AIWG 2026.7.22 - Configurable threat policy and complete capability discovery

AIWG 2026.7.22 - Configurable threat policy and complete capability discovery

Released: 2026-07-28 Channel: stable

AIWG 2026.7.22 makes threat assessment an explicit, inspectable project policy and closes the gap between shipping a component and being able to discover an operational driver for it. It also strengthens agentic installation, session history import, and release-publication integrity.

Highlights

  • Project-owned threat posture - select `off`, `audit`, or `enforce`, start

from documented built-in profiles, or compose project-local rule packs and per-surface overrides without patching framework code.

  • One deterministic forge-content engine - issue text, pull-request

metadata, diff summaries, review comments, outbound maintainer comments, release notes, and handoff artifacts share the same typed evidence and decision contract.

  • Calibrated interruption - negative statements, quoted evidence,

documentation, and explicit out-of-scope warnings are distinguished from requested behavior. The issue #1922 secret-storage warning is a passing regression while malicious credential and supply-chain variants remain detected.

  • Complete discovery coverage - every shipped operational component must

have an indexed driver or an explicit exemption. The LLM Wiki addon now has its missing driver, and CI prevents similar gaps from returning.

  • Agentic setup flow - a versioned `setup.aiwg.io/v1` contract can inspect,

repair, install, deploy, regenerate, index, and verify AIWG across supported providers while preserving source-checkout development mode.

  • Stronger release evidence - signed web manifests bind to the signed tag's

exact commit, and release CI installs its SQLite test dependency without weakening dependency-age gates.

Configurable threat assessment

Threat assessment now lives under `security.threatAssessment` in the resolved workspace member's AIWG configuration. Existing projects retain the documented balanced enforcement default. Trusted local projects may deliberately turn off AIWG's classifier, audit-only projects can collect the same findings without policy-driven interruption, and high-assurance projects can require stricter authorization or rejection thresholds.

The engine records policy and profile versions, a stable policy hash, source provenance, matched rule and statement IDs, quoted evidence, severity, configured action, and audit-mode `wouldAction`. Invalid configuration, unknown rules, cyclic inheritance, unsafe shadowing, and unavailable packs fail closed. Turning AIWG assessment off does not disable provider, hosting-platform, repository-authorization, secret-scanning, or approval controls.

The design is informed by the local NIST AI RMF/control-baseline, OWASP agentic, AgentSpec, deterministic-gate, harness-engineering, trust-calibration, and indirect-prompt-injection research corpus. The documentation uses those sources as design input and does not claim standards conformance.

Capability discovery

The shipped-component inventory is now checked against the framework index. Frameworks, addons, extensions, plugins, and other operational bundles must resolve through an indexed skill, command, flow, rule, agent, or declared driver. The check emits a machine-readable coverage report and blocks CI when a new component has no route.

The LLM Wiki addon is covered by a canonical operational driver with setup, ingest, query, maintenance, and health guidance. This fixes the prior state where the bundle shipped but ordinary capability discovery could not lead an operator to it.

Installation and sessions

The new agentic setup contract gives providers a shared path for installation, repair, upgrade, deployment, indexing, context regeneration, and engagement verification. It diagnoses Node/npm and PATH state, preserves source checkouts unless migration is explicitly approved, and reports evidence instead of assuming a successful install.

Session history imports now retain origin timelines, lifecycle terminal states, and relocation evidence across the normalized session contract. Regression fixtures protect the behavior while keeping provider-owned source histories unchanged.

Package matrix

All three packages are prepared to publish in CalVer lockstep:

[email protected]
@aiwg/[email protected]
@aiwg/[email protected]

The signed release tag publishes npm packages with provenance, creates Gitea release assets and checksums, packages the agent reference corpus, and mirrors the stable release to GitHub.

Upgrade

Full local-corpus distribution:

npm install --global [email protected]

Lightweight signed-web distribution:

npm install --global @aiwg/[email protected]

Existing projects remain compatible. The new threat policy is explicit, versioned, and independently documented; provider and repository authorization controls remain in force regardless of the selected AIWG assessment mode.