@event4u/agent-config 9.8.0 → 9.9.0

package/src/scripts/install.ts

@@ -77,6 +77,7 @@ import * as installed_lock from './_lib/installed_lock.js';
 import * as surface_tiers from './_lib/surface_tiers.js';
 import * as global_deploy_inventory from './_lib/global_deploy_inventory.js';
 import * as installed_tools from './_lib/installed_tools.js';
+import { collect_drift, format_drift_report } from './_lib/install_drift.js';
 import * as user_global_paths from './_lib/user_global_paths.js';
 import * as claude_desktop_bundler from './_lib/claude_desktop_bundler.js';
 import * as claude_settings_hooks from './_lib/claude_settings_hooks.js';
@@ -2892,7 +2893,11 @@ export function _apply_claude_flat_command_wrappers(
         current_files.delete(`commands/${fname}`);
         reserved.push(slug);
     }
-    // Tier-0/1 visible command slugs from the locked discovery manifest.
+    // Visible command slugs from the locked discovery manifest. `visibility`
+    // is the source of truth (ADR-090/092); the integer `tier` stays only as
+    // the fallback for a manifest published before `visibility` was emitted,
+    // so an older locked manifest keeps resolving. Neither key present → the
+    // artefact is skipped rather than silently treated as visible.
     const eligible = new Set<string>(_CLAUDE_FLAT_WRAPPER_EXTRA);
     try {
         const manifest = JSON.parse(
@@ -2900,7 +2905,13 @@ export function _apply_claude_flat_command_wrappers(
         ) as { artefacts?: Array<{ category?: string; slug?: string; tier?: number; visibility?: string }> };
         for (const a of manifest.artefacts ?? []) {
             if (a.category !== 'command' || typeof a.slug !== 'string') continue;
-            if ((a.tier ?? 2) <= 1 && a.visibility !== 'internal') eligible.add(a.slug);
+            const visible =
+                typeof a.visibility === 'string'
+                    ? a.visibility !== 'internal'
+                    : typeof a.tier === 'number'
+                      ? a.tier <= 1
+                      : false;
+            if (visible) eligible.add(a.slug);
         }
     } catch {
         // No manifest → wrap only the hardcoded essentials.
@@ -3136,34 +3147,36 @@ function _verify_deploy_targets(anchor: string, plan: ReadonlyArray<readonly [st
 }
 
 /**
- * Remove lab-tier skills/commands from a completed deploy (core-only).
+ * Remove skills/commands matching `is_pruned` from a completed deploy.
  *
- * road-to-install-contract-stability Phase 2 Step 2. Skills are pruned by
- * whole directory (tier decided by the skill's `SKILL.md` frontmatter);
- * commands by file (own frontmatter). Rules / personas / contexts / templates
- * are core/shared and left intact. Returns `[pruned_count, adjusted_results]`
- * with the lab paths removed from each tool's `written_paths` so the manifest
- * never records them.
+ * road-to-install-contract-stability Phase 2 Step 2 (generalized in
+ * road-to-credible-install Phase 2 to back both the core-only lab prune and
+ * the scoped-projection pack prune off the same mechanics). Skills are
+ * pruned by whole directory (tier decided by the skill's `SKILL.md`
+ * frontmatter); commands by file (own frontmatter). Rules / personas /
+ * contexts / templates are core/shared and left intact. Returns
+ * `[pruned_count, adjusted_results]` with the pruned paths removed from each
+ * tool's `written_paths` so the manifest never records them.
  */
-function _prune_lab_modules(
+function _prune_modules_by(
     deploy_results: Record<string, DeployResult>,
-    lab_ids: Set<string>,
+    is_pruned: (md_path: string) => boolean,
 ): [number, Record<string, DeployResult>] {
     let pruned = 0;
     const adjusted: Record<string, DeployResult> = {};
     for (const tool_id of Object.keys(deploy_results)) {
         const [written, skipped, status, paths] = deploy_results[tool_id] as DeployResult;
-        const lab_skill_dirs = new Set<string>();
+        const pruned_skill_dirs = new Set<string>();
         for (const p of paths) {
             const parts = p.split(path.sep);
             if (parts.includes('skills')) {
                 const i = parts.indexOf('skills');
                 if (i + 1 < parts.length) {
                     const skill_root = parts.slice(0, i + 2).join(path.sep);
-                    if (!lab_skill_dirs.has(skill_root)) {
+                    if (!pruned_skill_dirs.has(skill_root)) {
                         const skillmd = path.join(skill_root, 'SKILL.md');
-                        if (pathExists(skillmd) && surface_tiers.is_lab_artefact(skillmd, lab_ids)) {
-                            lab_skill_dirs.add(skill_root);
+                        if (pathExists(skillmd) && is_pruned(skillmd)) {
+                            pruned_skill_dirs.add(skill_root);
                         }
                     }
                 }
@@ -3173,22 +3186,22 @@ function _prune_lab_modules(
         const delete_files: string[] = [];
         for (const p of paths) {
             const parts = p.split(path.sep);
-            let is_lab = false;
+            let is_target = false;
             if (parts.includes('skills')) {
                 const i = parts.indexOf('skills');
-                if (i + 1 < parts.length && lab_skill_dirs.has(parts.slice(0, i + 2).join(path.sep))) {
-                    is_lab = true;
+                if (i + 1 < parts.length && pruned_skill_dirs.has(parts.slice(0, i + 2).join(path.sep))) {
+                    is_target = true;
                 }
             } else if (
                 parts.includes('commands') &&
                 path.extname(p) === '.md' &&
-                surface_tiers.is_lab_artefact(p, lab_ids)
+                is_pruned(p)
             ) {
-                is_lab = true;
+                is_target = true;
             }
-            (is_lab ? delete_files : keep).push(p);
+            (is_target ? delete_files : keep).push(p);
         }
-        for (const d of lab_skill_dirs) {
+        for (const d of pruned_skill_dirs) {
             fs.rmSync(d, { recursive: true, force: true });
         }
         for (const p of delete_files) {
@@ -3206,6 +3219,175 @@ function _prune_lab_modules(
     return [pruned, adjusted];
 }
 
+/**
+ * Remove lab-tier skills/commands from a completed deploy (core-only).
+ *
+ * road-to-install-contract-stability Phase 2 Step 2. Thin wrapper over
+ * `_prune_modules_by` — see that function for the mechanics.
+ */
+function _prune_lab_modules(
+    deploy_results: Record<string, DeployResult>,
+    lab_ids: Set<string>,
+): [number, Record<string, DeployResult>] {
+    return _prune_modules_by(deploy_results, (p) => surface_tiers.is_lab_artefact(p, lab_ids));
+}
+
+// --- Scoped-projection prune (road-to-credible-install Phase 2) ----------
+//
+// `projection.mode: scoped` narrows a GLOBAL deploy to the active profile's
+// packs (workspaces `engineering` + `agent-config-maintainer` by default,
+// unioned with a `runtime.active_packs` overlay, expanded over the packs.yml
+// `requires` graph). Mirrors the core-only lab prune above — same
+// `_prune_modules_by` mechanics, a different predicate.
+
+/** `workspaces` values whose packs are ALWAYS active under `scoped` mode. */
+const SCOPED_ACTIVE_WORKSPACES: ReadonlySet<string> = new Set(['engineering', 'agent-config-maintainer']);
+
+interface PackRecord {
+    id: string;
+    workspaces: string[];
+    requires: string[];
+}
+
+/**
+ * Parse `src/config/discovery/packs.yml` into `{id, workspaces, requires}`
+ * records. `requires` falls back to the legacy `requires_hint` field name
+ * when `requires` is absent.
+ *
+ * Deliberately THROWS on a missing file or a parse result that is not a
+ * list — an empty active-pack set would be the LEAST safe fallback here
+ * (it would prune every tagged artefact, the opposite of the fail-safe
+ * contract). The caller wraps this in a try/catch that restores the full
+ * tree on any error instead.
+ */
+function _load_packs_registry(package_root: string): PackRecord[] {
+    const vocab_path = path.join(package_root, 'src', 'config', 'discovery', 'packs.yml');
+    const data = yamlSafeLoad(readText(vocab_path));
+    if (!Array.isArray(data)) {
+        throw new Error(`packs.yml did not parse to a list: ${vocab_path}`);
+    }
+    const out: PackRecord[] = [];
+    for (const entry of data) {
+        if (!_isPlainObject(entry)) continue;
+        const id = entry['id'];
+        if (typeof id !== 'string' || id === '') continue;
+        const workspaces_raw = entry['workspaces'];
+        const workspaces = Array.isArray(workspaces_raw)
+            ? workspaces_raw.filter((w): w is string => typeof w === 'string')
+            : [];
+        const requires_raw = entry['requires'] ?? entry['requires_hint'];
+        const requires = Array.isArray(requires_raw)
+            ? requires_raw.filter((r): r is string => typeof r === 'string')
+            : [];
+        out.push({ id, workspaces, requires });
+    }
+    return out;
+}
+
+/**
+ * Active pack id set for `scoped` mode: every pack whose `workspaces`
+ * intersects `SCOPED_ACTIVE_WORKSPACES`, unioned with `runtime_active_packs`,
+ * expanded over the `requires` graph (transitive closure).
+ */
+function _compute_active_pack_ids(
+    packs: readonly PackRecord[],
+    runtime_active_packs: readonly string[],
+): Set<string> {
+    const by_id = new Map<string, PackRecord>();
+    for (const p of packs) by_id.set(p.id, p);
+
+    const active = new Set<string>();
+    for (const p of packs) {
+        if (p.workspaces.some((w) => SCOPED_ACTIVE_WORKSPACES.has(w))) {
+            active.add(p.id);
+        }
+    }
+    for (const id of runtime_active_packs) {
+        active.add(id);
+    }
+
+    let frontier = [...active];
+    while (frontier.length > 0) {
+        const next: string[] = [];
+        for (const id of frontier) {
+            const rec = by_id.get(id);
+            if (rec === undefined) continue;
+            for (const dep of rec.requires) {
+                if (!active.has(dep)) {
+                    active.add(dep);
+                    next.push(dep);
+                }
+            }
+        }
+        frontier = next;
+    }
+    return active;
+}
+
+/**
+ * Read the GLOBAL settings document that governs a global deploy, if one
+ * already exists on disk — the wizard's canonical typed-subdir location
+ * (`<event4u_root>/settings/.agent-settings.yml`, matching
+ * `src/server/routes/settings.ts`'s `SETTINGS_RELATIVE`) first, the legacy
+ * flat root (`<event4u_root>/.agent-settings.yml`) second. Returns `null`
+ * when neither exists — a genuinely fresh machine with no prior settings
+ * artefact of any kind.
+ */
+function _resolve_global_settings_doc(): Record<string, unknown> | null {
+    const root = user_global_paths.event4u_root();
+    const canonical = path.join(root, 'settings', SETTINGS_FILE);
+    if (pathExists(canonical)) return _load_yaml_doc(canonical);
+    const legacy = path.join(root, SETTINGS_FILE);
+    if (pathExists(legacy)) return _load_yaml_doc(legacy);
+    return null;
+}
+
+/**
+ * Resolve the effective `projection.mode` + `runtime.active_packs` overlay
+ * for THIS global install.
+ *
+ * An EXISTING global settings file (any prior install, wizard-written or
+ * hand-edited) is authoritative: a missing `projection.mode` key, an
+ * unreadable file, or an explicit non-`scoped` value ALL resolve to
+ * `legacy-all` — the upgrade-compat contract (an install that never opted in
+ * stays unscoped). Only when NO global settings file exists yet — before the
+ * wizard's `/api/v1/wizard/finish` route has ever written one on this
+ * machine — does resolution fall through to the packaged template's own
+ * default, the value a fresh install is about to receive.
+ */
+function _resolve_scoped_projection(
+    package_root: string,
+): { mode: 'scoped' | 'legacy-all'; active_packs: string[] } {
+    const doc = _resolve_global_settings_doc() ?? _load_default_settings(package_root);
+    const projection = _isPlainObject(doc['projection']) ? (doc['projection'] as Record<string, unknown>) : {};
+    const mode: 'scoped' | 'legacy-all' = projection['mode'] === 'scoped' ? 'scoped' : 'legacy-all';
+    const runtime = _isPlainObject(doc['runtime']) ? (doc['runtime'] as Record<string, unknown>) : {};
+    const active_packs_raw = runtime['active_packs'];
+    const active_packs = Array.isArray(active_packs_raw)
+        ? active_packs_raw.filter((v): v is string => typeof v === 'string')
+        : [];
+    return { mode, active_packs };
+}
+
+/**
+ * Prune every skill/command artefact whose `packs:` frontmatter is
+ * non-empty AND has no intersection with `active_ids`. Untagged artefacts
+ * (empty `packs:` frontmatter) are core/shared and always kept.
+ */
+function _prune_scoped_modules(
+    deploy_results: Record<string, DeployResult>,
+    active_ids: ReadonlySet<string>,
+): [number, Record<string, DeployResult>] {
+    return _prune_modules_by(deploy_results, (p) => {
+        const packs = surface_tiers.frontmatter_packs(p);
+        if (packs.size === 0) return false;
+        for (const id of packs) {
+            if (active_ids.has(id)) return false;
+        }
+        return true;
+    });
+}
+
 function install_global(
     tools: Set<string>,
     force: boolean,
@@ -3283,6 +3465,27 @@ function install_global(
         info(`  tools=${merged_tools.join(',')}`);
     }
 
+    // Installer drift report (measurement only, never a gate — see
+    // `_lib/install_drift.ts`). Printed here because this is the only
+    // moment the information is actionable: right before the redeploy below
+    // overwrites whatever the consumer may have locally edited since the
+    // last install. Same project-scoping the manifest update further below
+    // uses (skipped inside the agent-config source repo itself, where the
+    // manifest would be untracked noise).
+    if (
+        project_root !== null &&
+        pathExists(_resolve_settings_read(project_root)) &&
+        !isDir(path.join(project_root, '.agent-src.uncondensed'))
+    ) {
+        const drift = collect_drift(project_root);
+        if (!state.QUIET) {
+            process.stdout.write('\n');
+            for (const line of format_drift_report(drift).replace(/\n$/, '').split('\n')) {
+                info(line);
+            }
+        }
+    }
+
     const package_root = _resolve_package_root_for_global();
     let deploy_results = _deploy_global_content(tools, force, package_root, written);
 
@@ -3303,6 +3506,35 @@ function install_global(
         }
     }
 
+    // Scoped-projection prune (road-to-credible-install Phase 2 default
+    // flip): when the GLOBAL settings governing this install resolve to
+    // `projection.mode: scoped` (fresh installs; an EXISTING install without
+    // the key, or with any other value, stays untouched — see
+    // `_resolve_scoped_projection`), drop every skill/command artefact whose
+    // `packs:` frontmatter carries no intersection with the active pack set.
+    // A failed resolution (corrupt packs.yml, any thrown error) is caught
+    // here and restores the full tree — never a partial or crashed prune.
+    try {
+        const { mode, active_packs } = _resolve_scoped_projection(package_root);
+        if (mode === 'scoped') {
+            const packs_registry = _load_packs_registry(package_root);
+            const active_ids = _compute_active_pack_ids(packs_registry, active_packs);
+            let scoped_pruned: number;
+            [scoped_pruned, deploy_results] = _prune_scoped_modules(deploy_results, active_ids);
+            if (!state.QUIET) {
+                info(
+                    `🧹 Scoped install: pruned ${scoped_pruned} non-active-pack artefact(s) ` +
+                        `(active packs: ${[...active_ids].sort().join(', ') || '(none)'}). ` +
+                        'Set projection.mode: legacy-all in .agent-settings.yml to restore the full surface.',
+                );
+            }
+        }
+    } catch (e) {
+        if (!state.QUIET) {
+            warn(`Scoped-projection prune failed — restoring full tree (${String(e)}).`);
+        }
+    }
+
     const failed_tools = new Set<string>(
         Object.keys(deploy_results).filter(
             (tool_id) => (deploy_results[tool_id] as DeployResult)[2] === 'deploy_failed',
@@ -4794,5 +5026,14 @@ export {
     ensure_cline_bridge,
     ensure_windsurf_bridge,
     ensure_gemini_bridge,
+    // road-to-credible-install Phase 2: exported for the scoped-projection
+    // prune unit tests.
+    _prune_modules_by,
+    _prune_lab_modules,
+    _prune_scoped_modules,
+    _load_packs_registry,
+    _compute_active_pack_ids,
+    _resolve_global_settings_doc,
+    _resolve_scoped_projection,
 };
-export type { Options };
+export type { Options, PackRecord, DeployResult };

package/src/scripts/lint_budget_ownership.ts

@@ -0,0 +1,89 @@
+#!/usr/bin/env tsx
+/**
+ * lint_budget_ownership — every gate budget carries an owner and a review
+ * date (road-to-credible-install Phase 6.2, anti-ossification).
+ *
+ * A budget without a named owner and an annual review date fossilizes: the
+ * number outlives its rationale and the gate becomes ritual. This lint
+ * fails the build when any budget config under src/config/ lacks:
+ *   - `owner`     (non-empty string)
+ *   - `review_by` (YYYY-MM-DD; may be past — a PAST date is a WARN-level
+ *                  reminder printed to stderr, not a failure, so an overdue
+ *                  review never blocks unrelated PRs; a MISSING date fails)
+ *
+ * Scope: src/config/*budget*.json (top-level fields). Per-entry overrides
+ * are allowed but not required — the top-level owner/review_by covers the
+ * file.
+ *
+ * Exit codes: 0 clean · 1 findings · 2 internal error.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO_ROOT = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..');
+const CONFIG_DIR = path.join(REPO_ROOT, 'src', 'config');
+
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+export function checkBudgetDoc(relPath: string, doc: Record<string, unknown>): string[] {
+    const errors: string[] = [];
+    const owner = doc['owner'];
+    if (typeof owner !== 'string' || owner.trim() === '') {
+        errors.push(`${relPath}: missing non-empty top-level \`owner\``);
+    }
+    const review = doc['review_by'];
+    if (typeof review !== 'string' || !DATE_RE.test(review)) {
+        errors.push(`${relPath}: missing/invalid top-level \`review_by\` (YYYY-MM-DD)`);
+    }
+    return errors;
+}
+
+export function budgetFiles(dir: string = CONFIG_DIR): string[] {
+    try {
+        return fs
+            .readdirSync(dir)
+            .filter((f) => f.endsWith('.json') && f.toLowerCase().includes('budget'))
+            .map((f) => path.join(dir, f));
+    } catch {
+        return [];
+    }
+}
+
+export function main(): number {
+    const files = budgetFiles();
+    if (files.length === 0) {
+        process.stdout.write('ℹ️  no budget configs under src/config/ — nothing to lint\n');
+        return 0;
+    }
+    const errors: string[] = [];
+    const today = new Date().toISOString().slice(0, 10);
+    for (const abs of files) {
+        const rel = path.relative(REPO_ROOT, abs);
+        let doc: Record<string, unknown>;
+        try {
+            doc = JSON.parse(fs.readFileSync(abs, 'utf-8')) as Record<string, unknown>;
+        } catch (e) {
+            errors.push(`${rel}: unparseable JSON (${(e as Error).message})`);
+            continue;
+        }
+        errors.push(...checkBudgetDoc(rel, doc));
+        const review = doc['review_by'];
+        if (typeof review === 'string' && DATE_RE.test(review) && review < today) {
+            process.stderr.write(
+                `⚠️  ${rel}: review_by ${review} is overdue — re-affirm or adjust the budget\n`,
+            );
+        }
+    }
+    if (errors.length > 0) {
+        for (const e of errors) process.stderr.write(`❌  budget ownership: ${e}\n`);
+        return 1;
+    }
+    process.stdout.write(`✅  budget ownership OK (${files.length} budget config(s))\n`);
+    return 0;
+}
+
+const _selfPath = fileURLToPath(import.meta.url);
+if (process.argv[1] !== undefined && path.resolve(process.argv[1]) === path.resolve(_selfPath)) {
+    process.exit(main());
+}

package/src/scripts/lint_command_routing.ts

@@ -34,6 +34,9 @@ const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 // anchors to string start and `.*?` is non-greedy across newlines.
 const FM_RE = /^---\n([\s\S]*?)\n---/;
 const VISIBLE_TIERS: ReadonlySet<number> = new Set([0, 1]);
+// ADR-090/092: `visibility` is the source of truth; the integer `tier` is the
+// back-compat alias kept only as a fallback until it is removed.
+const VISIBLE_VISIBILITIES: ReadonlySet<string> = new Set(['visible', 'advanced']);
 const MIN_CASES = 5; // roadmap Step 5: "5–10 example prompts"
 
 interface Violation {
@@ -41,6 +44,26 @@ interface Violation {
     reason: string;
 }
 
+/**
+ * Is this command part of the gated visible surface?
+ *
+ * Reads `visibility` first, falls back to the deprecated `tier` alias.
+ * `null` = NEITHER key present — the silent-default hole this linter used to
+ * have (absent tier → 2 → skipped), which callers must report rather than
+ * treat as internal.
+ */
+function _isVisible(fm: Record<string, unknown>): boolean | null {
+    const vis = fm['visibility'];
+    if (typeof vis === 'string') {
+        return VISIBLE_VISIBILITIES.has(vis);
+    }
+    const tier = fm['tier'];
+    if (typeof tier === 'number') {
+        return VISIBLE_TIERS.has(tier);
+    }
+    return null;
+}
+
 function _isDir(p: string): boolean {
     try {
         return fs.statSync(p).isDirectory();
@@ -170,11 +193,19 @@ function _isNonEmptyString(v: unknown): v is string {
 
 function check(md: string): Violation[] {
     const fm = _frontmatter(fs.readFileSync(md, 'utf-8'));
-    const tier = 'tier' in fm ? (fm['tier'] as unknown) : 2;
-    if (typeof tier !== 'number' || !VISIBLE_TIERS.has(tier)) {
+    const visible = _isVisible(fm);
+    const rel = _relTo(md, ROOT);
+    if (visible === null) {
+        return [
+            {
+                file: rel,
+                reason: 'missing `visibility` (and no `tier` alias) — cannot determine whether routing metadata is required',
+            },
+        ];
+    }
+    if (!visible) {
         return [];
     }
-    const rel = _relTo(md, ROOT);
     const vio: Violation[] = [];
 
     const intent = fm['intent'];
@@ -310,8 +341,7 @@ function main(): number {
             continue;
         }
         const fm = _frontmatter(fs.readFileSync(md, 'utf-8'));
-        const tier = 'tier' in fm ? (fm['tier'] as unknown) : 2;
-        if (typeof tier === 'number' && VISIBLE_TIERS.has(tier)) {
+        if (_isVisible(fm) === true) {
             visible += 1;
         }
         violations.push(...check(md));

package/src/scripts/lint_command_verbs.ts

@@ -10,7 +10,8 @@
  * visible command under `--all`), and the same sorted iteration order.
  * snake_case kept. Historical quirks are preserved deliberately — tests and downstream consumers pin the exact behaviour.
  *
- * A VISIBLE command (tier 0/1) must have a leading token drawn from the
+ * A VISIBLE command (`visibility: visible|advanced`, i.e. the legacy tier 0/1)
+ * must have a leading token drawn from the
  * approved verb allowlist in `src/config/discovery/command-verbs.yml`.
  * `create-*` is a banned leading token for new visible commands
  * (`create-pr` is grandfathered).
@@ -32,8 +33,13 @@ const VERBS_YML = path.join(ROOT, 'src', 'config', 'discovery', 'command-verbs.y
 const _CMD_PATH_RE = /\.agent-src\.uncondensed\/commands\/.+\.md$/;
 const NAME_RE = /^name:\s*(.*)$/m;
 const TIER_RE = /^tier:\s*(\d+)/m;
+const VISIBILITY_RE = /^visibility:\s*['"]?([A-Za-z-]+)/m;
 const SUB_RE = /^sub:\s*(.*)$/m;
 const VISIBLE_TIERS: ReadonlySet<number> = new Set([0, 1]);
+// ADR-090/092: `visibility` is the source of truth; the integer `tier` is the
+// back-compat alias. `visible`/`advanced` are the two gated (non-internal)
+// values — the named equivalent of VISIBLE_TIERS {0, 1}.
+const VISIBLE_VISIBILITIES: ReadonlySet<string> = new Set(['visible', 'advanced']);
 
 interface Violation {
     file: string;
@@ -109,15 +115,31 @@ function _git(args: string[], tolerant = false): string {
     return r.stdout;
 }
 
-/** (name, tier, sub) from frontmatter text; tier defaults to 2 (internal). */
-function _parse(text: string): { name: string | null; tier: number; sub: string | null } {
+/**
+ * (name, visible, sub) from frontmatter text.
+ *
+ * `visible` reads `visibility` first and falls back to the deprecated integer
+ * `tier` alias, which is what PAST git revisions carry — the promotion check
+ * below parses pre-ADR-090 blobs, so the alias fallback must stay until those
+ * revisions age out. `null` means NEITHER key was present: that is the
+ * silent-default hole this linter used to have (absent tier → 2 → skipped, so
+ * the gate quietly stopped gating), and callers must treat it as a violation
+ * rather than as "internal".
+ */
+function _parse(text: string): { name: string | null; visible: boolean | null; sub: string | null } {
     const nm = NAME_RE.exec(text);
     const name = nm ? _stripQuotes(nm[1]!.trim()) : null;
+    const vm = VISIBILITY_RE.exec(text);
     const tm = TIER_RE.exec(text);
-    const tier = tm ? parseInt(tm[1]!, 10) : 2;
+    let visible: boolean | null = null;
+    if (vm) {
+        visible = VISIBLE_VISIBILITIES.has(vm[1]!);
+    } else if (tm) {
+        visible = VISIBLE_TIERS.has(parseInt(tm[1]!, 10));
+    }
     const sm = SUB_RE.exec(text);
     const sub = sm ? _stripQuotes(sm[1]!.trim()) : null;
-    return { name, tier, sub };
+    return { name, visible, sub };
 }
 
 function changed_command_files(baseline: string): Record<string, string> {
@@ -223,16 +245,27 @@ function check(
     if (!_exists(abs_path)) {
         return []; // deleted
     }
-    const { name, tier, sub } = _parse(fs.readFileSync(abs_path, 'utf-8'));
-    if (name === null || !VISIBLE_TIERS.has(tier)) {
+    const { name, visible, sub } = _parse(fs.readFileSync(abs_path, 'utf-8'));
+    if (visible === null) {
+        // Neither `visibility` nor the `tier` alias — fail loudly instead of
+        // defaulting to internal, which would silently un-gate the command.
+        return [
+            {
+                file: relpath,
+                rule: 'visibility',
+                reason: 'missing `visibility` (and no `tier` alias) — cannot determine whether this command is gated',
+            },
+        ];
+    }
+    if (name === null || !visible) {
         return []; // internal / unnamed — not gated
     }
     if (kind === 'M') {
         // Only a PROMOTION into visibility counts as a new visible surface.
         const prev = _git(['show', `${baseline}:${relpath}`], true);
         if (prev) {
-            const { tier: prev_tier } = _parse(prev);
-            if (VISIBLE_TIERS.has(prev_tier)) {
+            const { visible: prev_visible } = _parse(prev);
+            if (prev_visible === true) {
                 return []; // already visible before — grandfathered
             }
         }