@askexenow/exe-os 0.9.339 → 0.9.341

package/dist/{projection-worker-ZVOFHTXT.js → projection-worker-44SEKTZ5.js}

@@ -5,10 +5,10 @@ import {
   inferOutcome,
   inferSemanticLabel,
   ontologyPayload
-} from "./chunk-D3QASX2W.js";
+} from "./chunk-C2SRRCRK.js";
 import {
   processCRMEvent
-} from "./chunk-KTPG4XKI.js";
+} from "./chunk-IB336P52.js";
 import {
   loadConfig
 } from "./chunk-7Y5UDEVM.js";

package/dist/{prospective-memory-W6S67LZZ.js → prospective-memory-UACFTYXK.js}

@@ -1,8 +1,8 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";

package/dist/{reranker-SSFBRWWD.js → reranker-NL4YAV6R.js}

@@ -5,7 +5,7 @@ import {
   rerank,
   rerankWithContext,
   rerankWithScores
-} from "./chunk-C2UO2I6K.js";
+} from "./chunk-WNKVKNOM.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";

package/dist/{retrieval-health-TWHKYCRK.js → retrieval-health-4C2PO6HH.js}

@@ -2,7 +2,7 @@ import {
   computeDegradations,
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-IYB2NIW3.js";
+} from "./chunk-6MVI4QH2.js";
 import "./chunk-VGMACSEV.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{review-polling-PCMD5BFN.js → review-polling-W5AMHNLT.js}

@@ -1,26 +1,26 @@
 import {
   isExeSession,
   strictSessionScopeFilter
-} from "./chunk-PLRIJALF.js";
-import "./chunk-OFX5B2S7.js";
-import "./chunk-B76TSEP3.js";
-import "./chunk-RLRT2BVM.js";
+} from "./chunk-KKOLHBNC.js";
+import "./chunk-ATKW3SYL.js";
+import "./chunk-BJOBR6P2.js";
+import "./chunk-6D2PI4QD.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-UIV2WPBT.js";
-import "./chunk-SSTLTIF3.js";
+import "./chunk-HNLXMD2V.js";
 import "./chunk-RMOBQ6A5.js";
 import "./chunk-54QCG45Y.js";
-import "./chunk-FUIIVSW6.js";
-import "./chunk-65SVQELL.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-WH7XN5ER.js";
+import "./chunk-GFDGDFBF.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-MW2GJJ53.js";
+import "./chunk-2UGGBIDL.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-2233TQCA.js";
+import "./chunk-LLU6WZLK.js";
 import "./chunk-HCJCW7X4.js";
 import "./chunk-OPU3NYOO.js";
-import "./chunk-7TS64TBG.js";
+import "./chunk-UU4UINUX.js";
 import "./chunk-AFNRE2RV.js";
 import "./chunk-3NGZ4PL7.js";
 import "./chunk-NLEW62VC.js";
@@ -30,15 +30,15 @@ import "./chunk-MP2AFCGL.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+import "./chunk-7SEC2AG5.js";
+import "./chunk-PPZOWQHP.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
@@ -115,7 +115,7 @@ function createRealDeps(getClient) {
       return result.rows;
     },
     createReviewForOrphan: async (task) => {
-      const { createReviewForCompletedTask } = await import("./tasks-review-JKBRACII.js");
+      const { createReviewForCompletedTask } = await import("./tasks-review-PBIUYXAL.js");
       const cwd = process.cwd();
       await createReviewForCompletedTask(
         task,

package/dist/runtime/index.js

@@ -3,11 +3,11 @@ import {
   SessionManager,
   checkGitSafety,
   targetsMainBranch
-} from "../chunk-3OBWSCJN.js";
+} from "../chunk-B7CUBLF7.js";
 import {
   MultiAgentOrchestrator
-} from "../chunk-52KNOQMK.js";
-import "../chunk-RRWDYOQS.js";
+} from "../chunk-HJX6NCJF.js";
+import "../chunk-32YHCHWW.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
@@ -22,6 +22,10 @@ import {
   checkReadPathSafety,
   containsPathTraversal
 } from "../chunk-NGVOA6ZQ.js";
+import {
+  composeHooks,
+  createDefaultHooks
+} from "../chunk-O377P7GM.js";
 import {
   ContextManager,
   agentLoop,
@@ -53,31 +57,27 @@ import {
   matchInputPattern,
   matchToolPattern
 } from "../chunk-HF25XPZE.js";
-import {
-  composeHooks,
-  createDefaultHooks
-} from "../chunk-O377P7GM.js";
-import "../chunk-4IYSBPX3.js";
-import "../chunk-PLRIJALF.js";
-import "../chunk-OFX5B2S7.js";
-import "../chunk-B76TSEP3.js";
-import "../chunk-RLRT2BVM.js";
+import "../chunk-HAZO7TRD.js";
+import "../chunk-KKOLHBNC.js";
+import "../chunk-ATKW3SYL.js";
+import "../chunk-BJOBR6P2.js";
+import "../chunk-6D2PI4QD.js";
+import "../chunk-E23LNUWJ.js";
 import "../chunk-4JERP7NT.js";
 import "../chunk-EIKATSE4.js";
-import "../chunk-E23LNUWJ.js";
-import "../chunk-UIV2WPBT.js";
-import "../chunk-SSTLTIF3.js";
+import "../chunk-HNLXMD2V.js";
 import "../chunk-RMOBQ6A5.js";
 import "../chunk-54QCG45Y.js";
-import "../chunk-FUIIVSW6.js";
-import "../chunk-65SVQELL.js";
+import "../chunk-SSTLTIF3.js";
+import "../chunk-WH7XN5ER.js";
+import "../chunk-GFDGDFBF.js";
 import "../chunk-NGP6LSV2.js";
-import "../chunk-MW2GJJ53.js";
+import "../chunk-2UGGBIDL.js";
 import "../chunk-CVYC6DUW.js";
-import "../chunk-2233TQCA.js";
+import "../chunk-LLU6WZLK.js";
 import "../chunk-HCJCW7X4.js";
 import "../chunk-OPU3NYOO.js";
-import "../chunk-7TS64TBG.js";
+import "../chunk-UU4UINUX.js";
 import "../chunk-AFNRE2RV.js";
 import "../chunk-3NGZ4PL7.js";
 import "../chunk-NLEW62VC.js";
@@ -87,15 +87,15 @@ import {
   StateBus,
   orgBus
 } from "../chunk-MP2AFCGL.js";
-import "../chunk-HEPR6QTL.js";
+import "../chunk-RWSLVYTE.js";
 import "../chunk-2I23RPSI.js";
-import "../chunk-ATOU6CYR.js";
+import "../chunk-BV6GBSRP.js";
 import "../chunk-PNQDP3OA.js";
 import "../chunk-H73TUI4Y.js";
 import "../chunk-7HLWBYH7.js";
 import "../chunk-FXU7JOXK.js";
-import "../chunk-XACL67CS.js";
-import "../chunk-5Z5NATNS.js";
+import "../chunk-7SEC2AG5.js";
+import "../chunk-PPZOWQHP.js";
 import "../chunk-7Y5UDEVM.js";
 import "../chunk-SHIICYJW.js";
 import "../chunk-MLKGABMK.js";

package/dist/{session-events-3LCVQEL7.js → session-events-PGL5GJEB.js}

@@ -4,42 +4,42 @@ import {
   listRecentSessionEvents,
   recordSessionEvent,
   sweepExpiredSessionEvents
-} from "./chunk-QFPTDSY2.js";
-import "./chunk-PLRIJALF.js";
-import "./chunk-OFX5B2S7.js";
-import "./chunk-B76TSEP3.js";
-import "./chunk-RLRT2BVM.js";
+} from "./chunk-YLQXP7T7.js";
+import "./chunk-KKOLHBNC.js";
+import "./chunk-ATKW3SYL.js";
+import "./chunk-BJOBR6P2.js";
+import "./chunk-6D2PI4QD.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-UIV2WPBT.js";
-import "./chunk-SSTLTIF3.js";
+import "./chunk-HNLXMD2V.js";
 import "./chunk-RMOBQ6A5.js";
 import "./chunk-54QCG45Y.js";
-import "./chunk-FUIIVSW6.js";
-import "./chunk-65SVQELL.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-WH7XN5ER.js";
+import "./chunk-GFDGDFBF.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-MW2GJJ53.js";
+import "./chunk-2UGGBIDL.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-2233TQCA.js";
+import "./chunk-LLU6WZLK.js";
 import "./chunk-HCJCW7X4.js";
 import "./chunk-OPU3NYOO.js";
-import "./chunk-7TS64TBG.js";
+import "./chunk-UU4UINUX.js";
 import "./chunk-AFNRE2RV.js";
 import "./chunk-3NGZ4PL7.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-HEPR6QTL.js";
+import "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+import "./chunk-7SEC2AG5.js";
+import "./chunk-PPZOWQHP.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";

package/dist/{session-kill-telemetry-CZSPN5V6.js → session-kill-telemetry-6YDGEF27.js}

@@ -13,42 +13,42 @@ import {
   parseStreakState,
   recordSessionKill,
   sumTokensSavedSince
-} from "./chunk-T4KZ2Z2N.js";
-import "./chunk-PLRIJALF.js";
-import "./chunk-OFX5B2S7.js";
-import "./chunk-B76TSEP3.js";
-import "./chunk-RLRT2BVM.js";
+} from "./chunk-IELUDZAA.js";
+import "./chunk-KKOLHBNC.js";
+import "./chunk-ATKW3SYL.js";
+import "./chunk-BJOBR6P2.js";
+import "./chunk-6D2PI4QD.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-UIV2WPBT.js";
-import "./chunk-SSTLTIF3.js";
+import "./chunk-HNLXMD2V.js";
 import "./chunk-RMOBQ6A5.js";
 import "./chunk-54QCG45Y.js";
-import "./chunk-FUIIVSW6.js";
-import "./chunk-65SVQELL.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-WH7XN5ER.js";
+import "./chunk-GFDGDFBF.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-MW2GJJ53.js";
+import "./chunk-2UGGBIDL.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-2233TQCA.js";
+import "./chunk-LLU6WZLK.js";
 import "./chunk-HCJCW7X4.js";
 import "./chunk-OPU3NYOO.js";
-import "./chunk-7TS64TBG.js";
+import "./chunk-UU4UINUX.js";
 import "./chunk-AFNRE2RV.js";
 import "./chunk-3NGZ4PL7.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-HEPR6QTL.js";
+import "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+import "./chunk-7SEC2AG5.js";
+import "./chunk-PPZOWQHP.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";

package/dist/{session-scope-CFHVSVAQ.js → session-scope-3MEOO557.js}

@@ -1,29 +1,29 @@
 import {
   resolveExeSession
-} from "./chunk-PLRIJALF.js";
-import "./chunk-OFX5B2S7.js";
-import "./chunk-B76TSEP3.js";
-import "./chunk-RLRT2BVM.js";
+} from "./chunk-KKOLHBNC.js";
+import "./chunk-ATKW3SYL.js";
+import "./chunk-BJOBR6P2.js";
+import "./chunk-6D2PI4QD.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
 import {
   listSessions
-} from "./chunk-UIV2WPBT.js";
-import "./chunk-SSTLTIF3.js";
+} from "./chunk-HNLXMD2V.js";
 import "./chunk-RMOBQ6A5.js";
 import "./chunk-54QCG45Y.js";
-import "./chunk-FUIIVSW6.js";
-import "./chunk-65SVQELL.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-WH7XN5ER.js";
+import "./chunk-GFDGDFBF.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-MW2GJJ53.js";
+import "./chunk-2UGGBIDL.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-2233TQCA.js";
+import "./chunk-LLU6WZLK.js";
 import "./chunk-HCJCW7X4.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";
-import "./chunk-7TS64TBG.js";
+import "./chunk-UU4UINUX.js";
 import "./chunk-AFNRE2RV.js";
 import "./chunk-3NGZ4PL7.js";
 import "./chunk-NLEW62VC.js";
@@ -32,15 +32,15 @@ import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import {
   isCoordinatorName
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+import "./chunk-7SEC2AG5.js";
+import "./chunk-PPZOWQHP.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";

package/dist/{setup-wizard-CJZMM43G.js → setup-wizard-CJIYDSSP.js}

@@ -1,7 +1,7 @@
 import {
   runSetupWizard,
   validateModel
-} from "./chunk-Z7OZP3ET.js";
+} from "./chunk-HSYJ6DZ2.js";
 import "./chunk-TPHCZDE3.js";
 import "./chunk-Z42MXYWW.js";
 import "./chunk-7Y5UDEVM.js";

package/dist/{skill-refinement-74T6VDFM.js → skill-refinement-EOROTBPX.js}

@@ -2,10 +2,10 @@ import {
   incrementSkillSuccess,
   incrementSkillUsage,
   runSkillRefinement
-} from "./chunk-RLRT2BVM.js";
-import "./chunk-HEPR6QTL.js";
+} from "./chunk-6D2PI4QD.js";
+import "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";

package/dist/stack-promote-RSOWO6EY.js

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+import {
+  isMainModule
+} from "./chunk-6Y4B3QF6.js";
+import "./chunk-MLKGABMK.js";
+
+// src/bin/stack-promote.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import path from "path";
+function promoteCanaryStack(manifest, version) {
+  const entry = manifest.stacks[version];
+  if (!entry) {
+    throw new Error(`Stack version ${version} not found in manifest. Known versions: ${Object.keys(manifest.stacks).join(", ")}`);
+  }
+  if (manifest.latest === version) {
+    throw new Error(`Stack version ${version} is already manifest.latest \u2014 nothing to promote.`);
+  }
+  const stage = entry.rolloutStage ?? "ga";
+  if (stage !== "canary") {
+    throw new Error(
+      `Stack version ${version} has rolloutStage="${stage}", not "canary" \u2014 stack-promote only promotes canary releases to GA. To move the fleet to an older already-GA version, use "exe-os stack-update --target ${version} --yes" (or --rollback) instead.`
+    );
+  }
+  const previousLatest = manifest.latest;
+  entry.rolloutStage = "ga";
+  manifest.latest = version;
+  return { version, previousLatest };
+}
+function findDefaultManifestPath() {
+  let dir = path.dirname(new URL(import.meta.url).pathname);
+  for (let i = 0; i < 6; i++) {
+    const candidate = path.join(dir, "deploy", "stack-manifests", "v0.9.json");
+    if (existsSync(candidate)) return candidate;
+    dir = path.dirname(dir);
+  }
+  return path.join(process.cwd(), "deploy", "stack-manifests", "v0.9.json");
+}
+function parseArgs(args) {
+  const opts = { version: "", manifestPath: findDefaultManifestPath(), yes: false };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--version") opts.version = args[++i] ?? "";
+    else if (arg.startsWith("--version=")) opts.version = arg.slice("--version=".length);
+    else if (arg === "--manifest") opts.manifestPath = args[++i] ?? opts.manifestPath;
+    else if (arg.startsWith("--manifest=")) opts.manifestPath = arg.slice("--manifest=".length);
+    else if (arg === "--yes" || arg === "-y") opts.yes = true;
+  }
+  return opts;
+}
+function printUsage() {
+  console.log(`
+Usage: exe-os stack-promote --version <version> [options]
+
+Promote a CANARY stack version to general availability (GA): flips its
+rolloutStage to "ga" and bumps manifest.latest so every customer running
+plain "stack-update --yes" (no --target) will pick it up.
+
+Run this ONLY after the canary host has been deployed and verified healthy
+(vps-health-gate / verify-stack) for an appropriate soak period.
+
+Options:
+  --version <version>   Stack version to promote (must have rolloutStage: "canary")
+  --manifest <path>     Path to the stack manifest JSON (default: deploy/stack-manifests/v0.9.json)
+  --yes, -y             Skip the interactive confirmation prompt
+  --help                Show this help message
+
+This command edits the manifest file only \u2014 it does not commit, tag, or
+push. Review the diff and commit/push yourself (or via CI), same as
+"exe-os release --stack".
+`);
+}
+async function runStackPromoteCli(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printUsage();
+    return;
+  }
+  const opts = parseArgs(args);
+  if (!opts.version) {
+    console.error("[stack-promote] --version <version> is required.\n");
+    printUsage();
+    process.exitCode = 1;
+    return;
+  }
+  if (!existsSync(opts.manifestPath)) {
+    console.error(`[stack-promote] Manifest not found: ${opts.manifestPath}`);
+    process.exitCode = 1;
+    return;
+  }
+  const raw = readFileSync(opts.manifestPath, "utf8");
+  const manifest = JSON.parse(raw);
+  let result;
+  try {
+    result = promoteCanaryStack(manifest, opts.version);
+  } catch (err) {
+    console.error(`[stack-promote] ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`[stack-promote] ${result.previousLatest} -> ${result.version}`);
+  console.log(`[stack-promote] Manifest: ${opts.manifestPath}`);
+  if (!opts.yes) {
+    const { createInterface } = await import("readline");
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => {
+      rl.question(
+        `
+Promote ${result.version} to GA (manifest.latest)? Confirm the canary host is verified healthy. [y/N] `,
+        resolve
+      );
+    });
+    rl.close();
+    if (answer.trim().toLowerCase() !== "y") {
+      console.log("[stack-promote] Aborted.");
+      process.exitCode = 1;
+      return;
+    }
+  }
+  writeFileSync(opts.manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+  console.log(`[stack-promote] \u2713 Promoted ${result.version} to GA. Commit and push ${path.basename(opts.manifestPath)} to publish.`);
+}
+if (isMainModule(import.meta.url) && process.argv[1]?.includes("stack-promote")) {
+  runStackPromoteCli(process.argv.slice(2)).catch((err) => {
+    console.error(`[stack-promote] Fatal error: ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = 1;
+  });
+}
+export {
+  promoteCanaryStack,
+  runStackPromoteCli
+};

package/dist/{stack-release-XXMV7SPX.js → stack-release-PR2XKJ4Q.js}

@@ -144,7 +144,8 @@ function parseReleaseArgs(argv) {
     skipImageVerify: false,
     allowRed: false,
     root: null,
-    forceBuild: false
+    forceBuild: false,
+    canary: false
   };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
@@ -155,6 +156,7 @@ function parseReleaseArgs(argv) {
     else if (arg === "--minor") flags.minor = true;
     else if (arg === "--skip-image-verify") flags.skipImageVerify = true;
     else if (arg === "--allow-red") flags.allowRed = true;
+    else if (arg === "--canary") flags.canary = true;
     else if (arg === "--repos" && argv[i + 1]) {
       flags.repos = argv[++i].split(",").map((s) => s.trim()).filter(Boolean);
     } else if (arg.startsWith("--repos=")) {
@@ -672,7 +674,7 @@ function printImageVerification(results) {
   }
   console.log("");
 }
-async function updateStackManifest(changes, ciStatuses, dryRun, imageResults) {
+async function updateStackManifest(changes, ciStatuses, dryRun, imageResults, canary = false) {
   const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8"));
   const currentLatest = manifest.latest;
   const currentParts = currentLatest.split(".").map(Number);
@@ -724,17 +726,30 @@ async function updateStackManifest(changes, ciStatuses, dryRun, imageResults) {
     notes,
     npmVersion: exeOsVersion,
     breakingChanges: [],
-    services
+    services,
+    // Staged rollout (release-safety canary hardening): "canary" entries are
+    // published (images pinned + pullable) but NOT promoted for implicit
+    // adoption — see assertRolloutStageAllowed in src/lib/stack-update.ts.
+    rolloutStage: canary ? "canary" : "ga"
   };
   if (dryRun) {
-    log("dry", `Would create stack ${newStackVersion} in manifest`);
+    log("dry", `Would create stack ${newStackVersion} in manifest${canary ? " (CANARY \u2014 latest would NOT be bumped)" : ""}`);
     log("dry", `Notes: ${notes}`);
     return newStackVersion;
   }
-  manifest.latest = newStackVersion;
   manifest.stacks[newStackVersion] = newEntry;
-  writeFileSync(MANIFEST_PATH, JSON.stringify(manifest, null, 2) + "\n");
-  log("ok", `Stack manifest updated: ${currentLatest} -> ${newStackVersion}`);
+  if (canary) {
+    writeFileSync(MANIFEST_PATH, JSON.stringify(manifest, null, 2) + "\n");
+    log("ok", `Stack manifest updated: added CANARY ${newStackVersion} (latest unchanged: ${currentLatest})`);
+    log("warn", `${newStackVersion} is a CANARY release. Deploy to a designated canary host with:`);
+    log("warn", `  exe-os stack-update --target ${newStackVersion} --yes`);
+    log("warn", `Then verify health (vps-health-gate / verify-stack) and promote with:`);
+    log("warn", `  exe-os stack-promote --version ${newStackVersion} --yes`);
+  } else {
+    manifest.latest = newStackVersion;
+    writeFileSync(MANIFEST_PATH, JSON.stringify(manifest, null, 2) + "\n");
+    log("ok", `Stack manifest updated: ${currentLatest} -> ${newStackVersion}`);
+  }
   return newStackVersion;
 }
 function gatePublishWithPreflight(newStackVersion, dryRun, allowRed) {
@@ -911,7 +926,7 @@ async function confirm(message) {
 }
 async function runStackRelease(flags) {
   if (!flags.stack) {
-    console.error("Usage: exe-os release --stack [--dry-run] [--repos <list>] [--yes] [--skip-image-verify] [--allow-red] [--root <path>] [--force]");
+    console.error("Usage: exe-os release --stack [--dry-run] [--repos <list>] [--yes] [--skip-image-verify] [--allow-red] [--canary] [--root <path>] [--force]");
     process.exit(1);
   }
   if (flags.root) {
@@ -1021,7 +1036,7 @@ async function runStackRelease(flags) {
     printImageVerification(imageResults);
   }
   log("info", "Updating stack manifest...");
-  const newStackVersion = await updateStackManifest(changes, ciStatuses, flags.dryRun, imageResults);
+  const newStackVersion = await updateStackManifest(changes, ciStatuses, flags.dryRun, imageResults, flags.canary);
   gatePublishWithPreflight(newStackVersion, flags.dryRun, flags.allowRed);
   const exeOsChange = changes.find((c) => c.repo.serviceKey === "exe-os");
   await commitAndTagExeOs(newStackVersion, exeOsChange, flags.dryRun);

package/dist/{stack-update-E2TKHHSQ.js → stack-update-LMDM27ZW.js}

@@ -6,6 +6,7 @@ import {
   assertDeploymentScopeAllowed,
   assertHostReadyForApply,
   assertProductionDeployGate,
+  assertRolloutStageAllowed,
   backupStackConfig,
   bootstrapStackHost,
   buildDefaultServiceSelection,
@@ -58,9 +59,9 @@ import {
   verifyReleaseHealth,
   verifyStackManifestSignature,
   waitForHttpOk
-} from "./chunk-XWHE4LZK.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+} from "./chunk-4LWV633D.js";
+import "./chunk-7SEC2AG5.js";
+import "./chunk-PPZOWQHP.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
@@ -72,6 +73,7 @@ export {
   assertDeploymentScopeAllowed,
   assertHostReadyForApply,
   assertProductionDeployGate,
+  assertRolloutStageAllowed,
   backupStackConfig,
   bootstrapStackHost,
   buildDefaultServiceSelection,