AIWG 2026.7.23 - Complete package manifest publication recovery

Released: 2026-07-28 Channel: stable

AIWG 2026.7.23 publishes the feature set prepared in 2026.7.22 after the tarball supply-chain gate stopped both registry workflows before publication. The gate found three new package-root entries and required an explicit review before they could ship.

What changed

The reviewed roots are intentional parts of the public package contract:

• `schemas/` supplies the security configuration schemas introduced with the

configurable threat-assessment policy.

• `setup.aiwg.yaml` supplies the versioned `setup.aiwg.io/v1` agentic install,

repair, and upgrade contract.

• `vscode-extension/` supplies the editor-facing AIWG configuration schema.

The package allowlist now names those roots explicitly. The check remains fail-closed for any other unexpected top-level entry.

Included release

This patch carries the complete 2026.7.22 feature set:

• project-owned threat-assessment modes, profiles, and surface overrides;
• deterministic forge-content assessment with attributable evidence;
• complete shipped-component discovery coverage and an LLM Wiki driver;
• the agentic setup flow for installation, repair, upgrade, and verification;
• normalized session lifecycle and relocation evidence;
• stronger signed-release manifest binding and publish-test dependencies.

Package matrix

All three packages publish in CalVer lockstep:

[email protected]
@aiwg/[email protected]
@aiwg/[email protected]

Upgrade

Full local-corpus distribution:

npm install --global [email protected]

Lightweight signed-web distribution:

npm install --global @aiwg/[email protected]

The signed release tag drives both registry publishers, provenance generation, release assets, checksums, and the stable GitHub mirror release.