AIWG 2026.10.10 - Safer handoffs to helper CLIs

AIWG 2026.10.10 makes it safer to let an AI conductor hand work to helper CLIs such as Codex and Muse. Private files can be fenced off, worker results are checked before they count, and several setups that failed for the wrong reason now work. It also fixes two install annoyances.

Keep private task files away from the conductor

You can now list files a cloud conductor must never open. Declare them once in your project's `models.json`, then deploy as usual:

{ "defaults": { "workerSelection": { "dataPolicy": {
  "localOnlyPaths": ["private-inputs", "notes/customer.txt"] } } } }

For Claude, AIWG installs read refusals and a hook that blocks commands naming those paths, including wildcards like `cat notes/*` and recursive searches of a folder that contains one. Codex gets matching command rules. These are guards on explicit references, not an operating-system sandbox, so keep truly sensitive data off the conductor's machine.

Worker results are checked before they count

When a helper CLI finishes, AIWG now checks its result against the expected format and re-hashes every file the worker says it produced. A malformed result or a digest that does not match the file fails instead of passing. Codex's own last-message capture is kept separate, so the worker's structured result is no longer overwritten.

Handing work over is also simpler. `aiwg ralph-external --verify-worker` runs the installed verifier on a finished worker, a retry needs only `--retry-of-run-dir`, and `aiwg mcp serve` stays connected for the whole handoff.

Fewer false failures on Ubuntu and MCP

On stock Ubuntu, the worker sandbox check now tests the sandbox each CLI really uses (`bwrap`), so Codex and Muse launches are no longer refused by an AppArmor check that never applied to them. Over MCP, AIWG no longer offers Codex groups that the MCP route cannot launch; it points you to the shell launcher instead.

Smoother installs

Installing an add-on without `--provider` now records it for every provider in your project, so verification passes for all of them. Fresh deploys no longer warn about missing links to guidance files that are meant to be read on demand. Large `--json` reports also arrive complete when another program reads them slowly.

If you are upgrading

• Requalify existing worker approvals: `aiwg doctor --probe-workers --qualify`.
• To use the private-file guard, add `localOnlyPaths` and redeploy with `aiwg use`.
• Codex groups are no longer offered for MCP handoffs; use the shell launcher for them.

Full technical detail is in the CHANGELOG entry. Setup and dispatch are covered in the worker dispatch guide.