@askexenow/exe-os 0.9.316 → 0.9.319

package/deploy/compose/docker-compose.yml

@@ -1330,7 +1330,9 @@ services:
   # http://exe-otel-collector:4318 (HTTP) on the backend network.
 
   exe-otel-collector:
-    image: ${OTEL_COLLECTOR_IMAGE:-otel/opentelemetry-collector-contrib:0.114.0}
+    # bug 32d6e02f: digest-pinned default (was tag-only) — matches the
+    # stack manifest pin for otel/opentelemetry-collector-contrib:0.114.0.
+    image: ${OTEL_COLLECTOR_IMAGE:-otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197}
     container_name: exe-otel-collector
     restart: unless-stopped
     command: ["--config=/etc/otelcol-contrib/config.yaml"]
@@ -1343,23 +1345,33 @@ services:
       - "127.0.0.1:${OTEL_HEALTH_PORT:-13133}:13133" # Health check
     networks:
       - backend
-    # Bug 2e8ef511: otel-contrib is a distroless image — only the /otelcol-contrib
-    # binary is present (no shell/wget/curl/nc, and the binary has no probe
-    # subcommand), so a Docker `healthcheck.test` CMD that runs INSIDE the
-    # container cannot be implemented for this upstream, pull-only image. The old
-    # `test: ["NONE"]` actively DISABLED health, so a broken collector still
-    # reported "running" — a silent observability gap.
+    # Bug 2e8ef511 / 32d6e02f: otel-contrib is a distroless image — only the
+    # /otelcol-contrib binary is present (no shell/wget/curl/nc), so the usual
+    # `curl -f .../health` in-container probe is impossible. The binary DOES,
+    # however, ship the offline `validate` subcommand (since collector v0.99,
+    # present in 0.114.0), which exec-runs with no shell and exits 0 only when
+    # the binary is runnable AND the mounted config parses. We use that as the
+    # in-container Docker healthcheck below: it catches a missing binary, a
+    # corrupt image layer, or a bad config mount (the common failure modes for a
+    # pull-only image) without needing any HTTP client.
     #
-    # The collector's health_check extension serves HTTP 200 on :13133, and that
-    # port is published to 127.0.0.1 above. Health is therefore verified
-    # EXTERNALLY: status.sh now probes http://127.0.0.1:${OTEL_HEALTH_PORT}/
-    # alongside every other service endpoint, so a down/unhealthy collector is
-    # surfaced by the stack health tooling instead of hiding behind "running".
+    # `validate` is a config/binary sanity check, NOT a full runtime-liveness
+    # probe (a hung collector with a valid config could still pass it). TRUE
+    # runtime liveness — that receivers are actually listening — is verified
+    # EXTERNALLY: the collector's health_check extension serves HTTP 200 on
+    # :13133 (published to 127.0.0.1 above) and status.sh probes
+    # http://127.0.0.1:${OTEL_HEALTH_PORT}/ alongside every other service.
     # Keep that probe in lockstep with the OTEL_HEALTH_PORT mapping above.
     #
-    # NOTE: we intentionally do NOT set `test: ["NONE"]`. Leaving healthcheck
-    # unset inherits the upstream image's own HEALTHCHECK if one is ever added,
-    # whereas ["NONE"] would permanently suppress it.
+    # Nothing `depends_on` this service with `condition: service_healthy`, and
+    # `restart: unless-stopped` does not restart on `unhealthy`, so the
+    # healthcheck only surfaces status — it can never block or crash-loop the stack.
+    healthcheck:
+      test: ["CMD", "/otelcol-contrib", "validate", "--config=/etc/otelcol-contrib/config.yaml"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
     deploy:
       resources:
         limits:

package/deploy/compose/generate-env.ts

@@ -8,12 +8,12 @@ const AUTH_REGISTRY = "update.askexe.com/askexe";
 // Keep these defaults in sync with deploy/stack-manifests/v0.9.json latest.
 // deploy/compose/.env.example intentionally uses GHCR fallbacks so local
 // simulation can run without private update.askexe.com registry credentials.
-const CRM_RELEASE_TAG = "v0.9.47";
-const WIKI_RELEASE_TAG = "v0.9.21";
-const EXED_RELEASE_TAG = "v0.9.258";
-const GATEWAY_RELEASE_TAG = "v0.9.17";
-const MONITOR_RELEASE_TAG = "v0.9.4";
-const ERP_RELEASE_TAG = "v0.2.0-final8";
+const CRM_RELEASE_TAG = "v0.9.51";
+const WIKI_RELEASE_TAG = "v0.9.26";
+const EXED_RELEASE_TAG = "v0.9.311";
+const GATEWAY_RELEASE_TAG = "v0.9.24";
+const MONITOR_RELEASE_TAG = "v0.9.5";
+const ERP_RELEASE_TAG = "v0.2.2";
 const EXE_BUILD_RELEASE_TAG = "v0.1.0";
 // Bug 58840873: pin exe-auth to the manifest-pinned tag so a generated .env never
 // lets compose fall back to its (stale) hardcoded default image. MUST equal the

package/deploy/compose/init-db.sql

@@ -164,12 +164,62 @@ DO $$ DECLARE s text; BEGIN
   END LOOP;
 END $$;
 
--- raw.raw_events — SCHEMA OWNER: exe-db Prisma migrations (bug dc149875).
--- DO NOT create this table here. exe-db owns the raw_events schema via Prisma
--- migrations (20260504083822_add_raw_landing_pad + subsequent ALTERs). Creating
--- the table here with different column types (UUID vs TEXT id, TIMESTAMPTZ vs
--- TIMESTAMP) caused conflicts when Prisma migrations ran afterwards.
--- The projection-worker self-heals missing columns via ADD COLUMN IF NOT EXISTS.
+-- ---------------------------------------------------------------------------
+-- raw.raw_events — the immutable landing pad (audit dd214d82 P0, dc149875 P1).
+--
+-- init-db.sql (docker-initdb) and exe-db Prisma migrations are TWO INDEPENDENT
+-- bootstrap paths for the SAME database; only one runs per DB and they must
+-- CONVERGE on an identical schema. The canonical exe-db RawEvent model
+-- (prisma/schema.prisma) is the source of truth and explicitly names this file
+-- as the matching docker-initdb shape, including the full non-partial dedup
+-- index uq_raw_events_dedup (audit dd214d82). Omitting the table here broke that
+-- convergence and left a Prisma-only DB without the bootstrap shape.
+--
+-- Column TYPES mirror the Prisma model exactly to avoid the dc149875 drift that
+-- caused failures: id is TEXT (NOT uuid) and all timestamps are TIMESTAMPTZ —
+-- matching Prisma's `id String` + `@db.Timestamptz(3)`. The writers (gateway,
+-- cloud-sync) supply id explicitly; the default below is only for direct inserts.
+--
+-- The bare gateway/cloud-sync arbiter `ON CONFLICT (source, source_id,
+-- event_type)` requires a FULL (non-partial) unique index to be inferable — a
+-- partial index raises 42P10 and silently drops inbound events/media. That full
+-- index (uq_raw_events_dedup) is created below; NULLs are DISTINCT by default so
+-- multiple NULL-source_id events for the same (source, event_type) stay allowed.
+CREATE TABLE IF NOT EXISTS raw.raw_events (
+  id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+  source TEXT NOT NULL,
+  source_id TEXT,
+  event_type TEXT NOT NULL,
+  payload JSONB NOT NULL,
+  metadata JSONB,
+  timestamp TIMESTAMPTZ NOT NULL DEFAULT now(),
+  created_at TIMESTAMPTZ DEFAULT now(),
+  processed_at TIMESTAMPTZ,
+  projections JSONB,
+  retry_count INT NOT NULL DEFAULT 0,
+  error TEXT,
+  failed_at TIMESTAMPTZ
+);
+
+SELECT pg_temp.exe_add_column_if_missing('raw', 'raw_events', 'created_at', 'created_at TIMESTAMPTZ DEFAULT now()');
+SELECT pg_temp.exe_add_column_if_missing('raw', 'raw_events', 'processed_at', 'processed_at TIMESTAMPTZ');
+SELECT pg_temp.exe_add_column_if_missing('raw', 'raw_events', 'projections', 'projections JSONB');
+SELECT pg_temp.exe_add_column_if_missing('raw', 'raw_events', 'retry_count', 'retry_count INT NOT NULL DEFAULT 0');
+SELECT pg_temp.exe_add_column_if_missing('raw', 'raw_events', 'error', 'error TEXT');
+SELECT pg_temp.exe_add_column_if_missing('raw', 'raw_events', 'failed_at', 'failed_at TIMESTAMPTZ');
+
+-- Plain secondary indexes (match Prisma @@index declarations).
+SELECT pg_temp.exe_create_index_if_columns_exist('raw_events_source_event_type_idx', 'raw', 'raw_events', ARRAY['source', 'event_type'], 'CREATE INDEX IF NOT EXISTS raw_events_source_event_type_idx ON raw.raw_events (source, event_type)');
+SELECT pg_temp.exe_create_index_if_columns_exist('raw_events_processed_at_idx', 'raw', 'raw_events', ARRAY['processed_at'], 'CREATE INDEX IF NOT EXISTS raw_events_processed_at_idx ON raw.raw_events (processed_at)');
+SELECT pg_temp.exe_create_index_if_columns_exist('raw_events_timestamp_idx', 'raw', 'raw_events', ARRAY['timestamp'], 'CREATE INDEX IF NOT EXISTS raw_events_timestamp_idx ON raw.raw_events ("timestamp")');
+-- Partial functional indexes — same names + predicates as exe-db migration
+-- 20260623000000_raw_events_created_at_canonical (audit dc149875).
+SELECT pg_temp.exe_create_index_if_columns_exist('idx_raw_events_unprocessed', 'raw', 'raw_events', ARRAY['created_at', 'processed_at'], 'CREATE INDEX IF NOT EXISTS idx_raw_events_unprocessed ON raw.raw_events (created_at) WHERE processed_at IS NULL');
+SELECT pg_temp.exe_create_index_if_columns_exist('idx_raw_events_retryable', 'raw', 'raw_events', ARRAY['failed_at', 'processed_at', 'retry_count'], 'CREATE INDEX IF NOT EXISTS idx_raw_events_retryable ON raw.raw_events (failed_at) WHERE processed_at IS NULL AND failed_at IS NOT NULL AND retry_count < 5');
+-- Canonical FULL (non-partial) dedup arbiter for the bare ON CONFLICT. Name +
+-- columns match exe-db migration 20260620000000_raw_events_dedup_canonical_unique
+-- and prisma/schema.prisma's @@unique(map: "uq_raw_events_dedup") (audit dd214d82).
+SELECT pg_temp.exe_create_index_if_columns_exist('uq_raw_events_dedup', 'raw', 'raw_events', ARRAY['source', 'source_id', 'event_type'], 'CREATE UNIQUE INDEX IF NOT EXISTS uq_raw_events_dedup ON raw.raw_events (source, source_id, event_type)');
 
 -- ---------------------------------------------------------------------------
 -- Graph schema — Company Brain memory + GraphRAG projection targets.

package/deploy/stack-manifests/signing-key.pub

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA9jWntop9h4lBttod7yfeFcXQXKqqaGOOjvaKswNJdqs=
+-----END PUBLIC KEY-----