@danypops/papyrus 0.47.2 → 0.48.0

package/src/domain/project-registry.ts

@@ -0,0 +1,58 @@
+/**
+ * A registered project identity, shared across every artifact kind (Tasks, Docs, Rules,
+ * Playbooks) rather than owned by Tasks alone -- extracted so a Doc/Rule/Playbook can resolve
+ * and register against the exact same id/name/alias/root space a Task already does, instead of
+ * each domain inventing its own project catalog.
+ */
+export interface Project {
+	id: string;
+	name: string;
+	aliases: string[];
+	projectRoot: string;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface RegisterProjectInput {
+	projectRoot: string;
+	name?: string;
+	aliases?: string[];
+	existingId?: string;
+}
+
+export class ProjectNotFoundError extends Error {}
+export class ProjectAmbiguousError extends Error {}
+
+export interface ProjectReferenceLookup {
+	matchingProjects(reference: string): Project[];
+	projects(query: string | undefined, limit: number): Project[];
+}
+
+/**
+ * Same bounded, fail-closed exact-reference resolution Tasks' own resolveProject already uses
+ * (case-insensitive exact id/name/alias/root, zero matches is an error with up to 10 bounded
+ * candidates, more than one match is an error listing every match up to 10) -- extracted here so
+ * a non-Task domain (Rules, and later Docs/Playbooks) gets the identical contract instead of a
+ * hand-rolled approximation. Tasks' own TaskProjectNotFoundError/TaskProjectAmbiguousError are
+ * deliberately left as they are (a working, tested path with its own established call sites);
+ * this is for every domain that never had project-reference resolution before.
+ */
+export function resolveProjectReference(registry: ProjectReferenceLookup, reference: string): Project {
+	const matches = registry.matchingProjects(reference);
+	if (matches.length === 0) {
+		const candidates = registry.projects(reference, 10);
+		const fallback = candidates.length === 0 ? registry.projects(undefined, 10) : candidates;
+		const suffix =
+			fallback.length === 0 ? "" : ` Candidates: ${fallback.map((project) => `${project.name} (${project.projectRoot})`).join(", ")}`;
+		throw new ProjectNotFoundError(`no project named or aliased "${reference}" is registered.${suffix}`);
+	}
+	if (matches.length > 1) {
+		throw new ProjectAmbiguousError(
+			`project reference "${reference}" is ambiguous: ${matches
+				.slice(0, 10)
+				.map((project) => `${project.name} (${project.projectRoot})`)
+				.join(", ")}`,
+		);
+	}
+	return matches[0]!;
+}

package/src/domain/task-scope.ts

@@ -1,5 +1,6 @@
 import { basename, isAbsolute, normalize } from "node:path";
 import { TASK_PROJECT_ROOT_MAX_LENGTH } from "../constants.ts";
+import type { Project, RegisterProjectInput } from "./project-registry.ts";
 
 export type TaskViewMode = "project" | "graph" | "all";
 export type TaskScopeSource = "cwd" | "explicit" | "unscoped";
@@ -10,21 +11,10 @@ export interface TaskProjectScope {
 	source: TaskScopeSource;
 }
 
-export interface TaskProject {
-	id: string;
-	name: string;
-	aliases: string[];
-	projectRoot: string;
-	createdAt: string;
-	updatedAt: string;
-}
+/** Task's own name for the shared, kind-neutral Project identity -- see project-registry.ts. Kept as a type alias so every existing Task-scope call site keeps working unchanged. */
+export type TaskProject = Project;
 
-export interface RegisterTaskProjectInput {
-	projectRoot: string;
-	name?: string;
-	aliases?: string[];
-	existingId?: string;
-}
+export type RegisterTaskProjectInput = RegisterProjectInput;
 
 export interface TaskViewPreference {
 	projectRoot: string;

package/src/handlers/registry.ts

@@ -12,6 +12,7 @@ import type { ArtifactTrashStore } from "../artifact/artifact-trash-store.ts";
 import type { AuthorityRegistry } from "../authority-registry.ts";
 import type { Discussions } from "../discussion/discussion-service.ts";
 import type { Notes } from "../note/note-service.ts";
+import type { ProjectRegistryStore } from "../ports/project-registry-store.ts";
 import type { SessionIdentity } from "../session-identity/session-identity-service.ts";
 import type { TaskEventStore } from "../stores/task-event-store.ts";
 import type { TaskScopeStore } from "../stores/task-scope-store.ts";
@@ -34,6 +35,7 @@ export interface PapyrusVehicleDeps {
 	tasks: Tasks;
 	discussions: Discussions;
 	sessionIdentity: SessionIdentity;
+	projectRegistry: ProjectRegistryStore;
 }
 
 export function createPapyrusVehicleRegistry(deps: PapyrusVehicleDeps): VehicleRegistry {
@@ -48,7 +50,7 @@ export function createPapyrusVehicleRegistry(deps: PapyrusVehicleDeps): VehicleR
 	// session_id, a correlation id, not a secret -- see session-identity-service.ts).
 	registry.setExposeHandlerFailureDetails(true);
 	registerNotesVehicleOperations(registry, deps.notes, deps.artifacts);
-	registerRulesVehicleOperations(registry, deps.artifacts, deps.scopes);
+	registerRulesVehicleOperations(registry, deps.artifacts, deps.scopes, deps.projectRegistry);
 	registerDocsVehicleOperations(registry, deps.artifacts, deps.scopes, deps.authority);
 	registerPlaybooksVehicleOperations(registry, {
 		artifacts: deps.artifacts,

package/src/handlers/rules.ts

@@ -8,12 +8,20 @@ import type { VehicleRegistry } from "@danypops/vehicle-server";
 import type { ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "../artifact/artifact-store.ts";
 import { rulesOperations } from "../modules/rules.ts";
+import type { ProjectRegistryStore } from "../ports/project-registry-store.ts";
 import { listRules } from "../rules/rules-service.ts";
 import { booleanProp, createOperationDefiner, numberProp, resolveArtifactIdWidened, stringProp, validationError } from "./shared.ts";
 
 const OWNER = "rules";
 
-/** Resolves a rule's id from either an explicit id or its title, widened past project_root when unscoped-vs-scoped search finds nothing. */
+/**
+ * Resolves a rule's id from either an explicit id or its title. When project_root is given and
+ * the project-scoped search finds nothing, widens only to a rule that actually APPLIES to this
+ * project (global, or explicitly scoped to it via appliesToProjectRoot) -- never to a same-named
+ * rule that belongs to a different project. A prior version widened to every rule of that name
+ * across every project unconditionally once the scoped search came up empty, silently leaking a
+ * name-based mutation across project boundaries.
+ */
 function resolveRuleId(
 	artifacts: ArtifactStore,
 	scopes: ArtifactScopeStore,
@@ -27,7 +35,9 @@ function resolveRuleId(
 		artifacts,
 		name,
 		() => listRules(artifacts, scopes, { text: name, projectRoot }),
-		projectRoot === undefined ? undefined : () => listRules(artifacts, scopes, { text: name }),
+		projectRoot === undefined
+			? undefined
+			: () => artifacts.query({ kind: "rule", text: name }).filter((rule) => scopes.appliesToProjectRoot(rule.id, projectRoot)),
 	);
 }
 
@@ -42,8 +52,13 @@ function resolveTaskId(artifacts: ArtifactStore, _projectRoot: string | undefine
 	return resolveArtifactIdWidened(artifacts, name, () => artifacts.query({ kind: "task", text: name }));
 }
 
-export function registerRulesVehicleOperations(registry: VehicleRegistry, artifacts: ArtifactStore, scopes: ArtifactScopeStore): void {
-	const moduleOperations = new Map(rulesOperations(artifacts, scopes).map((op) => [op.name, op]));
+export function registerRulesVehicleOperations(
+	registry: VehicleRegistry,
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	projectRegistry: ProjectRegistryStore,
+): void {
+	const moduleOperations = new Map(rulesOperations(artifacts, scopes, projectRegistry).map((op) => [op.name, op]));
 	const call = (name: string, input: Record<string, unknown>): unknown => moduleOperations.get(name)!.execute(input);
 	const define = createOperationDefiner(registry, OWNER, "rules", ["rules:read", "rules:write"], call);
 
@@ -62,6 +77,7 @@ export function registerRulesVehicleOperations(registry: VehicleRegistry, artifa
 			extra: { type: "object" } as unknown as { type: string },
 			template_id: stringProp,
 			project_root: stringProp,
+			projects: { type: "array" } as unknown as { type: string },
 			actor: stringProp,
 			source: stringProp,
 			session_id: stringProp,
@@ -153,6 +169,77 @@ export function registerRulesVehicleOperations(registry: VehicleRegistry, artifa
 		(input) => ({ ...input, id: resolveRuleId(artifacts, scopes, undefined, input.id, input.name) }),
 	);
 
+	define(
+		"scope",
+		"Shows a Rule's real project scope: global (applies everywhere) or the bounded set of registered projects it applies to.",
+		"read",
+		{ id: stringProp, name: stringProp, project_root: stringProp },
+		[],
+		(input) => ({ ...input, id: resolveRuleId(artifacts, scopes, input.project_root as string | undefined, input.id, input.name) }),
+	);
+
+	define(
+		"set_global",
+		"Makes a Rule apply in every project, clearing any project membership. The only way to widen an active project-bound Rule back to global -- removing its last membership through remove_project is rejected instead.",
+		"local-write",
+		{ id: stringProp, name: stringProp, project_root: stringProp, actor: stringProp, source: stringProp, session_id: stringProp },
+		[],
+		(input) => ({ ...input, id: resolveRuleId(artifacts, scopes, input.project_root as string | undefined, input.id, input.name) }),
+	);
+
+	define(
+		"add_project",
+		"Adds one registered project (exact id, name, alias, or root) to a Rule's membership, switching it from global to project-bound if it was global. Idempotent if the project is already a member.",
+		"local-write",
+		{
+			id: stringProp,
+			name: stringProp,
+			project: { ...stringProp, description: "Exact project id, name, alias, or registered root to add." },
+			project_root: stringProp,
+			actor: stringProp,
+			source: stringProp,
+			session_id: stringProp,
+		},
+		["project"],
+		(input) => ({ ...input, id: resolveRuleId(artifacts, scopes, input.project_root as string | undefined, input.id, input.name) }),
+	);
+
+	define(
+		"remove_project",
+		"Removes one registered project from a Rule's membership. Rejected while it is the Rule's only remaining membership -- call set_global first if the Rule should stop being project-bound entirely.",
+		"local-write",
+		{
+			id: stringProp,
+			name: stringProp,
+			project: { ...stringProp, description: "Exact project id, name, alias, or registered root to remove." },
+			project_root: stringProp,
+			actor: stringProp,
+			source: stringProp,
+			session_id: stringProp,
+		},
+		["project"],
+		(input) => ({ ...input, id: resolveRuleId(artifacts, scopes, input.project_root as string | undefined, input.id, input.name) }),
+	);
+
+	define(
+		"replace_projects",
+		"Replaces a Rule's entire project membership with exactly this bounded, non-empty list of registered project references (id/name/alias/root). Use set_global instead to clear scoping entirely.",
+		"local-write",
+		{
+			id: stringProp,
+			name: stringProp,
+			projects: { type: "array", description: "Non-empty list of exact project id/name/alias/root references." } as unknown as {
+				type: string;
+			},
+			project_root: stringProp,
+			actor: stringProp,
+			source: stringProp,
+			session_id: stringProp,
+		},
+		["projects"],
+		(input) => ({ ...input, id: resolveRuleId(artifacts, scopes, input.project_root as string | undefined, input.id, input.name) }),
+	);
+
 	define(
 		"update",
 		"Changes a Rule's title/body/labels (at least one required). Body updates still enforce the same combined condition+action+body context-tax bound as creation. The response includes combinedLength and a non-blocking warning once it exceeds the ~600-character soft target.",

package/src/modules/rules.ts

@@ -15,14 +15,20 @@ import { type Artifact, summarizeArtifact } from "../artifact/artifact.ts";
 import type { ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "../artifact/artifact-store.ts";
 import type { OperationDefinition } from "../module-registry.ts";
+import type { ProjectRegistryStore } from "../ports/project-registry-store.ts";
 import {
+	addRuleProject,
 	assignRuleProject,
 	createRule,
 	gateTaskWithRule,
 	listRules,
 	previewRule,
+	removeRuleProject,
+	replaceRuleProjects,
 	ruleCombinedLength,
 	ruleCombinedLengthWarning,
+	ruleScope,
+	setRuleGlobal,
 	showRule,
 	transitionRule,
 	updateRule,
@@ -71,10 +77,19 @@ export const RULES_OPERATION_NAMES = [
 	"rules.disable",
 	"rules.gate",
 	"rules.assign_project",
+	"rules.scope",
+	"rules.set_global",
+	"rules.add_project",
+	"rules.remove_project",
+	"rules.replace_projects",
 	"rules.update",
 ] as const;
 
-export function rulesOperations(artifacts: ArtifactStore, scopes: ArtifactScopeStore): OperationDefinition[] {
+export function rulesOperations(
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	registry: ProjectRegistryStore,
+): OperationDefinition[] {
 	const define = <Input, Output>(name: string, execute: (input: Input) => Output): OperationDefinition<Input, Output> => ({
 		name,
 		moduleId: MODULE_ID,
@@ -97,8 +112,10 @@ export function rulesOperations(artifacts: ArtifactStore, scopes: ArtifactScopeS
 						extra: input.extra as Record<string, unknown> | undefined,
 						templateId: optionalString(input, "template_id") ?? optionalString(input, "templateId"),
 						projectRoot: optionalString(input, "project_root"),
+						projectReferences: input.projects as string[] | undefined,
 					},
 					eventContext(input),
+					registry,
 				),
 			),
 		),
@@ -125,6 +142,17 @@ export function rulesOperations(artifacts: ArtifactStore, scopes: ArtifactScopeS
 		define("rules.assign_project", (input: OperationInput) =>
 			assignRuleProject(artifacts, scopes, string(input, "id"), optionalString(input, "project_root")),
 		),
+		define("rules.scope", (input: OperationInput) => ruleScope(artifacts, scopes, string(input, "id"))),
+		define("rules.set_global", (input: OperationInput) => setRuleGlobal(artifacts, scopes, string(input, "id"))),
+		define("rules.add_project", (input: OperationInput) =>
+			addRuleProject(artifacts, scopes, registry, string(input, "id"), string(input, "project")),
+		),
+		define("rules.remove_project", (input: OperationInput) =>
+			removeRuleProject(artifacts, scopes, registry, string(input, "id"), string(input, "project")),
+		),
+		define("rules.replace_projects", (input: OperationInput) =>
+			replaceRuleProjects(artifacts, scopes, registry, string(input, "id"), (input.projects as string[] | undefined) ?? []),
+		),
 		define("rules.update", (input: OperationInput) =>
 			withRuleLengthInfo(
 				updateRule(

package/src/ops.ts

@@ -496,6 +496,7 @@ export function purgeDueArtifacts(db: Db, now: () => string = () => new Date().t
 			db.prepare("DELETE FROM task_scopes WHERE task_id = ?").run(id);
 			db.prepare("DELETE FROM task_views WHERE root_task_id = ?").run(id);
 			db.prepare("DELETE FROM graph_projection_identities WHERE artifact_id = ?").run(id);
+			db.prepare("DELETE FROM artifact_scope_projects WHERE artifact_id = ?").run(id);
 			db.prepare("DELETE FROM artifact_scopes WHERE artifact_id = ?").run(id);
 			db.prepare("DELETE FROM task_events WHERE task_id = ?").run(id);
 			db.prepare("DELETE FROM note_events WHERE note_id = ?").run(id);

package/src/ports/project-registry-store.ts

@@ -0,0 +1,13 @@
+import type { Project, RegisterProjectInput } from "../domain/project-registry.ts";
+
+/**
+ * Kind-neutral project identity, shared by Task scope and every non-Task artifact scope
+ * (Docs/Rules/Playbooks) rather than each domain keeping its own catalog. TaskScopeStore
+ * composes one of these for its own `projects`/`matchingProjects`/`registerProject` methods
+ * instead of implementing project bookkeeping itself; ArtifactScopeStore does the same.
+ */
+export interface ProjectRegistryStore {
+	projects(query: string | undefined, limit: number): Project[];
+	matchingProjects(reference: string): Project[];
+	registerProject(input: RegisterProjectInput): Project;
+}

package/src/rules/rules-service.ts

@@ -8,9 +8,14 @@
 import type { Artifact } from "../artifact/artifact.ts";
 import { requireLocallyOwnedContent } from "../artifact/artifact.ts";
 import type { ArtifactEventContext } from "../artifact/artifact-event.ts";
-import type { ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
+import type { ArtifactScope, ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "../artifact/artifact-store.ts";
-import { RULE_TEXT_HARD_LIMIT_CHARACTERS, RULE_TEXT_SOFT_TARGET_CHARACTERS } from "../constants.ts";
+import {
+	ARTIFACT_SCOPE_MAX_PROJECTS_PER_ARTIFACT,
+	RULE_TEXT_HARD_LIMIT_CHARACTERS,
+	RULE_TEXT_SOFT_TARGET_CHARACTERS,
+} from "../constants.ts";
+import { resolveProjectReference } from "../domain/project-registry.ts";
 import { normalizeProjectRoot } from "../domain/task-scope.ts";
 import {
 	assertLabelsBounds,
@@ -24,6 +29,7 @@ import {
 	type TransitionTable,
 	type UpdateContentInput,
 } from "../domain-service-shared.ts";
+import type { ProjectRegistryStore } from "../ports/project-registry-store.ts";
 
 export interface CreateRuleInput {
 	title: string;
@@ -36,6 +42,8 @@ export interface CreateRuleInput {
 	extra?: Record<string, unknown>;
 	templateId?: string;
 	projectRoot?: string;
+	/** Bounded exact registered project references (id/name/alias/root) -- fail-closed unlike projectRoot's auto-register-by-root legacy form. Takes precedence over projectRoot when both are given. */
+	projectReferences?: string[];
 }
 
 export type RuleTransition = "enable" | "disable";
@@ -121,8 +129,12 @@ export function createRule(
 	scopes: ArtifactScopeStore,
 	input: CreateRuleInput,
 	context?: ArtifactEventContext,
+	registry?: ProjectRegistryStore,
 ): Artifact {
 	assertRuleTextWithinBounds(input.condition, input.action, input.body);
+	if (input.projectReferences !== undefined && input.projectReferences.length > 0 && registry === undefined) {
+		throw new Error("projectReferences requires a project registry");
+	}
 	const projectRoot = input.projectRoot === undefined ? undefined : normalizeProjectRoot(input.projectRoot);
 	const rule = artifacts.create(
 		{
@@ -143,7 +155,15 @@ export function createRule(
 		},
 		context,
 	);
-	scopes.assign(rule.id, projectRoot, projectRoot === undefined ? "unscoped" : "explicit");
+	if (input.projectReferences !== undefined && input.projectReferences.length > 0) {
+		if (input.projectReferences.length > ARTIFACT_SCOPE_MAX_PROJECTS_PER_ARTIFACT) {
+			throw new Error(`projectReferences may include at most ${ARTIFACT_SCOPE_MAX_PROJECTS_PER_ARTIFACT} entries`);
+		}
+		const ids = input.projectReferences.map((reference) => resolveProjectReference(registry!, reference).id);
+		scopes.replaceProjects(rule.id, ids, "explicit");
+	} else {
+		scopes.assign(rule.id, projectRoot, projectRoot === undefined ? "unscoped" : "explicit");
+	}
 	return rule;
 }
 
@@ -161,22 +181,91 @@ export function assignRuleProject(
 }
 
 /**
- * Global rules always apply; scoped workflow-run rules apply only while their run owns active
- * focus. Both a workflow-definition target's own run scope ("skill-run", written by
- * workflow-execution.ts's runWorkflowSteps for that target kind) and a Playbook's own run scope
- * ("playbook-run", same call for a Playbook target) are recognized -- confirmed live that only
- * "skill-run" was ever checked here, silently breaking Playbook-run-scoped rule injection since
- * Playbook gained its own doc/rule structured steps.
+ * The multi-project scope surface rules.assign_project cannot express (more than one membership,
+ * or exact fail-closed reference resolution instead of assign's auto-register-by-root). id is
+ * resolved through requireKind so these reject the same way against a non-Rule or unknown id as
+ * every other rules.* mutation; the project REFERENCE (name/alias/root) is resolved through the
+ * shared registry's resolveProjectReference, so an unknown or ambiguous project fails closed with
+ * bounded candidates rather than silently creating a new registration or guessing.
+ */
+export function ruleScope(artifacts: ArtifactStore, scopes: ArtifactScopeStore, id: string): ArtifactScope {
+	requireKind(artifacts, id, "rule");
+	return scopes.scope(id);
+}
+
+export function setRuleGlobal(artifacts: ArtifactStore, scopes: ArtifactScopeStore, id: string): ArtifactScope {
+	requireKind(artifacts, id, "rule");
+	return scopes.setGlobal(id, "explicit");
+}
+
+export function replaceRuleProjects(
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	registry: ProjectRegistryStore,
+	id: string,
+	projectReferences: readonly string[],
+): ArtifactScope {
+	requireKind(artifacts, id, "rule");
+	if (projectReferences.length === 0) throw new Error("projectReferences must be non-empty; use rules.set_global to clear scoping");
+	if (projectReferences.length > ARTIFACT_SCOPE_MAX_PROJECTS_PER_ARTIFACT) {
+		throw new Error(`projectReferences may include at most ${ARTIFACT_SCOPE_MAX_PROJECTS_PER_ARTIFACT} entries`);
+	}
+	const ids = projectReferences.map((reference) => resolveProjectReference(registry, reference).id);
+	return scopes.replaceProjects(id, ids, "explicit");
+}
+
+export function addRuleProject(
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	registry: ProjectRegistryStore,
+	id: string,
+	projectReference: string,
+): ArtifactScope {
+	requireKind(artifacts, id, "rule");
+	const project = resolveProjectReference(registry, projectReference);
+	return scopes.addProject(id, project.id, "explicit");
+}
+
+export function removeRuleProject(
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	registry: ProjectRegistryStore,
+	id: string,
+	projectReference: string,
+): ArtifactScope {
+	requireKind(artifacts, id, "rule");
+	const project = resolveProjectReference(registry, projectReference);
+	return scopes.removeProject(id, project.id);
+}
+
+/** The extra.scope run-gating check alone -- a Rule with no extra.scope always passes this; one with a skill-run/playbook-run scope passes only while its run owns activeTaskId. Both a workflow-definition target's own run scope ("skill-run", written by workflow-execution.ts's runWorkflowSteps for that target kind) and a Playbook's own run scope ("playbook-run", same call for a Playbook target) are recognized -- confirmed live that only "skill-run" was ever checked here, silently breaking Playbook-run-scoped rule injection since Playbook gained its own doc/rule structured steps. */
+function passesRunScope(rule: Artifact, activeTaskId: string | undefined): boolean {
+	const scope = rule.extra.scope;
+	if (scope === undefined) return true;
+	if (typeof scope !== "object" || scope === null || Array.isArray(scope)) return false;
+	const value = scope as Record<string, unknown>;
+	if ((value.type !== "skill-run" && value.type !== "playbook-run") || !Array.isArray(value.taskIds)) return false;
+	return activeTaskId !== undefined && value.taskIds.some((id) => id === activeTaskId);
+}
+
+/**
+ * Global rules always apply everywhere; a project-bound Rule (ArtifactScopeStore's own
+ * project-membership scope, orthogonal to extra.scope's run-gating) is applicable only when
+ * projectRoot resolves to one of its registered project memberships. Both checks are an AND, not
+ * an alternative: extra.scope's own run-gating can no longer bypass project scope, and project
+ * membership can no longer bypass run-gating -- confirmed live that a project-bound Rule was
+ * injected into every project before this fix, since this function never consulted
+ * ArtifactScopeStore at all despite rules.assign_project already existing.
  */
-export function listInjectableRules(artifacts: ArtifactStore, activeTaskId?: string): Artifact[] {
+export function listInjectableRules(
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	projectRoot: string | undefined,
+	activeTaskId?: string,
+): Artifact[] {
 	return artifacts.query({ kind: "rule", status: "active" }).filter((rule) => {
 		if (rule.subtype === "artifact-template") return false;
-		const scope = rule.extra.scope;
-		if (scope === undefined) return true;
-		if (typeof scope !== "object" || scope === null || Array.isArray(scope)) return false;
-		const value = scope as Record<string, unknown>;
-		if ((value.type !== "skill-run" && value.type !== "playbook-run") || !Array.isArray(value.taskIds)) return false;
-		return activeTaskId !== undefined && value.taskIds.some((id) => id === activeTaskId);
+		return passesRunScope(rule, activeTaskId) && scopes.appliesToProjectRoot(rule.id, projectRoot);
 	});
 }
 

package/src/service.ts

@@ -4,6 +4,7 @@ import { createVehicleHttpApp } from "@danypops/vehicle-server/http";
 import type { Logger } from "@danypops/vehicle-server/logging";
 import type { CreateArtifactInput } from "./artifact/artifact.ts";
 import type { ArtifactEventReader } from "./artifact/artifact-event-reader.ts";
+import type { ArtifactScopeStore } from "./artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "./artifact/artifact-store.ts";
 import { removeArtifactSubtree } from "./artifact/artifact-subtree.ts";
 import type { ArtifactTrashStore } from "./artifact/artifact-trash-store.ts";
@@ -38,6 +39,7 @@ import { SQLiteGateRunner } from "./stores/sqlite-gate-runner.ts";
 import { SQLiteGraphProjectionStore } from "./stores/sqlite-graph-projection-store.ts";
 import { SQLiteLogStore } from "./stores/sqlite-log-store.ts";
 import { SQLiteNoteEventStore } from "./stores/sqlite-note-event-store.ts";
+import { SQLiteProjectRegistryStore } from "./stores/sqlite-project-registry-store.ts";
 import { SQLiteSessionIdentityStore } from "./stores/sqlite-session-identity-store.ts";
 import { SQLiteTaskCreateRequestStore } from "./stores/sqlite-task-create-request-store.ts";
 import { SQLiteTaskEventStore } from "./stores/sqlite-task-event-store.ts";
@@ -216,6 +218,7 @@ function handlers(
 	_notes: Notes,
 	_events: TaskEventStore,
 	_scopes: TaskScopeStore,
+	artifactScopes: ArtifactScopeStore,
 	migrate: () => unknown,
 	moduleRegistry: OperationRegistry,
 	authority: AuthorityRegistry,
@@ -345,8 +348,12 @@ function handlers(
 			const id = string(input, "id");
 			return artifacts.get(id)?.kind === "task" ? tasks.runGates(id, eventContextFor(input, "gates-api")) : gates.runAsync(id);
 		},
-		"rules.injectable": (input) =>
-			listInjectableRules(artifacts, tasks.active(taskFilter(input))?.id).map(({ id, title, body, extra }) => ({ id, title, body, extra })),
+		"rules.injectable": (input) => {
+			const filter = taskFilter(input);
+			return listInjectableRules(artifacts, artifactScopes, filter.projectRoot, tasks.active(filter)?.id).map(
+				({ id, title, body, extra }) => ({ id, title, body, extra }),
+			);
+		},
 		"tasks.create": forwardToModule("tasks.create"),
 		"tasks.update": forwardToModule("tasks.update"),
 		"tasks.list": forwardToModule("tasks.list"),
@@ -414,6 +421,11 @@ function handlers(
 		"rules.disable": forwardToModule("rules.disable"),
 		"rules.gate": forwardToModule("rules.gate"),
 		"rules.assign_project": forwardToModule("rules.assign_project"),
+		"rules.scope": forwardToModule("rules.scope"),
+		"rules.set_global": forwardToModule("rules.set_global"),
+		"rules.add_project": forwardToModule("rules.add_project"),
+		"rules.remove_project": forwardToModule("rules.remove_project"),
+		"rules.replace_projects": forwardToModule("rules.replace_projects"),
 		"rules.update": forwardToModule("rules.update"),
 		"playbooks.create": forwardToModule("playbooks.create"),
 		"playbooks.list": forwardToModule("playbooks.list"),
@@ -462,6 +474,7 @@ export function createPapyrusService(path: string): PapyrusService {
 	const notes = new Notes(artifacts, noteEvents);
 	const projections = new SQLiteGraphProjectionStore(db);
 	const artifactScopes = new SQLiteArtifactScopeStore(db);
+	const projectRegistry = new SQLiteProjectRegistryStore(db);
 	const logs = new Logs(new SQLiteLogStore(db));
 	const sessionIdentity = new SessionIdentity(new SQLiteSessionIdentityStore(db));
 	const discussions = new Discussions(artifacts, new SQLiteDiscussionRoundStore(db));
@@ -476,6 +489,7 @@ export function createPapyrusService(path: string): PapyrusService {
 		tasks,
 		discussions,
 		sessionIdentity,
+		projectRegistry,
 	});
 	const moduleRegistry = new OperationRegistry();
 	moduleRegistry.registerAll(notesOperations(notes));
@@ -484,10 +498,10 @@ export function createPapyrusService(path: string): PapyrusService {
 	moduleRegistry.registerAll(discussOperations(discussions));
 	moduleRegistry.registerAll(tasksOperations(tasks, artifacts, sessionIdentity));
 	moduleRegistry.registerAll(docsOperations(artifacts, artifactScopes, authority));
-	moduleRegistry.registerAll(rulesOperations(artifacts, artifactScopes));
+	moduleRegistry.registerAll(rulesOperations(artifacts, artifactScopes, projectRegistry));
 	moduleRegistry.registerAll(playbooksOperations({ artifacts, events, scopes, artifactScopes, tasks, sessionIdentity }));
 	moduleRegistry.registerAll(graphProjectionOperations(artifacts, projections, authority));
-	const registry = handlers(artifacts, gates, tasks, notes, events, scopes, () => migrateDb(db), moduleRegistry, authority);
+	const registry = handlers(artifacts, gates, tasks, notes, events, scopes, artifactScopes, () => migrateDb(db), moduleRegistry, authority);
 	const state = (): SchemaState => {
 		const current = schemaVersion(db);
 		return { current, required: SQLITE_SCHEMA_VERSION, migrationRequired: current !== SQLITE_SCHEMA_VERSION };