@atollhq/skill-codex 0.4.27 → 0.4.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atollhq/skill-codex",
-  "version": "0.4.27",
+  "version": "0.4.28",
   "description": "Install the Atoll project management integration for Codex CLI",
   "bin": {
     "skill-codex": "bin/install.mjs"

package/skill/SKILL.md

@@ -38,12 +38,17 @@ Read only the references required for the current task:
 - Request and response fields, enums, and validation:
   [api-fields.md](references/api-fields.md)
 
-For automation rule V1 actions (including create issue), CI create-only rules,
-event conditions, validation, safe disabling, and example-only CI dry runs, read [Automation Rule Fields](references/api-fields.md#automation-rule-fields).
+For automation rule V1 actions (including create issue), explicit project or
+organization scope, CI create-only rules, event conditions, validation, safe
+disabling, repair, and example-only CI dry runs, read [Automation Rule Fields](references/api-fields.md#automation-rule-fields).
 Use `atoll automation` for rule management, previews, and run history; see
 [CLI operations](references/cli-operations.md#automation-rules).
-Invalid rules execute no actions. Do not enable one before its full definition
-and references pass validation.
+Rule creates require an explicit `project_id`: use a project UUID for project
+scope or `null` for organization scope. Partial updates preserve the saved
+scope when `project_id` is omitted; include it only when intentionally changing
+scope. An invalid rule executes no actions. Repair an invalid rule with
+separate `disable`, `update` while it is disabled, `test`, and `enable`
+operations. Enable only after the latest saved revision passes the dry run.
 
 Do not load every reference by default. Start with this entrypoint and load a
 topic reference only when the requested operation needs it.

package/skill/references/api-endpoints.md

@@ -730,7 +730,15 @@ receive projectless work. An inaccessible explicit `projectId` is concealed as
 | POST | `/api/orgs/{id}/automation-rules/{ruleId}/test` | Dry-run test |
 
 V1 definitions validate on create, merged partial updates, dry runs, and runtime.
-A concurrent edit during validation returns `409`; reload before retrying.
+On create, `project_id` must be explicit: use a project UUID for project scope
+or `null` for organization scope. Partial updates preserve the saved scope
+when `project_id` is omitted; include it only when intentionally changing
+scope. A concurrent edit during validation returns `409`; reload before
+retrying. An enabled rule must be
+disabled with a separate exact `{ "enabled": false }` update before changing
+scope or repairing an invalid definition. A disabled invalid rule can be
+repaired while remaining disabled; run `test` on that saved revision before a
+separate `enable` update.
 GET/list preserve invalid rows with optional `validation: { valid, issues }`
 (`issues` contain `path`, `code`, and `message`). Owner/admin callers can disable
 an invalid rule with only `{ "enabled": false }`. Change-condition dry runs

package/skill/references/api-fields.md

@@ -553,7 +553,12 @@ Create and partial `PUT` requests reject unknown keys, unsupported versions,
 malformed conditions/actions, and invalid references with `400` and
 `issues: [{ path, code, message }]`. A partial update is merged with the stored
 definition and the complete result is validated. If another edit changes the rule
-during validation, `PUT` returns `409`; reload the rule before retrying. Project-scoped status values
+during validation, `PUT` returns `409`; reload the rule before retrying. An enabled
+rule must be disabled by a separate exact `{ "enabled": false }` request before
+changing `project_id`; combining disable with a scope change is rejected. An
+enabled invalid rule must also be disabled separately before repair. A disabled
+invalid rule accepts a valid repair only while remaining disabled; repair and
+enable must be separate. Project-scoped status values
 must exist in that workflow; project, member, and label references must belong
 to the organization. A request containing only `{ "enabled": false }` can
 disable an invalid rule without changing its definition; owner/admin access

package/skill/references/cli-operations.md

@@ -201,7 +201,9 @@ Use `atoll automation list`, `get <rule-uuid>`, `create --file rule.json`,
 `runs <rule-uuid> --limit 20`, `enable`, `disable`, and `delete --force`.
 Use `delete <rule-uuid> --dry-run` to preview deletion. Use `--json`
 for machine-readable results and `--file -` for standard input. Create defaults
-to disabled when `enabled` is omitted; update preserves omitted fields.
+to disabled when `enabled` is omitted, but the JSON must include an explicit
+`project_id` UUID or `null` for Organization-wide scope; update preserves omitted
+fields.
 List uses the selected organization and applies a project filter only with
 explicit `--project`; it does not inherit the default project.
 
@@ -213,4 +215,7 @@ The action chooses its target project/status and accepts approved
 CI `test` sends `{}` by default, uses marked fixed examples, rejects overrides,
 and executes no actions. Inspect the preview before explicitly enabling.
 Rule writes, tests, and run history require owner/admin access; CLI does not bypass it.
-`runs` preserves created issue IDs and interrupted-action evidence.
+`runs` preserves created issue IDs and interrupted-action evidence. For an invalid
+rule, use separate `disable`, `update` while disabled, `test`, and `enable`
+operations. Human `get` output includes invalid state and validation paths;
+`--json` preserves the API response.