AIWG 2026.6.12 - "Cockpit VM sessions over vsock"

Released: 2026-06-28 Channel: stable (`npm install -g aiwg`)

This release closes the loop on Cockpit's VM session path. The agentic-sandbox vsock transport line (`v2026.6.31`–`v2026.6.34`) fixed VM agent enrollment upstream; this release re-validates that path end to end from the Cockpit side, adds a one-command launcher for the full stack, and hardens stale-instance handling.

What changed

Cockpit live VM sessions validated over vsock (#561, #1659)

Before the vsock transport landed, a Cockpit-driven VM session would provision a qemu guest that could never enroll — the agent dialed management over a loopback-unreachable network path and the session hung at `bootstrap-pending`. agentic-sandbox `v2026.6.31`+ replaced that with an `AF_VSOCK` transport: the guest enrolls over its hypervisor-assigned CID instead of a routed network path.

This release re-ran the Cockpit live matrix against `v2026.6.34` and the VM target now completes the full lifecycle:

provision → vsock enroll (CID registered, session reconcile)
→ boot-ready → provider workload (AIWG_COCKPIT_LIVE_OK) → clean destroy

Evidence is recorded at `.aiwg/testing/cockpit-vm-vsock-2026-06-27.md` and its JSON sibling in the repository. The container matrix was re-validated against the same release.

`cockpit-up` launcher (#1657)

Bringing the Cockpit up previously meant starting the agentic-sandbox executor and the Cockpit Bridge/web separately and hoping they lined up. The new launcher does both:

npm run cockpit:up
# or: apps/cockpit/scripts/cockpit-up.sh [--rebuild]

It health-checks the executor, starts the latest agentic-sandbox via its `management/dev.sh` if it is down (resolving a sibling checkout or `~/dev/agentic-sandbox`), then brings up the Bridge and web UI. `--rebuild` forces a fresh web build.

Graceful stale-instance destroy (#1660)

Destroying an instance the executor has already reaped no longer surfaces a raw `404`. The Bridge maps the stale lookup to an `already_gone` result and refreshes inventory, so the operator sees the instance disappear instead of an error.

Artifact-index fixes

Canonical agents over persona mirrors — index builds resolve the canonical

agent definition rather than a persona mirror when both exist, preventing duplicate or incorrect agent records.

Missing-graph tolerance — a missing graph no longer aborts an all-graph

`aiwg index build`.

`acquire → induct-media` handoff (media-curator, research)

The media-curator acquisition flow now emits an explicit, validated handoff to the research `induct-media` step, so acquired media flows into the research corpus without a manual bridge. The `transcribe-media` skill also gained explicit `aiwg discover` triggers.

Upgrade

npm install -g aiwg            # stable
aiwg refresh                   # update + redeploy in place

No migration steps. The Cockpit VM session path requires agentic-sandbox `v2026.6.31` or newer (vsock transport); `v2026.6.34` is the validated build.