AIWG 2026.8.16 - Verified publication completion

AIWG 2026.8.16 - Verified publication completion

Release date: 2026-08-21 Channel: stable

AIWG 2026.8.16 completes the production path for locally verifiable public setup resources. The release callback now binds the exact setup digest into the site deployment contract, closing the final gap between signed package release, attested resource publication, and aiwg.io inspection.

What changed

  • The post-publication callback includes the top-level SHA-256 digest of the

release's exact `setup.aiwg.yaml` bytes required by aiwg.io's deployment verifier.

  • The site deployment can verify the signed resource manifest, setup and

agentic YAML descriptors, adjacent DSSE/in-toto attestations, publisher, validity window, and monotonic stable-channel freshness before activation.

  • Public YAML responses advertise their adjacent attestations through

`Link: rel="describedby"`; HTTP metadata and rendering remain non-authoritative.

  • Failed rebuilds cannot overwrite immutable release bytes, and rollback keeps

prior signed evidence and freshness state available for audit.

  • Project index health now counts `WORKSPACE.md`, linked context, and `.aiwg`

artifacts over one shared file set, keeping human and JSON coverage accurate and bounded at 100%.

Production verification

  • Stable promotion to `2026.8.16` occurs only after the callback binds the

release tag, manifest, and exact setup digest into the site deployment gate; the prior `2026.8.15` resources remain immutable and independently verifiable.

  • The published setup and agentic YAML bytes match their signed descriptors and

adjacent attestation descriptors exactly.

  • aiwg.io exposes inline and full-page inspection, copy, and download flows with

explicit rendered, unsigned, policy-exempt, and locally verified states.

  • Anonymous or invalid paid-resource access remains fail-closed; the scoped

production smoke path passes with the required entitlement.

Package matrix

[email protected]
@aiwg/[email protected]
@aiwg/[email protected]

Upgrade

Upgrade all AIWG packages together, then regenerate provider context:

npm install -g [email protected]
aiwg regenerate

Continue to use a local AIWG verifier with an explicit trust root and persisted freshness state before an agent consumes public setup or handoff resources.

Rollback

Roll all three npm packages back together to `2026.8.15`, then regenerate provider context. Existing immutable release evidence and trusted freshness state should be retained during rollback.