Transitive visibility policy

transitive_visibility.toml selects the package groups used by the repository’s Gazelle transitive-visibility extension. The groups themselves remain in their owning trees’ BUILD files.

The [paths] table maps workspace-relative directories to absolute group labels. Use "." for the workspace root. A mapping includes descendants; the most specific directory match wins. Paths are literal directories, not globs. The tools:build_api_consumers entries preserve existing build-tool and toolchain exceptions. Website, developer, and test exceptions remain expressed by the package groups.

Run bazel run //:gazelle -- -lang=enforce_transitive_visibility after changing this file. Gazelle validates all mappings before updating BUILD files and places managed package() declarations in existing files after loads and before rules. Do not add gazelle:transitive_visibility comments; the extension rejects them.

See the plugin documentation for standalone usage and the Bazel 9.3.1 indirect-enforcement limitation.

Gazelle 0.54.0 appends package() after generated rules when it creates a new BUILD file. A subsequent run moves it after the loads; further runs are stable. The repository uses unmodified upstream Gazelle and does not patch this behavior.

Artifact dependency tests

artifact_boundary_test in defs.bzl checks ordinary dependencies separately from native package exceptions. It rejects paths into tools, infra and users through direct or indirect dependencies, using Bazel genquery with --noimplicit_deps --notool_deps --nonodep_deps. Execution tools, toolchains, visibility metadata and Starlark loads are excluded. Select branches remain unconfigured, so this is a conservative source graph rather than a configured runtime or action-graph guarantee.

The current audited runtime roots are AL, the dependency analyzer, the X profile cleaner, and the Article uploader’s converter and draft commands. Their owning command BUILD files declare the tests; normal repository tests run them. Documentation aggregates and authenticated operator wrappers have different allowed inputs and are deliberately outside this check’s coverage. The fixture suite preserves query outputs proving indirect artifact inclusion and execution tool exclusion.