@danypops/papyrus 0.60.4 → 0.60.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/papyrus",
-  "version": "0.60.4",
+  "version": "0.60.5",
   "description": "Daemon-backed graph artifacts, evidence-bearing tasks, rules, skills, and native TUI workflows for Pi",
   "type": "module",
   "main": "./src/index.ts",

package/src/artifact/artifact-activation-audit.ts

@@ -0,0 +1,96 @@
+import { ARTIFACT_SCOPE_MAX_ARTIFACTS, CONTEXT_ESTIMATE_CHARACTERS_PER_TOKEN } from "../constants.ts";
+import { passesRuleRunScope, previewRule } from "../rules/rules-service.ts";
+import type { Artifact } from "./artifact.ts";
+import { type ActivationContext, activationConfig, evaluateActivation, type InjectionProfile } from "./artifact-activation.ts";
+import type { ArtifactScopeMode, ArtifactScopeStore } from "./artifact-scope-store.ts";
+import type { ArtifactStore } from "./artifact-store.ts";
+
+export interface ActivationAuditEntry {
+	id: string;
+	kind: "rule" | "playbook";
+	title: string;
+	status: string;
+	scopeMode: ArtifactScopeMode;
+	enabled: boolean;
+	reason: string;
+	priority: number;
+	injection: InjectionProfile;
+	estimatedTokens: number;
+}
+
+export interface ActivationAudit {
+	projectRoot: string;
+	entries: ActivationAuditEntry[];
+	summary: {
+		total: number;
+		enabled: number;
+		disabled: number;
+		global: number;
+		explicit: number;
+		hidden: number;
+		estimatedEnabledTokens: number;
+	};
+}
+
+function estimatedTokens(artifacts: ArtifactStore, artifact: Artifact): number {
+	const text =
+		artifact.kind === "rule"
+			? previewRule(artifacts, artifact.id)
+			: `• ${artifact.title} (when: ${typeof artifact.extra.trigger === "string" ? artifact.extra.trigger : "manual invocation"})`;
+	return Math.ceil(text.length / CONTEXT_ESTIMATE_CHARACTERS_PER_TOKEN);
+}
+
+export function auditArtifactActivation(
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	projectRoot: string,
+	activeTaskId: string | undefined,
+	context: ActivationContext,
+): ActivationAudit {
+	const rows = [
+		...artifacts.query({ kind: "rule", limit: ARTIFACT_SCOPE_MAX_ARTIFACTS }),
+		...artifacts.query({ kind: "playbook", limit: ARTIFACT_SCOPE_MAX_ARTIFACTS }),
+	] as Artifact[];
+	const entries = rows
+		.map((artifact): ActivationAuditEntry => {
+			const scope = scopes.scope(artifact.id);
+			const config = activationConfig(artifact.extra, artifact.kind === "rule" ? "full" : "catalog");
+			let decision: { enabled: boolean; reason: string };
+			if (artifact.status !== "active") decision = { enabled: false, reason: `lifecycle status is ${artifact.status}` };
+			else if (!scopes.appliesToProjectRoot(artifact.id, projectRoot))
+				decision = { enabled: false, reason: `scope ${scope.mode} does not apply` };
+			else if (artifact.kind === "rule" && artifact.subtype === "artifact-template") {
+				decision = { enabled: false, reason: "rule is an artifact template" };
+			} else if (artifact.kind === "rule" && !passesRuleRunScope(artifact, activeTaskId)) {
+				decision = { enabled: false, reason: "run ownership does not apply" };
+			} else decision = evaluateActivation(config, { ...context, projectRoot });
+			return {
+				id: artifact.id,
+				kind: artifact.kind as "rule" | "playbook",
+				title: artifact.title,
+				status: artifact.status,
+				scopeMode: scope.mode,
+				...decision,
+				priority: config.priority,
+				injection: config.injection,
+				estimatedTokens: estimatedTokens(artifacts, artifact),
+			};
+		})
+		.sort(
+			(left, right) =>
+				Number(right.enabled) - Number(left.enabled) || right.priority - left.priority || left.title.localeCompare(right.title),
+		);
+	return {
+		projectRoot,
+		entries,
+		summary: {
+			total: entries.length,
+			enabled: entries.filter((entry) => entry.enabled).length,
+			disabled: entries.filter((entry) => !entry.enabled).length,
+			global: entries.filter((entry) => entry.scopeMode === "all").length,
+			explicit: entries.filter((entry) => entry.scopeMode === "explicit").length,
+			hidden: entries.filter((entry) => entry.scopeMode === "none").length,
+			estimatedEnabledTokens: entries.filter((entry) => entry.enabled).reduce((sum, entry) => sum + entry.estimatedTokens, 0),
+		},
+	};
+}

package/src/artifact/artifact-activation.ts

@@ -0,0 +1,240 @@
+export const ACTIVATION_MAX_DEPTH = 8;
+export const ACTIVATION_MAX_NODES = 64;
+export const ACTIVATION_MAX_VALUES = 32;
+export const ACTIVATION_VALUE_MAX_LENGTH = 256;
+
+export const ACTIVATION_FIELDS = [
+	"project.root",
+	"task.status",
+	"task.labels",
+	"languages",
+	"file.extensions",
+	"tool.name",
+	"operation.name",
+	"session.capabilities",
+] as const;
+export type ActivationField = (typeof ACTIVATION_FIELDS)[number];
+
+export const ACTIVATION_OPERATORS = ["eq", "in", "contains_any", "contains_all", "exists"] as const;
+export type ActivationOperator = (typeof ACTIVATION_OPERATORS)[number];
+export type InjectionProfile = "full" | "catalog" | "on-demand";
+
+export type ActivationPredicate =
+	| { field: ActivationField; operator: ActivationOperator; value: string | string[] | boolean }
+	| { all: ActivationPredicate[] }
+	| { any: ActivationPredicate[] }
+	| { not: ActivationPredicate };
+
+export interface ActivationConfig {
+	predicate?: ActivationPredicate;
+	priority: number;
+	injection: InjectionProfile;
+	invalid?: true;
+}
+
+export interface ActivationContext {
+	projectRoot?: string;
+	taskStatus?: string;
+	taskLabels?: string[];
+	languages?: string[];
+	fileExtensions?: string[];
+	toolName?: string;
+	operationName?: string;
+	sessionCapabilities?: string[];
+}
+
+export interface ActivationDecision {
+	enabled: boolean;
+	reason: string;
+}
+
+function optionalContextString(value: unknown, label: string): string | undefined {
+	return value === undefined ? undefined : boundedString(value, label);
+}
+
+function optionalContextStrings(value: unknown, label: string): string[] | undefined {
+	return value === undefined ? undefined : stringValues(value, label);
+}
+
+/** Parses caller-supplied activation signals. Project and active-Task fields are supplied server-side and intentionally cannot be spoofed through this object. */
+export function activationContextFromInput(value: unknown): ActivationContext {
+	if (value === undefined) return {};
+	const input = record(value, "activation_context");
+	if (
+		!Object.keys(input).every((key) =>
+			["languages", "file_extensions", "tool_name", "operation_name", "session_capabilities"].includes(key),
+		)
+	) {
+		throw new Error("activation_context contains an unsupported field");
+	}
+	return {
+		languages: optionalContextStrings(input.languages, "activation_context.languages"),
+		fileExtensions: optionalContextStrings(input.file_extensions, "activation_context.file_extensions"),
+		toolName: optionalContextString(input.tool_name, "activation_context.tool_name"),
+		operationName: optionalContextString(input.operation_name, "activation_context.operation_name"),
+		sessionCapabilities: optionalContextStrings(input.session_capabilities, "activation_context.session_capabilities"),
+	};
+}
+
+const fieldSet = new Set<string>(ACTIVATION_FIELDS);
+const operatorSet = new Set<string>(ACTIVATION_OPERATORS);
+const arrayFields = new Set<ActivationField>(["task.labels", "languages", "file.extensions", "session.capabilities"]);
+
+function record(value: unknown, label: string): Record<string, unknown> {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value as Record<string, unknown>;
+}
+
+function boundedString(value: unknown, label: string): string {
+	if (typeof value !== "string" || value.length === 0 || value.length > ACTIVATION_VALUE_MAX_LENGTH) {
+		throw new Error(`${label} must be a string between 1 and ${ACTIVATION_VALUE_MAX_LENGTH} characters`);
+	}
+	return value;
+}
+
+function stringValues(value: unknown, label: string): string[] {
+	if (!Array.isArray(value) || value.length === 0 || value.length > ACTIVATION_MAX_VALUES) {
+		throw new Error(`${label} must contain 1-${ACTIVATION_MAX_VALUES} strings`);
+	}
+	return value.map((entry, index) => boundedString(entry, `${label}[${index}]`));
+}
+
+interface ValidationState {
+	nodes: number;
+}
+
+function validatePredicate(value: unknown, state: ValidationState, depth: number): ActivationPredicate {
+	if (depth > ACTIVATION_MAX_DEPTH) throw new Error(`activation predicate depth cannot exceed ${ACTIVATION_MAX_DEPTH}`);
+	state.nodes++;
+	if (state.nodes > ACTIVATION_MAX_NODES) throw new Error(`activation predicate cannot exceed ${ACTIVATION_MAX_NODES} nodes`);
+	const input = record(value, "activation predicate");
+	const keys = Object.keys(input);
+	if (keys.length === 1 && keys[0] === "all") {
+		if (!Array.isArray(input.all) || input.all.length === 0) throw new Error("activation all must be a non-empty array");
+		return { all: input.all.map((entry) => validatePredicate(entry, state, depth + 1)) };
+	}
+	if (keys.length === 1 && keys[0] === "any") {
+		if (!Array.isArray(input.any) || input.any.length === 0) throw new Error("activation any must be a non-empty array");
+		return { any: input.any.map((entry) => validatePredicate(entry, state, depth + 1)) };
+	}
+	if (keys.length === 1 && keys[0] === "not") return { not: validatePredicate(input.not, state, depth + 1) };
+	if (!keys.every((key) => key === "field" || key === "operator" || key === "value")) {
+		throw new Error("activation predicate must be exactly one all/any/not group or one field/operator/value test");
+	}
+	const field = boundedString(input.field, "activation field");
+	if (!fieldSet.has(field)) throw new Error(`unsupported activation field "${field}"`);
+	const operator = boundedString(input.operator, "activation operator");
+	if (!operatorSet.has(operator)) throw new Error(`unsupported activation operator "${operator}"`);
+	const typedField = field as ActivationField;
+	const typedOperator = operator as ActivationOperator;
+	let typedValue: string | string[] | boolean;
+	if (typedOperator === "exists") {
+		if (typeof input.value !== "boolean") throw new Error("activation exists value must be a boolean");
+		typedValue = input.value;
+	} else if (typedOperator === "eq") {
+		typedValue = boundedString(input.value, "activation eq value");
+	} else {
+		typedValue = stringValues(input.value, `activation ${typedOperator} value`);
+	}
+	if ((typedOperator === "contains_any" || typedOperator === "contains_all") && !arrayFields.has(typedField)) {
+		throw new Error(`activation operator ${typedOperator} requires an array-valued field`);
+	}
+	return { field: typedField, operator: typedOperator, value: typedValue };
+}
+
+export function validateActivationConfig(value: unknown, defaultInjection: InjectionProfile = "full"): ActivationConfig {
+	const input = record(value, "activation");
+	if (!Object.keys(input).every((key) => key === "predicate" || key === "priority" || key === "injection")) {
+		throw new Error("activation supports only predicate, priority, and injection");
+	}
+	const priority = input.priority === undefined ? 0 : input.priority;
+	if (!Number.isInteger(priority) || (priority as number) < -1000 || (priority as number) > 1000) {
+		throw new Error("activation priority must be an integer between -1000 and 1000");
+	}
+	const injection = input.injection === undefined ? defaultInjection : input.injection;
+	if (injection !== "full" && injection !== "catalog" && injection !== "on-demand") {
+		throw new Error("activation injection must be full, catalog, or on-demand");
+	}
+	return {
+		...(input.predicate === undefined ? {} : { predicate: validatePredicate(input.predicate, { nodes: 0 }, 1) }),
+		priority: priority as number,
+		injection,
+	};
+}
+
+export function activationConfig(extra: Record<string, unknown>, defaultInjection: InjectionProfile = "full"): ActivationConfig {
+	if (extra.activation === undefined) return { priority: 0, injection: defaultInjection };
+	try {
+		return validateActivationConfig(extra.activation, defaultInjection);
+	} catch {
+		return { priority: 0, injection: defaultInjection, invalid: true };
+	}
+}
+
+function contextValue(field: ActivationField, context: ActivationContext): string | string[] | undefined {
+	switch (field) {
+		case "project.root":
+			return context.projectRoot;
+		case "task.status":
+			return context.taskStatus;
+		case "task.labels":
+			return context.taskLabels;
+		case "languages":
+			return context.languages;
+		case "file.extensions":
+			return context.fileExtensions;
+		case "tool.name":
+			return context.toolName;
+		case "operation.name":
+			return context.operationName;
+		case "session.capabilities":
+			return context.sessionCapabilities;
+	}
+}
+
+function evaluatePredicate(predicate: ActivationPredicate, context: ActivationContext): ActivationDecision {
+	if ("all" in predicate) {
+		for (const child of predicate.all) {
+			const decision = evaluatePredicate(child, context);
+			if (!decision.enabled) return decision;
+		}
+		return { enabled: true, reason: "enabled" };
+	}
+	if ("any" in predicate) {
+		const decisions = predicate.any.map((child) => evaluatePredicate(child, context));
+		if (decisions.some((decision) => decision.enabled)) return { enabled: true, reason: "enabled" };
+		return { enabled: false, reason: decisions[0]?.reason ?? "activation any did not match" };
+	}
+	if ("not" in predicate) {
+		const decision = evaluatePredicate(predicate.not, context);
+		return decision.enabled ? { enabled: false, reason: "activation not matched" } : { enabled: true, reason: "enabled" };
+	}
+	const actual = contextValue(predicate.field, context);
+	if (predicate.operator === "exists") {
+		const exists = actual !== undefined && (!Array.isArray(actual) || actual.length > 0);
+		return exists === predicate.value
+			? { enabled: true, reason: "enabled" }
+			: { enabled: false, reason: `activation ${predicate.field} existence did not match` };
+	}
+	if (actual === undefined) return { enabled: false, reason: `activation context field ${predicate.field} is unavailable` };
+	const actualValues = Array.isArray(actual) ? actual : [actual];
+	if (predicate.operator === "eq") {
+		return actualValues.includes(predicate.value as string)
+			? { enabled: true, reason: "enabled" }
+			: { enabled: false, reason: `activation ${predicate.field} did not equal ${predicate.value as string}` };
+	}
+	const expected = predicate.value as string[];
+	const matches =
+		predicate.operator === "contains_all"
+			? expected.every((entry) => actualValues.includes(entry))
+			: expected.some((entry) => actualValues.includes(entry));
+	return matches
+		? { enabled: true, reason: "enabled" }
+		: { enabled: false, reason: `activation ${predicate.field} did not match ${predicate.operator}` };
+}
+
+export function evaluateActivation(config: ActivationConfig, context: ActivationContext): ActivationDecision {
+	if (config.invalid) return { enabled: false, reason: "invalid activation configuration" };
+	if (config.injection === "on-demand") return { enabled: false, reason: "activation injection profile is on-demand" };
+	return config.predicate === undefined ? { enabled: true, reason: "enabled" } : evaluatePredicate(config.predicate, context);
+}

package/src/cli/activation-command.ts

@@ -0,0 +1,81 @@
+import type { CommandContext } from "@stricli/core";
+import { buildApplication, buildCommand, buildRouteMap } from "@stricli/core";
+import type { PapyrusClient } from "../client.ts";
+import { runStricliToString } from "./stricli-run.ts";
+
+type ActivationClient = Pick<PapyrusClient, "call">;
+interface ActivationCliContext extends CommandContext {
+	readonly client: ActivationClient;
+	readonly json: boolean;
+	readonly callerProjectRoot: string;
+}
+
+interface ActivationAuditOutput {
+	summary: {
+		total: number;
+		enabled: number;
+		disabled: number;
+		global: number;
+		explicit: number;
+		hidden: number;
+		estimatedEnabledTokens: number;
+	};
+	entries: Array<{ enabled: boolean; kind: string; title: string; reason: string }>;
+}
+
+function parseObject(value: string): Record<string, unknown> {
+	const parsed = JSON.parse(value) as unknown;
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("value must be a JSON object");
+	return parsed as Record<string, unknown>;
+}
+
+const auditCommand = buildCommand({
+	func: async function (
+		this: ActivationCliContext,
+		flags: { projectRoot?: string; activationContextJson?: Record<string, unknown>; sessionId?: string },
+	) {
+		const result = await this.client.call<Record<string, unknown>, ActivationAuditOutput>("activation.audit", {
+			project_root: flags.projectRoot ?? this.callerProjectRoot,
+			activation_context: flags.activationContextJson,
+			session_id: flags.sessionId,
+		});
+		if (this.json) this.process.stdout.write(JSON.stringify(result));
+		else {
+			const summary = result.summary;
+			const lines = [
+				`${summary.enabled}/${summary.total} enabled; ${summary.disabled} disabled; ${summary.estimatedEnabledTokens} estimated tokens`,
+				`scope: ${summary.global} global, ${summary.explicit} explicit, ${summary.hidden} hidden`,
+				...result.entries.map((entry) => `${entry.enabled ? "enabled" : "disabled"} [${entry.kind}] ${entry.title} — ${entry.reason}`),
+			];
+			this.process.stdout.write(lines.join("\n"));
+		}
+	},
+	parameters: {
+		flags: {
+			projectRoot: { brief: "Project root (defaults to caller cwd)", kind: "parsed", parse: String, placeholder: "path", optional: true },
+			activationContextJson: {
+				brief: "Trusted activation context as JSON",
+				kind: "parsed",
+				parse: parseObject,
+				placeholder: "json",
+				optional: true,
+			},
+			sessionId: { brief: "Agent session id", kind: "parsed", parse: String, placeholder: "id", optional: true },
+		},
+	},
+	docs: { brief: "Audit Rule and Playbook activation decisions for a project context" },
+});
+
+const app = buildApplication(buildRouteMap({ routes: { audit: auditCommand }, docs: { brief: "Conditional activation operations" } }), {
+	name: "activation",
+	scanner: { caseStyle: "allow-kebab-for-camel" },
+});
+
+export async function runActivationCli(args: string[], client: ActivationClient, projectRoot: string = process.cwd()): Promise<string> {
+	const json = args.includes("--json");
+	return runStricliToString(
+		app,
+		args.filter((arg) => arg !== "--json"),
+		{ client, json, callerProjectRoot: projectRoot },
+	);
+}

package/src/cli/playbooks-command.ts

@@ -51,6 +51,7 @@ const createCommand = buildCommand({
 			toolsJson?: string[];
 			labelsJson?: string[];
 			extraJson?: Record<string, unknown>;
+			activationJson?: Record<string, unknown>;
 			argumentsJson?: unknown[] | Record<string, unknown>;
 			projectRoot?: string;
 			projectsJson?: string[];
@@ -64,6 +65,7 @@ const createCommand = buildCommand({
 			tools: flags.toolsJson,
 			labels: flags.labelsJson,
 			extra: flags.extraJson,
+			activation: flags.activationJson,
 			arguments: flags.argumentsJson,
 			project_root: flags.projectRoot,
 			projects: flags.projectsJson,
@@ -85,6 +87,13 @@ const createCommand = buildCommand({
 			toolsJson: { brief: "JSON string array of tool names", kind: "parsed", parse: parseStringArray, placeholder: "json", optional: true },
 			labelsJson: { brief: "JSON string array of labels", kind: "parsed", parse: parseStringArray, placeholder: "json", optional: true },
 			extraJson: { brief: "JSON object of extra fields", kind: "parsed", parse: parseObject, placeholder: "json", optional: true },
+			activationJson: {
+				brief: "Typed activation config as JSON: {predicate?,priority?,injection?}",
+				kind: "parsed",
+				parse: parseObject,
+				placeholder: "json",
+				optional: true,
+			},
 			argumentsJson: {
 				brief: "JSON array of declared argument definitions",
 				kind: "parsed",
@@ -108,7 +117,15 @@ const createCommand = buildCommand({
 const listCommand = buildCommand({
 	func: async function (
 		this: PlaybooksContext,
-		flags: { status?: string; text?: string; limit?: number; projectRoot?: string; applicable?: boolean },
+		flags: {
+			status?: string;
+			text?: string;
+			limit?: number;
+			projectRoot?: string;
+			applicable?: boolean;
+			activated?: boolean;
+			activationContextJson?: Record<string, unknown>;
+		},
 	) {
 		const rows = await this.client.call<Record<string, unknown>, CliArtifact[]>("playbooks.list", {
 			status: flags.status,
@@ -116,6 +133,8 @@ const listCommand = buildCommand({
 			limit: flags.limit,
 			project_root: flags.projectRoot,
 			applicable: flags.applicable,
+			activated: flags.activated,
+			activation_context: flags.activationContextJson,
 		});
 		render.call(this, rows, rows.length === 0 ? "No playbooks found." : rows.map((row) => artifactLabel(row)).join("\n"));
 	},
@@ -130,6 +149,14 @@ const listCommand = buildCommand({
 				kind: "boolean",
 				optional: true,
 			},
+			activated: { brief: "Evaluate typed activation predicates", kind: "boolean", optional: true },
+			activationContextJson: {
+				brief: "Trusted activation context as JSON",
+				kind: "parsed",
+				parse: parseObject,
+				placeholder: "json",
+				optional: true,
+			},
 		},
 	},
 	docs: { brief: "List Playbooks" },
@@ -388,7 +415,14 @@ const replaceGroupsCommand = buildCommand({
 const updateCommand = buildCommand({
 	func: async function (
 		this: PlaybooksContext,
-		flags: { title?: string; body?: string; labelsJson?: string[]; trigger?: string; stepsJson?: unknown[] | Record<string, unknown> },
+		flags: {
+			title?: string;
+			body?: string;
+			labelsJson?: string[];
+			trigger?: string;
+			stepsJson?: unknown[] | Record<string, unknown>;
+			activationJson?: Record<string, unknown>;
+		},
 		id: string,
 	) {
 		if (
@@ -396,9 +430,10 @@ const updateCommand = buildCommand({
 			flags.body === undefined &&
 			flags.labelsJson === undefined &&
 			flags.trigger === undefined &&
-			flags.stepsJson === undefined
+			flags.stepsJson === undefined &&
+			flags.activationJson === undefined
 		)
-			throw new Error("playbooks update requires --title, --body, --labels-json, --trigger, or --steps-json");
+			throw new Error("playbooks update requires --title, --body, --labels-json, --trigger, --steps-json, or --activation-json");
 		const artifact = await this.client.call<Record<string, unknown>, CliArtifact>("playbooks.update", {
 			id,
 			title: flags.title,
@@ -406,6 +441,7 @@ const updateCommand = buildCommand({
 			labels: flags.labelsJson,
 			trigger: flags.trigger,
 			steps: flags.stepsJson,
+			activation: flags.activationJson,
 		});
 		render.call(this, artifact, artifactLabel(artifact));
 	},
@@ -422,6 +458,13 @@ const updateCommand = buildCommand({
 				placeholder: "json",
 				optional: true,
 			},
+			activationJson: {
+				brief: "Replacement typed activation config as JSON",
+				kind: "parsed",
+				parse: parseObject,
+				placeholder: "json",
+				optional: true,
+			},
 		},
 		positional: { kind: "tuple", parameters: [{ brief: "Playbook id", parse: String, placeholder: "id" }] },
 	},

package/src/cli/rules-command.ts

@@ -41,6 +41,7 @@ const createCommand = buildCommand({
 			severity?: string;
 			labelsJson?: string[];
 			extraJson?: Record<string, unknown>;
+			activationJson?: Record<string, unknown>;
 			projectRoot?: string;
 		},
 	) {
@@ -52,6 +53,7 @@ const createCommand = buildCommand({
 			severity: flags.severity,
 			labels: flags.labelsJson,
 			extra: flags.extraJson,
+			activation: flags.activationJson,
 			project_root: flags.projectRoot,
 		});
 		render.call(this, artifact, `Created rule: ${artifactLabel(artifact)}`);
@@ -65,6 +67,13 @@ const createCommand = buildCommand({
 			severity: { brief: "block|warn|info", kind: "parsed", parse: String, placeholder: "severity", optional: true },
 			labelsJson: { brief: "JSON string array of labels", kind: "parsed", parse: parseStringArray, placeholder: "json", optional: true },
 			extraJson: { brief: "JSON object of extra fields", kind: "parsed", parse: parseObject, placeholder: "json", optional: true },
+			activationJson: {
+				brief: "Typed activation config as JSON: {predicate?,priority?,injection?}",
+				kind: "parsed",
+				parse: parseObject,
+				placeholder: "json",
+				optional: true,
+			},
 			projectRoot: { brief: "Project scope", kind: "parsed", parse: String, placeholder: "path", optional: true },
 		},
 	},
@@ -319,25 +328,41 @@ const gateCommand = buildCommand({
 });
 
 const injectableCommand = buildCommand({
-	func: async function (this: RulesContext) {
+	func: async function (this: RulesContext, flags: { activationContextJson?: Record<string, unknown> }) {
 		const rows = await this.client.call<Record<string, unknown>, CliArtifact[]>("rules.injectable", {
 			project_root: this.callerProjectRoot,
+			activation_context: flags.activationContextJson,
 		});
 		render.call(this, rows, rows.length === 0 ? "No injectable rules." : rows.map((row) => row.title).join("\n"));
 	},
-	parameters: { flags: {} },
+	parameters: {
+		flags: {
+			activationContextJson: {
+				brief: "Trusted activation context as JSON",
+				kind: "parsed",
+				parse: parseObject,
+				placeholder: "json",
+				optional: true,
+			},
+		},
+	},
 	docs: { brief: "List Rules currently injectable into the agent system prompt for this project" },
 });
 
 const updateCommand = buildCommand({
-	func: async function (this: RulesContext, flags: { title?: string; body?: string; labelsJson?: string[] }, id: string) {
-		if (flags.title === undefined && flags.body === undefined && flags.labelsJson === undefined)
-			throw new Error("rules update requires --title, --body, or --labels-json");
+	func: async function (
+		this: RulesContext,
+		flags: { title?: string; body?: string; labelsJson?: string[]; activationJson?: Record<string, unknown> },
+		id: string,
+	) {
+		if (flags.title === undefined && flags.body === undefined && flags.labelsJson === undefined && flags.activationJson === undefined)
+			throw new Error("rules update requires --title, --body, --labels-json, or --activation-json");
 		const artifact = await this.client.call<Record<string, unknown>, CliArtifact>("rules.update", {
 			id,
 			title: flags.title,
 			body: flags.body,
 			labels: flags.labelsJson,
+			activation: flags.activationJson,
 		});
 		render.call(this, artifact, artifactLabel(artifact));
 	},
@@ -346,6 +371,13 @@ const updateCommand = buildCommand({
 			title: { brief: "New title", kind: "parsed", parse: String, placeholder: "text", optional: true },
 			body: { brief: "New body", kind: "parsed", parse: String, placeholder: "text", optional: true },
 			labelsJson: { brief: "JSON string array of labels", kind: "parsed", parse: parseStringArray, placeholder: "json", optional: true },
+			activationJson: {
+				brief: "Replacement typed activation config as JSON",
+				kind: "parsed",
+				parse: parseObject,
+				placeholder: "json",
+				optional: true,
+			},
 		},
 		positional: { kind: "tuple", parameters: [{ brief: "Rule id", parse: String, placeholder: "id" }] },
 	},

package/src/cli.ts

@@ -3,6 +3,7 @@ import { execFileSync } from "node:child_process";
 import { copyFileSync, existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createNodeServiceInstallDeps, generateSystemdUnit, installUserService, type ServiceSpec } from "@danypops/vehicle-server/service";
+import { runActivationCli } from "./cli/activation-command.ts";
 import { runArtifactCli } from "./cli/artifact-command.ts";
 import { runBatchCli } from "./cli/batch-command.ts";
 import { runBindersCli } from "./cli/binders-command.ts";
@@ -107,6 +108,7 @@ const USAGE = `Usage:
   papyrus gates run <id> [--json]
   papyrus graph-projection apply --batch-json <json> [--json]
   papyrus graph-projection checkpoint --producer-id <id> [--json]
+  papyrus activation audit [--project-root <path>] [--activation-context-json <json>] [--session-id <id>] [--json]
   papyrus artifact create --kind <kind> [--title <title>] [--status <status>] [--subtype <subtype>] [--body <body>] [--labels-json <json>] [--extra-json <json>] [--template-id <id>] [--json]
   papyrus artifact query [--kind <kind>] [--status <status>] [--text <query>] [--limit <count>] [--json]
   papyrus artifact show <id> [--depth <n>] [--max-nodes <n>] [--json]
@@ -363,6 +365,7 @@ export function runIdMigrationCli(args: string[]): string {
 }
 
 export {
+	runActivationCli,
 	runArtifactCli,
 	runBatchCli,
 	runBindersCli,
@@ -466,6 +469,11 @@ export async function main(args: string[] = process.argv.slice(2)): Promise<void
 		console.log(await runRulesCli(args.slice(1), client));
 		return;
 	}
+	if (command === "activation") {
+		const client = await connectPapyrusClient();
+		console.log(await runActivationCli(args.slice(1), client));
+		return;
+	}
 	if (command === "artifact") {
 		const client = await connectPapyrusClient();
 		console.log(await runArtifactCli(args.slice(1), client));

package/src/constants.ts

@@ -72,6 +72,8 @@ export const CONTEXT_ESTIMATE_CHARACTERS_PER_TOKEN = 4;
  * this long cannot also risk a real JavaScript call-stack overflow independent of this bound.
  */
 export const CONTEXT_TREE_MAX_NODES = 50_000;
+/** Hard aggregate ceiling for Papyrus's recurring Rules + Playbooks + Task system-prompt injection. */
+export const PAPYRUS_CONTEXT_INJECTION_MAX_TOKENS = 8192;
 
 /**
  * A Papyrus Rule's condition+action+body is injected into EVERY relevant turn's system

package/src/handlers/activation.ts

@@ -0,0 +1,39 @@
+import type { VehicleRegistry } from "@danypops/vehicle-server";
+import { activationContextFromInput } from "../artifact/artifact-activation.ts";
+import { auditArtifactActivation } from "../artifact/artifact-activation-audit.ts";
+import type { ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
+import type { ArtifactStore } from "../artifact/artifact-store.ts";
+import type { Tasks } from "../task/task-service.ts";
+import { createOperationDefiner, stringProp } from "./shared.ts";
+
+export function registerActivationVehicleOperations(
+	registry: VehicleRegistry,
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	tasks: Tasks,
+): void {
+	const define = createOperationDefiner(registry, "activation", "activation", ["rules:read", "playbooks:read"], (name, input) => {
+		if (name !== "activation.audit") throw new Error(`unknown activation operation ${name}`);
+		const projectRoot = input.project_root as string;
+		const sessionId = input.session_id as string | undefined;
+		const activeTask = tasks.active({ projectRoot, sessionId });
+		return auditArtifactActivation(artifacts, scopes, projectRoot, activeTask?.id, {
+			...activationContextFromInput(input.activation_context),
+			projectRoot,
+			taskStatus: activeTask?.status,
+			taskLabels: activeTask?.labels,
+		});
+	});
+	define(
+		"audit",
+		"Audits every Rule and Playbook against lifecycle, project/scope-group applicability, run ownership, and typed activation predicates. Returns enabled/disabled decisions, exclusion reasons, priority, injection profile, scope counts, and estimated enabled tokens.",
+		"read",
+		{
+			project_root: stringProp,
+			activation_context: { type: "object", description: "Trusted turn signals used by typed activation predicates." },
+			session_id: stringProp,
+		},
+		["project_root"],
+		(input) => input,
+	);
+}

package/src/handlers/playbooks.ts

@@ -105,6 +105,7 @@ export function registerPlaybooksVehicleOperations(registry: VehicleRegistry, de
 			subtype: stringProp,
 			labels: { type: "array" },
 			extra: { type: "object" },
+			activation: { type: "object", description: "Typed activation config: {predicate?,priority?,injection?}." },
 			template_id: stringProp,
 			project_root: stringProp,
 			projects: { type: "array" },
@@ -123,7 +124,16 @@ export function registerPlaybooksVehicleOperations(registry: VehicleRegistry, de
 		"list",
 		"Lists Playbooks matching an optional status/text filter. project_root alone scopes to EXACT membership in that project (audit semantics); project_root plus applicable:true instead lists every Playbook APPLICABLE to it (global Playbooks plus Playbooks whose membership includes it) -- what pi-papyrus's before_agent_start uses to inject only relevant Playbooks. Returns a lean summary (no body/steps) by default -- pass full: true for the complete artifact.",
 		"read",
-		{ status: stringProp, text: stringProp, limit: numberProp, project_root: stringProp, applicable: booleanProp, full: booleanProp },
+		{
+			status: stringProp,
+			text: stringProp,
+			limit: numberProp,
+			project_root: stringProp,
+			applicable: booleanProp,
+			activated: booleanProp,
+			activation_context: { type: "object", description: "Trusted turn signals used by typed activation predicates." },
+			full: booleanProp,
+		},
 		[],
 		(input) => input,
 	);
@@ -316,6 +326,7 @@ export function registerPlaybooksVehicleOperations(registry: VehicleRegistry, de
 			labels: { type: "array" },
 			trigger: stringProp,
 			steps: { type: "array" },
+			activation: { type: "object", description: "Replacement typed activation config." },
 			actor: stringProp,
 			source: stringProp,
 			session_id: stringProp,

package/src/handlers/registry.ts

@@ -19,6 +19,7 @@ import type { SessionIdentity } from "../session-identity/session-identity-servi
 import type { TaskEventStore } from "../task/event/task-event-store.ts";
 import type { TaskScopeStore } from "../task/scope/task-scope-store.ts";
 import type { Tasks } from "../task/task-service.ts";
+import { registerActivationVehicleOperations } from "./activation.ts";
 import { registerArtifactTrashOperations } from "./artifact-trash.ts";
 import { registerBatchVehicleOperation } from "./batch.ts";
 import { registerBindersVehicleOperations } from "./binders.ts";
@@ -57,6 +58,7 @@ export function createPapyrusVehicleRegistry(deps: PapyrusVehicleDeps): VehicleR
 	// session_id, a correlation id, not a secret -- see session-identity-service.ts).
 	registry.setExposeHandlerFailureDetails(true);
 	registerNotesVehicleOperations(registry, deps.notes, deps.artifacts);
+	registerActivationVehicleOperations(registry, deps.artifacts, deps.scopes, deps.tasks);
 	registerBindersVehicleOperations(registry, deps.artifacts, deps.scopes, deps.projectRegistry, deps.scopeGroups);
 	registerRulesVehicleOperations(registry, deps.artifacts, deps.scopes, deps.projectRegistry, deps.scopeGroups);
 	registerDocsVehicleOperations(registry, deps.artifacts, deps.scopes, deps.authority, deps.projectRegistry, deps.scopeGroups);

package/src/handlers/rules.ts

@@ -77,6 +77,9 @@ export function registerRulesVehicleOperations(
 			subtype: stringProp,
 			labels: { type: "array" } as unknown as { type: string },
 			extra: { type: "object" } as unknown as { type: string },
+			activation: { type: "object", description: "Typed activation config: {predicate?,priority?,injection?}." } as unknown as {
+				type: string;
+			},
 			template_id: stringProp,
 			project_root: stringProp,
 			projects: { type: "array" } as unknown as { type: string },
@@ -314,6 +317,7 @@ export function registerRulesVehicleOperations(
 			title: stringProp,
 			body: stringProp,
 			labels: { type: "array" } as unknown as { type: string },
+			activation: { type: "object", description: "Replacement typed activation config." } as unknown as { type: string },
 			project_root: stringProp,
 			actor: stringProp,
 			source: stringProp,

package/src/index.ts

@@ -6,6 +6,13 @@
  */
 
 export type { Artifact, ArtifactEdge } from "./artifact/artifact.ts";
+export {
+	type ActivationConfig,
+	type ActivationContext,
+	type ActivationPredicate,
+	activationConfig,
+	type InjectionProfile,
+} from "./artifact/artifact-activation.ts";
 export { projectArtifactRelationships } from "./artifact/artifact-relationship-view.ts";
 export type { ArtifactStore } from "./artifact/artifact-store.ts";
 export {

package/src/modules/playbooks.ts

@@ -11,6 +11,7 @@
  */
 
 import { summarizeArtifact } from "../artifact/artifact.ts";
+import { activationContextFromInput } from "../artifact/artifact-activation.ts";
 import type { ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "../artifact/artifact-store.ts";
 import type { OperationDefinition } from "../module-registry.ts";
@@ -22,6 +23,7 @@ import {
 	containPlaybook,
 	createPlaybook,
 	dependPlaybook,
+	listActivatedPlaybooks,
 	listPlaybooks,
 	playbookInvocation,
 	playbookScope,
@@ -147,6 +149,7 @@ export function playbooksOperations({
 					subtype: optionalString(input, "subtype"),
 					labels: input.labels as string[] | undefined,
 					extra: input.extra as Record<string, unknown> | undefined,
+					activation: input.activation,
 					templateId: optionalString(input, "template_id") ?? optionalString(input, "templateId"),
 					projectRoot: optionalString(input, "project_root"),
 					projectReferences: input.projects as string[] | undefined,
@@ -156,7 +159,21 @@ export function playbooksOperations({
 			),
 		),
 		define("playbooks.list", (input: OperationInput) => {
-			const playbooks = listPlaybooks(artifacts, artifactScopes, artifactFilter(input));
+			const filter = artifactFilter(input);
+			const projectRoot = optionalString(input, "project_root");
+			const activeTask =
+				optionalBoolean(input, "activated") === true
+					? tasks.active({ projectRoot, sessionId: optionalString(input, "session_id") ?? optionalString(input, "sessionId") })
+					: undefined;
+			const playbooks =
+				optionalBoolean(input, "activated") === true
+					? listActivatedPlaybooks(artifacts, artifactScopes, filter, {
+							...activationContextFromInput(input.activation_context),
+							projectRoot,
+							taskStatus: activeTask?.status,
+							taskLabels: activeTask?.labels,
+						})
+					: listPlaybooks(artifacts, artifactScopes, filter);
 			return optionalBoolean(input, "full") === true ? playbooks : playbooks.map(summarizeArtifact);
 		}),
 		define("playbooks.show", (input: OperationInput) => showPlaybook(artifacts, string(input, "id"))),
@@ -225,6 +242,7 @@ export function playbooksOperations({
 					labels: input.labels as string[] | undefined,
 					trigger: optionalString(input, "trigger"),
 					steps: input.steps,
+					activation: input.activation,
 				},
 				eventContext(input),
 			),

package/src/modules/rules.ts

@@ -120,6 +120,7 @@ export function rulesOperations(
 						subtype: optionalString(input, "subtype"),
 						labels: input.labels as string[] | undefined,
 						extra: input.extra as Record<string, unknown> | undefined,
+						activation: input.activation,
 						templateId: optionalString(input, "template_id") ?? optionalString(input, "templateId"),
 						projectRoot: optionalString(input, "project_root"),
 						projectReferences: input.projects as string[] | undefined,
@@ -182,6 +183,7 @@ export function rulesOperations(
 						title: optionalString(input, "title"),
 						body: optionalString(input, "body"),
 						labels: input.labels as string[] | undefined,
+						activation: input.activation,
 					},
 					eventContext(input),
 				),

package/src/playbook/playbook-service.ts

@@ -24,6 +24,13 @@
 
 import type { Artifact } from "../artifact/artifact.ts";
 import { requireLocallyOwnedContent } from "../artifact/artifact.ts";
+import {
+	type ActivationContext,
+	activationConfig,
+	evaluateActivation,
+	type InjectionProfile,
+	validateActivationConfig,
+} from "../artifact/artifact-activation.ts";
 import type { ArtifactEventContext } from "../artifact/artifact-event.ts";
 import type { ArtifactScope, ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "../artifact/artifact-store.ts";
@@ -226,6 +233,7 @@ export interface CreatePlaybookInput {
 	subtype?: string;
 	labels?: string[];
 	extra?: Record<string, unknown>;
+	activation?: unknown;
 	templateId?: string;
 	projectRoot?: string;
 	/** Bounded exact registered project references (id/name/alias/root) -- fail-closed unlike projectRoot's auto-register-by-root legacy form. Takes precedence over projectRoot when both are given. */
@@ -246,6 +254,7 @@ export type PlaybookTransition = "enable" | "disable";
 export interface UpdatePlaybookInput extends UpdateContentInput {
 	trigger?: string;
 	steps?: unknown;
+	activation?: unknown;
 }
 
 const PLAYBOOK_TRANSITIONS: TransitionTable<PlaybookTransition, string> = {
@@ -266,6 +275,7 @@ export function createPlaybook(
 	const projectRoot = input.projectRoot === undefined ? undefined : normalizeProjectRoot(input.projectRoot);
 	const declaredArguments = validatePlaybookArguments(input.arguments);
 	const declaredSteps = validatePlaybookSteps(input.steps);
+	const activation = input.activation === undefined ? undefined : validateActivationConfig(input.activation, "catalog");
 	const playbook = artifacts.create(
 		{
 			kind: "playbook",
@@ -276,6 +286,7 @@ export function createPlaybook(
 			labels: input.labels,
 			extra: {
 				...(input.extra ?? {}),
+				...(activation === undefined ? {} : { activation }),
 				...(input.trigger ? { trigger: input.trigger } : {}),
 				...(declaredSteps ? { steps: declaredSteps } : {}),
 				...(input.tools ? { tools: input.tools } : {}),
@@ -297,6 +308,25 @@ export function listPlaybooks(artifacts: ArtifactStore, scopes: ArtifactScopeSto
 	return listScoped(artifacts, scopes, "playbook", filter);
 }
 
+export function listActivatedPlaybooks(
+	artifacts: ArtifactStore,
+	scopes: ArtifactScopeStore,
+	filter: ListFilter,
+	context: ActivationContext,
+): Artifact[] {
+	return listPlaybooks(artifacts, scopes, filter).filter(
+		(playbook) => evaluateActivation(activationConfig(playbook.extra, "catalog"), context).enabled,
+	);
+}
+
+export function playbookActivationDecision(
+	playbook: Artifact,
+	context: ActivationContext,
+): { enabled: boolean; reason: string; priority: number; injection: InjectionProfile } {
+	const config = activationConfig(playbook.extra, "catalog");
+	return { ...evaluateActivation(config, context), priority: config.priority, injection: config.injection };
+}
+
 export function assignPlaybookProject(
 	artifacts: ArtifactStore,
 	scopes: ArtifactScopeStore,
@@ -409,9 +439,10 @@ export function updatePlaybook(artifacts: ArtifactStore, id: string, input: Upda
 		input.body === undefined &&
 		input.labels === undefined &&
 		input.trigger === undefined &&
-		input.steps === undefined
+		input.steps === undefined &&
+		input.activation === undefined
 	) {
-		throw new Error("update requires title, body, labels, trigger, or steps");
+		throw new Error("update requires title, body, labels, trigger, steps, or activation");
 	}
 	assertTitleBounds(input.title);
 	assertBodyBounds(input.body);
@@ -423,13 +454,15 @@ export function updatePlaybook(artifacts: ArtifactStore, id: string, input: Upda
 	const hasContentFields = input.title !== undefined || input.body !== undefined || input.labels !== undefined;
 	const updated = hasContentFields ? artifacts.updateContent(playbook.id, input, context) : playbook;
 	if (!updated) throw new Error(`playbook "${id}" not found`);
-	if (declaredSteps === undefined && input.trigger === undefined) return updated;
+	if (declaredSteps === undefined && input.trigger === undefined && input.activation === undefined) return updated;
+	const activation = input.activation === undefined ? undefined : validateActivationConfig(input.activation, "catalog");
 	const withExtra = artifacts.setExtra(
 		updated.id,
 		{
 			...updated.extra,
 			...(input.trigger !== undefined ? { trigger: input.trigger } : {}),
 			...(declaredSteps !== undefined ? { steps: declaredSteps } : {}),
+			...(activation !== undefined ? { activation } : {}),
 		},
 		context,
 	);

package/src/rules/rules-service.ts

@@ -7,6 +7,13 @@
 
 import type { Artifact } from "../artifact/artifact.ts";
 import { requireLocallyOwnedContent } from "../artifact/artifact.ts";
+import {
+	type ActivationContext,
+	activationConfig,
+	evaluateActivation,
+	type InjectionProfile,
+	validateActivationConfig,
+} from "../artifact/artifact-activation.ts";
 import type { ArtifactEventContext } from "../artifact/artifact-event.ts";
 import type { ArtifactScope, ArtifactScopeStore } from "../artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "../artifact/artifact-store.ts";
@@ -23,7 +30,6 @@ import {
 	removeArtifactScopeProject,
 	replaceArtifactScopeGroups,
 	replaceArtifactScopeProjects,
-	requireContentUpdateFields,
 	requireKind,
 	runTransition,
 	setArtifactScopeNone,
@@ -43,6 +49,7 @@ export interface CreateRuleInput {
 	subtype?: string;
 	labels?: string[];
 	extra?: Record<string, unknown>;
+	activation?: unknown;
 	templateId?: string;
 	projectRoot?: string;
 	/** Bounded exact registered project references (id/name/alias/root) -- fail-closed unlike projectRoot's auto-register-by-root legacy form. Takes precedence over projectRoot when both are given. */
@@ -135,6 +142,7 @@ export function createRule(
 	registry?: ProjectRegistryStore,
 ): Artifact {
 	assertRuleTextWithinBounds(input.condition, input.action, input.body);
+	const activation = input.activation === undefined ? undefined : validateActivationConfig(input.activation, "full");
 	if (input.projectReferences !== undefined && input.projectReferences.length > 0 && registry === undefined) {
 		throw new Error("projectReferences requires a project registry");
 	}
@@ -149,6 +157,7 @@ export function createRule(
 			labels: input.labels,
 			extra: {
 				...(input.extra ?? {}),
+				...(activation === undefined ? {} : { activation }),
 				...(input.condition ? { condition: input.condition } : {}),
 				...(input.action ? { action: input.action } : {}),
 				severity: input.severity ?? "info",
@@ -271,7 +280,7 @@ export function removeRuleGroup(
 }
 
 /** The extra.scope run-gating check alone -- a Rule with no extra.scope always passes this; one with a skill-run/playbook-run scope passes only while its run owns activeTaskId. Both a workflow-definition target's own run scope ("skill-run", written by workflow-execution.ts's runWorkflowSteps for that target kind) and a Playbook's own run scope ("playbook-run", same call for a Playbook target) are recognized -- confirmed live that only "skill-run" was ever checked here, silently breaking Playbook-run-scoped rule injection since Playbook gained its own doc/rule structured steps. */
-function passesRunScope(rule: Artifact, activeTaskId: string | undefined): boolean {
+export function passesRuleRunScope(rule: Artifact, activeTaskId: string | undefined): boolean {
 	const scope = rule.extra.scope;
 	if (scope === undefined) return true;
 	if (typeof scope !== "object" || scope === null || Array.isArray(scope)) return false;
@@ -294,13 +303,23 @@ export function listInjectableRules(
 	scopes: ArtifactScopeStore,
 	projectRoot: string | undefined,
 	activeTaskId?: string,
+	context: ActivationContext = {},
 ): Artifact[] {
 	return artifacts.query({ kind: "rule", status: "active" }).filter((rule) => {
 		if (rule.subtype === "artifact-template") return false;
-		return passesRunScope(rule, activeTaskId) && scopes.appliesToProjectRoot(rule.id, projectRoot);
+		if (!passesRuleRunScope(rule, activeTaskId) || !scopes.appliesToProjectRoot(rule.id, projectRoot)) return false;
+		return evaluateActivation(activationConfig(rule.extra, "full"), { ...context, projectRoot }).enabled;
 	});
 }
 
+export function ruleActivationDecision(
+	rule: Artifact,
+	context: ActivationContext,
+): { enabled: boolean; reason: string; priority: number; injection: InjectionProfile } {
+	const config = activationConfig(rule.extra, "full");
+	return { ...evaluateActivation(config, context), priority: config.priority, injection: config.injection };
+}
+
 export function showRule(artifacts: ArtifactStore, id: string): Artifact {
 	requireKind(artifacts, id, "rule");
 	return artifacts.get(id, { tree: true })!;
@@ -319,11 +338,15 @@ export function transitionRule(artifacts: ArtifactStore, id: string, action: Rul
 	return runTransition(artifacts, rule, "rule", action, RULE_TRANSITIONS, context);
 }
 
-export type UpdateRuleInput = UpdateContentInput;
+export interface UpdateRuleInput extends UpdateContentInput {
+	activation?: unknown;
+}
 
 /** A Rule's body update stays under the same combined condition+action+body ceiling as creation -- a permanent per-turn injection cost doesn't get looser just because it's an edit, not a create. */
 export function updateRule(artifacts: ArtifactStore, id: string, input: UpdateRuleInput, context?: ArtifactEventContext): Artifact {
-	requireContentUpdateFields(input);
+	if (input.title === undefined && input.body === undefined && input.labels === undefined && input.activation === undefined) {
+		throw new Error("update requires title, body, labels, or activation");
+	}
 	assertTitleBounds(input.title);
 	assertLabelsBounds(input.labels);
 	const rule = requireLocallyOwnedContent(requireKind(artifacts, id, "rule"));
@@ -332,9 +355,14 @@ export function updateRule(artifacts: ArtifactStore, id: string, input: UpdateRu
 		const action = typeof rule.extra.action === "string" ? rule.extra.action : undefined;
 		assertRuleTextWithinBounds(condition, action, input.body);
 	}
-	const updated = artifacts.updateContent(id, input, context);
+	const hasContent = input.title !== undefined || input.body !== undefined || input.labels !== undefined;
+	const updated = hasContent ? artifacts.updateContent(id, input, context) : rule;
 	if (!updated) throw new Error(`rule "${id}" not found`);
-	return updated;
+	if (input.activation === undefined) return updated;
+	const activation = validateActivationConfig(input.activation, "full");
+	const withActivation = artifacts.setExtra(updated.id, { ...updated.extra, activation }, context);
+	if (!withActivation) throw new Error(`rule "${id}" not found`);
+	return withActivation;
 }
 
 export function gateTaskWithRule(artifacts: ArtifactStore, ruleId: string, taskId: string, context?: ArtifactEventContext): Artifact {

package/src/service.ts

@@ -4,6 +4,8 @@ import type { DaemonDiagnosis } from "@danypops/vehicle-server/daemon-lifecycle"
 import { createVehicleHttpApp } from "@danypops/vehicle-server/http";
 import type { Logger } from "@danypops/vehicle-server/logging";
 import type { CreateArtifactInput } from "./artifact/artifact.ts";
+import { activationContextFromInput } from "./artifact/artifact-activation.ts";
+import { auditArtifactActivation } from "./artifact/artifact-activation-audit.ts";
 import type { ArtifactEventReader } from "./artifact/artifact-event-reader.ts";
 import type { ArtifactScopeStore } from "./artifact/artifact-scope-store.ts";
 import type { ArtifactStore } from "./artifact/artifact-store.ts";
@@ -80,6 +82,7 @@ const COMPOSITION_ROOT_OPERATION_NAMES = [
 	"artifact.restore",
 	"artifact.trash_status",
 	"artifact.trash_list",
+	"activation.audit",
 	"graph.link",
 	"graph.unlink",
 	"graph.tree",
@@ -400,11 +403,26 @@ function handlers(
 			const id = string(input, "id");
 			return artifacts.get(id)?.kind === "task" ? tasks.runGates(id, eventContextFor(input, "gates-api")) : gates.runAsync(id);
 		},
+		"activation.audit": (input) => {
+			const filter = taskFilter(input);
+			if (!filter.projectRoot) throw new Error("project_root is required");
+			const activeTask = tasks.active(filter);
+			return auditArtifactActivation(artifacts, artifactScopes, filter.projectRoot, activeTask?.id, {
+				...activationContextFromInput(input.activation_context),
+				projectRoot: filter.projectRoot,
+				taskStatus: activeTask?.status,
+				taskLabels: activeTask?.labels,
+			});
+		},
 		"rules.injectable": (input) => {
 			const filter = taskFilter(input);
-			return listInjectableRules(artifacts, artifactScopes, filter.projectRoot, tasks.active(filter)?.id).map(
-				({ id, title, body, extra }) => ({ id, title, body, extra }),
-			);
+			const activeTask = tasks.active(filter);
+			return listInjectableRules(artifacts, artifactScopes, filter.projectRoot, activeTask?.id, {
+				...activationContextFromInput(input.activation_context),
+				projectRoot: filter.projectRoot,
+				taskStatus: activeTask?.status,
+				taskLabels: activeTask?.labels,
+			}).map(({ id, title, body, extra }) => ({ id, title, body, extra }));
 		},
 		"tasks.create": forwardToModule("tasks.create"),
 		"tasks.update": forwardToModule("tasks.update"),