@aiwg/cli 2026.8.11 → 2026.8.13

package/bin/aiwg.mjs

@@ -124,6 +124,8 @@ const FAST_HELP_TEXT = `
 
   VALIDATION
     validate-metadata [path]     Validate AIWG component metadata (defaults to agentic/code)
+    verify <artifact>            Verify DSSE provenance using an explicit versioned trust root
+    verify trust <action>        Bootstrap, update, or inspect artifact trust state
     context-firewall [scan]      Audit provider context, trust, drift, poisoning signals, and budget
     context-firewall baseline    Plan or explicitly write the reviewed context baseline
 

package/dist/src/api/index.d.ts

@@ -10,4 +10,10 @@ export * from '../resources/index.js';
 export * from '../sessions/index.js';
 export * from '../memory/index.js';
 export * from '../security/threat-assessment-config.js';
+export * from '../security/artifact-verifier.js';
+export * from '../security/artifact-attestation.js';
+export * from '../providers/transformation-receipt.js';
+export * from '../providers/transformation-receipt-integration.js';
+export * from '../marketplace/artifact-attestation.js';
+export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, type ArtifactTrustRoot, type ArtifactTrustState, type RootBootstrapResult, type RootTransitionResult, type ArtifactTrustPolicySettings, type TrustedChannelState, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/api/index.js

@@ -10,4 +10,10 @@ export * from '../resources/index.js';
 export * from '../sessions/index.js';
 export * from '../memory/index.js';
 export * from '../security/threat-assessment-config.js';
+export * from '../security/artifact-verifier.js';
+export * from '../security/artifact-attestation.js';
+export * from '../providers/transformation-receipt.js';
+export * from '../providers/transformation-receipt-integration.js';
+export * from '../marketplace/artifact-attestation.js';
+export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.js.map

package/dist/src/cli/handlers/artifact-verify.js

@@ -0,0 +1,171 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { bootstrapTrustRoot, parseTrustState, verifyRootTransition, writeTrustState, } from '../../security/artifact-trust.js';
+import { verifyArtifact } from '../../security/artifact-verifier.js';
+const MAX_BYTES = 32 * 1024 * 1024;
+const DEFAULT_STATE = '.aiwg/security/artifact-trust-state.json';
+function usage() {
+    return [
+        'aiwg verify — Verify cross-asset provenance using explicit trust policy',
+        '',
+        'Usage:',
+        '  aiwg verify <artifact> --attestation <file-or-https-url> --policy <root.json>',
+        '      [--state <file>] [--root-fingerprint <sha256>] [--material <uri>=<file>]...',
+        '      [--asset-type <type> --namespace <name> --channel <name>]',
+        '      [--offline] [--json] [--allow-policy-exempt] [--no-write-state]',
+        '  aiwg verify trust bootstrap --root <file> --fingerprint <sha256> [--state <file>]',
+        '  aiwg verify trust update --current <file> --next <file> [--state <file>]',
+        '  aiwg verify trust status [--state <file>] [--json]',
+        '',
+        'Trust is never inferred from DSSE keyid or embedded outer public keys.',
+    ].join('\n');
+}
+function valueAfter(args, flag) {
+    const index = args.indexOf(flag);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function resolve(cwd, file) {
+    return path.isAbsolute(file) ? file : path.resolve(cwd, file);
+}
+function checkedRead(file) {
+    const bytes = readFileSync(file);
+    if (bytes.length > MAX_BYTES)
+        throw new Error(`${file} exceeds the ${MAX_BYTES}-byte safety limit`);
+    return bytes;
+}
+async function readLocation(location, cwd, offline, signal) {
+    if (!/^https?:\/\//i.test(location))
+        return checkedRead(resolve(cwd, location));
+    if (offline)
+        throw new Error('offline mode forbids network locations');
+    if (!location.startsWith('https://'))
+        throw new Error('remote verification inputs must use HTTPS');
+    const response = await fetch(location, { redirect: 'follow', signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000) });
+    if (!response.ok || !response.url.startsWith('https://'))
+        throw new Error(`HTTPS input failed closed (${response.status})`);
+    const contentLength = Number(response.headers.get('content-length') ?? 0);
+    if (contentLength > MAX_BYTES)
+        throw new Error('remote input exceeds the safety limit');
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.length > MAX_BYTES)
+        throw new Error('remote input exceeds the safety limit');
+    return bytes;
+}
+function renderHuman(outcome) {
+    return [
+        `${outcome.status}: ${outcome.artifact.name}`,
+        `  SHA-256: ${outcome.artifact.sha256}`,
+        `  Policy: ${outcome.policy ?? 'unavailable'}`,
+        `  Identities: ${outcome.identities.join(', ') || 'none'}`,
+        `  Root version: ${outcome.rootVersion ?? 'unavailable'}`,
+        ...outcome.diagnostics.map(diagnostic => `  ${diagnostic.code}: ${diagnostic.message}`),
+    ].join('\n');
+}
+async function trustCommand(ctx) {
+    const action = ctx.args[1];
+    const stateFile = resolve(ctx.cwd, valueAfter(ctx.args, '--state') ?? DEFAULT_STATE);
+    if (action === 'status') {
+        if (!existsSync(stateFile))
+            return { exitCode: 1, message: `Trust state not found: ${stateFile}` };
+        const state = parseTrustState(checkedRead(stateFile));
+        return {
+            exitCode: 0,
+            message: ctx.args.includes('--json') ? JSON.stringify(state, null, 2) : `Root v${state.rootVersion} ${state.rootSha256}\nTrusted time: ${state.trustedTime}\nChannels: ${Object.keys(state.channels).length}`,
+            rawOutput: ctx.args.includes('--json'),
+        };
+    }
+    if (action === 'bootstrap') {
+        const rootFile = valueAfter(ctx.args, '--root');
+        const fingerprint = valueAfter(ctx.args, '--fingerprint');
+        if (!rootFile || !fingerprint)
+            return { exitCode: 1, message: 'trust bootstrap requires --root and --fingerprint' };
+        const bootstrapped = bootstrapTrustRoot(checkedRead(resolve(ctx.cwd, rootFile)), fingerprint);
+        writeTrustState(stateFile, bootstrapped.state);
+        return { exitCode: 0, message: `Bootstrapped trust root v${bootstrapped.root.signed.version} at ${stateFile}` };
+    }
+    if (action === 'update') {
+        const current = valueAfter(ctx.args, '--current');
+        const next = valueAfter(ctx.args, '--next');
+        if (!current || !next)
+            return { exitCode: 1, message: 'trust update requires --current and --next' };
+        if (!existsSync(stateFile))
+            return { exitCode: 1, message: `Trust state not found: ${stateFile}` };
+        const transition = verifyRootTransition(checkedRead(resolve(ctx.cwd, current)), checkedRead(resolve(ctx.cwd, next)), parseTrustState(checkedRead(stateFile)));
+        writeTrustState(stateFile, transition.state);
+        return { exitCode: 0, message: `Updated trust root to v${transition.state.rootVersion} at ${stateFile}` };
+    }
+    return { exitCode: 1, message: usage() };
+}
+export const artifactVerifyHandler = {
+    id: 'verify',
+    name: 'Artifact Verification',
+    description: 'Verify cross-asset DSSE provenance and manage trust roots',
+    category: 'utility',
+    aliases: [],
+    async execute(ctx) {
+        if (ctx.args.includes('--help') || ctx.args.includes('-h') || ctx.args.length === 0)
+            return { exitCode: 0, message: usage() };
+        try {
+            if (ctx.args[0] === 'trust')
+                return await trustCommand(ctx);
+            const artifactLocation = ctx.args[0];
+            const rootFile = valueAfter(ctx.args, '--policy');
+            if (!rootFile)
+                return { exitCode: 1, message: `--policy <root.json> is required\n\n${usage()}` };
+            const offline = ctx.args.includes('--offline');
+            const attestationLocation = valueAfter(ctx.args, '--attestation') ?? `${artifactLocation}.aiwg-attestation.json`;
+            const [artifactBytes, attestationBytes] = await Promise.all([
+                readLocation(artifactLocation, ctx.cwd, offline, ctx.signal),
+                readLocation(attestationLocation, ctx.cwd, offline, ctx.signal),
+            ]);
+            const rootBytes = checkedRead(resolve(ctx.cwd, rootFile));
+            const stateFile = resolve(ctx.cwd, valueAfter(ctx.args, '--state') ?? DEFAULT_STATE);
+            let state = existsSync(stateFile) ? parseTrustState(checkedRead(stateFile)) : undefined;
+            if (!state && !offline) {
+                const fingerprint = valueAfter(ctx.args, '--root-fingerprint');
+                if (fingerprint)
+                    state = bootstrapTrustRoot(rootBytes, fingerprint).state;
+            }
+            const materials = new Map();
+            for (let index = 0; index < ctx.args.length; index += 1) {
+                if (ctx.args[index] !== '--material')
+                    continue;
+                const spec = ctx.args[index + 1] ?? '';
+                const separator = spec.lastIndexOf('=');
+                if (separator <= 0)
+                    throw new Error('--material must use <uri>=<file>');
+                materials.set(spec.slice(0, separator), checkedRead(resolve(ctx.cwd, spec.slice(separator + 1))));
+            }
+            const outcome = await verifyArtifact({
+                artifactBytes,
+                artifactName: /^https:\/\//.test(artifactLocation) ? new URL(artifactLocation).pathname.split('/').pop() ?? artifactLocation : path.basename(artifactLocation),
+                attestation: JSON.parse(attestationBytes.toString('utf8')),
+                rootBytes,
+                state,
+                materials,
+                ...(valueAfter(ctx.args, '--asset-type') && valueAfter(ctx.args, '--namespace') && valueAfter(ctx.args, '--channel')
+                    ? { expectedScope: {
+                            assetType: valueAfter(ctx.args, '--asset-type'),
+                            namespace: valueAfter(ctx.args, '--namespace'),
+                            channel: valueAfter(ctx.args, '--channel'),
+                        } }
+                    : {}),
+                offline,
+            });
+            if (outcome.status === 'verified' && outcome.nextState && !ctx.args.includes('--no-write-state'))
+                writeTrustState(stateFile, outcome.nextState);
+            const json = ctx.args.includes('--json');
+            const processExit = outcome.status === 'policy-exempt' && ctx.args.includes('--allow-policy-exempt') ? 0 : outcome.exitCode;
+            return { exitCode: processExit, message: json ? JSON.stringify(outcome, null, 2) : renderHuman(outcome), rawOutput: json };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return { exitCode: 27, message: ctx.args.includes('--json') ? JSON.stringify({
+                    schemaVersion: 'aiwg.verify.result.v1', status: 'malformed', exitCode: 27,
+                    artifact: { name: ctx.args[0] ? path.basename(ctx.args[0]) : 'unknown', sha256: '0'.repeat(64) },
+                    identities: [], diagnostics: [{ code: 'CLI_INPUT_ERROR', message }],
+                }, null, 2) : `malformed: ${message}`, rawOutput: ctx.args.includes('--json') };
+        }
+    },
+};
+//# sourceMappingURL=artifact-verify.js.map

package/dist/src/cli/handlers/index.js

@@ -61,12 +61,13 @@ import { versionsHandler } from './resource-versions.js';
 import { jobHandler } from './job.js';
 import { costReportHandler } from './cost-report.js';
 import { evidenceHandler } from './evidence.js';
+import { artifactVerifyHandler } from './artifact-verify.js';
 // Re-export individual handlers
 export { 
 // Maintenance
 helpHandler, versionHandler, authHandler, doctorHandler, contextFirewallHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -148,6 +149,7 @@ export const allHandlers = [
     jobHandler,
     costReportHandler,
     evidenceHandler,
+    artifactVerifyHandler,
     // Workspace management
     ...workspaceHandlers,
     // Subcommand handlers (MCP, catalog, index, skills)

package/dist/src/cli/handlers/setup-manifest.js

@@ -4,6 +4,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { parseDocument, stringify } from 'yaml';
 import { findPackageRoot } from '../find-package-root.js';
+import { sha256 } from '../../security/artifact-trust.js';
+import { artifactVerifyHandler } from './artifact-verify.js';
 const SETUP_SCHEMA_REL = 'agentic/code/addons/agentic-installer/schemas/v1/setup-manifest.schema.json';
 const GENERATE_HELP = `aiwg setup-generate - generate a starter setup.aiwg.io/v1 SetupManifest
 
@@ -40,7 +42,8 @@ Usage:
   aiwg setup-run [manifest-path] [--manifest PATH] [--dry-run] [--platform OS]
                  [--distro NAME] [--params-file PATH] [--param KEY=VALUE]
                  [--step STEP_ID] [--skip A,B] [--type user|developer|ci]
-                 [--yes|--confirm]
+                 [--yes|--confirm] [--attestation PATH] [--policy ROOT]
+                 [--state PATH] [--offline]
 
 Options:
   --manifest PATH      Manifest path. Defaults to ./setup.manifest.yaml.
@@ -53,11 +56,17 @@ Options:
   --skip A,B           Comma-separated step IDs to skip.
   --type TYPE          Select default manifest by install type when no path is given.
   --yes, --confirm     Explicitly authorize mutating step execution and recovery.
+  --attestation PATH   Adjacent AIWG attestation for provider-orchestrated handoff.
+  --policy ROOT        Explicit cross-asset trust root; required for agent handoff.
+  --state PATH         Persisted trust/freshness state used by verification.
+  --offline            Forbid network retrieval and require portable evidence.
   --help, -h           Show this help.
 
 Safety:
   setup-run always runs setup-validate before platform detection or execution.
   Mutating execution refuses to run without explicit confirmation.
+  Provider-orchestrated manifests are never handed to an agent unless their
+  exact bytes have status verified under the explicit trust policy.
 `;
 function flagValue(args, name) {
     for (let i = 0; i < args.length; i += 1) {
@@ -85,6 +94,12 @@ function positionalManifest(args) {
         '--type',
         '--output',
         '--name',
+        '--attestation',
+        '--policy',
+        '--state',
+        '--asset-type',
+        '--namespace',
+        '--channel',
     ]);
     for (let i = 0; i < args.length; i += 1) {
         const arg = args[i];
@@ -689,9 +704,17 @@ export function runSetupManifest(options) {
     }
     const manifest = validation.manifest;
     if (manifest.metadata.execution_mode === 'provider-orchestrated') {
+        const expectedDigest = sha256(readFileSync(validation.manifestPath));
+        if (options.artifactVerification?.status !== 'verified'
+            || options.artifactVerification.artifact.sha256 !== expectedDigest) {
+            return {
+                exitCode: 29,
+                message: 'setup-run: provider-orchestrated handoff blocked; verify these exact manifest bytes with an explicit trust root and adjacent attestation first',
+            };
+        }
         return {
             exitCode: 2,
-            message: 'setup-run: this manifest is provider-orchestrated; give its URL or contents to a supported AI provider instead of executing it as a deterministic CLI manifest',
+            message: `setup-run: verified provider-orchestrated manifest (${options.artifactVerification.artifact.sha256}); give these exact contents to a supported AI provider instead of executing them as a deterministic CLI manifest`,
         };
     }
     const target = detectPlatform(options);
@@ -801,7 +824,33 @@ export const setupRunHandler = {
             process.stdout.write(RUN_HELP);
             return { exitCode: 0 };
         }
-        return runSetupManifest(parseRunOptions(ctx));
+        const options = parseRunOptions(ctx);
+        const manifestPath = options.manifestPath ?? 'setup.manifest.yaml';
+        let artifactVerification;
+        if (flagValue(ctx.args, '--policy')) {
+            const verificationArgs = [
+                manifestPath,
+                '--attestation', flagValue(ctx.args, '--attestation') ?? `${manifestPath}.aiwg-attestation.json`,
+                '--policy', flagValue(ctx.args, '--policy'),
+                '--asset-type', flagValue(ctx.args, '--asset-type') ?? 'setup-manifest',
+                '--namespace', flagValue(ctx.args, '--namespace') ?? 'aiwg',
+                '--channel', flagValue(ctx.args, '--channel') ?? 'stable',
+                '--json',
+                ...(flagValue(ctx.args, '--state') ? ['--state', flagValue(ctx.args, '--state')] : []),
+                ...(hasFlag(ctx.args, '--offline') ? ['--offline'] : []),
+            ];
+            const verification = await artifactVerifyHandler.execute({ ...ctx, args: verificationArgs, rawArgs: verificationArgs });
+            try {
+                artifactVerification = JSON.parse(verification.message ?? '');
+            }
+            catch {
+                return { exitCode: verification.exitCode || 27, message: `setup-run: artifact verification failed: ${verification.message ?? 'invalid verifier output'}` };
+            }
+            if (artifactVerification.status !== 'verified') {
+                return { exitCode: artifactVerification.exitCode, message: `setup-run: provider handoff blocked by artifact verification status '${artifactVerification.status}'` };
+            }
+        }
+        return runSetupManifest({ ...options, artifactVerification });
     },
 };
 //# sourceMappingURL=setup-manifest.js.map

package/dist/src/cli/handlers/setup.js

@@ -153,6 +153,13 @@ function secondaryRemotes(remotes, primary, issueTracker, ci) {
         push_on_release: false,
     }));
 }
+function normalizeForcePushPolicy(value, warnings) {
+    if (value === 'main-only-blocked') {
+        warnings.push('delivery.force_push_policy=main-only-blocked is a legacy alias; setup normalized it to own-branch-only.');
+        return 'own-branch-only';
+    }
+    return value;
+}
 function cloneConfig(config) {
     return JSON.parse(JSON.stringify(config));
 }
@@ -191,6 +198,9 @@ function validateSetupConfig(config, remotes, issueProvider) {
     else {
         checkRemote('remotes.issue_tracker', config.remotes?.issue_tracker);
     }
+    if (config.remotes?.issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.issue_provider)) {
+        errors.push('remotes.issue_provider is invalid');
+    }
     checkRemote('remotes.ci', config.remotes?.ci);
     if (!DELIVERY_MODES.includes(config.delivery?.mode))
         errors.push('delivery.mode is invalid');
@@ -222,6 +232,7 @@ export async function buildSetupProjectPlan(options) {
     const primaryRemote = remotes.find(r => r.name === primary);
     const hasLocalIssues = existsSync(projectAiwgPath(options.projectDir, 'issues', 'config.json'));
     const issueProvider = options.issueProvider ?? chooseIssueProvider(primaryRemote, hasLocalIssues);
+    const warnings = [];
     const issueTracker = issueProvider === 'local'
         ? 'local'
         : options.issueTracker ?? base.remotes?.issue_tracker ?? primary;
@@ -229,6 +240,7 @@ export async function buildSetupProjectPlan(options) {
     const remotesConfig = {
         primary,
         issue_tracker: issueTracker,
+        issue_provider: issueProvider,
         ci,
         secondary: base.remotes?.secondary ?? secondaryRemotes(remotes, primary, issueTracker, ci),
     };
@@ -249,9 +261,11 @@ export async function buildSetupProjectPlan(options) {
         require_ci_green: options.requireCiGreen ?? existingDelivery.require_ci_green ?? true,
         auto_close_issues: options.autoCloseIssues ?? existingDelivery.auto_close_issues ?? true,
         issue_comment_on_cycle: options.issueCommentOnCycle ?? existingDelivery.issue_comment_on_cycle ?? true,
-        force_push_policy: options.forcePushPolicy ?? existingDelivery.force_push_policy ?? 'never',
         require_signed_commits: options.requireSignedCommits ?? existingDelivery.require_signed_commits ?? false,
     };
+    delivery.force_push_policy = (options.forcePushPolicy
+        ?? normalizeForcePushPolicy(existingDelivery.force_push_policy, warnings)
+        ?? 'never');
     const committerName = options.committerName ?? existingDelivery.committer?.name ?? gitConfig(options.projectDir, 'user.name');
     const committerEmail = options.committerEmail ?? existingDelivery.committer?.email ?? gitConfig(options.projectDir, 'user.email');
     if (committerName || committerEmail) {
@@ -273,7 +287,6 @@ export async function buildSetupProjectPlan(options) {
     }
     base.remotes = remotesConfig;
     base.delivery = delivery;
-    const warnings = [];
     if (primaryRemote?.provider === 'unknown' && issueProvider !== 'local') {
         warnings.push(`Remote '${primary}' is self-hosted or unknown; provider '${issueProvider}' was selected explicitly/defaulted.`);
     }

package/dist/src/cli/handlers/use.js

@@ -52,10 +52,54 @@ import { generate as generateContextFiles, discoverDeployedArtifacts, } from '..
 import { verifyModelWrapperDeployment } from '../../models/wrapper-deployment.js';
 import { loadGraphIndexFile } from '../../artifacts/index-reader.js';
 import { aggregateUseDeploymentResult, buildDryRunUseResult, renderUseDeploymentResult, verifyProviderDeployment, } from '../services/deployment-verification.js';
+import { finalizeProviderTransformationReceipt, sourceVerificationsFromSignedWebRelease, } from '../../providers/transformation-receipt-integration.js';
+import { loadResourceTrustRootFile, resolveWebRelease, } from '../../resources/web-release.js';
+import { createResourceCredentialProvider } from '../../auth/resource-credentials.js';
 /**
  * Valid framework identifiers
  */
 const VALID_FRAMEWORKS = ['sdlc', 'marketing', 'media-curator', 'research', 'forensics', 'dfir', 'security-engineering', 'ops', 'validation', 'knowledge-base', 'writing', 'general', 'all'];
+function providerReceiptWebReleaseOptions() {
+    const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
+    const cacheRoot = process.env.AIWG_RESOURCE_CACHE_ROOT;
+    const trustRootFile = process.env.AIWG_RESOURCE_TRUST_ROOT_FILE;
+    const publicKeyPem = trustRootFile === undefined
+        ? undefined
+        : loadResourceTrustRootFile(path.resolve(trustRootFile));
+    return {
+        ...(baseUrl === undefined ? {} : { baseUrl }),
+        ...(cacheRoot === undefined ? {} : { cacheRoot }),
+        ...(publicKeyPem === undefined ? {} : { publicKeyPem }),
+        ...(process.env.AIWG_RESOURCE_ALLOW_INSECURE_LOOPBACK_HTTP === '1'
+            ? { allowInsecureLoopbackHttp: true }
+            : {}),
+    };
+}
+async function signedProviderSourceVerifications(options) {
+    const versionInfo = await getVersionInfo();
+    if (versionInfo.devMode)
+        return undefined;
+    const releaseOptions = providerReceiptWebReleaseOptions();
+    let release;
+    try {
+        release = await resolveWebRelease({ ...releaseOptions, selector: versionInfo.version, offline: true });
+    }
+    catch {
+        const credentialProvider = createResourceCredentialProvider(process.env);
+        const token = await credentialProvider();
+        // Protected production resources require the authenticated release
+        // credential. A configured alternate endpoint may intentionally be public.
+        if (!token && releaseOptions.baseUrl === undefined)
+            return undefined;
+        release = await resolveWebRelease({
+            ...releaseOptions,
+            selector: versionInfo.version,
+            credentialProvider: async () => token,
+        });
+    }
+    const verifications = await sourceVerificationsFromSignedWebRelease(options, release);
+    return Object.keys(verifications).length > 0 ? verifications : undefined;
+}
 /**
  * Framework name to deploy mode mapping.
  * Mode is passed as `--mode <value>` to deploy-agents.mjs, which resolves
@@ -630,7 +674,7 @@ const SESSION_RELOAD_NOTICE = {
         rationale: 'OpenCode loads agent files on session start and does not hot-reload.',
     },
     hermes: {
-        action: 'In an active Hermes session, run /reload-skills to pick up new skills in ~/.hermes/skills/ and /reload-mcp to pick up MCP server changes (~/.hermes/config.yaml) — both are in-session slash commands, no chat restart needed. Restart the chat only as a fallback if the slash commands are unavailable.',
+        action: 'In an active Hermes session, run /reload-skills to pick up new skills in $HERMES_HOME/skills/ and /reload-mcp to pick up MCP server changes ($HERMES_HOME/config.yaml) — both are in-session slash commands, no chat restart needed. Restart the chat only as a fallback if the slash commands are unavailable.',
         rationale: 'Hermes loads skills and MCP config at session start (verified in hermes_cli/commands.py:178 and hermes_cli/config.py:1228). The /reload-skills and /reload-mcp slash commands re-scan in place; /reload-mcp prompts for confirmation by default.',
         symptom: 'Until reloaded, newly deployed kernel skills are missing from `hermes skills list` and unreachable via natural-language invocation; new MCP servers (incl. AIWG) are missing from the tool surface.',
     },
@@ -1964,6 +2008,22 @@ export class UseHandler {
                 const effectiveScope = provider === 'openclaw' || provider === 'openhuman'
                     ? 'user'
                     : requestedScope;
+                if (coreResult.exitCode === 0 && !dryRun) {
+                    try {
+                        const receiptOptions = {
+                            projectRoot: projectDir,
+                            frameworkRoot,
+                            provider,
+                            scope: effectiveScope,
+                            requestedBundles: [requestedBundle],
+                        };
+                        const sourceVerifications = await signedProviderSourceVerifications(receiptOptions);
+                        await finalizeProviderTransformationReceipt({ ...receiptOptions, sourceVerifications });
+                    }
+                    catch (error) {
+                        originalConsole.warn(`Provider receipt finalization failed for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                }
                 providerResults.push(await verifyProviderDeployment({
                     projectRoot: projectDir,
                     frameworkRoot,
@@ -1974,6 +2034,10 @@ export class UseHandler {
                     invocationStartedAt: dryRun ? undefined : startedAt,
                     deploymentExitCode: coreResult.exitCode,
                     deploymentMessage: coreResult.message,
+                    // A normal first deployment has no authenticated verifier handoff
+                    // yet, so receipt absence belongs in doctor/status rather than
+                    // degrading an otherwise successful `aiwg use` result.
+                    reportMissingReceipt: false,
                 }));
             }
             result = aggregateUseDeploymentResult({
@@ -3185,11 +3249,12 @@ export class UseHandler {
         // Collect deployment counts for registry persistence and the final
         // orchestrated report. Presentation happens once, after verification, so
         // users do not see a second competing summary.
-        let counts = { agents: 0, commands: 0, skills: 0, rules: 0, behaviors: 0 };
-        if (quiet) {
-            const paths = getProviderPaths(provider);
-            counts = await countDeployedArtifacts(target, paths, provider);
-        }
+        //
+        // Counts are always populated from the on-disk artifacts so that the
+        // registry record written below (#621) reflects the real deploy even on
+        // a verbose run — the prior `if (quiet)` guard left the record
+        // `{agents: 0, commands: 0, skills: 0, rules: 0}` on `-v` runs.
+        const counts = await countDeployedArtifacts(target, paths, provider);
         // Deploy CI workflow files when --ci-hooks-enabled is set (#661)
         if (ciHooksEnabled) {
             await deployCiHooks({ frameworkRoot, framework, target, dryRun });

package/dist/src/cli/scope-resolver.js

@@ -11,6 +11,8 @@
  */
 import { homedir } from 'node:os';
 import * as path from 'node:path';
+import { resolveHermesHome, resolveHermesHomePath } from '../providers/hermes-home.js';
+export const hermesHome = resolveHermesHome;
 /**
  * User-scope deploy paths per provider per ADR-4 §2. Each path is absolute
  * (rooted in os.homedir()) so the orchestrator's existing path-join logic
@@ -159,7 +161,10 @@ export const USER_SCOPE_PATHS = {
     },
     hermes: {
         agents: '',
-        skills: path.join(homedir(), '.hermes', 'skills'),
+        // #2119: honor HERMES_HOME so `--scope user` deploys land under the same
+        // root the running Hermes session scans, matching the hermes provider's
+        // paths.skills resolution.
+        skills: resolveHermesHomePath('skills'),
         commands: '',
         rules: '',
         behaviors: '',