@agile-team/wl-skills-ui 1.16.0 → 1.18.0

package/CHANGELOG.md

@@ -1,9 +1,20 @@
 # Changelog
 
+## [1.18.0] - 2026-10-11
+
+- 任务路由前校验目标项目自身接入与平台；未接入/移动端零规则零任务写入，不继承父安装。
+- 最近项目边界与跨项目拆分、独立包禁用、严格范围Schema、notice/doctor/status范围与过期证据。
+- 原生及编辑器入口收窄适用描述；补充单包、移动端、开源未接入、工作区、异常配置和Maven模块回归。
+
 All notable changes to **@agile-team/wl-skills-ui** will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.17.0] - 2026-10-09
+
+- 统一可见 notice（包版本/判定/技能或基础约束/规则/目标/runId/待检查项）、开始与收尾提示、规范与执行器版本漂移诊断；保持单包使用与宿主证据未验证口径。
+- 按本包规则与实际 Profile 映射 Skill，不重复前端注释规则；保留旧入口哈希证明迁移与外来内容保护。
+
 ## [Unreleased]
 
 ## [1.16.0] - 2026-10-08

package/README.md

@@ -1,12 +1,22 @@
 # @agile-team/wl-skills-ui
 
-**企业级 UI 一致性与 AI 精确治理工具包 v1.16.0** — 面向 Vue 3 + Element Plus 的设计令牌、能力 Profile、样式皮肤、页面骨架、运行时能力、静态扫描、确定性修复、AI Skill、MCP 与脱敏 UI 模板契约。
+> 项目范围：只对目标自身已接入且平台适用的项目判定规则；父工作区安装不启用子项目。移动端与未接入开源项目不套用。详见 [精准触发与范围配置](docs/project-scope.md)。
+
+**企业级 UI 一致性与 AI 精确治理工具包 v1.17.0** — 面向 Vue 3 + Element Plus 的设计令牌、能力 Profile、样式皮肤、页面骨架、运行时能力、静态扫描、确定性修复、AI Skill、MCP 与脱敏 UI 模板契约。
 
 它把“视觉统一、问题识别、机械修复、项目适配和样例沉淀”拆成可验证、可组合的工程能力。脚本、规则和 MCP 先完成确定性工作，AI 只处理业务语义与人工决策，从而减少重复读源码、上下文 token 和误修改。
 
 [![npm version](https://img.shields.io/npm/v/@agile-team/wl-skills-ui.svg)](https://www.npmjs.com/package/@agile-team/wl-skills-ui)
 [![Node](https://img.shields.io/badge/node-%3E%3D22-green.svg)]()
 
+## 如何确认本包正在起作用
+
+每次适用任务先运行项目本地 `wl-ui task "修改目标文件" --target src/Foo.vue --json`。编辑前展示真实 `notice`：包名与版本、判定、选中 Skill 或基础约束、具体规则、目标、runId 和尚未执行的检查。普通修改也需要基础约束提醒；相关但未覆盖的意图显示 gap 与建议；没有目标依据显示 needs-context，职责外显示 not-applicable，不强行匹配。
+
+执行实际检查时复用 `--run-id`，结束读取 `wl-ui status --run-id <id> --json`，分别报告执行和验证、实际检查文件、过期证据与未执行项。`notice.displayEvidence=unverified` 表示工具回执不能证明聊天界面展示；安装、路由或模型自报不能证明宿主加载/模型读取。
+
+`wl-ui doctor-host --json` 对比已分发规范、本地执行器和正在运行的版本，漂移会显式报告。规范更新不会替代依赖升级：同步本包依赖、锁文件和受管入口；未使用的兄弟包无需安装。重开/刷新宿主加载后仍需观察真实任务调用，不能宣称所有 AI 自动触发。
+
 ## 你能获得什么
 
 | 目标 | 包提供的能力 | 带来的效果 |
@@ -500,7 +510,7 @@ npx wl-ui doctor --project . --print-overrides
 
 ## 版本与进一步阅读
 
-当前 v1.16.0：公开集成协议 describe/request 统一信封（能力清单与路由语料经真实打包产物验证）、输入校验收口与 MCP 目录对齐真实 tools/list。v1.15.0：任务判定、真实执行/验证回执、实际检查范围和过期检测；Codex 原生薄入口按需加载 canonical Skill。确定性路由覆盖已发布目录与显式缺口，不保证识别所有自然语言。v1.14.0：明确独立能力边界，安装、更新、清理按本包贡献保护用户及其他包内容；共享文件采用单文件原子替换，支持历史路由与 `.clinerules` 目录迁移。v1.13.2：R044 审查多列表单超宽标签，R040 识别自定义 `stepper`，均供人工复核。v1.13.0：新增 `native-jh-ag` Profile、显式 Profile 兼容承诺与联邦 AG 依赖识别。
+当前 v1.18.0：公开集成协议 describe/request 统一信封（能力清单与路由语料经真实打包产物验证）、输入校验收口与 MCP 目录对齐真实 tools/list。v1.15.0：任务判定、真实执行/验证回执、实际检查范围和过期检测；Codex 原生薄入口按需加载 canonical Skill。确定性路由覆盖已发布目录与显式缺口，不保证识别所有自然语言。v1.14.0：明确独立能力边界，安装、更新、清理按本包贡献保护用户及其他包内容；共享文件采用单文件原子替换，支持历史路由与 `.clinerules` 目录迁移。v1.13.2：R044 审查多列表单超宽标签，R040 识别自定义 `stepper`，均供人工复核。v1.13.0：新增 `native-jh-ag` Profile、显式 Profile 兼容承诺与联邦 AG 依赖识别。
 
 - [版本摘要](docs/version-history.md)
 - [完整 Changelog](CHANGELOG.md)

package/SKILL.md

@@ -1,11 +1,15 @@
 ---
 name: wl-skills-ui
 description: |
+  Only for PC Vue admin projects that adopted wl-skills-ui; excludes mobile and unadopted projects.
   Audit and align Vue 3 + Element Plus enterprise UI projects with deterministic
   scanning, profile-aware fixes, design tokens, vendor adapters, and runtime guards.
   Use for UI consistency, legacy skin migration, rule diagnostics, or safe UI fixes.
 ---
 
+先确认目标项目自身的接入证据（本包安装清单、直接依赖或 `.wl-skills-scope.json` 显式启用），再判定任务。只在目标已接入且平台适用时读取规则；父目录安装、兄弟包、Vue 文件或触发词不能证明接入。未接入的开源项目不套用规则、不建议自动安装；UniApp/小程序/App/PDA/移动 H5 不适用。跨项目目标分别判定，沿最近项目边界停止，不能越过未接入子项目找父清单。工具返回 `scope` 作为静态范围证据，宿主加载仍需实际事件。
+
+
 # wl-skills-ui
 
 Use deterministic project facts before reading or editing business source. Rules,

package/bin/__tests__/protocol-cli.test.mjs

@@ -3,7 +3,7 @@
  */
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync } from "node:fs";
+import fs, { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -17,7 +17,9 @@ const pkg = require("../../package.json");
 const BIN = path.join(here, "..", "wl-ui.js");
 
 function tempRoot() {
-  return mkdtempSync(path.join(tmpdir(), "wl-ui-protocol-"));
+  const root = mkdtempSync(path.join(tmpdir(), "wl-ui-protocol-"));
+  fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ devDependencies: { "@agile-team/wl-skills-ui": "*" } }));
+  return root;
 }
 
 test("describe 返回协议版本、能力目录与五个统一操作", () => {

package/bin/__tests__/protocol-evidence.test.mjs

@@ -3,14 +3,16 @@
  */
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync } from "node:fs";
+import fs, { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
 const { protocol, runOperation } = await import("../protocol-cli.mjs");
 
 function tempRoot() {
-  return mkdtempSync(path.join(tmpdir(), "wl-ui-evidence-"));
+  const root = mkdtempSync(path.join(tmpdir(), "wl-ui-evidence-"));
+  fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ devDependencies: { "@agile-team/wl-skills-ui": "*" } }));
+  return root;
 }
 
 test("status 严格回查同一 runId：字段精确、不兜底", () => {

package/bin/__tests__/protocol-routing.test.mjs

@@ -4,7 +4,7 @@
  */
 import { test, before } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync } from "node:fs";
+import fs, { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -22,6 +22,7 @@ function tempRoot() {
 }
 
 function routeAt(projectRoot, task) {
+  if (!fs.existsSync(path.join(projectRoot, "package.json"))) fs.writeFileSync(path.join(projectRoot, "package.json"), JSON.stringify({ devDependencies: { "@agile-team/wl-skills-ui": "*" } }));
   return protocol.request({ operation: "route", projectRoot, task }, runOperation);
 }
 
@@ -40,7 +41,7 @@ for (const item of cases) {
   const expectedBare = item.skill ? "gap" : item.status;
   const expectedInstalled = item.installedStatus || (item.skill ? "matched" : item.status);
 
-  test(`未安装：「${item.task}」→ ${expectedBare}${item.skill ? ` + ${item.skill}` : ""}`, () => {
+  test(`已声明接入但未初始化：「${item.task}」→ ${expectedBare}${item.skill ? ` + ${item.skill}` : ""}`, () => {
     const envelope = routeAt(tempRoot(), item.task);
     assert.equal(envelope.ok, true);
     const decision = envelope.result.decision || envelope.result;

package/bin/project-scope.cjs

@@ -0,0 +1,198 @@
+"use strict";
+
+// Independent snapshot: project adoption is checked before skill intent or writes.
+const fs = require("node:fs");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const CONFIG = ".wl-skills-scope.json";
+const MANIFESTS = {
+  kit: ".wl-skills-manifest.json", ui: ".wl-skills-ui-manifest.json",
+  bd: ".wl-skills-bd-manifest.json", design: ".wl-skills-design/state.json", test: ".wl-skills-test/manifest.json",
+};
+const TYPES = new Set(["pc", "backend", "documents", "testing", "mobile", "workspace", "unknown"]);
+
+function inside(root, target) {
+  const rel = path.relative(root, target);
+  return !path.isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${path.sep}`);
+}
+
+// Resolve missing paths through their nearest existing ancestor, including symlinks.
+function realTarget(target) {
+  if (fs.existsSync(target)) return fs.realpathSync(target);
+  const parent = path.dirname(target);
+  if (parent === target) throw new Error("Cannot resolve target ancestor");
+  return path.join(realTarget(parent), path.basename(target));
+}
+
+function readJson(root, relative) {
+  const file = path.join(root, relative);
+  if (!fs.existsSync(file)) return { present: false, value: null };
+  try {
+    if (!inside(root, fs.realpathSync(file))) throw new Error("metadata path escapes project");
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("expected object");
+    return { present: true, value };
+  } catch (error) { return { present: true, value: null, error: `${relative}: ${error.message}` }; }
+}
+
+function boundary(root, fallback) {
+  const markers = ["package.json", ".git", CONFIG, ...Object.values(MANIFESTS)];
+  // A Java project's Maven modules share its adoption; a nested independent repo still stops lookup.
+  if (root === fallback || !fs.existsSync(path.join(fallback, "pom.xml"))) markers.push("pom.xml");
+  return markers.some((file) => fs.existsSync(path.join(root, file)));
+}
+
+function nearestRoot(target, fallback) {
+  let dir = fs.existsSync(target) && fs.statSync(target).isDirectory() ? target : path.dirname(target);
+  while (inside(fallback, dir)) {
+    if (boundary(dir, fallback) || dir === fallback) return dir;
+    dir = path.dirname(dir);
+  }
+  return null;
+}
+
+function targetRoots(root, targets) {
+  const resolved = targets.map((target) => realTarget(path.resolve(root, target)));
+  if (resolved.some((target) => !inside(root, target))) return { error: "target-outside-authorized-project", roots: [], resolved };
+  return { roots: [...new Set(resolved.map((target) => nearestRoot(target, root)))], resolved };
+}
+
+function scopeConfig(root) {
+  const config = readJson(root, CONFIG);
+  if (!config.present || config.error) return config;
+  const { value } = config;
+  const allowed = ["schemaVersion", "projectType", "packages"];
+  if (value.schemaVersion !== 1 || !TYPES.has(value.projectType) || Object.keys(value).some((key) => !allowed.includes(key)) || !validPackageSwitches(value.packages)) {
+    return { ...config, error: `${CONFIG}: invalid schemaVersion/projectType/packages` };
+  }
+  return config;
+}
+
+function validPackageSwitches(packages) {
+  if (packages === undefined) return true;
+  return Boolean(packages && typeof packages === "object" && !Array.isArray(packages) && Object.entries(packages).every(([key, enabled]) => Object.hasOwn(MANIFESTS, key) && typeof enabled === "boolean"));
+}
+
+function mobileEvidence(root, pkg) {
+  const deps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
+  const mobile = deps.filter((name) => /^@dcloudio\/uni(?:-|$)|^@tarojs\/|^react-native$|^expo$|^@ionic\/|^@capacitor\//.test(name));
+  if (fs.existsSync(path.join(root, "pages.json")) && fs.existsSync(path.join(root, "manifest.json"))) mobile.push("pages.json+manifest.json");
+  return mobile;
+}
+
+function adoption(root, key, packageName, pkg, config) {
+  const manifest = readJson(root, MANIFESTS[key]);
+  validateAdoptionManifest(manifest, key, packageName);
+  const declared = [pkg.dependencies, pkg.devDependencies, pkg.optionalDependencies].some((deps) => deps?.[packageName]);
+  const explicit = config.value?.packages?.[key] === true;
+  const installed = manifest.present && !manifest.error;
+  return { adopted: explicit || declared || installed, sources: [
+    ...(explicit ? [`${CONFIG}:packages.${key}`] : []), ...(declared ? ["package.json:direct-dependency"] : []),
+    ...(installed ? [MANIFESTS[key]] : []),
+  ], error: manifest.error || null };
+}
+
+function validateAdoptionManifest(manifest, key, packageName) {
+  if (!manifest.present || manifest.error) return;
+  const { value } = manifest;
+  if (typeof value.version !== "string" || !value.version.trim() || value.package && value.package !== packageName) manifest.error = `${MANIFESTS[key]}: invalid package/version`;
+}
+
+function verdict(status, reason, extra = {}) {
+  return { schemaVersion: 1, status, reason, adopted: false, projectType: "unknown", evidence: [], inherited: false, ...extra };
+}
+
+function inspectProject(root, key, packageName) {
+  const config = scopeConfig(root);
+  const packageFile = readJson(root, "package.json");
+  if (config.error || packageFile.error) return verdict("needs-context", "invalid-project-metadata", { diagnostics: [config.error || packageFile.error] });
+  const pkg = packageFile.value || {};
+  if (!["dependencies", "devDependencies", "optionalDependencies"].every((field) => validDependencies(pkg[field]))) {
+    return verdict("needs-context", "invalid-project-metadata", { diagnostics: ["package.json: dependency declarations must be nonempty strings"] });
+  }
+  const exclusion = platformExclusion(root, key, pkg, config);
+  if (exclusion) return exclusion;
+  const own = adoption(root, key, packageName, pkg, config);
+  if (own.error) return verdict("needs-context", "invalid-package-adoption", { diagnostics: [own.error] });
+  if (!own.adopted) return verdict("not-applicable", "package-not-adopted-in-target-project");
+  return adoptedScope(root, key, pkg, config, own);
+}
+
+function validDependencies(deps) {
+  if (deps === undefined) return true;
+  return Boolean(deps && typeof deps === "object" && !Array.isArray(deps) && Object.values(deps).every((value) => typeof value === "string" && value.trim()));
+}
+
+function platformExclusion(root, key, pkg, config) {
+  const mobile = mobileEvidence(root, pkg);
+  const type = config.value?.projectType;
+  if (mobile.length || type === "mobile") return verdict("not-applicable", "mobile-project-excluded", { projectType: "mobile", evidence: mobile.length ? mobile : [CONFIG] });
+  if (type === "workspace") return verdict("not-applicable", "aggregate-workspace-is-not-project", { projectType: type, evidence: [CONFIG] });
+  if (config.value?.packages?.[key] === false) return verdict("not-applicable", "package-explicitly-disabled", { projectType: type || "unknown", evidence: [CONFIG] });
+  return null;
+}
+
+function unsupportedFrontend(root, key, pkg, type) {
+  if (!["kit", "ui"].includes(key)) return false;
+  if (type && type !== "pc") return "pc-frontend-package-excluded";
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  return !deps.vue && (deps.react || deps.svelte || deps["@angular/core"] || fs.existsSync(path.join(root, "pom.xml"))) ? "unsupported-project-framework" : false;
+}
+
+function defaultType(key) { return { kit: "pc", ui: "pc", bd: "backend", design: "documents", test: "testing" }[key]; }
+
+function scopeFingerprint(root, key) {
+  const metadata = [CONFIG, "package.json", "pom.xml", MANIFESTS[key], "pages.json", "manifest.json"].map((file) => {
+    const full = path.join(root, file);
+    if (!fs.existsSync(full)) return [file, "missing"];
+    if (!inside(root, fs.realpathSync(full))) return [file, "external-metadata"];
+    try { return [file, crypto.createHash("sha256").update(fs.readFileSync(full)).digest("hex")]; }
+    catch (error) { return [file, `unreadable:${error.code}`]; }
+  });
+  return crypto.createHash("sha256").update(JSON.stringify(metadata)).digest("hex");
+}
+
+function adoptedScope(root, key, pkg, config, own) {
+  const type = config.value?.projectType;
+  if (type === "unknown") return verdict("needs-context", "project-platform-needs-context", { adopted: true, evidence: own.sources });
+  const unsupported = unsupportedFrontend(root, key, pkg, type);
+  if (unsupported) return verdict("not-applicable", unsupported, { adopted: true, projectType: type || "unknown", evidence: ["package.json/pom.xml", ...own.sources] });
+  return verdict("applicable", "target-project-explicitly-adopted-package", {
+    adopted: true, projectType: type || defaultType(key),
+    typeEvidence: type ? "explicit-config" : "adoption-default-not-host-observed", evidence: own.sources,
+  });
+}
+
+/** Parent installation, Vue files and keyword matches are never adoption evidence. */
+function resolveScope({ projectRoot, packageName, targets = [] }) {
+  const root = fs.realpathSync(path.resolve(projectRoot || process.cwd()));
+  const key = packageName.replace("@agile-team/wl-skills-", "");
+  if (!Object.hasOwn(MANIFESTS, key)) throw new Error("Unknown WL package");
+  const located = targetRoots(root, targets.filter((item) => typeof item === "string" && item.trim()));
+  if (located.error || located.roots.length > 1) return { projectRoot: root, targets, scope: verdict("needs-context", located.error || "multiple-project-targets-split-required", { projectRoots: located.roots }) };
+  const actualRoot = located.roots[0] || root;
+  const actualTargets = located.resolved.map((target) => path.relative(actualRoot, target).split(path.sep).join("/") || ".");
+  return { projectRoot: actualRoot, targets: actualTargets, scope: { ...inspectProject(actualRoot, key, packageName), projectRoot: actualRoot, fingerprint: scopeFingerprint(actualRoot, key) } };
+}
+
+function excludedDecision(scope) {
+  const messages = {
+    "mobile-project-excluded": "目标为移动端/UniApp/小程序项目，不适用本轮WL项目约束",
+    "aggregate-workspace-is-not-project": "目标是聚合工作区，请指定实际已接入项目",
+    "package-explicitly-disabled": "目标项目已明确禁用本包",
+    "package-not-adopted-in-target-project": "目标项目未接入本包，不继承父目录或兄弟项目的安装",
+    "pc-frontend-package-excluded": "目标项目不是已接入的PC前端，PC规范不适用",
+    "unsupported-project-framework": "目标技术栈不是本包支持的Vue管理端，不套用PC Vue规范",
+    "multiple-project-targets-split-required": "目标跨越多个项目，请按项目分别判定并复用任务runId",
+    "target-outside-authorized-project": "目标超出当前授权项目边界，请从实际目标项目根调用",
+    "project-platform-needs-context": "项目已接入但平台未确认，请确认PC/后端/文档/测试或移动端范围",
+  };
+  const reason = messages[scope.reason] || "项目范围元数据无效，需要核对后再应用规则";
+  return { recordVersion: 1, status: scope.status, applicable: scope.status === "needs-context" ? null : false,
+    reason, reasons: [reason], scope, selectedSkills: [], candidates: [], baselineRules: [], requiredRules: [],
+    ruleDetails: [], requiredChecks: [], requiredFiles: [], missingInputs: scope.status === "needs-context" ? ["有效的目标项目范围"] : [],
+    gaps: [], constraints: [], ready: false, executionStatus: "not-executed", validationStatus: "unverified",
+    selectionEvidence: "project-scope-before-intent", hostDiscovery: "unverified", contentLoaded: "unverified", unverified: ["host-discovery", "model-read-canonical-files"] };
+}
+
+module.exports = { CONFIG, MANIFESTS, resolveScope, excludedDecision };

package/bin/project-scope.schema.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "urn:wl-skills:project-scope:1",
+  "title": "Explicit WL project scope and per-package adoption",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "projectType"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": {
+      "const": 1
+    },
+    "projectType": {
+      "enum": [
+        "pc",
+        "backend",
+        "documents",
+        "testing",
+        "mobile",
+        "workspace",
+        "unknown"
+      ]
+    },
+    "packages": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "kit": {
+          "type": "boolean"
+        },
+        "ui": {
+          "type": "boolean"
+        },
+        "bd": {
+          "type": "boolean"
+        },
+        "design": {
+          "type": "boolean"
+        },
+        "test": {
+          "type": "boolean"
+        }
+      }
+    }
+  }
+}

package/bin/protocol-cli.mjs

@@ -80,7 +80,7 @@ export const protocol = createProtocol({
   packageName: pkg.name,
   packageVersion: pkg.version,
   capabilities: capabilitiesDocument.capabilities || [],
-  constraints: { node: (pkg.engines && pkg.engines.node) || null, boundaryVersion: capabilitiesDocument.boundaryVersion || null },
+  constraints: { projectScope: { config: ".wl-skills-scope.json", schema: "bin/project-scope.schema.json", adoption: "own-manifest-or-direct-dependency-or-explicit-enable", inheritance: "never-across-project-boundaries", excluded: ["mobile", "unadopted-project", "aggregate-workspace"] }, node: (pkg.engines && pkg.engines.node) || null, boundaryVersion: capabilitiesDocument.boundaryVersion || null },
   operations: OPERATIONS,
   inventory: buildInventory(),
 });

package/bin/task-gateway.mjs

@@ -3,13 +3,17 @@ export const GATEWAY_PATH = ".agents/skills/wl-skills-ui/SKILL.md";
 export function taskGateway() {
   return `---
 name: wl-skills-ui
-description: Vue and Element Plus UI consistency, design tokens, styles, component layout and visual rule checks. Decide the applicable UI workflow and verify actual source files using local package tools.
+description: Only for adopted PC Vue/Web admin projects; excludes mobile and unadopted projects. Vue and Element Plus UI consistency, design tokens, styles, component layout and visual rule checks. Decide the applicable UI workflow and verify actual source files using local package tools.
 ---
 
 # wl-skills-ui task gateway
 For one user task reuse the same \`--run-id\` or \`WL_TASK_RUN_ID\` across installed applicable packages. Do not install unused sibling packages or create unrelated IDs.
 
-1. Start each task with \`node node_modules/@agile-team/wl-skills-ui/bin/wl-ui.js task "<task>" --target <path>\`. Retain the run ID and briefly explain the decision, applicable rules and unverified items. A routing decision does not execute checks.
+先确认目标项目自身的接入证据（本包安装清单、直接依赖或 \`.wl-skills-scope.json\` 显式启用），再判定任务。只在目标已接入且平台适用时读取规则；父目录安装、兄弟包、Vue 文件或触发词不能证明接入。未接入的开源项目不套用规则、不建议自动安装；UniApp/小程序/App/PDA/移动 H5 不适用。跨项目目标分别判定，沿最近项目边界停止，不能越过未接入子项目找父清单。工具返回 \`scope\` 作为静态范围证据，宿主加载仍需实际事件。
+
+多项目工作区先沿目标路径向上找到本包安装清单与项目 AGENTS，切到该项目根再调用工具；不要以聚合工作区根代替 projectRoot，也不要在聚合根安装。不同项目分别保存项目身份，同一用户任务复用 runId。
+
+1. Start each relevant task from its project root with \`node node_modules/@agile-team/wl-skills-ui/bin/wl-ui.js task "<task>" --target <path> --json\`. Before editing, visibly show the returned \`notice\`: actual package/version, decision, Skill or baseline, rule IDs/names, target, runId and unverified checks. Include baseline and gaps. Report missing/unsupported local commands and version drift explicitly. A routing decision does not execute checks.
 2. Read \`node_modules/@agile-team/wl-skills-ui/SKILL.md\`, then only the selected canonical Skill under \`node_modules/@agile-team/wl-skills-ui/skills\`. Resolve references relative to that Skill. Honor the actual project Profile; do not infer a table migration from a Skill match.
 3. Run the actual scan/check/fix tools with the same \`--run-id\`. For a code gate use \`wl-ui scan --target <path> --fail-on-error --run-id <id>\`. An ordinary Vue edit still receives UI baseline checks; tasks outside the domain are not applicable.
 4. End with \`wl-ui status --run-id <id>\` and report execution separately from validation. Zero files, skipped checks, dependency-only checks and unresolved review items are not proof of all UI constraints passing.

package/bin/task-integration.mjs

@@ -2,6 +2,7 @@ import { readFileSync, readdirSync, existsSync, realpathSync } from "node:fs";
 import { join, relative, resolve, isAbsolute } from "node:path";
 import { parseArgs } from "node:util";
 import core from "./task-observability.cjs";
+import projectScope from "./project-scope.cjs";
 import { GATEWAY_PATH } from "./task-gateway.mjs";
 import { resolveProjectProfile } from "../standards/profiles-loader.mjs";
 import { getRules } from "../scanner/rules/index.mjs";
@@ -41,7 +42,7 @@ export function taskCatalog() {
   return catalogFiles(join(root, "skills")).map((file) => {
     const id = relative(join(root, "skills"), file).replace(/\\/g, "/").replace(/\/SKILL\.md$/, "");
     const content = readFileSync(file, "utf8");
-    return { id, path: `node_modules/${pkg.name}/skills/${id}/SKILL.md`, description: content.match(/^# (.+)$/m)?.[1] || id, triggers: TRIGGERS[id] || [], rules: POLICY.baselineRules, checks: ["scan"], status: "enabled" };
+    return { id, path: `node_modules/${pkg.name}/skills/${id}/SKILL.md`, description: content.match(/^# (.+)$/m)?.[1] || id, triggers: TRIGGERS[id] || [], rules: getRules().filter((rule) => rule.skills?.includes(id)).map((rule) => rule.id), checks: ["scan"], status: "enabled" };
   });
 }
 
@@ -70,15 +71,22 @@ function capabilityGap(decision, reason) {
 }
 
 export function runTaskAction(action, input = {}) {
-  const opts = taskOptions(input.projectRoot || process.env.WL_PROJECT_ROOT || process.cwd(), { runId: input.runId, targets: input.targets || [] });
+  const resolved = projectScope.resolveScope({ projectRoot: input.projectRoot || process.env.WL_PROJECT_ROOT || process.cwd(), packageName: pkg.name, targets: input.targets || [] });
+  const opts = taskOptions(resolved.projectRoot, { runId: input.runId, targets: resolved.targets });
   if (action === "status") return core.readStatus(opts);
   if (action === "doctor-host") return hostDiagnostic({ ...opts, host: input.host || "unknown" });
+  if (resolved.scope.status !== "applicable") return core.attachNotice(projectScope.excludedDecision(resolved.scope), opts);
   const profile = resolveProjectProfile({ projectRoot: opts.projectRoot, profile: input.profile }).profile;
-  const routed = decideTask({ task: input.task || "", targets: opts.targets, skill: input.skill });
-  const decision = { ...routed, profile: profile.id, applicableConstraints: routed.applicable === true ? getRules({ profile: profile.id }).map((rule) => rule.id) : [] };
+  const routed = decideTask({ task: input.task || "", targets: opts.targets, skill: input.skill, context: input.context });
+  const applicable = getRules({ profile: profile.id });
+  const enabled = new Set(applicable.map((rule) => rule.id));
+  const decision = { ...routed, scope: resolved.scope, profile: profile.id, applicableConstraints: routed.applicable === true ? [...enabled] : [] };
+  decision.baselineRules = decision.baselineRules.filter((id) => enabled.has(id));
+  decision.requiredRules = decision.requiredRules.filter((id) => enabled.has(id));
+  decision.ruleDetails = applicable.filter((rule) => decision.requiredRules.includes(rule.id)).map((rule) => ({ id: rule.id, name: rule.title, source: `node_modules/${pkg.name}/standards/rules.json` }));
   assetReadiness(decision, opts.projectRoot);
-  if (action !== "task") return decision;
-  return { ...decision, ...core.startTask({ ...opts, task: input.task || "", decision }) };
+  if (action !== "task") return core.attachNotice(decision, opts);
+  return core.attachNotice({ ...decision, ...core.startTask({ ...opts, task: input.task || "", decision }) }, opts);
 }
 
 function hostDiagnostic(opts) {