@askexenow/exe-os 0.9.362 → 0.9.365

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.362",
-  "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
+  "version": "0.9.365",
+  "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "repository": {
@@ -46,6 +46,7 @@
     "exe-timers": "./dist/bin/exe-timers.js",
     "exe-config-dump": "./dist/bin/exe-config-dump.js",
     "exe-stack-update": "./dist/bin/stack-update.js",
+    "exe-verify-running-images": "./dist/bin/exe-verify-running-images.js",
     "exe-preflight": "./dist/bin/exe-preflight.js",
     "exe-cloud": "./dist/bin/exe-cloud.js",
     "exe-grant": "./dist/bin/exe-grant.js",
@@ -114,15 +115,20 @@
     "build": "node scripts/dist-ownership-guard.mjs && bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true) && node scripts/dist-integrity.mjs --record",
     "deploy": "node dist/bin/pre-build-guard.js && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node scripts/dist-integrity.mjs --verify && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "node postinstall.mjs",
-    "prepublishOnly": "npm run typecheck && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node dist/bin/prune-orphan-chunks.js --force && node scripts/dist-integrity.mjs --prune && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
-    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner — container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner — passes locally). Quarantined to match build-and-test (required gate): dispatch-chain/e2e-flow (timing-sensitive, flaky under parallel load — bug dfb25bf1). device-id-split-brain/reaper-deps-async/find-free-instance/db-backup-recovery de-flaked and promoted to the required gate (chore/deflake-required-ci). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
+    "prepublishOnly": "npm run typecheck && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node dist/bin/prune-orphan-chunks.js --force && node scripts/dist-integrity.mjs --prune && npm run guard:esm-require && npm run guard:defect-classes && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
+    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner \u2014 container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner \u2014 passes locally). Quarantined to match build-and-test (required gate): dispatch-chain/e2e-flow (timing-sensitive, flaky under parallel load \u2014 bug dfb25bf1). device-id-split-brain/reaper-deps-async/find-free-instance/db-backup-recovery de-flaked and promoted to the required gate (chore/deflake-required-ci). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
     "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",
     "guard:esm-require": "node scripts/check-no-runtime-require.mjs",
+    "guard:defect-classes": "node scripts/check-defect-gates.mjs",
     "check:schema-version": "node scripts/check-schema-version.mjs",
+    "check:perms-ui-sync": "node packages/permissions-ui/sync.mjs --check",
+    "check:switcher-ui-sync": "node packages/exe-service-switcher/sync.mjs --check",
     "check:stack-manifest-signature": "node scripts/verify-stack-manifest-signature.mjs",
+    "check:sso-cookie-contract": "node scripts/sso-cookie-contract-check.mjs",
     "test:stack-sim": "node scripts/stack-sim.mjs",
     "test:daemon-smoke": "vitest run --maxWorkers=1 tests/smoke/daemon-smoke-gate.test.ts",
-    "test:smoke": "vitest run --maxWorkers=1 tests/smoke/"
+    "test:smoke": "vitest run --maxWorkers=1 tests/smoke/",
+    "smoke:runtime": "node --import tsx src/bin/runtime-smoke.ts"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.95.2",

package/release-notes.json

@@ -1,68 +1,120 @@
 {
-  "current": "0.9.362",
+  "current": "0.9.365",
   "notes": {
-    "0.9.362": {
-      "version": "0.9.362",
-      "date": "2026-08-08",
-      "features": [],
-      "fixes": [],
+    "0.9.365": {
+      "version": "0.9.365",
+      "date": "2026-08-13",
+      "features": [
+        "mount cross-app service switcher in dashboard + team pages (#683)",
+        "phase 5 — org-aware usage/credits/keys/billing + persisted alert threshold (e51ca54c) (#677)",
+        "phase 6a — invite email via Resend + redeemability corrections (e51ca54c) (#678)",
+        "phase 4 — atomic spend-cap admission + freeze kill-switch (api-router lane) (#672)",
+        "phase 2 — self-serve org scoping (GET /v1/orgs, is_staff, panel mode 'self') (#653)",
+        "phase 3 — spend-limits model, authoring + ceiling guard, claim projection (e51ca54c) (#663)",
+        "detect the unsupervised-daemon state (ad8886b8) (#623)",
+        "phase 0 — planning-doc truth, permsSubject() identity join, live self-edit warning (#649)"
+      ],
+      "fixes": [
+        "deadlock-proof the release path — drift monitor + required-context gate off the release lane (#675)",
+        "write stack state files 0644 so the drift watchdog can read them (exe-monitor#27) (#680)",
+        "teach the named-subagent default at every layer, not just the ladder (#614)",
+        "honest backup verification — index is healthy, the alarm was not (e0b92e67) (#632)",
+        "attribute every kill + verify PID identity before signalling (7a915790, 9fc28233, 42aa8c56) (#636)",
+        "digest-pin every shipped image, make strict-digest the DEFAULT (#679)",
+        "move extended-tests out of CI workflow so a non-required job stops gating releases (debdb921) (#655)",
+        "match agent healthcheck to the PINNED image generation (bug 9ce2a68b coupling) (#676)",
+        "live manifest first, packaged only as offline fallback (bug c00e1544) (#674)",
+        "resolve the exe-db container dynamically in wire-update-service.sh (bug 7ff62674) (#666)",
+        "project attribution must survive git worktrees (e19ce3a3) (#661)",
+        "--services is run-scoped, managed-set writes additive-only (bug db262248) (#660)",
+        "fail-closed manifest signatures + built-in verification key (bug c00e1544) (#664)",
+        "make managed-permissions mode explicit in the shipped stack (e51ca54c) (#668)",
+        "role 'none' clears the roster admin bit + a real revoke path in the panel (Phase 1, e51ca54c) (#650)",
+        "enforce prepaid credit balance with a 402 gate (5a862f9c) (#642)",
+        "add missing /openai segment to Gemini base URL (#648)",
+        "stop committing empty secrets in wrangler [vars] (b6f1cbf9) (#647)",
+        "make isolation real and non-optional (2b7072a7) (#621)"
+      ],
       "security": [],
       "other": [
-        "v0.9.362 (#577)"
+        "v0.9.365 (#686)",
+        "build + push the exe-dashboard image on main (was hand-shipped) (#654)",
+        "right-size the x64 Linux release gate to native-module verification (e8f2cccd) (#651)",
+        "release(stack): 0.9.35 — pin exe-auth v0.5.0 (EXE INTELLIGENCE front door) (#645)"
       ],
       "migration_notes": []
     },
-    "0.9.359": {
-      "version": "0.9.359",
-      "date": "2026-07-30",
-      "features": [],
+    "0.9.364": {
+      "version": "0.9.364",
+      "date": "2026-08-12",
+      "features": [
+        "scheduled CI sweeper: green agent PRs merge automatically and their git worktrees are pruned in the same action, so completed work can no longer sit unmerged and worktrees cannot accumulate",
+        "permanent gates for four recurring defect classes, with a monotone inventory that fails when a fix leaves a stale allowlist entry behind"
+      ],
       "fixes": [
-        "org-mode: the org-mode-anchor keychain probe no longer risks raising the DESTRUCTIVE macOS 'A keychain cannot be found to store org-mode-anchor' dialog (whose 'Reset To Defaults' button can wipe the login keychain). nativeKeychainAllowed() now skips the native keychain — a best-effort mirror of the authoritative home-anchored file, so nothing is lost — in the daemon (EXE_IS_DAEMON), SSH/remote sessions, and on macOS with no default keychain (probed via a read-only `security default-keychain` that never invokes SecurityAgent). A healthy interactive GUI login is unaffected. Strictly-safer 1-file guard tightening (#514)",
-        "privacy: stop unconsented telemetry + support-content egress (bug 4b8b47fd, P0) (#510)",
-        "internal (dormant — no user-facing change until the org feature is wired): AI-Partner phase-1 infrastructure — B1 org-mode privacy/crypto boundary via a boot-resolved SyncCipher (existing single-user installs keep byte-identical v=1 cloud-sync encryption; the org path stays dormant until an org-membership anchor exists) + partner signing identity + sealed mailbox envelope (#504), and B2 sealed-mailbox relay/transport with cross-tenant SQL-predicate scoping (#505)"
+        "orphan reaper (P0): the daemon reaper matched free text and killed live agent work — two Codex agents and a shell were destroyed mid-run. It now positively identifies a process by argv identity (node-wrapped CLIs resolve to the real CLI) and requires an anchored pattern match",
+        "memory (P0): supersede writes are scoped to the calling agent, closing two cross-agent scope leaks; a silently-ignored agent_id is now rejected instead of ignored",
+        "cloud sync: the daemon socket leaked after a successful sync, keeping the process alive until SIGTERM; it is now disconnected on cleanup and on SIGTERM",
+        "cloud sync: require a reliable daemon DB init instead of syncing against a no-op client",
+        "cli: short-lived binaries exit instead of hanging on the daemon socket",
+        "agent config: correct Claude 5 model ids, drop a phantom Sonnet 4.8, and accept future claude models instead of failing on a hardcoded list",
+        "agent defs: internal Claude model ids are translated to Claude Code frontmatter aliases",
+        "registry proxy: routes are classified at a single choke point and unknown paths fail closed",
+        "daemon: repeated dirty-worktree archive failures are bounded instead of retrying forever",
+        "boot brief: open work that nothing is executing is now surfaced instead of being silently lost; section and brief timeouts are separated and fail loud",
+        "sso-edge: the healthcheck probes the exempt /healthz rather than the gated /",
+        "worker: a missing API_KEY_STORAGE_SECRET no longer turns a successful auth into a 500 with an unwritten api_key_hash"
+      ],
+      "infrastructure": [
+        "local-first Linux CI: linux-build-check, api-router, worker and smoke run on local arm64 Linux VMs (linux-build-check went from 5-6 min to ~1m17s). The x64 Linux matrix still runs on main-push and still gates release, so x64 coverage is preserved",
+        "per-SHA concurrency restored on main so a release commit can never lose its CI run to a later push"
       ],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.358": {
-      "version": "0.9.358",
-      "date": "2026-07-29",
+    "0.9.363": {
+      "version": "0.9.363",
+      "date": "2026-08-12",
       "features": [
-        "budget: proactive global spend-cap alerting — the daemon now evaluates 24h spend against the configured cap on each agent-stats refresh and fires ONE notification per escalation (ok→near_cap→over_cap, re-arming on a drop), so a runaway agent that blows the budget is surfaced actively instead of only reactively via get_agent_spend (7c89b432) (#482)",
-        "security: repo-wide gitleaks pre-commit hook (staged-content scan, warn-and-allow when the tool is missing, CI full-history scan as the hard backstop) plus a fully triaged .gitleaksignore baseline — every entry is a documented false-positive (redaction-test fixtures, doc examples, public keys), with the standing policy that new untriaged findings still fail CI (caf65918) (#424)"
+        "runtime smoke gate: a post-deploy check that verifies the deployed system actually works — cloud sync reaches 'complete' with an advancing cursor and DB backup passes integrity — so a merged-but-never-deployed fix can no longer masquerade as done (#600)",
+        "account identity + lifecycle: one authoritative identity bound to the verified GoTrue subject (not a client-asserted device id) plus enforceable account suspension at the network boundary; additive migration with a gotrue_sub partial-unique index and legacy backfill (#597)",
+        "named-subagent identity + employee memory brief at spawn: dispatch work to a subagent wearing an employee's identity with spawn-ledger-gated memory attribution, and inject the employee's scoped memory brief on first tool use; the PreToolUse matcher now upgrades on existing installs so Task/Agent dispatch is actually captured (#596, #601)",
+        "stack: machine-enforce two invariants — exactly one GoTrue per host and a canonical SSO cookie contract (#598)"
       ],
       "fixes": [
-        "db: reconcile the ADR-016 single-writer guard (supersedes #498+#487) — isDaemonWriterAuthority() now fails SAFE on a frozen daemon (a socket-ping timeout is read as \"authority present\", refusing a second writer) and resolves the daemon PID/socket from the same EXE_OS_DIR-aware path the daemon writes to; adds an MCP-process unconditional direct-write block, a read-path short-circuit, a DB-open telemetry tripwire, and WAL/scope fixes; also folds in daemon stall-attribution, boot timing and cloud-sync-via-daemon diagnostics (df26c896) (#503)",
-        "ci: make two required-gate tests deterministic — the retrieval-telemetry \"hot path\" test now asserts the real invariant (synchronous void return + in-memory buffering, no DB I/O) instead of a wall-clock threshold, and the daemon-ready \"starting health window\" test uses fake timers; both previously flaked under self-hosted-runner load and stalled releases (a8817ab0) (#506)",
-        "release: drift-proof the stack-promote runbook + printed NEXT STEPS — re-sign the stack manifest and commit the SIGNED file BEFORE arming auto-merge (an armed auto-merge could otherwise land an unsigned manifest and brick fleet stack-update), and publish only after the signed manifest is on merged main; adds a doc-lint guard enforcing the ordering and a cli.ts --version routing regression test (5a6c6c52 #463, hardened by 53816038 #509)",
-        "daemon-report: exclude macOS host-sleep wake-clusters from the restart-report slowest-timer leaderboard too (shared with the timer report via a new daemon-sleep-filter module), so a laptop suspend no longer inflates the slowest-timer numbers with multi-minute sleep spans (#457)",
-        "procedures: raise the injected-procedures size cap to 27000 to fit the \"Done = LANDED\" terminal-state discipline addition, and teach merge/landing discipline in the platform procedures (#486)"
+        "cloud sync had a 0% success rate: background sync destroyed the daemon socket under backpressure ('Sync failed: Connection closed'), so no sync ever completed. The socket is now preserved and sync completes end-to-end (verified live: 'Cloud sync: complete', 5,430 pushed) (#593)",
+        "local-store durability: DB backup can no longer lose data — a failed integrity check quarantines the file instead of deleting it, FTS corruption rethrows instead of silently returning an empty store, and the integrity verdict is a trustworthy tri-state; the online-backup integrity route is pinned to the write path (#590, #594)",
+        "daemon: background sweeps moved off the event loop so a long sweep can no longer block MCP handling (#591)",
+        "support: recording a fixed version must no longer auto-close a still-open bug (#599)"
       ],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.357": {
-      "version": "0.9.357",
-      "date": "2026-07-28",
+    "0.9.362": {
+      "version": "0.9.362",
+      "date": "2026-08-08",
       "features": [
-        "release ops: nightly image-pullability drift watchdog — a scheduled workflow HEAD-checks every pinned digest in the shipped stack manifests and fails loudly if any becomes un-pullable (registry GC, mirror rot, or proxy-auth drift), catching supply-chain breakage within ~24h instead of at a customer's deploy pre-flight (f4cbc12a) (#499)"
+        "p0 timers: daemon timers moved off the event loop — long-running timer callbacks no longer block the daemon event loop, and a worker-race in timer scheduling is closed so overlapping ticks cannot starve MCP handling (Codex gpt-5.5 build, triage 2026-08-06) (#562, re-review findings closed in #571)",
+        "p0 durability: last-mile durability for the local store — encrypted backups now actually run, the write path preserves the WAL and does not drop the ledger, and duplicate writes are de-duplicated (Codex gpt-5.5 build) (#560, 5 Codex NO-GO findings closed in #570)",
+        "p0 postinstall: postinstall now fails loud on genuine failures — the real exit code is propagated instead of being swallowed, so a broken install surfaces immediately instead of silently degrading (rebuild of #561, Codex findings fixed) (#574)"
       ],
       "fixes": [
-        "deploy: the legacy deploy/upgrade.sh now docker-logins the update.askexe.com registry proxy (Basic auth, user token + EXE_REGISTRY_PROXY_PULL_TOKENS) before pulling — closes the one un-authenticated pull path that made manifest-pinned images fail with 401 on that flow (the primary `exe-os stack-update` path already re-auths per pull). Idempotent + guarded; skips cleanly when no proxy token is present (5f94882d) (#500)"
+        "p0 provenance: app-image provenance repo map hardened against spoofing — the imageName→ghRepo mapping is enforced so a cross-named app image cannot masquerade under another repo's provenance (#572)"
       ],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.356": {
-      "version": "0.9.356",
-      "date": "2026-07-27",
+    "0.9.359": {
+      "version": "0.9.359",
+      "date": "2026-07-30",
       "features": [],
       "fixes": [
-        "memory reads no longer throw \"Database client not initialized\" — memory(search)/recall_my_memory/ask_team_memory now guard on a shared ensureReadDbReady() and return an empty result gracefully when the DB adapter is unregistered (daemon down / degraded fastDbInit no-op), instead of crashing (extends the #474 fix to the read paths) (8167b9aa) (#495)",
-        "spawn no longer emits a false \"Coordinator checkout refusal\" for worktree-isolated dispatch — the coordinator-cwd refusal now only fires for an explicit spawn_worktree=false opt-out into the coordinator's live checkout; the main-checkout branch-stomp protection is preserved downstream, so code-role agents can again be dispatched from the coordinator's own repo (7af6e4a1) (#496)"
+        "org-mode: the org-mode-anchor keychain probe no longer risks raising the DESTRUCTIVE macOS 'A keychain cannot be found to store org-mode-anchor' dialog (whose 'Reset To Defaults' button can wipe the login keychain). nativeKeychainAllowed() now skips the native keychain — a best-effort mirror of the authoritative home-anchored file, so nothing is lost — in the daemon (EXE_IS_DAEMON), SSH/remote sessions, and on macOS with no default keychain (probed via a read-only `security default-keychain` that never invokes SecurityAgent). A healthy interactive GUI login is unaffected. Strictly-safer 1-file guard tightening (#514)",
+        "privacy: stop unconsented telemetry + support-content egress (bug 4b8b47fd, P0) (#510)",
+        "internal (dormant — no user-facing change until the org feature is wired): AI-Partner phase-1 infrastructure — B1 org-mode privacy/crypto boundary via a boot-resolved SyncCipher (existing single-user installs keep byte-identical v=1 cloud-sync encryption; the org path stays dormant until an org-membership anchor exists) + partner signing identity + sealed mailbox envelope (#504), and B2 sealed-mailbox relay/transport with cross-tenant SQL-predicate scoping (#505)"
       ],
       "security": [],
       "other": [],

package/src/commands/exe/call.md

@@ -25,10 +25,12 @@ If `TMUX_MISSING`, show this message EXACTLY and STOP — do not launch any empl
    claude
    /exe
 
- Why: exe-os uses tmux for instant cross-session
- communication between employees. Without it,
- task dispatch, parallel execution, and agent
- coordination don't work.
+ Why: parallel work inside a session runs on
+ named subagents — no tmux needed. tmux is what
+ hosts background employees that outlive this
+ session and the instant cross-session messaging
+ between them. Without it, no durable employees
+ and no cross-session coordination.
 
  Install tmux:
    macOS:  brew install tmux

package/src/commands/exe-reference.md

@@ -27,10 +27,12 @@ do not proceed with boot:
  Naming: coordinator session names are user-assigned.
  Employees follow the same suffix: <employee>-<coordinator-session>.
 
- Why: exe-os uses tmux for instant cross-session
- communication between employees. Without it,
- task dispatch, parallel execution, and agent
- coordination don't work.
+ Why: parallel work inside a session runs on
+ named subagents — no tmux needed. tmux is what
+ hosts background employees that outlive this
+ session and the instant cross-session messaging
+ between them. Without it, no durable employees
+ and no cross-session coordination.
 
  Install tmux:
    macOS:  brew install tmux
@@ -50,9 +52,11 @@ Here's how we work together:
 
 **This session is your command center.** We plan, prioritize, review, and decide here.
 
-**When work needs doing:** I create a task and auto-launch the specialist in a
-background tmux session. You don't need to manage sessions — I handle dispatch
-automatically.
+**When work needs doing:** I normally hand it to a named subagent — the
+specialist's identity, working in parallel, reporting back to me. For work that
+has to keep running after this session ends, I create a tracked task and launch
+the specialist in a background tmux session instead. Either way you don't manage
+it — I handle dispatch automatically.
 
 **Quick reference:**
 - `/exe` — this session (me, your COO)

package/src/commands/exe.md

@@ -29,17 +29,8 @@ If `NEEDS_SETUP`: run `/exe-setup` inline, then continue below.
 
 # Coordinator boot
 
-Identity, title, and character come from your identity file (exe.md); this
-command only boots the session.
-
-The founder's right hand. Big picture across all projects — priorities, progress,
-risks, blockers. You don't write code. You coordinate, verify, and make sure the
-right work gets done by the right people.
-
-Character: No bullshit — say what's true, not what sounds good. Precise: numbers,
-timelines, dependencies. Calm foresight — raise concerns with solutions, not just
-warnings. Direct but never offensive. Always learning — use `recall_my_memory` and
-`ask_team_memory` constantly.
+Identity, title, character, and voice come from your identity file (exe.md) —
+this command only boots the session and does not restate them.
 
 ## How you operate
 
@@ -49,12 +40,17 @@ Route by role.
 
 1. **Status / priorities / quick questions** → handle directly. Query memories,
    synthesize across ALL 10-20+ projects.
-2. **Technical work** → `create_task` for the configured CTO (code, architecture,
-   technical audits, debugging, DevOps — NOT marketing copy, slides, social
-   media, design).
-3. **Design / content / marketing** → `create_task` for the configured CMO
-   (content, social media, slide design, brand, SEO/AEO, visual assets — NOT
-   code, architecture, debugging).
+2. **Technical work** → the configured CTO (code, architecture, technical audits,
+   debugging, DevOps — NOT marketing copy, slides, social media, design).
+3. **Design / content / marketing** → the configured CMO (content, social media,
+   slide design, brand, SEO/AEO, visual assets — NOT code, architecture, debugging).
+
+**Dispatch — stop at the lowest rung that fits:** (1) do it yourself; (2) **named
+subagent = the DEFAULT** for delegation and parallelism — `Agent(subagent_type:
+"<employee>")` wears that identity, worktree for code, cap 2-3, persist results
+into the task record + memory before finishing; (3) **`create_task` → tmux =
+LEGACY**, only for work that outlives this session or crosses sessions/projects —
+and then it is the ONLY tmux path, never spawn manually.
 
 `create_task` auto-dispatches — do NOT manually run `exe-dispatch.js` afterward
 (causes double intercoms). Parse the dispatch status from its output:
@@ -69,9 +65,9 @@ and the CMO reads from `exe/output/` where those technical deliverables were lef
 
 ## Task rules
 
-- **Always `create_task`** to assign work. Never modify an employee's in-progress
-  task (race conditions). Scope change / added work? Create a NEW task — the
-  employee auto-chains to it.
+- **When rung 3 is right, `create_task` is the only way to assign it.** Never
+  modify an employee's in-progress task (race conditions). Scope change / added
+  work? Create a NEW task — the employee auto-chains to it.
 - **`close_task`** only when you are acting as reviewer/coordinator finalizing a
   reviewed task — employees report done via `update_task`. `update_task` is low-level —
   status transitions and edge cases only.

package/dist/chunk-HISFWAAK.js

@@ -1,90 +0,0 @@
-import {
-  EXE_AI_DIR
-} from "./chunk-BRIZ6OZ3.js";
-import {
-  enforcePrivateFileSync,
-  ensurePrivateDirSync
-} from "./chunk-HSGBZSCA.js";
-
-// src/lib/daemon-auth.ts
-import crypto from "crypto";
-import path from "path";
-import { existsSync, readFileSync, writeFileSync } from "fs";
-var DAEMON_TOKEN_PATH = path.join(EXE_AI_DIR, "exed.token");
-function normalizeToken(token) {
-  if (!token) return null;
-  const trimmed = token.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function readDaemonToken() {
-  try {
-    if (!existsSync(DAEMON_TOKEN_PATH)) return null;
-    return normalizeToken(readFileSync(DAEMON_TOKEN_PATH, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function ensureDaemonToken(seed) {
-  const existing = readDaemonToken();
-  if (existing) return existing;
-  const token = normalizeToken(seed) ?? crypto.randomBytes(32).toString("hex");
-  ensurePrivateDirSync(EXE_AI_DIR);
-  writeFileSync(DAEMON_TOKEN_PATH, `${token}
-`, "utf8");
-  enforcePrivateFileSync(DAEMON_TOKEN_PATH);
-  return token;
-}
-function isUnclaimedAgentId(agentId) {
-  if (!agentId || agentId === "default") return true;
-  if (/^\$\{[^}]*\}$/.test(agentId)) return true;
-  return false;
-}
-function shouldEnforceSessionIdentity(env = process.env) {
-  const v = (env.EXE_ENFORCE_SESSION_IDENTITY ?? "").trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes" || v === "on";
-}
-function assessInitialBindIdentity(input) {
-  const { agentId, privileged, corroborated, enforce } = input;
-  if (!privileged || corroborated) {
-    return { allow: true, flagged: false, reject: false };
-  }
-  const reason = `header-only privileged identity "${agentId}": the X-Agent-Id header claims a management (chain-of-command) role but no launcher-written session-registry entry corroborates it. ${enforce ? "Rejecting handshake" : "Binding with a warning"} (bug 2138232d).`;
-  return { allow: !enforce, flagged: true, reject: enforce, reason };
-}
-function reconcileSessionAgentIdentity(boundAgentId, claimedAgentId, enforce = false) {
-  const bound = normalizeToken(boundAgentId ?? null);
-  if (!bound) {
-    return {
-      effectiveAgentId: claimedAgentId,
-      impersonationDetected: false,
-      reject: false,
-      claimedAgentId,
-      boundAgentId: claimedAgentId
-    };
-  }
-  if (isUnclaimedAgentId(claimedAgentId) || claimedAgentId === bound) {
-    return {
-      effectiveAgentId: bound,
-      impersonationDetected: false,
-      reject: false,
-      claimedAgentId,
-      boundAgentId: bound
-    };
-  }
-  return {
-    effectiveAgentId: bound,
-    impersonationDetected: true,
-    reject: enforce,
-    claimedAgentId,
-    boundAgentId: bound
-  };
-}
-
-export {
-  DAEMON_TOKEN_PATH,
-  readDaemonToken,
-  ensureDaemonToken,
-  shouldEnforceSessionIdentity,
-  assessInitialBindIdentity,
-  reconcileSessionAgentIdentity
-};

package/dist/daemon-auth-OCHW2U6B.js

@@ -1,20 +0,0 @@
-import {
-  DAEMON_TOKEN_PATH,
-  assessInitialBindIdentity,
-  ensureDaemonToken,
-  readDaemonToken,
-  reconcileSessionAgentIdentity,
-  shouldEnforceSessionIdentity
-} from "./chunk-HISFWAAK.js";
-import "./chunk-BRIZ6OZ3.js";
-import "./chunk-HSGBZSCA.js";
-import "./chunk-JKKZGDLP.js";
-import "./chunk-MLKGABMK.js";
-export {
-  DAEMON_TOKEN_PATH,
-  assessInitialBindIdentity,
-  ensureDaemonToken,
-  readDaemonToken,
-  reconcileSessionAgentIdentity,
-  shouldEnforceSessionIdentity
-};

package/dist/project-name-EWG5KAZP.js

@@ -1,10 +0,0 @@
-import {
-  _resetCache,
-  getProjectName
-} from "./chunk-OPU3NYOO.js";
-import "./chunk-GJV3WDWM.js";
-import "./chunk-MLKGABMK.js";
-export {
-  _resetCache,
-  getProjectName
-};

package/dist/session-summary-5EYI4XW4.js

@@ -1,128 +0,0 @@
-import "./chunk-MLKGABMK.js";
-
-// src/lib/session-summary.ts
-var MAX_CHARS = 800;
-var SECTION_BUDGETS = {
-  activity: 200,
-  tasks: 200,
-  traces: 200,
-  errors: 100,
-  decisions: 100
-};
-var SECTION_PATTERNS = [
-  { key: "activity", re: /^## Recent Activity$/m },
-  { key: "tasks", re: /^## Open \/ Active Tasks$/m },
-  { key: "skip", re: /^## Files Mentioned$/m },
-  { key: "traces", re: /^## Important Recent Traces$/m },
-  { key: "errors", re: /^## Errors \/ Risks$/m },
-  { key: "decisions", re: /^## Decision Candidates$/m },
-  // Extra sections appended by checkpoint-orchestrator (e.g., conversation thread)
-  { key: "skip", re: /^## Session-End Warnings$/m },
-  { key: "skip", re: /^## Conversation Thread/m }
-];
-function extractSections(text) {
-  const matches = [];
-  for (const { key, re } of SECTION_PATTERNS) {
-    const m = re.exec(text);
-    if (m && m.index !== void 0) {
-      matches.push({ key, start: m.index + m[0].length, content: "" });
-    }
-  }
-  matches.sort((a, b) => a.start - b.start);
-  for (let i = 0; i < matches.length; i++) {
-    const m = matches[i];
-    const next = matches[i + 1];
-    const endPos = next ? next.start : text.length;
-    const rawContent = text.slice(m.start, endPos);
-    m.content = rawContent.replace(/\n## [^\n]+$/, "").trim();
-  }
-  const result = /* @__PURE__ */ new Map();
-  for (const m of matches) {
-    if (m.key !== "skip" && m.content.length > 0) {
-      result.set(m.key, m.content);
-    }
-  }
-  return result;
-}
-function truncate(text, maxChars) {
-  if (text.length <= maxChars) return text;
-  const cut = text.lastIndexOf(" ", maxChars);
-  const pos = cut > maxChars * 0.5 ? cut : maxChars;
-  return text.slice(0, pos) + "...";
-}
-function compressBulletSection(content, budget) {
-  const lines = content.split("\n").filter((l) => l.trim().length > 0);
-  const compressed = [];
-  let totalLen = 0;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (/^-\s*Memories scanned:/i.test(trimmed)) continue;
-    const compact = trimmed.replace(/\s+/g, " ").slice(0, 150);
-    if (totalLen + compact.length + 1 > budget) {
-      const remaining = budget - totalLen - 4;
-      if (remaining > 30) {
-        compressed.push(truncate(compact, remaining));
-      }
-      break;
-    }
-    compressed.push(compact);
-    totalLen += compact.length + 1;
-  }
-  return compressed.join("\n");
-}
-function extractHeader(text) {
-  const lines = text.split("\n");
-  const parts = [];
-  for (const line of lines.slice(0, 6)) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith("Project:")) {
-      parts.push(trimmed);
-    } else if (trimmed.startsWith("Time:")) {
-      const timeMatch = /Time:\s*(\d{4}-\d{2}-\d{2}T\d{2}:\d{2})/.exec(trimmed);
-      if (timeMatch) parts.push(`Time: ${timeMatch[1]}`);
-      else parts.push(trimmed);
-    }
-  }
-  return parts.join(" | ");
-}
-function compressCheckpoint(rawText) {
-  if (!rawText || rawText.trim().length === 0) return null;
-  const sections = extractSections(rawText);
-  const header = extractHeader(rawText);
-  const parts = [];
-  if (header) parts.push(header);
-  const activity = sections.get("activity");
-  if (activity) {
-    const compressed = compressBulletSection(activity, SECTION_BUDGETS.activity);
-    if (compressed) parts.push("**Activity:** " + compressed.replace(/^-\s*/gm, "").replace(/\n/g, "; "));
-  }
-  const tasks = sections.get("tasks");
-  if (tasks) {
-    const compressed = compressBulletSection(tasks, SECTION_BUDGETS.tasks);
-    if (compressed) parts.push("**Tasks:** " + compressed);
-  }
-  const traces = sections.get("traces");
-  if (traces) {
-    const compressed = compressBulletSection(traces, SECTION_BUDGETS.traces);
-    if (compressed) parts.push("**Recent:** " + compressed);
-  }
-  const errors = sections.get("errors");
-  if (errors) {
-    const compressed = compressBulletSection(errors, SECTION_BUDGETS.errors);
-    if (compressed) parts.push("**Blockers:** " + compressed);
-  }
-  const decisions = sections.get("decisions");
-  if (decisions) {
-    const compressed = compressBulletSection(decisions, SECTION_BUDGETS.decisions);
-    if (compressed) parts.push("**Decisions:** " + compressed);
-  }
-  if (parts.length === 0) return null;
-  let result = parts.join("\n");
-  if (result.length > MAX_CHARS) {
-    result = result.slice(0, MAX_CHARS - 3) + "...";
-  }
-  return result;
-}
-export {
-  compressCheckpoint
-};