@askexenow/exe-os 0.9.318 → 0.9.319

package/deploy/compose/docker-compose.yml

@@ -1330,7 +1330,9 @@ services:
   # http://exe-otel-collector:4318 (HTTP) on the backend network.
 
   exe-otel-collector:
-    image: ${OTEL_COLLECTOR_IMAGE:-otel/opentelemetry-collector-contrib:0.114.0}
+    # bug 32d6e02f: digest-pinned default (was tag-only) — matches the
+    # stack manifest pin for otel/opentelemetry-collector-contrib:0.114.0.
+    image: ${OTEL_COLLECTOR_IMAGE:-otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197}
     container_name: exe-otel-collector
     restart: unless-stopped
     command: ["--config=/etc/otelcol-contrib/config.yaml"]
@@ -1343,23 +1345,33 @@ services:
       - "127.0.0.1:${OTEL_HEALTH_PORT:-13133}:13133" # Health check
     networks:
       - backend
-    # Bug 2e8ef511: otel-contrib is a distroless image — only the /otelcol-contrib
-    # binary is present (no shell/wget/curl/nc, and the binary has no probe
-    # subcommand), so a Docker `healthcheck.test` CMD that runs INSIDE the
-    # container cannot be implemented for this upstream, pull-only image. The old
-    # `test: ["NONE"]` actively DISABLED health, so a broken collector still
-    # reported "running" — a silent observability gap.
+    # Bug 2e8ef511 / 32d6e02f: otel-contrib is a distroless image — only the
+    # /otelcol-contrib binary is present (no shell/wget/curl/nc), so the usual
+    # `curl -f .../health` in-container probe is impossible. The binary DOES,
+    # however, ship the offline `validate` subcommand (since collector v0.99,
+    # present in 0.114.0), which exec-runs with no shell and exits 0 only when
+    # the binary is runnable AND the mounted config parses. We use that as the
+    # in-container Docker healthcheck below: it catches a missing binary, a
+    # corrupt image layer, or a bad config mount (the common failure modes for a
+    # pull-only image) without needing any HTTP client.
     #
-    # The collector's health_check extension serves HTTP 200 on :13133, and that
-    # port is published to 127.0.0.1 above. Health is therefore verified
-    # EXTERNALLY: status.sh now probes http://127.0.0.1:${OTEL_HEALTH_PORT}/
-    # alongside every other service endpoint, so a down/unhealthy collector is
-    # surfaced by the stack health tooling instead of hiding behind "running".
+    # `validate` is a config/binary sanity check, NOT a full runtime-liveness
+    # probe (a hung collector with a valid config could still pass it). TRUE
+    # runtime liveness — that receivers are actually listening — is verified
+    # EXTERNALLY: the collector's health_check extension serves HTTP 200 on
+    # :13133 (published to 127.0.0.1 above) and status.sh probes
+    # http://127.0.0.1:${OTEL_HEALTH_PORT}/ alongside every other service.
     # Keep that probe in lockstep with the OTEL_HEALTH_PORT mapping above.
     #
-    # NOTE: we intentionally do NOT set `test: ["NONE"]`. Leaving healthcheck
-    # unset inherits the upstream image's own HEALTHCHECK if one is ever added,
-    # whereas ["NONE"] would permanently suppress it.
+    # Nothing `depends_on` this service with `condition: service_healthy`, and
+    # `restart: unless-stopped` does not restart on `unhealthy`, so the
+    # healthcheck only surfaces status — it can never block or crash-loop the stack.
+    healthcheck:
+      test: ["CMD", "/otelcol-contrib", "validate", "--config=/etc/otelcol-contrib/config.yaml"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
     deploy:
       resources:
         limits:

package/deploy/stack-manifests/signing-key.pub

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA9jWntop9h4lBttod7yfeFcXQXKqqaGOOjvaKswNJdqs=
+-----END PUBLIC KEY-----

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.25",
+  "latest": "0.9.27",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -11,7 +11,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -65,7 +65,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -119,7 +119,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -173,7 +173,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -238,7 +238,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -303,7 +303,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -371,7 +371,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -439,7 +439,7 @@
           "id": "whatsapp_relink_required",
           "title": "WhatsApp QR re-link required for Baileys v7",
           "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
-          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp \u2192 Linked Devices after the update.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
         }
@@ -720,7 +720,7 @@
     "0.9.13": {
       "version": "0.9.13",
       "releasedAt": "2026-06-09T00:00:00Z",
-      "notes": "HYGO deployment readiness: gateway liveness watchdog removed (24/7 always-on), CRM branding + 5 security fixes, wiki GoTrue JWT auth, daemon timer perf (99% CPU \u2192 <1%), incremental Graph\u2192PG sync, ERP healthcheck fix.",
+      "notes": "HYGO deployment readiness: gateway liveness watchdog removed (24/7 always-on), CRM branding + 5 security fixes, wiki GoTrue JWT auth, daemon timer perf (99% CPU → <1%), incremental Graph→PG sync, ERP healthcheck fix.",
       "npmVersion": "0.9.238",
       "breakingChanges": [],
       "services": {
@@ -876,7 +876,7 @@
     "0.9.16": {
       "version": "0.9.16",
       "releasedAt": "2026-06-09T00:00:00Z",
-      "notes": "exe-os v0.9.243: fix: stack-release uses defaultBranch per repo (wiki uses master); chore: bump v0.9.242 for stack release; fix: prevent stale task intercom prompts; docs: add STACK-RELEASE.md \u2014 full release process documentation; fix: v0.9.241 \u2014 13 more bug fixes (28 total this session). gateway v0.9.15: chore: bump v0.9.14 for stack release; fix: WhatsApp pairing 15-20s \u2192 1-2s \u2014 remove blocking fetch, event-driven wait. wiki v0.9.21: chore: bump v0.9.20 for stack release; fix: accept wiki JWTs alongside GoTrue JWTs in auth middleware; feat: add GoTrue agent provisioning script; fix: set min-width on user menu dropdown to prevent layout collapse; fix: remove demo branding from exe-wiki main page greeting",
+      "notes": "exe-os v0.9.243: fix: stack-release uses defaultBranch per repo (wiki uses master); chore: bump v0.9.242 for stack release; fix: prevent stale task intercom prompts; docs: add STACK-RELEASE.md — full release process documentation; fix: v0.9.241 — 13 more bug fixes (28 total this session). gateway v0.9.15: chore: bump v0.9.14 for stack release; fix: WhatsApp pairing 15-20s → 1-2s — remove blocking fetch, event-driven wait. wiki v0.9.21: chore: bump v0.9.20 for stack release; fix: accept wiki JWTs alongside GoTrue JWTs in auth middleware; feat: add GoTrue agent provisioning script; fix: set min-width on user menu dropdown to prevent layout collapse; fix: remove demo branding from exe-wiki main page greeting",
       "npmVersion": "0.9.243",
       "breakingChanges": [],
       "services": {
@@ -928,7 +928,7 @@
     "0.9.17": {
       "version": "0.9.17",
       "releasedAt": "2026-06-09T00:00:00Z",
-      "notes": "gateway v0.9.16: fix: WhatsApp pairing \u2014 stale auth clearing + version fetch timeout",
+      "notes": "gateway v0.9.16: fix: WhatsApp pairing — stale auth clearing + version fetch timeout",
       "npmVersion": "0.9.247",
       "breakingChanges": [],
       "services": {
@@ -1032,7 +1032,7 @@
     "0.9.19": {
       "version": "0.9.19",
       "releasedAt": "2026-06-09T00:00:00Z",
-      "notes": "exe-os v0.9.253: fix: intercom force-deliver to idle agents + filter release noise. crm v0.9.47: fix: mobile Safari black screen \u2014 CSS spinner replaces visibility:hidden",
+      "notes": "exe-os v0.9.253: fix: intercom force-deliver to idle agents + filter release noise. crm v0.9.47: fix: mobile Safari black screen — CSS spinner replaces visibility:hidden",
       "npmVersion": "0.9.253",
       "breakingChanges": [],
       "services": {
@@ -1136,13 +1136,13 @@
     "0.9.21": {
       "version": "0.9.21",
       "releasedAt": "2026-06-10T00:00:00Z",
-      "notes": "COORDINATED RELEASE: memory\u2192graph schema heal. exe-db migration 20260610000000_fix_memory_graph_split_brain MUST run before/with exe-os container swap. exe-os v0.9.256 writes to graph.* \u2014 VPSs with data in memory.* will break without the heal migration.",
+      "notes": "COORDINATED RELEASE: memory→graph schema heal. exe-db migration 20260610000000_fix_memory_graph_split_brain MUST run before/with exe-os container swap. exe-os v0.9.256 writes to graph.* — VPSs with data in memory.* will break without the heal migration.",
       "npmVersion": "0.9.256",
       "breakingChanges": [
         {
           "id": "memory_graph_schema_heal",
-          "title": "memory.* \u2192 graph.* schema heal migration",
-          "description": "exe-db migration 20260610000000 moves memory_records, entities, relationships from memory.* to graph.* schema. exe-os v0.9.256+ writes exclusively to graph.*. Data in memory.* is renamed, not deleted \u2014 zero data loss. stack-update runs prisma migrate deploy automatically.",
+          "title": "memory.* → graph.* schema heal migration",
+          "description": "exe-db migration 20260610000000 moves memory_records, entities, relationships from memory.* to graph.* schema. exe-os v0.9.256+ writes exclusively to graph.*. Data in memory.* is renamed, not deleted — zero data loss. stack-update runs prisma migrate deploy automatically.",
           "requiredAction": "Run stack-update which handles the migration order automatically. Verify row counts match after update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
@@ -1151,7 +1151,7 @@
       "migrations": {
         "pre": [
           {
-            "description": "exe-db: heal memory\u2192graph split-brain (20260610000000)",
+            "description": "exe-db: heal memory→graph split-brain (20260610000000)",
             "command": "docker compose exec postgres psql -U exe -d exedb -c \"SELECT schema_name FROM information_schema.schemata WHERE schema_name IN ('memory','graph')\"",
             "verify": "docker compose exec postgres psql -U exe -d exedb -c \"SELECT count(*) FROM graph.memory_records\""
           }
@@ -1212,8 +1212,8 @@
       "breakingChanges": [
         {
           "id": "memory_graph_schema_heal",
-          "title": "memory.* \u2192 graph.* schema heal migration",
-          "description": "exe-db migration 20260610000000 moves memory_records, entities, relationships from memory.* to graph.* schema. exe-os v0.9.256+ writes exclusively to graph.*. Data in memory.* is renamed, not deleted \u2014 zero data loss. stack-update runs prisma migrate deploy automatically.",
+          "title": "memory.* → graph.* schema heal migration",
+          "description": "exe-db migration 20260610000000 moves memory_records, entities, relationships from memory.* to graph.* schema. exe-os v0.9.256+ writes exclusively to graph.*. Data in memory.* is renamed, not deleted — zero data loss. stack-update runs prisma migrate deploy automatically.",
           "requiredAction": "Run stack-update which handles the migration order automatically. Verify row counts match after update.",
           "expectedDowntimeMinutes": "2-5",
           "requiresConfirmation": true
@@ -1222,7 +1222,7 @@
       "migrations": {
         "pre": [
           {
-            "description": "exe-db: heal memory\u2192graph split-brain (20260610000000)",
+            "description": "exe-db: heal memory→graph split-brain (20260610000000)",
             "command": "docker compose exec postgres psql -U exe -d exedb -c \"SELECT schema_name FROM information_schema.schemata WHERE schema_name IN ('memory','graph')\"",
             "verify": "docker compose exec postgres psql -U exe -d exedb -c \"SELECT count(*) FROM graph.memory_records\""
           }
@@ -1278,7 +1278,7 @@
     "0.9.23": {
       "version": "0.9.23",
       "releasedAt": "2026-06-12T04:30:00Z",
-      "notes": "exe-gateway v0.9.21: WhatsApp full-history backfill + chunk ingestion (PR#15); FIX raw.raw_events ON CONFLICT now matches uq_raw_events_dedup (source, source_id, event_type) \u2014 prior 2-col target caused 42P10 and dropped every raw inbound event; gateway.contacts.owner_name added to runtime ensureSchema (fixes CRM contact projection 42703); history-backfill endpoint returns 400 (not 500) on missing anchor. Gateway-only update \u2014 no DB migration, no breaking changes.",
+      "notes": "exe-gateway v0.9.21: WhatsApp full-history backfill + chunk ingestion (PR#15); FIX raw.raw_events ON CONFLICT now matches uq_raw_events_dedup (source, source_id, event_type) — prior 2-col target caused 42P10 and dropped every raw inbound event; gateway.contacts.owner_name added to runtime ensureSchema (fixes CRM contact projection 42703); history-backfill endpoint returns 400 (not 500) on missing anchor. Gateway-only update — no DB migration, no breaking changes.",
       "npmVersion": "0.9.276",
       "breakingChanges": [],
       "services": {
@@ -1332,7 +1332,7 @@
           "healthUrl": "http://127.0.0.1:9222/health",
           "deploymentScope": "askexe-control-plane",
           "required": false,
-          "_comment": "AskExe infrastructure only \u2014 runs behind API router, not deployed to customer VPS"
+          "_comment": "AskExe infrastructure only — runs behind API router, not deployed to customer VPS"
         }
       }
     },
@@ -1349,8 +1349,8 @@
           "composeService": "exe-db",
           "required": true,
           "category": "core",
-          "description": "Postgres (pgvector) \u2014 shared system of record for all services",
-          "_comment": "bug ee16e7ef: pinned to versioned 0.8.0-pg16 tag \u2014 the mutable :pg16 rolling tag can change upstream without notice.",
+          "description": "Postgres (pgvector) — shared system of record for all services",
+          "_comment": "bug ee16e7ef: pinned to versioned 0.8.0-pg16 tag — the mutable :pg16 rolling tag can change upstream without notice.",
           "migrations": {
             "command": "exec -T exe-db psql -v ON_ERROR_STOP=1 -U ${POSTGRES_USER:-exe} -d ${POSTGRES_DB:-exedb} -f /docker-entrypoint-initdb.d/01-init.sql"
           }
@@ -1362,7 +1362,7 @@
           "healthUrl": "http://127.0.0.1:8765/health",
           "required": true,
           "category": "core",
-          "description": "Exe OS Daemon \u2014 memory, orchestration, MCP server"
+          "description": "Exe OS Daemon — memory, orchestration, MCP server"
         },
         "crm": {
           "image": "update.askexe.com/askexe/exe-crm:v0.9.49@sha256:656512528d2cecc7c0424f917a9b3d0a999f91b160c7b7e7e05778dd8b1319cc",
@@ -1426,8 +1426,8 @@
           "deploymentScope": "customer",
           "required": false,
           "category": "core",
-          "description": "Shared SSO Gateway \u2014 sign-up, sign-in across all services (auth.yourdomain.com)",
-          "_comment": "bug 2976868a: probe /api/health (the nginx \u2192 GoTrue proxy path), NOT static / \u2014 a green static page hid a dead login backend."
+          "description": "Shared SSO Gateway — sign-up, sign-in across all services (auth.yourdomain.com)",
+          "_comment": "bug 2976868a: probe /api/health (the nginx → GoTrue proxy path), NOT static / — a green static page hid a dead login backend."
         },
         "gotrue": {
           "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
@@ -1437,7 +1437,7 @@
           "deploymentScope": "customer",
           "required": false,
           "category": "core",
-          "description": "GoTrue auth backend \u2014 issues SSO/login tokens for CRM/Wiki/ERP",
+          "description": "GoTrue auth backend — issues SSO/login tokens for CRM/Wiki/ERP",
           "_comment": "bug 2976868a: the stack health gate previously omitted GoTrue, so SSO/login could be fully down while the gate reported green. Gate the backend directly."
         },
         "redis": {
@@ -1445,8 +1445,8 @@
           "composeService": "redis",
           "required": true,
           "category": "infra",
-          "description": "Redis \u2014 session cache, job queues (CRM, gateway, ERP)",
-          "_comment": "bug 4948fc48: compose-pinned infra dep \u2014 no env override, image tag lives in docker-compose.yml."
+          "description": "Redis — session cache, job queues (CRM, gateway, ERP)",
+          "_comment": "bug 4948fc48: compose-pinned infra dep — no env override, image tag lives in docker-compose.yml."
         },
         "clickhouse": {
           "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
@@ -1454,7 +1454,7 @@
           "composeService": "clickhouse",
           "required": true,
           "category": "infra",
-          "description": "ClickHouse \u2014 analytics and event storage (CRM)",
+          "description": "ClickHouse — analytics and event storage (CRM)",
           "_comment": "bug 4948fc48: compose-pinned infra dep required by CRM."
         },
         "cloudflared": {
@@ -1462,7 +1462,7 @@
           "composeService": "cloudflared",
           "required": true,
           "category": "infra",
-          "description": "Cloudflare Tunnel \u2014 secure ingress proxy (replaces nginx + SSL certs)",
+          "description": "Cloudflare Tunnel — secure ingress proxy (replaces nginx + SSL certs)",
           "_comment": "bug 4948fc48: digest-pinned in compose, no env override."
         },
         "exe-sso-edge": {
@@ -1470,7 +1470,7 @@
           "composeService": "exe-sso-edge",
           "required": true,
           "category": "infra",
-          "description": "SSO edge \u2014 reverse proxy that gates CRM/wiki/ERP behind unified auth",
+          "description": "SSO edge — reverse proxy that gates CRM/wiki/ERP behind unified auth",
           "_comment": "bug 4948fc48: stock nginx:alpine, config templated from DOMAIN."
         },
         "exe-otel-collector": {
@@ -1479,7 +1479,7 @@
           "composeService": "exe-otel-collector",
           "required": false,
           "category": "observability",
-          "description": "OpenTelemetry Collector \u2014 receives OTLP traces/metrics/logs from all services",
+          "description": "OpenTelemetry Collector — receives OTLP traces/metrics/logs from all services",
           "_comment": "bug 4948fc48: compose-pinned observability infra."
         }
       }
@@ -1491,12 +1491,12 @@
       "npmVersion": "0.9.312",
       "services": {
         "exe-db": {
-          "image": "pgvector/pgvector:0.8.0-pg16",
+          "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
           "env": "EXE_DB_IMAGE",
           "composeService": "exe-db",
           "required": true,
           "category": "core",
-          "description": "Postgres (pgvector) \u2014 pinned versioned tag (bug ee16e7ef)"
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
         },
         "exe-os": {
           "image": "update.askexe.com/askexe/exe-os:v0.9.311@sha256:011730042f55277724dbe83fde1a6416db2f3e8bf62d3254738d68d8de33e1f9",
@@ -1527,7 +1527,7 @@
           "composeService": "exe-gateway",
           "healthUrl": "http://127.0.0.1:3100/health",
           "category": "app",
-          "description": "WhatsApp/messaging gateway \u2014 CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor"
+          "description": "WhatsApp/messaging gateway — CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor"
         },
         "monitorAgent": {
           "image": "update.askexe.com/askexe/exe-monitor-agent:v0.9.5@sha256:d442170bb0d7411beb4195e7888377cee2013a0c2adb194d4e44cdab41886d2d",
@@ -1556,12 +1556,12 @@
           "category": "infra"
         },
         "redis": {
-          "image": "redis:7.4-alpine",
+          "image": "redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
           "composeService": "redis",
           "category": "infra"
         },
         "clickhouse": {
-          "image": "clickhouse/clickhouse-server:24.8.4.13-alpine",
+          "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
           "composeService": "clickhouse",
           "category": "infra"
         },
@@ -1571,17 +1571,238 @@
           "category": "infra"
         },
         "exe-sso-edge": {
-          "image": "nginx:alpine",
+          "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
           "composeService": "exe-sso-edge",
           "category": "infra"
         },
         "exe-otel-collector": {
-          "image": "otel/opentelemetry-collector-contrib:0.114.0",
+          "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
           "composeService": "exe-otel-collector",
           "category": "infra"
         }
       },
       "breakingChanges": []
+    },
+    "0.9.26": {
+      "version": "0.9.26",
+      "releasedAt": "2026-06-30T15:30:00Z",
+      "notes": "Open-beta hardening release. RESTORES erp service (regressed out of 0.9.25). Carries 26 merged PRs across all repos: HYGO WhatsApp pairing P0 (QR relay + pairing-code), gateway billing credit tables + media debit + token signing, gateway/CRM/ERP/auth tenant-scoping, exe-os mcp-session-scope + stack-update-safety, chat telemetry-PII redaction + signing, monitor secret-redaction, build supply-chain checksums, wiki backup safety, + 9 open-beta re-audit hardening PRs. NOTE: app-image digests below reflect the LATEST PUBLISHED images; services whose source changed in this release (exe-os, exe-gateway, exe-crm, exe-wiki, exe-auth, exe-erp, exe-monitor) require a CI image rebuild to refresh their @sha256 with the merged code before this manifest deploys those fixes — rebuild tracked on task 8614cb62. Infra/gotrue/cloudflared images are final.",
+      "npmVersion": "0.9.318",
+      "services": {
+        "exe-db": {
+          "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.311@sha256:011730042f55277724dbe83fde1a6416db2f3e8bf62d3254738d68d8de33e1f9",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.51@sha256:73864ce14aaac06b73d67100bbf88e669fd13c7da39edd9644107037211559b7",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.26@sha256:e6c1b67d5c431898248f845abfd36dc136575795f35e3652bb4f6164e8a9dd34",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v0.9.24@sha256:9cda7c00d886b4ab16a3b88aa953aa45c991f2977084ea8532f55fcaf75e8f37",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v0.9.5@sha256:d442170bb0d7411beb4195e7888377cee2013a0c2adb194d4e44cdab41886d2d",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v0.9.5@sha256:e9a406d1be7efe59cec38db1ace4beef728afa713781675cb30d33fe06b2ed08",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.2.0@sha256:8e1a17e5aff92b844be08c82120d91da0a4eaf6757c1071aec25ab5d7b560ba9",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.2.2@sha256:00fecc790ff848bfd4b7d87f42f859edfeb6090a7ca26bf2359dc6cb96767afb",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning"
+        },
+        "gotrue": {
+          "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        }
+      }
+    },
+    "0.9.27": {
+      "version": "0.9.27",
+      "releasedAt": "2026-07-01T00:00:00Z",
+      "notes": "Code-carrying release. All 7 app services REBUILT from today's merged code (28 PRs incl HYGO WhatsApp pairing P0, gateway billing credits, tenant-scoping across gateway/crm/erp/auth, exe-os mcp-session-scope + stack-update-safety, chat telemetry-PII, monitor secret-redaction, build supply-chain, wiki backup, ERP re-audit/debrand + RLS opt-in). erp service present. Every image @sha256-pinned to freshly-built digests (verified on build-my). Infra/gotrue/cloudflared unchanged from 0.9.26.",
+      "npmVersion": "0.9.318",
+      "services": {
+        "exe-db": {
+          "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.318@sha256:c6e5f93d4c1e7b0c18a210d50a0176af8a495ece2f09ff0fa99769fc4c79d39d",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.52@sha256:d8d283c6230e4ab62ce1a4fdada1bcb71b7516fa9cdf7cd2e28a62ab2d74f14c",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.26@sha256:c0d61d183b274a67977fdfb1b40d5e4736559a9d90507843183e5642da2a959d",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v0.9.27@sha256:55f51558f35b1e51bff782a1d04821411b34744cb62d77a8c5c1da6ebaf36437",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v0.9.5@sha256:cada7dace00ccb629aa10976e80e20d7d25685042519bd2aec58ab4bf35ff0cd",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v0.9.5@sha256:1af31893cc8b1e51892be7d7705fa6c6b3108af8366b1fa8da2879d8ae21ec88",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.1.0@sha256:5de4fe282c60c9877b6a0e22cfba43f6222982d81eb315667e9479eb94d94d7a",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.2.0-final8@sha256:15bb6020b109b4dfd51d245273ffa88bbfbaf0de09da05a09e6b6f9344b00c46",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning"
+        },
+        "gotrue": {
+          "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        }
+      }
     }
+  },
+  "signature": {
+    "keyId": "exe-stack-1",
+    "alg": "ed25519",
+    "signature": "nlSFjzjgZDRmXAsn9ZcpeUONDnDrYUpl5Ynx9xDaaKn5DYOlm+vDlH5XXHg8AsYpx2nnvGHgRJICvuUokNPSDw=="
   }
 }

package/dist/{active-agent-BPGGYQ6M.js → active-agent-EA2Q3KYR.js}

@@ -6,12 +6,12 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-QGXFUWDF.js";
+} from "./chunk-RJHOFX72.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-TZGBXYIY.js";
+import "./chunk-36SS3TE7.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-2R7GARWJ.js";
+import "./chunk-3EZQSPTG.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";