AIWG 2026.7.12 - "Cockpit recovery, VM reconnect, and OpenBao CI"

AIWG 2026.7.12 - "Cockpit recovery, VM reconnect, and OpenBao CI"

Released: 2026-07-13 Channel: stable (`npm install -g aiwg`)

The next stable release after `v2026.7.11`. It extends Cockpit stale-agent recovery to VM runtimes, ships a dedicated Cockpit documentation section, adds a native corpus-snapshot command, moves CI secrets and release signing to OpenBao, and lands the repaired LFD control surface for external agent loops.

Highlights

  • Cockpit Reconnect for stale agents — now including VMs (#1778). Inventory

and Sessions keep a running Docker/container/VM instance visible when its agent registration is stale, label it `agent unreachable`, and expose Reconnect. The Bridge recovers containers via `docker exec <container> agent-reconnect` and VMs via the libvirt qemu-guest-agent channel (`virsh qemu-agent-command <domain> guest-exec pkill -HUP -x agent-client`), after trying executor-owned reconnect endpoints first.

  • Dedicated Cockpit documentation section at `docs/cockpit/` — ten pages

(overview, installation, architecture, surfaces, sessions, Bridge API, trust & security, recovery, development, releases) derived code-to-docs from the actual Bridge, web UI, and companion components, and wired into the docsite.

  • `aiwg corpus snapshot` (#1647) — a deterministic native command producing

corpus-snapshot metrics as markdown, terminal summary, or JSON, backed by a declarative Flow playbook.

  • CI secrets and release signing on OpenBao — release workflows fetch

migrated secrets and the GPG release key from an OpenBao vault at CI time via a least-privilege AppRole; the signing identity is unchanged for verifiers.

  • Cockpit fixes: the VS Code shell now consumes shell-core and gains a

working Windows keychain backend (#1783); qemu/kvm instances correctly count as VM runtime coverage (#1782).

  • LFD remediation batch for external Ralph/agent-loop controls: resumed

budgets, unknown-vs-zero usage semantics, completion-vs-budget stop policy, declared exploration quota, stall rule, hypothesis records, holdout-isolated mode, eval harness, VOID runtime, and CI coverage — plus a bounded manual provider test runbook.

Companion upstream work. This release's Cockpit VM recovery was validated

against agentic-sandbox `2026.7.7`+, which fixed the VM control-channel idle

drop (#633) and made agent reconnect state-preserving (#634). On those agents

all session types survive a reconnect; the Bridge's reconnect message and

`docs/cockpit/recovery.md` state the version condition.

Upgrade

npm install -g aiwg@latest
aiwg --version
aiwg use cockpit
aiwg cockpit

For a real local Cockpit stack with host-runtime coverage:

AIWG_COCKPIT_START_HOST_DAEMON=1 npm run cockpit:up

Verification

The Cockpit stack was brought up for this release against the latest agentic-sandbox build with the host-runtime daemon (`AIWG_COCKPIT_START_HOST_DAEMON=1 npm run cockpit:up`): Bridge and executor healthy, a host instance provisioned and its agent registered over mTLS with a managed tmux backend, a session created with a live attach URL, the WebSocket data plane streaming, and the full-system `e2e:cockpit-dev` control-plane chain green.