@askexenow/exe-os 0.9.256 → 0.9.260

package/deploy/compose/.env.customer.example

@@ -1,4 +1,4 @@
-# exe-os CUSTOMER VPS stack — Hygo/customer example environment variables
+# exe-os CUSTOMER VPS stack — example environment variables
 # Copy to .env before deployment and replace every CHANGEME_* value.
 # Values under # SET_MANUALLY must be provided by the operator.
 
@@ -18,17 +18,17 @@ GOTRUE_JWT_SECRET=CHANGEME_GOTRUE_JWT_SECRET
 GOTRUE_API_PORT=9999
 GOTRUE_SITE_URL=https://crm.CHANGEME_DOMAIN
 GOTRUE_EXTERNAL_URL=https://auth.CHANGEME_DOMAIN
-GOTRUE_DISABLE_SIGNUP=false
-GOTRUE_MAILER_AUTOCONFIRM=true
+GOTRUE_DISABLE_SIGNUP=true
+GOTRUE_MAILER_AUTOCONFIRM=false
 
 # --- CRM ---
-CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.3
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.47
 CRM_SERVER_URL=https://CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.3
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.21
 WIKI_DB_SCHEMA=wiki
 WIKI_VECTOR_DB=postgres
 WIKI_AUTH_TOKEN=CHANGEME_WIKI_AUTH_TOKEN
@@ -38,17 +38,17 @@ WIKI_SIG_SALT=CHANGEME_WIKI_SIG_SALT
 WIKI_HOST_PORT=3001
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.9
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.256
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
-EXED_DEVICE_ID=hygo-vps
-EXE_MCP_HOST_BIND=0.0.0.0
+EXED_DEVICE_ID=CHANGEME_DEVICE_ID
+EXE_MCP_HOST_BIND=127.0.0.1
 EXE_MCP_HOST_PORT=48739
 # VPS-only: enables cloud/local SQLite -> exe-db Postgres projection.
 # Keep false on laptops/dev boxes.
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v0.9.3
+GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v0.9.16
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -64,7 +64,7 @@ GATEWAY_HTTP_HOST_PORT=3100
 GATEWAY_WS_HOST_PORT=3101
 
 # --- Monitoring hub (PocketBase — local per-customer instance) ---
-MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v0.9.3
+MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v0.9.4
 MONITOR_HUB_PORT=8090
 # Bootstrap superuser created on first start. Use your admin email + a strong password.
 # After first boot these values are no longer used (stored in pb_data volume).
@@ -74,7 +74,7 @@ MONITOR_HUB_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 MONITOR_HUB_ADMIN_PASSWORD=CHANGEME_MONITOR_HUB_ADMIN_PASSWORD
 
 # --- Monitoring agent (standard for managed customer VPSs) ---
-MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v0.9.3
+MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v0.9.4
 # Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
 # TOKEN and KEY are written automatically by stack-update via /api/register-agent.
@@ -84,13 +84,13 @@ MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_KEY
 MONITOR_AGENT_LISTEN=:45876
 
 # --- AskExe central monitoring hub ---
-# Not included on customer VPSs. Hygo/customer deployments run exe-monitor-agent above, never the hub.
+# Not included on customer VPSs. Customer deployments run exe-monitor-agent above, never the hub.
 
 # --- Cloudflare Tunnel ---
 # Token-based tunnel (recommended). Get your token:
 #   1. dash.cloudflare.com > Zero Trust > Networks > Tunnels > Create tunnel
 #   2. Choose "Cloudflared" connector, name your tunnel (e.g. "hygo-vps")
-#   3. Copy the token shown during setup
+#   3. Copy the token shown during setup (e.g. "customer-vps")
 # Then configure public hostnames in the dashboard (no config.yml needed):
 #   crm.<domain>     → http://exe-crm:3000
 #   wiki.<domain>    → http://exe-wiki:3001

package/deploy/compose/.env.example

@@ -18,18 +18,18 @@ GOTRUE_JWT_SECRET=CHANGEME_GOTRUE_JWT_SECRET
 GOTRUE_API_PORT=9999
 GOTRUE_SITE_URL=https://crm.CHANGEME_DOMAIN
 GOTRUE_EXTERNAL_URL=https://auth.CHANGEME_DOMAIN
-GOTRUE_DISABLE_SIGNUP=false
-GOTRUE_MAILER_AUTOCONFIRM=true
+GOTRUE_DISABLE_SIGNUP=true
+GOTRUE_MAILER_AUTOCONFIRM=false
 
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.4
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.47
 CRM_SERVER_URL=https://CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.4
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.21
 WIKI_DB_SCHEMA=wiki
 WIKI_VECTOR_DB=postgres
 WIKI_AUTH_TOKEN=CHANGEME_WIKI_AUTH_TOKEN
@@ -40,17 +40,17 @@ WIKI_SIG_SALT=CHANGEME_WIKI_SIG_SALT
 WIKI_HOST_PORT=3001
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.154
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.256
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=vps-default
-EXE_MCP_HOST_BIND=0.0.0.0
+EXE_MCP_HOST_BIND=127.0.0.1
 EXE_MCP_HOST_PORT=48739
 # VPS-only: enables cloud/local SQLite -> exe-db Postgres projection.
 # Keep false on laptops/dev boxes.
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.4
+GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.16
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -71,7 +71,7 @@ ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
 
 # --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.2.0-final3
+ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.2.0-final3
 ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD
 ERP_SITE_NAME=erp.askexe.com
 ERP_API_PORT=8069

package/deploy/compose/docker-compose.yml

@@ -138,8 +138,8 @@ services:
       GOTRUE_JWT_EXP: ${GOTRUE_JWT_EXP:-3600}
       GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
       API_EXTERNAL_URL: ${GOTRUE_EXTERNAL_URL:-https://auth.askexe.com}
-      GOTRUE_DISABLE_SIGNUP: ${GOTRUE_DISABLE_SIGNUP:-false}
-      GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-true}
+      GOTRUE_DISABLE_SIGNUP: ${GOTRUE_DISABLE_SIGNUP:-true}
+      GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-false}
       GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
       GOTRUE_SMTP_PORT: ${SMTP_PORT:-587}
       GOTRUE_SMTP_USER: ${SMTP_USER:-}
@@ -195,7 +195,7 @@ services:
   # ------------------------------------------------------------------
 
   exe-crm:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.4}
+    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.47}
     container_name: exe-crm
     restart: unless-stopped
     # Auto-migrate on boot: run database init before starting the app.
@@ -248,7 +248,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-crm-worker:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.4}
+    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.47}
     container_name: exe-crm-worker
     restart: unless-stopped
     command: ["yarn", "worker:prod"]
@@ -294,7 +294,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-wiki:
-    image: ${WIKI_IMAGE_TAG:-ghcr.io/askexe/exe-wiki:v0.9.5}
+    image: ${WIKI_IMAGE_TAG:-ghcr.io/askexe/exe-wiki:v0.9.21}
     container_name: exe-wiki
     restart: unless-stopped
     # Wiki uses Prisma — runs migrate on boot via built-in entrypoint.
@@ -342,7 +342,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-os:
-    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.157}}
+    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.255}}
     container_name: exe-os
     restart: unless-stopped
     env_file:
@@ -355,7 +355,7 @@ services:
       EXED_MCP_TOKEN: ${EXED_MCP_TOKEN:?EXED_MCP_TOKEN is required}
       EXE_DAEMON_TOKEN: ${EXED_MCP_TOKEN:?EXED_MCP_TOKEN is required}
       EXE_MCP_HOST: "0.0.0.0"
-      EXE_MCP_ALLOW_REMOTE: "1"
+      EXE_MCP_ALLOW_REMOTE: "${EXE_MCP_ALLOW_REMOTE:-0}"
       EXE_MCP_PORT: "48739"
       EXED_DEVICE_ID: ${EXED_DEVICE_ID:-vps-default}
       EXE_LICENSE_KEY: ${EXE_LICENSE_KEY:?EXE_LICENSE_KEY is required — purchase at https://askexe.com}
@@ -369,7 +369,7 @@ services:
       - exe_os_data:/home/exed/.exe-os
     ports:
       - "${EXED_HEALTH_HOST_BIND:-127.0.0.1}:${EXED_HOST_PORT:-8765}:8765"
-      - "${EXE_MCP_HOST_BIND:-0.0.0.0}:${EXE_MCP_HOST_PORT:-48739}:48739"
+      - "${EXE_MCP_HOST_BIND:-127.0.0.1}:${EXE_MCP_HOST_PORT:-48739}:48739"
     networks:
       backend:
         ipv4_address: 10.42.0.22
@@ -387,7 +387,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-gateway:
-    image: ${GATEWAY_IMAGE_TAG:-ghcr.io/askexe/exe-gateway:v0.9.4}
+    image: ${GATEWAY_IMAGE_TAG:-ghcr.io/askexe/exe-gateway:v0.9.16}
     container_name: exe-gateway
     restart: unless-stopped
     # Gateway needs 45s to flush outbound queues + disconnect Baileys adapters.
@@ -489,7 +489,7 @@ services:
   # AskExe control-plane only — not deployed on customer VPSs.
   # ------------------------------------------------------------------
   exe-update:
-    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.157}}
+    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.255}}
     container_name: exe-update
     profiles: ["askexe-control-plane"]
     restart: unless-stopped
@@ -538,7 +538,7 @@ services:
   # ------------------------------------------------------------------
 
   cloudflared:
-    image: cloudflare/cloudflared:latest
+    image: cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f
     container_name: cloudflared
     restart: unless-stopped
     # Token mode: `tunnel run --token <TOKEN>` — no local credentials file needed.
@@ -578,7 +578,7 @@ services:
   # 4 services: gunicorn API, websocket, RQ worker, scheduler.
 
   exe-erp:
-    image: ${ERP_IMAGE_TAG:-update.askexe.com/askexe/exe-erp:v0.2.0-final3}
+    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.0-final3}
     container_name: exe-erp
     restart: unless-stopped
     entrypoint: ["/usr/local/bin/entrypoint.sh"]
@@ -609,7 +609,7 @@ services:
       DB_NAME: exe_erp
       DB_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
       POSTGRES_USER: ${POSTGRES_USER:-exe}
-      ADMIN_PASSWORD: ${ERP_ADMIN_PASSWORD:-admin}
+      ADMIN_PASSWORD: ${ERP_ADMIN_PASSWORD:?ERP_ADMIN_PASSWORD is required}
       REDIS_CACHE: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379/3
       REDIS_QUEUE: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379/4
       REDIS_SOCKETIO: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379/5
@@ -625,7 +625,7 @@ services:
       # Sentry (optional)
       FRAPPE_SENTRY_DSN: ${ERP_SENTRY_DSN:-}
     ports:
-      - "${ERP_API_PORT:-8069}:8000"
+      - "127.0.0.1:${ERP_API_PORT:-8069}:8000"
     volumes:
       - erp_sites:/home/frappe/frappe-bench/sites
     networks:
@@ -648,7 +648,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-erp-websocket:
-    image: ${ERP_IMAGE_TAG:-update.askexe.com/askexe/exe-erp:v0.2.0-final3}
+    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.0-final3}
     container_name: exe-erp-websocket
     restart: unless-stopped
     entrypoint: []
@@ -663,7 +663,7 @@ services:
       REDIS_SOCKETIO: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379/5
       SITE_NAME: ${ERP_SITE_NAME:-erp.askexe.com}
     ports:
-      - "${ERP_WS_PORT:-9069}:9000"
+      - "127.0.0.1:${ERP_WS_PORT:-9069}:9000"
     volumes:
       - erp_sites:/home/frappe/frappe-bench/sites
     networks:
@@ -678,7 +678,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-erp-queue:
-    image: ${ERP_IMAGE_TAG:-update.askexe.com/askexe/exe-erp:v0.2.0-final3}
+    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.0-final3}
     container_name: exe-erp-queue
     restart: unless-stopped
     entrypoint: []
@@ -713,7 +713,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-erp-scheduler:
-    image: ${ERP_IMAGE_TAG:-update.askexe.com/askexe/exe-erp:v0.2.0-final3}
+    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.0-final3}
     container_name: exe-erp-scheduler
     restart: unless-stopped
     entrypoint: []

package/deploy/compose/generate-env.ts

@@ -1,27 +1,31 @@
 import { randomBytes } from "node:crypto";
 const REGISTRY = "ghcr.io/askexe";
 
-// v0.9.x is the private/customer pilot stack line. Component repos keep their
-// own package semver internally, but customer deployments use the tested stack
-// image alias so one stack manifest can pin the whole release. exe-os/exed is
-// the exception because the runtime package version is the orchestrator release.
-const STACK_IMAGE_TAG = "v0.9.4";
-const EXED_RELEASE_TAG = "v0.9.154";
+// Keep these defaults in sync with deploy/stack-manifests/v0.9.json latest.
+// deploy/compose/.env.example intentionally uses GHCR fallbacks so local
+// simulation can run without private update.askexe.com registry credentials.
+const CRM_RELEASE_TAG = "v0.9.47";
+const WIKI_RELEASE_TAG = "v0.9.21";
+const EXED_RELEASE_TAG = "v0.9.256";
+const GATEWAY_RELEASE_TAG = "v0.9.16";
+const MONITOR_RELEASE_TAG = "v0.9.4";
+const ERP_RELEASE_TAG = "v0.2.0-final3";
 
 const POSTGRES_USER = "exe";
 const POSTGRES_DB = "exedb";
 const CLICKHOUSE_DB = "default";
 const CLICKHOUSE_USER = "exe";
-export const CRM_IMAGE_TAG = `${REGISTRY}/exe-crm:${STACK_IMAGE_TAG}`;
+export const CRM_IMAGE_TAG = `${REGISTRY}/exe-crm:${CRM_RELEASE_TAG}`;
 const CRM_HOST_PORT = "3000";
-export const WIKI_IMAGE_TAG = `${REGISTRY}/exe-wiki:${STACK_IMAGE_TAG}`;
+export const WIKI_IMAGE_TAG = `${REGISTRY}/exe-wiki:${WIKI_RELEASE_TAG}`;
 const WIKI_DB_SCHEMA = "wiki";
 const WIKI_VECTOR_DB = "postgres";
 const WIKI_HOST_PORT = "3001";
 export const EXE_OS_IMAGE_TAG = `${REGISTRY}/exe-os:${EXED_RELEASE_TAG}`;
-export const GATEWAY_IMAGE_TAG = `${REGISTRY}/exe-gateway:${STACK_IMAGE_TAG}`;
-export const MONITOR_AGENT_IMAGE_TAG = `${REGISTRY}/exe-monitor-agent:${STACK_IMAGE_TAG}`;
-export const MONITOR_HUB_IMAGE_TAG = `${REGISTRY}/exe-monitor-hub:${STACK_IMAGE_TAG}`;
+export const GATEWAY_IMAGE_TAG = `${REGISTRY}/exe-gateway:${GATEWAY_RELEASE_TAG}`;
+export const MONITOR_AGENT_IMAGE_TAG = `${REGISTRY}/exe-monitor-agent:${MONITOR_RELEASE_TAG}`;
+export const MONITOR_HUB_IMAGE_TAG = `${REGISTRY}/exe-monitor-hub:${MONITOR_RELEASE_TAG}`;
+export const ERP_IMAGE_TAG = `${REGISTRY}/exe-erp:${ERP_RELEASE_TAG}`;
 const GATEWAY_HTTP_HOST_PORT = "3100";
 const GATEWAY_WS_HOST_PORT = "3101";
 const RANDOM_SECRET_16 = 16;
@@ -33,7 +37,7 @@ const EXAMPLE_LICENSE_KEY = "CHANGEME_EXE_LICENSE_KEY";
 const DEFAULT_API_ROUTER_URL = "https://gateway.askexe.com";
 const DEFAULT_MONITOR_HUB_URL = "http://exe-monitor-hub:8090";
 const DEFAULT_MONITOR_AGENT_LISTEN = ":45876";
-const DEFAULT_EXE_MCP_HOST_BIND = "0.0.0.0";
+const DEFAULT_EXE_MCP_HOST_BIND = "127.0.0.1";
 const DEFAULT_EXE_MCP_HOST_PORT = "48739";
 
 export interface GenerateEnvOptions {
@@ -64,8 +68,8 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "GOTRUE_API_PORT=9999",
     `GOTRUE_SITE_URL=https://crm.${normalizedDomain}`,
     `GOTRUE_EXTERNAL_URL=https://auth.${normalizedDomain}`,
-    "GOTRUE_DISABLE_SIGNUP=false",
-    "GOTRUE_MAILER_AUTOCONFIRM=true",
+    "GOTRUE_DISABLE_SIGNUP=true",
+    "GOTRUE_MAILER_AUTOCONFIRM=false",
     "",
     "# --- CRM ---",
     `CRM_IMAGE_TAG=${CRM_IMAGE_TAG}`,
@@ -116,7 +120,7 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors",
     "",
     "# --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---",
-    "ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.2.0-final3",
+    `ERP_IMAGE_TAG=${ERP_IMAGE_TAG}`,
     `ERP_ADMIN_PASSWORD=${randomSecret(RANDOM_SECRET_32)}`,
     `ERP_SITE_NAME=erp.${normalizedDomain}`,
     "ERP_API_PORT=8069",
@@ -181,8 +185,8 @@ export function generateExampleEnv(): string {
     "GOTRUE_API_PORT=9999",
     "GOTRUE_SITE_URL=https://crm.CHANGEME_DOMAIN",
     "GOTRUE_EXTERNAL_URL=https://auth.CHANGEME_DOMAIN",
-    "GOTRUE_DISABLE_SIGNUP=false",
-    "GOTRUE_MAILER_AUTOCONFIRM=true",
+    "GOTRUE_DISABLE_SIGNUP=true",
+    "GOTRUE_MAILER_AUTOCONFIRM=false",
     "",
     "# --- CRM ---",
     `CRM_IMAGE_TAG=${CRM_IMAGE_TAG}`,
@@ -234,7 +238,7 @@ export function generateExampleEnv(): string {
     "MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors",
     "",
     "# --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---",
-    "ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.2.0-final3",
+    `ERP_IMAGE_TAG=${ERP_IMAGE_TAG}`,
     "ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD",
     "ERP_SITE_NAME=erp.askexe.com",
     "ERP_API_PORT=8069",

package/deploy/compose/init-db.sql

@@ -73,53 +73,254 @@ CREATE TABLE IF NOT EXISTS raw.raw_events (
   timestamp TIMESTAMPTZ DEFAULT now(),
   created_at TIMESTAMPTZ DEFAULT now(),
   processed_at TIMESTAMPTZ,
+  failed_at TIMESTAMPTZ,
+  retry_count INT NOT NULL DEFAULT 0,
   error TEXT,
   projections JSONB DEFAULT '{}'::jsonb
 );
 
 CREATE INDEX IF NOT EXISTS idx_raw_events_unprocessed ON raw.raw_events (created_at) WHERE processed_at IS NULL;
+CREATE INDEX IF NOT EXISTS idx_raw_events_retryable ON raw.raw_events (failed_at) WHERE processed_at IS NULL AND failed_at IS NOT NULL AND retry_count < 5;
 CREATE UNIQUE INDEX IF NOT EXISTS uq_raw_events_dedup ON raw.raw_events (source, source_id, event_type);
 
+-- ---------------------------------------------------------------------------
+-- Graph schema — Company Brain memory + GraphRAG projection targets.
+-- These tables are written by projection-worker.ts and Graph→PG sync. They
+-- must exist on fresh stack boot before workers start projecting raw events.
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS graph.memory_records (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  agent_id TEXT NOT NULL DEFAULT 'system',
+  agent_role TEXT NOT NULL DEFAULT 'ingest',
+  session_id TEXT NOT NULL DEFAULT 'projection-worker',
+  timestamp TIMESTAMPTZ NOT NULL DEFAULT now(),
+  tool_name TEXT NOT NULL DEFAULT 'projection_worker',
+  project_name TEXT NOT NULL DEFAULT 'exe-os',
+  has_error BOOLEAN NOT NULL DEFAULT false,
+  raw_text TEXT NOT NULL,
+  vector vector(1024),
+  version INTEGER NOT NULL DEFAULT 0,
+  task_id TEXT,
+  intent TEXT,
+  outcome TEXT,
+  domain TEXT,
+  trajectory TEXT,
+  memory_type TEXT NOT NULL DEFAULT 'raw',
+  source_type TEXT NOT NULL DEFAULT 'unknown',
+  importance INTEGER NOT NULL DEFAULT 5,
+  status TEXT NOT NULL DEFAULT 'active',
+  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_graph_memory_records_agent ON graph.memory_records(agent_id);
+CREATE INDEX IF NOT EXISTS idx_graph_memory_records_project_time ON graph.memory_records(project_name, timestamp DESC);
+CREATE INDEX IF NOT EXISTS idx_graph_memory_records_status ON graph.memory_records(status);
+CREATE INDEX IF NOT EXISTS idx_graph_memory_records_source_type ON graph.memory_records(source_type);
+
+CREATE TABLE IF NOT EXISTS graph.entities (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  type TEXT NOT NULL,
+  first_seen TIMESTAMPTZ NOT NULL DEFAULT now(),
+  last_seen TIMESTAMPTZ NOT NULL DEFAULT now(),
+  properties JSONB NOT NULL DEFAULT '{}'::jsonb,
+  UNIQUE(name, type)
+);
+CREATE INDEX IF NOT EXISTS idx_graph_entities_type ON graph.entities(type);
+CREATE INDEX IF NOT EXISTS idx_graph_entities_last_seen ON graph.entities(last_seen DESC);
+
+CREATE TABLE IF NOT EXISTS graph.relationships (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  source_entity_id UUID NOT NULL REFERENCES graph.entities(id) ON DELETE CASCADE,
+  target_entity_id UUID NOT NULL REFERENCES graph.entities(id) ON DELETE CASCADE,
+  type TEXT NOT NULL,
+  weight DOUBLE PRECISION NOT NULL DEFAULT 1.0,
+  confidence DOUBLE PRECISION NOT NULL DEFAULT 0.8,
+  confidence_label TEXT,
+  timestamp TIMESTAMPTZ NOT NULL DEFAULT now(),
+  properties JSONB NOT NULL DEFAULT '{}'::jsonb,
+  UNIQUE(source_entity_id, target_entity_id, type)
+);
+CREATE INDEX IF NOT EXISTS idx_graph_relationships_source ON graph.relationships(source_entity_id);
+CREATE INDEX IF NOT EXISTS idx_graph_relationships_target ON graph.relationships(target_entity_id);
+CREATE INDEX IF NOT EXISTS idx_graph_relationships_type ON graph.relationships(type);
+
+CREATE TABLE IF NOT EXISTS graph.entity_memories (
+  entity_id UUID NOT NULL REFERENCES graph.entities(id) ON DELETE CASCADE,
+  memory_id UUID NOT NULL REFERENCES graph.memory_records(id) ON DELETE CASCADE,
+  PRIMARY KEY(entity_id, memory_id)
+);
+CREATE INDEX IF NOT EXISTS idx_graph_entity_memories_memory ON graph.entity_memories(memory_id);
+
+CREATE TABLE IF NOT EXISTS graph.agent_sessions (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  project_name TEXT,
+  started_at TIMESTAMP(3) NOT NULL,
+  last_event_at TIMESTAMP(3) NOT NULL,
+  event_count INTEGER NOT NULL DEFAULT 0,
+  properties JSONB NOT NULL DEFAULT '{}'::jsonb
+);
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent_time ON graph.agent_sessions(agent_id, started_at);
+
+CREATE TABLE IF NOT EXISTS graph.agent_goals (
+  id TEXT PRIMARY KEY,
+  statement TEXT NOT NULL,
+  owner_agent_id TEXT,
+  project_name TEXT,
+  status TEXT NOT NULL DEFAULT 'open',
+  priority INTEGER NOT NULL DEFAULT 5,
+  success_criteria TEXT,
+  parent_goal_id TEXT,
+  due_at TIMESTAMP(3),
+  achieved_at TIMESTAMP(3),
+  supersedes_id TEXT,
+  created_at TIMESTAMP(3) NOT NULL,
+  updated_at TIMESTAMP(3) NOT NULL,
+  source_memory_id TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_agent_goals_project_status ON graph.agent_goals(project_name, status, priority);
+
+CREATE TABLE IF NOT EXISTS graph.agent_events (
+  id TEXT PRIMARY KEY,
+  event_type TEXT NOT NULL,
+  occurred_at TIMESTAMP(3) NOT NULL,
+  sequence_index INTEGER NOT NULL,
+  actor_agent_id TEXT,
+  agent_role TEXT,
+  project_name TEXT,
+  session_id TEXT,
+  task_id TEXT,
+  goal_id TEXT,
+  parent_event_id TEXT,
+  intention TEXT,
+  outcome TEXT,
+  evidence_memory_id TEXT,
+  impact TEXT,
+  payload JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at TIMESTAMP(3) NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_events_time ON graph.agent_events(occurred_at, sequence_index);
+CREATE INDEX IF NOT EXISTS idx_agent_events_session_seq ON graph.agent_events(session_id, sequence_index);
+CREATE INDEX IF NOT EXISTS idx_agent_events_goal_time ON graph.agent_events(goal_id, occurred_at);
+CREATE INDEX IF NOT EXISTS idx_agent_events_memory ON graph.agent_events(evidence_memory_id);
+
+CREATE TABLE IF NOT EXISTS graph.agent_goal_links (
+  id TEXT PRIMARY KEY,
+  goal_id TEXT NOT NULL,
+  link_type TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  target_type TEXT NOT NULL,
+  created_at TIMESTAMP(3) NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_goal_links_goal ON graph.agent_goal_links(goal_id, target_type);
+
+CREATE TABLE IF NOT EXISTS graph.agent_semantic_labels (
+  id TEXT PRIMARY KEY,
+  source_memory_id TEXT NOT NULL,
+  event_id TEXT,
+  labeler TEXT NOT NULL,
+  schema_version INTEGER NOT NULL DEFAULT 1,
+  confidence DOUBLE PRECISION NOT NULL DEFAULT 0,
+  labels JSONB NOT NULL,
+  created_at TIMESTAMP(3) NOT NULL,
+  updated_at TIMESTAMP(3) NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory ON graph.agent_semantic_labels(source_memory_id, labeler);
+CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event ON graph.agent_semantic_labels(event_id);
+
+CREATE TABLE IF NOT EXISTS graph.agent_reflection_checkpoints (
+  id TEXT PRIMARY KEY,
+  project_name TEXT,
+  session_id TEXT,
+  window_start_at TIMESTAMP(3) NOT NULL,
+  window_end_at TIMESTAMP(3) NOT NULL,
+  event_count INTEGER NOT NULL DEFAULT 0,
+  goal_count INTEGER NOT NULL DEFAULT 0,
+  success_count INTEGER NOT NULL DEFAULT 0,
+  failure_count INTEGER NOT NULL DEFAULT 0,
+  risk_count INTEGER NOT NULL DEFAULT 0,
+  summary TEXT NOT NULL,
+  learnings JSONB NOT NULL DEFAULT '[]'::jsonb,
+  next_actions JSONB NOT NULL DEFAULT '[]'::jsonb,
+  evidence_event_ids JSONB NOT NULL DEFAULT '[]'::jsonb,
+  confidence DOUBLE PRECISION NOT NULL DEFAULT 0,
+  created_at TIMESTAMP(3) NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time ON graph.agent_reflection_checkpoints(project_name, window_end_at);
+CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time ON graph.agent_reflection_checkpoints(session_id, window_end_at);
+
+-- Minimal wiki projection tables used by projection-worker.ts before the
+-- full exe-wiki service has accepted API-ingested documents.
+CREATE TABLE IF NOT EXISTS wiki.workspaces (
+  id SERIAL PRIMARY KEY,
+  name TEXT NOT NULL,
+  slug TEXT NOT NULL UNIQUE,
+  chat_mode TEXT NOT NULL DEFAULT 'chat',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS wiki.workspace_documents (
+  id BIGSERIAL PRIMARY KEY,
+  doc_id TEXT NOT NULL UNIQUE,
+  filename TEXT NOT NULL,
+  docpath TEXT NOT NULL,
+  workspace_id INTEGER NOT NULL REFERENCES wiki.workspaces(id) ON DELETE CASCADE,
+  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
+  pinned BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_wiki_workspace_documents_workspace ON wiki.workspace_documents(workspace_id);
+CREATE INDEX IF NOT EXISTS idx_wiki_workspace_documents_docpath ON wiki.workspace_documents(docpath);
+
 -- Filtered schema — curated, deduplicated, entity-resolved data.
 -- Projected from raw.raw_events by daemon workers.
 CREATE SCHEMA IF NOT EXISTS filtered;
 
 -- Deduplicated person records from WhatsApp + CRM + manual entry
+-- Column names match projection-worker.ts ensureFilteredSchema (source of truth)
 CREATE TABLE IF NOT EXISTS filtered.contacts (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  phone TEXT UNIQUE,
+  name TEXT,
+  phone TEXT,
   email TEXT,
-  display_name TEXT NOT NULL,
-  source TEXT NOT NULL DEFAULT 'whatsapp',
-  source_id TEXT,
+  platform TEXT NOT NULL DEFAULT 'whatsapp',
+  platform_id TEXT,
   metadata JSONB DEFAULT '{}'::jsonb,
-  first_seen_at TIMESTAMPTZ DEFAULT now(),
-  last_seen_at TIMESTAMPTZ DEFAULT now(),
-  created_at TIMESTAMPTZ DEFAULT now(),
-  updated_at TIMESTAMPTZ DEFAULT now()
+  first_seen TIMESTAMPTZ NOT NULL DEFAULT now(),
+  last_seen TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(platform, platform_id)
 );
 
 CREATE INDEX IF NOT EXISTS idx_filtered_contacts_phone ON filtered.contacts (phone);
-CREATE INDEX IF NOT EXISTS idx_filtered_contacts_source ON filtered.contacts (source);
+CREATE INDEX IF NOT EXISTS idx_filtered_contacts_platform ON filtered.contacts (platform);
 
 -- Normalized chat threads across platforms
+-- Column names match projection-worker.ts ensureFilteredSchema (source of truth)
 CREATE TABLE IF NOT EXISTS filtered.conversations (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   contact_id UUID REFERENCES filtered.contacts(id),
   platform TEXT NOT NULL DEFAULT 'whatsapp',
-  remote_jid TEXT,
-  direction TEXT NOT NULL CHECK (direction IN ('inbound', 'outbound')),
-  content TEXT,
-  media_type TEXT,
-  timestamp TIMESTAMPTZ NOT NULL,
-  raw_event_id UUID,
-  created_at TIMESTAMPTZ DEFAULT now()
+  thread_id TEXT,
+  direction TEXT NOT NULL DEFAULT 'inbound',
+  content TEXT NOT NULL,
+  message_type TEXT NOT NULL DEFAULT 'text',
+  metadata JSONB DEFAULT '{}'::jsonb,
+  sent_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  source_ref TEXT,
+  UNIQUE(platform, source_ref)
 );
 
-CREATE INDEX IF NOT EXISTS idx_filtered_conversations_contact ON filtered.conversations (contact_id, timestamp DESC);
-CREATE INDEX IF NOT EXISTS idx_filtered_conversations_ts ON filtered.conversations (timestamp DESC);
+CREATE INDEX IF NOT EXISTS idx_filtered_conversations_contact ON filtered.conversations (contact_id, sent_at DESC);
+CREATE INDEX IF NOT EXISTS idx_filtered_conversations_ts ON filtered.conversations (sent_at DESC);
+CREATE INDEX IF NOT EXISTS idx_filtered_conversations_thread_sent ON filtered.conversations (platform, thread_id, sent_at);
 
 -- Knowledge documents for wiki ingestion
+-- Column names match projection-worker.ts ensureFilteredSchema (source of truth)
 CREATE TABLE IF NOT EXISTS filtered.documents (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   title TEXT NOT NULL,
@@ -128,8 +329,8 @@ CREATE TABLE IF NOT EXISTS filtered.documents (
   source TEXT NOT NULL DEFAULT 'exe-os',
   source_id TEXT,
   metadata JSONB DEFAULT '{}'::jsonb,
-  created_at TIMESTAMPTZ DEFAULT now(),
-  updated_at TIMESTAMPTZ DEFAULT now()
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(source, source_id)
 );
 
 CREATE INDEX IF NOT EXISTS idx_filtered_documents_type ON filtered.documents (doc_type);