AIWG 2026.8.28 - Governed evidence, resilient tooling

Release date: 2026-08-31

Channel: stable

AIWG 2026.8.28 makes operational evidence safer to publish and several runtime paths easier to recover. Ops workflows now have one classification, redaction, destination, and retention boundary; session storage can install its optional SQLite backend through the production feature path; A2A adapters preserve compatible routes during dual-version negotiation; and development-channel build drift produces a direct recovery message instead of a raw Node import error.

What this changes for you

Operational evidence crosses one explicit boundary

Operational output can contain sensitive values, internal topology, customer data, or more raw detail than a destination needs. The new governance API handles those concerns together before a payload reaches an agent response, file, repository, tracker, cross-repository transfer, export, or bundle.

The boundary minimizes evidence, redacts text and nested structures, compares artifact classification with the selected sink, and attaches retention or disposition metadata. When full publication is not allowed, it can emit a separately gated summary without copying sensitive source fields.

The command-line preparation path makes the same decision available to ops workflows:

aiwg ops evidence prepare \
  --input evidence.json \
  --policy governance-policy.yaml \
  --sink issue-comment

Projects can extend classification and retention policy while keeping secure defaults for raw audit output, identity audits, network inventories, disaster recovery evidence, and sanitized summaries.

Session SQLite support follows the feature boundary

Session commands can select the optional SQLite backend without treating it as a hidden base dependency. The feature workflow installs and verifies the backend for the scoped session path, while CI exercises the same package and runtime boundary used in production.

This keeps the default package smaller and makes the capability explicit: add the storage feature when a session workflow needs it, and diagnose its state through the normal session tooling.

A2A adapters remain compatible during version negotiation

Dual-version A2A clients and dispatchers now qualify negotiated endpoints without dropping the legacy interface base expected by compatible peers. Codec, client, and dispatch tests cover the route shapes so protocol upgrades do not silently strand an older integration.

A stale development checkout explains how to recover

Development mode can point a globally installed launcher at a local checkout. If that checkout contains `dist/src/cli/router.js` but not the compiled installation manager, AIWG now stops before dynamic import and prints both supported recovery paths:

Run: (cd /path/to/checkout && npm run build:cli)
Or switch back: aiwg --use-stable

Channel-switching commands are handled before the preflight, so recovery stays available even when the selected checkout is only partially built.

Discovered executable skills stay executable

Fortemi Core release indices now preserve skill script entrypoints and execution flags. A script-bearing skill discovered from the packaged corpus can therefore be run through `aiwg run skill <name>` with the same execution metadata it had at source.

Package matrix

[email protected]
@aiwg/[email protected]
@aiwg/[email protected]

Learn more

If you use the new evidence boundary, the most useful feedback is concrete: which sink you publish to, which classification decision surprised you, and whether a sanitized summary carried enough information to act. For development channels, let us know whether the new recovery message gets you back to a working command without needing to inspect the launcher or user-level channel state.