@event4u/agent-config 11.0.0 → 12.1.0

package/src/scripts/ai_council/clients.ts

@@ -115,7 +115,37 @@ export const DEFAULT_PERPLEXITY_MODEL = 'sonar-pro';
 // divergence is a one-line change, not a hunt through inline literals.
 // (`xai` / `perplexity` CLI reuse their API constants: their CLIs are
 // community wrappers around the same paid API, so the values do not diverge.)
-export const DEFAULT_OPENAI_CLI_MODEL = 'gpt-5';
+/**
+ * Sentinel: let the codex CLI pick its own model, by omitting `--model`.
+ *
+ * This is not a placeholder for a value nobody looked up. Measured
+ * 2026-08-15 against `codex exec --json` on a ChatGPT-account (subscription)
+ * transport, every explicitly named candidate was refused with
+ * `400 invalid_request_error: The '<model>' model is not supported when using
+ * Codex with a ChatGPT account.` — `gpt-4o`, `gpt-5` (this constant's previous
+ * value) and `gpt-5.1-codex` alike. Omitting the flag answered normally.
+ *
+ * So the only value known to work on this transport is "whatever the CLI
+ * chooses", and pinning ANY name here would re-break the seat the next time
+ * the vendor rotates its lineup. The label is carried into records as-is so a
+ * reader can see that no model was pinned, rather than a name being implied
+ * that nobody verified.
+ */
+export const OPENAI_CLI_VENDOR_DEFAULT = 'codex-default';
+
+/**
+ * Models MEASURED to be refused by the codex subscription transport, with the
+ * date they were measured. This is a deny-list on purpose: the CLI publishes
+ * no allow-list, so the honest claim is "these were rejected when we tried",
+ * never "only these are allowed".
+ */
+export const CODEX_MEASURED_UNSERVABLE: ReadonlyMap<string, string> = new Map([
+    ['gpt-4o', '2026-08-15'],
+    ['gpt-5', '2026-08-15'],
+    ['gpt-5.1-codex', '2026-08-15'],
+]);
+
+export const DEFAULT_OPENAI_CLI_MODEL = OPENAI_CLI_VENDOR_DEFAULT;
 export const DEFAULT_ANTHROPIC_CLI_MODEL = 'claude-sonnet-4-5';
 export const DEFAULT_GEMINI_CLI_MODEL = 'gemini-2.5-pro';
 
@@ -665,7 +695,18 @@ export class OpenAIClient extends ExternalAIClient {
 
     constructor(opts: ApiClientOptions = {}) {
         super();
-        this.model = opts.model ?? DEFAULT_OPENAI_MODEL;
+        // `codex-default` is the CLI transport's "let the host choose" sentinel,
+        // and ONE `model:` field in `.ai-council.yml` feeds both transports —
+        // which one a member resolves to is decided at run time, not in the
+        // config. The API has no such sentinel (there is no endpoint named
+        // `codex-default`), so it resolves to this client's own default instead
+        // of being sent verbatim and rejected. Without this, making the shipped
+        // template CLI-safe would break every api-transport user in the same
+        // commit.
+        this.model =
+            opts.model === undefined || opts.model === OPENAI_CLI_VENDOR_DEFAULT
+                ? DEFAULT_OPENAI_MODEL
+                : opts.model;
         if (opts.client !== undefined && opts.client !== null) {
             this._client = opts.client;
             return;
@@ -1252,6 +1293,20 @@ export abstract class CliClient extends ExternalAIClient {
         }
     }
 
+    /**
+     * Refuse a call this transport cannot serve, BEFORE spawning.
+     *
+     * `null` means "nothing known to be wrong" — deliberately not "verified
+     * servable". No vendor CLI here publishes the set of models its
+     * subscription tier accepts, so an allow-list would be invented and would
+     * reject valid pins the day the vendor adds one. What CAN be stated is the
+     * complement: models this estate has MEASURED being rejected. Subclasses
+     * override; the base transport knows of none.
+     */
+    protected _preflight_transport(): { code: string; detail: string } | null {
+        return null;
+    }
+
     /** Return text to send on stdin, or `null` to inherit caller's stdin. */
     protected _stdin_payload(system_prompt: string, user_prompt: string): string | null {
         void system_prompt;
@@ -1391,6 +1446,26 @@ export abstract class CliClient extends ExternalAIClient {
             }
         }
 
+        // 1b. transport pre-flight — refuse BEFORE spending.
+        //
+        // A subscription transport can be structurally unable to serve the
+        // configured model. Discovering that by spawning costs a call against
+        // the daily cap and returns an opaque `exit_1`, which reads as "the CLI
+        // is flaky" rather than "this pin can never work here". A refusal that
+        // names the model and the transport is the difference between a config
+        // bug someone fixes in a minute and a seat that quietly stays dead.
+        const preflight = this._preflight_transport();
+        if (preflight !== null) {
+            return new CouncilResponse({
+                provider: this.name,
+                model: this.model,
+                text: '',
+                latency_ms: _elapsedMs(t0),
+                error: preflight.code,
+                metadata: { cli: true, transport: this.transport, detail: preflight.detail },
+            });
+        }
+
         // 2. build command + spawn.
         const cmd = this._build_command(system_prompt, user_prompt, max_tokens);
         const stdinPayload = this._stdin_payload(system_prompt, user_prompt);
@@ -1726,9 +1801,46 @@ export class OpenAICliClient extends CliClient {
         void system_prompt;
         void user_prompt;
         void max_tokens;
+        // `--skip-git-repo-check` is not a convenience flag. Without it codex
+        // refuses any directory it does not consider trusted — captured
+        // `stderr_tail`: `Not inside a trusted directory and
+        // --skip-git-repo-check was not specified.` A worktree path is never
+        // trusted, which is the whole explanation for the standing observation
+        // that the openai seat dies in a worktree while working from the main
+        // checkout. The council reads a prompt and writes nothing through this
+        // process, so the trust gate protects nothing here that the council's
+        // own gates do not already cover.
+        //
         // `-` is codex's documented "read the prompt from stdin" positional;
         // the payload itself is assembled in `_stdin_payload`.
-        return [this.binary, 'exec', '--json', '--model', this.model, '-'];
+        const modelArgs =
+            this.model === OPENAI_CLI_VENDOR_DEFAULT ? [] : ['--model', this.model];
+        return [this.binary, 'exec', '--json', '--skip-git-repo-check', ...modelArgs, '-'];
+    }
+
+    /**
+     * Refuse a pin this estate has measured the transport rejecting.
+     *
+     * The remedy is named because it is not guessable: removing the `model:`
+     * line is the fix, and "remove a setting" is the last thing an operator
+     * tries when a member is silent.
+     */
+    protected override _preflight_transport(): { code: string; detail: string } | null {
+        const measuredOn = CODEX_MEASURED_UNSERVABLE.get(this.model);
+        if (measuredOn === undefined) return null;
+        return {
+            code: 'model_unsupported_on_transport',
+            detail:
+                `openai member pins model \`${this.model}\`, which the codex CLI ` +
+                `(subscription transport) refused when measured on ${measuredOn}: ` +
+                `"The '${this.model}' model is not supported when using Codex with a ` +
+                'ChatGPT account." The CLI publishes no list of models it DOES accept, ' +
+                'so there is no supported set to offer here — the one configuration ' +
+                'measured to work is no pin at all. Fix: remove the `model:` line from ' +
+                'the openai member (or set it to `codex-default`) to use the CLI\'s own ' +
+                'default. A pinned model is only reachable on the API transport ' +
+                '(`api_key_ref:` without `mode: cli`).',
+        };
     }
 
     /**
@@ -1752,6 +1864,7 @@ export class OpenAICliClient extends CliClient {
         let text = '';
         let input_tokens = 0;
         let output_tokens = 0;
+        let failure: string | null = null;
         const meta: Record<string, unknown> = {};
         for (let line of _splitlines(stdout)) {
             line = line.trim();
@@ -1794,6 +1907,31 @@ export class OpenAICliClient extends CliClient {
                             text = chunks.join('\n').trim();
                         }
                     }
+                    // The FLAT shape, and it is the one the CLI emits today:
+                    //   {"item":{"type":"agent_message","text":"OK"}}
+                    // The `content[]` branch above is the older nested form. Both
+                    // are read because this adapter has no way to pin a CLI
+                    // version, and reading only the nested one is why the seat
+                    // returned an empty string with NO error for every call —
+                    // measured 2026-08-15, and indistinguishable downstream from
+                    // a model that answered with nothing. Only an `agent_message`
+                    // is taken: an `error` item also carries `text`-adjacent
+                    // fields, and treating one as an answer would turn the
+                    // skills-budget warning into the member's response.
+                    //
+                    // LAST message wins, never the first. A codex turn emits
+                    // several `agent_message` items — a preamble ("I'll check X
+                    // first…") and then the answer — so keeping the first one
+                    // truncates the response to its throat-clearing. Measured
+                    // 2026-08-15 on a real council run: 1,479 output tokens
+                    // billed, 134 characters captured. A one-word probe cannot
+                    // catch this, which is why it survived the first fix.
+                    if (_dictGet(itemObj, 'type', undefined) === 'agent_message') {
+                        const flat = _pyStr(_dictGet(itemObj, 'text', '')).trim();
+                        if (flat) {
+                            text = flat;
+                        }
+                    }
                     if (_pyTruthy(_dictGet(itemObj, 'id', undefined))) {
                         meta['item_id'] = _pyStr(itemObj['id']);
                     }
@@ -1812,8 +1950,49 @@ export class OpenAICliClient extends CliClient {
                 if (_pyTruthy(_dictGet(ev, 'session_id', undefined))) {
                     meta['session_id'] = _pyStr(ev['session_id']);
                 }
+            } else if (event_type === 'turn.failed') {
+                // The turn's real cause lives ONLY here, and codex still exits
+                // 0. Without this branch the response is an empty text, which
+                // the caller reports as `no response` — indistinguishable from
+                // a model that answered with nothing. Measured 2026-08-15: a
+                // pinned `gpt-4o` produced exactly this shape, and the seat
+                // read as flaky for weeks instead of as misconfigured.
+                let err = _dictGet(ev, 'error', null);
+                if (!_pyTruthy(err)) err = {};
+                if (_isPlainObject(err)) {
+                    const raw = _pyStr(_dictGet(err as Record<string, unknown>, 'message', ''));
+                    if (raw) failure = raw;
+                }
             }
         }
+
+        if (failure !== null && !text) {
+            const unsupported = /not supported when using Codex/i.test(failure);
+            return new CouncilResponse({
+                provider: this.name,
+                model: this.model,
+                text: '',
+                input_tokens,
+                output_tokens,
+                error: unsupported ? 'model_unsupported_on_transport' : 'turn_failed',
+                metadata: {
+                    ...meta,
+                    // The vendor's own sentence, kept because it names the
+                    // model and the account type — the two facts an operator
+                    // needs and neither of which the error code carries.
+                    detail: failure.slice(0, 400),
+                    ...(unsupported
+                        ? {
+                              hint:
+                                  'the codex subscription transport serves no explicitly pinned ' +
+                                  'model measured so far — remove the `model:` line from the ' +
+                                  'openai member to use the CLI default',
+                          }
+                        : {}),
+                },
+            });
+        }
+
         return new CouncilResponse({
             provider: this.name,
             model: this.model,

package/src/scripts/ai_council/config.ts

@@ -81,6 +81,7 @@ import * as user_global_paths from '../_lib/user_global_paths.js';
 // `import type` and is erased at build, so there is no runtime cycle today.
 // Converting it to a value import — or adding any other runtime import from
 // quorum into config — creates a real ESM cycle in the loader's init path.
+import { OPENAI_CLI_VENDOR_DEFAULT } from './clients.js';
 import { SOLO_FLOOR_MIN_PRESENT } from './quorum.js';
 
 const _VALID_PROVIDERS: ReadonlySet<string> = new Set([
@@ -1843,7 +1844,21 @@ function _build_member(
             }
             entries.push(entry);
         }
-        if (member_enabled && model && !entries.includes(model)) {
+        // `codex-default` is a SENTINEL, not a model id — "let the transport
+        // choose". Requiring it to appear on a downgrade ladder of concrete ids
+        // is a category error, and it is the check that blocks the one config
+        // that actually works on a subscription account: the shipped template
+        // cannot pin an id (every id this package shipped is on
+        // `CODEX_MEASURED_UNSERVABLE`), and its ladder is an api-transport
+        // concern the CLI's own default cannot be ordered against. Exempting
+        // the sentinel is narrower than dropping the check — a real pin is
+        // still required to be on its own ladder.
+        if (
+            member_enabled &&
+            model &&
+            model !== OPENAI_CLI_VENDOR_DEFAULT &&
+            !entries.includes(model)
+        ) {
             throw new CouncilConfigError(
                 `members.${name}.model_ladder must include the active ` +
                     `\`model\` (${_pyReprStr(model)}); got ${_pyRepr(entries)}.`,

package/src/scripts/ai_council/low_impact.ts

@@ -35,6 +35,7 @@
 // - dict insertion order + `dict(sorted(...))` for the stats aggregation.
 
 import { pyRound } from '../_lib/value_ladder.js';
+import { OPENAI_CLI_VENDOR_DEFAULT } from './clients.js';
 import type { CouncilResponse, ExternalAIClient } from './clients.js';
 import type { LowImpactFastPathConfig, MemberConfig } from './config.js';
 import type { ImpactVerdict } from './necessity.js';
@@ -630,7 +631,19 @@ export function resolve_low_impact(
             const pinned = model_downgrade.model_tier_override?.[member.name];
             const cheapest = member.model_ladder.length > 0 ? member.model_ladder[0] : null;
             const target = pinned && pinned.length > 0 ? pinned : cheapest;
-            if (target && target !== client.model) {
+            // A member left on the vendor-default sentinel is NOT downgradable
+            // off the ladder. There is nothing to downgrade FROM — the
+            // transport picks the model — and writing a rung onto it re-creates
+            // the pinned-id shape the seat repair removed. Concretely: the
+            // shipped ladder's cheapest rung is `gpt-4o-mini` and its
+            // neighbours are `gpt-4o` / `gpt-4.1`, so this line could hand the
+            // codex transport an id `CODEX_MEASURED_UNSERVABLE` already records
+            // as refused — on a path whose `model_downgrade.enabled` defaults
+            // to true. An explicit per-run `model_tier_override` still wins,
+            // because that is a human naming a model for this run.
+            const unpinned = client.model === OPENAI_CLI_VENDOR_DEFAULT;
+            const overrideWins = pinned !== undefined && pinned.length > 0;
+            if (target && target !== client.model && (!unpinned || overrideWins)) {
                 client.model = target;
             }
         }

package/src/scripts/ai_council/orchestrator.ts

@@ -2029,7 +2029,20 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
 function _render_quorum_line(q: QuorumResult): string {
     const verdict = q.status === 'concluded' ? 'concluded' : 'INCONCLUSIVE — release gate holds';
     const solo = isSoloConcluded(q) ? ' · **solo** — one voice concluded this pass' : '';
-    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${solo}`;
+    // The DEGRADED marker shipped on stdout (`council_cli.ts::_format_quorum_line`,
+    // round 7 § 5.3) and did NOT ship here, although this function is the one
+    // the mirror was copied FROM. The two then diverged in the worse direction:
+    // stdout scrolls away, this string is what gets committed as evidence and
+    // cited months later. `1/2 present, needed 1 — concluded` is literally true
+    // and reads as agreement; the solo marker alone covers only present === 1,
+    // so 2-of-4 rendered as plain "concluded" with nothing to stop a reader
+    // inferring convergence. Same sentence as stdout on purpose — one wording,
+    // so neither surface can drift into being the softer one again.
+    const degraded =
+        q.present < q.total
+            ? `  ⚠️  DEGRADED — ${String(q.total - q.present)} member(s) did not answer; this is not convergence.`
+            : '';
+    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${solo}${degraded}`;
 }
 
 /**

package/src/scripts/ai_council/transport_resolver.ts

@@ -356,6 +356,7 @@ export type CliFailureClass =
     | 'binary_missing'
     | 'auth_rejected'
     | 'cli_unsupported'
+    | 'model_unservable'
     | 'timeout'
     | 'server_error'
     | 'quota_exhausted'
@@ -376,6 +377,20 @@ const FALLBACK_ELIGIBLE: ReadonlySet<CliFailureClass> = new Set([
     'binary_missing',
     'auth_rejected',
     'cli_unsupported',
+    // `model_unservable` satisfies the same no-double-charge property in both
+    // of its shapes: the pre-spend gate refuses before any subprocess exists,
+    // and the call-time shape is a provider 400 — rejected at the request
+    // boundary, no generation performed.
+    //
+    // HONEST SCOPE: this set is not consumed by any shipped path today.
+    // `isFallbackEligible` and `MidFlightFallback` have zero call sites outside
+    // this module and its tests, so membership here is a stated property of the
+    // class, NOT a behaviour a caller performs. Said plainly because the
+    // opposite reading is the attractive one — the constraint really is the
+    // subscription transport's rather than the model's, so the api rung really
+    // would serve the same id, and it would be easy to write that as if it
+    // happened. It does not happen yet.
+    'model_unservable',
 ]);
 
 /** Normalise a raw client error / skip reason into a `CliFailureClass`. */
@@ -388,6 +403,15 @@ export function classifyCliFailure(raw: string): CliFailureClass {
     if (s === 'cli_unsupported' || s === 'unsupported' || s === 'parse_failed') {
         return 'cli_unsupported';
     }
+    // Prefix match, not equality: the detail carries the operator-facing reason
+    // after the code, and that sentence IS the value of this class — collapsing
+    // it back to a bare token would restore the opaque `exit_1` this replaced.
+    // Also matched on the provider's own wording, so a model refused at call
+    // time (one the deny-list has never seen) classifies the same as one the
+    // pre-spend gate caught.
+    if (s.startsWith('model_unservable') || s.includes('is not supported when using codex')) {
+        return 'model_unservable';
+    }
     if (s === 'timeout') return 'timeout';
     if (s === 'cli_quota_exhausted' || s === 'quota_exhausted') return 'quota_exhausted';
     if (/^exit_5\d\d$/.test(s) || s === 'server_error' || s === 'os') return 'server_error';
@@ -406,8 +430,14 @@ export function isFallbackEligible(failure: CliFailureClass): boolean {
  * can bucket every absent member — whether it never got a transport at all
  * or lost one partway through — under one vocabulary. Returns `null` for a
  * failure class outside the four-value enum (`cli_unsupported`,
- * `server_error`, `other`); a caller falls back to the raw failure detail
- * for those rather than mis-classifying them.
+ * `server_error`, `model_unservable`, `other`); a caller falls back to the raw
+ * failure detail for those rather than mis-classifying them.
+ *
+ * `model_unservable` is deliberately unmapped rather than folded into
+ * `no_auth`: the credential is fine, the model is not, and the `detail` string
+ * carries the specific reason. So the bucket a reader sees is still the generic
+ * `unavailable`, while the line beside it now names the cause — an incomplete
+ * improvement, stated as one.
  */
 export function absentReasonFromCliFailure(failure: CliFailureClass): AbsentReason | null {
     switch (failure) {

package/src/scripts/audit_command_surface.ts

@@ -57,9 +57,14 @@ const SIZE_BUDGETS: Record<string, number> = {
     platform: 10,
 };
 // ADR-092: `visibility:` is the named source of truth (visible / advanced /
-// internal); the integer `tier:` is a back-compat alias. A command counts
-// toward the per-pack budget when it is surfaced — visibility in {visible,
-// advanced} (or, when only the alias is present, tier in {0,1}). `internal`
+// internal). The integer `tier:` alias was REMOVED from live command files in
+// road-to-tier-removal Phase 4, but this file still parses it on purpose: the
+// surface-growth check reads PAST git revisions (`_tier_at_ref`), and pre-ADR-092
+// blobs carry only the alias. The live-file tier read below is therefore a
+// harmless residue on current files and the correct read on historical ones.
+// A command counts toward the per-pack budget when it is surfaced — visibility
+// in {visible, advanced} (or, when only the alias is present, tier in {0,1}).
+// `internal`
 // (or absent → defaults to internal) is uncapped.
 const VISIBLE_TIERS: ReadonlySet<number> = new Set([0, 1]);
 const VISIBLE_VISIBILITIES: ReadonlySet<string> = new Set(['visible', 'advanced']);
@@ -622,17 +627,17 @@ export function render_md(commands: Command[], pairs: OverlapPair[]): string {
             '[`command-surface-synthesis.md`](command-surface-synthesis.md). Every command ' +
             "in this table maps to `keep` unless named in that file's tables.",
         '',
-        '| Name | Path | Tier | Cluster | Aliases | Lines | Commits | Age (d) | Bucket |',
+        '| Name | Path | Visibility | Cluster | Aliases | Lines | Commits | Age (d) | Bucket |',
         '|---|---|---:|---|---|---:|---:|---:|---|',
     );
     const sortedCmds = _stableSortStr(commands, (c) => c.relpath);
     for (const c of sortedCmds) {
         const aliases = c.aliases.length ? c.aliases.join(', ') : '—';
-        const tier = c.tier === null ? '—' : String(c.tier);
+        const visibility = c.visibility === null ? '—' : c.visibility;
         const cluster = c.cluster || '—';
         const age = c.days_since_first_commit === null ? '—' : String(c.days_since_first_commit);
         lines.push(
-            `| \`${c.name}\` | \`${c.relpath}\` | ${tier} | ${cluster} | ${aliases} | ` +
+            `| \`${c.name}\` | \`${c.relpath}\` | ${visibility} | ${cluster} | ${aliases} | ` +
                 `${c.line_count} | ${c.commit_count} | ${age} | |`,
         );
     }
@@ -738,7 +743,7 @@ function _is_visible(c: Command): boolean {
 
 interface VisibleCommand {
     name: string;
-    tier: number | null;
+    visibility: string | null;
     cluster: string;
     citations_docs: number;
     commit_count: number;
@@ -797,7 +802,7 @@ export function build_budget_audit(
         if (over) {
             const vis = visible.map((c) => ({
                 name: c.name,
-                tier: c.tier,
+                visibility: c.visibility,
                 cluster: c.cluster,
                 citations_docs: citation_count(c.name),
                 commit_count: c.commit_count,
@@ -832,8 +837,9 @@ export function render_budget_md(audit: BudgetAudit): string {
     L.push('# Command budget audit (6.0.0-B Phase 2 Step 4)\n');
     L.push(
         '> Per-pack VISIBLE-command counts vs. the `size_class` budget ' +
-            '(capability-packs.md). `visible` = tier ∈ {0,1}; tier 2 / absent = ' +
-            'internal (uncapped). Citations = docs/ files referencing `/<name>`.\n' +
+            '(capability-packs.md). `visible` = visibility ∈ {visible, advanced}; ' +
+            '`internal` / absent = uncapped. Citations = docs/ files referencing ' +
+            '`/<name>`.\n' +
             '>\n' +
             '> **Signal note:** docs-citations is the load-bearing signal (rank ' +
             'candidates low→high). The git commit/idle columns are low-variance on ' +
@@ -862,11 +868,11 @@ export function render_budget_md(audit: BudgetAudit): string {
                 `budget ${p.budget} (${p.size_class}), over by ${p.over_by}\n`,
         );
         L.push('Decide per command: keep-visible · set `internal` · relocate-to-pack-X.\n');
-        L.push('| Command | tier | cluster | docs citations | commits | days idle |');
-        L.push('|---|--:|---|--:|--:|--:|');
+        L.push('| Command | visibility | cluster | docs citations | commits | days idle |');
+        L.push('|---|---|---|--:|--:|--:|');
         for (const c of p.visible_commands ?? []) {
             L.push(
-                `| \`${c.name}\` | ${c.tier} | ${c.cluster || '—'} | ` +
+                `| \`${c.name}\` | ${c.visibility ?? '—'} | ${c.cluster || '—'} | ` +
                     `${c.citations_docs} | ${c.commit_count} | ` +
                     `${c.days_since_modified !== null ? c.days_since_modified : '—'} |`,
             );
@@ -1050,8 +1056,8 @@ export function check_new_budget(baseline: string, quiet: boolean): number {
             );
         }
         process.stdout.write(
-            '\nResolve by one of: set the command to `tier: 2` (internal, ' +
-                'uncapped) · merge into a sibling cluster · relocate to a pack ' +
+            '\nResolve by one of: set the command to `visibility: internal` ' +
+                '(uncapped) · merge into a sibling cluster · relocate to a pack ' +
                 'with budget headroom · file a budget-exemption ADR ' +
                 '(docs/contracts/capability-packs.md § Budget exemption process).\n',
         );

package/src/scripts/build_catalog_index.ts

@@ -138,7 +138,7 @@ export function buildEntries(): CatalogIndexEntry[] {
             cls: 'command',
             name,
             description: _str(fm['description']) || _str(fm['intent']),
-            tags: [_str(fm['pack']), _str(fm['tier']), _str(fm['visibility'])].filter((s) => s.length > 0),
+            tags: [_str(fm['pack']), _str(fm['visibility'])].filter((s) => s.length > 0),
             path: _rel(abs),
         });
     }

package/src/scripts/build_discovery_manifest.ts

@@ -657,26 +657,13 @@ function _build(strict: boolean): [JsonObject, JsonObject[]] {
         // 6.0.0-C: surface command routing metadata. Does not affect the
         // per-file checksum (computed over frontmatter, below).
         if (category === 'command' && fm !== null && _isObject(fm)) {
-            if (fm['tier'] !== undefined && fm['tier'] !== null) {
-                entry['tier'] = fm['tier'];
-            }
-            // ADR-090: `visibility:` is the named source of truth; the integer
-            // `tier:` is a back-compat alias. Dual-emit BOTH into the manifest
-            // (a published data contract) during the deprecation window so
-            // external consumers reading the integer key keep working. The
-            // top-level `deprecations` block (ADR-092 / road-to-tier-removal)
-            // announces the `tier` deprecation; removal is Phase 4. Prefer the
-            // explicit field; derive from tier when absent.
-            const _tierToVis: Record<number, string> = { 0: 'visible', 1: 'advanced', 2: 'internal' };
-            let _vis: Json = fm['visibility'];
-            if (
-                (_vis === undefined || _vis === null) &&
-                fm['tier'] !== undefined &&
-                fm['tier'] !== null
-            ) {
-                // `.get(fm["tier"])` returns None when tier is not 0/1/2 → undefined here.
-                _vis = typeof fm['tier'] === 'number' ? _tierToVis[fm['tier']] : undefined;
-            }
+            // ADR-090 named `visibility:` the source of truth; the integer
+            // `tier:` alias it superseded was dual-emitted here through the
+            // deprecation window and REMOVED in road-to-tier-removal Phase 4.
+            // The manifest no longer carries `tier` in any entry — the
+            // top-level `deprecations` block records the removal for consumers
+            // that still read the old key.
+            const _vis: Json = fm['visibility'];
             if (_vis !== undefined && _vis !== null) {
                 entry['visibility'] = _vis;
             }
@@ -788,27 +775,36 @@ function _build(strict: boolean): [JsonObject, JsonObject[]] {
     const stats = _compute_stats(artefacts, unassigned, documentedUnassigned);
 
     const manifest: JsonObject = {
-        version: 2,
-        // Machine-readable deprecation signal (road-to-tier-removal Phase 1,
-        // ADR-092). The integer command `tier` (0/1/2) is a back-compat alias
-        // for the named `visibility` field (ADR-090). It is STILL emitted into
-        // command entries above (non-breaking) — this block only ANNOUNCES the
-        // deprecation so external manifest consumers can migrate to `visibility`
-        // during the soak window. Removal of `tier` is Phase 4 of
-        // road-to-tier-removal (cheaply reversible per ADR-092); `sunset` is
-        // maintainer-owned and stays null until the soak clears.
+        // v3 (road-to-tier-removal Phase 4): the integer command `tier` is no
+        // longer emitted on `category: command` artefacts. That is a breaking
+        // change to a published data contract, and this schema's own rule is
+        // "bump on breaking change" — so the version carries the break rather
+        // than leaving a v2 consumer to discover a silently-absent field.
+        version: 3,
+        // Machine-readable removal record (road-to-tier-removal Phase 1 added
+        // this block as a deprecation ANNOUNCEMENT; Phase 4 turned it into the
+        // record of an executed removal). The entry is retained on purpose: a
+        // consumer that still reads the old key needs to find out what replaced
+        // it and when it went, and an absent entry would say neither. `sunset`
+        // is maintainer-owned: SET on 2026-08-13, with the soak wait explicitly
+        // waived ("wir haben lange genug gewartet"). ADR-137 had already reduced
+        // the re-open trigger set to this one act — a concrete sunset — after
+        // withdrawing the second trigger as structurally impossible in a
+        // no-runtime package.
         deprecations: [
             {
                 key: 'tier',
                 scope: 'command',
                 replacement: 'visibility',
                 since: 'ADR-092',
-                sunset: null,
+                sunset: '2026-08-13',
+                removed_in: 3,
                 note:
-                    'Integer command `tier` (0/1/2) is a deprecated back-compat ' +
-                    'alias for the named `visibility` field (ADR-090). Read ' +
-                    '`visibility`; `tier` is still emitted (non-breaking) but ' +
-                    'scheduled for removal — see road-to-tier-removal.',
+                    'Integer command `tier` (0/1/2) was a back-compat alias for ' +
+                    'the named `visibility` field (ADR-090). REMOVED in manifest ' +
+                    'v3 — command artefacts no longer carry `tier`. Read ' +
+                    '`visibility` (`visible` / `advanced` / `internal`); the old ' +
+                    'mapping was 0↔visible, 1↔advanced, 2↔internal.',
             },
         ],
         generated_at: _nowUtc(),