@aiwg/cli 2026.8.10 → 2026.8.12

package/bin/aiwg.mjs

@@ -124,6 +124,8 @@ const FAST_HELP_TEXT = `
 
   VALIDATION
     validate-metadata [path]     Validate AIWG component metadata (defaults to agentic/code)
+    verify <artifact>            Verify DSSE provenance using an explicit versioned trust root
+    verify trust <action>        Bootstrap, update, or inspect artifact trust state
     context-firewall [scan]      Audit provider context, trust, drift, poisoning signals, and budget
     context-firewall baseline    Plan or explicitly write the reviewed context baseline
 

package/dist/src/agents/packaged-agent-inventory.js

@@ -1,4 +1,5 @@
 import { promises as fs } from 'node:fs';
+import { createHash } from 'node:crypto';
 import path from 'node:path';
 const MANAGED_MARKER_RE = /(?:^|\n)(?:#|<!--)\s*aiwg:managed\s+v?([^\s]+)\s+([^\s>]+)(?:\s*-->)?/;
 /** Normalize provider-specific deployed filenames to the source agent id. */
@@ -12,6 +13,31 @@ export function parseManagedArtifactMarker(content) {
     const match = MANAGED_MARKER_RE.exec(content);
     return match ? { version: match[1], source: match[2] } : null;
 }
+/** Extract the developer-instruction body from a canonical Markdown agent. */
+export function extractAgentInstructionBody(content) {
+    if (!content.startsWith('---'))
+        return content.trim();
+    const withoutFrontmatter = content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '');
+    return withoutFrontmatter.trim();
+}
+function instructionHash(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+function extractDeployedInstructions(filename, content) {
+    if (!filename.toLowerCase().endsWith('.toml')) {
+        return extractAgentInstructionBody(content);
+    }
+    const match = content.match(/^developer_instructions\s*=\s*(.+)$/m);
+    if (!match)
+        return null;
+    try {
+        const value = JSON.parse(match[1]);
+        return typeof value === 'string' ? value.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
 async function collectAgentSources(frameworkRoot, rootDir, inventory, allMarkdownFiles) {
     let entries;
     try {
@@ -31,8 +57,12 @@ async function collectAgentSources(frameworkRoot, rootDir, inventory, allMarkdow
         if (!allMarkdownFiles && path.basename(rootDir) !== 'agents')
             return;
         let stat;
+        let content;
         try {
-            stat = await fs.stat(absolute);
+            [stat, content] = await Promise.all([
+                fs.stat(absolute),
+                fs.readFile(absolute, 'utf8'),
+            ]);
         }
         catch {
             return;
@@ -42,6 +72,7 @@ async function collectAgentSources(frameworkRoot, rootDir, inventory, allMarkdow
         sources.push({
             path: path.relative(frameworkRoot, absolute),
             size: stat.size,
+            instructionHash: instructionHash(extractAgentInstructionBody(content)),
         });
         inventory.set(name, sources);
     }));
@@ -67,6 +98,11 @@ export function diagnoseOversizedAgent(filename, content, inventory, ceilingByte
     const packaged = inventory.get(normalizeAgentArtifactName(filename)) ?? [];
     if (packaged.some((source) => source.size > ceilingBytes))
         return 'current-package';
+    const deployedInstructions = extractDeployedInstructions(filename, content);
+    if (deployedInstructions !== null
+        && packaged.some((source) => source.instructionHash === instructionHash(deployedInstructions))) {
+        return 'current-package';
+    }
     const marker = parseManagedArtifactMarker(content);
     if (marker?.source === 'bundled')
         return 'stale-deployment';

package/dist/src/api/index.d.ts

@@ -10,4 +10,10 @@ export * from '../resources/index.js';
 export * from '../sessions/index.js';
 export * from '../memory/index.js';
 export * from '../security/threat-assessment-config.js';
+export * from '../security/artifact-verifier.js';
+export * from '../security/artifact-attestation.js';
+export * from '../providers/transformation-receipt.js';
+export * from '../providers/transformation-receipt-integration.js';
+export * from '../marketplace/artifact-attestation.js';
+export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, type ArtifactTrustRoot, type ArtifactTrustState, type RootBootstrapResult, type RootTransitionResult, type ArtifactTrustPolicySettings, type TrustedChannelState, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/api/index.js

@@ -10,4 +10,10 @@ export * from '../resources/index.js';
 export * from '../sessions/index.js';
 export * from '../memory/index.js';
 export * from '../security/threat-assessment-config.js';
+export * from '../security/artifact-verifier.js';
+export * from '../security/artifact-attestation.js';
+export * from '../providers/transformation-receipt.js';
+export * from '../providers/transformation-receipt-integration.js';
+export * from '../marketplace/artifact-attestation.js';
+export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.js.map

package/dist/src/artifacts/fortemi-core-sync.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
 import { GRAPH_CONFIGS, getProjectIndexRoot, loadGlobalGraphConfigs } from "./types.js";
 import { buildAiwgFortemiIndexExport, } from "./browser-export.js";
 import { loadGraphIndexFile } from "./index-reader.js";
@@ -25,7 +26,7 @@ function findPackageRoot(startDir) {
     }
 }
 function prebuiltDir(graph) {
-    const moduleDir = path.dirname(new URL(import.meta.url).pathname);
+    const moduleDir = path.dirname(fileURLToPath(import.meta.url));
     const packageRoot = findPackageRoot(moduleDir);
     if (!packageRoot)
         return null;
@@ -215,17 +216,31 @@ export function getFortemiCorePrebuiltStatus(graph = "framework") {
             reason: manifestReadReason,
         };
     }
+    const prebuiltManifest = manifest;
     const exportExists = fs.existsSync(exportPath);
     let reason = null;
     if (exportExists) {
         try {
             const exportText = fs.readFileSync(exportPath, "utf-8");
             const exported = JSON.parse(exportText);
-            if (sha256(exportText) !== manifest.export_checksum) {
+            if (prebuiltManifest.schema_version !== "aiwg.fortemi.prebuilt.v1" ||
+                prebuiltManifest.backend !== "fortemi-core" ||
+                prebuiltManifest.graph !== graph ||
+                prebuiltManifest.export_path !== "aiwg-fortemi-index-v2.json" ||
+                prebuiltManifest.export_schema_version !== "aiwg.fortemi.index.export.v2") {
+                reason = "prebuilt manifest is incompatible with the requested graph";
+            }
+            else if (sha256(exportText) !== prebuiltManifest.export_checksum) {
                 reason = "prebuilt export checksum does not match manifest";
             }
-            else if (exported.schema_version !== manifest.export_schema_version) {
-                reason = `prebuilt export schema '${exported.schema_version}' does not match manifest '${manifest.export_schema_version}'`;
+            else if (exported.schema_version !== prebuiltManifest.export_schema_version) {
+                reason = `prebuilt export schema '${exported.schema_version}' does not match manifest '${prebuiltManifest.export_schema_version}'`;
+            }
+            else if (exported.source?.graph !== graph) {
+                reason = `prebuilt export graph '${exported.source?.graph ?? "unknown"}' does not match requested graph '${graph}'`;
+            }
+            else if (!Array.isArray(exported.items) || exported.items.length !== prebuiltManifest.item_count) {
+                reason = "prebuilt export item count does not match manifest";
             }
         }
         catch (err) {
@@ -241,10 +256,10 @@ export function getFortemiCorePrebuiltStatus(graph = "framework") {
         exportPath,
         built: exportExists,
         stale: !exportExists || reason !== null,
-        itemCount: manifest.item_count,
-        exportChecksum: manifest.export_checksum,
-        generatedAt: manifest.generated_at,
-        sourceIndexBuiltAt: manifest.source_index_built_at,
+        itemCount: prebuiltManifest.item_count,
+        exportChecksum: prebuiltManifest.export_checksum,
+        generatedAt: prebuiltManifest.generated_at,
+        sourceIndexBuiltAt: prebuiltManifest.source_index_built_at,
         reason: !exportExists ? "prebuilt manifest exists but export file is missing" : reason,
     };
 }

package/dist/src/cli/handlers/artifact-verify.js

@@ -0,0 +1,171 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { bootstrapTrustRoot, parseTrustState, verifyRootTransition, writeTrustState, } from '../../security/artifact-trust.js';
+import { verifyArtifact } from '../../security/artifact-verifier.js';
+const MAX_BYTES = 32 * 1024 * 1024;
+const DEFAULT_STATE = '.aiwg/security/artifact-trust-state.json';
+function usage() {
+    return [
+        'aiwg verify — Verify cross-asset provenance using explicit trust policy',
+        '',
+        'Usage:',
+        '  aiwg verify <artifact> --attestation <file-or-https-url> --policy <root.json>',
+        '      [--state <file>] [--root-fingerprint <sha256>] [--material <uri>=<file>]...',
+        '      [--asset-type <type> --namespace <name> --channel <name>]',
+        '      [--offline] [--json] [--allow-policy-exempt] [--no-write-state]',
+        '  aiwg verify trust bootstrap --root <file> --fingerprint <sha256> [--state <file>]',
+        '  aiwg verify trust update --current <file> --next <file> [--state <file>]',
+        '  aiwg verify trust status [--state <file>] [--json]',
+        '',
+        'Trust is never inferred from DSSE keyid or embedded outer public keys.',
+    ].join('\n');
+}
+function valueAfter(args, flag) {
+    const index = args.indexOf(flag);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function resolve(cwd, file) {
+    return path.isAbsolute(file) ? file : path.resolve(cwd, file);
+}
+function checkedRead(file) {
+    const bytes = readFileSync(file);
+    if (bytes.length > MAX_BYTES)
+        throw new Error(`${file} exceeds the ${MAX_BYTES}-byte safety limit`);
+    return bytes;
+}
+async function readLocation(location, cwd, offline, signal) {
+    if (!/^https?:\/\//i.test(location))
+        return checkedRead(resolve(cwd, location));
+    if (offline)
+        throw new Error('offline mode forbids network locations');
+    if (!location.startsWith('https://'))
+        throw new Error('remote verification inputs must use HTTPS');
+    const response = await fetch(location, { redirect: 'follow', signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000) });
+    if (!response.ok || !response.url.startsWith('https://'))
+        throw new Error(`HTTPS input failed closed (${response.status})`);
+    const contentLength = Number(response.headers.get('content-length') ?? 0);
+    if (contentLength > MAX_BYTES)
+        throw new Error('remote input exceeds the safety limit');
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.length > MAX_BYTES)
+        throw new Error('remote input exceeds the safety limit');
+    return bytes;
+}
+function renderHuman(outcome) {
+    return [
+        `${outcome.status}: ${outcome.artifact.name}`,
+        `  SHA-256: ${outcome.artifact.sha256}`,
+        `  Policy: ${outcome.policy ?? 'unavailable'}`,
+        `  Identities: ${outcome.identities.join(', ') || 'none'}`,
+        `  Root version: ${outcome.rootVersion ?? 'unavailable'}`,
+        ...outcome.diagnostics.map(diagnostic => `  ${diagnostic.code}: ${diagnostic.message}`),
+    ].join('\n');
+}
+async function trustCommand(ctx) {
+    const action = ctx.args[1];
+    const stateFile = resolve(ctx.cwd, valueAfter(ctx.args, '--state') ?? DEFAULT_STATE);
+    if (action === 'status') {
+        if (!existsSync(stateFile))
+            return { exitCode: 1, message: `Trust state not found: ${stateFile}` };
+        const state = parseTrustState(checkedRead(stateFile));
+        return {
+            exitCode: 0,
+            message: ctx.args.includes('--json') ? JSON.stringify(state, null, 2) : `Root v${state.rootVersion} ${state.rootSha256}\nTrusted time: ${state.trustedTime}\nChannels: ${Object.keys(state.channels).length}`,
+            rawOutput: ctx.args.includes('--json'),
+        };
+    }
+    if (action === 'bootstrap') {
+        const rootFile = valueAfter(ctx.args, '--root');
+        const fingerprint = valueAfter(ctx.args, '--fingerprint');
+        if (!rootFile || !fingerprint)
+            return { exitCode: 1, message: 'trust bootstrap requires --root and --fingerprint' };
+        const bootstrapped = bootstrapTrustRoot(checkedRead(resolve(ctx.cwd, rootFile)), fingerprint);
+        writeTrustState(stateFile, bootstrapped.state);
+        return { exitCode: 0, message: `Bootstrapped trust root v${bootstrapped.root.signed.version} at ${stateFile}` };
+    }
+    if (action === 'update') {
+        const current = valueAfter(ctx.args, '--current');
+        const next = valueAfter(ctx.args, '--next');
+        if (!current || !next)
+            return { exitCode: 1, message: 'trust update requires --current and --next' };
+        if (!existsSync(stateFile))
+            return { exitCode: 1, message: `Trust state not found: ${stateFile}` };
+        const transition = verifyRootTransition(checkedRead(resolve(ctx.cwd, current)), checkedRead(resolve(ctx.cwd, next)), parseTrustState(checkedRead(stateFile)));
+        writeTrustState(stateFile, transition.state);
+        return { exitCode: 0, message: `Updated trust root to v${transition.state.rootVersion} at ${stateFile}` };
+    }
+    return { exitCode: 1, message: usage() };
+}
+export const artifactVerifyHandler = {
+    id: 'verify',
+    name: 'Artifact Verification',
+    description: 'Verify cross-asset DSSE provenance and manage trust roots',
+    category: 'utility',
+    aliases: [],
+    async execute(ctx) {
+        if (ctx.args.includes('--help') || ctx.args.includes('-h') || ctx.args.length === 0)
+            return { exitCode: 0, message: usage() };
+        try {
+            if (ctx.args[0] === 'trust')
+                return await trustCommand(ctx);
+            const artifactLocation = ctx.args[0];
+            const rootFile = valueAfter(ctx.args, '--policy');
+            if (!rootFile)
+                return { exitCode: 1, message: `--policy <root.json> is required\n\n${usage()}` };
+            const offline = ctx.args.includes('--offline');
+            const attestationLocation = valueAfter(ctx.args, '--attestation') ?? `${artifactLocation}.aiwg-attestation.json`;
+            const [artifactBytes, attestationBytes] = await Promise.all([
+                readLocation(artifactLocation, ctx.cwd, offline, ctx.signal),
+                readLocation(attestationLocation, ctx.cwd, offline, ctx.signal),
+            ]);
+            const rootBytes = checkedRead(resolve(ctx.cwd, rootFile));
+            const stateFile = resolve(ctx.cwd, valueAfter(ctx.args, '--state') ?? DEFAULT_STATE);
+            let state = existsSync(stateFile) ? parseTrustState(checkedRead(stateFile)) : undefined;
+            if (!state && !offline) {
+                const fingerprint = valueAfter(ctx.args, '--root-fingerprint');
+                if (fingerprint)
+                    state = bootstrapTrustRoot(rootBytes, fingerprint).state;
+            }
+            const materials = new Map();
+            for (let index = 0; index < ctx.args.length; index += 1) {
+                if (ctx.args[index] !== '--material')
+                    continue;
+                const spec = ctx.args[index + 1] ?? '';
+                const separator = spec.lastIndexOf('=');
+                if (separator <= 0)
+                    throw new Error('--material must use <uri>=<file>');
+                materials.set(spec.slice(0, separator), checkedRead(resolve(ctx.cwd, spec.slice(separator + 1))));
+            }
+            const outcome = await verifyArtifact({
+                artifactBytes,
+                artifactName: /^https:\/\//.test(artifactLocation) ? new URL(artifactLocation).pathname.split('/').pop() ?? artifactLocation : path.basename(artifactLocation),
+                attestation: JSON.parse(attestationBytes.toString('utf8')),
+                rootBytes,
+                state,
+                materials,
+                ...(valueAfter(ctx.args, '--asset-type') && valueAfter(ctx.args, '--namespace') && valueAfter(ctx.args, '--channel')
+                    ? { expectedScope: {
+                            assetType: valueAfter(ctx.args, '--asset-type'),
+                            namespace: valueAfter(ctx.args, '--namespace'),
+                            channel: valueAfter(ctx.args, '--channel'),
+                        } }
+                    : {}),
+                offline,
+            });
+            if (outcome.status === 'verified' && outcome.nextState && !ctx.args.includes('--no-write-state'))
+                writeTrustState(stateFile, outcome.nextState);
+            const json = ctx.args.includes('--json');
+            const processExit = outcome.status === 'policy-exempt' && ctx.args.includes('--allow-policy-exempt') ? 0 : outcome.exitCode;
+            return { exitCode: processExit, message: json ? JSON.stringify(outcome, null, 2) : renderHuman(outcome), rawOutput: json };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return { exitCode: 27, message: ctx.args.includes('--json') ? JSON.stringify({
+                    schemaVersion: 'aiwg.verify.result.v1', status: 'malformed', exitCode: 27,
+                    artifact: { name: ctx.args[0] ? path.basename(ctx.args[0]) : 'unknown', sha256: '0'.repeat(64) },
+                    identities: [], diagnostics: [{ code: 'CLI_INPUT_ERROR', message }],
+                }, null, 2) : `malformed: ${message}`, rawOutput: ctx.args.includes('--json') };
+        }
+    },
+};
+//# sourceMappingURL=artifact-verify.js.map

package/dist/src/cli/handlers/index.js

@@ -61,12 +61,13 @@ import { versionsHandler } from './resource-versions.js';
 import { jobHandler } from './job.js';
 import { costReportHandler } from './cost-report.js';
 import { evidenceHandler } from './evidence.js';
+import { artifactVerifyHandler } from './artifact-verify.js';
 // Re-export individual handlers
 export { 
 // Maintenance
 helpHandler, versionHandler, authHandler, doctorHandler, contextFirewallHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -148,6 +149,7 @@ export const allHandlers = [
     jobHandler,
     costReportHandler,
     evidenceHandler,
+    artifactVerifyHandler,
     // Workspace management
     ...workspaceHandlers,
     // Subcommand handlers (MCP, catalog, index, skills)

package/dist/src/cli/handlers/refresh.js

@@ -15,6 +15,7 @@
 import { promises as fs } from 'fs';
 import path from 'path';
 import { createScriptRunner } from './script-runner.js';
+import { createUseHandler } from './use.js';
 import { getFrameworkRoot } from '../../channel/manager.mjs';
 import { refreshAllPackages } from '../../packages/registry.js';
 import { resolveActiveProvider } from '../provider-resolution.js';
@@ -97,7 +98,14 @@ export async function pruneStaleManagedAgentFiles(options) {
                 continue;
             const artifactName = normalizeAgentArtifactName(entry.name);
             const missingFromCurrentPackage = !desired.has(artifactName);
-            const fromOlderPackage = currentVersion !== null && isOlderManagedVersion(marker.version, currentVersion);
+            // Addons have independent manifest versions. Comparing their managed
+            // marker to the top-level package version makes a successful refresh
+            // delete freshly restored addon agents. Version-based cleanup remains
+            // valid for other provider trees that were not refreshed, while the
+            // active provider removes only artifacts absent from current sources.
+            const fromOlderPackage = provider !== options.provider
+                && currentVersion !== null
+                && isOlderManagedVersion(marker.version, currentVersion);
             if (!missingFromCurrentPackage && !fromOlderPackage)
                 continue;
             const relFile = path.relative(options.projectRoot, file);
@@ -163,6 +171,7 @@ export const refreshHandler = {
         const modelDeployArgs = collectModelDeployArgs(ctx.args);
         const frameworkRoot = await getFrameworkRoot();
         const runner = createScriptRunner(frameworkRoot);
+        const activeUseHandler = createUseHandler();
         if (!quiet) {
             ui.blank();
             // Deprecation notice when invoked as 'sync'
@@ -195,6 +204,7 @@ export const refreshHandler = {
         // Step 2.5: Refresh remote packages (always, unless --packages-only skips npm)
         if (!quiet)
             ui.info(dryRun ? 'Would refresh remote packages...' : 'Refreshing remote packages...');
+        const deploymentFailures = [];
         if (!dryRun) {
             try {
                 const refreshed = await refreshAllPackages();
@@ -259,13 +269,30 @@ export const refreshHandler = {
                 ui.dim('  No installed frameworks or addons to re-deploy');
             }
             for (const fw of frameworks) {
-                const providerArgs = ['--provider', detectedProvider, ...modelDeployArgs];
-                const useResult = await runner.run('tools/cli/deploy.mjs', [fw, ...providerArgs], { capture: quiet });
+                // Invoke the active installation's handler directly. The historical
+                // deploy.mjs bridge shells out to the first `aiwg` on PATH, which can
+                // be a different version/root and therefore cannot safely refresh
+                // addons installed by this package (#143/#2102).
+                const useResult = await activeUseHandler.execute({
+                    ...ctx,
+                    cwd: ctx.cwd,
+                    frameworkRoot,
+                    args: [
+                        fw,
+                        '--provider', detectedProvider,
+                        '--target', ctx.cwd,
+                        '--yes',
+                        '--json',
+                        ...modelDeployArgs,
+                    ],
+                    rawArgs: ['use', fw],
+                });
                 if (useResult.exitCode === 0) {
                     if (!quiet)
                         ui.success(`Deployed: ${fw}`);
                 }
                 else {
+                    deploymentFailures.push(fw);
                     if (!quiet)
                         ui.warn(`Deploy issue: ${fw} (exit ${useResult.exitCode})`);
                 }
@@ -281,11 +308,10 @@ export const refreshHandler = {
             }
         }
         // Step 4.25: Report planned project-local deploys (#1035).
-        // The actual deploy is performed by `aiwg use` underneath via deploy.mjs;
-        // this block surfaces what *would* happen during dry-run and what was
-        // covered during a real refresh.
+        // The active use handler performs the actual project-local deploy during
+        // framework refresh; this block surfaces dry-run and completion details.
         try {
-            const plDiscovery = await discoverProjectLocalBundles(process.cwd());
+            const plDiscovery = await discoverProjectLocalBundles(ctx.cwd);
             const plCount = plDiscovery.bundles.length;
             if (plCount > 0) {
                 if (dryRun) {
@@ -312,11 +338,12 @@ export const refreshHandler = {
         if (!quiet)
             ui.info('Checking for stale deployments...');
         let staleAgentRemovals = [];
-        if (!dryRun) {
+        if (!dryRun && deploymentFailures.length === 0) {
             try {
                 staleAgentRemovals = await pruneStaleManagedAgentFiles({
                     projectRoot: ctx.cwd,
                     frameworkRoot,
+                    provider: detectedProvider,
                 });
                 if (staleAgentRemovals.length > 0 && !quiet) {
                     const total = staleAgentRemovals.reduce((sum, item) => sum + item.paths.length, 0);
@@ -435,10 +462,17 @@ export const refreshHandler = {
                 skipUpdate,
                 channel: channel || undefined,
                 staleAgentRemovals,
+                deploymentFailures,
             });
             console.log(output);
         }
-        return { exitCode: dryRun ? 0 : 0 };
+        if (deploymentFailures.length > 0) {
+            return {
+                exitCode: 1,
+                message: `Failed to re-deploy installed bundle(s): ${deploymentFailures.join(', ')}`,
+            };
+        }
+        return { exitCode: 0 };
     },
 };
 //# sourceMappingURL=refresh.js.map

package/dist/src/cli/handlers/setup-manifest.js

@@ -4,6 +4,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { parseDocument, stringify } from 'yaml';
 import { findPackageRoot } from '../find-package-root.js';
+import { sha256 } from '../../security/artifact-trust.js';
+import { artifactVerifyHandler } from './artifact-verify.js';
 const SETUP_SCHEMA_REL = 'agentic/code/addons/agentic-installer/schemas/v1/setup-manifest.schema.json';
 const GENERATE_HELP = `aiwg setup-generate - generate a starter setup.aiwg.io/v1 SetupManifest
 
@@ -40,7 +42,8 @@ Usage:
   aiwg setup-run [manifest-path] [--manifest PATH] [--dry-run] [--platform OS]
                  [--distro NAME] [--params-file PATH] [--param KEY=VALUE]
                  [--step STEP_ID] [--skip A,B] [--type user|developer|ci]
-                 [--yes|--confirm]
+                 [--yes|--confirm] [--attestation PATH] [--policy ROOT]
+                 [--state PATH] [--offline]
 
 Options:
   --manifest PATH      Manifest path. Defaults to ./setup.manifest.yaml.
@@ -53,11 +56,17 @@ Options:
   --skip A,B           Comma-separated step IDs to skip.
   --type TYPE          Select default manifest by install type when no path is given.
   --yes, --confirm     Explicitly authorize mutating step execution and recovery.
+  --attestation PATH   Adjacent AIWG attestation for provider-orchestrated handoff.
+  --policy ROOT        Explicit cross-asset trust root; required for agent handoff.
+  --state PATH         Persisted trust/freshness state used by verification.
+  --offline            Forbid network retrieval and require portable evidence.
   --help, -h           Show this help.
 
 Safety:
   setup-run always runs setup-validate before platform detection or execution.
   Mutating execution refuses to run without explicit confirmation.
+  Provider-orchestrated manifests are never handed to an agent unless their
+  exact bytes have status verified under the explicit trust policy.
 `;
 function flagValue(args, name) {
     for (let i = 0; i < args.length; i += 1) {
@@ -85,6 +94,12 @@ function positionalManifest(args) {
         '--type',
         '--output',
         '--name',
+        '--attestation',
+        '--policy',
+        '--state',
+        '--asset-type',
+        '--namespace',
+        '--channel',
     ]);
     for (let i = 0; i < args.length; i += 1) {
         const arg = args[i];
@@ -689,9 +704,17 @@ export function runSetupManifest(options) {
     }
     const manifest = validation.manifest;
     if (manifest.metadata.execution_mode === 'provider-orchestrated') {
+        const expectedDigest = sha256(readFileSync(validation.manifestPath));
+        if (options.artifactVerification?.status !== 'verified'
+            || options.artifactVerification.artifact.sha256 !== expectedDigest) {
+            return {
+                exitCode: 29,
+                message: 'setup-run: provider-orchestrated handoff blocked; verify these exact manifest bytes with an explicit trust root and adjacent attestation first',
+            };
+        }
         return {
             exitCode: 2,
-            message: 'setup-run: this manifest is provider-orchestrated; give its URL or contents to a supported AI provider instead of executing it as a deterministic CLI manifest',
+            message: `setup-run: verified provider-orchestrated manifest (${options.artifactVerification.artifact.sha256}); give these exact contents to a supported AI provider instead of executing them as a deterministic CLI manifest`,
         };
     }
     const target = detectPlatform(options);
@@ -801,7 +824,33 @@ export const setupRunHandler = {
             process.stdout.write(RUN_HELP);
             return { exitCode: 0 };
         }
-        return runSetupManifest(parseRunOptions(ctx));
+        const options = parseRunOptions(ctx);
+        const manifestPath = options.manifestPath ?? 'setup.manifest.yaml';
+        let artifactVerification;
+        if (flagValue(ctx.args, '--policy')) {
+            const verificationArgs = [
+                manifestPath,
+                '--attestation', flagValue(ctx.args, '--attestation') ?? `${manifestPath}.aiwg-attestation.json`,
+                '--policy', flagValue(ctx.args, '--policy'),
+                '--asset-type', flagValue(ctx.args, '--asset-type') ?? 'setup-manifest',
+                '--namespace', flagValue(ctx.args, '--namespace') ?? 'aiwg',
+                '--channel', flagValue(ctx.args, '--channel') ?? 'stable',
+                '--json',
+                ...(flagValue(ctx.args, '--state') ? ['--state', flagValue(ctx.args, '--state')] : []),
+                ...(hasFlag(ctx.args, '--offline') ? ['--offline'] : []),
+            ];
+            const verification = await artifactVerifyHandler.execute({ ...ctx, args: verificationArgs, rawArgs: verificationArgs });
+            try {
+                artifactVerification = JSON.parse(verification.message ?? '');
+            }
+            catch {
+                return { exitCode: verification.exitCode || 27, message: `setup-run: artifact verification failed: ${verification.message ?? 'invalid verifier output'}` };
+            }
+            if (artifactVerification.status !== 'verified') {
+                return { exitCode: artifactVerification.exitCode, message: `setup-run: provider handoff blocked by artifact verification status '${artifactVerification.status}'` };
+            }
+        }
+        return runSetupManifest({ ...options, artifactVerification });
     },
 };
 //# sourceMappingURL=setup-manifest.js.map

package/dist/src/cli/handlers/setup.js

@@ -153,6 +153,13 @@ function secondaryRemotes(remotes, primary, issueTracker, ci) {
         push_on_release: false,
     }));
 }
+function normalizeForcePushPolicy(value, warnings) {
+    if (value === 'main-only-blocked') {
+        warnings.push('delivery.force_push_policy=main-only-blocked is a legacy alias; setup normalized it to own-branch-only.');
+        return 'own-branch-only';
+    }
+    return value;
+}
 function cloneConfig(config) {
     return JSON.parse(JSON.stringify(config));
 }
@@ -191,6 +198,9 @@ function validateSetupConfig(config, remotes, issueProvider) {
     else {
         checkRemote('remotes.issue_tracker', config.remotes?.issue_tracker);
     }
+    if (config.remotes?.issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.issue_provider)) {
+        errors.push('remotes.issue_provider is invalid');
+    }
     checkRemote('remotes.ci', config.remotes?.ci);
     if (!DELIVERY_MODES.includes(config.delivery?.mode))
         errors.push('delivery.mode is invalid');
@@ -222,6 +232,7 @@ export async function buildSetupProjectPlan(options) {
     const primaryRemote = remotes.find(r => r.name === primary);
     const hasLocalIssues = existsSync(projectAiwgPath(options.projectDir, 'issues', 'config.json'));
     const issueProvider = options.issueProvider ?? chooseIssueProvider(primaryRemote, hasLocalIssues);
+    const warnings = [];
     const issueTracker = issueProvider === 'local'
         ? 'local'
         : options.issueTracker ?? base.remotes?.issue_tracker ?? primary;
@@ -229,6 +240,7 @@ export async function buildSetupProjectPlan(options) {
     const remotesConfig = {
         primary,
         issue_tracker: issueTracker,
+        issue_provider: issueProvider,
         ci,
         secondary: base.remotes?.secondary ?? secondaryRemotes(remotes, primary, issueTracker, ci),
     };
@@ -249,9 +261,11 @@ export async function buildSetupProjectPlan(options) {
         require_ci_green: options.requireCiGreen ?? existingDelivery.require_ci_green ?? true,
         auto_close_issues: options.autoCloseIssues ?? existingDelivery.auto_close_issues ?? true,
         issue_comment_on_cycle: options.issueCommentOnCycle ?? existingDelivery.issue_comment_on_cycle ?? true,
-        force_push_policy: options.forcePushPolicy ?? existingDelivery.force_push_policy ?? 'never',
         require_signed_commits: options.requireSignedCommits ?? existingDelivery.require_signed_commits ?? false,
     };
+    delivery.force_push_policy = (options.forcePushPolicy
+        ?? normalizeForcePushPolicy(existingDelivery.force_push_policy, warnings)
+        ?? 'never');
     const committerName = options.committerName ?? existingDelivery.committer?.name ?? gitConfig(options.projectDir, 'user.name');
     const committerEmail = options.committerEmail ?? existingDelivery.committer?.email ?? gitConfig(options.projectDir, 'user.email');
     if (committerName || committerEmail) {
@@ -273,7 +287,6 @@ export async function buildSetupProjectPlan(options) {
     }
     base.remotes = remotesConfig;
     base.delivery = delivery;
-    const warnings = [];
     if (primaryRemote?.provider === 'unknown' && issueProvider !== 'local') {
         warnings.push(`Remote '${primary}' is self-hosted or unknown; provider '${issueProvider}' was selected explicitly/defaulted.`);
     }