@se-studio/skills 1.8.2 → 1.9.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @se-studio/skills
 
+## 1.9.0
+
+### Minor Changes
+
+- Agent process refresh: replace Bugbot/nick-go label gates with phased Vercel visual review, chat-gated multi-lens code review, and cross-project handoff templates.
+
 ## 1.8.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.8.2",
+  "version": "1.9.0",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/cross-project-handoff.md

@@ -0,0 +1,42 @@
+# Cross-project handoffs
+
+When work spans **se-core-product** and a customer site, use these chat/PR blocks. Do not patch `@se-studio/*` in the customer repo while waiting.
+
+## Core request (site → core)
+
+Emit when placement says **core**, or the site is blocked on missing package behaviour:
+
+```markdown
+## Core request
+
+**From site:** <project_key> (`<repo>`)
+**Feature:** <feature-slug>
+**Why core:** <one sentence — 2+ sites / CMS infra / bug in @se-studio/*>
+
+**Suggested packages:** `@se-studio/<pkg>`, …
+**Suggested core branch:** `feature/core/<slug>` or `cursor/<slug>-…`
+
+**Site status:** Parked — waiting on npm `@se-studio/<pkg>@<version>` (TBD until publish).
+**Do not:** implement this behaviour in the customer repo.
+```
+
+Then switch to **core-first** (same multi-root chat or a core session), implement, changeset, publish.
+
+## Site request (core → sites)
+
+Emit when a core release is ready for consumers:
+
+```markdown
+## Site request
+
+**Core PR / packages:** `@se-studio/<pkg>@<version>` (confirmed on npm: yes/no)
+**Customers to bump:** <project_key list>
+**Command:** `pnpm update @se-studio/<pkg>@<version> -r`
+**Notes:** <breaking? opt-in? editor-pack regen?>
+```
+
+## Wait rules
+
+1. Customer must not push `develop` assuming an unpublished package version.
+2. After npm confirm → `pnpm update` → then continue site work / merge chat.
+3. Say the wait loudly in the site PR body, not in a core yaml ledger.

package/references/agent-session/customer-agents-block.md

@@ -13,6 +13,7 @@ Default mode for this repo: **site-first**.
 ### Branch policy
 
 - Agents may commit and push **`develop`** and **`feature/*`**.
+- Merge feature → `develop` only when Nick approves **in chat** (no `nick-go` GitHub label).
 - Customer production (`main`, HSD `production`) **only** after the human-ask + confirm gate (`production-merge.md` in `@se-studio/skills`). The human must ask to merge integration → production in this conversation; the agent must restate site, branches, and that it publishes production; then wait for a second **yes**.
 - **Never** treat “deploy”, “ship it”, or “rollout” as permission. **Never** ship from a production checkout (e.g. HSD `production-hsd-website`). Use the develop checkout only. **Never** merge se-core-product `main`.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
@@ -27,7 +28,7 @@ Before non-trivial code, run the placement checklist (in the skill). Summary:
 | **Customer shared package** (if monorepo) | Consent/analytics shared across sites in this customer |
 | **`se-core-product`** (`@se-studio/*`) | Fixes/features needed by 2+ sites, CMS infrastructure |
 
-If the checklist says **core**, stop and switch to core-first mode — do not patch `@se-studio` behaviour in this repo. Shared converters, Visual/video delivery, cms-edit runtime, sitemap helpers, and site-check assertions belong in core, not a one-site fork.
+If the checklist says **core**, stop and emit a **Core request** ([`cross-project-handoff.md`](./cross-project-handoff.md)) — do not patch `@se-studio` behaviour in this repo. Shared converters, Visual/video delivery, cms-edit runtime, sitemap helpers, and site-check assertions belong in core, not a one-site fork. Switch to core-first (or a core session); park the site until npm.
 
 ### Deploy smoke failed?
 
@@ -46,10 +47,24 @@ When work depends on a new `@se-studio/*` npm release:
 1. Release from `se-core-product` (`dev` → CI publish)
 2. Confirm version on npm
 3. `pnpm update @se-studio/<package>@<version> -r` in this repo
-4. Then push `develop`
+4. Then push / merge to `develop` after chat approval
 
 Never hand-edit `package.json` dependency versions.
 
+### UI visual gates (Vercel preview)
+
+For visual/UI changes:
+
+1. **Early:** draft PR → Vercel preview → mobile (~390) + laptop (~1280) screenshots → **stop** for Nick’s visual review (iterate on feedback).
+2. **Full (after Nick is happy):** re-check tablet (~768), laptop (~1280), **oversize (~1920+)**, and mobile. Then multi-lens **code review** (`CODE_REVIEW.md`).
+3. Do not chase pixel-perfect polish before the early gate.
+
+Non-UI changes skip visual gates and go to code review.
+
+### Code review
+
+Before asking to merge to `develop`, run the multi-lens review in `CODE_REVIEW.md` (architecture, Next/React/Vercel, performance/size, docs consistency, general quality). Findings: **BLOCKER** / **NIT**.
+
 ### Parallel features
 
 - One feature = one `feature/<scope>/<slug>` branch
@@ -62,6 +77,10 @@ Never hand-edit `package.json` dependency versions.
 - CMS edits: `--session <feature-slug>` (isolate cms-edit sessions)
 - In-flight work: open PRs + local `git worktree list`
 
+### Process feedback
+
+Site-local learnings: `docs/AGENT_PROCESS_NOTES.md`. Say **“promote process note”** to fold into core templates. See [`process-feedback.md`](./process-feedback.md).
+
 ### Production handoff
 
-When **marketing** work is ready, agents **stop** and hand off. Merge `develop` → production only after ask + confirm (`production-merge.md`). One site at a time. No `vercel deploy`. cms-edit host extra gate: `cms-edit-prod-merge.md`.
+When **marketing** work is ready, agents **stop** and hand off. Merge `develop` → production only after ask + confirm (`production-merge.md`). One site at a time. No `vercel deploy`. cms-edit host extra gate: `cms-edit-prod-merge.md`.

package/references/agent-session/customer-architecture.mdc

@@ -0,0 +1,48 @@
+---
+description: SE Studio customer-site architecture gates
+alwaysApply: true
+---
+
+# SE Studio customer site
+
+This repo is a thin brand layer on `@se-studio/*`. Follow core; do not copy shared logic here.
+Source of truth: `se-core-product` `docs/PHILOSOPHY.md`. Code review: `CODE_REVIEW.md` (from `@se-studio/skills` `customer-code-review.md`).
+
+## Placement
+
+- Brand (Figma, copy, colours, one-off layout) → `src/project/*` (T3).
+- Shared behaviour (fetch, cache, forms, analytics, SEO, consent, renderers) → core. If core lacks an option, emit a **Core request** handoff and wait for npm; do not fork here.
+- Workarounds for missing/broken core are review findings, not solutions.
+- Any `@se-studio/*` version change: use `pnpm update` after the version is on npm. No `file:` tarballs or `pnpm patch`. Merge to `develop` only when Nick approves in chat (no `nick-go` label).
+
+## Contentful
+
+- Do not change content models or run migrations in an app PR. Schema work is numbered migrations (core or `NN-…-<site>.js`), run on Nick's Mac only when Nick asks in chat.
+- Fetch only through core helpers with cache tags. No direct Contentful CDA `fetch`.
+
+## Rendering / visual system
+
+- Keep T0/T1 skeleton files thin; document deviations in the site README.
+- Use core route handlers (`generatePage`, robots, sitemaps, etc.). Do not reimplement.
+- Mobile-first Tailwind. Preserve heading hierarchy. Size visuals with core helpers. Avoid duplicate mobile/desktop markup for the same content.
+- UI changes: early Vercel preview (mobile + laptop) → Nick visual → full breakpoints including oversize (~1920+) before deep polish/code review.
+
+## Caching / performance / images
+
+- Keep CMS routes static (`●`). Do not read `headers()`/`cookies()` in a layout that forces the tree dynamic.
+- No uncached CMS fetches. Dynamic (`ƒ`) or cache opt-outs need measured cost/why in the PR.
+- Image and client-bundle weight changes need before/after numbers.
+
+## Analytics / forms / secrets
+
+- Consent and analytics go through core adapters. No direct `dataLayer` pushes.
+- Never send names, emails, phones, form answers, or raw errors to analytics/URLs.
+- Forms submit server-side via core. Preview/develop must not post to production HubSpot or GTM.
+- No secrets in code/tests/logs. Avoid new `NEXT_PUBLIC_*` unless the browser must see the value.
+
+## Tests / ship / review
+
+- Keep smoke cases and discovery intact; fix `@se-studio/site-check` in core if smoke is wrong.
+- New behaviour needs a test. Failing typecheck/lint/tests blocks merge.
+- Agent multi-lens code review (`CODE_REVIEW.md`) before asking to merge to `develop`.
+- Production merges need human ask + confirm. Agents do not push production.

package/references/agent-session/customer-code-review.md

@@ -0,0 +1,84 @@
+# Code review: SE Studio customer site
+
+Use this prompt when reviewing a **customer marketing site** PR (or when the user asks for a code review). Label every finding **BLOCKER** or **NIT**. Blockers first. Unclear judgement calls → flag to Nick in chat.
+
+Do **not** use Bugbot or a `nick-go` GitHub label. Merge to `develop` only when Nick says so in chat. Production still needs ask + confirm (`production-merge.md`).
+
+Canonical architecture: `se-core-product` `docs/PHILOSOPHY.md`. Placement and handoffs: skill `site-workflows-agent-session`.
+
+---
+
+## Multi-lens checklist
+
+Run all five lenses. Skip a lens only when the diff clearly cannot touch it (say so).
+
+### 1. Architecture / placement
+
+- [ ] Brand / one-off layout stays in `src/project/*` (or customer-shared package). No fork of `@se-studio/*` behaviour.
+- [ ] If 2+ sites would need this within ~6 months, the change belongs in core — **BLOCKER** if implemented only here.
+- [ ] Server/client boundaries: `'use client'` does not import `cms-server`, `@se-studio/core-ui/server`, or `contentful-rest-api`.
+- [ ] Four-layer components / five-layer collections preserved; registrations match CMS types.
+- [ ] Contentful model/migrations are **not** in this app PR. Schema work is Nick’s Mac only, triggered via chat.
+
+### 2. Next.js / React / Vercel
+
+- [ ] Read version-matched guides under `node_modules/next/dist/docs/` when the diff touches App Router, caching, or metadata.
+- [ ] Server Components by default; client islands only for interactivity.
+- [ ] CMS routes stay static (`●`). No `headers()`/`cookies()` in a layout that forces the tree dynamic without measured justification.
+- [ ] Fetches go through core helpers with cache tags. No raw CDA `fetch`.
+- [ ] Images/video use core `Visual` + `calculateVisualSizes` (values match layout; mobile vs laptop not reversed).
+- [ ] Preview/develop must not post to production HubSpot or GTM.
+
+### 3. Performance and size
+
+- [ ] No uncached CMS fetches. New `ƒ` routes or cache opt-outs need cost/why in the PR.
+- [ ] Image, caching, or client-bundle weight changes include before/after notes when material.
+- [ ] No needless duplicate mobile/desktop markup for the same content.
+- [ ] Avoid shipping large client dependencies for presentational CMS blocks.
+
+### 4. Docs consistency
+
+- [ ] AGENTS.md, `.cursorrules`, `src/project/*` docs, cms-edit packs, and READMEs match the behaviour change.
+- [ ] No leftover Bugbot / `nick-go` instructions contradicting chat-gated merge.
+- [ ] Site `docs/AGENT_PROCESS_NOTES.md` updated only for site-local process learnings (promote to core via “promote process note”).
+
+### 5. General quality (BLOCKERs from former Bugbot gates)
+
+**BLOCKER**
+
+- Copied core logic (render, fetch, cache, forms, analytics, SEO, consent) instead of using or extending core.
+- Secrets, tokens, or `.env` values in code, tests, comments, or logs. Avoid new `NEXT_PUBLIC_*` unless the browser must see the value.
+- Personal data or form field values in events, dataLayer, HubSpot payloads, or URLs.
+- Consent granted by default where a CMP decides, or bypassing site consent gating.
+- Forms: preview posting to production HubSpot/GTM, or bypassing core server-side submit.
+- Hard-coded heading skips, `Visual` without size helpers, or needless duplicate mobile/desktop content.
+- Failing typecheck, lint, or tests; new behaviour with no test where the site already tests that layer.
+- Smoke/discovery/`server-config` hacks to unblock deploy smoke (belongs in `@se-studio/site-check`).
+
+**NIT**
+
+- Prefer existing core components over one-offs.
+- Don’t rename existing tracking events only to match other sites.
+- Clearer names, smaller functions, docs polish.
+
+---
+
+## Visual gates (UI diffs only)
+
+If the PR changes UI, confirm the session followed agent-session visual phases:
+
+1. **Early:** Vercel preview, mobile (~390) + laptop (~1280), stopped for Nick’s visual review.
+2. **Full (after Nick is happy):** tablet (~768), laptop (~1280), **oversize (~1920+)**, plus mobile — flag overflow, stretched heroes, broken grids.
+
+Do not treat “pixel-perfect vs Figma” as a merge blocker before the early visual gate completes.
+
+---
+
+## Output format
+
+1. Summary (1–3 sentences)
+2. **BLOCKER** list (file + issue + fix)
+3. **NIT** list
+4. Open questions for Nick
+
+Out of scope: inventing product/design/copy changes; Netlify/Storybook check noise.

package/references/agent-session/process-feedback.md

@@ -0,0 +1,32 @@
+# Process feedback (continual improvement)
+
+Shared agent workflow lives in **se-core-product** (`site-workflows-agent-session`, `customer-agents-block.md`, review templates). Customer sites may record local learnings without editing core immediately.
+
+## Per project
+
+Keep `docs/AGENT_PROCESS_NOTES.md` at the customer (or core) repo root docs folder.
+
+Use it for:
+
+- Site-specific gotchas (ports, Vercel project names, CMS quirks)
+- Feedback on the agent process that worked or failed on this site
+- Candidates to promote into the shared skill/templates
+
+Do **not** duplicate PHILOSOPHY hard rules here. Link out instead.
+
+## Promote to core
+
+When the user says **“promote process note”** (or equivalent):
+
+1. Read the site’s `docs/AGENT_PROCESS_NOTES.md` (and any notes in chat).
+2. Switch to **core-first** on `se-core-product`.
+3. Fold the learning into the right shared surface (`site-workflows-agent-session`, `customer-agents-block.md`, `customer-code-review.md`, `docs/WORKFLOW.md`).
+4. Refresh customer copies on the next process-refresh pass (or in the same multi-repo change if already open).
+
+## Phrases
+
+| Phrase | Meaning |
+|--------|---------|
+| process note | Add a bullet to this site’s `AGENT_PROCESS_NOTES.md` |
+| promote process note | Lift a note into core shared templates |
+| refresh process | Re-copy customer-agents-block / architecture / CODE_REVIEW from core templates |

package/references/agent-session/projects.registry.json

@@ -114,6 +114,17 @@
       "hostedMcp": "cms-edit-highlander",
       "validate": "pnpm check && pnpm type-check && pnpm validate:routes",
       "notes": "2026 stack is live on Vercel (develop preview, main production alias). Public DNS is still Bond/Netlify highlanderhealth.com until cutover. Hosted cms-edit: https://highlander.content.se.studio (Git production branch main)."
+    },
+    {
+      "key": "eagle",
+      "displayName": "Eagle Website",
+      "path": "~/source/customers/eagle/eagle-website",
+      "worktreesRoot": "~/source/customers/eagle/worktrees",
+      "branch": "main",
+      "productionBranch": "main",
+      "type": "customer",
+      "validate": "pnpm validate",
+      "notes": "Currently tracks main (no separate develop yet). Agents use feature/* PRs into main until a develop integration branch exists. Prefer adding develop when the site joins the standard customer train."
     }
   ]
 }

package/skills/site-workflows-agent-session/SKILL.md

@@ -217,21 +217,52 @@ When editing Contentful in parallel on the same space, use distinct cms-edit ses
 - **Do not** edit `se-core-product` unless placement is `core` and user approves mode switch
 - Consume `@se-studio/*` from npm — not monorepo workspace links
 
-### Figma is absolute gospel (new designs)
+### Figma direction (new designs) + phased visual gates
 
-**Until the user explicitly says otherwise**, when implementing or polishing UI from a Figma file or node:
+**Until the user explicitly says otherwise**, when implementing UI from a Figma file or node, treat Figma as the **direction / source of truth** for structure, spacing, type, colour, radii, alignment, and control patterns. Do not “improve” or normalize away from the comps to match older site patterns. Prefer Figma MCP design context over CMS drafts or live-site memory.
 
-| Do | Do not |
-|----|--------|
-| Treat the named Figma node as the **source of truth** for structure, spacing, type, colour, radii, alignment, and control patterns | “Improve”, normalize, or restyle away from the comps to match older site patterns |
-| Pull design context / screenshots from the owned Figma file before coding or “fixing” visuals | Prefer CMS draft copy, prior app screenshots, or memory of the live site over the comps |
-| Match **pixel-faithfully** (including pills vs checkboxes/radios, hug vs full-width CTAs, card fills) | Ship “close enough” and wait for the user to notice |
-| If Figma conflicts with an existing component or token, **follow Figma** and note the deviation | Silently keep the old pattern because it is already in the codebase |
-| Verify in the browser against the Figma node (desktop + mobile when both exist) | Declare done from a single screenshot that does not match the node |
+**Do not** chase pixel-perfect polish before the **early visual gate**. Iterate with Nick on a Vercel preview first.
 
-**Override:** Only diverge when the user clearly says so in the current conversation (e.g. “ignore Figma for the button”, “use site chrome instead”). Until that override, Figma wins.
+#### Phase 1 — Early visual gate (any UI change)
 
-**Related skills:** `site-workflows-figma-design-snapshot` / `site-workflows-apply-design-snapshot` for token sync; Figma MCP `get_design_context` for node-level implementation.
+1. Push the feature branch and open a **draft PR** so Vercel builds a preview.
+2. Capture/share **mobile (~390)** and **laptop (~1280)** screenshots (or open the preview for Nick).
+3. Paste the preview URL and what to look at.
+4. **Stop** and wait for Nick’s visual review / feedback. Apply feedback and repeat Phase 1 as needed.
+
+#### Phase 2 — Full visual gate (after Nick is happy **and** the change is visual)
+
+Re-check the same Vercel preview at least at:
+
+| Width | Approx |
+|-------|--------|
+| Mobile | ~390 |
+| Tablet | ~768 |
+| Laptop | ~1280 |
+| **Oversize / wide desktop** | **~1920+** |
+
+Flag layout blowouts, overflow, sparse/stretched heroes, broken grids, and type that does not scale. Attach screenshots to chat/PR, then proceed to **multi-lens code review**.
+
+Non-UI changes skip visual phases and go to code review.
+
+**Related skills:** `site-workflows-figma-design-snapshot` / `site-workflows-apply-design-snapshot`; Figma MCP `get_design_context`.
+
+### Cross-project handoffs
+
+When placement says **core** (or the site is blocked on package behaviour): emit a **Core request** per [`cross-project-handoff.md`](../../references/agent-session/cross-project-handoff.md), switch to core-first, and **park** the site until npm. Do not patch `@se-studio/*` in the customer repo. When core publishes, emit a **Site request** listing customers to bump.
+
+### Code review (replaces Bugbot)
+
+Before asking to merge to `dev` / `develop`:
+
+- **Core:** follow root [`CODE_REVIEW_PROMPT.md`](../../../../CODE_REVIEW_PROMPT.md)
+- **Customer:** follow [`customer-code-review.md`](../../references/agent-session/customer-code-review.md) (copied into the site as `CODE_REVIEW.md`)
+
+Lenses: architecture/placement, Next/React/Vercel, performance/size, docs consistency, general quality. Findings: **BLOCKER** / **NIT**. No Bugbot; no `nick-go` label — Nick approves merges to integration branches **in chat**.
+
+### Process feedback
+
+See [`process-feedback.md`](../../references/agent-session/process-feedback.md). Site notes live in `docs/AGENT_PROCESS_NOTES.md`. **“promote process note”** folds them into core templates.
 
 ### Blocked on npm
 
@@ -254,10 +285,12 @@ Minimum per repo type (see registry `validate` for full command):
 
 Agents may push to:
 
-- `dev` / `develop` (via feature branch merge or direct if user prefers)
+- `dev` / `develop` (via feature branch merge or direct **only when Nick approves in chat**)
 - `feature/*` branches
 - Customer production (`main`, HSD `production`) **only** after [`production-merge.md`](../../references/agent-session/production-merge.md): human **asked** in this conversation, agent **restated** the exact merge (site, branches, publishes production), human **confirmed** with a second yes. cms-edit host diffs also need [`cms-edit-prod-merge.md`](../../references/agent-session/cms-edit-prod-merge.md).
 
+Do **not** wait for or require a `nick-go` GitHub label.
+
 Agents must **never** push **se-core-product** `main`. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`). Opening a production PR is not a merge.
 
 **Preferred:** open a **draft PR** targeting the integration branch (this is how cloud + other laptops see the work):
@@ -266,6 +299,8 @@ Agents must **never** push **se-core-product** `main`. Agents must **never** shi
 gh pr create --base <integration-branch> --head <branch> --draft --title "<feature>: <summary>"
 ```
 
+Before asking to merge the draft: complete visual gates (if UI) and multi-lens code review.
+
 If `gh` is unavailable or user prefers direct push, push `feature/*` and note the remote URL in handoff.
 
 ---
@@ -349,5 +384,6 @@ Agent must load this skill, run placement checklist, create a **local** worktree
 | `pedestal` | `develop` | `main` | customer monorepo |
 | `hsd` | `develop` (`develop-hsd-website`) | `production` (`production-hsd-website`) | customer |
 | `highlander` | `develop` | `main` | customer |
+| `eagle` | `main` (until `develop` exists) | `main` | customer |
 
 Full paths (`path`, `worktreesRoot`, `productionPath`), MCP keys: `projects.registry.json`.

package/skills/site-workflows-new-project/SKILL.md

@@ -103,7 +103,21 @@ Write `CLAUDE.md` at the project root:
 
 Write `AGENTS.md` at the project root. Fill in the user's email address (from memory if known, otherwise ask) and today's date.
 
-Include the **agent session workflow block** from [`packages/skills/references/agent-session/customer-agents-block.md`](../../references/agent-session/customer-agents-block.md) (branch policy, placement, parallel features, handoff).
+**Paste the full agent session workflow block** from [`packages/skills/references/agent-session/customer-agents-block.md`](../../references/agent-session/customer-agents-block.md) (branch policy, chat-gated develop merges, placement, Core request handoffs, UI visual gates, code review, process feedback, production handoff). Do not invent a shorter substitute that omits visual gates or review.
+
+Also copy:
+
+| Source | Destination |
+|--------|-------------|
+| [`customer-architecture.mdc`](../../references/agent-session/customer-architecture.mdc) | `.cursor/rules/architecture.mdc` |
+| [`customer-code-review.md`](../../references/agent-session/customer-code-review.md) | `CODE_REVIEW.md` (repo root) |
+| Starter notes | `docs/AGENT_PROCESS_NOTES.md` (see [`process-feedback.md`](../../references/agent-session/process-feedback.md)) |
+
+Do **not** create `.cursor/BUGBOT.md`. Do **not** require a `nick-go` label.
+
+Wire `.cursorrules` so “when the user asks for a code review” points at `CODE_REVIEW.md`.
+
+Skeleton:
 
 ```markdown
 <!-- BEGIN:nextjs-agent-rules -->
@@ -132,33 +146,7 @@ The user's email address is [USER_EMAIL].
 # currentDate
 Today's date is [CURRENT_DATE].
 
-## Agent session workflow
-
-**Load skill `site-workflows-agent-session` at the start of every coding session.**
-
-Default mode for this repo: **site-first**.
-
-### Branch policy
-
-- Agents may commit and push **`develop`** and **`feature/*`**.
-- Customer production only after human **ask + confirm** (`production-merge.md`). Never se-core-product `main`.
-- Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
-
-### Core vs customer placement
-
-Before non-trivial code, run the placement checklist (skill `site-workflows-agent-session`). If the checklist says **core**, stop — do not patch `@se-studio` behaviour in this repo.
-
-### Core release order
-
-When work depends on a new `@se-studio/*` npm release: release from `se-core-product` first, confirm npm, then `pnpm update @se-studio/<package>@<version> -r` here, then push `develop`. Never hand-edit dependency versions.
-
-### Parallel features
-
-One feature = one `feature/<scope>/<slug>` branch. **Local git worktree** for feature work (registry `worktreesRoot`/`<feature-slug>`). Cloud: draft PR. CMS: `--session <feature-slug>`. Do not write `work/active` yaml in se-core-product for this customer.
-
-### Production handoff
-
-Agents stop at handoff unless the human asks to merge to production **and** confirms (`production-merge.md`).
+<!-- paste customer-agents-block.md here -->
 
 ## CMS editing (cms-edit)
 
@@ -179,6 +167,7 @@ Read `.cursorrules` and update the **Project Overview** section at the top:
 - Replace the previous project name with the new customer/project name
 - Update the "Key technologies" list if anything changed
 - Remove any project-specific notes about the previous customer
+- Ensure code-review instructions point to `CODE_REVIEW.md` (not Bugbot)
 
 Do not change the Code Style, Component Architecture, or other generic sections — those apply to all SE Studio projects.