@askexenow/exe-os 0.9.341 → 0.9.343

package/README.md

@@ -1,243 +1,206 @@
-# Exe OS
+# exe-os
 
-![CI](https://github.com/AskExe/exe-os/actions/workflows/ci.yml/badge.svg) ![npm version](https://img.shields.io/npm/v/@askexenow/exe-os.svg) ![License: Proprietary](https://img.shields.io/badge/license-proprietary-blue.svg) ![Node.js](https://img.shields.io/badge/node-%3E%3D20.0.0-brightgreen.svg)
+AI employee operating system for AskExe: local-first memory, identity, task orchestration, and runtime glue for managing AI teammates through Claude Code, Codex, OpenCode, and the emerging desktop/runtime stack.
 
-**Hire the team you couldn't afford.** AI employee operating system with persistent memory, identity, and multi-agent orchestration.
+Current npm package: `@askexenow/exe-os` v0.9.341. Node.js `>=20` required.
 
-Run 5-10 AI employees as a real organization. Each employee has persistent memory across sessions, a permanent identity, and a task queue. You talk to your COO. Your COO coordinates everyone else.
+## What this repo is for
 
----
+exe-os lets a founder run an AI org instead of a single chat session:
 
-## Install
+- A coordinator agent owns the founder conversation and delegates through tracked tasks.
+- Specialists run in isolated tmux/worktree sessions with persistent identity, behaviors, and memory.
+- The local daemon, MCP server, hooks, and CLI keep sessions, reminders, reviews, cloud sync, and diagnostics connected.
+- Customer data stays local-first and encrypted; cloud sync is end-to-end encrypted when enabled.
 
-```bash
-npm install -g @askexenow/exe-os
-exe-os setup
-```
-
-Two commands. Encryption key generated, embedding model downloaded, team created, and Claude Code MCP/hooks/launchers installed.
-
----
+Hard constraints for every change:
 
-## Two Ways to Work
+- **MCP is the only data interface.** Never access the SQLCipher DB directly.
+- **Preserve customer data sovereignty.** Updates must not overwrite identities, behaviors, procedures, rosters, local memory, or user config.
+- **No secrets in code, logs, tests, telemetry, or bug reports.**
+- **No `require()` in runtime ESM TypeScript** under `src/lib`, `src/mcp`, or `src/tui`; use ESM imports.
+- **Every task/review/message/notification query must filter by `session_scope`.**
+- **No hardcoded employee names.** Use role/config resolution, not AskExe's local roster.
 
-### Mode 1: Claude Code
+## Architecture at a glance
 
-Use your existing Claude Code subscription. `exe-os setup` wires Claude Code once; then type your COO's name in the terminal.
+```text
+User / founder
+  -> coordinator agent session
+     -> managers / specialists via task DB + tmux sessions
 
-```bash
-exe                        # talk to your COO
+Claude Code / Codex / OpenCode
+  -> hooks + MCP tools
+     -> exe daemon
+        -> encrypted local memory/tasks/identity/behavior store
+        -> optional E2EE cloud sync
+        -> gateway / stack integrations
 ```
 
-Best for: developers who live in the terminal.
-
-### Mode 2: Dashboard
-
-Visual terminal UI with sidebar, team view, tasks, and metrics.
+Key pieces:
+
+- **MCP server (`src/mcp`)** exposes the supported tool surface for memory, tasks, identity, behavior, support, diagnostics, config, documents, CRM/raw data, and gateway actions.
+- **Daemon (`src/lib`, `src/services`)** supervises sessions, timers, task enforcement, intercom delivery, sync, diagnostics, and local state.
+- **Adapters (`src/adapters`)** integrate with Claude Code, Codex, and OpenCode through hooks and launcher behavior.
+- **CLI commands (`src/bin`, `src/commands`)** install, launch, diagnose, update, release, preflight, sync, and operate the stack.
+- **Runtime/TUI (`src/runtime`, `src/tui`)** are legacy/current terminal runtime surfaces; the architecture doc notes the legacy Ink TUI is frozen while the product direction moves toward the native exe-build/desktop chat runtime.
+- **Stack deploy (`deploy`)** contains compose, manifests, observability, registry proxy, nginx, migrations, and customer VPS deployment assets.
+
+Cognition layers used by agents:
+
+1. Company procedures: org-wide rules.
+2. Identity: role definition and non-negotiables.
+3. Behaviors/expertise: learned corrections and skills.
+4. Experience/memory: searchable history and decisions.
+5. Prospective items: future-condition memory/reminders surfaced at boot.
+
+## Repo map
+
+| Path | Purpose |
+|---|---|
+| `src/lib/` | Core daemon/runtime libraries: memory, tasks, identity, behaviors, search, sync, config, orchestration. |
+| `src/mcp/` | Consolidated MCP server and tool implementations. This is the supported data/control boundary. |
+| `src/adapters/` | Claude/Codex/OpenCode integration hooks and adapter glue. |
+| `src/bin/` | CLI entrypoints published through `package.json#bin`. |
+| `src/commands/` | Command implementations for `exe-os`, setup/update/release flows, diagnostics, etc. |
+| `src/runtime/` | Agent runtime/tool registry pieces. |
+| `src/tui/` | Legacy Ink TUI surface; avoid new product investment unless explicitly tasked. |
+| `src/gateway/` | Gateway/provider adapters and external messaging integration code. |
+| `deploy/` | Customer stack compose files, manifests, migrations, nginx, observability, registry proxy, Ansible. |
+| `deploy/stack-manifests/` | Customer-facing stack manifests; images must be digest-pinned. |
+| `packages/` | Shared UI/theme/health/error-page packages. |
+| `tests/` | Vitest suites, smoke tests, deploy tests, integration tests, orchestration tests. |
+| `scripts/` | Build locks, guards, schema checks, stack simulation, preflight helpers. |
+| `.planning/ARCHITECTURE.md` | Source of truth for current architecture and shipped progress. Future roadmap belongs in MCP support feature records, not markdown. |
+| `release-notes.json` | Current npm release notes shown after updates. |
+| `stack.release.json` | Stack release descriptor for customer/VPS participation. |
+
+## Key commands
+
+Customer/operator commands published by this package:
+
+| Command | Use |
+|---|---|
+| `exe` | Launch the configured coordinator agent. |
+| `exe-os` | Main CLI/dashboard entry. |
+| `exe-os setup` | First-time setup wizard: encryption, license, team, hooks, MCP, daemon. |
+| `exe-os update` | Recommended interactive update path for installed systems. |
+| `exe-os healthcheck` / `exe-healthcheck` | Health check for daemon, memory, cloud/sync, retrieval, and runtime state. |
+| `exe-doctor` | Deeper diagnostics. |
+| `exe-pending-reviews` | Show review queue; use before claiming work is idle/done. |
+| `exe-pending-messages` | Show pending inter-agent messages. |
+| `exe-config-dump` | Read-only effective config dump with secret redaction. |
+| `exe-timers` | Timer health dashboard. |
+| `exe-search-quality` | Retrieval quality/latency telemetry. |
+| `exe-stack-update` | Customer stack image update flow. Run only with explicit approval. |
+| `exe-preflight` | Stack/client production preflight checks. |
+| `exe-cloud` | Cloud sync/linking commands. Never print recovery phrases in agent output. |
+
+Useful local checks:
 
 ```bash
-exe-os                     # launch the dashboard
+npm run typecheck
+npm run lint
+npm test
+npm run test:daemon-smoke
+npm run test:stack-sim
+npm run guard:esm-require
+npm run check:schema-version
+npm run build
 ```
 
-Best for: managing multiple projects and employees.
+## Development workflow
 
-**Both modes share the same memory, employees, and data. Switch anytime.**
-
----
-
-## What You Get
-
-| Feature | What it does |
-|---------|-------------|
-| **Persistent memory** | Every interaction stored in encrypted SQLCipher + vector search. Searchable across sessions. |
-| **Four-layer cognition** | Company Procedures (org-wide rules) + Identity (who you are) + Expertise (what you've learned) + Experience (what you remember) |
-| **Multi-agent orchestration** | COO coordinates CTO, CMO, engineers. Parallel task execution via tmux. |
-| **Task system** | Create, assign, review, chain tasks. Auto-dispatch. Review pipeline with cascading approval. |
-| **Company procedures** | Org-wide rules that every employee follows. Set once, cascades everywhere. |
-| **Identity injection** | Each employee gets a permanent identity doc. Claude Code's `--agent` flag replaces the default system prompt. |
-| **Skill learning** | Agents learn procedures from repeated patterns. Corrections become permanent behaviors. |
-| **Cloud sync** | End-to-end encrypted memory sync across devices. Your key, your data. |
-| **License activation** | `exe-os --activate <key>` to unlock CTO + CMO. Free tier: 1 employee (COO only). |
-
----
-
-## How It Works
-
-```
-You
- |
- v
-Your COO (exe)
- ├── CTO ──> architecture, code reviews, tech decisions
- │    └── Engineer ──> implementation, tests, commits
- ├── CMO ──> design, content, SEO, branding
- │    └── Content specialist ──> video, images, production
- └── AI specialist ──> AI tools, research, evaluation
-```
-
-You talk to your COO. Your COO delegates. Each employee has:
-- **Persistent memory** — remembers past work, decisions, patterns
-- **Identity** — permanent role doc that defines who they are
-- **Task queue** — auto-chains through assigned work
-- **Behavioral expertise** — corrections accumulate as permanent rules
-- **Company procedures** — org-wide rules that cascade to every employee
-
----
-
-## Setup Walkthrough
-
-### 1. Install
+Install dependencies:
 
 ```bash
-# macOS
-xcode-select --install && brew install tmux
-npm install -g @askexenow/exe-os
-
-# Linux / WSL2
-sudo apt install -y tmux git cmake g++ libsecret-1-dev curl
-npm install -g @askexenow/exe-os
-
-# Windows — must use WSL2 (native Windows not supported)
-# Run `wsl --install` in PowerShell first, then follow Linux steps inside WSL2
+npm install
 ```
 
-Requires Node.js 20+ and tmux. See **[docs/install.md](docs/install.md)** for full platform-specific instructions and **[docs/quickstart.md](docs/quickstart.md)** for the 5-minute getting started guide.
-
-### 2. Run Setup
-
-```bash
-exe-os setup
-```
+Before coding:
 
-This runs the setup wizard:
-- Generates 256-bit encryption key (stored in system keychain)
-- Optional embeddings (off by default — graph + keyword search is the default); the embedding model, if enabled, runs locally
-- Names your COO (default: exe)
-- Shows your team (CTO, CMO) and pricing tiers
-- Optionally activates a license key
-- Installs Claude Code MCP, hooks, launchers, and daemon supervision
+1. Read the task brief and source docs.
+2. Use code-context/MCP search when available before broad manual grep.
+3. Keep diffs surgical; do not reformat unrelated files.
+4. Do not touch customer-local data, identities, behaviors, procedures, or rosters.
 
-### 3. Choose Your Mode
-
-**Mode 1 — Claude Code:**
+Standard validation:
 
 ```bash
-exe                        # launch your COO (or whatever you named them)
+npm run typecheck
+npm test
+npm run build
 ```
 
-**Mode 2 — Dashboard:**
+Targeted validation is acceptable for small changes, but release/merge gates require the relevant full checks. For runtime/daemon-critical work, also run:
 
 ```bash
-exe-os                     # launch the TUI dashboard
+npm run guard:esm-require
+npm run test:daemon-smoke
 ```
 
----
-
-## Pricing
-
-| Plan | Price | Employees | Memories | Devices |
-|------|-------|-----------|----------|---------|
-| Free | $0 | 1 (COO) | 50,000 | 1 |
-| Solopreneur | $97/mo | 5 | 250,000 | 2 |
-| Company | $297/mo | 20 | 1,000,000 | 10 |
-| Agency | $497/mo | 100 | 10,000,000 | 50 |
-| Enterprise | Custom | Unlimited | Unlimited | Unlimited |
+Build details:
 
-Activate: `exe-os --activate <key>` or paste during `exe-os setup`.
+- `npm run build` uses `scripts/build-lock.sh`, then copies runtime assets into `dist/` and generates hook manifests when possible.
+- `npm run deploy` builds, installs this checkout globally, and restarts/re-registers pieces. It disrupts active MCP sessions; do not run it casually.
+- `postinstall` runs command-only install behavior so global installs expose CLIs without overwriting customer data.
 
-Purchase at [askexe.com](https://askexe.com).
+## Test and CI notes
 
----
+- Main test runner: `vitest run`.
+- `test:publish` is the required publish gate subset plus selected serialized stress/gateway tests.
+- Tests that touch support/bug/feature upstream paths must mock `fetch`; never create live support records from tests.
+- Docker/live-DB tests may be quarantined in `test:publish`; read the script comments before assuming a missing test is accidental.
+- CI must be green on the exact commit before merge/release.
 
-## Employee Templates
-
-Create employees with built-in templates:
-
-```bash
-exe-new-employee atlas --role <template>
-```
+## Publish and release
 
-Or create custom employees:
+NPM publish gate:
 
 ```bash
-exe-new-employee alex                      # custom specialist
+npm run prepublishOnly
 ```
 
-Each employee gets an identity doc at `~/.exe-os/identity/{name}.md`, a task folder, and launcher commands.
-
----
-
-## For Agencies
-
-See [docs/Agency-Playbook.md](docs/Agency-Playbook.md) for multi-client VPS deployment:
-- One VPS, multiple clients, full data isolation
-- Per-client wiki workspaces
-- Cross-client querying for agency owners
-- Config-driven white-label theming via `branding.json`
-
----
-
-## Commands
+That runs typecheck, build, orphan chunk pruning, ESM `require()` guard, schema version check, customer-readiness, and pre-publish checks.
 
-| Command | What it does |
-|---------|-------------|
-| `exe-os` | Launch TUI dashboard (Mode 2) |
-| `exe-os setup` | Run setup wizard |
-| `exe-os claude` | Install hooks + MCP into Claude Code (Mode 1) |
-| `exe-os --activate <key>` | Activate a license key |
-| `exe` | Launch your COO in Claude Code |
-| `exe-new-employee <name>` | Create a new employee |
-| `/exe` | Boot your COO (inside Claude Code) |
-| `/exe-team` | Show employee roster |
-| `/exe-search <query>` | Search memories |
+Normal local package update path for users:
 
----
-
-## Architecture
-
-```
-exe-os/
-  src/
-    lib/          # Core: memory, tasks, identity, behaviors, search, sync, encryption
-    mcp/          # MCP server (100+ tools for Claude Code integration)
-    adapters/     # Claude Code hooks (ingest, session-start, pre-tool-use, etc.)
-    tui/          # Ink-based terminal dashboard (Mode 2)
-    runtime/      # Agent loop, tool registry, permissions (Mode 2 standalone)
-    gateway/      # External messaging (WhatsApp, Telegram, Discord, webhook)
-  deploy/
-    compose/      # Docker Compose for VPS deployment (CRM + wiki + gateway + daemon)
-    Dockerfile*   # Per-service Docker images
-  docs/
-    Agency-Playbook.md  # Multi-client VPS guide
+```bash
+npm install -g @askexenow/exe-os@latest
+# or use the interactive path
+exe-os update
 ```
 
-**Three runtime modes:**
-
-| Mode | Entry | What you see |
-|------|-------|-------------|
-| Mode 1: Claude Code | `exe` | Claude Code terminal with COO identity |
-| Mode 2: TUI Dashboard | `exe-os` | Terminal dashboard with sidebar + team view |
-| Mode 3: Desktop | `exe-os desktop` | Tauri native app (coming soon) |
-
-**Storage:** SQLCipher (encrypted SQLite) + optional local embeddings (1024-dim, off by default). No data leaves your machine unless you opt into Exe Cloud (E2EE).
-
----
-
-## Requirements
-
-- **Node.js 20+**
-- **tmux** — for multi-agent session management
-- **Claude Code** subscription (Mode 1) or API key (Mode 2)
-
-| Platform | Quick Install |
-|----------|-------------|
-| macOS | `brew install tmux node` + Xcode CLI Tools |
-| Linux | `apt install tmux git cmake g++ libsecret-1-dev` + Node.js 20+ |
-| Windows | WSL2 required (`wsl --install`), then follow Linux steps |
-
-Full guide: **[docs/install.md](docs/install.md)**
-
----
+Customer stack releases are separate from npm package releases:
+
+- `release-notes.json` currently tracks npm v0.9.341.
+- `stack.release.json` currently describes stack/source v0.9.312 and includes TODO notes for private GHCR app image digest resolution.
+- Customer stack manifests/images must be SHA256 digest-pinned. Do not promote tag-only app images to customer releases.
+- Production stack updates must preserve named Docker volumes and customer state; never use `docker compose down -v` or remove data volumes.
+- Stack image release should go through the documented `exe-os release --stack` flow, Bob/customer-readiness audit, preflight, pinned images, and health verification.
+
+## Operational gotchas
+
+- **MCP only.** If MCP is disconnected, reconnect it; do not bypass with direct DB reads or ad-hoc scripts against SQLCipher.
+- **Session scope matters.** Cross-session task/review/message leakage is a P0 class bug. Query filters must include `session_scope` where applicable.
+- **Data is immutable unless the user changes it.** Installers, updates, imports, starter packs, and stack updates must be additive/check-exists-first.
+- **Cloud endpoint is `https://api.askexe.com`.** Do not introduce legacy cloud domains.
+- **Key material belongs in Keychain/secret-tool.** Never log, print, or commit recovery phrases or master keys.
+- **Runtime TypeScript is ESM.** `require()` in daemon/MCP/TUI runtime paths will break after build.
+- **Stack state needs volumes.** WhatsApp auth, Postgres, wiki/CRM/gateway data, monitor data, and other stateful services need named volumes before image swaps.
+- **Health before claims.** Verify daemon health, pending reviews, pending messages, task status, and tmux state before reporting an agent is idle/done/stuck.
+- **Build after merges.** A clean git merge is not a build check; run `npm run build` after merged work that affects shipped code.
+- **No `:latest` in manifests/compose.** Release images must be versioned and digest-pinned for customer deploys.
+
+## Security checklist for reviews
+
+- No secrets, PII, API keys, recovery phrases, or tokens in code/test fixtures/log output.
+- Auth middleware and permission checks preserved.
+- External network connections use TLS unless explicitly local-only.
+- Telemetry/bug-report egress redacts secrets and mnemonics.
+- No direct DB access paths added; all agent-facing data flows through MCP tools.
+- No hardcoded AskExe employee names, local paths, or private roster assumptions.
+- Compose services have healthchecks and stateful services have durable volumes.
 
 ## License
 

package/deploy/compose/.env.customer.example

@@ -42,6 +42,7 @@ GOTRUE_MAILER_AUTOCONFIRM=false
 # Auth-email From address — customer domain, not askexe.com (bug 133c9d5b).
 SMTP_FROM=noreply@CHANGEME_DOMAIN
 # To enable verified email confirmation, set SMTP_* (MAILER_AUTOCONFIRM stays false).
+# Bug 799e7b1e: use these bare SMTP_* names, not GoTrue's own GOTRUE_SMTP_* names.
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=

package/deploy/compose/.env.example

@@ -70,6 +70,7 @@ GOTRUE_MAILER_AUTOCONFIRM=false
 # From address for auth emails — customer domain, not askexe.com (bug 133c9d5b).
 SMTP_FROM=noreply@CHANGEME_DOMAIN
 # To enable verified email confirmation, set SMTP_* below (MAILER_AUTOCONFIRM stays false).
+# Bug 799e7b1e: use these bare SMTP_* names, not GoTrue's own GOTRUE_SMTP_* names.
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=

package/deploy/compose/docker-compose.yml

@@ -221,10 +221,19 @@ services:
       GOTRUE_JWT_ISSUER: ${GOTRUE_JWT_ISSUER:-${GOTRUE_EXTERNAL_URL:?GOTRUE_EXTERNAL_URL is required — set to https://auth.<your-domain> in .env}}
       GOTRUE_DISABLE_SIGNUP: ${GOTRUE_DISABLE_SIGNUP:-true}
       GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-false}
-      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
-      GOTRUE_SMTP_PORT: ${SMTP_PORT:-587}
-      GOTRUE_SMTP_USER: ${SMTP_USER:-}
-      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
+      # Bug 799e7b1e: generate-env.ts writes the canonical .env keys as
+      # bare SMTP_HOST/PORT/USER/PASS (no GOTRUE_ prefix — see generate-env.ts).
+      # But GoTrue's own upstream docs name these vars GOTRUE_SMTP_HOST/USER/PASS,
+      # so a human hand-editing .env (prod hotfix, manual onboarding, following
+      # GoTrue's docs instead of ours) naturally reaches for the GOTRUE_-prefixed
+      # names — which this compose never read, so SMTP silently stayed disabled
+      # even though credentials were present in .env. Accept BOTH spellings:
+      # prefer the canonical SMTP_* (generate-env.ts output), fall back to the
+      # GOTRUE_SMTP_* alias so a manually-set value still takes effect.
+      GOTRUE_SMTP_HOST: ${SMTP_HOST:-${GOTRUE_SMTP_HOST:-}}
+      GOTRUE_SMTP_PORT: ${SMTP_PORT:-${GOTRUE_SMTP_PORT:-587}}
+      GOTRUE_SMTP_USER: ${SMTP_USER:-${GOTRUE_SMTP_USER:-}}
+      GOTRUE_SMTP_PASS: ${SMTP_PASS:-${GOTRUE_SMTP_PASS:-}}
       # Bug 133c9d5b: never fall back to a hardcoded askexe.com sender. SMTP_FROM
       # is written to .env by generate-env.ts as noreply@<customer-domain>. A
       # missing value fails loudly rather than silently sending auth mail From

package/deploy/compose/generate-env.ts

@@ -122,6 +122,9 @@ export function generateEnv(options: GenerateEnvOptions): string {
     `SMTP_FROM=noreply@${normalizedDomain}`,
     "# To enable verified email confirmation, set SMTP_HOST/PORT/USER/PASS below.",
     "# MAILER_AUTOCONFIRM is already false, so once SMTP is live, ownership is verified.",
+    "# Bug 799e7b1e: use these bare SMTP_* names, NOT GoTrue's own GOTRUE_SMTP_*",
+    "# names — compose reads SMTP_* first (falling back to GOTRUE_SMTP_* only if",
+    "# hand-set) and maps it to GoTrue's container env internally.",
     "SMTP_HOST=",
     "SMTP_PORT=587",
     "SMTP_USER=",
@@ -377,6 +380,7 @@ export function generateExampleEnv(): string {
     "# From address for auth emails — customer domain, not askexe.com (bug 133c9d5b).",
     "SMTP_FROM=noreply@CHANGEME_DOMAIN",
     "# To enable verified email confirmation, set SMTP_* below (MAILER_AUTOCONFIRM stays false).",
+    "# Bug 799e7b1e: use these bare SMTP_* names, not GoTrue's own GOTRUE_SMTP_* names.",
     "SMTP_HOST=",
     "SMTP_PORT=587",
     "SMTP_USER=",

package/dist/{active-agent-LW45DSJ4.js → active-agent-MDGDKGCL.js}

@@ -6,18 +6,18 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-C445WRUX.js";
+} from "./chunk-7M5AWCR3.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-RWSLVYTE.js";
+import "./chunk-GD7FA6IP.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-BV6GBSRP.js";
+import "./chunk-IKAGAKAI.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+import "./chunk-OL4JFQ2T.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 export {
   cleanupSessionMarkers,

package/dist/{active-agent-AIQP4DFL.js → active-agent-SNVSJFI5.js}

@@ -5,18 +5,18 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-C445WRUX.js";
+} from "./chunk-7M5AWCR3.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-RWSLVYTE.js";
+import "./chunk-GD7FA6IP.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-BV6GBSRP.js";
+import "./chunk-IKAGAKAI.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+import "./chunk-OL4JFQ2T.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 export {
   cleanupSessionMarkers,

package/dist/{agentic-ontology-RVUNRCQY.js → agentic-ontology-SCG6UUHK.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-C2SRRCRK.js";
+} from "./chunk-EBTWNNAS.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{backfill-gate-J7UXFNXU.js → backfill-gate-HARARX5F.js}

@@ -5,9 +5,9 @@ import {
   backfillKillSwitchEnabled,
   computeBackfillDisabled,
   countActionableNullVectors
-} from "./chunk-KPIN44GZ.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+} from "./chunk-H6WLWIPN.js";
+import "./chunk-OL4JFQ2T.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 export {
   NOT_PARKED_SQL,

package/dist/{backfill-metadata-ZSDJ4O2T.js → backfill-metadata-SCQ5FPDR.js}

@@ -2,26 +2,26 @@
 import {
   disposeStore,
   initStore
-} from "./chunk-EDH54E5A.js";
+} from "./chunk-ZYLKX3KB.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-7LF5DS3A.js";
-import "./chunk-RP5GETX5.js";
+import "./chunk-4MLSFZLY.js";
+import "./chunk-4QCFFW2H.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient,
   getEmployeeNamesByRole,
   loadEmployeesSync
-} from "./chunk-RWSLVYTE.js";
+} from "./chunk-GD7FA6IP.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-BV6GBSRP.js";
+import "./chunk-IKAGAKAI.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-Z42MXYWW.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+import "./chunk-QWVXN224.js";
+import "./chunk-OL4JFQ2T.js";
+import "./chunk-BYTDMAGB.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";

package/dist/{background-jobs-STURKDCS.js → background-jobs-KKRO3QRO.js}

@@ -9,9 +9,9 @@ import {
   releaseJobLock,
   reniceCurrentProcess,
   startManagedJob
-} from "./chunk-JSKBHUR7.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+} from "./chunk-BZA4N43B.js";
+import "./chunk-OL4JFQ2T.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 export {
   acquireJobLock,

package/dist/{backup-verify-ZAJLEL4X.js → backup-verify-KDLOT4RP.js}

@@ -1,9 +1,9 @@
 import {
   getLatestBackup,
   reasonFromBackupName
-} from "./chunk-BV6GBSRP.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+} from "./chunk-IKAGAKAI.js";
+import "./chunk-OL4JFQ2T.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 
 // src/lib/backup-verify.ts
@@ -264,7 +264,7 @@ async function compareToLive(name, gotCounts, opts) {
 }
 async function recordVerdict(res) {
   try {
-    const { recordDbRestoreEvent } = await import("./db-restore-events-JVEEP52Z.js");
+    const { recordDbRestoreEvent } = await import("./db-restore-events-GQGQSYHV.js");
     if (res.ok) {
       recordDbRestoreEvent({
         kind: "restore-verify-pass",

package/dist/{behaviors-EO7KCP3H.js → behaviors-MICGF3H3.js}

@@ -12,23 +12,23 @@ import {
   reactivateBehavior,
   storeBehavior,
   storeReflexBehavior
-} from "./chunk-OUEFW4RK.js";
-import "./chunk-EDH54E5A.js";
+} from "./chunk-KRRZNASS.js";
+import "./chunk-ZYLKX3KB.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-7LF5DS3A.js";
-import "./chunk-RP5GETX5.js";
+import "./chunk-4MLSFZLY.js";
+import "./chunk-4QCFFW2H.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-RWSLVYTE.js";
+import "./chunk-GD7FA6IP.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-BV6GBSRP.js";
+import "./chunk-IKAGAKAI.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-Z42MXYWW.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+import "./chunk-QWVXN224.js";
+import "./chunk-OL4JFQ2T.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 export {
   GHOST_BEHAVIOR_SQL,