AIWG 2026.8.5 - Observable sandbox operations and reliable plugin delivery

AIWG 2026.8.5 - Observable sandbox operations and reliable plugin delivery

Release date: 2026-08-04 Channel: stable

AIWG 2026.8.5 makes sandbox activity and managed-Docker posture visible in Cockpit, adds verifiable web-resource revalidation, and repairs the versioning and self-containment contracts used by the complete Claude Code plugin catalog.

What changed

  • Cockpit presents coverage before activity timelines, preserves explicit scope

and completeness evidence, and exports signed activity manifests without exposing restricted event content.

  • Managed-Docker instances expose a governed security posture and clear

recreation guidance when legacy identity boundaries do not meet the secure default.

  • Signed web-resource metadata uses payload-bound ETag or Last-Modified

validators. A 304 response can reuse only previously verified bytes, while inconsistent cache evidence triggers an unconditional verified recovery.

  • Session analytics and forensic views retain content-free operational facts,

stable citations, and explicit authorization boundaries.

  • Reviewed line-memory promotion and marketing theme-management workflows add

durable memory and repeatable design operations.

  • Every repository-hosted Claude plugin advances to `2026.8.5`, uses a

discoverable skill layout, and keeps its own runtime paths inside the cached plugin payload. The external `training` plugin retains its independent version.

  • Cockpit preserves sandbox authentication and authorization failures across

coverage, timeline, and export routes, and rejects incomplete activity summaries before browser rendering.

  • Context-pack batch touches are serialized with other line-memory mutations.
  • The credential-free live qualification gate pins Agentic Sandbox `v2026.8.3`

to commit `201221e5a26f7f0cc719ab584520ce3164065825`, proves fleet restart re-adoption and governed activity behavior, and records unavailable runtime tiers without converting insufficient evidence into a pass.

Verification

The release candidate is required to pass marketplace/version lockstep, Claude-compatible plugin layout and isolated-path regression tests, Cockpit activity authorization and envelope tests, line-memory process-concurrency tests, TypeScript, the production build, the full test suite, release metadata validation, and Fortemi index validation. The signed release tag then gates forge releases, checksums, SBOM/provenance assets, npm publication, and installer verification.

The latest Sandbox compatibility evidence is the v2026.8.3 qualification. Earlier v2026.7.x Cockpit observations remain minimum-feature evidence.

Package matrix

All three npm packages publish in CalVer lockstep:

[email protected]
@aiwg/[email protected]
@aiwg/[email protected]

Upgrade

Full local-corpus distribution:

npm install --global [email protected]

Lightweight signed-web distribution:

npm install --global @aiwg/[email protected]

Refresh Cockpit through the base CLI to keep it in lockstep:

aiwg use cockpit
aiwg cockpit

Claude Code users should update the AIWG marketplace and installed plugins so the new `2026.8.5` payloads replace older cached versions.

Rollback

Roll back all three npm packages together to `2026.8.4`. That version does not contain the Cockpit activity/posture additions, web metadata revalidation, plugin cache-version repair, or the regression fixes described above.