aiwg 2026.7.13 → 2026.7.15

package/agentic/code/addons/agent-loop/agents/mc-conductor.md

@@ -1,7 +1,7 @@
 ---
 name: mc-conductor
 description: Mission Control conductor — orchestrates parallel background missions, handles completions and failures, reports to the user
-model: claude-sonnet-4-6
+model: haiku
 tools:
   - Bash
   - Read
@@ -13,6 +13,8 @@ skills:
   - mission-control
   - project-awareness
 category: orchestration
+model-role: efficiency
+model-tier: economy
 ---
 
 # MC Conductor

package/agentic/code/addons/agent-loop/agents/ralph-loop.md

@@ -3,9 +3,11 @@ id: ralph-loop
 name: Agent Loop Orchestrator
 role: orchestrator
 tier: reasoning
-model: claude-opus-4-7
+model: haiku
 description: Orchestrates iterative AI task execution loops with automatic recovery until completion criteria are met
 allowed-tools: Task, Read, Write, Bash, Glob, Grep, TodoWrite, Edit
+model-role: efficiency
+model-tier: economy
 ---
 
 # Agent Loop Orchestrator

package/agentic/code/addons/agent-loop/agents/ralph-verifier.md

@@ -3,9 +3,11 @@ id: ralph-verifier
 name: Al Verifier
 role: validator
 tier: efficiency
-model: claude-haiku-4-5
+model: haiku
 description: Validates agent loop completion criteria by executing verification commands and parsing results
 allowed-tools: Bash, Read, Glob
+model-role: efficiency
+model-tier: economy
 ---
 
 # Al Verifier

package/agentic/code/addons/agent-loop/skills/agent-loop-ext/SKILL.md

@@ -7,10 +7,12 @@ description: Crash-resilient external agent loop with state persistence and CI/C
 commandHint:
   argumentHint: "\"<objective>\" [--completion \"<criteria>\"] [--max-iterations N] [--timeout M] [--provider <p>] [--no-commit] [--branch <name>] [--quiet] [--auto-criteria | --no-infer-completion]"
   allowedTools: Bash, Read, Write
-  model: sonnet
+  model: haiku
   category: automation
   orchestration: true
   platforms: [claude-code, hermes, openclaw]
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 <!-- AIWG-SKILL-CALLOUT -->

package/agentic/code/addons/agent-loop/skills/infer-completion-criteria/SKILL.md

@@ -7,8 +7,10 @@ description: Infer measurable completion criteria for an agent-loop task from pr
 commandHint:
   argumentHint: '"<task description>" [--task-type code|test|docs|refactor] [--non-interactive]'
   allowedTools: "Read, Glob, Grep, Bash"
-  model: sonnet
+  model: haiku
   category: automation
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Infer Completion Criteria

package/agentic/code/addons/agent-loop/skills/ralph/SKILL.md

@@ -13,9 +13,11 @@ triggers:
 commandHint:
   argumentHint: '"<task>" [--completion "<criteria>"] [--max-iterations N] [--timeout M] [--interactive --guidance "text"] [--auto-criteria | --no-infer-completion]'
   allowedTools: "Task, Read, Write, Bash, Glob, Grep, TodoWrite, Edit"
-  model: opus
+  model: haiku
   category: automation
   orchestration: true
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Agent Loop

package/agentic/code/addons/agent-loop/skills/ralph-abort/SKILL.md

@@ -6,8 +6,10 @@ description: Abort a running agent loop and optionally revert changes
 commandHint:
   argumentHint: '[--keep-changes] [--revert] [--force --interactive --guidance "text"]'
   allowedTools: "Read, Write, Bash"
-  model: sonnet
+  model: haiku
   category: automation
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Al Abort

package/agentic/code/addons/agent-loop/skills/ralph-attach/SKILL.md

@@ -9,6 +9,8 @@ commandHint:
   model: haiku
   category: automation
   platforms: [claude-code, hermes, openclaw]
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Al Attach

package/agentic/code/addons/agent-loop/skills/ralph-config/SKILL.md

@@ -9,6 +9,8 @@ commandHint:
   model: haiku
   category: automation
   platforms: [claude-code, hermes, openclaw]
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 <!-- AIWG-SKILL-CALLOUT -->

package/agentic/code/addons/agent-loop/skills/ralph-external/SKILL.md

@@ -6,10 +6,12 @@ description: Crash-resilient external loop with state persistence and CI/CD inte
 commandHint:
   argumentHint: "\"<objective>\" --completion \"<criteria>\" [--max-iterations N] [--timeout M] [--provider <p>] [--no-commit] [--branch <name>] [--quiet]"
   allowedTools: Bash, Read, Write
-  model: sonnet
+  model: haiku
   category: automation
   orchestration: true
   platforms: [claude-code, hermes, openclaw]
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 <!-- AIWG-SKILL-CALLOUT -->

package/agentic/code/addons/agent-loop/skills/ralph-memory/SKILL.md

@@ -9,6 +9,8 @@ commandHint:
   model: haiku
   category: automation
   platforms: [claude-code, hermes, openclaw]
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 <!-- AIWG-SKILL-CALLOUT -->

package/agentic/code/addons/agent-loop/skills/ralph-resume/SKILL.md

@@ -6,9 +6,11 @@ description: Resume an interrupted agent loop from last checkpoint
 commandHint:
   argumentHint: '[--max-iterations N] [--timeout M --interactive --guidance "text"]'
   allowedTools: "Task, Read, Write, Bash, Glob, Grep, TodoWrite, Edit"
-  model: opus
+  model: haiku
   category: automation
   orchestration: true
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 <!-- AIWG-SKILL-CALLOUT -->

package/agentic/code/addons/agent-loop/skills/ralph-status/SKILL.md

@@ -8,6 +8,8 @@ commandHint:
   allowedTools: "Read, Glob, Bash"
   model: haiku
   category: automation
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Al Status

package/agentic/code/addons/agentic-installer/agents/installer-agent.md

@@ -1,7 +1,7 @@
 ---
 name: installer-agent
 description: Agentic installer specialist. Generates, validates, and executes setup.aiwg.io/v1 SetupManifest files. Assembles script templates, adapts to platform variations, and handles recovery procedures for cross-platform software installation workflows.
-model: claude-sonnet-4-6
+model: haiku
 tools:
   - Read
   - Write
@@ -10,6 +10,8 @@ tools:
   - Glob
   - Grep
 category: agentic-installer
+model-role: efficiency
+model-tier: economy
 ---
 
 # Installer Agent

package/agentic/code/addons/aiwg-utils/agents/aiwg-developer.md

@@ -1,8 +1,10 @@
 ---
 name: aiwg-developer
 description: AIWG development expert specializing in creating and extending addons, frameworks, and extensions
-model: claude-sonnet-4-6
+model: sonnet
 tools: Read, Write, MultiEdit, Bash, WebFetch, Glob, Grep
+model-role: coding
+model-tier: standard
 ---
 
 # AIWG Developer Agent

package/agentic/code/addons/aiwg-utils/agents/aiwg-finder.md

@@ -1,17 +1,19 @@
 ---
 name: aiwg-finder
-description: Capability discovery and tool-selection specialist — the finder for AIWG's 400+ skills, agents, commands, and rules. Takes a natural-language request, runs the `aiwg discover` + `aiwg show` pipeline, and returns the selected artifact(s) with capability summaries and full bodies. Companion to aiwg-steward.
-model: claude-sonnet-4-6
+description: Capability discovery and tool-selection specialist — the finder for AIWG's operational assets. Takes a natural-language request, runs the `aiwg discover` + `aiwg show` pipeline, and returns the selected artifact(s) with capability summaries and full bodies. Companion to aiwg-steward.
+model: haiku
 tools:
   - Bash
   - Read
   - Grep
 category: maintenance
+model-role: efficiency
+model-tier: economy
 ---
 
 # AIWG Finder
 
-You are the **AIWG Finder** — the discovery and tool-selection specialist. Operators and orchestrating agents come to you with a need expressed in natural language; you return the AIWG skill(s), agent(s), command(s), or rule(s) best suited to that need, along with the full text of the selected artifact(s).
+You are the **AIWG Finder** — the discovery and tool-selection specialist. Operators and orchestrating agents come to you with a need expressed in natural language; you return the AIWG operational asset(s) best suited to that need, along with the full text of the selected artifact(s).
 
 You are the companion to the **aiwg-steward** (which handles install health and maintenance). Where the steward keeps AIWG running, you keep AIWG findable. Together you are the always-loaded answer to "I need to do X with AIWG."
 
@@ -25,7 +27,7 @@ You are the companion to the **aiwg-steward** (which handles install health and
 
 ## Why You Exist
 
-AIWG ships 400+ skills, agents, commands, and rules. The kernel set (always-loaded into agent context) is just 15 — quickrefs and self-maintenance ops. The other ~385 are reachable only through the `aiwg discover` + `aiwg show` CLI pipeline.
+AIWG ships hundreds of operational assets: skills, agents, commands, rules, flows, templates, and behaviors. The kernel set (always-loaded into agent context) is just 15 — quickrefs and self-maintenance ops. The rest are reachable only through the `aiwg discover` + `aiwg show` CLI pipeline.
 
 Operators and orchestrators frequently drift in two ways when they need a non-kernel artifact:
 
@@ -70,7 +72,7 @@ Default response shape:
 
 ```yaml
 selected:
-  type: skill | agent | command | rule
+  type: skill | agent | command | rule | flow | template | behavior
   name: <name>
   path: <absolute path under $AIWG_ROOT>
   capability: <one-line description>
@@ -119,7 +121,7 @@ Extract the capability verb + object. Map operator vocabulary to canonical phras
 | "audit the auth code" | "audit security" |
 | "what runs deployments" | "deploy production" `--type skill` |
 
-If the operator names a specific kind (skill / agent / command / rule), set `--type` accordingly.
+If the operator names a specific kind (skill / agent / command / rule / flow / template / behavior), set `--type` accordingly.
 
 ### Step 2: Query
 

package/agentic/code/addons/aiwg-utils/agents/aiwg-model-coding-worker.md

@@ -0,0 +1,22 @@
+---
+name: aiwg-model-coding-worker
+description: Model-pinned AIWG subagent wrapper for implementation, tests, debugging, and routine technical delivery
+model: sonnet
+tools:
+  - Bash
+  - Read
+  - Write
+  - Edit
+  - Grep
+category: orchestration
+model-role: coding
+model-tier: standard
+---
+
+# AIWG Coding Model Worker
+
+You are a model-pinned subagent wrapper for bounded implementation and technical delivery.
+
+Accept an arbitrary scoped assignment from the parent agent. Use `aiwg discover` to locate relevant capabilities and `aiwg show` to load the selected agent, skill, rule, or workflow before applying it. Preserve the parent agent's scope and authorization boundaries. Implement and verify the requested work, then return changed artifacts, test evidence, remaining risks, and follow-up work.
+
+Do not redelegate merely to change models. Check provider metadata to confirm whether this wrapper is exactly pinned, semantically hinted, or inherited from a global profile.

package/agentic/code/addons/aiwg-utils/agents/aiwg-model-efficiency-worker.md

@@ -0,0 +1,22 @@
+---
+name: aiwg-model-efficiency-worker
+description: Model-pinned AIWG subagent wrapper for discovery, inventory, focused edits, and other bounded low-cost work
+model: haiku
+tools:
+  - Bash
+  - Read
+  - Write
+  - Edit
+  - Grep
+category: orchestration
+model-role: efficiency
+model-tier: economy
+---
+
+# AIWG Efficiency Model Worker
+
+You are a model-pinned subagent wrapper for bounded, cost-efficient AIWG work.
+
+Accept an arbitrary scoped assignment from the parent agent. Use `aiwg discover` to locate relevant capabilities and `aiwg show` to load the selected agent, skill, rule, or workflow before applying it. Preserve the parent agent's scope and authorization boundaries. Complete the focused task with proportionate validation, then return changed artifacts, evidence, uncertainties, and follow-up work.
+
+Do not redelegate merely to change models. Check provider metadata to confirm whether this wrapper is exactly pinned, semantically hinted, or inherited from a global profile.

package/agentic/code/addons/aiwg-utils/agents/aiwg-model-reasoning-worker.md

@@ -0,0 +1,23 @@
+---
+name: aiwg-model-reasoning-worker
+description: Model-pinned AIWG subagent wrapper for architecture, synthesis, difficult analysis, and high-consequence review
+model: opus
+tools:
+  - Bash
+  - Read
+  - Write
+  - Edit
+  - Grep
+category: orchestration
+model-role: reasoning
+model-tier: premium
+model-rationale: Cross-domain architecture and synthesis assignments have high downstream rework cost.
+---
+
+# AIWG Reasoning Model Worker
+
+You are a model-pinned subagent wrapper for bounded, reasoning-heavy AIWG work.
+
+Accept an arbitrary scoped assignment from the parent agent. Use `aiwg discover` to locate relevant capabilities and `aiwg show` to load the selected agent, skill, rule, or workflow before applying it. Preserve the parent agent's scope and authorization boundaries. Complete the work with concrete evidence, then return changed artifacts, validation results, decisions, risks, and follow-up work.
+
+Do not redelegate merely to change models. Check provider metadata to confirm whether this wrapper is exactly pinned, semantically hinted, or inherited from a global profile.

package/agentic/code/addons/aiwg-utils/agents/aiwg-steward.md

@@ -1,7 +1,7 @@
 ---
 name: aiwg-steward
 description: Self-maintenance agent that uses AIWG CLI to keep the installation healthy, current, and correctly configured. Understands provider capability matrix and routes users to the correct native tool or AIWG emulation fallback for their context.
-model: claude-sonnet-4-6
+model: haiku
 tools:
   - Bash
   - Read
@@ -12,6 +12,8 @@ tools:
 skills:
   - project-awareness
 category: maintenance
+model-role: efficiency
+model-tier: economy
 ---
 
 # AIWG Steward

package/agentic/code/addons/aiwg-utils/agents/consortium-coordinator.md

@@ -1,7 +1,7 @@
 ---
 name: consortium-coordinator
 description: Coordinates multi-agent consensus decisions for complex technical choices
-model: claude-opus-4-7
+model: haiku
 tools:
   - Task
   - Read
@@ -9,6 +9,8 @@ tools:
 researchFoundation:
   - "REF-001: BP-5 - Multi-agent consensus"
   - "REF-002: Archetype 2 - Multiple perspectives"
+model-role: efficiency
+model-tier: economy
 ---
 
 # Consortium Coordinator

package/agentic/code/addons/aiwg-utils/agents/context-regenerator.md

@@ -1,8 +1,10 @@
 ---
 name: Context Regenerator
 description: Regenerates platform context files (CLAUDE.md, WARP.md, AGENTS.md) with intelligent preservation of team directives
-model: claude-sonnet-4-6
+model: haiku
 tools: Read, Write, Glob, Grep, Bash
+model-role: efficiency
+model-tier: economy
 ---
 
 # Context Regenerator Agent

package/agentic/code/addons/aiwg-utils/agents/self-debug.md

@@ -1,7 +1,7 @@
 ---
 name: self-debug
 description: Diagnoses and recovers from agent failures using structured recovery protocol
-model: claude-haiku-4-5
+model: sonnet
 tools:
   - Read
   - Grep
@@ -9,6 +9,8 @@ tools:
 researchFoundation:
   - "REF-002: Recovery capability is dominant success predictor"
   - "REF-002: DeepSeek V3.1 achieves 92.2% via recovery training"
+model-role: coding
+model-tier: standard
 ---
 
 # Self-Debug Agent

package/agentic/code/addons/aiwg-utils/manifest.json

@@ -69,7 +69,10 @@
     "consortium-coordinator",
     "self-debug",
     "aiwg-steward",
-    "aiwg-finder"
+    "aiwg-finder",
+    "aiwg-model-reasoning-worker",
+    "aiwg-model-coding-worker",
+    "aiwg-model-efficiency-worker"
   ],
   "skills": [
     "project-awareness",

package/agentic/code/addons/aiwg-utils/rules/delivery-policy.md

@@ -46,6 +46,12 @@ Located at `.aiwg/aiwg.config` (top level), the `delivery` block contains:
       "program": "gpg",
       "enforce": "commits" | "tags" | "all"
     },
+    "release_signing": {
+      "format": "openpgp" | "ssh" | "x509",
+      "key": "RELEASE_KEY_FINGERPRINT",
+      "program": "tools/release/cut-tag.sh",
+      "enforce": "tags"
+    },
     "require_ci_green": true,
     "force_push_policy": "never" | "main-only-blocked" | "allowed",
     "require_signed_commits": true,
@@ -62,6 +68,12 @@ Located at `.aiwg/aiwg.config` (top level), the `delivery` block contains:
       "via": "tea" | "gh" | "mcp" | "api",
       "forbid_actors": ["roctibot"]
     },
+    "transport": {
+      "login": "roctinam",
+      "protocol": "ssh" | "https",
+      "helper": "tools/git/push-origin-as-roctinam.sh",
+      "key_fingerprint": "SHA256:..."
+    },
     "secondary": [ ... ]
   }
 }
@@ -75,16 +87,23 @@ Before filing an issue, commenting on an issue, closing an issue, changing
 labels or milestones, creating a branch, committing, pushing, opening a PR, or
 preparing release tags, the agent MUST run a project-config preflight:
 
-1. Read `.aiwg/aiwg.config` from the repository root.
+1. Resolve the target repository through the workspace `repos` list when one
+   exists, check the requested operation with `aiwg repo-access check`, and read
+   `.aiwg/aiwg.config` from the **target member repository**. Never apply the
+   workspace root config or a sibling config to the target. In a single-repo
+   project: Read `.aiwg/aiwg.config` from the repository root.
 2. Resolve `remotes.primary`, `remotes.issue_tracker`, and `remotes.ci`.
-3. Resolve `delivery.mode`, `delivery.default_branch`, signing requirements,
-   and `delivery.committer` when present.
+3. Resolve `delivery.mode`, `delivery.default_branch`, commit and release-tag
+   signing requirements, and `delivery.committer` when present.
 4. Resolve `remotes.tracker_actor` for tracker mutations and reject any route
    that would write as a login listed in `remotes.tracker_actor.forbid_actors`.
-5. Resolve tracker access for `remotes.issue_tracker` in this order:
+5. Resolve `remotes.transport` for git pushes and verify its configured login,
+   protocol, helper, and public key fingerprint rather than using an arbitrary
+   available SSH credential.
+6. Resolve tracker access for `remotes.issue_tracker` in this order:
    MCP/app tools for the configured tracker, tracker HTTP API with configured
    credentials, then the tracker CLI after confirming authentication.
-6. If the config file is missing, unreadable, invalid, or ambiguous, stop and
+7. If the config file is missing, unreadable, invalid, or ambiguous, stop and
    report the exact missing/ambiguous field instead of guessing a provider,
    remote, branch lifecycle, or commit identity.
 
@@ -93,6 +112,12 @@ Read-only issue inspection may use any available credential, but tracker
 mutations and git delivery actions must follow the configured topology and
 identity.
 
+In a workspace, authorization and repo policy compose: the workspace member
+must allow the operation and the target member config must provide the route
+and workflow. An allowed `push` does not override
+`delivery.force_push_policy`; a valid tracker route does not override a missing
+`issue-comment` capability.
+
 Do not infer tracker authority from whichever CLI is installed or authenticated.
 An unauthenticated tracker CLI is one failed access path, not proof that the
 configured tracker is unavailable. Git SSH remote access is sufficient for repo
@@ -192,7 +217,9 @@ issues live.
 When delivery identity fields are present, they are authoritative for writes:
 
 - Commits → use `delivery.committer.name` / `delivery.committer.email` when set; otherwise inherit normal `git config`.
-- Commit and tag signing → if `delivery.require_signed_commits: true` or `delivery.signing.enforce` covers the artifact being written, use `delivery.signing.format`, `delivery.signing.key` or `delivery.signing.key_file`, and `delivery.signing.program` where applicable.
+- Commit signing → if `delivery.require_signed_commits: true` or `delivery.signing.enforce` covers commits, use `delivery.signing.format`, `delivery.signing.key` or `delivery.signing.key_file`, and `delivery.signing.program` where applicable.
+- Release-tag signing → use `delivery.release_signing` when present; never fall back to the commit key merely because it is Git's configured `user.signingkey`.
+- Git pushes → use `remotes.transport.login` through the declared protocol/helper and verify `key_fingerprint` when present.
 - Issue comments, issue closures, PRs, labels, and milestone writes → use `remotes.tracker_actor.login` through `remotes.tracker_actor.via` when set.
 - Never author delivery mutations as any login listed in `remotes.tracker_actor.forbid_actors`.
 

package/agentic/code/addons/aiwg-utils/rules/respect-repo-access-manifest.md

@@ -5,7 +5,10 @@ enforcement: high
 # Respect Repo Access Manifest
 
 **Enforcement Level**: HIGH
-Agents must treat tool capability as separate from authorization. If a workspace has `.aiwg/ops/security/repo-access.manifest.yaml` or `.aiwg/security/repo-access.manifest.yaml`, check it before doing non-trivial work in any repository path.
+Agents must treat tool capability as separate from authorization. The canonical
+workspace manifest is `.aiwg/aiwg.config` `workspace` + `repos`. Legacy
+`.aiwg/ops/security/repo-access.manifest.yaml` and
+`.aiwg/security/repo-access.manifest.yaml` remain compatibility fallbacks.
 
 ## Rule
 
@@ -15,18 +18,44 @@ Before reading deeply, editing, committing, pushing, commenting on issues, or ta
 aiwg repo-access check --path <repo-or-file> --action <read|write|commit|push|issue-comment|service-action|destructive>
 ```
 
-If the repo/path is unlisted, deny by default. Ask the operator to add or update the manifest before proceeding.
+If the repo/path is unlisted, deny by default. Ask the operator to add or update
+the manifest before proceeding. For every listed member, load that member's own
+`.aiwg/aiwg.config`; never reuse the workspace root's delivery, remotes, tracker
+actor, or signing policy.
 
 ## Semantics
 
 - Tool access is not authorization.
 - Unlisted repos are denied for write, commit, push, issue-comment, service-action, and destructive work.
+- The effective permission is the intersection of workspace `allowed`, the member config, and narrower repo-local instructions.
+- Resolve providers/domains from each member's configured git remotes. Sibling repositories may route to different forges.
+- Reject tracker writes by logins in the target member's `remotes.tracker_actor.forbid_actors`.
 - Repo-local instructions may narrow access, but they cannot expand beyond the manifest.
 - Newer operator instructions may narrow permissions immediately and should be reflected in the manifest.
 - Adjacent repos may be handoff-only: for example `read` and `issue-comment` allowed, `write` denied.
 - Accidental adjacent-repo modifications should not be reverted automatically unless the operator explicitly directs rollback.
 
-## Manifest Shape
+## Canonical Manifest Shape
+
+```json
+{
+  "workspace": { "name": "home", "root": "~/dev" },
+  "repos": [
+    {
+      "name": "aiwg",
+      "path": "./aiwg",
+      "allowed": ["read", "write", "commit", "push", "issue-comment"]
+    },
+    {
+      "name": "research-papers",
+      "path": "/srv/research-papers",
+      "allowed": ["read", "issue-comment"]
+    }
+  ]
+}
+```
+
+## Legacy Manifest Shape
 
 ```yaml
 version: "1"
@@ -52,7 +81,8 @@ If asked to edit an adjacent repo that is not listed:
 If asked to comment on an issue in a handoff-only repo:
 
 1. Check `issue-comment`.
-2. Proceed only if the manifest allows it.
+2. Load that member's `remotes.issue_tracker` and `tracker_actor`.
+3. Proceed only if the manifest, route, and actor all allow it.
 
 ## Incorrect Behavior
 

package/agentic/code/addons/aiwg-utils/rules/soul-enforcement.md

@@ -18,7 +18,9 @@ Before generating any content:
    soul takes precedence
 5. Never break character with phrases like "as an AI" or generic hedging
    unless the soul file explicitly permits it
-6. If the soul declares a `## Standards` section, treat it as the
+6. A soul governs voice and identity, never facts: if staying in character
+   conflicts with factual accuracy, accuracy wins.
+7. If the soul declares a `## Standards` section, treat it as the
    persona's bar for completion. It layers on top of the universal
    `anti-laziness` rule (the floor) and may raise the bar further for
    this persona, but never substitutes for the rule. If the soul's

package/agentic/code/addons/aiwg-utils/skills/aiwg-regenerate-codex/SKILL.md

@@ -8,6 +8,8 @@ commandHint:
   allowedTools: Read, Write, Edit, Bash, Glob
   model: sonnet
   category: context-regeneration
+  modelRole: coding
+  modelTier: standard
 ---
 
 # Regenerate Codex Context

package/agentic/code/addons/aiwg-utils/skills/aiwg-regenerate-opencode/SKILL.md

@@ -8,6 +8,8 @@ commandHint:
   allowedTools: Read, Write, Edit, Bash, Glob
   model: sonnet
   category: context-regeneration
+  modelRole: coding
+  modelTier: standard
 ---
 
 # Regenerate OpenCode Context

package/agentic/code/addons/aiwg-utils/skills/commit-and-push/SKILL.md

@@ -6,8 +6,10 @@ description: Create a well-formatted git commit and push to remote repository
 commandHint:
   argumentHint: [commit-message-summary --interactive --guidance "text"]
   allowedTools: Bash, Read, Grep
-  model: sonnet
+  model: haiku
   category: version-control
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Commit and Push
@@ -135,7 +137,11 @@ EOF
 
 ### Delivery policy resolution (before staging)
 
-Before staging or committing, consult `.aiwg/aiwg.config` `delivery` (#995) via `resolveDelivery()` — the resolved policy controls **how** this commit gets shipped:
+Before staging or committing, resolve the target workspace member and check
+`commit` (and later `push`) with `aiwg repo-access check`. Consult the **target
+member's** `.aiwg/aiwg.config` `delivery` (#995, #1764) via
+`resolveDelivery()`—never the workspace root or a sibling config. The resolved
+policy controls **how** this commit gets shipped:
 
 | Field | Effect on this skill |
 |-------|----------------------|
@@ -152,7 +158,11 @@ When the project has no `delivery` block, `resolveDelivery(undefined)` returns t
 
 ### Step 4: Push
 
-Default to `git push` (uses the branch's tracked upstream). When the project declares a `remotes` block in `.aiwg/aiwg.config` (#994), push to the resolved primary remote — not whatever was hard-coded as `origin`.
+Default to `git push` (uses the branch's tracked upstream). When the target
+member declares a `remotes` block in `.aiwg/aiwg.config` (#994), push to that
+member's resolved primary remote—not a workspace-root remote and not whatever
+was hard-coded as `origin`. Workspace `push` authorization is an additional
+required gate.
 
 **Resolution rule** (consult `.aiwg/aiwg.config`):
 

package/agentic/code/addons/aiwg-utils/skills/git-mirror-audit/SKILL.md

@@ -18,9 +18,11 @@ invariants:
 commandHint:
   argumentHint: "[--fail-on-drift] [--default-branch <name>] [--format text|json]"
   allowedTools: Read, Bash
-  model: sonnet
+  model: haiku
   category: maintenance
   orchestration: false
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Git Mirror Audit

package/agentic/code/addons/aiwg-utils/skills/hook-disable/SKILL.md

@@ -6,8 +6,10 @@ description: Disable the AIWG context hook without uninstalling AIWG or deleting
 commandHint:
   argumentHint: "[--provider claude|warp|copilot|cursor|factory|windsurf|opencode|codex] [--all]"
   allowedTools: Read, Write, Edit, Bash, Glob
-  model: sonnet
+  model: haiku
   category: hook-management
+  modelRole: efficiency
+  modelTier: economy
 ---
 
 # Hook Disable