v2026.8.15

AIWG 2026.8.15 - Verified setup handoffs

Release date: 2026-08-21
Channel: stable

AIWG 2026.8.15 adds a reviewed agent handoff for the public setup path and
connects signed release evidence to local inspection on aiwg.io. It also lets
projects separate customer-facing issue intake from their internal engineering
tracker.

What changed

• The repository now owns agentic.yaml, a provider-orchestrated handoff that
  requires local verification of the exact public setup.aiwg.yaml bytes and
  adjacent attestation before an agent may inspect or execute the setup plan.
• Release CI binds both YAML files to the verified signed tag and dispatches the
  private publisher on the stable channel. The publisher emits adjacent
  DSSE/in-toto provenance and commits digest, byte length, and media type in the
  signed web release manifest.
• aiwg.io verifies the pinned Ed25519 authority, signed manifest, exact artifact
  and sidecar bytes, publisher scope, validity window, and monotonic stable
  sequence before showing verified status. Rendering, copying, downloading, or
  HTTP cache metadata remains non-authoritative.
• Ordinary site deployments preserve previously published evidence, and a
  release rollback stops new emission without deleting sidecars, signed
  manifests, or trusted sequence state.
• Workspace configuration may independently identify customer-facing and
  internal issue trackers while retaining the configured delivery authority.
• Generated tracker-authority blocks compute their configuration link from the
  receiving document, keeping root and nested context entry points valid.
• Threat assessment distinguishes benign ML/NLP terminology from actual
  authentication-material handling while retaining strict exfiltration gates.

Verification

• The canonical handoff passes strict SetupManifest validation and contract
  coverage for exact-source release dispatch.
• Tracker-link generation and threat-assessment precision have focused
  regression coverage, including cross-surface false-positive and
  false-negative measurements.
• The aiwg.io verifier, staging pipeline, viewer, cache policy, and deployment
  workflow pass repository CI and deployment gates.
• Branch CI is required to pass before the signed release tag is created.
• The stable publication and public-path verification are completed by the
  signed-tag release workflow.

Package matrix

aiwg@2026.8.15
@aiwg/cli@2026.8.15
@aiwg/cockpit@2026.8.15

Upgrade

Upgrade all AIWG packages together, then regenerate provider context:

npm install -g aiwg@2026.8.15
aiwg regenerate

The public YAML viewer is an inspection surface. Use aiwg verify with an
explicit trust root and persisted freshness state before agent-guided use.

Rollback

Roll all three npm packages back together to 2026.8.14, then regenerate
provider context. Stop new attestation emission if necessary, but retain prior
sidecars, signed manifests, and freshness state for audit and downgrade
protection.