AIWG 2026.10.7 - Signed worker approvals and clearer release evidence

AIWG 2026.10.7 signs worker qualification records, standardizes sensitive-value input and restores context files after failed deployments. Decision benchmarks can reuse saved Jev responses and compare against an OpenRouter baseline. Release comparison gains reproducible offline preparation and spend controls, while Knowledge Shard full-v1 adds the 2.2.0 candidate contract.

This release covers the 17 merged PRs since 2026.10.6. Live qualification and small paired benchmarks are reported below with their limits.

Security and secrets handling

MCP profile login, Jev setup, auth secret storage and guided setup/apply now share one sensitive-value resolver. It prefers hidden terminal entry, explicit stdin, a private file, a named OS-store entry and a named shell variable, in that order. Setup plans save references and resolve the secret only when applying the plan. `aiwg auth secret set|delete` manages named raw values through the existing native store, separately from OAuth tokens (#3079 slice 1, #3597).

Behavior and upgrade advice: without a terminal, select a source explicitly. Use `--token-env JEV_API_KEY` for Jev setup from that variable, or pipe a manager's output with `--token-stdin`. MCP profile login adds `--api-key-interactive` and `--api-key-store`; no-source terminal login now asks for a hidden key rather than starting Codex OAuth. When several sources are selected, shared precedence applies. An empty or inaccessible selected source fails without trying another.

Private files must be regular, user-owned, single-link and private to that user; symlinks are refused. Windows file input fails closed until native ACL validation is available; use stdin or the native store there. Terminal entry and stdin keep the value off command arguments and the shell environment. Named environment input remains the least preferred option because the invoking shell can expose it.

Reviewed helper children receive an explicit environment allowlist, retaining proxy, CA and platform settings needed to work on managed hosts. Codex profile login sends its key over stdin and bounds and redacts output. Provider/deploy children with provider-specific needs retain their existing environment contract; the inventory distinguishes adopted boundaries from remaining work (#3597).

The second slice (#3605) covers the highest-risk remaining surfaces. Git package installs no longer put your token in the clone URL, where it showed up in git's command line and in debug logs; AIWG now hands it to git through a private, short-lived config file scoped to that one host. `marketplace publish --key` checks that your signing key file is private and also reads the key from stdin. `agentcard verify` and `issue import/export --live` accept the same `--bearer-` / `--token-` sources as every other adopted command.

Behavior changes: the literal `agentcard verify --bearer <token>` still works but is deprecated and prints a warning. Token-authenticated Git installs on Windows now fail closed; use SSH there until Windows file-permission checks land. Remaining owners (MCP registry literals, daemon and storage credentials, and others) are listed in the inventory for a later slice. See the sensitive-value input guide and inventory.

Orchestration and workers

Worker installation approvals now carry an Ed25519 signature using the existing effect-ledger key. The signature binds the record, timestamp, project directory and keyring scope. Loading verifies the signature, trusted key and validity window before importing an adapter. Edited, missing or wrong-key evidence disables the affected installation and produces a scoped diagnostic (#2959, #3596).

Upgrade required: initialize the selected key provider with `aiwg effect keys init`, check `effects.keyProvider`, then run `aiwg doctor --probe-workers --qualify` deliberately. Existing unsigned approvals require this one-time requalification and are never silently signed. Projects without worker dispatch retain their existing behavior.

Worker recovery now distinguishes trusted outage observations from worker claims. Only launcher evidence and bounded recovery probes can open recovery scopes; worker-authored outage text alone cannot. A single bounded executable-binding correction for ENOENT uses an existing attempt and keeps the same allowances, deadline, cancellation and policy (#3048, #3595).

Text, JSON and MCP worker status expose sanitized recovery reasons, eligibility, canary activity and bounded transition history through closure. Worker-written diagnostic text is excluded from those projections (#3049, #3595). The worker dispatch guide covers qualification and recovery.

Decision and Jev

The paired collector can compare a new baseline with saved Jev answers using `--jev-capture <capture>`. It validates the schema, dataset digest, split and exact pass count before making a call, preserves the original Jev observations and costs, and charges only new baseline calls against the new collection's bounds. Checkpoints and offline analysis continue to work (#3291, #3592).

New selection: `--baseline-provider openai|openrouter` chooses the baseline transport. OpenAI remains the default and uses `OPENAI_API_KEY`; OpenRouter requires explicit selection and `OPENROUTER_API_KEY` in the caller environment. OpenRouter requests strict decision JSON with no tools. Its reported `usage.cost` drives known-spend accounting when present; sourced price files remain supported. Errors expose status without returning keys or response bodies (#3291, #3603).

Live paired collection still requires both call and USD bounds. The stop at 80% of recorded spend governs the next call; an in-flight request can cross that threshold. Ordinary decision asks do not invoke a baseline.

D05 results now show actual reported usage separately from conservative budget reservations. Result v2 adds `reservedUsage` and `reportedUsage`, retains unknown usage as null with a labeled known subtotal, and records the served model and safe request ID when available. The CLI prints both totals. Older v1 evidence remains verifiable and acceptable to G5 (#2682, #3582, #3589).

Jev also retains available usage/model/request metadata from failed and invalid answers. An invalid HTTP 200 response with reported usage is charged for that usage instead of the full reservation; unknown usage retains the conservative ceiling (#2680, #3589).

Release tooling

Release comparison now prepares cached published packages, local RC tarballs or built trees against the same project template. Preparation is offline by default and fails on a cache miss; network downloads require explicit permission. Reports show changes in fetched rules/skills, tool calls and tokens, put regressions first and include suspected causes. Judge identity comes from observed model telemetry, and output must be under the configured artifact store (#3298, #3601).

The Claude comparison adapter can use OpenRouter with `AIWG_RELEASE_CLAUDE_TRANSPORT=openrouter`. It restricts the child environment, passes the key only through the intended authentication variable, redacts errors and verifies the observed model against the requested router pin (#3298, #3604).

Budget behavior: `--max-usd`, `--max-calls` and a sourced `--price-file` reserve each pair's two subject calls and judge call before starting. The runner stops before projected spend crosses 80% of the USD cap, records per-call accounting and `stop_reason`, and refuses to pass an incomplete comparison. Subscription entries count as zero incremental USD. The verifier checks accounting against the trusted plan while retaining legacy report compatibility. These are call admission controls; an invoice ceiling also needs a provider-side spending limit.

Offline harness coverage is separate from live release qualification. A pilot does not replace the full corpus, and the budget does not authorize dropping scenarios. See the release comparison guide for preparation, adapters and gate requirements.

Socket post-publish audits now install production dependencies with lifecycle scripts disabled before loading the evaluator, fixing the missing-`semver` crash (#3051, #3591). They also wait for all three exact-version packages to appear on npm before building an inventory. The default wait is 45 minutes, configurable from 1 to 90; expiry records `unavailable: npm-review-pending` with a re-dispatch command and still fails closed. A 240-minute job budget covers visibility wait, Socket quota pacing and overhead (#3590, #3593). See the Socket audit runbook.

Shards and storage

The full-v1 consumer accepts Knowledge Shard 2.2.0 and preserves three optional nullable fields through persistence and export: `embedding_sets.query_template`, `embedding_sets.vector_source` and `embedding_configs.provider_dimension`. Vector sources must be `internal` or `external`; missing or null means internal, and invalid values are rejected before a database write (#3157, #3594).

Compatibility note: 2.2.0 is a pinned unreleased Fortemi candidate contract, supported only by full-v1. Other profiles continue to reject it, and the older 1.x, 2.0.0 and 2.1.0 contracts retain their behavior. The candidate contract and schemas ship with provenance in the 2.2.0 contract. The repository schema catalog now registers those schemas, fixing the stale catalog gate (#3598).

Deploy

A failed `aiwg use` restores context files from a journal of writes actually completed by that deploy. The journal covers context generators, hooks, finalization and provider writers, including staged rule promotion. If someone edits a file after the deploy writes it, rollback preserves that edit and reports a conflict, including in JSON output (#3037, #2873, #3599).

Linux anchors writes and restores on directory descriptors with no-follow opens and identity checks. Platforms without descriptor traversal use checked path access, refuse symlinks and verify identity around writes and restores; that fallback retains a documented check-then-write race. If the safety layer cannot load, read-only provider imports remain usable but context writes fail closed.

CI health

Deploy journal tests now hold the old inode before replacing a file, keeping the identity-conflict assertion deterministic on filesystems that reuse inode numbers. The helper documents the remaining same-inode/same-bytes identity limit (#3600).

Rule probes accept the discovery engine's `aiwg show rule <id> --body` fetch form. Cold rule resolution preserves canonical IDs through staging, and the qualified Codex runtime admits 0.163's `.sqlite-maintenance.lock` file so later probes can run. The four candidate rules retain their kernel placement after the U5 results below (#3292, #2944, #3602).

The shard conformance workflow explicitly runs the full-v1 corpus lane, and Socket workflow contracts pin runtime dependency availability, visibility waits and timeout arithmetic (#3594, #3598, #3591, #3593).

Release comparisons that use Codex as subject or judge no longer mark pairs invalid because of the helper links Codex leaves in its account `tmp/` directory. The account check admits only those links, and only when they resolve to the declared Codex executable. Any other symlink is still rejected, and the error names its path (#3606, #3607).

Live evidence

• Release comparison (#3298): 2026.10.6 (A) was compared against a candidate

built from `main` at `0e2d38dfc` (B), across all 286 corpus scenarios, on two lanes:

• Claude: Claude Haiku 5.5 through OpenRouter, judged by GPT-6 Luna.

Final results: 269 unchanged, 15 improved, 1 flagged and 1 invalid. The flagged scenario, `ops-fleet-drift`, passed 2 of 3 runs on both sides; the misses fell on different repetitions. The invalid pair had one judge answer whose winner contradicted its own scores; the other two judgments split 1–1.

• Codex: GPT-6.1 Sol, judged by GPT-6 Luna. Final results: 273 unchanged,

10 improved, 1 flagged and 2 invalid. Every remaining failure is a 180-second Codex timeout, 6 on A and 7 on B across the confirmations. Every Codex run that finished passed its assertions.

Each lane first ran once per scenario. Pairs broken by a harness defect (#3606, fixed in #3607) were rerun, and every flagged scenario was rerun three times. The automated gate still reports `pass: false` because of the flagged and invalid scenarios above. None of them shows a reproducible regression.

Limits:

• one run per scenario outside the confirmations;
• a single judge model;
• no Hermes lane, because no qualified launcher was available.

After `0e2d38dfc`, only CLI credential handling (#3605) and the comparison harness (#3607) changed. No deployed rule, skill or agent content changed. OpenRouter spend was about USD 5.88 for #3291 and #3298 combined, under a USD 10 cap. The Codex lanes ran on the Codex subscription.

• D05 admission control (#2682): live qualification passed on 2026-10-25

with 135/135 bounds, 809 calls and about USD 0.05 actual provider spend. Result v2 separates that provider usage from conservative reservations.

• Paired Jev benchmark (#3291): on six synthetic cases, Jev and GPT-6.1 Sol

both returned 100% correct answers. Jev's one-pass cost was about 1/24 of the baseline per decision and its response was about 17 times faster: 108 ms versus 1,828 ms. This is a smoke-scale sample, not a broad quality or production performance claim.

• U5 kernel-move probes (#3292, #3602): none of four candidate rules passed.

Positive compliance was 0.1 for instruction-comprehension, 0.1 for research-before-decision, 0.2 for artifact-output-policy and 0.6–0.8 for citation-policy across the initial and paired runs. All four remain always-loaded. The rule activation ADR records the failed moves; the compound probe cases remain available for a future attempt.

Upgrade

Update using your existing installation method, then refresh deployed frameworks and addons. Initialize the effect key provider and deliberately requalify existing worker installations. Select explicit secret sources in headless setup scripts, account for MCP profile login's hidden-key prompt, and select OpenRouter explicitly when using it for a benchmark baseline. Consumers of D05 results should read the separate reserved and reported totals. Accept 2.2.0 shards only with the full-v1 profile and the pinned candidate contract. Inspect rollback conflicts after a failed deployment before retrying. Replace literal `agentcard verify --bearer` in scripts with a `--bearer-*` source, and use SSH for token-authenticated Git installs on Windows.

The changelog lists every merged change, and the versioning guide describes publication surfaces. Live model runs remain explicit operator choices.