AIWG 2026.10.8 - Safer secret references and decision ledger retention

AIWG 2026.10.8 lets MCP registrations keep secret references instead of secret bytes, extends private-file and OS-store handling to more credential owners, and adds explicit retention for decision history. Grok Build model discovery stops reporting aliases that upstream ignores in custom endpoint configurations.

This release covers the seven merged PRs since 2026.10.7. No live comparison ran for this release; the local checks are described under Evidence.

Security and secrets handling

`aiwg mcp add` and `mcp update` can register each environment value or header without putting its secret on the command line or in the registry. The existing repeatable `--env-from KEY=SOURCE` and `--header-env HEADER=SOURCE` flags accept bare environment names plus four source forms (#3079 slice 3a, #3615):

Source	What AIWG saves and when it reads the value
`file:ABSOLUTE_PATH`	Saves the private-file path; reads it when the runtime client connects.
`store:NAME`	Saves the OS-store entry name; reads it when the runtime client connects.
`stdin:STORE_NAME`	Explicitly reads piped input, saves it to the named OS-store entry, and persists only `store:STORE_NAME`.
`interactive:STORE_NAME`	Explicitly requests hidden terminal entry, saves it to the named OS-store entry, and persists only `store:STORE_NAME`.

Registration does not prompt unless `interactive:` is selected. At most one value per invocation may use stdin. Transient sources replace an existing named store entry; if a later registration step fails, an entry already saved remains in the store. Missing or invalid selected input fails without fallback.

Deprecation and upgrade advice: secret-looking literal `--env` and `--headers` values still work but print one warning per invocation, without printing the values. Existing literal registrations load unchanged and are not migrated automatically. Move secrets to references. `--args` stays literal and retains its command-line and saved-config exposure.

Native provider limitation: Codex, OMP, Grok Build and other native provider/profile config writers refuse `file:` and `store:` locators before writing. They cannot invoke AIWG's resolver. Keep bare environment-name references for native `mcp inject`, `mcp install` and provider/profile sessions. AIWG's registry-backed Fortemi client resolves file/store sources for stdio, HTTP and SSE, redacts resolved values from errors and results, drains recipient stderr privately, and refuses stdio credential delivery when Node child-process debug logging could expose the environment (#3615).

Four more credential owners use the shared resolver and private-file checks (#3079 slice 3b, #3612):

• Sandbox management: `AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE` receives shared

validation; `AIWG_SANDBOX_MANAGEMENT_TOKEN_STORE` selects a named OS-store entry.

• Fleet costs: `cost-report --key <ref> --key-store <name>` selects a store

entry for one key; fleet YAML uses per-entry `key_store`. Without a store selector, named environment variables and private key files keep their lookup order. One entry never falls back to another entry's key, and reflected keys are redacted. Cost reporting observes spend; OpenRouter enforces spending caps.

• Jev runtime: the existing `jev.json` credential record uses shared

descriptor validation, with the compatibility advice below.

• Local executor: `local-executor serve --token-interactive`, `--token-stdin`,

`--token-file`, `--token-store` and `--token-env` accept a preexisting bearer. Without a source, `AIWG_EXECUTOR_TOKEN`, the restart cache and registration keep their existing behavior. There is no implicit prompt. Restart credentials use a 0600 file in a 0700 directory and shared validation; token values stay out of events and registration errors. Windows cache persistence refuses until native ACL checks are available.

Private input files must be regular, user-owned, single-link, non-symlink and inaccessible to group/others. Windows file input refuses until native ACL validation is available; stdin and store input remain alternatives where the command supports them. The sensitive-value guide and inventory records adopted owners and remaining work; the fleet cost guide describes key references.

Decision and Jev

`aiwg decision rotate` keeps recent decision records easy to inspect while moving older records into a private archive under `archive/decision/` in the resolved artifact root (#3058, #3613).

Retention behavior: rotation is an explicit operator action. The default keeps the last 90 days; `--keep-last <Nd|N>` selects days or a positive record count. Archiving everything requires `--all`. A custom `--to` must stay beneath that archive directory and end in `.jsonl`. `decision history` and `decision stats` read the live ledger by default; add `--include-archives` to include rotated records. Both remain offline.

Readers, appends and rotation share a cross-process lock with dead-owner recovery and a bounded wait. Rotation writes the archive and replacement live file exclusively, then replaces the live file under the lock so concurrent appends are preserved. Malformed lines keep their exact bytes and remain live unless `--all` is selected. Recording trouble warns without failing the decision result. This protects against accidental local file hazards; a hostile process running as the same user remains outside that boundary.

Jev upgrade advice: a symlinked or hard-linked `~/.config/aiwg/credentials/jev.json` is now refused. Replace linked records with a private regular single-link file. Shared validation also rejects exposed, unowned and nonregular files. The JSON format and existing directory checks remain; runtime lookup still prefers `JEV_API_KEY`, then `AIWG_DECISION_JEV_API_KEY`, then the credential file, without prompting (#3079, #3612). The CLI reference covers retention flags and credential-source selection.

Providers: Grok Build

Grok Build model discovery now withholds config-derived aliases when external auth is combined with a custom models endpoint. Upstream ignores local model aliases and ordinary allowlists in that mode, so AIWG reports discovery as unresolved until an effective runtime catalog is available. This includes settings split across active config layers or environment variables. Discovery does not execute the auth command or fetch the endpoint (#3609, #3611).

The reviewed public source advances to `2bdd1d6` (`SOURCE_REV 559751fd`), reviewed on 2026-10-26. Relied-on CLI spellings and inspection fields remain compatible. Offline coverage checks whole-turn streaming usage frames and preservation of final text; those usage frames do not establish completion without a successful end event.

Qualification limit: the provider remains experimental and its released qualification binary remains 1.0.38. Advancing reviewed source identifiers does not establish binary build provenance or qualify that tree through a new live run. Existing live receipts keep their original pins. See model discovery and the qualification record.

CI health

Sandbox credential-loader failures now point installed users to `aiwg doctor` for repair. The Grok Build qualification page uses a repository link for the provider profile excluded from the public docsite, fixing its strict-link build failure (#3079, #3609, #3614).

The offline decision-offload report test clears and restores the host's `AIWG_DECISION_ENABLED`. An enabled workstation can no longer override the fixture's disabled project setting and cause a false failure; product enablement behavior is unchanged (#3616).

Shared-host admission no longer reports a valid host authority as unsafe when two processes race: a reader that opened the snapshot just before another process atomically replaced it now reads that complete earlier snapshot instead of failing. Hard-linked authority files are still refused (#3618).

Evidence

No live comparison ran for this release. Local verification covers version lockstep, TypeScript checking, the CLI build, offline release and documentation tests, test-registration and process-timeout linting, and the public docsite audience audit and strict-link build. These checks establish local build and contract behavior; they provide no new live model quality or performance result.

The MCP source change (#3615) passed the full local verification suite before merge: 44 of 44 CI lanes, including 27,019 default-lane tests with no failures. The other changes passed their touched and neighbouring test suites on two hosts, and `main` CI was green before the release tag.

Upgrade

Update using your existing installation method, then refresh deployed frameworks and addons. Replace secret-looking MCP literals with references; use bare environment-name references for native provider configs. Check that Jev and sandbox credential files are private regular single-link files, and select `--key-store` or fleet `key_store` when moving cost-report keys to the OS store. Use an explicit `local-executor serve --token-*` source for a preexisting bearer. Choose a ledger keep window before rotation and add `--include-archives` when historical reports should span archives. Expect unresolved Grok Build model discovery with external auth plus a custom models endpoint.

The changelog lists the changes, and the versioning guide describes publication surfaces. Live model runs remain explicit operator choices.