v2026.8.16

AIWG 2026.8.16 - Verified publication completion

Release date: 2026-08-21
Channel: stable

AIWG 2026.8.16 completes the production path for locally verifiable public
setup resources. The release callback now binds the exact setup digest into the
site deployment contract, closing the final gap between signed package release,
attested resource publication, and aiwg.io inspection.

What changed

• The post-publication callback includes the top-level SHA-256 digest of the
  release's exact setup.aiwg.yaml bytes required by aiwg.io's deployment
  verifier.
• The site deployment can verify the signed resource manifest, setup and
  agentic YAML descriptors, adjacent DSSE/in-toto attestations, publisher,
  validity window, and monotonic stable-channel freshness before activation.
• Public YAML responses advertise their adjacent attestations through
  Link: rel="describedby"; HTTP metadata and rendering remain non-authoritative.
• Failed rebuilds cannot overwrite immutable release bytes, and rollback keeps
  prior signed evidence and freshness state available for audit.
• Project index health now counts WORKSPACE.md, linked context, and .aiwg
  artifacts over one shared file set, keeping human and JSON coverage accurate
  and bounded at 100%.

Production verification

• Stable promotion to 2026.8.16 occurs only after the callback binds the
  release tag, manifest, and exact setup digest into the site deployment gate;
  the prior 2026.8.15 resources remain immutable and independently verifiable.
• The published setup and agentic YAML bytes match their signed descriptors and
  adjacent attestation descriptors exactly.
• aiwg.io exposes inline and full-page inspection, copy, and download flows with
  explicit rendered, unsigned, policy-exempt, and locally verified states.
• Anonymous or invalid paid-resource access remains fail-closed; the scoped
  production smoke path passes with the required entitlement.

Package matrix

aiwg@2026.8.16
@aiwg/cli@2026.8.16
@aiwg/cockpit@2026.8.16

Upgrade

Upgrade all AIWG packages together, then regenerate provider context:

npm install -g aiwg@2026.8.16
aiwg regenerate

Continue to use a local AIWG verifier with an explicit trust root and persisted
freshness state before an agent consumes public setup or handoff resources.

Rollback

Roll all three npm packages back together to 2026.8.15, then regenerate
provider context. Existing immutable release evidence and trusted freshness
state should be retained during rollback.