@uipath/skills 1.199.0 → 1.200.0

package/skills/uipath-review/references/agents/guardrails/coded-guardrails-review.md

@@ -2,7 +2,7 @@
 
 The read-only **review** counterpart of the `uipath-agents` coded guardrail recommend/validate capability. It
 powers the coded guardrail judgment rules in [`../agents-coded-rules.md`](../agents-coded-rules.md)
-§GuardrailsChecker. Run it during a **coded** agent review (SKILL.md Step 2.5b) **after** `uip codedagent review`
+§GuardrailsChecker. Run it during a **coded** agent review (SKILL.md Step 2.5b) **after** `uip codedagent review` <!-- uip-check-skip -->
 (Step 2.5a). Two modes:
 
 - **Audit Mode** — the agent already wires guardrails → are they *effective, appropriate, and actually wired*?
@@ -13,7 +13,7 @@ powers the coded guardrail judgment rules in [`../agents-coded-rules.md`](../age
 This is **review only** — never write, fix, or run `uip codedagent` mutating commands. The reviewer emits
 findings; the user (or the `uipath-agents` skill) applies them.
 
-> **Boundary with `uip codedagent review` — do not double-flag.** The review CLI owns every **deterministic**
+> **Boundary with `uip codedagent review` — do not double-flag.** <!-- uip-check-skip --> The review CLI owns every **deterministic**
 > coded guardrail check and emits them as rule IDs: `CODED_GUARDRAIL_WRONG_IMPORT` (LangChain agent imports
 > guardrails from `uipath.platform.guardrails` and never from `uipath_langchain.guardrails`, so the adapter never
 > registers and the guardrail silently no-ops), `CODED_GUARDRAIL_TOOL_SCOPE_NO_TOOLS` (a Tool-scope middleware with
@@ -23,6 +23,36 @@ findings; the user (or the `uipath-agents` skill) applies them.
 > all, whether a decorator is wired where it will actually wrap the target, and whether a guardrail the agent should
 > have is missing. Never re-describe a CLI deterministic finding here.
 
+## Deterministic CLI fast path — completed deliverable before Step 0
+
+If `uip codedagent review` returns any `Data.Issues[]` entry whose `RuleId` starts with <!-- uip-check-skip -->
+`CODED_GUARDRAIL_`, **immediately create or update the requested review report before any catalog, validator-list,
+SDK-documentation, package research, or general architecture analysis**. This report is the completed deliverable
+for the deterministic guardrail path, not an in-progress checkpoint, and
+contains at minimum:
+
+1. the project and review scope;
+2. the `uip codedagent review` command and `Data.Grade`; <!-- uip-check-skip -->
+3. every emitted `CODED_GUARDRAIL_*` issue with its `RuleId`, `Severity`, `Description`, `File`, and `SuggestedFix`
+   copied verbatim; and
+4. an explicit note that the CLI finding is authoritative and the flagged guardrail was excluded from judgment
+   re-verification.
+
+The CLI description and suggested fix are authoritative. Do not re-verify, rename, reword, or supplement a
+deterministic finding by fetching SDK documentation, installing or inspecting packages, or probing framework APIs.
+Exclude every CLI-flagged guardrail from Step 0 class mapping and Audit Mode. Step 0 may still run **after the
+report** only when source inspection has already identified a separate unflagged guardrail or distinct missing-
+guardrail recommendation.
+
+After saving this report, **return it immediately and end the current review turn**. Do not continue into catalog,
+validator-list, SDK-doc, dependency, general checklist, or architecture work merely to make the report broader.
+Continue beyond the deterministic report only when the user's initial request explicitly asks for an exhaustive
+review or names additional non-guardrail checks. Preserve the deterministic fields verbatim if a later request
+extends the report.
+
+If the CLI does not emit `Data.Issues[]`, do not invent a substitute `CODED_GUARDRAIL_*` rule ID. Report a
+source-observed problem as rule-ID-less prose and list the deterministic CLI rule as skipped.
+
 Like the recommend capability, this is **live-catalog driven** — the catalog's authored fields (`when_to_use`,
 `use_cases`, `security_risk_addressed`, `when_not_to_use`, `security_category`, `examples[].config`) drive every
 decision. The coded vocabulary (Python class names, scopes, entity enums) comes from the SDK docs. Do not hardcode
@@ -32,10 +62,12 @@ which guardrail fits which agent, or which Python class implements which validat
 
 ## Step 0 — Fetch Catalog, Available Validators, and SDK Docs
 
-Run this once when the coded agent's entry source wires guardrails (any `*UiPath…Middleware(...)` inside
-`create_agent(middleware=[...])` or any `@guardrail(...)` decorator) **or** the agent matches a catalog use case
-(so Recommend Mode can run). This is the read-only review counterpart of the guardrail recommend capability — it
-runs the same Step 0 fetches (specified in full below) but emits findings instead of writing code.
+Run this once when the coded agent has at least one **unflagged** wired guardrail to audit (any
+`*UiPath…Middleware(...)` inside `create_agent(middleware=[...])` or any `@guardrail(...)` decorator) **or** the
+agent matches a catalog use case for a distinct missing-guardrail recommendation. A guardrail already flagged by
+`uip codedagent review` does not, by itself, trigger Step 0. <!-- uip-check-skip --> This is the read-only review counterpart of the
+guardrail recommend capability — it runs the same Step 0 fetches (specified in full below) but emits findings
+instead of writing code.
 
 ### Catalog (cacheable — 30-minute TTL)
 
@@ -62,7 +94,7 @@ uip agent guardrails list --output json
 
 Build a `{ validatorId: status }` lookup from the `Data` array (use only `Status == "Available"`).
 
-### SDK Docs (NEVER skipped — Python class names)
+### SDK Docs (required when Step 0 needs Python class names)
 
 Coded agents reference guardrails by **Python class name** (`UiPathPIIDetectionMiddleware`, `PIIValidator`), not by
 `validator_id`. Fetch the SDK doc pages via `WebFetch` to map the two:
@@ -87,6 +119,9 @@ class/scope/enum names:
    scopes, stages, and entity enums.
 3. Neither reachable → SDK-docs skip path in the next section.
 
+Stop at the first successful documentation source. Guardrail review must not install or download dependencies,
+inspect unrelated framework APIs, or search package internals beyond the documented fallback modules above.
+
 ### If the catalog (or SDK docs) is unavailable
 
 Do **not** guess:
@@ -136,6 +171,14 @@ cases:
 Name the catalog-recommended action for that scope in the description. Severity `judgment` — a guardrail that breaks
 the agent or leaves a security gap can be Critical; a milder ineffectiveness is Warning/Info.
 
+**The catalog verdict IS the evidence — do not verify SDK behavior empirically.** Source read + catalog comparison
+fully decides this check. Do NOT import or execute the project's dependencies, inspect `uipath_langchain` /
+`langchain` package sources, fetch SDK documentation sites, or run the agent's factory code to "prove" an action is
+ineffective — that forensic detour adds no admissible evidence to the finding and routinely burns the entire review
+budget. Once the configured action diverges from the catalog's recommendation for that scope, write the finding and
+move on to the report (the report file is the deliverable; an unwritten report scores zero regardless of analysis
+depth).
+
 ### Relevance + Wiring Check → `CODED_GUARDRAIL_MISAPPLIED`
 
 Two ways a format-valid guardrail can be misapplied:
@@ -206,26 +249,31 @@ Merge findings into the Step 5 "Rule Findings" subsection (SKILL.md Step 2.5b),
 - Defects (`CODED_GUARDRAIL_ACTION_INEFFECTIVE`, `CODED_GUARDRAIL_MISAPPLIED`) → the `judgment` band; pick
   Critical/Warning/Info by impact and show the reasoning.
 - `file` = the entry `.py`; `element` = the guardrail name.
+- If a deterministic checkpoint was created, update that same file into the complete report and remove its
+  in-progress note. Do not recreate the report in a way that drops or paraphrases checkpointed CLI findings.
 
 ---
 
 ## Critical Rules
 
-1. **Run after `uip codedagent review` (Step 2.5a)** and only on guardrails the CLI did not flag — never
+1. **Checkpoint deterministic findings first.** Before Step 0 or any research, write every CLI-emitted
+   `CODED_GUARDRAIL_*` issue verbatim into the requested report; later update that same report to the complete
+   Step 5 form.
+2. **Run after `uip codedagent review` (Step 2.5a)** and only on guardrails the CLI did not flag — never <!-- uip-check-skip -->
    double-flag a `CODED_GUARDRAIL_WRONG_IMPORT` / `CODED_GUARDRAIL_TOOL_SCOPE_NO_TOOLS` /
    `CODED_GUARDRAIL_INVALID_CONTRACT` deterministic finding.
-2. **Catalog-driven, not hardcoded** — every audit verdict and recommendation cites a catalog field
+3. **Catalog-driven, not hardcoded** — every audit verdict and recommendation cites a catalog field
    (`when_not_to_use`, `when_to_use` / `use_cases`, `examples[].config.action_type`). Class/enum/import names come
    from the SDK docs, never memory.
-3. **Catalog unavailable → defer Audit Mode** (Rules Skipped), keep Recommend Mode's source-only detection with
+4. **Catalog unavailable → defer Audit Mode** (Rules Skipped), keep Recommend Mode's source-only detection with
    generic wording and the code-only wiring half of `CODED_GUARDRAIL_MISAPPLIED`. Never guess
    effectiveness/relevance without the catalog.
-4. **Recommendations are one Info rule** (`CODED_GUARDRAIL_RECOMMENDED`), one finding per missing guardrail, details
+5. **Recommendations are one Info rule** (`CODED_GUARDRAIL_RECOMMENDED`), one finding per missing guardrail, details
    in the message; signal **block/escalate** (protection) vs **log** (audit).
-5. **Never silently downgrade block → log** — a security-critical guardrail at `log` is a defect
+6. **Never silently downgrade block → log** — a security-critical guardrail at `log` is a defect
    (`CODED_GUARDRAIL_ACTION_INEFFECTIVE`), not an acceptable choice, unless the catalog/agent shows a stated reason.
-6. **Do not name platform-documented validators** (`harmful_content` / `intellectual_property` /
+7. **Do not name platform-documented validators** (`harmful_content` / `intellectual_property` /
    `user_prompt_attacks`) unless already present — phrase generically. `pii_detection` / `prompt_injection` may be
    named.
-7. **Review only** — emit findings; never write guardrails, edit the entry `.py`, or run mutating `uip codedagent`
+8. **Review only** — emit findings; never write guardrails, edit the entry `.py`, or run mutating `uip codedagent`
    commands.

package/skills/uipath-review/references/agents/guardrails/guardrails-review.md

@@ -24,6 +24,54 @@ Like the recommend capability, this is **live-catalog driven** — the catalog's
 `use_cases`, `security_risk_addressed`, `when_not_to_use`, `security_category`, `examples[].config`) drive every
 decision. Do not hardcode which guardrail fits which agent.
 
+## Conclusive existing-guardrail fast path — completed report checkpoint
+
+When a format-valid existing guardrail and the source it selects conclusively match a catalog
+`when_not_to_use` clause, use this bounded sequence **before** general manual review:
+
+1. run `uip agent review` and retain its deterministic findings and `Data.Grade`;
+2. read the existing guardrail's exact source path, `id`, `name`, `validatorType`, action, scopes, and
+   `matchNames`, plus only the source or resource selected by that guardrail;
+3. fetch the catalog and tenant validator list once, as specified in Step 0;
+4. compare the configured action and scope with the catalog's exact `when_not_to_use` clause and relevant
+   `examples[].config`; and
+5. when the clause directly matches the selected source, establish `LC_GUARDRAIL_ACTION_INEFFECTIVE` and
+   immediately save the requested report.
+
+The saved report is a completed checkpoint, not working notes. It must include the retained CLI findings, the
+letter-grade derivation, and the Audit Mode finding with the exact guardrail source path and identifiers, selected
+resource path and identifiers, matched catalog clause, configured scope/action, and catalog-supported fix. If the
+user explicitly requested additional exhaustive review, save this checkpoint first and update the same report
+after that work completes. Otherwise, return the report and end the current review turn. Do not delay the checkpoint
+for solution packing, eval inspection, repeated validation or catalog calls, general architecture analysis, or
+unrelated project introspection.
+
+This fast path requires a direct source-to-catalog contradiction, not a plausible concern. Canonical example:
+`pii_detection` uses `Block` or `Filter` at `Tool` scope, `matchNames` selects `SendCustomerEmail`, and that tool's
+input schema requires `recipient_email`; the catalog says that action breaks a tool that requires PII to function.
+If the selected input is optional or the catalog clause does not directly match, continue normal Audit Mode instead.
+
+## Missing-guardrail fast path — completed deliverable
+
+When the source clearly matches a missing-guardrail use case and `guardrails[]` is absent or lacks the matching
+validator, use this bounded sequence:
+
+1. run `uip agent review` and retain its deterministic findings and `Data.Grade`;
+2. read the system prompt, schema property names, tool/resource names, and existing `guardrails[]` from the target
+   agent source;
+3. fetch the catalog and tenant validator list once, as specified in Step 0;
+4. establish the `LC_GUARDRAIL_RECOMMENDED` finding using R2–R5; and
+5. immediately save the requested report with the rule ID exactly
+   `LC_GUARDRAIL_RECOMMENDED`, the exact source-evidence clause, and the R5 scope/action, then return it.
+
+The saved report is the completed deliverable for this guardrail path. After saving it, **end the current review
+turn**. Do not delay delivery for solution packing, eval inspection, repeated catalog/list calls, general
+architecture analysis, or unrelated project introspection. Continue beyond it only when the user's initial request
+explicitly asks for an exhaustive review or names additional non-guardrail checks.
+
+`LC_GUARDRAIL_PII_MISSING`, `LC_GUARDRAIL_MISSING`, and other descriptive variants are not valid rule IDs. When
+catalog evidence is unavailable, use rule-ID-less prose rather than inventing an identifier.
+
 ---
 
 ## Step 0 — Fetch Catalog and Available Validators
@@ -48,6 +96,9 @@ else:
 - **CACHE_MISS**: fetch and save: `uip agent guardrails catalog --output json > .guardrails-catalog-cache.json`
   (the CLI writes both success and error JSON to stdout — do not add `2>&1`).
 
+**Never invoke `uip agent guardrails catalog` a second time in the same review.** Every later read — a quick
+look, a `python3`/`jq` parse, a re-check — goes through `.guardrails-catalog-cache.json`, not a fresh CLI call.
+
 ### Guardrails List (NEVER cached — tenant-specific)
 
 ```bash
@@ -147,8 +198,12 @@ Default to the catalog example's `action_type`, and state which of the two the r
 
 One `LC_GUARDRAIL_RECOMMENDED` (Info) per missing guardrail. The message must carry: which guardrail /
 `security_category`, why (the matched `when_to_use` / `use_cases` item or the data flow), the recommended scope,
-and the recommended action with the protection-vs-audit signal. Cite the catalog's `examples[].config` in the
-fix. Examples:
+and the recommended action with the protection-vs-audit signal. It must also carry a source-evidence clause in
+the form `<source path>: <exact matching identifier(s)>`. Copy schema property names, tool names, resource names,
+and other matched identifiers verbatim from the source; never replace them with display-friendly prose. For a
+schema match, cite the property path and names, for example
+`agent.json inputSchema.properties: customer_email, full_name, ssn`. Cite the catalog's `examples[].config` in
+the fix. Examples:
 
 - *"Recommend a PII-detection guardrail at Agent scope with a **block** action — the input schema carries
   `customer_email` / `ssn` (data_privacy); blocking at Agent · PRE stops unexpected PII before the LLM.
@@ -188,8 +243,9 @@ Merge findings into the Step 5 "Rule Findings" subsection (SKILL.md Step 2.5b),
    (`when_not_to_use`, `when_to_use` / `use_cases`, `examples[].config.action_type`).
 3. **Catalog unavailable → defer Audit Mode** (Rules Skipped), keep Recommend Mode's `agent.json`-only detection
    with generic wording. Never guess effectiveness/relevance without the catalog.
-4. **Recommendations are one Info rule** (`LC_GUARDRAIL_RECOMMENDED`), one finding per missing guardrail, details
-   in the message; signal **block/escalate** (protection) vs **log** (audit).
+4. **Recommendations are one Info rule** (`LC_GUARDRAIL_RECOMMENDED`), one finding per missing guardrail. The
+   message preserves the exact source path and matched identifiers verbatim, then signals **block/escalate**
+   (protection) vs **log** (audit).
 5. **Never silently downgrade block → log** — a security-critical guardrail at `log` is a defect
    (`LC_GUARDRAIL_ACTION_INEFFECTIVE`), not an acceptable choice, unless the catalog/agent shows a stated reason.
 6. **Do not name platform-documented validators** (`harmful_content` / `intellectual_property` /

package/skills/uipath-review/references/review-workflow-guide.md

@@ -72,10 +72,10 @@ Run these commands to detect what exists in the target directory:
 find . -maxdepth 1 -name "*.uipx" 2>/dev/null
 
 # Detect all project types
-find . -maxdepth 3 -name "project.json" -o -name "agent.json" -o -name "*.flow" -o -name "app.config.json" -o -name "project.uiproj" 2>/dev/null
+find . -maxdepth 3 \( -type d \( -name ".agent-builder" -o -path "*/.local/build" \) \) -prune -o \( -name "project.json" -o -name "agent.json" -o -name "*.flow" -o -name "app.config.json" -o -name "project.uiproj" \) -print 2>/dev/null
 
 # Detect coded agent markers
-find . -maxdepth 2 \( -name "langgraph.json" -o -name "llama_index.json" -o -name "openai_agents.json" -o -name "uipath.json" \) 2>/dev/null
+find . -maxdepth 2 \( -type d \( -name ".agent-builder" -o -path "*/.local/build" \) \) -prune -o \( -name "langgraph.json" -o -name "llama_index.json" -o -name "openai_agents.json" -o -name "uipath.json" \) -print 2>/dev/null
 ```
 
 ### Scope Decision Tree
@@ -173,6 +173,7 @@ Include the Workflow Analyzer rule ID (e.g., ST-NMG-001, ST-DBP-003, ST-SEC-007)
 
 ```bash
 # Low-code agent
+uip agent refresh ./agent-directory --output json
 uip agent validate ./agent-directory --output json
 
 # Coded agent — check if eval sets exist first

package/skills/uipath-review/references/rule-catalog-workflow.md

@@ -1,6 +1,6 @@
 # Rule Catalog — Workflow (SKILL.md Step 2.5)
 
-Step 2.5 of the review workflow. Runs **after** Step 2 (`uip agent validate` and related CLI validation) and **before** Step 3 (manual checklist review). Adds rule-ID-level findings to the report from two sources, in order:
+Step 2.5 of the review workflow. Runs **after** Step 2 (`uip agent refresh` then `uip agent validate` for low-code agents, plus related CLI validation) and **before** Step 3 (manual checklist review). Adds rule-ID-level findings to the report from two sources, in order:
 
 1. **The review CLI** (`uip agent review` / `uip codedagent review`) — all deterministic static checks.
 2. **The judgment catalog** (`agents-*-rules.md`) — checks that require the agent to read source and reason.
@@ -55,10 +55,9 @@ Maps project signals to the judgment catalog files that must be loaded. Extend t
 
 | Signals present | Project type | Catalog files |
 |---|---|---|
-| `agent.json` AND no `main.py` AND no `pyproject.toml` | Agent (low-code) | `agents/agents-common-rules.md` + `agents/agents-lowcode-rules.md` (+ `agents/guardrails/guardrails-review.md` when `guardrails[]` is present or a guardrail use case matches — see Step 2.5b item 3) |
-| `pyproject.toml` + `main.py` + any framework config (`langgraph.json` / `llama_index.json` / `openai_agents.json` / `google_adk.json` / `pydantic_ai.json` / `agent_framework.json`) | Agent (coded) | `agents/agents-common-rules.md` + `agents/agents-coded-rules.md` (+ `agents/guardrails/coded-guardrails-review.md` when the entry source wires SDK guardrails or a guardrail use case matches — see Step 2.5b item 3) |
+| `agent.json.type == "lowCode"` | Agent (low-code) | `agents/agents-lowcode-rules.md` (+ `agents/guardrails/guardrails-review.md` when `guardrails[]` is present or a guardrail use case matches — see Step 2.5b item 3) |
+| Python coded-agent signals or `agent.json.type == "coded"` | Agent (coded) | `agents/agents-coded-rules.md` (+ `agents/guardrails/coded-guardrails-review.md` when the entry source wires SDK guardrails or a guardrail use case matches — see Step 2.5b item 3) |
 | `pyproject.toml` + `main.py` + `uipath.json[functions]` only (no framework config) | Agent (coded — Simple Function) | same as Agent (coded) |
-| `agent.json` + `pyproject.toml` + `main.py` (agent-builder coded layout) | Agent (low-code + coded) | all three: common + lowcode + coded; tag each finding with its source file; also `agents/guardrails/guardrails-review.md` for the `agent.json` guardrails and `agents/guardrails/coded-guardrails-review.md` for SDK guardrails wired in the entry `.py` |
 | `project.json` + `.xaml` / `.cs` | RPA | *(phase 2 — catalog not yet authored)* |
 | `*.flow` + `project.uiproj` with `ProjectType: "Flow"` | Flow | *(phase 2)* |
 | `.uipath/` or `app.config.json` | Coded App | *(phase 2)* |
@@ -87,6 +86,6 @@ Two consecutive runs over the same project produce identical findings *for the r
 1. **Do not invent rule IDs.** If you observe a real issue covered by neither the review CLI nor the judgment catalog, surface it under the Critical / Warning / Info sections as a normal finding — do not promote it to a `rule_id`.
 2. **Do not re-rank severities.** The CLI's `Severity` and the catalog's `severity` are authoritative for `error` / `warning` / `info`. For `judgment` rows, log the reasoning when picking the report band.
 3. **Do not silently skip rules.** Every skip belongs in the report's "Rules Skipped" subsection with a reason.
-4. **Do not run the catalog before the CLI.** Run `uip agent review` / `uip codedagent review` first (2.5a), then `uip agent validate` is assumed already passed (Step 2) — so the judgment catalog focuses only on reasoning the CLI cannot do.
+4. **Do not run the catalog before the CLI.** Run `uip agent review` / `uip codedagent review` first (2.5a); for low-code agents, `uip agent refresh` and `uip agent validate` are assumed already completed in that order (Step 2) — so the judgment catalog focuses only on reasoning the CLI cannot do.
 5. **Do not load catalog files outside the detection table.** Loading low-code rules against a non-agent project produces false positives.
 6. **Do not re-implement deterministic checks inline.** Counts, regex, schema-presence, and set-membership are the review CLI's job. The skill itself ships no executable code.

package/skills/uipath-rpa/.maintenance/pattern-card-maintenance.md

@@ -0,0 +1,20 @@
+# Pattern Card Maintenance
+
+Regeneration procedure for [references/common-pattern-card.md](../references/common-pattern-card.md). Run when: a stamped package ships a new minor/major, a staleness report arrives (`/uipath-feedback` or repo issue), or a new pattern is added.
+
+## Procedure
+
+1. Scratch project (never committed): `uip rpa init --name PatternCard --location <TEMP_DIR> --template-id BlankTemplate --expression-language VisualBasic --target-framework Portable --output json`. On macOS/Linux the Helm host cannot open `Windows`-target projects — `Portable` is mandatory there.
+2. Install every card-stamped package at the target versions: `uip rpa packages versions --package-id <Id> --include-prerelease ...` to pick, then `uip rpa packages install` (flag shape drifts across CLI builds — confirm with `--help`; current builds take a JSON array `[{"id":"...","version":"..."}]`).
+3. One probe workflow per card entry: paste the entry's snippet inside a complete `<Activity>` root cloned from the scaffolded `Main.xaml` (namespaces + `TextExpression` blocks), adding the entry's listed prefixes.
+4. Gate: per-file `uip rpa validate --file-path "<RELATIVE_FILE>" --project-dir "<DIR>" --output json` to 0 errors (relative path — absolute falsely fails), then `uip rpa build "<DIR>" --output json` clean. `validate` clean is NOT sufficient — namespace-registration and member-name errors surface only at `build`.
+5. Failing entry → fix from `{PROJECT_DIR}/.local/docs/packages/<PackageId>/activities/<Activity>.md` (post-install, authoritative for the installed version), re-gate. `Cannot create unknown type` / `TypeLoadException` on a cross-platform gate usually means Windows-only activity → move the entry to the card's "Not on this card" list or validate on a Windows machine before stamping.
+6. Update every entry's version stamp + the header package-anchor line. Entries never carry a version they were not gated against.
+7. New pattern candidates qualify by frequency: appears in ≥2 `tests/tasks/uipath-rpa/` tasks or is a documented top user ask. Keep the card ≤ ~15 entries — it is a hot-path read, not a catalog.
+
+## Rules
+
+- CLI-gate before stamp — no exceptions, no "obviously fine" edits.
+- UIA activities never enter this card (`skills/uipath-rpa/CLAUDE.md` boundary).
+- Windows-only families (Excel X, SMTP SendMail) require a Windows-target gate; until one runs, they stay off the card with an explicit "Not on this card" note.
+- Prose follows `.claude/rules/token-optimization.md`.