@aiwg/cli 2026.8.14 → 2026.8.16

package/dist/src/artifacts/index-builder.js

@@ -17,30 +17,10 @@ import { DEFAULT_INDEX_EXTENSIONS, INDEX_EXTRACTOR_VERSION, INDEX_VERSION, INDEX
 import { parseCitationSidecar, citationResultToEdges, buildRefToPathMap } from './citation-parser.js';
 import { writeIndexFile, resolveIndexDir, loadGraphIndexFile } from './index-reader.js';
 import { loadManifest, writeManifest, statMatches, makeEntry } from './checksum-manifest.js';
-import { workspaceLinkedFiles } from '../smiths/context-pipeline/workspace-context.js';
 import { normalizeOperationalState } from './operational-state.js';
 import { DEFAULT_PROJECT_AIWG_DIR, resolveProjectAiwgDir, } from '../config/project-artifacts.js';
 import { normalizeStateTransferProjection } from './state-transfer.js';
-function pathContains(parent, child) {
-    const relative = path.relative(parent, child);
-    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
-}
-function toPosixPath(value) {
-    return value.split(path.sep).join('/');
-}
-function indexPathFor(cwd, fullPath, graph) {
-    if (!graph || graph === 'project') {
-        const artifactRoot = resolveProjectAiwgDir(cwd);
-        if (pathContains(artifactRoot, fullPath)) {
-            const relative = toPosixPath(path.relative(artifactRoot, fullPath));
-            return relative ? `${DEFAULT_PROJECT_AIWG_DIR}/${relative}` : DEFAULT_PROJECT_AIWG_DIR;
-        }
-    }
-    const rel = path.relative(cwd, fullPath);
-    if (!rel.startsWith('..') && !path.isAbsolute(rel))
-        return toPosixPath(rel);
-    return fullPath;
-}
+import { collectGraphIndexFiles, findArtifactFiles, indexPathFor } from './index-files.js';
 function absoluteEntryPath(cwd, entryPath, graph) {
     if ((!graph || graph === 'project') && entryPath.startsWith(`${DEFAULT_PROJECT_AIWG_DIR}/`)) {
         return path.join(resolveProjectAiwgDir(cwd), entryPath.slice(DEFAULT_PROJECT_AIWG_DIR.length + 1));
@@ -587,31 +567,6 @@ function applyMetadataSupplements(entries, supplements, cwd) {
         }
     }
 }
-/**
- * Recursively find all indexable files under a directory
- */
-function findArtifactFiles(dir, extensions = [...DEFAULT_INDEX_EXTENSIONS]) {
-    const results = [];
-    if (!fs.existsSync(dir))
-        return results;
-    const entries = fs.readdirSync(dir, { withFileTypes: true });
-    for (const entry of entries) {
-        const fullPath = path.join(dir, entry.name);
-        if (entry.isSymbolicLink() && !fs.existsSync(fullPath)) {
-            continue;
-        }
-        if (entry.isDirectory()) {
-            // Skip hidden dirs and .index
-            if (entry.name.startsWith('.'))
-                continue;
-            results.push(...findArtifactFiles(fullPath, extensions));
-        }
-        else if (extensions.some(ext => entry.name.endsWith(ext))) {
-            results.push(fullPath);
-        }
-    }
-    return results;
-}
 /**
  * Build the artifact index
  */
@@ -798,24 +753,9 @@ export async function buildIndex(cwd, options = {}) {
         pruned: 0,
     };
     // Collect files from all scan directories
-    const files = [];
-    for (const dir of existingDirs) {
-        files.push(...findArtifactFiles(dir, fileExtensions));
-    }
-    // WORKSPACE.md is the root of the project context graph. Index it and its
-    // local Markdown-linked nodes without copying them into provider trees.
-    if (!scope && (!graph || graph === 'project')) {
-        const workspacePath = path.join(cwd, 'WORKSPACE.md');
-        const contextFiles = [
-            ...(fs.existsSync(workspacePath) ? [workspacePath] : []),
-            ...await workspaceLinkedFiles(cwd),
-        ];
-        for (const contextFile of contextFiles) {
-            if (fileExtensions.some((extension) => contextFile.endsWith(extension)) && !files.includes(contextFile)) {
-                files.push(contextFile);
-            }
-        }
-    }
+    const files = scope
+        ? existingDirs.flatMap(dir => findArtifactFiles(dir, fileExtensions))
+        : await collectGraphIndexFiles(cwd, graph);
     const entries = {};
     const tagIndex = {};
     const depGraph = {};

package/dist/src/artifacts/index-files.js

@@ -0,0 +1,80 @@
+/**
+ * Shared artifact source-file enumeration.
+ *
+ * Index builds and coverage reporting must use the same file set so project
+ * context files cannot inflate the indexed count beyond the reported total.
+ *
+ * @implements jmagly/aiwg#146
+ */
+import fs from 'fs';
+import path from 'path';
+import { DEFAULT_INDEX_EXTENSIONS, GRAPH_CONFIGS, resolveGraphScanDir, } from './types.js';
+import { DEFAULT_PROJECT_AIWG_DIR, resolveProjectAiwgDir, } from '../config/project-artifacts.js';
+import { workspaceLinkedFiles } from '../smiths/context-pipeline/workspace-context.js';
+function pathContains(parent, child) {
+    const relative = path.relative(parent, child);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+function toPosixPath(value) {
+    return value.split(path.sep).join('/');
+}
+export function indexPathFor(cwd, fullPath, graph) {
+    if (!graph || graph === 'project') {
+        const artifactRoot = resolveProjectAiwgDir(cwd);
+        if (pathContains(artifactRoot, fullPath)) {
+            const relative = toPosixPath(path.relative(artifactRoot, fullPath));
+            return relative ? `${DEFAULT_PROJECT_AIWG_DIR}/${relative}` : DEFAULT_PROJECT_AIWG_DIR;
+        }
+    }
+    const relative = path.relative(cwd, fullPath);
+    if (!relative.startsWith('..') && !path.isAbsolute(relative))
+        return toPosixPath(relative);
+    return fullPath;
+}
+/** Recursively find indexable files, excluding hidden directories such as .index. */
+export function findArtifactFiles(dir, extensions = DEFAULT_INDEX_EXTENSIONS) {
+    const results = [];
+    if (!fs.existsSync(dir))
+        return results;
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isSymbolicLink() && !fs.existsSync(fullPath))
+            continue;
+        if (entry.isDirectory()) {
+            if (entry.name.startsWith('.'))
+                continue;
+            results.push(...findArtifactFiles(fullPath, extensions));
+        }
+        else if (extensions.some(extension => entry.name.endsWith(extension))) {
+            results.push(fullPath);
+        }
+    }
+    return results;
+}
+/** Return the exact current source-file set used by a standard graph build. */
+export async function collectGraphIndexFiles(cwd, graph) {
+    const config = graph ? GRAPH_CONFIGS[graph] : undefined;
+    const scanDirs = config
+        ? config.scanDirs.map(directory => resolveGraphScanDir(cwd, directory))
+        : [resolveProjectAiwgDir(cwd)];
+    const extensions = config?.extensions ?? [...DEFAULT_INDEX_EXTENSIONS];
+    const files = new Set();
+    for (const scanDir of scanDirs) {
+        for (const file of findArtifactFiles(scanDir, extensions))
+            files.add(file);
+    }
+    if (!graph || graph === 'project') {
+        const workspacePath = path.join(cwd, 'WORKSPACE.md');
+        const contextFiles = [
+            ...(fs.existsSync(workspacePath) ? [workspacePath] : []),
+            ...await workspaceLinkedFiles(cwd),
+        ];
+        for (const contextFile of contextFiles) {
+            if (extensions.some(extension => contextFile.endsWith(extension)))
+                files.add(contextFile);
+        }
+    }
+    return [...files];
+}
+//# sourceMappingURL=index-files.js.map

package/dist/src/artifacts/stats.js

@@ -7,40 +7,23 @@
  * @source @src/artifacts/types.ts
  * @tests @test/unit/artifacts/stats.test.ts
  */
-import fs from 'fs';
-import path from 'path';
-import { GRAPH_CONFIGS, loadUserGraphConfigs, resolveGraphScanDir } from './types.js';
+import { GRAPH_CONFIGS, loadUserGraphConfigs } from './types.js';
 import { loadIndexStats, loadGraphIndexFile } from './index-reader.js';
-/**
- * Count total indexable files under scan directories (excluding .index/)
- */
-function countArtifactFiles(cwd, graphType) {
-    const config = graphType ? GRAPH_CONFIGS[graphType] : undefined;
-    const scanDirs = config
-        ? config.scanDirs.map(d => resolveGraphScanDir(cwd, d))
-        : [resolveGraphScanDir(cwd, '.aiwg')];
-    const extensions = config?.extensions ?? ['.md', '.yaml', '.json'];
-    let count = 0;
-    function walk(dir) {
-        if (!fs.existsSync(dir))
-            return;
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                if (entry.name.startsWith('.'))
-                    continue; // Skip .index, etc.
-                walk(full);
-            }
-            else if (extensions.some(ext => entry.name.endsWith(ext))) {
-                count++;
-            }
-        }
-    }
-    for (const dir of scanDirs) {
-        walk(dir);
-    }
-    return count;
+import { collectGraphIndexFiles, indexPathFor } from './index-files.js';
+/** Calculate coverage over the same current file set used by the index builder. */
+async function calculateCoverage(cwd, stats, graphType) {
+    const sourcePaths = new Set((await collectGraphIndexFiles(cwd, graphType))
+        .map(file => indexPathFor(cwd, file, graphType)));
+    const index = loadGraphIndexFile(cwd, 'metadata.json', graphType);
+    const indexed = index
+        ? Object.keys(index.entries).filter(entryPath => sourcePaths.has(entryPath)).length
+        : Math.min(stats.totalArtifacts, sourcePaths.size);
+    const totalFiles = sourcePaths.size;
+    return {
+        indexed,
+        totalFiles,
+        percentage: totalFiles > 0 ? Math.round((indexed / totalFiles) * 100) : 100,
+    };
 }
 /**
  * Show artifact index statistics
@@ -84,14 +67,10 @@ export async function showStats(cwd, options = {}) {
         // JSON mode: aggregate all graphs into one response
         const combined = {};
         for (const { type, stats: s } of availableGraphs) {
-            const totalFiles = countArtifactFiles(cwd, type);
+            const coverage = await calculateCoverage(cwd, s, type);
             combined[type] = {
                 ...s,
-                coverage: {
-                    indexed: s.totalArtifacts,
-                    totalFiles,
-                    percentage: totalFiles > 0 ? Math.round((s.totalArtifacts / totalFiles) * 100) : 100,
-                },
+                coverage,
             };
         }
         console.log(JSON.stringify(combined, null, 2));
@@ -108,14 +87,10 @@ export async function showStats(cwd, options = {}) {
  */
 async function renderStats(cwd, stats, options, graphType) {
     if (options.json) {
-        const totalFiles = countArtifactFiles(cwd, graphType);
+        const coverage = await calculateCoverage(cwd, stats, graphType);
         console.log(JSON.stringify({
             ...stats,
-            coverage: {
-                indexed: stats.totalArtifacts,
-                totalFiles,
-                percentage: totalFiles > 0 ? Math.round((stats.totalArtifacts / totalFiles) * 100) : 100,
-            },
+            coverage,
         }, null, 2));
         return;
     }
@@ -167,11 +142,8 @@ async function renderStats(cwd, stats, options, graphType) {
     }
     console.log('');
     // Coverage
-    const totalFiles = countArtifactFiles(cwd, graphType);
-    const coverage = totalFiles > 0
-        ? Math.round((stats.totalArtifacts / totalFiles) * 100)
-        : 100;
+    const coverage = await calculateCoverage(cwd, stats, graphType);
     console.log('Index Health:');
-    console.log(`  Coverage: ${stats.totalArtifacts}/${totalFiles} artifacts indexed (${coverage}%)`);
+    console.log(`  Coverage: ${coverage.indexed}/${coverage.totalFiles} artifacts indexed (${coverage.percentage}%)`);
 }
 //# sourceMappingURL=stats.js.map

package/dist/src/cli/handlers/setup.js

@@ -68,8 +68,10 @@ export function parseSetupProjectOptions(ctx) {
         nonInteractive: boolFlag(args, '--non-interactive') || boolFlag(args, '--yes'),
         primary: flagValue(args, '--primary'),
         issueTracker: flagValue(args, '--issue-tracker'),
+        customerIssueTracker: flagValue(args, '--customer-issue-tracker'),
         ci: flagValue(args, '--ci'),
         issueProvider: parseEnum(flagValue(args, '--issue-provider'), ISSUE_PROVIDERS, '--issue-provider'),
+        customerIssueProvider: parseEnum(flagValue(args, '--customer-issue-provider'), ISSUE_PROVIDERS, '--customer-issue-provider'),
         deliveryMode: parseEnum(flagValue(args, '--delivery-mode'), DELIVERY_MODES, '--delivery-mode'),
         defaultBranch: flagValue(args, '--default-branch'),
         requireCiGreen: parseBooleanFlag(args, '--require-ci-green'),
@@ -84,6 +86,8 @@ export function parseSetupProjectOptions(ctx) {
         signingEnforce: parseEnum(flagValue(args, '--signing-enforce'), ['commits', 'tags', 'all'], '--signing-enforce'),
         trackerActorLogin: flagValue(args, '--tracker-actor-login'),
         trackerActorVia: parseEnum(flagValue(args, '--tracker-actor-via'), TRACKER_VIA, '--tracker-actor-via'),
+        customerTrackerActorLogin: flagValue(args, '--customer-tracker-actor-login'),
+        customerTrackerActorVia: parseEnum(flagValue(args, '--customer-tracker-actor-via'), TRACKER_VIA, '--customer-tracker-actor-via'),
         providers: parseStringList(flagValue(args, '--providers')),
     };
 }
@@ -201,6 +205,12 @@ function validateSetupConfig(config, remotes, issueProvider) {
     if (config.remotes?.issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.issue_provider)) {
         errors.push('remotes.issue_provider is invalid');
     }
+    if (config.remotes?.customer_issue_tracker) {
+        checkRemote('remotes.customer_issue_tracker', config.remotes.customer_issue_tracker);
+    }
+    if (config.remotes?.customer_issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.customer_issue_provider)) {
+        errors.push('remotes.customer_issue_provider is invalid');
+    }
     checkRemote('remotes.ci', config.remotes?.ci);
     if (!DELIVERY_MODES.includes(config.delivery?.mode))
         errors.push('delivery.mode is invalid');
@@ -217,6 +227,9 @@ function validateSetupConfig(config, remotes, issueProvider) {
     if (config.remotes?.tracker_actor?.via && !TRACKER_VIA.includes(config.remotes.tracker_actor.via)) {
         errors.push('remotes.tracker_actor.via is invalid');
     }
+    if (config.remotes?.customer_tracker_actor?.via && !TRACKER_VIA.includes(config.remotes.customer_tracker_actor.via)) {
+        errors.push('remotes.customer_tracker_actor.via is invalid');
+    }
     if (!config.providers.every(p => VALID_PROVIDERS.includes(p))) {
         errors.push('providers contains an unknown AIWG provider');
     }
@@ -237,11 +250,15 @@ export async function buildSetupProjectPlan(options) {
         ? 'local'
         : options.issueTracker ?? base.remotes?.issue_tracker ?? primary;
     const ci = options.ci ?? base.remotes?.ci ?? primary;
+    const customerIssueTracker = options.customerIssueTracker ?? base.remotes?.customer_issue_tracker;
+    const customerIssueProvider = options.customerIssueProvider ?? base.remotes?.customer_issue_provider;
     const remotesConfig = {
         primary,
         issue_tracker: issueTracker,
         issue_provider: issueProvider,
         ci,
+        ...(customerIssueTracker ? { customer_issue_tracker: customerIssueTracker } : {}),
+        ...(customerIssueProvider ? { customer_issue_provider: customerIssueProvider } : {}),
         secondary: base.remotes?.secondary ?? secondaryRemotes(remotes, primary, issueTracker, ci),
     };
     const trackerLogin = options.trackerActorLogin ?? base.remotes?.tracker_actor?.login;
@@ -253,6 +270,16 @@ export async function buildSetupProjectPlan(options) {
             ...(trackerVia ? { via: trackerVia } : {}),
         };
     }
+    const customerTrackerLogin = options.customerTrackerActorLogin ?? base.remotes?.customer_tracker_actor?.login;
+    const customerTrackerVia = options.customerTrackerActorVia ?? base.remotes?.customer_tracker_actor?.via
+        ?? (customerIssueProvider === 'github' ? 'gh' : customerIssueProvider === 'gitea' ? 'tea' : undefined);
+    if (customerTrackerLogin || customerTrackerVia || base.remotes?.customer_tracker_actor?.forbid_actors) {
+        remotesConfig.customer_tracker_actor = {
+            ...(base.remotes?.customer_tracker_actor ?? {}),
+            ...(customerTrackerLogin ? { login: customerTrackerLogin } : {}),
+            ...(customerTrackerVia ? { via: customerTrackerVia } : {}),
+        };
+    }
     const existingDelivery = base.delivery ?? {};
     const delivery = {
         ...existingDelivery,

package/dist/src/config/aiwg-config.js

@@ -478,6 +478,7 @@ export function resolveRemoteProvider(remoteUrl) {
  * Defaults:
  *   - `primary` defaults to "origin"
  *   - `issue_tracker` defaults to `primary`
+ *   - customer tracker fields remain unset unless explicitly configured
  *   - `ci` defaults to `primary`
  *   - `secondary` defaults to `[]`
  *
@@ -491,6 +492,9 @@ export function resolveRemotes(remotes) {
         issue_provider: remotes?.issue_provider,
         ci: remotes?.ci ?? primary,
         tracker_actor: remotes?.tracker_actor,
+        customer_issue_tracker: remotes?.customer_issue_tracker,
+        customer_issue_provider: remotes?.customer_issue_provider,
+        customer_tracker_actor: remotes?.customer_tracker_actor,
         transport: remotes?.transport,
         secondary: remotes?.secondary ?? [],
     };

package/dist/src/config/cli.js

@@ -151,7 +151,9 @@ const ENUM_RULES = {
     'delivery.release_signing.format': ['openpgp', 'ssh', 'x509'],
     'delivery.release_signing.enforce': ['commits', 'tags', 'all'],
     'remotes.issue_provider': ['gitea', 'github', 'local'],
+    'remotes.customer_issue_provider': ['gitea', 'github', 'local'],
     'remotes.tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
+    'remotes.customer_tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
     'remotes.transport.protocol': ['ssh', 'https'],
     'repo_maintainer.tiers.local': ['collaborator', 'maintainer', 'admin'],
     'security.threatAssessment.mode': ['off', 'audit', 'enforce'],
@@ -169,6 +171,7 @@ const BOOLEAN_FIELDS = new Set([
 ]);
 const STRING_ARRAY_FIELDS = new Set([
     'remotes.tracker_actor.forbid_actors',
+    'remotes.customer_tracker_actor.forbid_actors',
     'command_log.scopes',
     'telemetry.skill_usage.scopes',
 ]);
@@ -592,6 +595,9 @@ For project-level config: aiwg config show --project [--json]
     const remotesView = {
         primary: { name: resolvedRemotes.primary, url: getUrl(resolvedRemotes.primary) },
         issue_tracker: { name: resolvedRemotes.issue_tracker, url: getUrl(resolvedRemotes.issue_tracker) },
+        customer_issue_tracker: resolvedRemotes.customer_issue_tracker
+            ? { name: resolvedRemotes.customer_issue_tracker, url: getUrl(resolvedRemotes.customer_issue_tracker) }
+            : null,
         ci: { name: resolvedRemotes.ci, url: getUrl(resolvedRemotes.ci) },
         secondary: resolvedRemotes.secondary.map((s) => ({
             ...s,
@@ -653,7 +659,10 @@ For project-level config: aiwg config show --project [--json]
     };
     console.log(fmt('Primary       ', remotesView.primary));
     if (remotesView.issue_tracker.name !== remotesView.primary.name) {
-        console.log(fmt('Issue tracker ', remotesView.issue_tracker));
+        console.log(fmt('Internal issues', remotesView.issue_tracker));
+    }
+    if (remotesView.customer_issue_tracker) {
+        console.log(fmt('Customer issues', remotesView.customer_issue_tracker));
     }
     if (remotesView.ci.name !== remotesView.primary.name) {
         console.log(fmt('CI            ', remotesView.ci));

package/dist/src/config/workspace.js

@@ -119,8 +119,7 @@ async function resolveEndpoint(repoPath, remote, providerHint) {
                 : 'unknown',
     };
 }
-function trackerProviderHint(remotes, fallback) {
-    const configured = remotes.issue_provider;
+function providerHint(configured, fallback) {
     if (configured === 'gitea' || configured === 'github')
         return configured;
     return fallback;
@@ -130,10 +129,14 @@ async function resolveMember(entry, workspaceRoot) {
     const configPath = getConfigPath(memberPath);
     const config = await readAiwgConfig(memberPath);
     const remotes = resolveRemotes(config?.remotes);
-    const issueProviderHint = trackerProviderHint(remotes, entry.provider);
-    const [primary, issueTracker, ci] = await Promise.all([
+    const issueProviderHint = providerHint(remotes.issue_provider, entry.provider);
+    const customerProviderHint = providerHint(remotes.customer_issue_provider);
+    const [primary, issueTracker, customerIssueTracker, ci] = await Promise.all([
         resolveEndpoint(memberPath, remotes.primary, entry.provider),
         resolveEndpoint(memberPath, remotes.issue_tracker, issueProviderHint),
+        remotes.customer_issue_tracker
+            ? resolveEndpoint(memberPath, remotes.customer_issue_tracker, customerProviderHint)
+            : Promise.resolve(undefined),
         resolveEndpoint(memberPath, remotes.ci, entry.provider),
     ]);
     const drift = [];
@@ -145,12 +148,18 @@ async function resolveMember(entry, workspaceRoot) {
         drift.push(`primary remote '${remotes.primary}' is unavailable`);
     if (!issueTracker.url)
         drift.push(`issue tracker remote '${remotes.issue_tracker}' is unavailable`);
+    if (remotes.customer_issue_tracker && !customerIssueTracker?.url) {
+        drift.push(`customer issue tracker remote '${remotes.customer_issue_tracker}' is unavailable`);
+    }
     if (primary.provider === 'unknown') {
         drift.push(`primary remote provider is unknown for '${primary.domain ?? remotes.primary}'`);
     }
     if (issueTracker.provider === 'unknown') {
         drift.push(`issue tracker provider is unknown for '${issueTracker.domain ?? remotes.issue_tracker}'`);
     }
+    if (customerIssueTracker?.provider === 'unknown') {
+        drift.push(`customer issue tracker provider is unknown for '${customerIssueTracker.domain ?? remotes.customer_issue_tracker}'`);
+    }
     if (entry.allowed.includes('issue-comment') && !remotes.tracker_actor?.login) {
         drift.push('issue-comment is allowed but remotes.tracker_actor.login is missing');
     }
@@ -158,6 +167,10 @@ async function resolveMember(entry, workspaceRoot) {
         && remotes.tracker_actor.forbid_actors?.includes(remotes.tracker_actor.login)) {
         drift.push(`configured tracker actor '${remotes.tracker_actor.login}' is also forbidden`);
     }
+    if (remotes.customer_tracker_actor?.login
+        && remotes.customer_tracker_actor.forbid_actors?.includes(remotes.customer_tracker_actor.login)) {
+        drift.push(`configured customer tracker actor '${remotes.customer_tracker_actor.login}' is also forbidden`);
+    }
     if (config?.delivery?.signing?.enforce
         && !config.delivery.signing.key
         && !config.delivery.signing.key_file) {
@@ -177,6 +190,7 @@ async function resolveMember(entry, workspaceRoot) {
         remotes,
         primary,
         issueTracker,
+        ...(customerIssueTracker ? { customerIssueTracker } : {}),
         ci,
         drift,
     };
@@ -251,33 +265,35 @@ export async function authorizeWorkspaceOperation(startPath, targetPath, action,
     };
 }
 /** Enforce the member config tracker_actor + forbid_actors contract. */
-export function checkTrackerActor(member, actualActor) {
-    const configured = member.remotes.tracker_actor;
+export function checkTrackerActor(member, actualActor, role = 'internal') {
+    const configured = role === 'customer'
+        ? member.remotes.customer_tracker_actor
+        : member.remotes.tracker_actor;
     const actor = actualActor ?? configured?.login;
     if (!actor) {
         return {
             allowed: false,
-            reason: `repo '${member.name}' does not resolve a tracker actor`,
+            reason: `repo '${member.name}' does not resolve a ${role} tracker actor`,
         };
     }
     if (configured?.forbid_actors?.includes(actor)) {
         return {
             allowed: false,
             actor,
-            reason: `tracker actor '${actor}' is forbidden by repo '${member.name}'`,
+            reason: `${role} tracker actor '${actor}' is forbidden by repo '${member.name}'`,
         };
     }
     if (actualActor && configured?.login && actualActor !== configured.login) {
         return {
             allowed: false,
             actor,
-            reason: `tracker actor '${actualActor}' does not match configured actor '${configured.login}'`,
+            reason: `${role} tracker actor '${actualActor}' does not match configured actor '${configured.login}'`,
         };
     }
     return {
         allowed: true,
         actor,
-        reason: `tracker actor '${actor}' is allowed for repo '${member.name}'`,
+        reason: `${role} tracker actor '${actor}' is allowed for repo '${member.name}'`,
     };
 }
 //# sourceMappingURL=workspace.js.map

package/dist/src/smiths/context-pipeline/aiwg-md.js

@@ -50,7 +50,7 @@ export async function buildAiwgMdContent(projectPath, stagedClaudeMdContent) {
     // #1362: parallelism cap section, injected after generation so it surfaces
     // in regenerated context files regardless of CLAUDE.md content.
     const parallelismSection = await buildParallelismSection(projectPath);
-    const finalizationBlock = await buildContextFinalizationBlock(projectPath);
+    const finalizationBlock = await buildContextFinalizationBlock(projectPath, path.join(projectPath, 'AIWG.md'));
     const externalLinksSection = await buildExternalLinksSection(projectPath);
     if (claudeMdContent) {
         // Insert the AIWG signature comment as the second line.

package/dist/src/smiths/context-pipeline/finalization.js

@@ -54,7 +54,21 @@ function displayProjectPath(projectPath, targetPath) {
         return relative;
     return targetPath;
 }
-export async function buildContextFinalizationBlock(projectPath) {
+function documentRelativeHref(projectPath, documentPath, targetPath) {
+    const absoluteDocument = path.isAbsolute(documentPath)
+        ? documentPath
+        : path.resolve(projectPath, documentPath);
+    const absoluteTarget = path.isAbsolute(targetPath)
+        ? targetPath
+        : path.resolve(projectPath, targetPath);
+    const relative = path.relative(path.dirname(absoluteDocument), absoluteTarget).replace(/\\/g, '/');
+    if (!relative)
+        return `./${path.basename(absoluteTarget)}`;
+    return relative.startsWith('./') || relative.startsWith('../')
+        ? relative
+        : `./${relative}`;
+}
+export async function buildContextFinalizationBlock(projectPath, documentPath = path.join(projectPath, 'AIWG.md')) {
     const config = await readConfig(projectPath);
     const remoteUrls = await readGitRemoteUrls(projectPath);
     const providers = config?.providers ?? [];
@@ -68,6 +82,7 @@ export async function buildContextFinalizationBlock(projectPath) {
             providerDeployments.add(provider);
         }
     }
+    const trackerAuthority = resolveTrackerAuthority(config, remoteUrls);
     const lines = [
         FINALIZATION_START,
         '## Context Finalization',
@@ -91,7 +106,9 @@ export async function buildContextFinalizationBlock(projectPath) {
         '',
         'When a user asks whether AIWG is active or engaged in this project, run or read `aiwg status --probe --json` and report the result plainly: engaged state, project root, deployed provider files, installed frameworks/addons, and the next action from the probe. Do not add AIWG attribution, signatures, generated-by text, or passive footers to user files, commits, PRs, comments, code headers, or docs.',
         '',
-        renderTrackerProtocol(resolveTrackerAuthority(config, remoteUrls)),
+        renderTrackerProtocol(trackerAuthority, {
+            configHref: documentRelativeHref(projectPath, documentPath, trackerAuthority.configPath),
+        }),
         '',
         '### Source Model',
         '',
@@ -112,7 +129,8 @@ export function replaceOrAppendFinalizationBlock(content, block) {
     return `${trimmed}\n\n${block}`;
 }
 export async function buildNormalizedAiwgMd(projectPath, existing = '') {
-    const block = await buildContextFinalizationBlock(projectPath);
+    const normalizedDocumentPath = projectControlPath(projectPath, 'AIWG.md');
+    const block = await buildContextFinalizationBlock(projectPath, normalizedDocumentPath);
     const externalLinksSection = await buildExternalLinksSection(projectPath);
     const normalizedAiwgMdPath = displayProjectPath(projectPath, projectControlPath(projectPath, 'AIWG.md'));
     const base = existing.trim().length > 0

package/dist/src/tracker/capability-protocol.js

@@ -54,6 +54,15 @@ export function resolveTrackerAuthority(config, remoteUrls = {}, configPath = '.
     const storageProvider = providerFromIssueStorage(issueStorage);
     const configuredProvider = remotes.issue_provider ? normalizeProvider(remotes.issue_provider) : 'unknown';
     const urlProvider = issueTrackerUrl ? normalizeProvider(resolveRemoteProvider(issueTrackerUrl)) : 'unknown';
+    const customerIssueTrackerUrl = remotes.customer_issue_tracker
+        ? remoteUrls[remotes.customer_issue_tracker]
+        : undefined;
+    const configuredCustomerProvider = remotes.customer_issue_provider
+        ? normalizeProvider(remotes.customer_issue_provider)
+        : 'unknown';
+    const customerUrlProvider = customerIssueTrackerUrl
+        ? normalizeProvider(resolveRemoteProvider(customerIssueTrackerUrl))
+        : 'unknown';
     return {
         configPath,
         primaryRemote: remotes.primary,
@@ -66,6 +75,13 @@ export function resolveTrackerAuthority(config, remoteUrls = {}, configPath = '.
             : storageProvider !== 'unknown'
                 ? storageProvider
                 : urlProvider,
+        ...(remotes.customer_issue_tracker ? {
+            customerIssueTrackerRemote: remotes.customer_issue_tracker,
+            customerIssueTrackerUrl,
+            customerProvider: configuredCustomerProvider !== 'unknown'
+                ? configuredCustomerProvider
+                : customerUrlProvider,
+        } : {}),
         secondaryRemotes: remotes.secondary,
     };
 }
@@ -91,7 +107,7 @@ export function chooseTrackerAccess(authority, probes) {
         ].join(' '),
     };
 }
-export function renderTrackerProtocol(authority) {
+export function renderTrackerProtocol(authority, options = {}) {
     const secondary = authority.secondaryRemotes.length > 0
         ? authority.secondaryRemotes
             .map((remote) => `${remote.name}${remote.purpose ? ` (${remote.purpose})` : ''}`)
@@ -99,11 +115,16 @@ export function renderTrackerProtocol(authority) {
         : 'none configured';
     const issueStorage = authority.issueStorage ?? 'not configured';
     const trackerUrl = authority.issueTrackerUrl ?? 'remote URL unavailable';
+    const customerTracker = authority.customerIssueTrackerRemote
+        ? `\`${authority.customerIssueTrackerRemote}\` (${authority.customerProvider ?? 'unknown'}; ${authority.customerIssueTrackerUrl ?? 'remote URL unavailable'})`
+        : 'not configured';
+    const configHref = options.configHref ?? `./${authority.configPath}`;
     return [
         '### Tracker Authority Protocol',
         '',
-        `- Source of truth: [${authority.configPath}](./${authority.configPath})`,
-        `- Canonical tracker: \`${authority.issueTrackerRemote}\` (${authority.provider}; ${trackerUrl})`,
+        `- Source of truth: [${authority.configPath}](${configHref})`,
+        `- Internal/canonical tracker: \`${authority.issueTrackerRemote}\` (${authority.provider}; ${trackerUrl})`,
+        `- Customer issue tracker: ${customerTracker}`,
         `- Primary repo remote: \`${authority.primaryRemote}\`; CI remote: \`${authority.ciRemote}\``,
         `- Secondary/mirror remotes: ${secondary}`,
         `- Issue storage mode: ${issueStorage}`,
@@ -115,6 +136,8 @@ export function renderTrackerProtocol(authority) {
         '4. Stop and report a blocker.',
         '',
         '- Project config decides tracker authority; installed/authenticated CLIs do not.',
+        '- Route internal engineering, delivery, and CI-sensitive issue work to the internal tracker.',
+        '- Route customer acknowledgements, follow-up, and closure to the customer tracker when configured.',
         '- Git SSH remote access is repository sync, not issue-tracker API access.',
         '- Do not file on mirror or secondary remotes just because their CLI is authenticated.',
         '- Treat an unauthenticated tracker CLI as one failed access path, then continue probing MCP/app/API before blocking.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.14",
+  "version": "2026.8.16",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",