aiwg 2026.7.9 → 2026.7.11

package/agentic/code/frameworks/sdlc-complete/agents/security-auditor.md

@@ -1,6 +1,6 @@
 ---
 name: Security Auditor
-description: Application security and code review specialist. Review code for OWASP Top 10 vulnerabilities, secure authentication wiring, input validation, CORS/CSP, encryption *invocation*. Delegates cryptographic primitive selection to applied-cryptographer and chain-of-trust integrity to secure-bootstrap-reviewer
+description: Application security code reviewer for OWASP Top 10, auth wiring, input validation, CORS/CSP, and encryption invocation. Delegates deep crypto and chain-of-trust work.
 model: claude-sonnet-4-6
 memory: user
 tools: Bash, Read, Write, MultiEdit, WebFetch
@@ -52,17 +52,7 @@ When you find a finding that should be delegated:
 3. Continue the OWASP review without producing a remediation in-line
 4. Roll up specialist findings in your final report
 
-Example:
-
-```markdown
-### A02-Crypto-3 [Delegated]
-
-**Severity**: HIGH
-**Location**: `secrets-lib-dual.sh:42`
-**Finding**: Custom MAC construction `SHA-256(key || data)` used for signature.
-**Delegated to**: `applied-cryptographer` — see `cryptographic-decisions.md` (in progress)
-**Status**: Awaiting specialist remediation; do not deploy until resolved
-```
+Use this compact format: severity, `file:line`, confirmed finding, `Delegated to: <owner>`, and status. Do not produce remediation inline for delegated work.
 
 ## Confirmation Discipline
 
@@ -152,13 +142,6 @@ The same schema is used by the `security-gate` skill. Do not rewrite or truncate
 
 After appending, log an `audit` entry to `.aiwg/activity.log` per the `activity-log` rule.
 
-## SDLC Phase Context
-
-- **Elaboration** — secure architecture, authn/authz strategy, security requirements, compliance needs.
-- **Construction (Primary)** — code security review, secure auth (JWT/OAuth2), input validation, encryption invocation.
-- **Testing** — audit + pentest coordination, vulnerability scanning, security-test execution, compliance validation.
-- **Transition** — production security validation, monitoring setup, incident-response prep, config review.
-
 ## Your Process
 
 ### 1. Security Audit Framework
@@ -211,84 +194,13 @@ Follow the thought-protocol / reasoning-sections / tao-loop rules (`@$AIWG_ROOT/
 
 ## Deliverables
 
-For each security engagement:
-
-1. **Security Audit Report** - Severity levels, risk assessment, OWASP mapping
-2. **Secure Implementation Code** - Authentication, authorization, encryption
-3. **Authentication Flow Diagrams** - Visual representation of security flows
-4. **Security Checklist** - Feature-specific security requirements
-5. **Security Headers Configuration** - CSP, HSTS, CORS, etc.
-6. **Security Test Cases** - Automated tests for security scenarios
-7. **Input Validation Patterns** - Reusable validation and sanitization
-8. **Encryption Implementation** - Data at rest and in transit
-
-## Best Practices
-
-### Defense in Depth
-- Multiple layers of security controls
-- No single point of failure
-- Assume breach mentality
-
-### Principle of Least Privilege
-- Minimal permissions by default
-- Role-based access control (RBAC)
-- Time-limited access when possible
-
-### Never Trust User Input
-- Validate all input server-side
-- Sanitize before use
-- Use parameterized queries
-- Implement rate limiting
-
-### Fail Securely
-- No information leakage in errors
-- Secure defaults
-- Fail closed, not open
-
-### Stay Current
-- Regular dependency updates
-- Security patch monitoring
-- Vulnerability scanning
-- Security training
+For each security engagement, produce a concise security audit report with confirmed findings, severity, OWASP mapping, risk, remediation, and regression tests. Add supporting artifacts only when requested or when a gate needs them: security checklist, auth flow notes, security header config, validation patterns, or encryption/auth invocation fixes.
 
-## Success Metrics
-
-- **Vulnerability Remediation**: 100% critical, >95% high severity fixed
-- **Security Test Coverage**: >90% of security-critical paths tested
-- **Dependency Health**: Zero known CVEs in production dependencies
-- **Compliance**: 100% compliance with relevant standards (OWASP, PCI DSS, etc.)
-- **Incident Rate**: <1 security incident per quarter
-
-## Few-Shot Examples
-
-### Example: SQL Injection Vulnerability
-
-**Input:** Review the user authentication endpoint for security vulnerabilities.
-
-**Output:**
-```markdown
-# Security Finding: SQL Injection Vulnerability
-
-**Severity**: CRITICAL
-**OWASP Category**: A03:2021 - Injection
-**Location**: `src/auth/login.ts:42`
-
-## Current Code
-`const query = `SELECT * FROM users WHERE email = '${email}' AND password = '${password}'`;`
-
-## Vulnerability
-Direct string interpolation of user input into SQL query allows SQL injection. Inputs like `admin@example.com' OR '1'='1` bypass authentication.
-
-## Remediation
-Use parameterized queries (`'SELECT * FROM users WHERE email = $1', [email]`) and verify the password with `bcrypt.compare` against the stored hash.
-
-## Additional Recommendations
-- bcrypt hashing (cost factor 12+), rate limiting, log failed attempts, prepared statements everywhere.
-```
+Keep the operating defaults simple: defense in depth, least privilege, server-side validation, parameterized data access, fail-closed behavior, dependency hygiene, and no known critical/high production vulnerabilities.
 
-The finding pattern: specific `file:line`, mapped OWASP category, severity for prioritization, complete remediation code (not just a description), and hardening recommendations beyond the immediate fix.
+## Examples
 
-> Additional worked examples: see `docs/agent-examples/security-auditor-examples.md` (`aiwg discover "security auditor worked examples"`). Covers the SQL-injection finding in full plus a STRIDE threat model for an authentication API and an end-to-end JWT implementation security review (3 CRITICAL + 2 HIGH findings with remediation, prioritized plan, and regression tests).
+Do not inline bulky examples in this agent definition; it must remain below the 16 KiB subagent-dispatch ceiling. For concrete report patterns and remediation examples, read `docs/agent-examples/security-auditor-examples.md` (`aiwg discover "security auditor worked examples"`), including SQL injection, STRIDE, and JWT review examples.
 
 ## References
 

package/agentic/code/plugins/sdlc/agents/security-auditor.md

@@ -1,6 +1,6 @@
 ---
 name: Security Auditor
-description: Application security and code review specialist. Review code for OWASP Top 10 vulnerabilities, secure authentication wiring, input validation, CORS/CSP, encryption *invocation*. Delegates cryptographic primitive selection to applied-cryptographer and chain-of-trust integrity to secure-bootstrap-reviewer
+description: Application security code reviewer for OWASP Top 10, auth wiring, input validation, CORS/CSP, and encryption invocation. Delegates deep crypto and chain-of-trust work.
 model: claude-sonnet-4-6
 memory: user
 tools: Bash, Read, Write, MultiEdit, WebFetch
@@ -52,17 +52,7 @@ When you find a finding that should be delegated:
 3. Continue the OWASP review without producing a remediation in-line
 4. Roll up specialist findings in your final report
 
-Example:
-
-```markdown
-### A02-Crypto-3 [Delegated]
-
-**Severity**: HIGH
-**Location**: `secrets-lib-dual.sh:42`
-**Finding**: Custom MAC construction `SHA-256(key || data)` used for signature.
-**Delegated to**: `applied-cryptographer` — see `cryptographic-decisions.md` (in progress)
-**Status**: Awaiting specialist remediation; do not deploy until resolved
-```
+Use this compact format: severity, `file:line`, confirmed finding, `Delegated to: <owner>`, and status. Do not produce remediation inline for delegated work.
 
 ## Confirmation Discipline
 
@@ -152,13 +142,6 @@ The same schema is used by the `security-gate` skill. Do not rewrite or truncate
 
 After appending, log an `audit` entry to `.aiwg/activity.log` per the `activity-log` rule.
 
-## SDLC Phase Context
-
-- **Elaboration** — secure architecture, authn/authz strategy, security requirements, compliance needs.
-- **Construction (Primary)** — code security review, secure auth (JWT/OAuth2), input validation, encryption invocation.
-- **Testing** — audit + pentest coordination, vulnerability scanning, security-test execution, compliance validation.
-- **Transition** — production security validation, monitoring setup, incident-response prep, config review.
-
 ## Your Process
 
 ### 1. Security Audit Framework
@@ -211,84 +194,13 @@ Follow the thought-protocol / reasoning-sections / tao-loop rules (`@$AIWG_ROOT/
 
 ## Deliverables
 
-For each security engagement:
-
-1. **Security Audit Report** - Severity levels, risk assessment, OWASP mapping
-2. **Secure Implementation Code** - Authentication, authorization, encryption
-3. **Authentication Flow Diagrams** - Visual representation of security flows
-4. **Security Checklist** - Feature-specific security requirements
-5. **Security Headers Configuration** - CSP, HSTS, CORS, etc.
-6. **Security Test Cases** - Automated tests for security scenarios
-7. **Input Validation Patterns** - Reusable validation and sanitization
-8. **Encryption Implementation** - Data at rest and in transit
-
-## Best Practices
-
-### Defense in Depth
-- Multiple layers of security controls
-- No single point of failure
-- Assume breach mentality
-
-### Principle of Least Privilege
-- Minimal permissions by default
-- Role-based access control (RBAC)
-- Time-limited access when possible
-
-### Never Trust User Input
-- Validate all input server-side
-- Sanitize before use
-- Use parameterized queries
-- Implement rate limiting
-
-### Fail Securely
-- No information leakage in errors
-- Secure defaults
-- Fail closed, not open
-
-### Stay Current
-- Regular dependency updates
-- Security patch monitoring
-- Vulnerability scanning
-- Security training
+For each security engagement, produce a concise security audit report with confirmed findings, severity, OWASP mapping, risk, remediation, and regression tests. Add supporting artifacts only when requested or when a gate needs them: security checklist, auth flow notes, security header config, validation patterns, or encryption/auth invocation fixes.
 
-## Success Metrics
-
-- **Vulnerability Remediation**: 100% critical, >95% high severity fixed
-- **Security Test Coverage**: >90% of security-critical paths tested
-- **Dependency Health**: Zero known CVEs in production dependencies
-- **Compliance**: 100% compliance with relevant standards (OWASP, PCI DSS, etc.)
-- **Incident Rate**: <1 security incident per quarter
-
-## Few-Shot Examples
-
-### Example: SQL Injection Vulnerability
-
-**Input:** Review the user authentication endpoint for security vulnerabilities.
-
-**Output:**
-```markdown
-# Security Finding: SQL Injection Vulnerability
-
-**Severity**: CRITICAL
-**OWASP Category**: A03:2021 - Injection
-**Location**: `src/auth/login.ts:42`
-
-## Current Code
-`const query = `SELECT * FROM users WHERE email = '${email}' AND password = '${password}'`;`
-
-## Vulnerability
-Direct string interpolation of user input into SQL query allows SQL injection. Inputs like `admin@example.com' OR '1'='1` bypass authentication.
-
-## Remediation
-Use parameterized queries (`'SELECT * FROM users WHERE email = $1', [email]`) and verify the password with `bcrypt.compare` against the stored hash.
-
-## Additional Recommendations
-- bcrypt hashing (cost factor 12+), rate limiting, log failed attempts, prepared statements everywhere.
-```
+Keep the operating defaults simple: defense in depth, least privilege, server-side validation, parameterized data access, fail-closed behavior, dependency hygiene, and no known critical/high production vulnerabilities.
 
-The finding pattern: specific `file:line`, mapped OWASP category, severity for prioritization, complete remediation code (not just a description), and hardening recommendations beyond the immediate fix.
+## Examples
 
-> Additional worked examples: see `docs/agent-examples/security-auditor-examples.md` (`aiwg discover "security auditor worked examples"`). Covers the SQL-injection finding in full plus a STRIDE threat model for an authentication API and an end-to-end JWT implementation security review (3 CRITICAL + 2 HIGH findings with remediation, prioritized plan, and regression tests).
+Do not inline bulky examples in this agent definition; it must remain below the 16 KiB subagent-dispatch ceiling. For concrete report patterns and remediation examples, read `docs/agent-examples/security-auditor-examples.md` (`aiwg discover "security auditor worked examples"`), including SQL injection, STRIDE, and JWT review examples.
 
 ## References
 

package/dist/src/artifacts/browser-export.js

@@ -2,6 +2,44 @@ import fs from "fs";
 import path from "path";
 import { createHash } from "crypto";
 import { loadGraphIndexFile } from "./index-reader.js";
+export const DEFAULT_MAX_SOURCE_BODY_BYTES = 256 * 1024;
+const BINARY_SOURCE_EXTENSIONS = new Set([
+    ".7z",
+    ".a",
+    ".avi",
+    ".bin",
+    ".bmp",
+    ".bz2",
+    ".class",
+    ".dll",
+    ".doc",
+    ".docx",
+    ".dylib",
+    ".exe",
+    ".gif",
+    ".gz",
+    ".ico",
+    ".jar",
+    ".jpeg",
+    ".jpg",
+    ".mov",
+    ".mp3",
+    ".mp4",
+    ".o",
+    ".odt",
+    ".pdf",
+    ".png",
+    ".ppt",
+    ".pptx",
+    ".so",
+    ".tar",
+    ".tgz",
+    ".war",
+    ".webp",
+    ".xls",
+    ".xlsx",
+    ".zip",
+]);
 function stableArtifactId(artifactPath) {
     return ("aiwg:artifact:" +
         createHash("sha256").update(artifactPath).digest("hex").slice(0, 16));
@@ -35,12 +73,29 @@ function stripFrontmatter(text) {
     const match = text.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/);
     return match ? text.slice(match[0].length) : text;
 }
-function sourceBodyForEntry(cwd, entry) {
+function looksBinary(buffer) {
+    if (buffer.includes(0))
+        return true;
+    const sample = buffer.subarray(0, Math.min(buffer.length, 4096)).toString("utf-8");
+    if (sample.length === 0)
+        return false;
+    const replacementCount = (sample.match(/\uFFFD/g) ?? []).length;
+    return replacementCount / sample.length > 0.01;
+}
+function sourceBodyForEntry(cwd, entry, maxBytes) {
     const sourcePath = path.isAbsolute(entry.path)
         ? entry.path
         : path.join(cwd, entry.path);
     try {
-        return stripFrontmatter(fs.readFileSync(sourcePath, "utf-8")).trim();
+        const stat = fs.statSync(sourcePath);
+        if (!stat.isFile() || stat.size > maxBytes)
+            return "";
+        if (BINARY_SOURCE_EXTENSIONS.has(path.extname(sourcePath).toLowerCase()))
+            return "";
+        const buffer = fs.readFileSync(sourcePath);
+        if (looksBinary(buffer))
+            return "";
+        return stripFrontmatter(buffer.toString("utf-8")).trim();
     }
     catch {
         return "";
@@ -279,13 +334,16 @@ export function buildAiwgFortemiIndexExport(cwd, options = {}) {
     const dependencyGraph = loadGraphIndexFile(cwd, "dependencies.json", options.graph);
     const privacy = options.privacy ?? "private";
     const repo = options.repo ?? path.basename(cwd);
+    const maxSourceBodyBytes = options.maxSourceBodyBytes ?? DEFAULT_MAX_SOURCE_BODY_BYTES;
     const entries = Object.values(index.entries);
     const recordTypesByPath = new Map(entries.map((entry) => [
         entry.path,
         recordTypeForEntry(entry, schemaVersion),
     ]));
     const items = entries
-        .map((entry) => recordForEntry(entry, graphName, dependencyGraph, privacy, schemaVersion, recordTypesByPath, options.includeSourceBody === false ? "" : sourceBodyForEntry(cwd, entry)))
+        .map((entry) => recordForEntry(entry, graphName, dependencyGraph, privacy, schemaVersion, recordTypesByPath, options.includeSourceBody === false
+        ? ""
+        : sourceBodyForEntry(cwd, entry, maxSourceBodyBytes)))
         .sort((left, right) => left.id.localeCompare(right.id));
     return {
         schema_version: schemaVersion === "v2"

package/dist/src/artifacts/index-builder.js

@@ -636,7 +636,19 @@ export async function buildIndex(cwd, options = {}) {
             manifestStats.checked++;
             // Phase 1: stat-based quick filter — skip content read if mtime+size match manifest.
             // This is the fast path: unchanged files don't touch the filesystem beyond fs.statSync.
-            const stat = fs.statSync(fullPath);
+            let stat;
+            try {
+                stat = fs.statSync(fullPath);
+            }
+            catch (err) {
+                if (err.code === 'ENOENT') {
+                    manifestStats.pruned++;
+                    if (verbose)
+                        console.log(`  skipped missing: ${relativePath}`);
+                    continue;
+                }
+                throw err;
+            }
             const manifestEntry = manifest.entries[relativePath];
             if (!force && statMatches(stat, manifestEntry) && existingEntries[relativePath]?.checksum === manifestEntry?.checksum) {
                 // Stat matches manifest AND the stored index entry references the same checksum.

package/docs/blog/2025-10-aiwg-october-2025-report.md

@@ -0,0 +1,134 @@
+---
+title: "AIWG — October 2025 Report"
+slug: "2025-10-aiwg-october-2025-report"
+date: "2025-10-31"
+project: "aiwg"
+type: report
+tags: [report, "2025-10", "aiwg"]
+summary: "A big build month: AIWG took shape as guided workflows, specialized agents, and templates for planning, building, testing, and shipping software with AI. Nothing shipped to users yet."
+status: "published"
+canonical: "https://aiwg.io/blog/2025-10-aiwg-october-2025-report"
+---
+
+# AIWG — October 2025
+
+_AIWG is a toolkit that helps AI coding agents work in a clear, reliable way. It gives them skills, rules, ready-made workflows, and shared memory so they make fewer mistakes and stay easy to follow._
+
+## TL;DR
+
+October was a big build month. This is when AIWG really took shape. The framework gained guided workflows for the whole life of a software project — plan, design, build, test, and ship. It gained specialized agents for each stage. It gained a large set of ready-to-use templates. And it gained a simple installer and a command-line tool. It also learned to set itself up on more than one AI coding app.
+
+One term first: SDLC means "software development life cycle" — the steps a team follows to plan, build, test, and ship software. AIWG now walks you through those steps.
+
+Nothing shipped to users yet. AIWG had not published to npm. This was build-in-progress.
+
+## By the numbers
+
+| What's public | Value |
+| --- | --- |
+| Where to find it | github.com/jmagly/aiwg |
+| On npm | Not yet — the first public release came later |
+| What it now offered | guided workflows for each stage · specialized agents · a large template library · a CLI and one-line installer |
+| Works with | Claude Code · OpenAI Codex · Warp Terminal |
+
+## Highlights
+
+**1. Guided workflows for the whole life of a project.**
+What it is: ready-made steps for each stage of building software — plan, design, build, test, and ship.
+How you'd use it: pick a stage, and AIWG walks you and your agents through it, one step at a time.
+Why it helps: you don't have to invent the process. You follow a clear path and skip fewer steps.
+
+**2. A team of agents that draft, review, and merge.**
+What it is: specialized agents, each good at one job — one writes a first draft, others review it, and one merges the feedback.
+How you'd use it: ask for a document, like a design write-up. AIWG runs the draft-review-merge cycle for you.
+Why it helps: you get a stronger result than one agent working alone, with fewer blind spots.
+
+**3. Start fast — from an idea or from code you already have.**
+What it is: a guided "intake" that captures what you're building. It can start from a plain description, or read an existing codebase and describe it for you.
+How you'd use it: answer a few questions, or point it at your project. AIWG fills in the starting details.
+Why it helps: you get moving in minutes, whether the project is brand new or already exists.
+
+**4. Just say what you want.**
+What it is: plain-language triggers for the workflows. You don't need to memorize commands.
+How you'd use it: say "move to the design stage" or "run a security review," and AIWG picks the right workflow.
+Why it helps: you work in normal words, and the tool does the mapping.
+
+**5. A large template library.**
+What it is: fill-in-the-blank documents for the common needs — requirements, architecture, testing, security, privacy, and more.
+How you'd use it: reach for the template you need, and start from a solid outline instead of a blank page.
+Why it helps: you keep your work consistent and complete, and you save time.
+
+**6. Set up on more than one AI tool, in one command.**
+What it is: a one-line installer and an `aiwg` command-line tool that place AIWG's helpers where each AI app expects them.
+How you'd use it: run one command. AIWG sets itself up for Claude Code, OpenAI Codex, or Warp Terminal.
+Why it helps: you keep the same helpers and habits as you move between tools.
+
+## Features shipped
+
+**The workflow set.** This was the heart of the month. AIWG gained ready-made workflows for each stage of a project, and for the jumps between stages. There are also ongoing workflows you run again and again — like reviewing risks, checking security, running tests, deploying, and holding a look-back after a stage. Each workflow is a guide: what to produce, who reviews it, and what "done" looks like.
+
+**Specialized agents and the draft-review-merge pattern.** AIWG gained agents for the roles a real project needs — from writing requirements to designing architecture to reviewing code. A shared pattern ties them together: one agent drafts, several review in parallel, and one merges the feedback into a clean result. New documentation agents make this work for write-ups, not just code.
+
+**Guided intake.** A friendly intake wizard asks about your project and captures the basics. It has an interactive mode and a "fill the gaps" mode for a form you already started. A second path reads an existing codebase and writes the intake for you. You can also add guidance up front, so the tool aims the right way from the start.
+
+**The template library.** AIWG gained a broad set of templates covering requirements, architecture, testing, security, privacy, legal, metrics, and team setup. There are small "cards" for test cases and team roles too. The templates carry ownership notes, so it's clear who owns each piece.
+
+**The installer and command-line tool.** A one-line installer sets everything up. The `aiwg` command-line tool creates new projects, deploys agents, and keeps itself current. It checks for the right version of Node.js (the program that runs the tool) and can install it if needed. If a setup goes wrong, it recovers on its own instead of leaving a mess.
+
+**Support for more AI tools.** AIWG learned to set itself up cleanly for OpenAI Codex and Warp Terminal, on top of Claude Code. It knows where each app looks for its helpers and puts them in the right spot. For tools that read a single shared file, it gathers the pieces into one place.
+
+**Writing quality and voice.** AIWG gained a set of tools that check AI-written text for robotic habits — tired phrases, weak verbs, over-hedging, and cookie-cutter structure. It can also match a chosen voice, so the writing sounds the way you want. A themed voice guide shipped as an early example.
+
+**Turn a transcript into notes.** A new command takes a meeting transcript and turns it into a clean summary you can share.
+
+**Tracing and contributor tools.** AIWG gained a way to link requirements to code and tests, so you can see what covers what. It also gained tools to help outside contributors follow a clear, repeatable path.
+
+## Fixes
+
+Setup got more careful. New projects now create the right folders, and a scaffolding script that could fail was repaired. The tool that deploys agents got better at spotting files it had already placed, so it stops making duplicates. Warp Terminal commands were wired into the installer correctly. Public links were pointed at the right home. The intake step that people found confusing was clarified — it's one of several ways to start, not a required first move. And a planning template was rewritten to capture what stakeholders actually care about.
+
+## Performance & reliability
+
+Reliability got real attention. The installer now recovers on its own when a step fails, so a bad setup doesn't leave you stuck. The command-line tool checks its own version and updates itself when you run it. It confirms Node.js is present and the right version. Groundwork for testing and for checking quality targets — like speed, security, and reliability — was also built this month, ready for the stages ahead.
+
+## Breaking changes & migrations
+
+None this month. AIWG had no public users yet, so there was nothing to break. The command-line tool did settle on a single name, `aiwg`, with clear subcommands — but that only affected the project's own build, not any user.
+
+## Releases
+
+None this month — AIWG had not yet published to npm; this was build-in-progress.
+
+## Dependencies & security
+
+A security-review workflow shipped as part of the workflow set, so security has a clear place in the process. Tracing work also landed, linking requirements to code and tests. Package changes this month were internal setup only. No security alerts needed fixing.
+
+## Docs & developer experience
+
+The README got a full redesign for clarity and a friendlier first read. New sections cover what you need before you start, with step-by-step install guides, plus plain warnings and legal notes so expectations are clear. A command reference explains the command-line tool. A plain-language guide maps everyday phrases to the right workflow. And a guide explains the draft-review-merge pattern, so you can follow how the agents work together.
+
+## Tests & CI
+
+The first test infrastructure landed, along with a way to check quality targets like speed and security. Automatic checks kept the docs and lists consistent, and a drift check flagged when a generated file fell out of date. Some of the strictest documentation checks were paused late in the month, to be revisited once the build settled.
+
+## Cross-project impact
+
+- This month is the **foundation** for everything that follows. The workflows, agents, templates, and multi-tool setup built here are what later AIWG work builds on.
+- The **writing quality and voice** tools became the base for AIWG's later writing helpers.
+- **Multi-tool support** (Claude Code, OpenAI Codex, Warp Terminal) set the pattern for the many AI apps AIWG supports today.
+
+## Known issues & open threads
+
+- **Not public yet.** AIWG had not published to npm, so there was no one-command install for outside users this month.
+- **Still mid-build.** The design and build stages were in progress, so some pieces were internal and rough.
+- **Strict doc checks paused.** The tightest documentation checks were turned off late in the month, to be turned back on later.
+
+## What's next
+
+Keep building toward a first public release. Finish the build stages, publish to npm, and add more AI tools. Keep sharpening the workflows, the agents, and the writing tools. Small, steady progress from here.
+
+## Appendix
+
+- **Published packages:** none yet — not on npm this month.
+- **Source:** github.com/jmagly/aiwg · window: all of October 2025.
+- **What it offered:** guided workflows for each stage · specialized agents · a large template library · a CLI and one-line installer · setup for Claude Code, OpenAI Codex, and Warp Terminal.

package/docs/blog/2025-11-aiwg-november-2025-report.md

@@ -0,0 +1,108 @@
+---
+title: "AIWG — November 2025 Report"
+slug: "2025-11-aiwg-november-2025-report"
+date: "2025-11-30"
+project: "aiwg"
+type: report
+tags: [report, "2025-11", "aiwg"]
+summary: "A build month before launch: AIWG learned to run on Factory AI, let you pick your own model, gained a new marketing framework, and grew a real codebase with tests."
+status: "published"
+canonical: "https://aiwg.io/blog/2025-11-aiwg-november-2025-report"
+---
+
+# AIWG — November 2025
+
+_AIWG is a toolkit that helps AI coding agents work in a clear, reliable way. It gives them skills, rules, and shared memory so they make fewer mistakes and stay easy to follow._
+
+## TL;DR
+
+November was a busy build month. AIWG was not yet public, so there were no releases. But a lot got built toward the first launch. The big theme: AIWG learned to set itself up inside a second AI coding tool, Factory AI. You can now pick which model your agents use, instead of being stuck with a fixed one. A brand-new marketing framework arrived, with its own agents and commands. And the core toolkit moved into a real, tested codebase. This was the groundwork for going public.
+
+## By the numbers
+
+| What's public | Value |
+|---|---|
+| On npm | Not yet — first public release came the next month |
+| Source | github.com/jmagly/aiwg |
+| Works with | Claude Code · OpenAI Codex · Warp Terminal · Factory AI (new this month) |
+| New this month | pick-your-model config · Media/Marketing Kit framework |
+| What it helps you do | run agents on more AI tools · choose your model · run marketing work |
+
+## Highlights
+
+**1. AIWG now runs on Factory AI.**
+What it is: AIWG can set itself up inside a new AI coding tool called Factory AI. (A "provider" is an AI coding tool AIWG can set itself up inside, like Claude Code or Factory AI.)
+How you'd use it: run one setup command for Factory AI, and AIWG puts its agents and commands where that tool looks for them.
+Why it helps: you can use the same AIWG helpers on more than one tool. You don't start over when you switch.
+
+**2. Pick your own model.**
+What it is: AIWG used to have fixed model names written into its code. Now they live in one small settings file you control.
+How you'd use it: point AIWG at the model you want, either with a quick command or by editing the file. You can set it for one project or for all of them.
+Why it helps: you upgrade to a newer model, or swap in a cheaper one, without editing any code.
+
+**3. A new marketing framework.**
+What it is: a full kit for marketing work, called the Media/Marketing Kit. It brings its own set of helper agents and ready-made commands.
+How you'd use it: kick off a campaign, plan content, or run a brand review, each with one command. You can add your own steering notes as you go.
+Why it helps: AIWG now covers marketing work too, not just software building.
+
+**4. A real codebase and tests behind AIWG.**
+What it is: the core parts moved into a proper code layout, and the tests were rewritten in a modern, checkable way.
+How you'd use it: nothing to do — this is under the hood.
+Why it helps: a tested, well-organized base means fewer surprises and a smoother path to the public launch.
+
+## Features shipped
+
+**AIWG runs on Factory AI.** This was the month's biggest push. AIWG now knows how to deploy into Factory AI, a second AI coding tool. It maps AIWG's tools onto the ones Factory AI uses, so your agents keep their full set of powers. It also sets up the tool for you, so agents that coordinate other agents get what they need. When you set up a Factory AI project, AIWG can write a starter project file so the tool knows how to work with your code.
+
+**Pick your own model.** Model names no longer live inside the code. They sit in one small settings file. AIWG checks for your choice in a clear order: a quick command wins first, then your project's file, then your personal file, then the built-in default. So you can set a model just for one project, or for everything you do. Upgrading to a newer model is now a one-line change.
+
+**The Media/Marketing Kit.** AIWG gained a whole new framework for marketing. It ships with a large team of helper agents grouped by job — strategy, writing, design, communications, production, and more. It has commands for the everyday tasks: starting a campaign, planning content, reviewing a brand, checking the numbers. It also has many ready-made templates. The work flows through five clear stages, from strategy to writing to review to publishing to results. This month it also got a guided intake, so you can start a project by answering a few simple questions. And every marketing command now takes a steering note (like "focus on new customers") and a guided question-and-answer mode — the same easy pattern the software commands already use.
+
+**A real, tested codebase.** The core software moved into a clean layout, split by job — reading a codebase, running builds, checking health, recovering from errors, and more. The tests moved too, and were rewritten in a modern, type-checked style that catches mistakes early. AIWG also hit a build milestone, with all its planned core features done, and began planning the steps to go public.
+
+## Fixes
+
+Most fixes cleaned up the new Factory AI support. Command names now use the right format for that tool, so they show up and run correctly. A tool-specific name tag that only made sense in one place was removed, so commands work the same everywhere. A round of test cleanup fixed and steadied the tests across the software and writing parts. A setup script that pointed at the wrong address was corrected, and a small setup detail was written down so it's easy to follow.
+
+## Performance & reliability
+
+The quiet win was reliability. The test cleanup raised how much of the code is checked and made the tests steadier, so problems get caught before they reach you. Moving the code into a clear layout, with a modern testing setup, makes the whole toolkit safer to change. None of this is flashy, but it is the base a public launch stands on.
+
+## Breaking changes & migrations
+
+None this month. AIWG was still pre-public, so there was nothing shipped to break.
+
+## Releases
+
+None this month — AIWG had not yet published to npm; the first public release came the next month.
+
+## Dependencies & security
+
+No security alerts needed fixing this month. The move to a settings file for models means those choices now live in version control, where you can see and review them. The build milestone review found no product security problems.
+
+## Docs & developer experience
+
+Docs grew to match the new features. There's a getting-started guide for running AIWG on Factory AI, with setup steps and troubleshooting. There's a full guide to picking your model, with examples for using the newest model, a cheaper one, or your own custom choice. The new marketing framework got its own quick-start. The main README now lists Factory AI as a supported tool.
+
+## Tests & CI
+
+The tests were pulled into one place and rewritten in a modern, type-checked style using a current test runner. A broad cleanup fixed failing tests across the software and writing parts and made the suite steadier. This sets a solid testing base before the code goes public.
+
+## Cross-project impact
+
+AIWG stayed a single project this month, getting ready for launch. Inside it, the new marketing framework now sits alongside the software-building framework, so one toolkit covers both kinds of work. The move to a shared model settings file means every provider — every AI tool AIWG supports — reads model choices the same way.
+
+## Known issues & open threads
+
+- On Factory AI, the agents still need one manual import step before they're ready. Making that automatic is a follow-up.
+- The build milestone review flagged a few areas to firm up before the public release, and that work was planned for the following weeks.
+
+## What's next
+
+The big one: the first public release on npm, coming the next month. Finishing the go-public steps — final checks, deployment notes, and a short watch period after launch. More polish on Factory AI setup so it needs fewer manual steps. And more growth for the new marketing framework. Small, steady updates start once AIWG is public.
+
+## Appendix
+
+- **Published packages:** none yet — first public release came the next month.
+- **Source:** github.com/jmagly/aiwg · window: all of November 2025.
+- **Supported tools this month:** Claude Code · OpenAI Codex · Warp Terminal · Factory AI (new).