aiwg 2026.7.18 → 2026.7.19

package/docs/contributing/secret-rotation.md

@@ -67,7 +67,9 @@ Watch Gitea Actions:
 - `Mirror signed release assets to Gitea release` should fetch the Gitea token
   from vault during manual asset mirroring.
 
-Then smoke-test installation from the Gitea registry on a clean host.
+Then smoke-test the versioned Gitea `dist.tarball` URL on a clean host. Do not
+set Gitea as npm's process-wide registry for this test: Gitea stores AIWG
+packages but does not proxy their public npmjs.org dependencies.
 
 ### 4. Revoke the Old Source Credential
 

package/docs/contributing/versioning.md

@@ -1,7 +1,7 @@
 # Versioning Guide
 
 **Version:** 1.0
-**Last Updated:** 2026-01-14
+**Last Updated:** 2026-07-23
 **Target Audience:** All contributors and AI agents
 
 ## Overview
@@ -638,13 +638,50 @@ is intentional; don't try to "unify" them.
 - **Releases:** Gitea release = `.gitea/workflows/gitea-release.yml`; GitHub release
   - mirror push = `.gitea/workflows/github-mirror.yml`.
 
+Gitea's bundled npm registry stores AIWG packages but does not proxy packages
+from npmjs.org. A process-wide `--registry=<gitea>` install therefore sends
+third-party dependencies to Gitea and fails when they are not mirrored there.
+For a clean mirror install, resolve or copy the package's `dist.tarball` URL
+from Gitea and install that URL with npm's default registry:
+
+```bash
+VERSION=2026.7.18
+npm install --global \
+  "https://git.integrolabs.net/api/packages/roctinam/npm/aiwg/-/${VERSION}/aiwg-${VERSION}.tgz"
+```
+
+This downloads AIWG from Gitea while resolving its public dependencies from
+npmjs.org. The Gitea release workflow emits the version-specific form of this
+command, and the publish workflow clean-installs all three mirrored tarballs.
+
 ### OIDC trusted publishers are per-package
 
 Each package needs its **own** OIDC trusted publisher configured on npmjs.org,
 pointed at `jmagly/aiwg`'s `.github/workflows/npm-publish.yml`. Configure the
 same publisher tuple separately for `aiwg`, `@aiwg/cli`, and `@aiwg/cockpit`.
-The `@aiwg/cli@0.0.0-bootstrap.0` reservation is not an AIWG release; real
-publishes begin at the next shared AIWG CalVer.
+The historical `@aiwg/cli@0.0.0-bootstrap.0` reservation is not an AIWG
+release. Released packages use the shared AIWG CalVer, and the deprecated
+`bootstrap` dist-tag is intentionally absent.
+
+### Published package README standard
+
+Every npm package must ship a full, dedicated README rather than a short
+registry stub. The source files are:
+
+| Package | README source |
+|---|---|
+| `aiwg` | `README.md` |
+| `@aiwg/cli` | `packages/cli/README.md` |
+| `@aiwg/cockpit` | `apps/cockpit/README.md` |
+
+Each README must stand alone on npm and include package-specific installation,
+quick start, architecture or operating model, troubleshooting, documentation
+links, and an honest statement of package scope. Relative links or images that
+depend on unpublished repository files should use stable public URLs instead.
+`test/smoke/published-package-readmes.test.ts` enforces dedicated identity,
+minimum depth, and required package-level sections; packed-install integration
+tests verify that the dedicated CLI README is copied byte-for-byte into
+`@aiwg/cli`.
 
 ### Gotchas (learned the hard way — #1648)
 

package/docs/releases/v2026.7.18-announcement.md

@@ -34,6 +34,22 @@ aiwg@2026.7.18
 @aiwg/cli@2026.7.18
 ```
 
+The signed tag published all three packages to npmjs.org through GitHub OIDC
+trusted publishing with SLSA provenance. The same versions are mirrored in
+Gitea. Because Gitea's bundled npm registry is not an npmjs proxy, install a
+Gitea mirror tarball by URL rather than using a process-wide Gitea
+`--registry` override:
+
+```bash
+npm install --global \
+  https://git.integrolabs.net/api/packages/roctinam/npm/aiwg/-/2026.7.18/aiwg-2026.7.18.tgz
+```
+
+Release validation clean-installed every package from npmjs.org and from its
+Gitea tarball, exercised both `aiwg` binaries without configuration, and
+confirmed the installed Cockpit binary serves its health endpoint and compiled
+UI.
+
 Use the full local-corpus distribution:
 
 ```bash

package/docs/releases/v2026.7.19-announcement.md

@@ -0,0 +1,68 @@
+# AIWG 2026.7.19 - "Complete package documentation and release verification"
+
+**Released:** 2026-07-23
+**Channel:** stable
+
+AIWG 2026.7.19 completes the npm presentation and verification work for the
+web-backed CLI distribution. The lightweight package now presents a full,
+package-specific guide on npm, and release regressions prevent any AIWG package
+from falling back to stub-level documentation.
+
+## Highlights
+
+- **Full `@aiwg/cli` guide** — the package README covers distribution choice,
+  zero-configuration signed web resources, discovery and lookup, per-call
+  version selection, caching, offline operation, the JavaScript API, security,
+  migration, troubleshooting, and package scope.
+- **README quality contract** — all three published package sources must remain
+  substantial, self-contained, package-specific documents. The packed CLI
+  integration test also verifies that npm receives the exact dedicated README.
+- **Safer mirror verification** — Gitea package checks install AIWG tarballs by
+  direct URL while resolving third-party dependencies from npmjs.org, matching
+  the supported operator workflow.
+- **Bootstrap tag retirement** — the one-time package reservation remains in
+  npm history, while the deprecated `bootstrap` dist-tag is removed through a
+  narrowly scoped authenticated maintenance workflow.
+
+## Package matrix
+
+All three packages publish in CalVer lockstep:
+
+```text
+aiwg@2026.7.19
+@aiwg/cli@2026.7.19
+@aiwg/cockpit@2026.7.19
+```
+
+The signed release tag publishes all three packages to npmjs.org through GitHub
+OIDC trusted publishing with provenance and mirrors them to Gitea.
+
+Use the full local-corpus distribution:
+
+```bash
+npm install --global aiwg@latest
+aiwg discover "architecture evolution"
+```
+
+Use the lightweight signed-web distribution:
+
+```bash
+npm install --global @aiwg/cli@latest
+aiwg discover "architecture evolution"
+aiwg show skill architecture-evolution
+```
+
+No project configuration is required for `@aiwg/cli` web discovery. Operators
+can pin resources for one call with `--aiwg-version <version>` or choose a
+source explicitly with `--resource-source local|web|auto`.
+
+## Upgrade
+
+```bash
+npm install --global aiwg@latest
+# or
+npm install --global @aiwg/cli@latest
+```
+
+Existing local installations, project deployments, and explicit web-mode
+invocations continue to work without migration.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiwg",
-  "version": "2026.7.18",
+  "version": "2026.7.19",
   "description": "Deployment tool and support utility for AI context. Copies agents, skills, commands, rules, and behaviors into the paths each AI platform reads (Claude Code, Codex, Copilot, Cursor, Warp, OpenClaw, and 6 more) so one source of truth works across 10 platforms. Optional utilities for persistent artifact memory, background orchestration, autonomous loops, and artifact indexing.",
   "type": "module",
   "bin": {