@askexenow/exe-os 0.9.303 → 0.9.310

package/dist/{telemetry-upload-ZUFI5VH4.js → telemetry-upload-DWFGC2XJ.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-2XZ6X3PJ.js";
 import {
   getOrchestrationMetrics
-} from "./chunk-P4WXINQT.js";
-import "./chunk-N5G4T47B.js";
+} from "./chunk-OR3TAZL3.js";
+import "./chunk-SCYWCWKY.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-Q5V3B6BP.js";
+import "./chunk-GWPICNSO.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-VQRTO7IS.js";
 import "./chunk-7HLWBYH7.js";
@@ -14,8 +14,8 @@ import "./chunk-FXU7JOXK.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-UN6KSHLI.js";
-import "./chunk-V7E4I7J5.js";
+} from "./chunk-JV225JBX.js";
+import "./chunk-2EJ636HI.js";
 import {
   loadConfig
 } from "./chunk-DFIOOK5R.js";
@@ -398,14 +398,14 @@ async function buildTelemetryPayload(sinceHours = 24) {
   }
   let toolUsage;
   try {
-    const { getToolUsageSummary } = await import("./tool-telemetry-P6XVPFOF.js");
+    const { getToolUsageSummary } = await import("./tool-telemetry-BS5JXM5M.js");
     const summary = getToolUsageSummary();
     if (Object.keys(summary).length > 0) toolUsage = summary;
   } catch {
   }
   let calibration;
   try {
-    const { DreamingEngine } = await import("./dreaming-BZZAZHL5.js");
+    const { DreamingEngine } = await import("./dreaming-Q4E3WBGY.js");
     const engine = new DreamingEngine();
     const cal = await engine.computeCalibration("*", sinceHours);
     if (cal.assertions.total > 0 || cal.estimation.total > 0) {

package/dist/{token-budget-7BD6ROHF.js → token-budget-4RFZKWGH.js}

@@ -1,9 +1,9 @@
 import {
   createTokenBudgetMiddleware
-} from "./chunk-ZXZU6NCE.js";
-import "./chunk-N5G4T47B.js";
+} from "./chunk-ZOVHXTGC.js";
+import "./chunk-SCYWCWKY.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-Q5V3B6BP.js";
+import "./chunk-GWPICNSO.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-VQRTO7IS.js";
 import "./chunk-7HLWBYH7.js";

package/dist/{tool-capability-index-335P663V.js → tool-capability-index-ZEXBWKUZ.js}

@@ -1,7 +1,7 @@
 import {
   ToolCapabilityIndex,
   getToolCapabilityIndex
-} from "./chunk-6JJBGPMF.js";
+} from "./chunk-I3DPCSDG.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{tool-telemetry-P6XVPFOF.js → tool-telemetry-BS5JXM5M.js}

@@ -5,7 +5,7 @@ import {
   startToolTelemetryFlush,
   stopToolTelemetryFlush,
   wrapServerWithTelemetry
-} from "./chunk-Z77S2QQU.js";
+} from "./chunk-J3SR5MGG.js";
 import "./chunk-MLKGABMK.js";
 export {
   getToolUsageStats,

package/dist/tui/App.js

@@ -1,44 +1,44 @@
 #!/usr/bin/env node
 import {
   getSessionPrompt
-} from "../chunk-MGKZPSXW.js";
-import "../chunk-S76SQ6R5.js";
+} from "../chunk-IZPO6IOZ.js";
+import "../chunk-ISILDO7P.js";
 import "../chunk-VUH67PT4.js";
 import {
   sessionScopeFilter
-} from "../chunk-FMJ4D5G6.js";
-import "../chunk-5SYMJCBM.js";
-import "../chunk-E23LNUWJ.js";
+} from "../chunk-HED6D5KR.js";
+import "../chunk-RZJ6DXVE.js";
 import "../chunk-4JERP7NT.js";
 import "../chunk-4FVVJ7ME.js";
-import "../chunk-G4SVYLPT.js";
+import "../chunk-E23LNUWJ.js";
+import "../chunk-WJ2PZGRV.js";
+import "../chunk-SSTLTIF3.js";
 import "../chunk-KOO3J5PV.js";
 import "../chunk-22TVSRQQ.js";
-import "../chunk-SSTLTIF3.js";
-import "../chunk-P4WXINQT.js";
+import "../chunk-OR3TAZL3.js";
 import "../chunk-QB5JOGPK.js";
 import "../chunk-NGP6LSV2.js";
-import "../chunk-VTMPER4B.js";
+import "../chunk-XYG722JW.js";
 import "../chunk-CVYC6DUW.js";
 import "../chunk-OPU3NYOO.js";
 import "../chunk-GJV3WDWM.js";
 import {
   orgBus
 } from "../chunk-MP2AFCGL.js";
-import "../chunk-HDCP6CGI.js";
+import "../chunk-NIZQ3CIS.js";
 import "../chunk-HYZV25LY.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   isCoordinatorName
-} from "../chunk-N5G4T47B.js";
+} from "../chunk-SCYWCWKY.js";
 import "../chunk-2I23RPSI.js";
-import "../chunk-Q5V3B6BP.js";
+import "../chunk-GWPICNSO.js";
 import "../chunk-PNQDP3OA.js";
 import "../chunk-VQRTO7IS.js";
 import "../chunk-7HLWBYH7.js";
 import "../chunk-FXU7JOXK.js";
-import "../chunk-UN6KSHLI.js";
-import "../chunk-V7E4I7J5.js";
+import "../chunk-JV225JBX.js";
+import "../chunk-2EJ636HI.js";
 import {
   THEME_MODES,
   tuiPalette
@@ -6699,7 +6699,7 @@ function CommandCenterView({
     if (!chatMode || agentConfig) return;
     (async () => {
       try {
-        const { createProvider } = await import("../factory-CTFAGZUA.js");
+        const { createProvider } = await import("../factory-YHQZ6RZZ.js");
         const { ToolRegistry } = await import("../tool-registry-B2OLSYV6.js");
         const { createPermissionsFromPreset, EMPLOYEE_PERMISSIONS } = await import("../permissions-BTCYZNMN.js");
         const { getPresetByRole } = await import("../permission-presets-E3DZK46K.js");
@@ -7411,7 +7411,7 @@ function useOrchestrator(enabled = true) {
     let cancelled = false;
     async function init() {
       try {
-        const { MultiAgentOrchestrator } = await import("../orchestrator-DMM6AJVL.js");
+        const { MultiAgentOrchestrator } = await import("../orchestrator-PUT45J4O.js");
         const { getCoordinatorName, isCoordinatorRole, loadEmployees } = await import("../lib/employees.js");
         const { isExeSession } = await import("../lib/tmux-routing.js");
         const { listTmuxSessions, inTmux } = await import("../lib/tmux-status.js");
@@ -7452,7 +7452,7 @@ function useOrchestrator(enabled = true) {
         setTotalInProgress(health.totalInProgress);
         try {
           const { getClient } = await import("../lib/database.js");
-          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-ZGFHVDG5.js");
+          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-P5STKYAC.js");
           const client = getClient();
           const uoScope = sessionScopeFilter2();
           const result = await client.execute({
@@ -7484,7 +7484,7 @@ function useOrchestrator(enabled = true) {
   const spawnSession = useCallback5(
     async (agentId) => {
       try {
-        const { createTaskCore } = await import("../tasks-crud-KIZREZSN.js");
+        const { createTaskCore } = await import("../tasks-crud-24HMTULR.js");
         const { ensureEmployee } = await import("../lib/tmux-routing.js");
         const { getCoordinatorName } = await import("../lib/employees.js");
         await createTaskCore({
@@ -8108,7 +8108,7 @@ function TasksView({ onBack }) {
     const { withTrace } = await import("../telemetry-43X3GT3R.js");
     return withTrace("tui.tasks.loadTasks", async () => {
       try {
-        const { loadTaskList } = await import("../tui-data-QWJVWVTP.js");
+        const { loadTaskList } = await import("../tui-data-UNO5B7PU.js");
         const tasks = await loadTaskList();
         setAllTasks(
           tasks.map((task) => ({
@@ -8941,7 +8941,7 @@ function TeamView({ onBack, onViewSessions }) {
         let projectsByEmployee = /* @__PURE__ */ new Map();
         let currentTaskByEmployee = /* @__PURE__ */ new Map();
         try {
-          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-QWJVWVTP.js");
+          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-UNO5B7PU.js");
           setBadgeInFlight(true);
           const badgeCountsPromise = loadTeamBadgeCounts();
           const detailsPromise = loadTeamDetailMetrics(roster.map((emp) => emp.name));
@@ -9307,7 +9307,7 @@ function WikiView({ onBack }) {
     }
     setSearchLoading(true);
     try {
-      const { searchWikiMemoryRows } = await import("../tui-data-QWJVWVTP.js");
+      const { searchWikiMemoryRows } = await import("../tui-data-UNO5B7PU.js");
       setSearchResults(await searchWikiMemoryRows(query));
     } catch {
       setSearchResults([]);

package/dist/{tui-data-QWJVWVTP.js → tui-data-UNO5B7PU.js}

@@ -1,35 +1,35 @@
 import {
   sessionScopeFilter
-} from "./chunk-FMJ4D5G6.js";
-import "./chunk-5SYMJCBM.js";
-import "./chunk-E23LNUWJ.js";
+} from "./chunk-HED6D5KR.js";
+import "./chunk-RZJ6DXVE.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-4FVVJ7ME.js";
-import "./chunk-G4SVYLPT.js";
+import "./chunk-E23LNUWJ.js";
+import "./chunk-WJ2PZGRV.js";
+import "./chunk-SSTLTIF3.js";
 import "./chunk-KOO3J5PV.js";
 import "./chunk-22TVSRQQ.js";
-import "./chunk-SSTLTIF3.js";
-import "./chunk-P4WXINQT.js";
+import "./chunk-OR3TAZL3.js";
 import "./chunk-QB5JOGPK.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-VTMPER4B.js";
+import "./chunk-XYG722JW.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-OPU3NYOO.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-HDCP6CGI.js";
+import "./chunk-NIZQ3CIS.js";
 import "./chunk-HYZV25LY.js";
 import {
   getClient
-} from "./chunk-N5G4T47B.js";
+} from "./chunk-SCYWCWKY.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-Q5V3B6BP.js";
+import "./chunk-GWPICNSO.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-VQRTO7IS.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-UN6KSHLI.js";
-import "./chunk-V7E4I7J5.js";
+import "./chunk-JV225JBX.js";
+import "./chunk-2EJ636HI.js";
 import "./chunk-DFIOOK5R.js";
 import "./chunk-65DBIEM2.js";
 import "./chunk-MLKGABMK.js";

package/dist/{worker-gate-IHCMOXDF.js → worker-gate-C6CTTYMD.js}

@@ -6,7 +6,7 @@ import {
   releaseBackfillLock,
   tryAcquireBackfillLock,
   tryAcquireWorkerSlot
-} from "./chunk-C5CR4XDV.js";
+} from "./chunk-GMZMBLHT.js";
 import "./chunk-DFIOOK5R.js";
 import "./chunk-65DBIEM2.js";
 import "./chunk-MLKGABMK.js";

package/dist/{workflow-engine-PJ7JAO6E.js → workflow-engine-4W2KYCDV.js}

@@ -10,8 +10,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-7DAUFPDV.js";
-import "./chunk-ERAHOO7R.js";
+} from "./chunk-X4AFBL4N.js";
+import "./chunk-2NS3QRMJ.js";
 import "./chunk-MLKGABMK.js";
 export {
   advanceWorkflow,

package/dist/{worktree-4BR3ZQWN.js → worktree-2CXY6NEB.js}

@@ -7,11 +7,11 @@ import {
   parseInstanceLabel,
   worktreeBranch,
   worktreePath
-} from "./chunk-5SYMJCBM.js";
-import "./chunk-P4WXINQT.js";
-import "./chunk-N5G4T47B.js";
+} from "./chunk-RZJ6DXVE.js";
+import "./chunk-OR3TAZL3.js";
+import "./chunk-SCYWCWKY.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-Q5V3B6BP.js";
+import "./chunk-GWPICNSO.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-VQRTO7IS.js";
 import "./chunk-7HLWBYH7.js";

package/dist/{worktree-sweep-XCPOF3RD.js → worktree-sweep-K3CJFSUL.js}

@@ -2,12 +2,12 @@ import {
   cleanupAgentWorktree,
   discoverRepoPaths,
   sweepWorktrees
-} from "./chunk-UFYO4DLS.js";
-import "./chunk-5SYMJCBM.js";
-import "./chunk-P4WXINQT.js";
-import "./chunk-N5G4T47B.js";
+} from "./chunk-MTIJ2NXY.js";
+import "./chunk-RZJ6DXVE.js";
+import "./chunk-OR3TAZL3.js";
+import "./chunk-SCYWCWKY.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-Q5V3B6BP.js";
+import "./chunk-GWPICNSO.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-VQRTO7IS.js";
 import "./chunk-7HLWBYH7.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.303",
+  "version": "0.9.310",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -45,6 +45,7 @@
     "exe-timers": "./dist/bin/exe-timers.js",
     "exe-config-dump": "./dist/bin/exe-config-dump.js",
     "exe-stack-update": "./dist/bin/stack-update.js",
+    "exe-preflight": "./dist/bin/exe-preflight.js",
     "exe-cloud": "./dist/bin/exe-cloud.js",
     "exe-os-bulk-sync-postgres": "./dist/bin/bulk-sync-postgres.js"
   },
@@ -112,7 +113,7 @@
     "build": "bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true)",
     "deploy": "node dist/bin/pre-build-guard.js 2>/dev/null; npm run build && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "node dist/bin/install.js --commands-only || true",
-    "prepublishOnly": "npm run typecheck && npm run build && (node dist/bin/prune-orphan-chunks.js || true) && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
+    "prepublishOnly": "npm run typecheck && npm run build && node dist/bin/prune-orphan-chunks.js --force && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
     "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' && echo '::warning::clean-stack-projection quarantined (needs Docker); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner — passes locally). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
     "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",
     "guard:esm-require": "node scripts/check-no-runtime-require.mjs",

package/release-notes.json

@@ -1,52 +1,19 @@
 {
-  "current": "0.9.303",
+  "current": "0.9.310",
   "notes": {
-    "0.9.303": {
-      "version": "0.9.303",
+    "0.9.310": {
+      "version": "0.9.310",
       "date": "2026-06-22",
-      "features": [
-        "surface retrieval degradation in cloud_status/memory_audit/doctor (#246)",
-        "wire restart_telemetry action into config MCP tool (feature 3caa55e9) (#247)",
-        "live /mcp 503 + Retry-After when event loop is blocked (bcc70778)",
-        "add read-only telemetry reader + exe-search-quality CLI",
-        "add /exe-timers operator CLI — per-timer health dashboard (9ddc55b2)",
-        "enforce SCHEMA_VERSION bump on migration change (fc72433f)",
-        "wire createTokenBudgetMiddleware into session-manager (d4d7ba0d)",
-        "CPU-steal detection in daemon health + boot brief (#245)",
-        "add exe-config-dump — read-only effective config dump with provenance",
-        "surface orchestration-health telemetry (spawn_failures, orchestration_health, work_map)",
-        "enrich session-kill death attribution (role + load + cause)",
-        "worktree-discipline guard — emit worktree.bypassed when code-role lands in main checkout (hardening 03-B)"
-      ],
+      "features": [],
       "fixes": [
-        "replace single-origin CORS with domain-scoped whitelist (bug 7772300f)",
-        "prevent concurrent builds from corrupting daemon chunk manifest (bug 22d2af5a)",
-        "remove phantom auto-pair route + fix alert auth & cooldown (bug b9a54e21)",
-        "pin exe-db to versioned tag + add missing infra deps to manifest (bugs ee16e7ef P0, 4948fc48 P0)",
-        "correct stale docs + missing healthchecks + broken setup path (bug 3191b765)",
-        "lazy DB init guards \"Database client not initialized\" race (bug 2d8842e6)",
-        "pin image tags + replace host networking with bridge (bug 4ee36dc8)",
-        "eliminate isDaemonAlive false-negative when PID file missing (bug b5fb9404) (#244)",
-        "monitor volume path + EXE_MONITOR_KEY backfill (bugs 1fdb8be9 P1, 84d9a74a P1)",
-        "quarantine 4 timing-sensitive tests + add missing mock exports (bug dfb25bf1)",
-        "correct cpuStealSeverity cast — self-referential 'as typeof' narrowed to 'na' (follow-up to #245)",
-        "gateway-watchdog accurate+fail-safe (facd5078) & overlay survives upgrade (02bc1bb8)",
-        "break hook⇄daemon CPU-starvation spiral (db33dba1, be1457c2)",
-        "provision MONITOR_API_KEY to exe-crm + exe-wiki services (bug b99d3762)",
-        "optional daemon-shared MCP rate counter, hot-path-safe (bug d55d5830)",
-        "bind agent identity to MCP session — block shared-token impersonation (bug 7bfd208a, P0 SECURITY)",
-        "harden tmux spawn PATH + classify spawn failures (bug bbf7824c)",
-        "inherit+derive spawn PATH (bbf7824c); bounded daemon-ready retry before degraded boot (78d7526c)"
+        "kill the version-bump reload storm — surface-hash marker + reload debounce",
+        "enforce canonical 4096 daemon heap cap, correct stale 6144 (bug f215433d)",
+        "fail-closed BYOK env-contract — direct keys only on explicit BYOK (bug df8823d0)",
+        "erp healthHost localhost not askexe.com (preflight gate)"
       ],
       "security": [],
       "other": [
-        "bump v0.9.303 — 17 bug fixes (4 P0, 7 P1, 3 P2, 1 P3 + Baileys WA version + build lock + CORS whitelist)",
-        "move ps/pgrep off the main event loop (async execFile)",
-        "disaster-recovery test — prove a backup can be restored (feat 57a1d161)",
-        "extract shared buildStatusFilter helper (feat 0e9162d2)",
-        "dedupe spawn PATH to single buildSpawnPath() source",
-        "fix false-positive DELETE lint + device-id cache leak across tests",
-        "regenerate 0.9.302 notes from commit log (post-publish)"
+        "stack manifest v0.9.25 — 17 bug fixes, gateway v0.9.24 with WhatsApp/CRM/BYOK fixes"
       ],
       "migration_notes": []
     },

package/stack.release.json

@@ -4,58 +4,58 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.270",
-  "image": "ghcr.io/askexe/exe-os:v0.9.270",
+  "version": "0.9.310",
+  "image": "ghcr.io/askexe/exe-os:v0.9.310",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "components": {
     "erp": {
-      "image": "ghcr.io/askexe/exe-erp:v0.2.0-final8",
+      "image": "ghcr.io/askexe/exe-erp:v0.9.310",
       "env": "ERP_IMAGE_TAG",
       "composeService": "exe-erp",
       "note": "Bug 790794e8: pinned to v0.2.0-final8 — first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15). Earlier final3/final7 crash-looped exe-erp-websocket (missing socketio.js)."
     },
     "exe-db": {
-      "image": "pgvector/pgvector:0.8.0-pg16",
+      "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9:v0.9.310",
       "env": "EXE_DB_IMAGE",
       "composeService": "exe-db",
       "category": "infra",
       "note": "Bug ee16e7ef: pinned to versioned 0.8.0-pg16 tag (was mutable :pg16)."
     },
     "redis": {
-      "image": "redis:7.4-alpine",
+      "image": "redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99:v0.9.310",
       "env": "REDIS_IMAGE",
       "composeService": "redis",
       "category": "infra",
       "note": "Bug 4948fc48: compose-pinned infra dep required by CRM, gateway, ERP."
     },
     "clickhouse": {
-      "image": "clickhouse/clickhouse-server:24.8.4.13-alpine",
+      "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c:v0.9.310",
       "env": "CLICKHOUSE_IMAGE",
       "composeService": "clickhouse",
       "category": "infra",
       "note": "Bug 4948fc48: compose-pinned infra dep required by CRM."
     },
     "cloudflared": {
-      "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+      "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f:v0.9.310",
       "composeService": "cloudflared",
       "category": "infra",
       "note": "Bug 4948fc48: digest-pinned tunnel — no env override, managed in compose."
     },
     "exe-sso-edge": {
-      "image": "nginx:alpine",
+      "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c:v0.9.310",
       "composeService": "exe-sso-edge",
       "category": "infra",
       "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP — uses stock nginx:alpine."
     },
     "exe-otel-collector": {
-      "image": "otel/opentelemetry-collector-contrib:0.114.0",
+      "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197:v0.9.310",
       "env": "OTEL_COLLECTOR_IMAGE",
       "composeService": "exe-otel-collector",
       "category": "infra",
       "note": "Bug 4948fc48: OTLP collector for traces/metrics/logs."
     },
     "gotrue": {
-      "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+      "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4:v0.9.310",
       "composeService": "gotrue",
       "category": "infra",
       "note": "Bug 4948fc48: GoTrue auth backend — digest-pinned in compose."
@@ -102,5 +102,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.270"
+  "sourceVersion": "0.9.310"
 }