patches.md).
 
 ### Step 3b — Refuse customer patches (mandatory)
 
 After the placement checklist, run the **refusal table** when the task involves deploy smoke, `smoke.cases.json`, discovery routes, `server-config`, or “fix site-check / unblock Vercel.”
 
-**Reference:** [`packages/skills/references/agent-session/refuse-customer-patches.md`](../../references/agent-session/refuse-customer-patches.md)
+**Reference:** [`refuse-customer-patches.md`](../../references/agent-session/refuse-customer-patches.md)
 
 | If the fix would… | Agent must |
 |-------------------|------------|
@@ -132,21 +130,21 @@ After the placement checklist, run the **refusal table** when the task involves
 | Change `route-build-policy.json` only to hide a new `ƒ` CMS route | **Refuse** — fix dynamic usage (Biome / layout) |
 | Add curated URLs or site-only probe cases | **Allow** — placement `customer`; follow smoke-test skill |
 
-**Deploy / live smoke failed?** Follow [`smoke-deploy-failure-playbook.md`](../../references/agent-session/smoke-deploy-failure-playbook.md) — classify failure → core vs customer → `blocked_on` if waiting on npm. Emergency: `SMOKE_TEST_IGNORE` or human Deployment Check approval — **not** permanent site hacks.
-
-**Manifest gate:** Before committing customer changes to smoke config, discovery routes, or `server-config` for deploy-smoke goals, record `placement.decision` in `work/active/<feature>.yaml`. If `core`, do not commit customer workaround.
+**Deploy / live smoke failed?** Follow [`smoke-deploy-failure-playbook.md`](../../references/agent-session/smoke-deploy-failure-playbook.md) — classify failure → core vs customer. Emergency: `SMOKE_TEST_IGNORE` or human Deployment Check approval — **not** permanent site hacks.
 
-**`defer-extract`:** Only when the user explicitly approves in chat. Set `extract_to_core: pending` + rationale; add tracker rollout if multi-site.
+**Smoke/server-config commits:** If the goal is “fix deploy smoke” and placement is `core`, **do not commit** a customer workaround. If `customer`, confirm in chat that it is URL curation only. If `defer-extract`, the user must confirm the extraction plan in chat.
 
 ---
 
-## Step 4 — Git isolation (worktrees required)
+## Step 4 — Git isolation
 
-**Required for all projects:** any work on a `feature/*` branch must run in a **git worktree**, not the primary `dev` / `develop` checkout. This applies to se-core-product and every customer site in the registry.
+**Local laptop:** any work on a `feature/*` branch must run in a **git worktree**, not the primary `dev` / `develop` checkout. This applies to se-core-product and every customer site in the registry.
 
-Primary checkouts (`path` / develop / dev) stay on the integration branch for fetch, deps, and short integration-only maintenance. Feature implementation always uses `worktreesRoot`.
+**Cloud / remote agents:** they already have an isolated checkout. Open a **draft PR** to the integration branch so other machines can see the work. Do not require a yaml file in se-core-product. Do not implement on a registry `productionPath`.
 
-### Create worktree (mandatory for feature/*)
+Primary checkouts (`path` / develop / dev) stay on the integration branch for fetch, deps, and short integration-only maintenance.
+
+### Create worktree (mandatory for local feature/*)
 
 ```bash
 cd <primary_repo>   # registry path — develop/dev checkout
@@ -171,7 +169,7 @@ cd <worktreesRoot>/<feature-slug>
 | `hsd` | `~/source/customers/hopskipdrive/worktrees` |
 | `highlander` | `~/source/customers/highlander/worktrees` |
 
-**Manifest gate:** set `worktree:` to the worktree path before coding. Do all edits, installs, tests, and commits from that path. Do not leave the primary checkout on a feature branch.
+Do all local edits, installs, tests, and commits from that path. Do not leave the primary checkout on a feature branch.
 
 ### Portless URLs in worktrees
 
@@ -181,24 +179,16 @@ Portless prefixes the hostname with the **last segment of the branch name**. `fe
 
 Without the OS service, agents may get `https://<name>.localhost:1355` from an ad-hoc proxy — do not hardcode `:1355` in docs or cms-edit `devBaseUrl`.
 
-### Gate — refuse primary-checkout feature work
+### Gate — refuse primary-checkout feature work (local)
 
-If you are about to implement a feature and `worktree` is null without `worktree_opt_out: true`:
+If you are about to implement a feature locally and you are on the primary develop/dev checkout:
 
 1. **Stop** — create the worktree (or ask the user to confirm opt-out)
 2. Do not edit product code on the primary develop/dev checkout for a feature branch
 
 ### Opt-out (narrow)
 
-Only when the user **explicitly** says work in place / no worktree **in the current conversation**:
-
-```bash
-cd <primary_repo>
-git fetch origin
-git checkout -b <branch> origin/<integration-branch>
-```
-
-Set `worktree: null` and `worktree_opt_out: true` in the manifest. Do not invent an opt-out.
+Only when the user **explicitly** says work in place / no worktree **in the current conversation**. Do not invent an opt-out.
 
 ### CMS parallel sessions
 
@@ -209,8 +199,6 @@ When editing Contentful in parallel on the same space, use distinct cms-edit ses
 # or CONTENTFUL_CMS_SESSION=<feature-slug>
 ```
 
-Record `cms_session: <feature-slug>` in manifest when doing CMS work.
-
 ---
 
 ## Step 5 — Work execution rules
@@ -243,9 +231,9 @@ Record `cms_session: <feature-slug>` in manifest when doing CMS work.
 
 **Related skills:** `site-workflows-figma-design-snapshot` / `site-workflows-apply-design-snapshot` for token sync; Figma MCP `get_design_context` for node-level implementation.
 
-### Blocked work
+### Blocked on npm
 
-If manifest has `blocked_on: "@se-studio/foo@1.2.3"`, do not push customer `develop` until npm publish is confirmed. Update manifest when unblocked.
+If customer work needs an unpublished `@se-studio/<pkg>@<version>`, do not push customer `develop` until npm publish is confirmed. Say that in the PR, not in a core yaml file.
 
 ---
 
@@ -258,8 +246,6 @@ Minimum per repo type (see registry `validate` for full command):
 | se-core-product | `pnpm validate` or targeted `pnpm type-check` + tests |
 | Customer | registry `validate` field |
 
-Record commands run in manifest `validation:` before push.
-
 ---
 
 ## Step 7 — Push and PR policy
@@ -272,13 +258,13 @@ Agents may push to:
 
 Agents must **never** push **se-core-product** `main`. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`). Opening a production PR is not a merge.
 
-**Preferred:** open a **draft PR** targeting the integration branch:
+**Preferred:** open a **draft PR** targeting the integration branch (this is how cloud + other laptops see the work):
 
 ```bash
 gh pr create --base <integration-branch> --head <branch> --draft --title "<feature>: <summary>"
 ```
 
-If `gh` is unavailable or user prefers direct push, push `feature/*` and note in handoff.
+If `gh` is unavailable or user prefers direct push, push `feature/*` and note the remote URL in handoff.
 
 ---
 
@@ -286,9 +272,7 @@ If `gh` is unavailable or user prefers direct push, push `feature/*` and note in
 
 When **marketing** work is ready for production, **stop** and hand off. Do **not** merge `develop` → production unless [`production-merge.md`](../../references/agent-session/production-merge.md) passed in this conversation (ask + restatement + second yes). One customer repo at a time. cms-edit host extra gate: [`cms-edit-prod-merge.md`](../../references/agent-session/cms-edit-prod-merge.md).
 
-1. Set manifest `status: ready_for_review`
-2. Deliver handoff using template below
-3. If core release was part of the work, list published package versions needed for customer bump
+Deliver handoff using the template below. If a core release was part of the work, list published package versions needed for the customer bump.
 
 ### Handoff template
 
@@ -296,7 +280,7 @@ When **marketing** work is ready for production, **stop** and hand off. Do **not
 ## Handoff: <feature>
 
 **Mode:** <core-first | site-first>
-**Manifest:** work/active/<feature>.yaml
+**PRs:** <links>
 
 ### Repos and branches
 - <repo>: `<branch>` → merge to `<integration-branch>`
@@ -324,13 +308,10 @@ Do not merge until the human asks **and** confirms (`production-merge.md`). Not
 
 ## Step 9 — Complete or park
 
-| Outcome | Manifest update |
-|---------|-----------------|
-| Merged / done | Move to `work/completed/<feature>.yaml` or delete from `work/active/` |
-| Blocked | `status: blocked`, set `blocked_on` |
-| Parked | `status: parked`, add `parked_reason` |
-
-Remove worktree when done:
+| Outcome | Action |
+|---------|--------|
+| Merged / done | Remove the **local** worktree if you created one; the PR close is the record |
+| Parked | Leave the branch + draft PR; say why in chat |
 
 ```bash
 git worktree remove <worktree-path>
@@ -350,7 +331,7 @@ Feature: hero-redesign
 Branch: feature/om1/hero-redesign
 ```
 
-Agent must load this skill, write manifest (with `worktree` path), run placement checklist, create the worktree, then proceed.
+Agent must load this skill, run placement checklist, create a **local** worktree (or use the cloud checkout), then proceed. **Do not** write `work/active/*.yaml`.
 
 ---
 
@@ -360,11 +341,11 @@ Agent must load this skill, write manifest (with `worktree` path), run placement
 |-----|-------------|-------------------------|------|
 | `se-core-product` | `dev` | `main` | core monorepo |
 | `se2026` | `develop` | `main` | customer |
-| `brightline` | `develop` | `main` | customer monorepo |
+| `brightline` | `develop` | `main` | customer |
 | `om1` | `develop` | `main` | customer |
 | `pointme` | `develop` | `main` | customer |
 | `pedestal` | `develop` | `main` | customer monorepo |
 | `hsd` | `develop` (`develop-hsd-website`) | `production` (`production-hsd-website`) | customer |
-| `highlander` | `port-2026` until live, then `develop` | `main` after cutover | customer |
+| `highlander` | `develop` | `main` | customer |
 
 Full paths (`path`, `worktreesRoot`, `productionPath`), MCP keys: `projects.registry.json`.

package/skills/site-workflows-deps-update/SKILL.md

@@ -55,7 +55,7 @@ Run that locally **before push** whenever `package.json`, lockfile, or overrides
 
 User may name a key (`update deps in om1`) or ask to run through all projects sequentially.
 
-**HSD:** Agents update **only** `~/source/customers/hopskipdrive/develop-hsd-website` on `develop`. Production is human-only: branch `production`, checkout `~/source/customers/hopskipdrive/production-hsd-website` — never push or promote from there. Prefer targeted `@se-studio/*` bumps per `work/tracker.yaml` rollout before full `pnpm update -r --latest`.
+**HSD:** Agents update **only** `~/source/customers/hopskipdrive/develop-hsd-website` on `develop`. Production is human-only: branch `production`, checkout `~/source/customers/hopskipdrive/production-hsd-website` — never push or promote from there. Prefer targeted `@se-studio/*` bumps from the core release PR before full `pnpm update -r --latest`.
 
 ---
 

package/skills/site-workflows-new-project/SKILL.md

@@ -154,7 +154,7 @@ When work depends on a new `@se-studio/*` npm release: release from `se-core-pro
 
 ### Parallel features
 
-One feature = one `feature/<scope>/<slug>` branch. **Git worktree required** for feature work (registry `worktreesRoot`/`<feature-slug>`). CMS: `--session <feature-slug>`. Manifest: `~/source/se/se-core-product/work/active/<feature>.yaml` with `worktree:` set.
+One feature = one `feature/<scope>/<slug>` branch. **Local git worktree** for feature work (registry `worktreesRoot`/`<feature-slug>`). Cloud: draft PR. CMS: `--session <feature-slug>`. Do not write `work/active` yaml in se-core-product for this customer.
 
 ### Production handoff
 

package/references/agent-session/manifest.template.yaml

@@ -1,37 +0,0 @@
-# Copy to work/active/<feature>.yaml — one file per in-flight feature.
-# Canonical location: se-core-product/work/active/ (cross-repo visibility).
-
-feature: my-feature-slug
-mode: site-first # core-first | site-first
-project_key: om1
-primary_repo: ~/source/customers/om1/om1-website
-branch: feature/om1/my-feature-slug
-# REQUIRED for feature/* work — path under registry worktreesRoot (e.g. ~/source/customers/om1/worktrees/my-feature-slug).
-# null only when user explicitly opts out of worktrees in this conversation (record worktree_opt_out: true).
-worktree: ~/source/customers/om1/worktrees/my-feature-slug
-worktree_opt_out: false
-integration_branch: develop
-
-related_repos:
-  - repo: se-core-product
-    path: ~/source/se/se-core-product
-    role: read-only # read-only | pending-extract | active
-
-placement:
-  decision: customer # core | customer | customer-shared | defer-extract
-  rationale: One-site hero layout tied to OM1 Figma
-  extract_to_core: null # pending | null
-  extract_rationale: null
-  # Required before smoke/server-config commits for deploy-smoke goals (agent-session Step 3b):
-  # smoke_edit: null # curated-urls | blocked-on-core | defer-extract
-
-blocked_on: null # e.g. "@se-studio/core-ui@2.1.0"
-cms_session: null # set to feature slug when doing parallel CMS edits
-
-status: in_progress # in_progress | blocked | parked | ready_for_review
-started_at: 2026-07-05
-updated_at: 2026-07-05
-
-validation: []
-
-handoff: null