@askexenow/exe-os 0.9.116 → 0.9.118

package/deploy/compose/.env.example

@@ -1,4 +1,4 @@
-# exe-os CUSTOMER VPS stack — Hygo/customer example environment variables
+# exe-os VPS stack — example environment variables
 # Copy to .env before deployment and replace every CHANGEME_* value.
 # Values under # SET_MANUALLY must be provided by the operator.
 
@@ -14,13 +14,13 @@ CLICKHOUSE_PASSWORD=CHANGEME_CLICKHOUSE_PASSWORD
 REDIS_PASSWORD=CHANGEME_REDIS_PASSWORD
 
 # --- CRM ---
-CRM_IMAGE_TAG=registry.askexe.com/askexe/exe-crm:v0.9.3
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.2
 CRM_SERVER_URL=https://CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=registry.askexe.com/askexe/exe-wiki:v0.9.3
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.2
 WIKI_DB_SCHEMA=wiki
 WIKI_VECTOR_DB=postgres
 WIKI_AUTH_TOKEN=CHANGEME_WIKI_AUTH_TOKEN
@@ -30,22 +30,22 @@ WIKI_SIG_SALT=CHANGEME_WIKI_SIG_SALT
 WIKI_HOST_PORT=3001
 
 # --- exed ---
-EXED_IMAGE_TAG=registry.askexe.com/askexe/exed:v0.9.7
+EXED_IMAGE_TAG=ghcr.io/askexe/exed:v0.9.2
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
-EXED_DEVICE_ID=hygo-vps
+EXED_DEVICE_ID=vps-default
 # VPS-only: enables cloud/local SQLite -> exe-db Postgres projection.
 # Keep false on laptops/dev boxes.
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=registry.askexe.com/askexe/exe-gateway:v0.9.3
+GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.2
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
 # SET_MANUALLY
-WHATSAPP_ACCESS_TOKEN=
+WHATSAPP_ACCESS_TOKEN=CHANGEME_WHATSAPP_ACCESS_TOKEN
 API_ROUTER_URL=https://gateway.askexe.com
-API_ROUTER_KEY=exe_rk_CHANGEME_API_ROUTER_KEY
+API_ROUTER_KEY=CHANGEME_API_ROUTER_KEY
 # BYOK: to use your own API keys instead of the Exe API Router,
 # set BYOK_ENABLED=true and provide ANTHROPIC_API_KEY below.
 # BYOK_ENABLED=false
@@ -54,15 +54,25 @@ GATEWAY_HTTP_HOST_PORT=3100
 GATEWAY_WS_HOST_PORT=3101
 
 # --- Monitoring agent (standard for managed customer VPSs) ---
-MONITOR_AGENT_IMAGE_TAG=registry.askexe.com/askexe/exe-monitor-agent:v0.9.3
+MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.2
 MONITOR_HUB_URL=https://monitor.askexe.com
-# Required: values copied from monitor.askexe.com when adding the Hygo/customer system.
+# Values copied from monitor.askexe.com when adding a new system.
 MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN_FROM_MONITOR_HUB
 MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_PUBLIC_KEY_FROM_MONITOR_HUB
 MONITOR_AGENT_LISTEN=:45876
 
-# --- AskExe central monitoring hub ---
-# Not included on customer VPSs. Hygo/customer deployments run exe-monitor-agent above, never the hub.
+# --- AskExe central monitoring hub auth (AskExe-owned infra only) ---
+# Customer VPSs normally run only MONITOR_AGENT_* above. These hub values are
+# for monitor.askexe.com on exe-db-jkt.
+MONITOR_HUB_PUBLIC_URL=https://monitor.askexe.com
+MONITOR_HUB_SOURCE_DIR=/opt/exe-monitor
+MONITOR_HUB_HOST_PORT=8090
+MONITOR_HUB_DATA_DIR=/opt/exe-monitor-data
+MONITOR_TRUSTED_AUTH_HEADER=X-AskExe-User-Email
+# Keep false during bootstrap; flip true after the GoTrue auth proxy is live.
+MONITOR_DISABLE_PASSWORD_AUTH=false
+MONITOR_USER_CREATION=true
+MONITOR_SHARE_ALL_SYSTEMS=false
 
 # --- License ---
 # injected by deploy_client

package/deploy/compose/docker-compose.yml

@@ -108,7 +108,7 @@ services:
   # ------------------------------------------------------------------
 
   exe-crm:
-    image: ${CRM_IMAGE_TAG:-registry.askexe.com/askexe/exe-crm:v0.9.3}
+    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.2}
     container_name: exe-crm
     restart: unless-stopped
     depends_on:
@@ -154,7 +154,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-crm-worker:
-    image: ${CRM_IMAGE_TAG:-registry.askexe.com/askexe/exe-crm:v0.9.3}
+    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.2}
     container_name: exe-crm-worker
     restart: unless-stopped
     command: ["yarn", "worker:prod"]
@@ -194,7 +194,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-wiki:
-    image: ${WIKI_IMAGE_TAG:-registry.askexe.com/askexe/exe-wiki:v0.9.3}
+    image: ${WIKI_IMAGE_TAG:-ghcr.io/askexe/exe-wiki:v0.9.2}
     container_name: exe-wiki
     restart: unless-stopped
     depends_on:
@@ -236,7 +236,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exed:
-    image: ${EXED_IMAGE_TAG:-registry.askexe.com/askexe/exed:v0.9.7}
+    image: ${EXED_IMAGE_TAG:-ghcr.io/askexe/exed:v0.9.2}
     container_name: exed
     restart: unless-stopped
     env_file:
@@ -272,7 +272,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-gateway:
-    image: ${GATEWAY_IMAGE_TAG:-registry.askexe.com/askexe/exe-gateway:v0.9.3}
+    image: ${GATEWAY_IMAGE_TAG:-ghcr.io/askexe/exe-gateway:v0.9.2}
     container_name: exe-gateway
     restart: unless-stopped
     depends_on:
@@ -322,7 +322,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-monitor-agent:
-    image: ${MONITOR_AGENT_IMAGE_TAG:-registry.askexe.com/askexe/exe-monitor-agent:v0.9.3}
+    image: ${MONITOR_AGENT_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-agent:v0.9.2}
     container_name: exe-monitor-agent
     restart: unless-stopped
     environment:

package/deploy/compose/generate-env.ts

@@ -87,7 +87,7 @@ export function generateEnv(options: GenerateEnvOptions): string {
     MANUAL_VALUE_COMMENT,
     "WHATSAPP_ACCESS_TOKEN=",
     `API_ROUTER_URL=${DEFAULT_API_ROUTER_URL}`,
-    `API_ROUTER_KEY=exe_rk_${randomSecret(48)}`,
+    `API_ROUTER_KEY=${randomSecret(48)}`,
     "# BYOK: to use your own API keys instead of the Exe API Router,",
     "# set BYOK_ENABLED=true and provide ANTHROPIC_API_KEY below.",
     "# BYOK_ENABLED=false",
@@ -155,9 +155,9 @@ export function generateExampleEnv(): string {
     "EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN",
     "EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN",
     MANUAL_VALUE_COMMENT,
-    "WHATSAPP_ACCESS_TOKEN=",
+    "WHATSAPP_ACCESS_TOKEN=CHANGEME_WHATSAPP_ACCESS_TOKEN",
     `API_ROUTER_URL=${DEFAULT_API_ROUTER_URL}`,
-    "API_ROUTER_KEY=exe_rk_CHANGEME_API_ROUTER_KEY",
+    "API_ROUTER_KEY=CHANGEME_API_ROUTER_KEY",
     "# BYOK: to use your own API keys instead of the Exe API Router,",
     "# set BYOK_ENABLED=true and provide ANTHROPIC_API_KEY below.",
     "# BYOK_ENABLED=false",

package/dist/bin/age-ontology-load.js

@@ -72,8 +72,8 @@ var DEFAULT_CONFIG = {
     rerankerAutoTrigger: {
       enabled: true,
       broadQueryMinCardinality: 5e4,
-      fetchTopK: 200,
-      returnTopK: 20
+      fetchTopK: 150,
+      returnTopK: 5
     }
   },
   graphRagEnabled: true,

package/dist/bin/agentic-ontology-backfill.js

@@ -278,8 +278,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3372,7 +3372,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3637,7 +3646,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/agentic-reflection-backfill.js

@@ -278,8 +278,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3372,7 +3372,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3637,7 +3646,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/agentic-semantic-label.js

@@ -278,8 +278,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3372,7 +3372,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3637,7 +3646,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/backfill-conversations.js

@@ -278,8 +278,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3512,7 +3512,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3777,7 +3786,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/backfill-responses.js

@@ -278,8 +278,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3512,7 +3512,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3777,7 +3786,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/backfill-vectors.js

@@ -278,8 +278,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3508,7 +3508,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3773,7 +3782,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/bulk-sync-postgres.js

@@ -278,8 +278,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3692,7 +3692,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3957,7 +3966,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/cc-doctor.js

@@ -79,8 +79,8 @@ var DEFAULT_CONFIG = {
     rerankerAutoTrigger: {
       enabled: true,
       broadQueryMinCardinality: 5e4,
-      fetchTopK: 200,
-      returnTopK: 20
+      fetchTopK: 150,
+      returnTopK: 5
     }
   },
   graphRagEnabled: true,

package/dist/bin/cleanup-stale-review-tasks.js

@@ -280,8 +280,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -4525,7 +4525,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -4790,7 +4799,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",
@@ -6499,6 +6508,27 @@ var init_agent_symlinks = __esm({
   }
 });
 
+// src/lib/agent-context.ts
+var agent_context_exports = {};
+__export(agent_context_exports, {
+  getAgentContext: () => getAgentContext,
+  runWithAgent: () => runWithAgent
+});
+import { AsyncLocalStorage } from "async_hooks";
+function runWithAgent(ctx, fn) {
+  return agentStore.run(ctx, fn);
+}
+function getAgentContext() {
+  return agentStore.getStore();
+}
+var agentStore;
+var init_agent_context = __esm({
+  "src/lib/agent-context.ts"() {
+    "use strict";
+    agentStore = new AsyncLocalStorage();
+  }
+});
+
 // src/lib/tmux-routing.ts
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, existsSync as existsSync14, appendFileSync, readdirSync as readdirSync2 } from "fs";
 import path14 from "path";
@@ -6558,8 +6588,17 @@ function getParentExe(sessionKey) {
 function resolveExeSession() {
   const mySession = getMySession();
   const fromSessionName = mySession ? extractRootExe(mySession) ?? null : null;
-  if (process.env.EXE_SESSION_NAME) {
-    const fromEnv = extractRootExe(process.env.EXE_SESSION_NAME) ?? process.env.EXE_SESSION_NAME;
+  const alsHint = (() => {
+    try {
+      const { getAgentContext: getAgentContext2 } = (init_agent_context(), __toCommonJS(agent_context_exports));
+      return getAgentContext2()?.sessionHint ?? "";
+    } catch {
+      return "";
+    }
+  })();
+  const sessionHintRaw = alsHint || process.env.EXE_SESSION_NAME || "";
+  if (sessionHintRaw) {
+    const fromEnv = extractRootExe(sessionHintRaw) ?? sessionHintRaw;
     if (fromEnv) {
       if (!mySession) {
         return fromEnv;