AIWG 2026.8.15 - Verified setup handoffs

AIWG 2026.8.15 - Verified setup handoffs

Release date: 2026-08-21 Channel: stable

AIWG 2026.8.15 adds a reviewed agent handoff for the public setup path and connects signed release evidence to local inspection on aiwg.io. It also lets projects separate customer-facing issue intake from their internal engineering tracker.

What changed

  • The repository now owns `agentic.yaml`, a provider-orchestrated handoff that

requires local verification of the exact public `setup.aiwg.yaml` bytes and adjacent attestation before an agent may inspect or execute the setup plan.

  • Release CI binds both YAML files to the verified signed tag and dispatches the

private publisher on the stable channel. The publisher emits adjacent DSSE/in-toto provenance and commits digest, byte length, and media type in the signed web release manifest.

  • aiwg.io verifies the pinned Ed25519 authority, signed manifest, exact artifact

and sidecar bytes, publisher scope, validity window, and monotonic stable sequence before showing verified status. Rendering, copying, downloading, or HTTP cache metadata remains non-authoritative.

  • Ordinary site deployments preserve previously published evidence, and a

release rollback stops new emission without deleting sidecars, signed manifests, or trusted sequence state.

  • Workspace configuration may independently identify customer-facing and

internal issue trackers while retaining the configured delivery authority.

  • Generated tracker-authority blocks compute their configuration link from the

receiving document, keeping root and nested context entry points valid.

  • Threat assessment distinguishes benign ML/NLP terminology from actual

authentication-material handling while retaining strict exfiltration gates.

Verification

  • The canonical handoff passes strict SetupManifest validation and contract

coverage for exact-source release dispatch.

  • Tracker-link generation and threat-assessment precision have focused

regression coverage, including cross-surface false-positive and false-negative measurements.

  • The aiwg.io verifier, staging pipeline, viewer, cache policy, and deployment

workflow pass repository CI and deployment gates.

  • Branch CI is required to pass before the signed release tag is created.
  • The stable publication and public-path verification are completed by the

signed-tag release workflow.

Package matrix

[email protected]
@aiwg/[email protected]
@aiwg/[email protected]

Upgrade

Upgrade all AIWG packages together, then regenerate provider context:

npm install -g [email protected]
aiwg regenerate

The public YAML viewer is an inspection surface. Use `aiwg verify` with an explicit trust root and persisted freshness state before agent-guided use.

Rollback

Roll all three npm packages back together to `2026.8.14`, then regenerate provider context. Stop new attestation emission if necessary, but retain prior sidecars, signed manifests, and freshness state for audit and downgrade protection.