@askexenow/exe-os 0.9.311 → 0.9.313

package/deploy/compose/.env.askexe-control-plane.example

@@ -2,7 +2,7 @@
 # This file is for AskExe-owned infrastructure only. Do NOT use for Hygo/customer VPSs.
 
 # --- Central monitor hub (AskExe-owned: monitor.askexe.com) ---
-MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.2
+MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.5
 MONITOR_HUB_PUBLIC_URL=https://monitor.askexe.com
 MONITOR_HUB_SOURCE_DIR=/opt/exe-monitor
 MONITOR_HUB_HOST_PORT=8090

package/deploy/compose/.env.customer.example

@@ -7,6 +7,10 @@
 DOMAIN=CHANGEME_DOMAIN
 
 # --- Data Layer ---
+# bug 8dc31733: EXE_DB_IMAGE overrides the Postgres image tag in compose.
+# The manifest declares env: "EXE_DB_IMAGE" — keep this in sync with the
+# stack manifest pin. Defaults to pgvector/pgvector:0.8.0-pg16 in compose.
+# EXE_DB_IMAGE=pgvector/pgvector:0.8.0-pg16
 POSTGRES_USER=exe
 POSTGRES_PASSWORD=CHANGEME_POSTGRES_PASSWORD
 POSTGRES_DB=exedb
@@ -57,13 +61,13 @@ AUTH_DEFAULT_PRODUCT=AUTH
 AUTH_DISABLE_SIGNUP=true
 
 # --- CRM ---
-CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.47
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.51
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.21
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.26
 WIKI_DB_SCHEMA=wiki
 WIKI_VECTOR_DB=exeOsMcp
 WIKI_AUTH_TOKEN=CHANGEME_WIKI_AUTH_TOKEN
@@ -77,7 +81,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.256
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.311
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=CHANGEME_DEVICE_ID
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -87,7 +91,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- ERP (Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.2.0-final8
+ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.2.2
 # Administrator password for the ERPNext site (created on first boot).
 # bug 43854b31: this only applies at FIRST boot. To rotate it later you must also
 # run `bench --site $ERP_SITE_NAME set-admin-password <new>` inside exe-erp —
@@ -103,7 +107,7 @@ ERP_WS_PORT=9069
 ERP_SENTRY_DSN=
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v0.9.16
+GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v0.9.24
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -121,7 +125,7 @@ GATEWAY_WS_HOST_PORT=3101
 CRM_GRAPHQL_URL=http://exe-crm:3000/graphql
 
 # --- Monitoring hub (PocketBase — local per-customer instance) ---
-MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v0.9.4
+MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v0.9.5
 MONITOR_HUB_PORT=8090
 # Bootstrap superuser created on first start. Use your admin email + a strong password.
 # After first boot these values are no longer used (stored in pb_data volume).
@@ -154,7 +158,7 @@ GATEWAY_ALERT_URL=http://exe-gateway:3100/api/alerts/error-spike
 # host-access prompt, or uncomment COMPOSE_PROFILES below.
 # Full scope details: deploy/monitor/HOST-ACCESS-CONSENT.md
 # COMPOSE_PROFILES=monitor-agent
-MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v0.9.4
+MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v0.9.5
 # Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
 # bug dacf0042: TOKEN and KEY MUST start EMPTY (the safe "unpaired" state) — NOT a

package/deploy/compose/.env.default

@@ -13,10 +13,10 @@ EXE_LICENSE_KEY=CHANGEME_EXE_LICENSE_KEY
 # ------------------------------------------------------------------
 # Image tags (per-client pinning — never use :latest in production)
 # ------------------------------------------------------------------
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.1
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.1
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.66
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.1
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.51
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.26
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.311
+GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.24
 
 # ------------------------------------------------------------------
 # Postgres (shared by CRM + wiki)

package/deploy/compose/.env.example

@@ -84,14 +84,14 @@ AUTH_DEFAULT_PRODUCT=AUTH
 AUTH_DISABLE_SIGNUP=true
 
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.47
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.51
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.21
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.26
 WIKI_DB_SCHEMA=wiki
 WIKI_VECTOR_DB=exeOsMcp
 WIKI_AUTH_TOKEN=CHANGEME_WIKI_AUTH_TOKEN
@@ -105,7 +105,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.258
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.311
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=vps-default
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -115,7 +115,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.17
+GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.24
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -144,7 +144,7 @@ ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
 
 # --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.2.0-final8
+ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.2.2
 ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD
 EXE_ERP_ADMIN_TOKEN=CHANGEME_EXE_ERP_ADMIN_TOKEN
 # Frappe site name — must match the erp.<domain> the customer serves (bug e61ad373).
@@ -162,7 +162,7 @@ EXE_BUILD_WS_PORT=7643
 EXE_BUILD_HTTP_PORT=9222
 
 # --- Monitoring hub (PocketBase — local per-customer instance) ---
-MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.4
+MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.5
 MONITOR_HUB_PORT=8090
 # Bootstrap superuser created on first start. Use your admin email + a strong password.
 # After first boot these values are no longer used (stored in pb_data volume).
@@ -180,7 +180,7 @@ MONITOR_HUB_ADMIN_PASSWORD=CHANGEME_MONITOR_HUB_ADMIN_PASSWORD
 # To enable: run setup.sh and acknowledge the host-access prompt, or add
 # "monitor-agent" to COMPOSE_PROFILES below. Scope: deploy/monitor/HOST-ACCESS-CONSENT.md.
 # COMPOSE_PROFILES=monitor-agent
-MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.4
+MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.5
 # Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
 # bug dacf0042: TOKEN and KEY MUST start EMPTY (the safe "unpaired" state) —

package/deploy/compose/docker-compose.yml

@@ -236,7 +236,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-monitor-hub:
-    image: ${MONITOR_HUB_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-hub:v0.9.4}
+    image: ${MONITOR_HUB_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-hub:v0.9.5}
     container_name: exe-monitor-hub
     restart: unless-stopped
     # bug d3d49101 / 1fdb8be9: PocketBase's data dir for this hub is a RELATIVE
@@ -311,7 +311,7 @@ services:
   # ------------------------------------------------------------------
 
   exe-crm:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.48}
+    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.51}
     container_name: exe-crm
     restart: unless-stopped
     # bug ad4471ad: NO compose `command` override. The image entrypoint
@@ -380,7 +380,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-crm-worker:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.48}
+    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.51}
     container_name: exe-crm-worker
     restart: unless-stopped
     command: ["yarn", "worker:prod"]
@@ -440,7 +440,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-wiki:
-    image: ${WIKI_IMAGE_TAG:-ghcr.io/askexe/exe-wiki:v0.9.23}
+    image: ${WIKI_IMAGE_TAG:-ghcr.io/askexe/exe-wiki:v0.9.26}
     container_name: exe-wiki
     restart: unless-stopped
     # Wiki uses Prisma — runs migrate on boot via built-in entrypoint.
@@ -507,7 +507,7 @@ services:
       # offline boots fail). WIKI_EXE_OS_NPM_VERSION defaults to the stack's
       # pinned exe-os npm version and is threaded into the spawn args.
       EXE_OS_MCP_COMMAND: ${WIKI_EXE_OS_MCP_COMMAND:-npx}
-      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.278} mcp}
+      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.312} mcp}
       BRANDING_CONFIG_PATH: /app/branding.json
     ports:
       - "127.0.0.1:${WIKI_HOST_PORT:-3001}:3001"
@@ -531,7 +531,7 @@ services:
   # to pin the split server image; falls back to the combined EXE_OS_IMAGE_TAG
   # for backward compatibility with existing manifests.
   exe-os:
-    image: ${EXE_OS_SERVER_IMAGE_TAG:-${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.270}}}
+    image: ${EXE_OS_SERVER_IMAGE_TAG:-${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.311}}}
     container_name: exe-os
     restart: unless-stopped
     # bug debf4a39 / 93ddfa27: the daemon connects to exe-db at boot
@@ -596,7 +596,7 @@ services:
   # the GGUF model files at /home/exed/.exe-os/models/.
   # ------------------------------------------------------------------
   exe-os-worker:
-    image: ${EXE_OS_WORKER_IMAGE_TAG:-ghcr.io/askexe/exe-os-worker:v0.9.270}
+    image: ${EXE_OS_WORKER_IMAGE_TAG:-ghcr.io/askexe/exe-os-worker:v0.9.311}
     container_name: exe-os-worker
     profiles: ["embeddings"]
     restart: unless-stopped
@@ -635,7 +635,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-gateway:
-    image: ${GATEWAY_IMAGE_TAG:-ghcr.io/askexe/exe-gateway:v0.9.21}
+    image: ${GATEWAY_IMAGE_TAG:-ghcr.io/askexe/exe-gateway:v0.9.24}
     container_name: exe-gateway
     restart: unless-stopped
     # Gateway needs 45s to flush outbound queues + disconnect Baileys adapters.
@@ -716,7 +716,11 @@ services:
       - "127.0.0.1:${GATEWAY_WS_HOST_PORT:-3101}:3101"
     volumes:
       - gateway_data:/data
-      - gateway_whatsapp_auth:/app/auth_info
+      # bug 99281cd8: mount the WhatsApp auth volume under EXE_GATEWAY_HOME
+      # (/data), NOT /app/auth_info. The gateway resolves authDir relative to
+      # EXE_GATEWAY_HOME; the old /app/auth_info mount was unreachable when the
+      # gateway used its default path. gateway.json authDir updated to match.
+      - gateway_whatsapp_auth:/data/auth_info
       - ./gateway.json:/data/gateway.json:ro
       # bug 02bc1bb8: PERSISTENT customer-overlay bind-mount. Anything the
       # customer drops in the host ./overlay dir (e.g. po-intake.js) is exposed
@@ -758,7 +762,7 @@ services:
   # include "monitor-agent". See deploy/monitor/HOST-ACCESS-CONSENT.md.
   # ------------------------------------------------------------------
   exe-monitor-agent:
-    image: ${MONITOR_AGENT_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-agent:v0.9.4}
+    image: ${MONITOR_AGENT_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-agent:v0.9.5}
     container_name: exe-monitor-agent
     # Host-access consent gate: only starts when the operator has
     # acknowledged the host-access scope (COMPOSE_PROFILES=monitor-agent).
@@ -838,7 +842,7 @@ services:
   # Without a token the binary exits 0 (no crash-loop). (bug 3416cead)
   # ------------------------------------------------------------------
   exe-update:
-    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.270}}
+    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.311}}
     container_name: exe-update
     profiles: ["registry-proxy", "askexe-control-plane"]
     restart: unless-stopped
@@ -968,11 +972,14 @@ services:
     # Token mode: `tunnel run --token <TOKEN>` — no local credentials file needed.
     # The token embeds the tunnel ID + credentials; routes are managed in the CF dashboard.
     # --metrics exposes a local HTTP endpoint used by the healthcheck.
+    # bug 820c6473: CLOUDFLARE_TUNNEL_TOKEN must be required (:?) so a missing
+    # token fails at `docker compose up` parse time instead of silently starting
+    # cloudflared with an empty --token (which connects to nothing).
     command: >
       tunnel
       --metrics localhost:2000
       run
-      --token ${CLOUDFLARE_TUNNEL_TOKEN}
+      --token ${CLOUDFLARE_TUNNEL_TOKEN:?CLOUDFLARE_TUNNEL_TOKEN is required — create a tunnel in the Cloudflare dashboard and paste the token in .env}
     depends_on:
       # App subdomains (crm/wiki/erp) are fronted by exe-sso-edge for the unified
       # SSO redirect (bug 96f8b2b2); gateway is routed directly.
@@ -981,7 +988,7 @@ services:
       exe-gateway:
         condition: service_healthy
     environment:
-      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}
+      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:?CLOUDFLARE_TUNNEL_TOKEN is required — create a tunnel in the Cloudflare dashboard and paste the token in .env}
     networks:
       - backend
       - frontend
@@ -1336,11 +1343,23 @@ services:
       - "127.0.0.1:${OTEL_HEALTH_PORT:-13133}:13133" # Health check
     networks:
       - backend
-    # otel-contrib is a scratch image (no shell/wget/curl). Health is monitored
-    # externally via curl http://127.0.0.1:13133/ from health-monitor.sh.
-    # The health_check extension inside the collector still runs on :13133.
-    healthcheck:
-      test: ["NONE"]
+    # Bug 2e8ef511: otel-contrib is a distroless image — only the /otelcol-contrib
+    # binary is present (no shell/wget/curl/nc, and the binary has no probe
+    # subcommand), so a Docker `healthcheck.test` CMD that runs INSIDE the
+    # container cannot be implemented for this upstream, pull-only image. The old
+    # `test: ["NONE"]` actively DISABLED health, so a broken collector still
+    # reported "running" — a silent observability gap.
+    #
+    # The collector's health_check extension serves HTTP 200 on :13133, and that
+    # port is published to 127.0.0.1 above. Health is therefore verified
+    # EXTERNALLY: status.sh now probes http://127.0.0.1:${OTEL_HEALTH_PORT}/
+    # alongside every other service endpoint, so a down/unhealthy collector is
+    # surfaced by the stack health tooling instead of hiding behind "running".
+    # Keep that probe in lockstep with the OTEL_HEALTH_PORT mapping above.
+    #
+    # NOTE: we intentionally do NOT set `test: ["NONE"]`. Leaving healthcheck
+    # unset inherits the upstream image's own HEALTHCHECK if one is ever added,
+    # whereas ["NONE"] would permanently suppress it.
     deploy:
       resources:
         limits:
@@ -1398,6 +1417,10 @@ services:
       gotrue:
         condition: service_healthy
     healthcheck:
+      # bug 0da060e5: exe-auth is a static nginx site — use --spider to verify the
+      # server answers without downloading the full page body. Previous probe used
+      # -qO- (downloaded content to stdout, no start_period). --spider exits 0 on
+      # any 2xx/3xx and avoids wasting bandwidth.
       # bug 2976868a: this probes the exe-auth nginx ("/" serves the login SPA),
       # which proves the gateway UI is up but NOT that the GoTrue login backend is
       # reachable. The stack-level SSO/login gate is enforced separately by the
@@ -1406,9 +1429,10 @@ services:
       # while this static page stays green. (Strengthening THIS probe to the
       # GoTrue-proxied path lives in the exe-auth image, which owns the nginx
       # /api/ rewrite — not this compose file.)
-      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/"]
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:80/"]
       interval: 30s
       timeout: 5s
+      start_period: 10s
       retries: 3
     deploy:
       resources:

package/deploy/compose/gateway.json

@@ -8,12 +8,12 @@
     "whatsapp": {
       "enabled": true,
       "credentials": {
-        "authDir": "/app/auth_info/default"
+        "authDir": "/data/auth_info/default"
       },
       "accounts": [
         {
           "name": "default",
-          "authDir": "/app/auth_info/default"
+          "authDir": "/data/auth_info/default"
         }
       ]
     }

package/deploy/compose/init-db.sql

@@ -164,26 +164,12 @@ DO $$ DECLARE s text; BEGIN
   END LOOP;
 END $$;
 
--- Create raw.raw_events landing pad
-CREATE TABLE IF NOT EXISTS raw.raw_events (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  source TEXT NOT NULL,
-  source_id TEXT,
-  event_type TEXT NOT NULL,
-  payload JSONB NOT NULL,
-  metadata JSONB,
-  timestamp TIMESTAMPTZ DEFAULT now(),
-  created_at TIMESTAMPTZ DEFAULT now(),
-  processed_at TIMESTAMPTZ,
-  failed_at TIMESTAMPTZ,
-  retry_count INT NOT NULL DEFAULT 0,
-  error TEXT,
-  projections JSONB DEFAULT '{}'::jsonb
-);
-
-SELECT pg_temp.exe_create_index_if_columns_exist('idx_raw_events_unprocessed', 'raw', 'raw_events', ARRAY['created_at', 'processed_at'], 'CREATE INDEX IF NOT EXISTS idx_raw_events_unprocessed ON raw.raw_events (created_at) WHERE processed_at IS NULL');
-SELECT pg_temp.exe_create_index_if_columns_exist('idx_raw_events_retryable', 'raw', 'raw_events', ARRAY['failed_at', 'processed_at', 'retry_count'], 'CREATE INDEX IF NOT EXISTS idx_raw_events_retryable ON raw.raw_events (failed_at) WHERE processed_at IS NULL AND failed_at IS NOT NULL AND retry_count < 5');
-SELECT pg_temp.exe_create_index_if_columns_exist('uq_raw_events_dedup', 'raw', 'raw_events', ARRAY['source', 'source_id', 'event_type'], 'CREATE UNIQUE INDEX IF NOT EXISTS uq_raw_events_dedup ON raw.raw_events (source, source_id, event_type)');
+-- raw.raw_events — SCHEMA OWNER: exe-db Prisma migrations (bug dc149875).
+-- DO NOT create this table here. exe-db owns the raw_events schema via Prisma
+-- migrations (20260504083822_add_raw_landing_pad + subsequent ALTERs). Creating
+-- the table here with different column types (UUID vs TEXT id, TIMESTAMPTZ vs
+-- TIMESTAMP) caused conflicts when Prisma migrations ran afterwards.
+-- The projection-worker self-heals missing columns via ADD COLUMN IF NOT EXISTS.
 
 -- ---------------------------------------------------------------------------
 -- Graph schema — Company Brain memory + GraphRAG projection targets.

package/deploy/compose/setup.sh

@@ -52,118 +52,27 @@ info "Step 2: Generating .env file"
 if [[ -f .env ]]; then
   warn ".env already exists — skipping generation. Delete .env to regenerate."
 else
+  # generate-env.ts is the SINGLE SOURCE OF TRUTH for image tags + secrets — its
+  # image-tag constants are kept in lockstep with deploy/stack-manifests/v0.9.json.
+  # Bug 716c0f6e: the previous inline shell fallback hardcoded STALE tag-only refs
+  # (exe-os:v0.9.155, exe-crm:v0.9.3, gateway:v0.9.3, …) far behind the manifest,
+  # so any failure of the generator silently deployed ancient images that bypass
+  # the manifest's digest-pinning entirely. There is NO safe inline fallback for
+  # image tags — fail loudly instead and let the operator install node/npx.
   if command -v node >/dev/null 2>&1 && command -v npx >/dev/null 2>&1; then
-    # generate-env.ts is a TypeScript ESM file shipped at deploy/compose/generate-env.ts.
-    # Run it via npx tsx (the project is pure ESM — require() is forbidden).
-    npx --yes tsx "$SCRIPT_DIR/generate-env.ts" "$CLIENT" "$DOMAIN" "${LICENSE:-}" > .env 2>/dev/null || {
-      # Fallback: generate inline
-      info "Generating secrets inline..."
-      gen() { openssl rand -hex "$1"; }
-      cat > .env << ENVEOF
-DOMAIN=${DOMAIN}
-POSTGRES_USER=exe
-POSTGRES_PASSWORD=$(gen 32)
-POSTGRES_DB=exedb
-CLICKHOUSE_DB=default
-CLICKHOUSE_USER=exe
-CLICKHOUSE_PASSWORD=$(gen 32)
-REDIS_PASSWORD=$(gen 32)
-GOTRUE_JWT_SECRET=$(gen 48)
-# Bug dc99d78e: SITE_URL = auth gateway (not crm) so email links + GoTrue's
-# default redirect honor the originating product's ?redirect= via SPA /confirm.
-GOTRUE_SITE_URL=https://auth.${DOMAIN}
-GOTRUE_EXTERNAL_URL=https://auth.${DOMAIN}
-# SSO redirect allow-list (bug 66f8e10a): app origins the gateway may bounce
-# users back to via ?redirect=. Required for unified SSO across crm/wiki/erp.
-GOTRUE_URI_ALLOW_LIST=https://crm.${DOMAIN},https://wiki.${DOMAIN},https://erp.${DOMAIN}
-# Bug 0327b017: scope the session cookie to the PARENT apex domain so it is
-# shared across crm/wiki/erp/auth subdomains → true SSO (no re-login).
-GOTRUE_COOKIE_DOMAIN=.${DOMAIN}
-GOTRUE_COOKIE_KEY=exe-auth
-# Invite-only by default; never autoconfirm without an SMTP round-trip (bug 36c04fe3).
-# Configure SMTP_HOST below and keep MAILER_AUTOCONFIRM=false to verify email ownership.
-GOTRUE_DISABLE_SIGNUP=true
-GOTRUE_MAILER_AUTOCONFIRM=false
-GOTRUE_EXTERNAL_EMAIL_ENABLED=true
-GOTRUE_EXTERNAL_PHONE_ENABLED=false
-# Auth-email From address — customer domain, not askexe.com (bug 133c9d5b).
-SMTP_FROM=noreply@${DOMAIN}
-SMTP_HOST=
-SMTP_PORT=587
-SMTP_USER=
-SMTP_PASS=
-IS_SIGN_UP_DISABLED=true
-AUTH_PASSWORD_ENABLED=true
-# --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
-# Bug 58840873: pin the auth image so compose never falls back to its stale
-# default tag. Bug 379e5c13: server_name/CORS from the configured apex domain
-# directly (no last-2-label slicing → safe for company.co.uk). Bug 5960ebb1:
-# AUTH_DISABLE_SIGNUP mirrors GOTRUE_DISABLE_SIGNUP so the SPA hides signup UI.
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.2.0
-AUTH_SERVER_NAME=auth.${DOMAIN}
-AUTH_CORS_ORIGIN=https://${DOMAIN}
-AUTH_DEFAULT_PRODUCT=AUTH
-AUTH_DISABLE_SIGNUP=true
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.3
-CRM_SERVER_URL=https://crm.${DOMAIN}
-CRM_APP_SECRET=$(gen 48)
-EXE_CRM_ADMIN_TOKEN=$(gen 48)
-CRM_HOST_PORT=3000
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.4
-WIKI_DB_SCHEMA=wiki
-WIKI_VECTOR_DB=exeOsMcp
-WIKI_AUTH_TOKEN=$(gen 48)
-EXE_WIKI_ADMIN_TOKEN=$(gen 48)
-WIKI_JWT_SECRET=$(gen 48)
-WIKI_SIG_KEY=$(gen 48)
-WIKI_SIG_SALT=$(gen 16)
-WIKI_HOST_PORT=3001
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.155
-EXED_MCP_TOKEN=$(gen 48)
-EXED_DEVICE_ID=vps-${CLIENT}
-EXE_MCP_HOST_BIND=0.0.0.0
-EXE_MCP_HOST_PORT=48739
-EXE_CLOUD_SYNC_TO_POSTGRES=true
-EXE_LICENSE_KEY=${LICENSE:-CHANGEME_EXE_LICENSE_KEY}
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.3
-EXE_GATEWAY_AUTH_TOKEN=$(gen 48)
-EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=$(gen 48)
-EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=$(gen 32)
-API_ROUTER_URL=https://gateway.${DOMAIN}
-GATEWAY_HTTP_HOST_PORT=3100
-GATEWAY_WS_HOST_PORT=3101
-MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.4
-MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.4
-EXE_MONITOR_ADMIN_TOKEN=$(gen 48)
-# bug a125785d: shared secret for hub error ingestion (POST /api/exe-monitor/errors).
-# The hub fails CLOSED (rejects all ingestion) when unset, so generate one and
-# wire it to every error-reporting service via X-Monitor-Key.
-EXE_MONITOR_KEY=$(gen 32)
-# bug 182c6da3: URL the hub POSTs error-spike alerts to. Unset = alerting silently
-# disabled. Default to the gateway's error-spike endpoint (POST /api/alerts/error-spike
-# on the gateway HTTP port) so spikes reach WhatsApp alerting.
-GATEWAY_ALERT_URL=http://exe-gateway:3100/api/alerts/error-spike
-MONITOR_HUB_URL=http://exe-monitor-hub:8090
-MONITOR_HUB_PORT=8090
-# Bootstrap superuser — created on first start, stored in pb_data afterwards.
-MONITOR_HUB_ADMIN_EMAIL=admin@${DOMAIN}
-MONITOR_HUB_ADMIN_PASSWORD=$(gen 24)
-# bug dacf0042: leave TOKEN/KEY EMPTY (not a CHANGEME placeholder). The agent
-# treats empty as "unpaired, keep retrying" — the safe state. `exe-os stack-update`
-# fills the real values after pairing the agent with the hub. A non-empty
-# placeholder would be submitted to the hub as a bogus token forever.
-MONITOR_AGENT_TOKEN=
-MONITOR_AGENT_KEY=
-MONITOR_AGENT_LISTEN=:45876
-# --- R2 (Cloudflare) — shared by media uploads + VPS backups ---
-R2_MEDIA_BUCKET=CHANGEME_R2_BUCKET
-R2_MEDIA_ENDPOINT=CHANGEME_https://ACCOUNT_ID.r2.cloudflarestorage.com
-R2_MEDIA_ACCESS_KEY=CHANGEME_R2_ACCESS_KEY
-R2_MEDIA_SECRET_KEY=CHANGEME_R2_SECRET_KEY
-# --- Backup encryption (customer-owned, AskExe cannot decrypt) ---
-EXE_BACKUP_KEY=$(gen 32)
-ENVEOF
-    }
+    # Run via npx tsx (the project is pure ESM — require() is forbidden).
+    if ! npx --yes tsx "$SCRIPT_DIR/generate-env.ts" "$CLIENT" "$DOMAIN" "${LICENSE:-}" > .env 2>/tmp/exe-generate-env.err; then
+      rm -f .env
+      err "generate-env.ts failed — refusing to write a .env with stale fallback image tags."
+      err "Generator error:"; cat /tmp/exe-generate-env.err >&2 || true
+      err "Fix node/tsx and re-run setup.sh (the inline fallback was removed: bug 716c0f6e)."
+      exit 1
+    fi
+  else
+    err "node + npx are required to generate .env (single source of truth for"
+    err "manifest-pinned image tags). Install Node.js, then re-run setup.sh."
+    err "The stale inline fallback was removed (bug 716c0f6e)."
+    exit 1
   fi
   # bug 759d13db: lock the secret file to owner-only even if a prior umask was
   # looser or the node generator path created it before umask took effect.
@@ -259,12 +168,12 @@ if [[ ! -f gateway.json ]]; then
     "whatsapp": {
       "enabled": true,
       "credentials": {
-        "authDir": "/app/auth_info/default"
+        "authDir": "/data/auth_info/default"
       },
       "accounts": [
         {
           "name": "default",
-          "authDir": "/app/auth_info/default"
+          "authDir": "/data/auth_info/default"
         }
       ]
     }
@@ -289,27 +198,60 @@ else
   info "Cloudflared config exists."
 fi
 
-# Step 4: Pull images
-info "Step 4: Pulling Docker images..."
-docker compose pull 2>&1 || { err "Image pull failed — check GHCR authentication"; exit 1; }
+# Step 4+5: Bring up the stack.
+#
+# Bug 716c0f6e: first-install must route through `exe-os stack-update` — the SAME
+# gated path used for upgrades — so a fresh deploy gets the manifest's
+# digest-pinned image refs, the BLOCKING static preflight gate, registry/proxy
+# auth, health-gated rollout, and automatic rollback on failure. Raw
+# `docker compose pull && up` skips ALL of that and pulls whatever tags happen to
+# be in .env with no preflight, no rollback, and no health sequencing.
+#
+# The exe-os CLI is REQUIRED — setup.sh will attempt to install it via npm
+# if not already on PATH. If npm is unavailable, setup fails loudly.
+# There is NO raw compose fallback (that was the bug).
+EXE_CLI=""
+if command -v exe-os >/dev/null 2>&1; then EXE_CLI="exe-os"; fi
 
-# Step 5: Start stack
-info "Step 5: Starting stack..."
-docker compose up -d 2>&1
+if [[ -z "$EXE_CLI" ]]; then
+  # Bug 716c0f6e: the exe-os CLI is REQUIRED for first-install. Raw
+  # `docker compose pull && up` bypasses the digest-pinned manifest,
+  # preflight gates, proxy auth, health sequencing, and rollback — all
+  # critical for production deploys. Attempt to install the CLI via npm
+  # (node is already validated present in Step 2). If npm is not available,
+  # fail loudly with install instructions instead of silently deploying
+  # with stale/unverified images.
+  info "Step 4: exe-os CLI not found — attempting install via npm..."
+  if command -v npm >/dev/null 2>&1; then
+    if npm install -g exe-os 2>/tmp/exe-npm-install.err; then
+      EXE_CLI="exe-os"
+      info "exe-os CLI installed successfully."
+    else
+      err "npm install -g exe-os failed:"
+      cat /tmp/exe-npm-install.err >&2 || true
+    fi
+  fi
+fi
 
-# Step 6: Wait for health
-info "Step 6: Waiting for services to be healthy..."
-sleep 10
-HEALTHY=0
-for i in $(seq 1 30); do
-  COUNT=$(docker ps --filter "health=healthy" --format '{{.Names}}' | wc -l | tr -d ' ')
-  TOTAL=$(docker ps --format '{{.Names}}' | wc -l | tr -d ' ')
-  echo -ne "\r  $COUNT/$TOTAL healthy (attempt $i/30)..."
-  if [[ "$COUNT" -ge "$TOTAL" ]]; then HEALTHY=1; break; fi
-  sleep 5
-done
-echo ""
-[[ "$HEALTHY" -eq 1 ]] && info "All services healthy!" || warn "Some services not healthy yet — check docker ps"
+if [[ -n "$EXE_CLI" ]]; then
+  info "Step 4+5: Deploying via '$EXE_CLI stack-update' (preflight + proxy auth + health-gated rollout + rollback)..."
+  if ! "$EXE_CLI" stack-update --yes; then
+    err "stack-update failed — the gated deploy refused or rolled back. Review the"
+    err "output above. Do NOT bypass with raw 'docker compose up' — fix the cause"
+    err "(preflight RED, image pull, or health failure) and re-run setup.sh."
+    exit 1
+  fi
+  info "stack-update completed (preflight + health gates passed)."
+else
+  err "Step 4+5: exe-os CLI is REQUIRED for first-install deploys (bug 716c0f6e)."
+  err "Raw 'docker compose up' bypasses the digest-pinned manifest, preflight"
+  err "gates, health sequencing, and rollback — deploying stale/unverified images."
+  err ""
+  err "Install the CLI and re-run setup.sh:"
+  err "  npm install -g exe-os"
+  err "  ./setup.sh --client $CLIENT --domain $DOMAIN${LICENSE:+ --license $LICENSE}"
+  exit 1
+fi
 
 # Step 7: Verify
 info "Step 7: Verification"

package/deploy/compose/status.sh

@@ -33,6 +33,11 @@ check "Gateway"  "http://127.0.0.1:3100/health"
 check "Monitor"  "http://127.0.0.1:8090/api/health"
 check "GoTrue"   "http://127.0.0.1:9999/health"
 check "exe-os"   "http://127.0.0.1:8765/health"
+# Bug 2e8ef511: the otel-collector is distroless and cannot run an in-container
+# Docker healthcheck, so its health_check extension (HTTP 200 on the published
+# OTEL_HEALTH_PORT, default 13133) is verified here instead. Without this probe a
+# broken collector silently shows as "running" with no health signal anywhere.
+check "OTel"     "http://127.0.0.1:${OTEL_HEALTH_PORT:-13133}/"
 
 echo ""