diff --git a/.aiwg/AIWG.md b/.aiwg/AIWG.md
index 36ccf9d..39e1a80 100644
--- a/.aiwg/AIWG.md
+++ b/.aiwg/AIWG.md
@@ -29,7 +29,8 @@ When a user asks whether AIWG is active or engaged in this project, run or read
 ### Tracker Authority Protocol
 
 - Source of truth: [.aiwg/aiwg.config](./.aiwg/aiwg.config)
-- Canonical tracker: `origin` (github; https://github.com/elder-plinius/OBLITERATUS.git)
+- Internal/canonical tracker: `origin` (github; https://github.com/elder-plinius/OBLITERATUS.git)
+- Customer issue tracker: not configured
 - Primary repo remote: `origin`; CI remote: `origin`
 - Secondary/mirror remotes: none configured
 - Issue storage mode: not configured
@@ -41,6 +42,8 @@ Tracker access order for issue, PR, release, and CI-sensitive tracker operations
 4. Stop and report a blocker.
 
 - Project config decides tracker authority; installed/authenticated CLIs do not.
+- Route internal engineering, delivery, and CI-sensitive issue work to the internal tracker.
+- Route customer acknowledgements, follow-up, and closure to the customer tracker when configured.
 - Git SSH remote access is repository sync, not issue-tracker API access.
 - Do not file on mirror or secondary remotes just because their CLI is authenticated.
 - Treat an unauthenticated tracker CLI as one failed access path, then continue probing MCP/app/API before blocking.
diff --git a/.aiwg/aiwg.config b/.aiwg/aiwg.config
index 820956d..a138a11 100644
--- a/.aiwg/aiwg.config
+++ b/.aiwg/aiwg.config
@@ -33,14 +33,14 @@
   ],
   "installed": {
     "all": {
-      "version": "2026.8.11",
+      "version": "2026.8.15",
       "source": "bundled",
-      "installedAt": "2026-08-16T08:24:23.824Z",
+      "installedAt": "2026-08-21T22:02:07.869Z",
       "deployedTo": {
         "codex": {
           "agents": 0,
           "commands": 50,
-          "skills": 31,
+          "skills": 32,
           "rules": 2
         }
       },
@@ -49,7 +49,7 @@
     "bt6-maintainer": {
       "version": "0.3.0",
       "source": "project-local",
-      "installedAt": "2026-08-21T02:05:54.137Z",
+      "installedAt": "2026-08-21T22:00:58.629Z",
       "deployedTo": {
         "codex": {
           "agents": 5,
diff --git a/AIWG.md b/AIWG.md
index 98d2c81..ddb2432 100644
--- a/AIWG.md
+++ b/AIWG.md
@@ -74,7 +74,8 @@ When a user asks whether AIWG is active or engaged in this project, run or read
 ### Tracker Authority Protocol
 
 - Source of truth: [.aiwg/aiwg.config](./.aiwg/aiwg.config)
-- Canonical tracker: `origin` (github; https://github.com/elder-plinius/OBLITERATUS.git)
+- Internal/canonical tracker: `origin` (github; https://github.com/elder-plinius/OBLITERATUS.git)
+- Customer issue tracker: not configured
 - Primary repo remote: `origin`; CI remote: `origin`
 - Secondary/mirror remotes: none configured
 - Issue storage mode: not configured
@@ -86,6 +87,8 @@ Tracker access order for issue, PR, release, and CI-sensitive tracker operations
 4. Stop and report a blocker.
 
 - Project config decides tracker authority; installed/authenticated CLIs do not.
+- Route internal engineering, delivery, and CI-sensitive issue work to the internal tracker.
+- Route customer acknowledgements, follow-up, and closure to the customer tracker when configured.
 - Git SSH remote access is repository sync, not issue-tracker API access.
 - Do not file on mirror or secondary remotes just because their CLI is authenticated.
 - Treat an unauthenticated tracker CLI as one failed access path, then continue probing MCP/app/API before blocking.
diff --git a/tests/test_aiwg_workspace_contracts.py b/tests/test_aiwg_workspace_contracts.py
index 10e7a81..1f44fc3 100644
--- a/tests/test_aiwg_workspace_contracts.py
+++ b/tests/test_aiwg_workspace_contracts.py
@@ -28,16 +28,16 @@ def _assert_utc_timestamp(value: str) -> None:
     assert parsed.utcoffset() is not None
 
 
-def test_aiwg_manifest_requires_release_with_codex_size_fix():
+def test_aiwg_manifest_requires_current_codex_surface():
     config = _load_json(".aiwg/aiwg.config")
     installation = config["installed"]["all"]
 
-    assert _calendar_version(installation["version"]) >= (2026, 8, 11)
+    assert _calendar_version(installation["version"]) >= (2026, 8, 15)
     assert installation["source"] == "bundled"
     assert installation["deployedTo"]["codex"] == {
         "agents": 0,
         "commands": 50,
-        "skills": 31,
+        "skills": 32,
         "rules": 2,
     }
     _assert_utc_timestamp(installation["installedAt"])