aiwg 2026.7.17 → 2026.7.18

package/LICENSE

@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.

package/README.md

@@ -18,14 +18,13 @@ release host:
 
 ```bash
 npm i -g @aiwg/cli
-aiwg discover "architecture evolution" \
-  --resource-source web \
-  --aiwg-version stable
+aiwg discover "architecture evolution"
+aiwg show skill architecture-evolution
 ```
 
 See [Web-Backed AIWG Resources](docs/install/web-backed-resources.md) for source
-selection, cache verification, offline use, and the current framework-graph
-constraints.
+selection, exact-version overrides, cache verification, offline use, and the
+current framework-graph constraints.
 
 Then ask your AI assistant to set up the project for AIWG. The agent-led setup
 conversation should establish remotes, issue storage, delivery behavior,

package/dist/src/artifacts/cli.js

@@ -17,9 +17,12 @@
  * @tests @test/unit/artifacts/cli.test.ts
  */
 import path from 'node:path';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
 import { GRAPH_CONFIGS, OPERATIONAL_DISCOVERY_TYPES, OPERATIONAL_SHOW_TYPES, isOperationalShowType, loadUserGraphConfigs, loadGlobalGraphConfigs, orderedGraphEntries, } from './types.js';
 import { SUPPORTED_VIEWS } from './corpus-views/renderers.js';
 import { parseResourceSelector, readVerifiedRegularFile, } from '../resources/web-release.js';
+import { findPackageRoot } from '../cli/find-package-root.js';
 const MAX_RESOURCE_TRUST_ROOT_BYTES = 64 * 1024;
 function webReleaseOptionsFromEnvironment() {
     const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
@@ -82,6 +85,27 @@ function parseBackendFlag(args) {
 function parseSearchBackendFlag(args) {
     return parseBackendFlag(args) ?? 'fortemi-core';
 }
+/**
+ * The full `aiwg` package owns a local corpus, while `@aiwg/cli` intentionally
+ * ships only executable code and embedded runtime metadata. Select web
+ * resources automatically for the lightweight distribution so a normal
+ * `aiwg discover` / `aiwg show` invocation works immediately after install.
+ *
+ * Resolve from this module rather than process.argv so the exported API gets
+ * the same package-aware default as the npm binary.
+ */
+function defaultResourceSource() {
+    const packageRoot = findPackageRoot(path.dirname(fileURLToPath(import.meta.url)));
+    if (!packageRoot)
+        return 'local';
+    try {
+        const manifest = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+        return manifest.name === '@aiwg/cli' ? 'web' : 'local';
+    }
+    catch {
+        return 'local';
+    }
+}
 function parseResourceSourceFlag(args) {
     const indices = args
         .map((arg, index) => arg === '--resource-source' ? index : -1)
@@ -91,7 +115,7 @@ function parseResourceSourceFlag(args) {
         process.exit(1);
     }
     if (indices.length === 0)
-        return 'local';
+        return defaultResourceSource();
     const value = args[indices[0] + 1];
     if (value === 'local' || value === 'web' || value === 'auto')
         return value;

package/dist/src/resources/web-release.js

@@ -23,7 +23,11 @@ const MAX_SIGNATURE_BYTES = 64 * 1024;
 const MAX_COMPLETION_MARKER_BYTES = 4 * 1024;
 const MAX_CHANNEL_CACHE_CANDIDATES = 128;
 const MAX_RELEASE_CACHE_CANDIDATES = 32;
-const RESOURCE_FETCH_TIMEOUT_MS = 15_000;
+// A cold lightweight-CLI install downloads the signed release manifest
+// (~2 MiB) and Fortemi export (~11 MiB today). Fifteen seconds proved too
+// aggressive on otherwise healthy container and remote-network paths. Keep a
+// finite total-request bound, but allow normal first-run transfer variance.
+const RESOURCE_FETCH_TIMEOUT_MS = 60_000;
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }

package/docs/cli-reference.md

@@ -3571,9 +3571,10 @@ aiwg discover "<phrase>" [options]
   fall back to the packaged prebuilt index described in
   [`docs/fortemi-core-prebuilt-indices.md`](fortemi-core-prebuilt-indices.md).
 - `--resource-source <local|web|auto>` — Select installed resources, signed
-  web resources, or local-first fallback for this call. `local` is the default.
-  The current `web` slice requires the `framework` graph and the `fortemi-core`
-  backend.
+  web resources, or local-first fallback for this call. The full `aiwg`
+  distribution defaults to `local`; the lightweight `@aiwg/cli` distribution
+  defaults to `web`. The current `web` slice requires the `framework` graph and
+  the `fortemi-core` backend.
 - `--aiwg-version <version-or-channel>` — Select the exact signed resource
   release or channel (`stable`, `candidate`, `nightly`) for web resolution.
 - `--offline` — For web resolution, use only previously verified cached release
@@ -3588,6 +3589,7 @@ aiwg discover "audit security" --type skill         # narrow to skills only
 aiwg discover "rotate service certificates" --type runbook # procedural runbooks only
 aiwg discover "review code" --type agent --format json --compact # JSON for sub-agent consumption
 aiwg discover "static retrieval" --json                # legacy JSON alias
+aiwg discover "architecture evolution"                 # @aiwg/cli selects signed stable web resources
 aiwg discover "architecture evolution" --resource-source web --aiwg-version stable
 aiwg discover "architecture evolution" --resource-source web --offline
 ```
@@ -3654,9 +3656,10 @@ aiwg index show <type> <name> [options]      # equivalent
   `fortemi-core`; `local` selects the legacy local fallback. The Fortemi Core
   backend reads the static cache created by `aiwg index sync`.
 - `--resource-source <local|web|auto>` — Select installed resources, signed
-  web resources, or local-first fallback for this call. `local` is the default.
-  The current `web` slice requires the `framework` graph and the `fortemi-core`
-  backend.
+  web resources, or local-first fallback for this call. The full `aiwg`
+  distribution defaults to `local`; the lightweight `@aiwg/cli` distribution
+  defaults to `web`. The current `web` slice requires the `framework` graph and
+  the `fortemi-core` backend.
 - `--aiwg-version <version-or-channel>` — Select the exact signed resource
   release or channel (`stable`, `candidate`, `nightly`) for web resolution.
 - `--offline` — For web resolution, use only previously verified cached release
@@ -3674,6 +3677,7 @@ aiwg index show <type> <name> [options]      # equivalent
 ```bash
 aiwg show skill aiwg:skill:6f1477d99813ca8d         # streams SKILL.md to stdout
 aiwg show skill flow-deploy-to-production --json    # id + path + content envelope
+aiwg show skill architecture-evolution              # @aiwg/cli selects signed stable web resources
 aiwg show skill architecture-evolution --resource-source web --aiwg-version stable
 aiwg show metadata aiwg:skill:6f1477d99813ca8d --json # full Fortemi metadata + paths
 aiwg show agent aiwg-steward                        # agent definition

package/docs/install/web-backed-resources.md

@@ -1,11 +1,14 @@
 # Web-Backed AIWG Resources
 
-**Status**: Experimental / partially implemented
+**Status**: Beta / framework discovery and lookup
 
-AIWG has an experimental implementation for web-backed resource loading. The
-`local` source remains the default and continues to work as the stable path.
+AIWG has a beta implementation for web-backed resource loading. The
+full `aiwg` distribution continues to default to its bundled local corpus. The
+lightweight `@aiwg/cli` distribution defaults to the signed `stable` web
+channel because it intentionally does not bundle that corpus.
 
-Operator workflows should remain command-driven and unchanged; source selection is controlled by per-call flags.
+Operator workflows remain command-driven and unchanged. Source selection is
+automatic for the normal package choice and can be overridden per call.
 
 Release artifacts are hosted at `releases.aiwg.io` (not `aiwg.io/resources`),
 and the public AIWG website remains separate.
@@ -16,14 +19,17 @@ Web-backed use does not require the full npm corpus package. Install the
 CalVer-locked CLI package instead:
 
 ```bash
-npm install --global @aiwg/cli@next
-aiwg discover "architecture evolution" --resource-source web --aiwg-version stable
+npm install --global @aiwg/cli@latest
+aiwg discover "architecture evolution"
+aiwg show skill architecture-evolution
 ```
 
 `@aiwg/cli` and `aiwg` always publish with the exact same AIWG CalVer. The npm
 package version selects CLI behavior; `--aiwg-version` independently selects
 the signed resource release for a call. The CLI package contains executable
-and API code only. It does not contain the default framework/addon corpus.
+and API code only. It does not contain the default framework/addon corpus. Both
+the installed executable and the package's exported CLI API apply the same
+default, without project configuration.
 
 ## Relocating Project AIWG Artifacts
 
@@ -43,10 +49,14 @@ setup.
 
 | Mode    | Behavior                                                                                       |
 | ------- | ---------------------------------------------------------------------------------------------- |
-| `local` | Use installed/project-local resources only. This is the default for all commands.              |
+| `local` | Use installed/project-local resources only. This is the default for the full `aiwg` package.    |
 | `web`   | Resolve resources from versioned, signed release-host bundles with cache and integrity checks. |
 | `auto`  | Prefer local resources when present; otherwise fall back to web-backed resources.              |
 
+For `discover` and `show`, `@aiwg/cli` selects `web` and the signed `stable`
+channel when no source/version flags are supplied. Explicit
+`--resource-source local|web|auto` and `--aiwg-version` values always win.
+
 ## Current Implemented Commands and Flags
 
 `aiwg discover` and `aiwg show` currently support:
@@ -58,12 +68,14 @@ setup.
 Examples:
 
 ```bash
-aiwg discover "architecture evolution" --resource-source local --aiwg-version 2026.7.16
+aiwg discover "architecture evolution"
+aiwg discover "architecture evolution" --resource-source local
 aiwg discover "architecture evolution" --resource-source web --aiwg-version stable
-aiwg discover "architecture evolution" --resource-source auto --aiwg-version 2026.7.16
+aiwg discover "architecture evolution" --resource-source auto --aiwg-version 2026.7.18
 aiwg discover "architecture evolution" --resource-source web --offline
 
-aiwg show skill architecture-evolution --resource-source web --aiwg-version 2026.7.16
+aiwg show skill architecture-evolution
+aiwg show skill architecture-evolution --resource-source web --aiwg-version 2026.7.18
 aiwg show framework sdlc --resource-source web --aiwg-version candidate
 aiwg show framework sdlc --resource-source web --offline
 ```
@@ -123,4 +135,4 @@ AIWG corpus.
 - `aiwg versions` command family.
 - Web behavior for `aiwg use`/`aiwg regenerate`.
 - Lockfile persistence for resolved web versions.
-- Repository-wide default-web mode decisions.
+- Web parity for project/codebase graph operations.

package/docs/releases/v2026.7.18-announcement.md

@@ -0,0 +1,64 @@
+# AIWG 2026.7.18 - "Web-first CLI and packaged Cockpit"
+
+**Released:** 2026-07-23
+**Channel:** stable
+
+AIWG 2026.7.18 is a corrective package release for the lightweight web-backed
+CLI and Cockpit distributions introduced in 2026.7.17. It makes the documented
+no-configuration install path match the behavior of the packages users receive
+from npm.
+
+## Highlights
+
+- **Web resources by default in `@aiwg/cli`** — install the lightweight package
+  and run `aiwg discover` or `aiwg show` without project configuration or
+  resource flags. Both the binary and exported CLI API select the signed
+  `stable` channel.
+- **Legacy local behavior preserved** — the full `aiwg` package still defaults
+  to its bundled local corpus, so existing installations can opt into web mode
+  per call without changing project deployments.
+- **Deployable Cockpit tarball** — `@aiwg/cockpit` now includes its compiled
+  production web UI and license, launches through npm's global binary symlink,
+  and remains available when the optional executor is not installed.
+- **Package-level regression coverage** — clean-install tests verify the real
+  package entry points, default configuration, resource resolution, served
+  Cockpit UI, licenses, and allowlists.
+
+## Package matrix
+
+All three packages publish in CalVer lockstep:
+
+```text
+aiwg@2026.7.18
+@aiwg/cockpit@2026.7.18
+@aiwg/cli@2026.7.18
+```
+
+Use the full local-corpus distribution:
+
+```bash
+npm install --global aiwg@latest
+aiwg discover "architecture evolution"
+```
+
+Use the lightweight signed-web distribution:
+
+```bash
+npm install --global @aiwg/cli@latest
+aiwg discover "architecture evolution"
+aiwg show skill architecture-evolution
+```
+
+Operators can pin resources for one call with `--aiwg-version <version>` or
+override source selection with `--resource-source local|web|auto`.
+
+## Upgrade
+
+```bash
+npm install --global aiwg@latest
+# or
+npm install --global @aiwg/cli@latest
+```
+
+No project migration is required. Existing local configurations and explicit
+web-mode invocations continue to work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiwg",
-  "version": "2026.7.17",
+  "version": "2026.7.18",
   "description": "Deployment tool and support utility for AI context. Copies agents, skills, commands, rules, and behaviors into the paths each AI platform reads (Claude Code, Codex, Copilot, Cursor, Warp, OpenClaw, and 6 more) so one source of truth works across 10 platforms. Optional utilities for persistent artifact memory, background orchestration, autonomous loops, and artifact indexing.",
   "type": "module",
   "bin": {