@event4u/agent-config 8.13.0 → 9.1.0

package/src/config/gitignore-block.txt

@@ -1,12 +1,9 @@
 # Agent config — tool-scope leftovers (ADR-020 § global-only consumer
 # install). After the Phase-5 migration the entire `.augment/`, `.claude/`,
 # `.cursor/` trees live under `~/.event4u/agent-config/`; consumers carry
-# only `agents/overrides/` + `agents/.event4u-bridge.yml`. The per-tool
-# bridge pointer files for Windsurf / Cline / Gemini-CLI live under
-# `.windsurf/`, `.clinerules/`, `.gemini/` and ARE committed — those
-# directories stay tracked (not listed here). Pre-Phase-5 entries kept
-# as a defence-in-depth ignore list for legacy installs that have not
-# migrated yet — Phase 5 unstages them on first migrate run.
+# only `agents/overrides/`. Pre-Phase-5 entries kept as a defence-in-depth
+# ignore list for legacy installs that have not migrated yet — Phase 5
+# unstages them on first migrate run.
 .augment/skills/
 .augment/commands/
 .augment/guidelines/
@@ -21,6 +18,19 @@
 .claude/CLAUDE.md
 .cursor/rules/
 
+# Agent config — consumer bridge marker + per-tool project anchors.
+# The bridge marker was retired (ADR-020 amendment 2026-07-13): it carried
+# no project-specific data (global_root resolves from `~/.event4u/agent-config`)
+# yet was committed and rewritten by every developer's install. The global
+# root is now the well-known path. The Windsurf / Cline / Gemini-CLI anchors
+# remain (those tools cannot read user scope) but are gitignored — each
+# developer regenerates them on install; they are never shared. The install
+# deletes any legacy committed marker; this entry keeps a stale one ignored.
+/agents/.event4u-bridge.yml
+.windsurf/agent-config.bridge.yml
+.clinerules/agent-config.bridge.yml
+.gemini/agent-config.bridge.yml
+
 # Agent config — Phase 5 migration snapshot (ADR-020). Written by
 # `agent-config migrate-to-global` as a copy-then-move safety net so a
 # migration can be rolled back. Local-only — never commit.

package/src/config/prelaunch-areas.yml

@@ -0,0 +1,36 @@
+# Pre-launch diagnostic — fixed coverage-area vocabulary
+# (road-to-ecosystem-harvest-prelaunch-diagnostics Phase 1, Source L).
+#
+# The AREA code is the middle segment of the immutable finding-ID grammar
+# `AC-<AREA>-NNN` (docs/contracts/prelaunch-diagnostics.md). Codes are
+# append-only: renaming or re-using a code would re-assign IDs and break
+# every committed baseline. Add new areas at the end; never delete.
+#
+# `launch_gate: true` areas participate in the regression gate's
+# Pass→Finding CI trigger and block a "ready" verdict while Unknown.
+schema_version: prelaunch-areas-v1
+areas:
+  auth:
+    code: AUTH
+    launch_gate: true
+    description: Authentication, authorization, tenancy boundaries on the launch surface.
+  migrations:
+    code: MIG
+    launch_gate: true
+    description: Schema/data migrations shipped with the launch — reversibility, expand-contract, backfill safety.
+  secrets:
+    code: SEC
+    launch_gate: true
+    description: Secrets, tokens, key handling touched by the launch — storage, rotation, exposure paths.
+  observability:
+    code: OBS
+    launch_gate: false
+    description: Telemetry proving rollout health — the metric, alert, and pager path for the new surface.
+  rollback:
+    code: RBK
+    launch_gate: true
+    description: Rollback contract — trip wires, decision windows, abort paths, named irreversible steps.
+  agent-governance:
+    code: AGOV
+    launch_gate: false
+    description: AI/agent surfaces shipped with the launch — tool grants, egress paths, injection exposure.

package/src/scripts/_cli/cmd_conformance.ts

@@ -47,7 +47,7 @@ import {
     _run_checks_no_manifest,
     _scan_foreign,
     ArgparseExit,
-    BRIDGE_MARKER_RELATIVE,
+    _is_global_only_consumer,
     STATUS_SYMBOLS,
 } from './cmd_doctor.js';
 
@@ -630,7 +630,7 @@ function main(argv: string[] | null = null): number {
     let doctorChecks: Dict[];
     let drift: Record<string, Dict[]> = { missing: [], modified: [], foreign: [], tag_drift: [] };
     if (manifest === null) {
-        const bridge_present = fs.existsSync(path.join(project_root, BRIDGE_MARKER_RELATIVE));
+        const bridge_present = _is_global_only_consumer(project_root);
         doctorChecks = _run_checks_no_manifest(project_root, bridge_present, null);
     } else {
         const [records, known] = _collect_manifest_entries(project_root, manifest);

package/src/scripts/_cli/cmd_doctor.ts

@@ -99,6 +99,13 @@ import {
 } from '../_lib/agent_settings.js';
 import * as ai_council_clients from '../ai_council/clients.js';
 import * as ai_council_config from '../ai_council/config.js';
+import { review_gate_doctor_signal } from '../ai_team/review_gate.js';
+import {
+    LEGACY_ALL,
+    excludedRuleBasenames,
+    ruleScopeFromSettings,
+    type RuleScope,
+} from '../../install/rule_scope.js';
 
 type Dict = Record<string, unknown>;
 
@@ -737,6 +744,7 @@ const CHECK_IDS = [
     'surface-state',
     'hook-wiring',
     'stale-orphans',
+    'rule-scope-drift',
     'manifest-integrity',
     'lockfile-freshness',
     'bridge-drift',
@@ -763,6 +771,7 @@ const GLOBAL_CHECK_IDS: ReadonlySet<string> = new Set([
     'surface-state',
     'hook-wiring',
     'stale-orphans',
+    'rule-scope-drift',
     'mcp-mode',
     'mcp-beta-readiness',
     'offline-readiness',
@@ -782,8 +791,20 @@ const MANIFEST_REQUIRED_CHECK_IDS: ReadonlySet<string> = new Set([
     'unsupported-combos',
 ]);
 
-/** Project-root-relative path of the ADR-020 global-only consumer marker. */
-const BRIDGE_MARKER_RELATIVE = 'agents/.event4u-bridge.yml';
+/**
+ * Signals a set-up global-only consumer. The `.event4u-bridge.yml` marker was
+ * retired (ADR-020 amendment 2026-07-13); the durable project-side signal is
+ * the install-mode marker (written on every install) or the `agents/overrides/`
+ * scaffold. Either is sufficient.
+ */
+const INSTALL_MODE_MARKER_RELATIVE = 'agents/.agent-state/install-mode.txt';
+
+function _is_global_only_consumer(project_root: string): boolean {
+    return (
+        isFile(path.join(project_root, INSTALL_MODE_MARKER_RELATIVE)) ||
+        isDir(path.join(project_root, 'agents', 'overrides'))
+    );
+}
 
 /** Repair targets that `--repair <id>` accepts. */
 const REPAIR_IDS = ['wizard-state'] as const;
@@ -1090,15 +1111,16 @@ function _check_global_binary(project_root: string): Dict {
             remedy: 'agent-config upgrade (refresh the global install + plugin)',
         };
     }
-    const bridge = path.join(project_root, 'agents', '.event4u-bridge.yml');
-    const bridge_note = isFile(bridge) ? '' : ' · no project bridge marker';
+    const consumer_note = _is_global_only_consumer(project_root)
+        ? ''
+        : ' · no project install marker';
     return {
         id: 'global-binary',
         status: 'ok',
-        message: `on PATH (${binary}); version ${binary_v || 'unknown'}${bridge_note}`,
-        remedy: !bridge_note
+        message: `on PATH (${binary}); version ${binary_v || 'unknown'}${consumer_note}`,
+        remedy: !consumer_note
             ? ''
-            : 'agent-config refresh --project (scaffold the bridge marker)',
+            : 'agent-config refresh --project (scaffold agents/overrides/)',
     };
 }
 
@@ -1589,6 +1611,130 @@ function _check_stale_orphans(): Dict {
     };
 }
 
+/**
+ * Per-file rule projection trees a consumer install writes (basenames match
+ * the shipped `dist/agent-src/rules` tree). The first one that exists and
+ * holds ≥ 1 `.md` rule is the surface we diff against the consumer's scope.
+ */
+const _RULE_PROJECTION_DIRS: readonly string[] = [
+    '.augment/rules',
+    '.windsurf/rules',
+    '.cursor/rules',
+    '.clinerules',
+];
+
+/**
+ * Rule-scope drift (road-to-request-scoped-rule-load, 9.0 consumer flip).
+ *
+ * After the 9.0 default flip to consumer-scoped rule projection, a consumer
+ * whose settings now exclude maintainer-only workspaces may still carry a
+ * pre-flip FULL/GLOBAL rule projection on disk. This check diffs the scope
+ * the consumer's settings imply against the rules actually projected and
+ * reports the leftover set as an ACTIONABLE diff (not a bare boolean).
+ *
+ * The scope-derived expected set reuses the ONE install-time scoping surface
+ * (`rule_scope.ts`), so doctor's diagnosis can never drift from the install
+ * semantics. `excludedRuleBasenames` returns exactly the rules PRESENT in the
+ * projected tree that the current scope says should NOT arrive.
+ *
+ * Degrades gracefully: `skipped` in the agent-config source repo (the in-repo
+ * `.augment/rules` is the full generated projection, not a consumer surface)
+ * and `skipped` when no projected rule tree is present to inspect.
+ */
+function _check_rule_scope_drift(project_root: string): Dict {
+    if (_is_source_repo(project_root)) {
+        return {
+            id: 'rule-scope-drift',
+            status: 'skipped',
+            message: 'agent-config source repo — no consumer rule projection to inspect',
+            remedy: '',
+        };
+    }
+
+    // Consumer projection scope (absent / empty settings → legacy-all: every
+    // rule ships, so nothing is ever out of scope).
+    let scope: RuleScope = LEGACY_ALL;
+    const settings_file = project_settings_path(project_root);
+    if (isFile(settings_file)) {
+        const loaded = yamlSafeLoad(readText0(settings_file));
+        const raw =
+            typeof loaded === 'object' && loaded !== null && !Array.isArray(loaded)
+                ? (loaded as Dict)
+                : {};
+        scope = ruleScopeFromSettings(raw);
+    }
+
+    // First projected rule tree that exists and holds a `.md` rule.
+    let rules_dir: string | null = null;
+    let found = 0;
+    for (const rel of _RULE_PROJECTION_DIRS) {
+        const cand = path.join(project_root, rel);
+        if (!isDir(cand)) {
+            continue;
+        }
+        let count = 0;
+        try {
+            for (const name of fs.readdirSync(cand)) {
+                if (name.endsWith('.md') && isFile(path.join(cand, name))) {
+                    count += 1;
+                }
+            }
+        } catch {
+            continue;
+        }
+        if (count > 0) {
+            rules_dir = cand;
+            found = count;
+            break;
+        }
+    }
+    if (rules_dir === null) {
+        return {
+            id: 'rule-scope-drift',
+            status: 'skipped',
+            message: 'no projected rule tree found (.augment/rules, .windsurf/rules, …) — nothing to inspect',
+            remedy: '',
+        };
+    }
+
+    let unexpected: string[];
+    try {
+        unexpected = excludedRuleBasenames(rules_dir, scope);
+    } catch (exc) {
+        const rel = relativeTo(rules_dir, project_root) ?? rules_dir;
+        return {
+            id: 'rule-scope-drift',
+            status: 'fail',
+            message: `cannot inspect ${rel}: ${osErrorStr(exc)}`,
+            remedy: 'check read permissions on the projected rule tree',
+        };
+    }
+
+    const rel_dir = relativeTo(rules_dir, project_root) ?? rules_dir;
+    if (unexpected.length === 0) {
+        return {
+            id: 'rule-scope-drift',
+            status: 'ok',
+            message: `rule projection matches scope (${found} rules in ${rel_dir})`,
+            remedy: '',
+        };
+    }
+    const expected = found - unexpected.length;
+    const sample = unexpected.slice(0, 8);
+    const more = unexpected.length - sample.length;
+    const names = sample.join(', ') + (more > 0 ? `, +${more} more` : '');
+    return {
+        id: 'rule-scope-drift',
+        status: 'warn',
+        message:
+            `rule-scope drift in ${rel_dir}: expected ${expected} rules, found ${found} — ` +
+            `${unexpected.length} unexpected (out of scope): ${names}`,
+        remedy:
+            're-run `agent-config init --project` (or `agent-config global`) to re-project rules ' +
+            'under the current scope — these are leftover from a pre-9.0 full/global projection',
+    };
+}
+
 function _check_python_runtime(): Dict {
     // Post-teardown: the package runtime is TypeScript-on-`tsx`. python3 is no
     // longer a runtime dependency, so this check no longer probes for an
@@ -2028,6 +2174,79 @@ function _settings_flag(val: unknown): boolean {
     return false;
 }
 
+/**
+ * Decode a JWT payload's `exp` claim (epoch seconds) — base64 decode only,
+ * NO signature verification, no network. Non-JWT / undecodable → null.
+ */
+function _jwt_exp(token: unknown): number | null {
+    if (typeof token !== 'string') return null;
+    const parts = token.split('.');
+    if (parts.length !== 3) return null;
+    try {
+        const payload: unknown = JSON.parse(
+            Buffer.from(parts[1] as string, 'base64url').toString('utf-8'),
+        );
+        if (typeof payload !== 'object' || payload === null) return null;
+        const exp = (payload as Record<string, unknown>)['exp'];
+        return typeof exp === 'number' && Number.isFinite(exp) && exp > 0 ? exp : null;
+    } catch {
+        return null;
+    }
+}
+
+/** Coerce an explicit expiry field to epoch seconds (number or ISO string). */
+function _epoch_seconds(value: unknown): number | null {
+    if (typeof value === 'number' && Number.isFinite(value) && value > 0) {
+        // Heuristic: values past ~2286 in seconds are epoch milliseconds.
+        return value > 1e12 ? value / 1000 : value;
+    }
+    if (typeof value === 'string' && value.trim() !== '') {
+        const ms = Date.parse(value);
+        return Number.isNaN(ms) ? null : ms / 1000;
+    }
+    return null;
+}
+
+/**
+ * Latest locally-derivable expiry (epoch seconds) from a codex `auth.json`,
+ * or null when none is derivable. Sources, all offline:
+ *
+ * - explicit `expires_at` / `expiry` / `exp` fields (top level; numbers in
+ *   seconds or ms, or ISO date strings), and
+ * - the `exp` claim of JWT tokens under `tokens.{access_token,id_token}`
+ *   (or the same keys top-level) — base64 payload decode only, never
+ *   signature verification.
+ *
+ * LATEST wins: the real codex auth.json holds a refresh_token, so an
+ * expired id_token sitting next to a live access_token is not an auth
+ * failure — WARN only when everything derivable is past.
+ */
+function _codex_auth_expiry(auth_path: string): number | null {
+    let data: unknown;
+    try {
+        data = JSON.parse(fs.readFileSync(auth_path, 'utf-8'));
+    } catch {
+        return null;
+    }
+    if (typeof data !== 'object' || data === null) return null;
+    const d = data as Record<string, unknown>;
+    const candidates: number[] = [];
+    for (const key of ['expires_at', 'expiry', 'exp']) {
+        const v = _epoch_seconds(d[key]);
+        if (v !== null) candidates.push(v);
+    }
+    const tokens_raw = d['tokens'];
+    const tokens =
+        typeof tokens_raw === 'object' && tokens_raw !== null && !Array.isArray(tokens_raw)
+            ? (tokens_raw as Record<string, unknown>)
+            : {};
+    for (const key of ['access_token', 'id_token']) {
+        const v = _jwt_exp(tokens[key] ?? d[key]);
+        if (v !== null) candidates.push(v);
+    }
+    return candidates.length > 0 ? Math.max(...candidates) : null;
+}
+
 /** The `ai_team` block from `.agent-settings.yml` — lenient, `{}` when absent. */
 function _read_ai_team_block(project_root: string): Dict {
     const settings_file = project_settings_path(project_root);
@@ -2049,14 +2268,21 @@ function _read_ai_team_block(project_root: string): Dict {
  * `team` health check — three sub-signals folded into one result:
  *
  * (a) codex binary present (council-probe binary discovery reused) AND
- *     auth present. Auth is a READ-ONLY presence probe of
- *     `$CODEX_HOME/auth.json` (default `~/.codex/auth.json`) — token
- *     expiry cannot be validated without a billable call; runtime expiry
- *     is caught by `OpenAICliClient._AUTH_FAILURE_PATTERNS`.
+ *     auth present. Auth is a READ-ONLY probe of `$CODEX_HOME/auth.json`
+ *     (default `~/.codex/auth.json`): presence, plus locally-derivable
+ *     expiry evidence (`_codex_auth_expiry` — explicit expiry fields or
+ *     JWT `exp` payloads; no network, no signature verification). Past
+ *     expiry → WARN; no derivable expiry → presence-only note in the
+ *     detail. Runtime expiry is still caught authoritatively by
+ *     `OpenAICliClient._AUTH_FAILURE_PATTERNS`.
  * (b) on Claude-Code hosts (claude binary on PATH or the Claude config dir
  *     present): the official codex plugin recorded in
- *     `plugins/installed_plugins.json`. Detection is read-only — doctor
- *     never writes under `~/.claude/`.
+ *     `plugins/installed_plugins.json`, with namespace-resistant identity
+ *     via `codex_plugin_identity()` — a prefix match whose marketplace
+ *     source repo cannot be verified against `openai/codex-plugin-cc`
+ *     keeps ✅ but is annotated "identity not fully verified (prefix
+ *     match)". Detection is read-only — doctor never writes under
+ *     `~/.claude/`.
  * (c) Review-Gate consistency: `ai_team.review_gate.managed` on while the
  *     loop bound (`max_consecutive_blocks`, Phase 4 — unbuilt) is absent
  *     → WARN.
@@ -2074,8 +2300,6 @@ function _check_team(project_root: string): Dict {
             ? (gateRaw as Dict)
             : {};
     const gate_managed = _settings_flag(gate['managed']);
-    const bound = gate['max_consecutive_blocks'];
-    const bound_present = typeof bound === 'number' && Number.isInteger(bound) && bound > 0;
 
     if (!enabled) {
         if (gate_managed) {
@@ -2110,12 +2334,26 @@ function _check_team(project_root: string): Dict {
         remedies.push('install the codex CLI: `npm install -g @openai/codex`');
     }
 
-    // (a, cont.) codex auth — presence probe of $CODEX_HOME/auth.json.
+    // (a, cont.) codex auth — READ-ONLY probe of $CODEX_HOME/auth.json:
+    // presence + locally-derivable expiry evidence (no network).
     const auth_path = path.join(_codex_home(), 'auth.json');
     const authed = pathExists(auth_path);
-    const auth_glyph = authed ? '✅' : '❌';
+    let auth_str: string;
     if (!authed) {
+        auth_str = `codex auth ❌ (${auth_path})`;
         remedies.push('run `codex login`');
+    } else {
+        const expiry = _codex_auth_expiry(auth_path);
+        if (expiry !== null && expiry * 1000 < Date.now()) {
+            auth_str = `codex auth ⚠️ expired (${auth_path})`;
+            remedies.push('auth token appears expired — run `codex login`');
+        } else if (expiry === null) {
+            auth_str =
+                `codex auth ✅ (${auth_path}; ` +
+                'presence-only check — expiry not verifiable locally)';
+        } else {
+            auth_str = `codex auth ✅ (${auth_path})`;
+        }
     }
 
     // (b) official codex plugin — Claude-Code hosts only.
@@ -2123,34 +2361,33 @@ function _check_team(project_root: string): Dict {
         shutilWhich('claude') !== null || pathExists(claude_plugin.claude_config_dir());
     let plugin_str: string;
     if (is_claude_host) {
-        const plugin_present = claude_plugin.codex_plugin_installed();
-        plugin_str = `codex plugin ${plugin_present ? '✅' : '❌'}`;
-        if (!plugin_present) {
+        const identity = claude_plugin.codex_plugin_identity();
+        if (!identity.installed) {
+            plugin_str = 'codex plugin ❌';
             remedies.push(
                 'install the official codex plugin: ' +
                     claude_plugin.CODEX_PLUGIN_INSTALL_HINT.map((c) => `\`${c}\``).join(' then '),
             );
+        } else if (!identity.identity_verified) {
+            plugin_str = 'codex plugin ✅ — identity not fully verified (prefix match)';
+        } else {
+            plugin_str = 'codex plugin ✅';
         }
     } else {
         plugin_str = 'codex plugin — (not a Claude Code host; fallback path applies)';
     }
 
-    // (c) Review-Gate consistency.
-    let gate_str: string;
-    if (gate_managed && !bound_present) {
-        gate_str = 'review-gate ⚠️ on, loop bound absent';
-        remedies.push(
-            'set `ai_team.review_gate.max_consecutive_blocks` (loop bound; ' +
-                'ships with the Review-Gate governance phase) or set ' +
-                '`ai_team.review_gate.managed: false`',
-        );
-    } else {
-        gate_str = `review-gate ${gate_managed ? 'on' : 'off'}`;
-    }
+    // (c) Review-Gate governance (Phase 4) — logic lives in
+    // src/scripts/ai_team/review_gate.ts (upstream gate probe + WARN
+    // states, incl. plugin-gate-on-while-unmanaged with the quoted
+    // upstream cost warning).
+    const gate_signal = review_gate_doctor_signal(project_root, gate);
+    const gate_str = gate_signal.gate_str;
+    remedies.push(...gate_signal.remedies);
 
     const detail =
         `codex binary ${binary_glyph} (${binary_name}) · ` +
-        `codex auth ${auth_glyph} (${auth_path}) · ${plugin_str} · ${gate_str}`;
+        `${auth_str} · ${plugin_str} · ${gate_str}`;
     if (remedies.length > 0) {
         return {
             id: 'team',
@@ -2433,6 +2670,7 @@ function _run_checks(
         'surface-state': _check_surface_state,
         'hook-wiring': _check_hook_wiring,
         'stale-orphans': _check_stale_orphans,
+        'rule-scope-drift': () => _check_rule_scope_drift(project_root),
         'manifest-integrity': () => _check_manifest_integrity(manifest),
         'lockfile-freshness': () => _check_lockfile_freshness(manifest),
         'bridge-drift': () =>
@@ -2490,8 +2728,8 @@ function _check_bridge_drift_no_manifest(bridge_present: boolean): Dict {
         id: 'bridge-drift',
         status: 'skipped',
         message:
-            'no project lockfile and no bridge marker → drift check ' +
-            'not applicable',
+            'no project lockfile and no consumer install marker → drift ' +
+            'check not applicable',
         remedy:
             'run `agent-config init` (project install) or ' +
             '`agent-config refresh --project` (global-only consumer)',
@@ -2512,6 +2750,7 @@ function _run_checks_no_manifest(
         'surface-state': _check_surface_state,
         'hook-wiring': _check_hook_wiring,
         'stale-orphans': _check_stale_orphans,
+        'rule-scope-drift': () => _check_rule_scope_drift(project_root),
         'manifest-integrity': () => _skipped_manifest_check('manifest-integrity'),
         'lockfile-freshness': () => _skipped_manifest_check('lockfile-freshness'),
         'bridge-drift': () => _check_bridge_drift_no_manifest(bridge_present),
@@ -2555,7 +2794,7 @@ function _run_no_manifest(
         print(`  📍  project_root: ${project_root} (origin: ${origin})`);
         if (bridge_present) {
             print(
-                '  ℹ️   global-only consumer: bridge marker present, no ' +
+                '  ℹ️   global-only consumer: install marker present, no ' +
                     'project lockfile (expected under ADR-020)',
             );
             print(
@@ -2563,7 +2802,7 @@ function _run_no_manifest(
                     'to project-local distributed tools',
             );
         } else {
-            eprint(`  ⚠️   no project lockfile and no bridge marker at ${project_root}`);
+            eprint(`  ⚠️   no project lockfile and no consumer install marker at ${project_root}`);
             eprint(
                 '      run `agent-config init` (project install) or ' +
                     '`agent-config refresh --project` (global-only consumer)',
@@ -2906,7 +3145,7 @@ function main(argv: string[] | null = null): number {
     const manifest_pth = installed_tools.manifest_path(project_root);
     const manifest = installed_tools.read_manifest(manifest_pth);
     if (manifest === null) {
-        const bridge_present = isFile(path.join(project_root, BRIDGE_MARKER_RELATIVE));
+        const bridge_present = _is_global_only_consumer(project_root);
         return _run_no_manifest(opts, project_root, origin, bridge_present);
     }
 
@@ -3007,6 +3246,7 @@ export {
     _check_mcp_mode,
     _check_offline_readiness,
     _check_stale_orphans,
+    _check_rule_scope_drift,
     _check_python_runtime,
     _check_humanizer_runtime,
     _check_mcp_beta_readiness,
@@ -3030,7 +3270,8 @@ export {
     CHECK_IDS,
     GLOBAL_CHECK_IDS,
     MANIFEST_REQUIRED_CHECK_IDS,
-    BRIDGE_MARKER_RELATIVE,
+    INSTALL_MODE_MARKER_RELATIVE,
+    _is_global_only_consumer,
     REPAIR_IDS,
     MCP_BETA_GATES,
     STATUS_SYMBOLS,