@aiwg/cli 2026.8.13 → 2026.8.15

package/dist/src/artifacts/output-policy.js

@@ -0,0 +1,87 @@
+import { appendFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export function defaultArtifactOutputs() {
+    return { canonical: 'aiwg', provider_native: 'explicit-only', destinations: {} };
+}
+export function validateArtifactOutputs(value) {
+    if (value === undefined)
+        return [];
+    const errors = [];
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return ['artifact_outputs must be an object'];
+    if (value.canonical !== undefined && value.canonical !== 'aiwg')
+        errors.push("artifact_outputs.canonical must be 'aiwg'");
+    if (value.provider_native !== undefined && !['disabled', 'explicit-only', 'project-default'].includes(value.provider_native))
+        errors.push('artifact_outputs.provider_native must be disabled, explicit-only, or project-default');
+    for (const [id, destination] of Object.entries(value.destinations ?? {})) {
+        if (!/^[a-z0-9][a-z0-9.-]*$/.test(id))
+            errors.push(`artifact_outputs destination '${id}' has an invalid stable ID`);
+        if (!destination || typeof destination !== 'object' || Array.isArray(destination)) {
+            errors.push(`artifact_outputs.destinations.${id} must be an object`);
+            continue;
+        }
+        if (destination.enabled !== undefined && typeof destination.enabled !== 'boolean')
+            errors.push(`artifact_outputs.destinations.${id}.enabled must be boolean`);
+        if (destination.use_when !== undefined && !['disabled', 'user-requested', 'project-default'].includes(destination.use_when))
+            errors.push(`artifact_outputs.destinations.${id}.use_when is invalid`);
+    }
+    return errors;
+}
+export function resolveArtifactOutputs(options) {
+    const project = { ...defaultArtifactOutputs(), ...(options.project ?? {}) };
+    const supported = new Set(options.supportedDestinations ?? []);
+    const presentations = [];
+    const authority = {};
+    const diagnostics = [];
+    const explicit = new Set(options.explicitDestinations ?? []);
+    const candidateAuthority = new Map();
+    for (const id of options.providerDefaults ?? [])
+        candidateAuthority.set(id, 'provider-default');
+    if (project.provider_native === 'project-default') {
+        for (const [id, destination] of Object.entries(project.destinations ?? {})) {
+            if (destination.use_when === 'project-default')
+                candidateAuthority.set(id, 'project-default');
+        }
+    }
+    if (options.userPreference?.provider_native === 'project-default') {
+        for (const [id, destination] of Object.entries(options.userPreference.destinations ?? {})) {
+            if (destination.enabled !== false && destination.use_when === 'project-default')
+                candidateAuthority.set(id, 'user-preference');
+        }
+    }
+    for (const id of explicit)
+        candidateAuthority.set(id, 'explicit-task');
+    const candidates = candidateAuthority.keys();
+    for (const id of candidates) {
+        if (!supported.has(id)) {
+            diagnostics.push(`Destination '${id}' is unknown or unsupported and was not selected.`);
+            continue;
+        }
+        const policy = project.destinations?.[id];
+        if (project.provider_native === 'disabled' || policy?.enabled === false || policy?.use_when === 'disabled') {
+            diagnostics.push(`Destination '${id}' is disabled by project policy.`);
+            continue;
+        }
+        const selectedBy = candidateAuthority.get(id);
+        if (selectedBy === 'explicit-task') {
+            presentations.push(id);
+            authority[id] = 'explicit-task';
+            continue;
+        }
+        if (project.provider_native === 'project-default' && policy?.use_when === 'project-default') {
+            presentations.push(id);
+            authority[id] = selectedBy;
+            continue;
+        }
+        diagnostics.push(`Destination '${id}' requires an explicit per-task request; provider and user defaults cannot select it.`);
+    }
+    return { canonical: 'aiwg', presentations: [...new Set(presentations)].sort(), authority, diagnostics };
+}
+export async function recordArtifactOutputProvenance(artifactRoot, record) {
+    const path = join(artifactRoot, 'provenance', 'artifact-outputs.jsonl');
+    await mkdir(dirname(path), { recursive: true });
+    const value = { schemaVersion: 'aiwg.artifact-output-provenance.v1', createdAt: new Date().toISOString(), ...record };
+    await appendFile(path, `${JSON.stringify(value)}\n`, 'utf8');
+    return path;
+}
+//# sourceMappingURL=output-policy.js.map

package/dist/src/cli/handlers/index.js

@@ -62,12 +62,13 @@ import { jobHandler } from './job.js';
 import { costReportHandler } from './cost-report.js';
 import { evidenceHandler } from './evidence.js';
 import { artifactVerifyHandler } from './artifact-verify.js';
+import { outputModeHandler } from './output-mode.js';
 // Re-export individual handlers
 export { 
 // Maintenance
 helpHandler, versionHandler, authHandler, doctorHandler, contextFirewallHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, outputModeHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -150,6 +151,7 @@ export const allHandlers = [
     costReportHandler,
     evidenceHandler,
     artifactVerifyHandler,
+    outputModeHandler,
     // Workspace management
     ...workspaceHandlers,
     // Subcommand handlers (MCP, catalog, index, skills)

package/dist/src/cli/handlers/output-mode.js

@@ -0,0 +1,69 @@
+import { loadOutputModeRegistry, readOutputModeState, resolveOutputModes, writeOutputModeState } from '../../output-modes/registry.js';
+function flagValue(args, name) {
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function parseScope(args) {
+    const scope = flagValue(args, '--scope') ?? 'session';
+    if (!['invocation', 'session', 'project'].includes(scope))
+        throw new Error(`Invalid scope '${scope}'; expected invocation, session, or project.`);
+    return scope;
+}
+async function execute(ctx) {
+    const [action = 'status', id] = ctx.args.filter((arg, index, all) => !arg.startsWith('-') && all[index - 1] !== '--scope');
+    const registry = await loadOutputModeRegistry(ctx.cwd, ctx.frameworkRoot);
+    if (action === 'list') {
+        const rows = [...registry.values()].sort((a, b) => a.id.localeCompare(b.id)).map(p => `${p.id}\t${p.kind}\t${p.validation.level}\t${p.source}\t${p.description}`);
+        return { exitCode: 0, rawOutput: true, message: `ID\tKIND\tVALIDATION\tSOURCE\tDESCRIPTION\n${rows.join('\n')}` };
+    }
+    if (action === 'show') {
+        if (!id)
+            return { exitCode: 1, message: 'Usage: aiwg output-mode show <id>' };
+        const p = registry.get(id);
+        if (!p)
+            return { exitCode: 1, message: `Unknown output mode '${id}'.` };
+        return { exitCode: 0, rawOutput: true, message: JSON.stringify(p, null, 2) };
+    }
+    if (action === 'status') {
+        const invocation = ctx.args.flatMap((arg, i) => arg === '--output-mode' && ctx.args[i + 1] ? [ctx.args[i + 1]] : []);
+        const resolved = await resolveOutputModes(ctx.cwd, ctx.frameworkRoot, invocation);
+        if (resolved.modes.length === 0)
+            return { exitCode: 0, rawOutput: true, message: 'Effective output mode: unaltered\nContext cost: 0 tokens\nNo transformations active.' };
+        const lines = resolved.modes.map((p, i) => `${i + 1}. ${p.id} [${p.kind}/${p.stage}] source=${p.source} scope=${p.scope} validation=${p.validation.level} context≈${p.contextCost ?? 0}`);
+        return { exitCode: 0, rawOutput: true, message: `Effective ordered stack:\n${lines.join('\n')}\nEstimated context cost: ${resolved.modes.reduce((n, p) => n + (p.contextCost ?? 0), 0)} tokens` };
+    }
+    if (!['enable', 'disable', 'clear'].includes(action))
+        return { exitCode: 1, message: `Unknown output-mode action '${action}'.` };
+    const scope = parseScope(ctx.args);
+    if (scope === 'invocation') {
+        if (action !== 'enable' || !id)
+            return { exitCode: 1, message: 'Invocation scope is ephemeral; pass --output-mode <id> to the command being run.' };
+        if (!registry.has(id))
+            return { exitCode: 1, message: `Unknown output mode '${id}'.` };
+        return { exitCode: 0, message: `Invocation mode '${id}' validated. Pass --output-mode ${id} to the command being run; no files were modified.` };
+    }
+    const state = await readOutputModeState(ctx.cwd, scope);
+    let modes = [...state.modes];
+    if (action === 'clear')
+        modes = [];
+    else {
+        if (!id)
+            return { exitCode: 1, message: `Usage: aiwg output-mode ${action} <id> --scope ${scope}` };
+        if (!registry.has(id))
+            return { exitCode: 1, message: `Unknown output mode '${id}'.` };
+        modes = action === 'enable' ? [...new Set([...modes, id])] : modes.filter(value => value !== id);
+    }
+    await resolveOutputModes(ctx.cwd, ctx.frameworkRoot, scope === 'session' ? modes : []);
+    const path = await writeOutputModeState(ctx.cwd, scope, modes);
+    return { exitCode: 0, message: `${action === 'clear' ? 'Cleared' : `${action}d`} ${scope} output modes (${modes.join(', ') || 'unaltered'}) at ${path}` };
+}
+export const outputModeHandler = {
+    id: 'output-mode', name: 'Output Modes', description: 'List, inspect, and select composable output modes', category: 'project', aliases: ['output-modes'],
+    async execute(ctx) { try {
+        return await execute(ctx);
+    }
+    catch (error) {
+        return { exitCode: 1, message: error.message };
+    } },
+};
+//# sourceMappingURL=output-mode.js.map

package/dist/src/cli/handlers/run.js

@@ -16,6 +16,23 @@ import { spawn } from 'child_process';
 import { readAiwgConfig, getProjectDir } from '../../config/aiwg-config.js';
 import { handlerResultFromError } from '../errors.js';
 import * as ui from '../ui.js';
+import { resolveOutputModes } from '../../output-modes/registry.js';
+function extractOutputModes(args) {
+    const cleaned = [];
+    const modes = [];
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === '--output-mode') {
+            const id = args[i + 1];
+            if (!id || id.startsWith('-'))
+                throw new Error('--output-mode requires a mode ID');
+            modes.push(id);
+            i += 1;
+        }
+        else
+            cleaned.push(args[i]);
+    }
+    return { args: cleaned, modes };
+}
 /**
  * Execute a shell command with inherited stdio.
  * Returns the exit code.
@@ -41,8 +58,28 @@ export const runHandler = {
     category: 'utility',
     aliases: [],
     async execute(ctx) {
-        const scriptName = ctx.args[0];
+        let parsed;
+        try {
+            parsed = extractOutputModes(ctx.args);
+        }
+        catch (error) {
+            return { exitCode: 1, message: error.message };
+        }
+        const scriptName = parsed.args[0];
         const projectDir = getProjectDir(ctx, ctx.args);
+        let outputModeEnv = {};
+        try {
+            const resolved = await resolveOutputModes(projectDir, ctx.frameworkRoot, parsed.modes);
+            if (resolved.modes.length > 0) {
+                outputModeEnv = {
+                    AIWG_OUTPUT_MODES: resolved.modes.map(mode => mode.id).join(','),
+                    AIWG_OUTPUT_MODES_JSON: JSON.stringify(resolved.modes),
+                };
+            }
+        }
+        catch (error) {
+            return { exitCode: 1, message: `Output mode resolution failed: ${error.message}` };
+        }
         // #1231 — intercept --help/-h before script lookup so the user sees
         // help for both run forms, not "No script named '--help'".
         if (scriptName === '--help' || scriptName === '-h') {
@@ -55,7 +92,7 @@ export const runHandler = {
         if (scriptName === 'skill') {
             try {
                 const { main } = await import('../../skills/run.js');
-                const exitCode = await main(ctx.args);
+                const exitCode = await main(parsed.args, outputModeEnv);
                 return { exitCode };
             }
             catch (error) {
@@ -119,6 +156,7 @@ export const runHandler = {
         const env = {
             AIWG_PROJECT: projectDir,
             AIWG_PROVIDERS: config.providers.join(','),
+            ...outputModeEnv,
         };
         ui.blank();
         console.log(`  ${ui.brandMark()} ${ui.bold(`aiwg run ${scriptName}`)}`);
@@ -140,8 +178,8 @@ export const runHandler = {
     },
 };
 function printRunUsage() {
-    console.log('Usage: aiwg run <script-name> [args...]');
-    console.log('       aiwg run skill <skill-name> [--cwd <path>] [-- <args forwarded to script>]');
+    console.log('Usage: aiwg run <script-name> [--output-mode <id>] [args...]');
+    console.log('       aiwg run skill <skill-name> [--output-mode <id>] [--cwd <path>] [-- <args forwarded to script>]');
     console.log('');
     console.log('Two forms share the `run` namespace:');
     console.log('');

package/dist/src/cli/handlers/setup.js

@@ -68,8 +68,10 @@ export function parseSetupProjectOptions(ctx) {
         nonInteractive: boolFlag(args, '--non-interactive') || boolFlag(args, '--yes'),
         primary: flagValue(args, '--primary'),
         issueTracker: flagValue(args, '--issue-tracker'),
+        customerIssueTracker: flagValue(args, '--customer-issue-tracker'),
         ci: flagValue(args, '--ci'),
         issueProvider: parseEnum(flagValue(args, '--issue-provider'), ISSUE_PROVIDERS, '--issue-provider'),
+        customerIssueProvider: parseEnum(flagValue(args, '--customer-issue-provider'), ISSUE_PROVIDERS, '--customer-issue-provider'),
         deliveryMode: parseEnum(flagValue(args, '--delivery-mode'), DELIVERY_MODES, '--delivery-mode'),
         defaultBranch: flagValue(args, '--default-branch'),
         requireCiGreen: parseBooleanFlag(args, '--require-ci-green'),
@@ -84,6 +86,8 @@ export function parseSetupProjectOptions(ctx) {
         signingEnforce: parseEnum(flagValue(args, '--signing-enforce'), ['commits', 'tags', 'all'], '--signing-enforce'),
         trackerActorLogin: flagValue(args, '--tracker-actor-login'),
         trackerActorVia: parseEnum(flagValue(args, '--tracker-actor-via'), TRACKER_VIA, '--tracker-actor-via'),
+        customerTrackerActorLogin: flagValue(args, '--customer-tracker-actor-login'),
+        customerTrackerActorVia: parseEnum(flagValue(args, '--customer-tracker-actor-via'), TRACKER_VIA, '--customer-tracker-actor-via'),
         providers: parseStringList(flagValue(args, '--providers')),
     };
 }
@@ -201,6 +205,12 @@ function validateSetupConfig(config, remotes, issueProvider) {
     if (config.remotes?.issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.issue_provider)) {
         errors.push('remotes.issue_provider is invalid');
     }
+    if (config.remotes?.customer_issue_tracker) {
+        checkRemote('remotes.customer_issue_tracker', config.remotes.customer_issue_tracker);
+    }
+    if (config.remotes?.customer_issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.customer_issue_provider)) {
+        errors.push('remotes.customer_issue_provider is invalid');
+    }
     checkRemote('remotes.ci', config.remotes?.ci);
     if (!DELIVERY_MODES.includes(config.delivery?.mode))
         errors.push('delivery.mode is invalid');
@@ -217,6 +227,9 @@ function validateSetupConfig(config, remotes, issueProvider) {
     if (config.remotes?.tracker_actor?.via && !TRACKER_VIA.includes(config.remotes.tracker_actor.via)) {
         errors.push('remotes.tracker_actor.via is invalid');
     }
+    if (config.remotes?.customer_tracker_actor?.via && !TRACKER_VIA.includes(config.remotes.customer_tracker_actor.via)) {
+        errors.push('remotes.customer_tracker_actor.via is invalid');
+    }
     if (!config.providers.every(p => VALID_PROVIDERS.includes(p))) {
         errors.push('providers contains an unknown AIWG provider');
     }
@@ -237,11 +250,15 @@ export async function buildSetupProjectPlan(options) {
         ? 'local'
         : options.issueTracker ?? base.remotes?.issue_tracker ?? primary;
     const ci = options.ci ?? base.remotes?.ci ?? primary;
+    const customerIssueTracker = options.customerIssueTracker ?? base.remotes?.customer_issue_tracker;
+    const customerIssueProvider = options.customerIssueProvider ?? base.remotes?.customer_issue_provider;
     const remotesConfig = {
         primary,
         issue_tracker: issueTracker,
         issue_provider: issueProvider,
         ci,
+        ...(customerIssueTracker ? { customer_issue_tracker: customerIssueTracker } : {}),
+        ...(customerIssueProvider ? { customer_issue_provider: customerIssueProvider } : {}),
         secondary: base.remotes?.secondary ?? secondaryRemotes(remotes, primary, issueTracker, ci),
     };
     const trackerLogin = options.trackerActorLogin ?? base.remotes?.tracker_actor?.login;
@@ -253,6 +270,16 @@ export async function buildSetupProjectPlan(options) {
             ...(trackerVia ? { via: trackerVia } : {}),
         };
     }
+    const customerTrackerLogin = options.customerTrackerActorLogin ?? base.remotes?.customer_tracker_actor?.login;
+    const customerTrackerVia = options.customerTrackerActorVia ?? base.remotes?.customer_tracker_actor?.via
+        ?? (customerIssueProvider === 'github' ? 'gh' : customerIssueProvider === 'gitea' ? 'tea' : undefined);
+    if (customerTrackerLogin || customerTrackerVia || base.remotes?.customer_tracker_actor?.forbid_actors) {
+        remotesConfig.customer_tracker_actor = {
+            ...(base.remotes?.customer_tracker_actor ?? {}),
+            ...(customerTrackerLogin ? { login: customerTrackerLogin } : {}),
+            ...(customerTrackerVia ? { via: customerTrackerVia } : {}),
+        };
+    }
     const existingDelivery = base.delivery ?? {};
     const delivery = {
         ...existingDelivery,

package/dist/src/config/aiwg-config.js

@@ -16,6 +16,7 @@ import { getProviderDefinition, getProviderKernelSkillPath, PROVIDER_IDS, resolv
 import { validateAuthorization, } from '../policy/authorization.js';
 import { projectAiwgPath, projectControlPath, resolveProjectAiwgDir, } from './project-artifacts.js';
 import { defaultThreatAssessmentConfig, validateThreatAssessmentConfig, } from '../security/threat-assessment-config.js';
+import { defaultArtifactOutputs, validateArtifactOutputs } from '../artifacts/output-policy.js';
 const CONFIG_FILENAME = 'aiwg.config';
 /**
  * Operations that a workspace may authorize for one member repository.
@@ -477,6 +478,7 @@ export function resolveRemoteProvider(remoteUrl) {
  * Defaults:
  *   - `primary` defaults to "origin"
  *   - `issue_tracker` defaults to `primary`
+ *   - customer tracker fields remain unset unless explicitly configured
  *   - `ci` defaults to `primary`
  *   - `secondary` defaults to `[]`
  *
@@ -490,6 +492,9 @@ export function resolveRemotes(remotes) {
         issue_provider: remotes?.issue_provider,
         ci: remotes?.ci ?? primary,
         tracker_actor: remotes?.tracker_actor,
+        customer_issue_tracker: remotes?.customer_issue_tracker,
+        customer_issue_provider: remotes?.customer_issue_provider,
+        customer_tracker_actor: remotes?.customer_tracker_actor,
         transport: remotes?.transport,
         secondary: remotes?.secondary ?? [],
     };
@@ -638,6 +643,7 @@ export function emptyConfig(providers = ['claude']) {
         security: {
             threatAssessment: defaultThreatAssessmentConfig(),
         },
+        artifact_outputs: defaultArtifactOutputs(),
         delivery: {
             mode: 'pr-required',
             default_branch: 'main',
@@ -730,6 +736,9 @@ export async function readAiwgConfig(projectDir) {
     if (threatAssessmentErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
     }
+    const artifactOutputErrors = validateArtifactOutputs(parsed.artifact_outputs);
+    if (artifactOutputErrors.length > 0)
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${artifactOutputErrors.join('\n')}`);
     return parsed;
 }
 /**
@@ -742,6 +751,9 @@ export async function writeAiwgConfig(projectDir, config) {
     if (threatAssessmentErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
     }
+    const artifactOutputErrors = validateArtifactOutputs(config.artifact_outputs);
+    if (artifactOutputErrors.length > 0)
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${artifactOutputErrors.join('\n')}`);
     const localPath = getConfigPath(projectDir);
     const artifactDir = resolveProjectAiwgDir(projectDir);
     const artifactPath = join(artifactDir, CONFIG_FILENAME);

package/dist/src/config/cli.js

@@ -151,10 +151,14 @@ const ENUM_RULES = {
     'delivery.release_signing.format': ['openpgp', 'ssh', 'x509'],
     'delivery.release_signing.enforce': ['commits', 'tags', 'all'],
     'remotes.issue_provider': ['gitea', 'github', 'local'],
+    'remotes.customer_issue_provider': ['gitea', 'github', 'local'],
     'remotes.tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
+    'remotes.customer_tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
     'remotes.transport.protocol': ['ssh', 'https'],
     'repo_maintainer.tiers.local': ['collaborator', 'maintainer', 'admin'],
     'security.threatAssessment.mode': ['off', 'audit', 'enforce'],
+    'artifact_outputs.canonical': ['aiwg'],
+    'artifact_outputs.provider_native': ['disabled', 'explicit-only', 'project-default'],
 };
 const BOOLEAN_FIELDS = new Set([
     'delivery.delete_branch_on_merge',
@@ -167,6 +171,7 @@ const BOOLEAN_FIELDS = new Set([
 ]);
 const STRING_ARRAY_FIELDS = new Set([
     'remotes.tracker_actor.forbid_actors',
+    'remotes.customer_tracker_actor.forbid_actors',
     'command_log.scopes',
     'telemetry.skill_usage.scopes',
 ]);
@@ -590,6 +595,9 @@ For project-level config: aiwg config show --project [--json]
     const remotesView = {
         primary: { name: resolvedRemotes.primary, url: getUrl(resolvedRemotes.primary) },
         issue_tracker: { name: resolvedRemotes.issue_tracker, url: getUrl(resolvedRemotes.issue_tracker) },
+        customer_issue_tracker: resolvedRemotes.customer_issue_tracker
+            ? { name: resolvedRemotes.customer_issue_tracker, url: getUrl(resolvedRemotes.customer_issue_tracker) }
+            : null,
         ci: { name: resolvedRemotes.ci, url: getUrl(resolvedRemotes.ci) },
         secondary: resolvedRemotes.secondary.map((s) => ({
             ...s,
@@ -651,7 +659,10 @@ For project-level config: aiwg config show --project [--json]
     };
     console.log(fmt('Primary       ', remotesView.primary));
     if (remotesView.issue_tracker.name !== remotesView.primary.name) {
-        console.log(fmt('Issue tracker ', remotesView.issue_tracker));
+        console.log(fmt('Internal issues', remotesView.issue_tracker));
+    }
+    if (remotesView.customer_issue_tracker) {
+        console.log(fmt('Customer issues', remotesView.customer_issue_tracker));
     }
     if (remotesView.ci.name !== remotesView.primary.name) {
         console.log(fmt('CI            ', remotesView.ci));

package/dist/src/config/workspace.js

@@ -119,8 +119,7 @@ async function resolveEndpoint(repoPath, remote, providerHint) {
                 : 'unknown',
     };
 }
-function trackerProviderHint(remotes, fallback) {
-    const configured = remotes.issue_provider;
+function providerHint(configured, fallback) {
     if (configured === 'gitea' || configured === 'github')
         return configured;
     return fallback;
@@ -130,10 +129,14 @@ async function resolveMember(entry, workspaceRoot) {
     const configPath = getConfigPath(memberPath);
     const config = await readAiwgConfig(memberPath);
     const remotes = resolveRemotes(config?.remotes);
-    const issueProviderHint = trackerProviderHint(remotes, entry.provider);
-    const [primary, issueTracker, ci] = await Promise.all([
+    const issueProviderHint = providerHint(remotes.issue_provider, entry.provider);
+    const customerProviderHint = providerHint(remotes.customer_issue_provider);
+    const [primary, issueTracker, customerIssueTracker, ci] = await Promise.all([
         resolveEndpoint(memberPath, remotes.primary, entry.provider),
         resolveEndpoint(memberPath, remotes.issue_tracker, issueProviderHint),
+        remotes.customer_issue_tracker
+            ? resolveEndpoint(memberPath, remotes.customer_issue_tracker, customerProviderHint)
+            : Promise.resolve(undefined),
         resolveEndpoint(memberPath, remotes.ci, entry.provider),
     ]);
     const drift = [];
@@ -145,12 +148,18 @@ async function resolveMember(entry, workspaceRoot) {
         drift.push(`primary remote '${remotes.primary}' is unavailable`);
     if (!issueTracker.url)
         drift.push(`issue tracker remote '${remotes.issue_tracker}' is unavailable`);
+    if (remotes.customer_issue_tracker && !customerIssueTracker?.url) {
+        drift.push(`customer issue tracker remote '${remotes.customer_issue_tracker}' is unavailable`);
+    }
     if (primary.provider === 'unknown') {
         drift.push(`primary remote provider is unknown for '${primary.domain ?? remotes.primary}'`);
     }
     if (issueTracker.provider === 'unknown') {
         drift.push(`issue tracker provider is unknown for '${issueTracker.domain ?? remotes.issue_tracker}'`);
     }
+    if (customerIssueTracker?.provider === 'unknown') {
+        drift.push(`customer issue tracker provider is unknown for '${customerIssueTracker.domain ?? remotes.customer_issue_tracker}'`);
+    }
     if (entry.allowed.includes('issue-comment') && !remotes.tracker_actor?.login) {
         drift.push('issue-comment is allowed but remotes.tracker_actor.login is missing');
     }
@@ -158,6 +167,10 @@ async function resolveMember(entry, workspaceRoot) {
         && remotes.tracker_actor.forbid_actors?.includes(remotes.tracker_actor.login)) {
         drift.push(`configured tracker actor '${remotes.tracker_actor.login}' is also forbidden`);
     }
+    if (remotes.customer_tracker_actor?.login
+        && remotes.customer_tracker_actor.forbid_actors?.includes(remotes.customer_tracker_actor.login)) {
+        drift.push(`configured customer tracker actor '${remotes.customer_tracker_actor.login}' is also forbidden`);
+    }
     if (config?.delivery?.signing?.enforce
         && !config.delivery.signing.key
         && !config.delivery.signing.key_file) {
@@ -177,6 +190,7 @@ async function resolveMember(entry, workspaceRoot) {
         remotes,
         primary,
         issueTracker,
+        ...(customerIssueTracker ? { customerIssueTracker } : {}),
         ci,
         drift,
     };
@@ -251,33 +265,35 @@ export async function authorizeWorkspaceOperation(startPath, targetPath, action,
     };
 }
 /** Enforce the member config tracker_actor + forbid_actors contract. */
-export function checkTrackerActor(member, actualActor) {
-    const configured = member.remotes.tracker_actor;
+export function checkTrackerActor(member, actualActor, role = 'internal') {
+    const configured = role === 'customer'
+        ? member.remotes.customer_tracker_actor
+        : member.remotes.tracker_actor;
     const actor = actualActor ?? configured?.login;
     if (!actor) {
         return {
             allowed: false,
-            reason: `repo '${member.name}' does not resolve a tracker actor`,
+            reason: `repo '${member.name}' does not resolve a ${role} tracker actor`,
         };
     }
     if (configured?.forbid_actors?.includes(actor)) {
         return {
             allowed: false,
             actor,
-            reason: `tracker actor '${actor}' is forbidden by repo '${member.name}'`,
+            reason: `${role} tracker actor '${actor}' is forbidden by repo '${member.name}'`,
         };
     }
     if (actualActor && configured?.login && actualActor !== configured.login) {
         return {
             allowed: false,
             actor,
-            reason: `tracker actor '${actualActor}' does not match configured actor '${configured.login}'`,
+            reason: `${role} tracker actor '${actualActor}' does not match configured actor '${configured.login}'`,
         };
     }
     return {
         allowed: true,
         actor,
-        reason: `tracker actor '${actor}' is allowed for repo '${member.name}'`,
+        reason: `${role} tracker actor '${actor}' is allowed for repo '${member.name}'`,
     };
 }
 //# sourceMappingURL=workspace.js.map

package/dist/src/extensions/commands/definitions.js

@@ -1061,6 +1061,24 @@ export const sessionCommand = {
         },
     },
 };
+export const outputModeCommand = {
+    id: 'output-mode',
+    type: 'command',
+    name: 'Output Modes',
+    description: 'List, inspect, enable, disable, clear, and report composable output modes',
+    version: '1.0.0',
+    capabilities: ['cli', 'voice', 'output-mode', 'controlled-language', 'presentation'],
+    keywords: ['output-mode', 'voice', 'style', 'asd-ste', 'presentation'],
+    category: 'project',
+    platforms: { claude: 'full', generic: 'full' },
+    deployment: { pathTemplate: '.{platform}/commands/{id}.md', core: true },
+    metadata: {
+        type: 'command',
+        template: 'utility',
+        argumentHint: '<list|show|enable|disable|clear|status> [id] [--scope invocation|session|project]',
+        allowedTools: ['Read', 'Write'],
+    },
+};
 // Session Catalog Command (#1903)
 export const sessionsCommand = {
     id: 'sessions',
@@ -3701,6 +3719,7 @@ export const commandDefinitions = [
     // Session (#884)
     sessionCommand,
     sessionsCommand,
+    outputModeCommand,
 ];
 // ============================================
 // Helper Functions

package/dist/src/output-modes/registry.js

@@ -0,0 +1,158 @@
+import { access, mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { dirname, extname, join, resolve } from 'node:path';
+import { parse, stringify } from 'yaml';
+const PROTECTED = ['code', 'commands', 'citations', 'quoted-text', 'identifiers', 'machine-readable-blocks'];
+const STAGE_ORDER = ['semantic', 'voice', 'controlled-language', 'structure', 'presentation'];
+const BUILTINS = [
+    {
+        id: 'unaltered', version: '1.0.0', description: 'No-op mode; preserves the provider output path unchanged.',
+        kind: 'presentation', stage: 'presentation', order: -1000, instructions: '',
+        provenance: { source: 'AIWG', license: 'MIT' }, validation: { level: 'advisory' }, contextCost: 0,
+        protectedContent: PROTECTED,
+    },
+    {
+        id: 'wittgenstein-inspired', version: '1.0.0', description: 'Concise, proposition-oriented stylistic profile; not impersonation or attribution.',
+        kind: 'voice', stage: 'voice', order: 100, instructions: 'Prefer concise propositions, clarify terms in use, and expose category errors. Do not imitate or attribute text to Ludwig Wittgenstein.',
+        provenance: { source: 'AIWG original style guidance', license: 'MIT' }, validation: { level: 'advisory' }, contextCost: 48,
+        protectedContent: PROTECTED,
+    },
+    {
+        id: 'asd-ste', version: '1.0.0', description: 'Operator-configured ASD Simplified Technical English adapter.',
+        kind: 'controlled-language', stage: 'controlled-language', order: 200,
+        instructions: 'Apply only operator-supplied ASD-STE rules and approved terminology. Without licensed rules and a configured validator, describe output as advisory and never claim conformance.',
+        provenance: { source: 'AIWG adapter; standard content supplied by operator', license: 'MIT adapter only' },
+        validation: { level: 'advisory', standardVersion: 'operator-configured' }, contextCost: 64,
+        protectedContent: PROTECTED,
+    },
+];
+function profileDirs(cwd) {
+    return [
+        { dir: join(cwd, '.aiwg', 'output-modes'), source: 'project' },
+        { dir: join(homedir(), '.config', 'aiwg', 'output-modes'), source: 'user' },
+    ];
+}
+async function readable(path) {
+    try {
+        await access(path, constants.R_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function validateProfile(value, path) {
+    if (!value || typeof value !== 'object')
+        throw new Error(`Invalid output mode profile at ${path}: expected an object`);
+    const p = value;
+    for (const field of ['id', 'version', 'description', 'kind', 'stage', 'instructions', 'provenance', 'validation']) {
+        if (p[field] === undefined)
+            throw new Error(`Invalid output mode profile at ${path}: missing ${field}`);
+    }
+    if (!['voice', 'controlled-language', 'structure', 'presentation'].includes(String(p.kind)))
+        throw new Error(`Invalid output mode kind in ${path}: ${p.kind}`);
+    if (!STAGE_ORDER.includes(String(p.stage)))
+        throw new Error(`Invalid output mode stage in ${path}: ${p.stage}`);
+    return p;
+}
+async function loadDirectory(dir, source) {
+    if (!(await readable(dir)))
+        return [];
+    const result = [];
+    for (const name of (await readdir(dir)).sort()) {
+        if (!['.yaml', '.yml', '.json'].includes(extname(name)))
+            continue;
+        const sourcePath = join(dir, name);
+        const raw = await readFile(sourcePath, 'utf8');
+        const value = extname(name) === '.json' ? JSON.parse(raw) : parse(raw);
+        result.push({ ...validateProfile(value, sourcePath), source, sourcePath });
+    }
+    return result;
+}
+async function loadVoiceAdapters(frameworkRoot) {
+    const dir = join(frameworkRoot, 'agentic', 'code', 'addons', 'voice-framework', 'voices', 'templates');
+    if (!(await readable(dir)))
+        return [];
+    const result = [];
+    for (const name of (await readdir(dir)).filter(n => /\.ya?ml$/.test(n)).sort()) {
+        const sourcePath = join(dir, name);
+        const voice = parse(await readFile(sourcePath, 'utf8'));
+        const id = String(voice.id ?? name.replace(/\.ya?ml$/, ''));
+        result.push({
+            id, version: String(voice.version ?? '1.0.0'), description: String(voice.description ?? `Adapted voice profile: ${id}`),
+            kind: 'voice', stage: 'voice', order: 100, instructions: `Apply the existing voice profile '${id}' through voice-apply.`,
+            provenance: { source: sourcePath, license: String(voice.license ?? 'project license') },
+            validation: { level: 'advisory' }, protectedContent: PROTECTED, contextCost: 32,
+            mergeStrategy: 'weighted-voice', source: 'voice-adapter', sourcePath,
+        });
+    }
+    return result;
+}
+export async function loadOutputModeRegistry(cwd, frameworkRoot) {
+    const registry = new Map();
+    for (const profile of BUILTINS)
+        registry.set(profile.id, { ...profile, source: 'builtin' });
+    for (const profile of await loadVoiceAdapters(frameworkRoot))
+        if (!registry.has(profile.id))
+            registry.set(profile.id, profile);
+    // User overrides built-ins; project overrides user.
+    for (const entry of [...profileDirs(cwd)].reverse())
+        for (const profile of await loadDirectory(entry.dir, entry.source))
+            registry.set(profile.id, profile);
+    return registry;
+}
+function statePath(cwd, scope) {
+    if (scope === 'project')
+        return join(cwd, '.aiwg', 'output-modes.yaml');
+    const workspace = createHash('sha256').update(resolve(cwd)).digest('hex').slice(0, 16);
+    const session = process.env.AIWG_SESSION_ID?.replace(/[^a-zA-Z0-9_.-]/g, '_') || 'default';
+    return join(tmpdir(), 'aiwg-output-modes', `${workspace}-${session}.yaml`);
+}
+export async function readOutputModeState(cwd, scope) {
+    const path = statePath(cwd, scope);
+    if (!(await readable(path)))
+        return { version: 1, modes: [] };
+    const value = parse(await readFile(path, 'utf8'));
+    return { version: 1, modes: Array.isArray(value.modes) ? value.modes.map(String) : [] };
+}
+export async function writeOutputModeState(cwd, scope, modes) {
+    const path = statePath(cwd, scope);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, stringify({ version: 1, modes }), 'utf8');
+    return path;
+}
+export async function resolveOutputModes(cwd, frameworkRoot, invocation = []) {
+    const registry = await loadOutputModeRegistry(cwd, frameworkRoot);
+    const project = await readOutputModeState(cwd, 'project');
+    const session = await readOutputModeState(cwd, 'session');
+    const selected = [...project.modes.map(id => ({ id, scope: 'project' })), ...session.modes.map(id => ({ id, scope: 'session' })), ...invocation.map(id => ({ id, scope: 'invocation' }))];
+    const effective = new Map();
+    const diagnostics = [];
+    for (const item of selected) {
+        const profile = registry.get(item.id);
+        if (!profile)
+            throw new Error(`Unknown output mode '${item.id}'. Unknown provider-native or custom modes fail safe; run 'aiwg output-mode list'.`);
+        effective.set(item.id, { ...profile, scope: item.scope });
+    }
+    const modes = [...effective.values()].sort((a, b) => STAGE_ORDER.indexOf(a.stage) - STAGE_ORDER.indexOf(b.stage) || (a.order ?? 0) - (b.order ?? 0) || a.id.localeCompare(b.id));
+    for (let i = 0; i < modes.length; i++)
+        for (let j = i + 1; j < modes.length; j++) {
+            const a = modes[i], b = modes[j];
+            if (a.conflicts?.includes(b.id) || b.conflicts?.includes(a.id))
+                throw new Error(`Output modes '${a.id}' and '${b.id}' conflict. Disable one or configure an explicit merge strategy.`);
+            if (a.kind === b.kind && a.kind !== 'voice')
+                throw new Error(`Output modes '${a.id}' and '${b.id}' share kind '${a.kind}' without a merge strategy.`);
+            if (a.kind === 'voice' && b.kind === 'voice' && a.mergeStrategy !== 'weighted-voice' && b.mergeStrategy !== 'weighted-voice')
+                throw new Error(`Voice modes '${a.id}' and '${b.id}' require an explicit weighted-voice merge strategy.`);
+        }
+    for (const mode of modes)
+        for (const requirement of mode.requires ?? [])
+            if (!effective.has(requirement))
+                throw new Error(`Output mode '${mode.id}' requires '${requirement}'.`);
+    if (modes.length === 0)
+        diagnostics.push('unaltered: no configured modes; no instructions or post-processing are added');
+    return { modes, diagnostics };
+}
+//# sourceMappingURL=registry.js.map

package/dist/src/output-modes/runtime.js

@@ -0,0 +1,64 @@
+function protectedPattern(classes) {
+    const set = new Set(classes);
+    const alternatives = [];
+    if (set.has('machine-readable-blocks') || set.has('code'))
+        alternatives.push('```[\\s\\S]*?```');
+    if (set.has('code') || set.has('commands'))
+        alternatives.push('`[^`\\n]+`');
+    if (set.has('quoted-text'))
+        alternatives.push('^>.*(?:\\n>.*)*', '“[^”]*”', '"[^"\\n]+"');
+    if (set.has('citations'))
+        alternatives.push('\\[[^\\]\\n]+\\]\\([^\\s)]+\\)', '\\[[0-9]+\\]');
+    if (set.has('identifiers'))
+        alternatives.push('\\b(?:[A-Za-z_$][\\w$]*\\.)+[A-Za-z_$][\\w$]*\\b', '\\b[A-Z][A-Z0-9_]{2,}\\b');
+    return alternatives.length ? new RegExp(alternatives.join('|'), 'gm') : null;
+}
+function protect(content, classes) {
+    const literals = [];
+    const pattern = protectedPattern(classes);
+    const protectedContent = pattern ? content.replace(pattern, value => {
+        const token = `\uE000${literals.length}\uE001`;
+        literals.push({ token, value });
+        return token;
+    }) : content;
+    return { content: protectedContent, literals };
+}
+function restore(content, literals, mode) {
+    let restored = content;
+    for (const literal of literals) {
+        if (!restored.includes(literal.token))
+            throw new Error(`Output mode '${mode}' modified or removed a protected literal.`);
+        restored = restored.replaceAll(literal.token, literal.value);
+    }
+    return restored;
+}
+export async function applyOutputModes(input, modes, options) {
+    if (modes.length === 0)
+        return { content: input, diagnostics: [], applied: [], fallback: 'none' };
+    let content = input;
+    const diagnostics = [];
+    const applied = [];
+    for (const mode of modes) {
+        const snapshot = content;
+        const masked = protect(content, mode.protectedContent ?? []);
+        const transformed = await options.transform(masked.content, mode);
+        content = restore(transformed, masked.literals, mode.id);
+        if (mode.validation.level !== 'advisory') {
+            if (!options.validate)
+                throw new Error(`Output mode '${mode.id}' declares ${mode.validation.level} validation but no validator is configured.`);
+            const result = await options.validate(content, mode);
+            if (!result.valid) {
+                diagnostics.push({ mode: mode.id, level: mode.validation.level, message: result.message ?? 'validation failed' });
+                if ((options.onMandatoryValidationFailure ?? 'unaltered') === 'fail')
+                    throw new Error(`Output mode '${mode.id}' validation failed: ${result.message ?? 'no diagnostic'}`);
+                return { content: input, diagnostics, applied, fallback: 'unaltered' };
+            }
+        }
+        // A transform may only change semantic presentation, never return an absent result.
+        if (typeof content !== 'string')
+            content = snapshot;
+        applied.push(mode.id);
+    }
+    return { content, diagnostics, applied, fallback: 'none' };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/src/output-modes/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/skills/run.js

@@ -148,6 +148,7 @@ export async function runSkill(opts) {
         AIWG_SKILL_DIR: skillDir,
         AIWG_PROJECT_ROOT: opts.cwd,
         ...(aiwgRoot ? { AIWG_ROOT: aiwgRoot } : {}),
+        ...opts.env,
     };
     const fullArgs = [...invocation.prefixArgs, entrypointPath, ...opts.args];
     return new Promise((resolve) => {
@@ -181,7 +182,7 @@ export async function runSkill(opts) {
  * Anything after `--` is verbatim-forwarded. If no `--`, all args after
  * the skill name are forwarded.
  */
-export async function main(args) {
+export async function main(args, env) {
     // First positional must be the kind ("skill" — reserved for future kinds).
     if (args.length === 0) {
         printUsage();
@@ -243,6 +244,7 @@ export async function main(args) {
         name,
         args: scriptArgs,
         cwdOverride,
+        env,
     });
 }
 function printUsage() {

package/dist/src/smiths/context-pipeline/aiwg-md.js

@@ -50,7 +50,7 @@ export async function buildAiwgMdContent(projectPath, stagedClaudeMdContent) {
     // #1362: parallelism cap section, injected after generation so it surfaces
     // in regenerated context files regardless of CLAUDE.md content.
     const parallelismSection = await buildParallelismSection(projectPath);
-    const finalizationBlock = await buildContextFinalizationBlock(projectPath);
+    const finalizationBlock = await buildContextFinalizationBlock(projectPath, path.join(projectPath, 'AIWG.md'));
     const externalLinksSection = await buildExternalLinksSection(projectPath);
     if (claudeMdContent) {
         // Insert the AIWG signature comment as the second line.

package/dist/src/smiths/context-pipeline/claude-hook.js

@@ -24,18 +24,30 @@ import * as path from 'path';
 import { buildProviderBootstrapBlock, PROVIDER_BOOTSTRAP_START, PROVIDER_BOOTSTRAP_END, } from './workspace-context.js';
 export const CLAUDE_HOOK_START = '<!-- AIWG:claude-md-hook:start -->';
 export const CLAUDE_HOOK_END = '<!-- AIWG:claude-md-hook:end -->';
-/**
- * The managed block that gets inserted into CLAUDE.md. Tells Claude Code
- * to load AIWG.md as the project context entry point. Kept short — the
- * actual context lives in AIWG.md.
- */
-export function buildClaudeHookBlock() {
+function buildClaudeArtifactOutputPolicy(policy = {}) {
+    const providerNative = policy.provider_native ?? 'explicit-only';
+    const design = policy.destinations?.['claude-code.design'];
+    const designEnabled = design?.enabled !== false && design?.use_when !== 'disabled';
+    return [
+        '## AIWG artifact output policy',
+        '',
+        `- Canonical durable artifacts: AIWG artifact store (policy: ${policy.canonical ?? 'aiwg'}).`,
+        `- Provider-native presentation/export: ${providerNative}.`,
+        `- Claude Design: ${designEnabled ? 'available only when explicitly selected by the resolved policy or requested by the user' : 'disabled by project policy'}.`,
+        '- Never substitute, relocate, or omit the canonical AIWG plan/review artifact because Claude adds or changes a provider default.',
+        '- When both canonical and presentation outputs are selected, write the canonical artifact first; treat Design as a derived export and record provenance linking it to the canonical source of truth.',
+        '- Unknown provider-native destinations fail safe with a diagnostic. Higher-authority project policy overrides user preferences; explicit task selection overrides provider defaults only within the project policy ceiling.',
+    ];
+}
+export function buildClaudeHookBlock(policy = {}) {
     return [
         CLAUDE_HOOK_START,
         '',
         buildProviderBootstrapBlock('claude'),
         '@.aiwg/aiwg.config',
         '',
+        ...buildClaudeArtifactOutputPolicy(policy),
+        '',
         '<!--',
         '  This block is managed by `aiwg regenerate` and `aiwg use`.',
         '  Operator content above and below this block is preserved on regenerate.',
@@ -57,7 +69,15 @@ export async function ensureClaudeMdHook(projectPath, opts = {}) {
         action: 'skipped',
         warnings: [],
     };
-    const block = buildClaudeHookBlock();
+    let policy = {};
+    try {
+        const config = JSON.parse(await fs.readFile(path.join(projectPath, '.aiwg', 'aiwg.config'), 'utf8'));
+        policy = config.artifact_outputs ?? {};
+    }
+    catch {
+        // Missing/legacy/temporarily malformed config receives the safe default.
+    }
+    const block = buildClaudeHookBlock(policy);
     // Case 1: CLAUDE.md does not exist — create a minimal one with just the block.
     let existing;
     try {

package/dist/src/smiths/context-pipeline/finalization.js

@@ -54,7 +54,21 @@ function displayProjectPath(projectPath, targetPath) {
         return relative;
     return targetPath;
 }
-export async function buildContextFinalizationBlock(projectPath) {
+function documentRelativeHref(projectPath, documentPath, targetPath) {
+    const absoluteDocument = path.isAbsolute(documentPath)
+        ? documentPath
+        : path.resolve(projectPath, documentPath);
+    const absoluteTarget = path.isAbsolute(targetPath)
+        ? targetPath
+        : path.resolve(projectPath, targetPath);
+    const relative = path.relative(path.dirname(absoluteDocument), absoluteTarget).replace(/\\/g, '/');
+    if (!relative)
+        return `./${path.basename(absoluteTarget)}`;
+    return relative.startsWith('./') || relative.startsWith('../')
+        ? relative
+        : `./${relative}`;
+}
+export async function buildContextFinalizationBlock(projectPath, documentPath = path.join(projectPath, 'AIWG.md')) {
     const config = await readConfig(projectPath);
     const remoteUrls = await readGitRemoteUrls(projectPath);
     const providers = config?.providers ?? [];
@@ -68,6 +82,7 @@ export async function buildContextFinalizationBlock(projectPath) {
             providerDeployments.add(provider);
         }
     }
+    const trackerAuthority = resolveTrackerAuthority(config, remoteUrls);
     const lines = [
         FINALIZATION_START,
         '## Context Finalization',
@@ -91,7 +106,9 @@ export async function buildContextFinalizationBlock(projectPath) {
         '',
         'When a user asks whether AIWG is active or engaged in this project, run or read `aiwg status --probe --json` and report the result plainly: engaged state, project root, deployed provider files, installed frameworks/addons, and the next action from the probe. Do not add AIWG attribution, signatures, generated-by text, or passive footers to user files, commits, PRs, comments, code headers, or docs.',
         '',
-        renderTrackerProtocol(resolveTrackerAuthority(config, remoteUrls)),
+        renderTrackerProtocol(trackerAuthority, {
+            configHref: documentRelativeHref(projectPath, documentPath, trackerAuthority.configPath),
+        }),
         '',
         '### Source Model',
         '',
@@ -112,7 +129,8 @@ export function replaceOrAppendFinalizationBlock(content, block) {
     return `${trimmed}\n\n${block}`;
 }
 export async function buildNormalizedAiwgMd(projectPath, existing = '') {
-    const block = await buildContextFinalizationBlock(projectPath);
+    const normalizedDocumentPath = projectControlPath(projectPath, 'AIWG.md');
+    const block = await buildContextFinalizationBlock(projectPath, normalizedDocumentPath);
     const externalLinksSection = await buildExternalLinksSection(projectPath);
     const normalizedAiwgMdPath = displayProjectPath(projectPath, projectControlPath(projectPath, 'AIWG.md'));
     const base = existing.trim().length > 0

package/dist/src/tracker/capability-protocol.js

@@ -54,6 +54,15 @@ export function resolveTrackerAuthority(config, remoteUrls = {}, configPath = '.
     const storageProvider = providerFromIssueStorage(issueStorage);
     const configuredProvider = remotes.issue_provider ? normalizeProvider(remotes.issue_provider) : 'unknown';
     const urlProvider = issueTrackerUrl ? normalizeProvider(resolveRemoteProvider(issueTrackerUrl)) : 'unknown';
+    const customerIssueTrackerUrl = remotes.customer_issue_tracker
+        ? remoteUrls[remotes.customer_issue_tracker]
+        : undefined;
+    const configuredCustomerProvider = remotes.customer_issue_provider
+        ? normalizeProvider(remotes.customer_issue_provider)
+        : 'unknown';
+    const customerUrlProvider = customerIssueTrackerUrl
+        ? normalizeProvider(resolveRemoteProvider(customerIssueTrackerUrl))
+        : 'unknown';
     return {
         configPath,
         primaryRemote: remotes.primary,
@@ -66,6 +75,13 @@ export function resolveTrackerAuthority(config, remoteUrls = {}, configPath = '.
             : storageProvider !== 'unknown'
                 ? storageProvider
                 : urlProvider,
+        ...(remotes.customer_issue_tracker ? {
+            customerIssueTrackerRemote: remotes.customer_issue_tracker,
+            customerIssueTrackerUrl,
+            customerProvider: configuredCustomerProvider !== 'unknown'
+                ? configuredCustomerProvider
+                : customerUrlProvider,
+        } : {}),
         secondaryRemotes: remotes.secondary,
     };
 }
@@ -91,7 +107,7 @@ export function chooseTrackerAccess(authority, probes) {
         ].join(' '),
     };
 }
-export function renderTrackerProtocol(authority) {
+export function renderTrackerProtocol(authority, options = {}) {
     const secondary = authority.secondaryRemotes.length > 0
         ? authority.secondaryRemotes
             .map((remote) => `${remote.name}${remote.purpose ? ` (${remote.purpose})` : ''}`)
@@ -99,11 +115,16 @@ export function renderTrackerProtocol(authority) {
         : 'none configured';
     const issueStorage = authority.issueStorage ?? 'not configured';
     const trackerUrl = authority.issueTrackerUrl ?? 'remote URL unavailable';
+    const customerTracker = authority.customerIssueTrackerRemote
+        ? `\`${authority.customerIssueTrackerRemote}\` (${authority.customerProvider ?? 'unknown'}; ${authority.customerIssueTrackerUrl ?? 'remote URL unavailable'})`
+        : 'not configured';
+    const configHref = options.configHref ?? `./${authority.configPath}`;
     return [
         '### Tracker Authority Protocol',
         '',
-        `- Source of truth: [${authority.configPath}](./${authority.configPath})`,
-        `- Canonical tracker: \`${authority.issueTrackerRemote}\` (${authority.provider}; ${trackerUrl})`,
+        `- Source of truth: [${authority.configPath}](${configHref})`,
+        `- Internal/canonical tracker: \`${authority.issueTrackerRemote}\` (${authority.provider}; ${trackerUrl})`,
+        `- Customer issue tracker: ${customerTracker}`,
         `- Primary repo remote: \`${authority.primaryRemote}\`; CI remote: \`${authority.ciRemote}\``,
         `- Secondary/mirror remotes: ${secondary}`,
         `- Issue storage mode: ${issueStorage}`,
@@ -115,6 +136,8 @@ export function renderTrackerProtocol(authority) {
         '4. Stop and report a blocker.',
         '',
         '- Project config decides tracker authority; installed/authenticated CLIs do not.',
+        '- Route internal engineering, delivery, and CI-sensitive issue work to the internal tracker.',
+        '- Route customer acknowledgements, follow-up, and closure to the customer tracker when configured.',
         '- Git SSH remote access is repository sync, not issue-tracker API access.',
         '- Do not file on mirror or secondary remotes just because their CLI is authenticated.',
         '- Treat an unauthenticated tracker CLI as one failed access path, then continue probing MCP/app/API before blocking.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.13",
+  "version": "2026.8.15",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",