AIWG 2026.10.14 - Approvals that work in your workflows, focused helper agents and fewer deploy surprises

AIWG 2026.10.14 puts last release's approval profiles to work: the workflows that used to stop and ask can now check your project's policy first. It also adds two small, focused helper agents for looking around and checking work, and fixes several problems people hit when deploying their own project add-ons.

Fewer approval prompts, now in the workflows

In 2026.10.12 you could set up an `authorization.hitl` profile and preview it. Now address-issues, issue creation, the agent loop and the provider confirmation hooks check that profile before they ask you. Work your profile clearly allows goes ahead, and AIWG keeps a signed receipt of it. Anything else still asks you, exactly as before. Secrets, destructive changes and production can never be pre-approved, and text in an issue or a model's reply never counts as approval. To check one action by hand, run `aiwg config authorization check --action-file <file> --target <repo>`.

Helpers for looking and checking

Two new helper agents handle read-only jobs. Explorer looks through code and reports what it found. Verifier checks whether a piece of work meets its stated test. Both give a short criterion, evidence and verdict instead of pages of output, and neither uses the most expensive model tier unless you choose it. Run `aiwg use all` to install them for every provider you use.

Helpers stay on the tier you expect

Where a provider lets AIWG pin a model, every helper agent is now pinned to its intended tier. The deploy report tells you, provider by provider, whether that pin is enforced or only inherited.

One guide for handing off work

docs/orchestration/guide.md explains the whole flow in one place: handing a task to a helper, choosing which helper, writing a brief it can finish, and how results are reviewed and approved.

Your own skills stay yours

If a skill synced into a provider folder has the same name as one AIWG manages, AIWG now tells you about the clash and refuses to overwrite it. Files you wrote yourself are never overwritten.

Smaller fixes you may notice

• Project add-ons can target pi, Hermes and every other supported provider. A misspelled provider name is reported instead of silently ignored.
• Codex deploys copy a skill's whole folder, including helper scripts the skill doesn't name.
• A sentence ending in a file path, such as "Run scripts/helper.py.", no longer breaks a deploy.
• `aiwg doctor --project-local` catches a rule summary that is too long, and `aiwg use` tells you which file and which limit.
• Deployed rule counts are correct for summary rules.

If you are upgrading

• Run `aiwg use all` to get the new helper agents and the updated workflow skills.
• If you set up an `authorization.hitl` profile in 2026.10.12, it now takes effect in the workflows above. Run `aiwg config authorization preview` to check what it allows.

Full technical detail is in the CHANGELOG entry.