AIWG 2026.10.6 - Reviewed memory maintenance and safer worker orchestration

AIWG 2026.10.6 adds a complete memory maintenance cycle, guided setup with reviewable plans, and an optional managed orchestration tier. It also repairs the release Socket audit, migrates AIWG schemas to zod 4, hardens shared MCP writers, and reduces deployment overhead. Discovery now starts with compact metadata cards and explicit content fetches.

This release covers the changes since 2026.10.5, including the zod migration and Socket capability reviews landing immediately before the tag.

Security

The body-parser dependency moves to 2.4.0 to fix compressed-request denial of service GHSA-27r3-jxmh-p828. AIWG moves to native zod 4.6.7, with a minimum range of `^4.6.6`, for GHSA-mrhx-c7xc-m3w5: oversized constrained collections could exhaust memory even after failing their size bound. There is no zod 3 fix. The droid-bridge lockfile receives both updates (#3577, #3580, #3051).

Upgrade advice for schema consumers: code importing AIWG schemas must use the zod 4 API. The migration covers records, error handling, object strictness and inference types. Existing persisted-document parsing behavior is retained, including the previously accepted integer, datetime, URL and infinite-number forms. A fixture pins the JSON Schema of all 88 MCP tools. Consult the zod 4 migration guide when updating integrations.

Fortemi still brings a nested zod 3.25.76 copy. That vulnerability remains upstream-pending in the Fortemi upstream tracker (zod 4 release request filed). No schema crosses the AIWG/Fortemi version boundary. The Socket accepted-risk review is specific to that version and expires on 2026-12-15; this release does not claim to eliminate the nested dependency's advisory.

Shared MCP registry writers now stop on malformed, unreadable or wrongly shaped files and leave their bytes intact, rather than replacing them with defaults. Existing Codex TOML is parsed and malformed input is refused. Muse deployment, profile export, provider cleanup and OpenCode instruction merging use checked atomic writes with private temporary files and backups (#3565, #3572, #3574).

Behavior change: an add or update that writes a literal credential into an existing standalone registry tightens its permissions to 0600 and warns with the previous and new modes. Credential-free writes retain existing permissions; new private parent directories are 0700. Repair malformed registries before retrying a write. Codex/OpenAI user roots may be deliberate symlink aliases, but symlinked directories beneath that root are refused.

Worker version probes now retry transient ETXTBSY failures inside their existing timeout, so updating a CLI binary does not immediately look like a broken installation. A persistent writer still produces a bounded failure with the original code (#3575).

Executor re-registration now requires the current bearer token. An unauthenticated caller can no longer reclaim a known identity or retrieve its token; comparisons use a constant-time helper and token caches are private. Upgrade advice: for an executor identity created before this change, supply `AIWG_EXECUTOR_TOKEN` once so the shim can establish its restart cache. Host-bound identities trust only the live executor or protected host record (#3439, #3482, #2923).

The release also fixes CodeQL findings in citation comment sanitization, shell-free config editor execution and cockpit origin enforcement, and updates Vite/Vitest and the VS Code extension's markdown-it lockfile. The desktop Tauri/Wry glib 0.18 dependency remains constrained upstream (#3418, #3413, #3420, #3417, #3434).

Supply chain and release: Socket becomes a working gate

The Socket audit now queries in 500-component batches, validates the API's actual alert shape and excludes unpublished workspace packages that could never return an artifact. Optional enrichments are optional; malformed fields that are present still fail validation. Advisory IDs, URLs and patched versions are read from alert properties, including GHSA-only responses with empty CVE fields (#3051, #3576, #3578).

Quota pacing remains available after HTTP 429. The workflow defaults `SOCKET_PACE_QUOTA_MINUTES` to 120 and allows 150 minutes for the job; `SOCKET_PURL_BATCH_SIZE` or `--batch-size` can override batching. The final reviewed release-state audit reported zero blocking and zero unavailable components (#3564, #3051).

Policy change: first-party reviews cover the repository's own packages, including cases where Socket supplies no artifact hash, and cannot authorize third-party code. Third-party direct capability reviews are pinned to artifact hashes and explain the flagged code. Updating a version or hash requires a new review. Reviews with `reviewedVersion` match only that version; accepted risks remain dated and scoped. Non-behavioral environment/URL metadata reviews and informational upgrade alerts are distinct from capability approval. Medium Cargo advisories remain visible under the baseline policy without blocking.

Release comparison also becomes more useful at small sample sizes. Assertion regressions remain hard failures; judge preferences use a one-sided exact sign test and dimension-score margin, with decision details in the report and independent recomputation by the verifier (#3438, #3480). Release index builds reclaim locks only from owners proven dead on the same host (#3484, #3493).

Memory maintenance: audit, recommend, plan, apply, verify, restore

Epic #3278 delivers memory maintenance through the existing `aiwg memory` family and existing storage owners (#3279–#3285). The taxonomy separates scope, placement, lifecycle and authority, with stable identities, aliases, replacement lineage, tombstones and observation evidence. Provider adapters cover the canonical provider roster and report opaque or unavailable content explicitly.

Start with a read-only `aiwg memory audit`. It inventories native memory and instructions, eligible rules and prompts, includes, canonical context and artifact memory. Reports identify duplicate exposure, conflicts, shadows, include cycles, stale references and unmanaged content. Missing permissions mean inaccessible; an unobserved live load never counts as verified.

`aiwg memory cost` and `audit --cost` attribute bytes and estimated tokens, separating startup residency, task injection, repeated overhead and actual use. Cache discounts and utility remain unknown without evidence. A demotion preview names the retrieval anchors required to keep the content reachable (#3281).

`aiwg memory recommend` ranks explained candidates for consolidation, recategorization, conflict repair, promotion, demotion and retirement. Recency or frequency alone never permits retirement. Pins, rare obligations, unknown utility, unverified provenance and fresh notes can block a proposal; the report keeps those candidates visible with reasons. New knowledge defaults to indexed placement, with bounded task packs considered before resident context (#3283).

Review a recommendation, create an exact plan, then apply it through the owning store. Plans bind source digests and revisions, scope, rationale, affected links and expected session effects. Stale plans are refused; partial or interrupted operations produce truthful receipts and support idempotent resume. Retirement keeps sources and tombstones, and resident removal requires verified retrieval. `aiwg memory verify --plan <file>` checks receipts, end states, lineage and retrievability without mutation; `restore` reverses the operation (#3282, #3284).

CLI contract: audit, cost, recommend, plan, apply, verify and restore use exit 0 for success/no findings, 1 for findings, 2 for usage/malformed input and 3 for stale/failed operations. Apply requires exact-plan confirmation, with `--yes` for headless use. Legacy storage subcommands keep their previous contract.

Behavior and upgrade advice: canonical resident entries are projected into `WORKSPACE.md` as quoted data during regeneration, within the existing inline budget. Demoted or retired entries disappear on regeneration and restored entries return. Apply, restore and verify report whether provider copies are current or stale and print the regeneration command; they do not regenerate automatically. Canonical context follows the configured artifact root. If legacy local history exists while the external canonical store is absent, migrate deliberately when the diagnostic names both paths (#3553, #3560).

Synthetic qualification covers owner operations, scope isolation, stale plans, interrupted resume, failed index publication, retrieval and source-fact survival across providers. Native live status remains separately reported; fixture success is not a live provider qualification (#3285, #3556).

See the memory maintenance design and contracts for owner boundaries and limitations.

Scheduled housekeeper jobs

The optional housekeeper profile reuses the daemon's scheduler, task store, watcher and minimal IPC without constructing its conversational stack. Typed jobs verify/reconcile indices, retain caches and check updates without model calls. Cron supports IANA timezones and DST; receipts persist missed-run policy, attempts and owner results. Uncertain outcomes block for inspection rather than being replayed (#3353 B1–B5).

Memory audit and recommendation jobs write reports under the routed artifact root. A scheduled apply must name the exact reviewed plan and digest, preview through its owners and verify afterwards. Stale, partial, interrupted or failed verification blocks the schedule. A manual one-shot apply can run without a schedule; scheduling adds no mutation authority (#3353 B6, #3557).

Update installation is opt-in per job (`install: false` by default), subject to channel/version policy, named-zone windows, absence of active work and installer preflight. Refusals record deferred receipts; uncertain installation outcomes require recovery. Receipts report old/new versions and rollback guidance. Installation does not redeploy providers. Resource bounds cover concurrency, queue size, timeouts, niceness and watch handles (#3540).

File reconciliation recovers dropped events, overflow, downtime and returning roots, queues changes while consumers are busy and falls back to polling. Unavailable roots do not generate deletions; same-size rewrites within one timestamp tick are detected. Per-index targets report fresh, stale, degraded, unsupported or unavailable states. Locked staged publication preserves the last valid snapshot on failure (#3519, #3521, #3523).

Service installation is explicit and does not enable the service automatically. Linux systemd user units are supported, launchd is best-effort and Windows is unsupported. Use daemon-free `run-once` where appropriate. See the housekeeper operator guide.

Orchestration and workers

The optional managed tier adds shared admission across group, member, model and quota dimensions, cumulative allowances, bounded queues, common attempt counters and durable 429 cooldowns. Mission/Flow CLI and MCP dispatch share digest-checked prepared worker bindings. Generation fencing and execution identity prevent stale callers from settling or replaying work; uncertain termination retains capacity until proof-based settlement (#2919–#2922, #3447).

Cross-project host admission requires an owner-installed trusted binding. Migration checks revisions and history digests, refuses admitted or uncertain leases, transfers accounting once and fences old callers. Public executor registration grants no host authority. The operator guide covers activation, observation, cancellation, recovery and quiescent rollback to direct mode. Availability: managed dispatch remains a pilot with a same-uid limitation; the isolation gate is still required before general availability (#2923, #2924).

Muse gains operator-qualified direct Tier 0 dispatch using the existing installed adapter contract. Presence alone does not enable it; qualification remains explicit. Its direct profile retains the documented model-identity, data-policy, workspace and stream-grammar constraints (#3181, #3498, #3499).

Worker launches preserve PATH, and Codex qualification exercises a model-free sandbox command under the exact allowed environment. Tier 0 qualification is separate from the systemd launcher probe. Rendered worker commands should run outside the conductor's sandbox so the worker's own sandbox can start. Explicit external sandbox execution is available for Codex/Muse on restricted hosts and produces an advisory (#3474, #3466, #3518, #3497).

Systemd launches now probe their actual namespace boundary and refuse before creating a run directory when it cannot start. Project policy may explicitly select Codex `launchMode: native-sandbox`; it retains the verified CLI sandbox but has no cgroup memory limit or kill scope. Doctor and status name every group using it. External or unverified renderers and unsupported MCP launches are refused (GitHub #366, #367; #3448, #3494).

Resolution keeps canonical adapter registrations, scopes qualification to the groups considered by the request and excludes only load-time `fetchedAt` from the catalog digest. Resource checks now receive worker directories and report bounded, sanitized launch refusals. Health waits for stdout to drain, status sampling uses one clock, and a deadline before identity capture stops the attached transport with honest signal/termination reporting (#3442, #3444–#3446, #3489, #3509, #3527, #3532).

Upgrade advice: requalify existing worker installations to capture PATH and sandbox checks, and resolve saved plans again after the catalog digest change. Approvals are explicitly scoped to each workspace and the configured `accountScope` label; a native CLI account switch does not revoke them, so requalify when switching accounts. Parallel worktrees can retain bounded, separately approved workspace records (#3179, #3475).

Generated parallelism context reports eligibility freshness, review family and local limits. The shell-only Tier 0 walkthrough explains check-ins and places plain-text briefs and final outputs inside the qualified worker tree (#2893, #2914, #3432, #3433). See the worker dispatch guide.

Decision and Jev

`aiwg decision pricing` shows sourced input/output rates and provenance in the existing cost configuration. Explicit `--refresh --model` fetches the official TypeSafe model table; snapshots require `--offline` or explicit fallback consent. Ordinary asks do not fetch pricing. Split rates use actual supported token usage, with the blended rate retained as fallback; old ledger records stay intact (#3291, #3481).

The offline benchmark analyzer validates captures, splits tuning and holdout cases deterministically and compares pass, threshold and agreement settings. The paired collector records Jev passes and baseline model identity, latency, tokens, fallback and sourced costs, checkpoints captures and can extend them. Unknown cost stays unknown. Opt-in live collection requires both call and USD bounds, stopping at 80% of the USD cap based on reported usage; an in-flight call can cross that threshold. Ordinary `decision ask` never calls the baseline (#3483, #3570).

D05 supplies a staged load harness with per-scope rate, token, cost and retained- work bounds, reservation checks, real-clock resource measurements, retries, breaker transitions, cancellation latency and shadow/canary rollback. G5 requires a verified v3 digest-bound artifact from the exact clean commit; a legacy boolean cannot qualify it. This ships the offline harness, not a completed live load qualification. Live preregistration remains a draft awaiting operator approval (#2682, #3571).

The detailed pricing and benchmark guide and D05 live preregistration are available in the tagged repository.

Discovery and rules

Behavior change: plain `aiwg show` returns a metadata card, including governing rules, section outlines with sizes, resources and exact drill-in commands. Use `--body` wherever scripts previously consumed the whole artifact; `--json` also returns the card unless content is requested. `--section`, `--resource` and MCP parameters provide matching focused reads. Headings beginning with `--` work, including equals-form arguments (#3306, #3416, #3435).

A card is metadata: fetch the relevant sections or body before deciding how to perform a workflow. Discovery guidance now leads with the actual discover call before recommending or declining unchecked capabilities. Compound discovery tests pin governing-rule counts and required fetch commands and independently compare compiled CLI and MCP results (#3311, #3292, #3436, #3568).

The new core rule class delivers compact startup bodies before kernel rules, with a 1024-byte per-rule cap and 6144-byte total cap. Anti-laziness is the first core rule in the always-installed utilities addon; budget pressure cannot demote it. Actual loaders now cover eight additional providers, while Grok Bot remains a degraded target with no core-delivery claim (#3450, #3457).

Rule sources follow installed bundles and dependencies. Missing activation falls back to on-demand with a migration warning, and shipped rules must declare it. `use all` delivers kernel and core rules; Pi/OMP retain bulk prompts. Compact bound-rule pointers keep deployed agent definitions within their size budget. Windsurf budgets count rule content rather than its entire aggregated agent file (#3460, #3463, #3471, #3473, #3487, #3490, #3513).

A proposed kernel re-evaluation was recorded and then rejected by the operator. It did not move rule files or adopt the proposed reduced kernel figures; remaining proposed moves need separate decisions (#3573, #3579).

Providers: Grok live grammar

Scrubbed fixtures from an authenticated Grok Build 1.0.38 run now back stream, health-observer and direct-adapter parity tests. They cover text, tool calls and updates, usage, terminal events and command metadata, including pending tool status, null update status, usage without message identifiers and nested tool output. `end` with `stopReason: end_turn` is terminal success. These are captured 1.0.38 observations, not live qualification of 1.0.50 (#2994, #3567).

See the Grok Build evidence record.

Review: evaluator independence

Review records can now include evaluator model, vendor and observed family, acceptance-criteria references, generator/evaluator disagreements and a re-review link; older records remain valid. Guidance across review roles and templates states that agreement or cross-vendor selection does not establish independent errors. Consequential claims need executable checks or accountable human acceptance (#3316, #3581).

The evaluator calibration guide provides a held-out ground-truth procedure and blank template for error-overlap tracking. It does not report measurements or promise reduced human review time.

Performance: in-process deployment

Compatible deploy-agents passes and Codex helpers now run in-process and serialized. Under one measured background-load comparison, `aiwg use sdlc --provider codex` dropped from 160 Node processes to 1 and from 117.6 seconds to 73.1 seconds; guided apply dropped from 161 to 2 processes and 117.7 to 72.9 seconds. These are host measurements, not a universal speedup promise (#3558, #3561).

Callers requiring another working directory, environment overrides or timeouts retain subprocess execution; `AIWG_DEPLOY_SUBPROCESS=1` forces it. Equivalence fixtures compare complete file trees, manifests and previews. Rule projection runs once per provider, binding scans avoid full source-index construction and no-op index builds avoid staging, backup copies and duplicate freshness scans (#3492, #3503, #3541, #3542).

CLI and doctor

Guided setup now follows interview → review → apply. Discovery stays within the workspace, registry seeds and explicitly supplied roots; plans record credential references rather than secrets. Optional Jev and worker integrations can be declined or deferred. Review and dry-run show per-action destinations, diffs and conflicts without writes; apply revalidates facts, records receipts and resumes only incomplete actions. Existing init/setup invocations without the new guided flags retain their behavior (#3449 A1–A6).

`use` rejects unknown options before mutation with exit 2, accepts `sdlc-complete` as an alias and prints one consolidated dry-run plan. It propagates the deployment version and counts agents actually written. Behavior changes: Hermes project-scope deployment is refused because its skills load at user scope; `--no-context-files` now consistently preserves startup files, including Copilot. The inert `--dev` flag is removed from guidance (#3459, #3461, #3464–#3470, #3476).

Doctor recognizes intentional kernel-only installs, counts native agent files rather than index entries and diagnoses missing project configuration instead of crashing. Worker errors name the actual bad argument, workspace boundary, role effort, profile pin or invocation-stage blocker. Provider preparation drains IPC before settling and stops spawning after closure (#3462, #3465, #3452, #3408, #3409, #3475, #3516, #3488).

Removal dry-runs list each file to remove or preserve with reasons from the real ownership checks, and removal help documents those guarantees (#3472). Index sync warns about empty or text-poor graphs without changing its exit status (#2572). Explicit Codex session roots add to the defaults authorized by `--provider-home`; without that flag only explicit roots are scanned, and refresh keeps the saved roots (#3254, GitHub #333).

See the guided setup reference.

Documentation: addon evidence status

Every addon README now labels its evidence as measured, paper-reported or design intent. Paper figures are attributed and distinguished from measurements in AIWG. RLM is experimental with effectiveness unmeasured in AIWG; evaluation examples are illustrative and the skill-factory evaluation document is a plan, not results (#3317, #3566).

Startup regeneration removes duplicate bootstrap headings and repeated imports, uses plain configuration pointers and trims workflow and worker-health detail into linked references (#3451). Managed-dispatch contract links point to GitHub so the strict docsite build can resolve them (#3453). Export-control guidance corrects the Syria comprehensive-embargo table while retaining the EAR licensing caveat (GitHub #347, #3427).

CI health

Plugin validation runs bounded native shards plus its deployment lane with an inventory guard for exact coverage. Runtime WebAssembly tests run once in a separate forks lane rather than worker threads, avoiding the observed V8 teardown abort without dropping coverage (#3401, #3073, #3426, #3549).

Mirror authentication failures now stop at the push step with redacted token rotation guidance, including GitHub's “invalid username or token” wording (#3400, #3411, #3495). Process waits and cleanup, injected clocks, atomic fixture ports, closed HTTP fixture sockets and less load-sensitive performance sampling remove sources of shared-runner flakes. Doctor qualification tests reuse setup while retaining public-CLI coverage; guided setup stays in its owned serial lane with a realistic walkthrough budget (#3529, #3558).

Orchestration lifecycle fixtures and the S2 evidence lane exercise scheduler gates and caller events. Memory qualification reports fixture and live outcomes separately. Show/body callers and link expectations follow the new contracts (#2917, #3285, #3306, #3568, #3569).

Upgrade

Update AIWG using your existing installation method, then refresh deployed frameworks and addons. Adapt `show` consumers to request `--body` or sections, migrate imported schemas to zod 4, repair malformed registries before retrying MCP writes, and account for credential registries becoming private. Requalify workers and resolve saved plans again. Review Socket policy when changing dependencies, and regenerate provider context explicitly after memory placement changes when stale-copy diagnostics request it.

The changelog lists the grouped changes; the versioning guide describes publication surfaces. Housekeeper services, automatic update installation, managed dispatch and live benchmark/load runs remain explicit operator choices.