v2026.7.23

AIWG 2026.7.23 - Complete package manifest publication recovery

Released: 2026-07-28
Channel: stable

AIWG 2026.7.23 publishes the feature set prepared in 2026.7.22 after the
tarball supply-chain gate stopped both registry workflows before publication.
The gate found three new package-root entries and required an explicit review
before they could ship.

What changed

The reviewed roots are intentional parts of the public package contract:

• schemas/ supplies the security configuration schemas introduced with the
  configurable threat-assessment policy.
• setup.aiwg.yaml supplies the versioned setup.aiwg.io/v1 agentic install,
  repair, and upgrade contract.
• vscode-extension/ supplies the editor-facing AIWG configuration schema.

The package allowlist now names those roots explicitly. The check remains
fail-closed for any other unexpected top-level entry.

Included release

This patch carries the complete 2026.7.22 feature set:

• project-owned threat-assessment modes, profiles, and surface overrides;
• deterministic forge-content assessment with attributable evidence;
• complete shipped-component discovery coverage and an LLM Wiki driver;
• the agentic setup flow for installation, repair, upgrade, and verification;
• normalized session lifecycle and relocation evidence;
• stronger signed-release manifest binding and publish-test dependencies.

Package matrix

All three packages publish in CalVer lockstep:

aiwg@2026.7.23
@aiwg/cli@2026.7.23
@aiwg/cockpit@2026.7.23

Upgrade

Full local-corpus distribution:

npm install --global aiwg@2026.7.23

Lightweight signed-web distribution:

npm install --global @aiwg/cli@2026.7.23

The signed release tag drives both registry publishers, provenance generation,
release assets, checksums, and the stable GitHub mirror release.