@askexenow/exe-os 0.9.372 → 0.9.374

package/deploy/compose/.env.customer.example

@@ -10,7 +10,12 @@ DOMAIN=CHANGEME_DOMAIN
 # bug 8dc31733: EXE_DB_IMAGE overrides the Postgres image tag in compose.
 # The manifest declares env: "EXE_DB_IMAGE" — keep this in sync with the
 # stack manifest pin. Defaults to pgvector/pgvector:0.8.0-pg16 in compose.
-# EXE_DB_IMAGE=pgvector/pgvector:0.8.0-pg16
+EXE_DB_IMAGE=update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9
+
+# --- Observability ---
+# OTLP collector image. Compose carries no fallback default: a missing pin
+# ABORTS the deploy rather than substituting an old image.
+OTEL_COLLECTOR_IMAGE=update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197
 POSTGRES_USER=exe
 POSTGRES_PASSWORD=CHANGEME_POSTGRES_PASSWORD
 POSTGRES_DB=exedb
@@ -33,7 +38,12 @@ GOTRUE_EXTERNAL_URL=https://auth.CHANGEME_DOMAIN
 # tokens are rejected as iss-mismatch. Keep equal to GOTRUE_EXTERNAL_URL.
 GOTRUE_JWT_ISSUER=https://auth.CHANGEME_DOMAIN
 # SSO redirect allow-list (bug 66f8e10a) — app origins for unified SSO.
-GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN
+# Must list EVERY origin the SPA can redirect back to, including the opt-in
+# dashboard: dashboard-page sends ?redirect=https://dashboard.<domain> through
+# auth, and GoTrue rejects any redirect_to that is not on this list. Kept in
+# lockstep with generate-env.ts and .env.example — a customer who enables the
+# dashboard profile must not have to discover this entry themselves.
+GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN,https://dashboard.CHANGEME_DOMAIN,https://gateway.CHANGEME_DOMAIN
 # Bug 0327b017: parent-domain session cookie → shared across all subdomains.
 GOTRUE_COOKIE_DOMAIN=.CHANGEME_DOMAIN
 GOTRUE_COOKIE_KEY=exe-auth
@@ -48,10 +58,18 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASS=
 
+# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---
+# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`.
+# No default is written here on purpose — the pin comes from the signed stack
+# manifest (services.dashboard.image), so .env stays derived rather than
+# becoming a competing source of truth that outranks it once it goes stale.
+#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...
+#DASHBOARD_PORT=3301
+
 # --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG.
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.5.0
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941
 # Bug 379e5c13: server_name / CORS from the CONFIGURED apex domain, not by naive
 # last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -61,6 +79,23 @@ AUTH_DEFAULT_PRODUCT=AUTH
 # the sign-up UI/route instead of showing a form that always fails.
 AUTH_DISABLE_SIGNUP=true
 
+# --- Session cookie contract (exe-auth v0.6.0) — INFORMATIONAL, not settings ---
+# Recorded here because operators reason about XSS blast radius from this file,
+# and an earlier draft of these notes described the OPPOSITE of what ships.
+# exe-auth performs the GoTrue token exchange server-side in njs and sets:
+#   exe_sess          HttpOnly Secure SameSite=Lax  — the real access token
+#   exe_sess_refresh  HttpOnly Secure SameSite=Lax  — the real refresh token
+#   exe_access_token  JS-readable, value literally "1" — presence sentinel only
+# All three are scoped to the apex (AUTH_COOKIE_DOMAIN) so they are shared
+# across product subdomains.
+#
+# The credentials are HttpOnly ON PURPOSE (security bug 368bf916): page
+# JavaScript CANNOT read them, so an XSS on any subdomain cannot exfiltrate a
+# session token from document.cookie. The only JS-readable cookie is the
+# sentinel, whose value is the constant "1" and is not a credential.
+# Apps must NOT read a token from document.cookie — send credentialed
+# same-site requests and let the HttpOnly cookie ride along.
+
 # --- Centralized role administration (permissions) ---
 # The apps refuse to let an unmanaged first login mint its own admin
 # (exe-crm#102 / exe-wiki#45). Both flags below are therefore left at their
@@ -89,7 +124,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.51
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 # The CRM's first admin — seeded at boot by WorkspaceBootstrapService, which is
@@ -103,7 +138,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.26
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -126,7 +161,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.311
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=CHANGEME_DEVICE_ID
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -136,7 +171,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- ERP (Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.2.2
+ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
 # Administrator password for the ERPNext site (created on first boot).
 # bug 43854b31: this only applies at FIRST boot. To rotate it later you must also
 # run `bench --site $ERP_SITE_NAME set-admin-password <new>` inside exe-erp —
@@ -152,7 +187,7 @@ ERP_WS_PORT=9069
 ERP_SENTRY_DSN=
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v0.9.24
+GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -173,7 +208,7 @@ CRM_GRAPHQL_URL=http://exe-crm:3000/graphql
 # bug 633995f1: v0.9.5 is a QUARANTINED build that crashloops on any existing
 # deployment; v0.9.4 is the last known-good generation and matches the signed
 # apps manifest. See deploy/known-bad-images.json.
-MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v0.9.4
+MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97
 MONITOR_HUB_PORT=8090
 # Bootstrap superuser created on first start. Use your admin email + a strong password.
 # After first boot these values are no longer used (stored in pb_data volume).
@@ -207,7 +242,7 @@ GATEWAY_ALERT_URL=http://exe-gateway:3100/api/alerts/error-spike
 # Full scope details: deploy/monitor/HOST-ACCESS-CONSENT.md
 # COMPOSE_PROFILES=monitor-agent
 # bug 633995f1 / 9ce2a68b: the agent healthcheck is coupled to this generation.
-MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v0.9.4
+MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a
 # Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
 # bug dacf0042: TOKEN and KEY MUST start EMPTY (the safe "unpaired" state) — NOT a

package/deploy/compose/.env.example

@@ -59,7 +59,7 @@ GOTRUE_EXTERNAL_URL=https://auth.CHANGEME_DOMAIN
 # Bug 51086951: JWT issuer pinned to the public auth URL so signer + consumers agree.
 GOTRUE_JWT_ISSUER=https://auth.CHANGEME_DOMAIN
 # SSO redirect allow-list (bug 66f8e10a) — app origins for unified SSO.
-GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN
+GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN,https://dashboard.CHANGEME_DOMAIN,https://gateway.CHANGEME_DOMAIN
 # Bug 0327b017: parent-domain cookie → session shared across all subdomains.
 GOTRUE_COOKIE_DOMAIN=.CHANGEME_DOMAIN
 GOTRUE_COOKIE_KEY=exe-auth
@@ -76,11 +76,26 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASS=
 
+# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---
+# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`
+# and is off unless you run `docker compose --profile dashboard ...`.
+# DELIBERATELY UNSET AND COMMENTED OUT. Unlike the older *_IMAGE_TAG lines
+# above/below, this one carries no hardcoded literal: a pinned default here is
+# a second source of truth that silently outranks the manifest the moment it
+# goes stale. Take the value from the signed stack manifest
+# (deploy/stack-manifests/v0.9.json -> services.dashboard.image), digest and all.
+# Leave it unset and compose refuses the dashboard loudly ("has neither an image
+# nor a build context specified") instead of booting something arbitrary.
+#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...
+# Host port for the dashboard container (bound to 127.0.0.1; the tunnel and the
+# SSO edge reach it over the docker network, not this port).
+#DASHBOARD_PORT=3301
+
 # --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG. exe-auth
 # ships only from the private update.askexe.com registry (no GHCR mirror).
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.5.0
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941
 # Bug 379e5c13: server_name / CORS derived from the CONFIGURED apex domain,
 # not by naive last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -95,6 +110,23 @@ AUTH_DEFAULT_PRODUCT=AUTH
 # the sign-up UI/route instead of showing a form that always fails.
 AUTH_DISABLE_SIGNUP=true
 
+# --- Session cookie contract (exe-auth v0.6.0) — INFORMATIONAL, not settings ---
+# Recorded here because operators reason about XSS blast radius from this file,
+# and an earlier draft of these notes described the OPPOSITE of what ships.
+# exe-auth performs the GoTrue token exchange server-side in njs and sets:
+#   exe_sess          HttpOnly Secure SameSite=Lax  — the real access token
+#   exe_sess_refresh  HttpOnly Secure SameSite=Lax  — the real refresh token
+#   exe_access_token  JS-readable, value literally "1" — presence sentinel only
+# All three are scoped to the apex (AUTH_COOKIE_DOMAIN) so they are shared
+# across product subdomains.
+#
+# The credentials are HttpOnly ON PURPOSE (security bug 368bf916): page
+# JavaScript CANNOT read them, so an XSS on any subdomain cannot exfiltrate a
+# session token from document.cookie. The only JS-readable cookie is the
+# sentinel, whose value is the constant "1" and is not a credential.
+# Apps must NOT read a token from document.cookie — send credentialed
+# same-site requests and let the HttpOnly cookie ride along.
+
 # --- Centralized role administration (permissions) ---
 # The apps refuse to let an unmanaged first login mint its own admin
 # (exe-crm#102 / exe-wiki#45). Both flags below are therefore left at their
@@ -123,7 +155,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.51
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
@@ -136,7 +168,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.26
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -159,7 +191,12 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.311
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
+
+# Infra image pins — manifest-derived. Compose has no fallback default for
+# these: a missing pin ABORTS the deploy instead of substituting an old image.
+EXE_DB_IMAGE=update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9
+OTEL_COLLECTOR_IMAGE=update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=vps-default
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -169,7 +206,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.24
+GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -209,7 +246,7 @@ ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
 
 # --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.2.2
+ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
 ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD
 EXE_ERP_ADMIN_TOKEN=CHANGEME_EXE_ERP_ADMIN_TOKEN
 # Frappe site name — must match the erp.<domain> the customer serves (bug e61ad373).
@@ -231,7 +268,7 @@ EXE_BUILD_HTTP_PORT=9222
 # data dir and entrypoint all changed) and crashloops on any existing
 # deployment. v0.9.4 is the last known-good generation and is what the signed
 # apps manifest pins. See deploy/known-bad-images.json.
-MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.4
+MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97
 MONITOR_HUB_PORT=8090
 # Bootstrap superuser created on first start. Use your admin email + a strong password.
 # After first boot these values are no longer used (stored in pb_data volume).
@@ -251,7 +288,7 @@ MONITOR_HUB_ADMIN_PASSWORD=CHANGEME_MONITOR_HUB_ADMIN_PASSWORD
 # COMPOSE_PROFILES=monitor-agent
 # bug 633995f1 / 9ce2a68b: keep the agent on the v0.9.4 generation — the
 # compose healthcheck (`/app/beszel-agent health`) is coupled to it.
-MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.4
+MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a
 # Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
 # bug dacf0042: TOKEN and KEY MUST start EMPTY (the safe "unpaired" state) —

package/deploy/compose/docker-compose.yml

@@ -29,7 +29,7 @@ services:
     # bug ee16e7ef: pin a versioned tag, not the mutable :pg16 rolling tag.
     # pgvector/pgvector:pg16 can change upstream without notice; 0.8.0-pg16
     # is the tested stable release. Override via EXE_DB_IMAGE in .env.
-    image: ${EXE_DB_IMAGE:-pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9}
+    image: ${EXE_DB_IMAGE:?EXE_DB_IMAGE must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-db
     restart: unless-stopped
     # SECURITY (bug 67d62490): no blanket `env_file: .env`. Each service
@@ -176,6 +176,17 @@ services:
       GOTRUE_API_PORT: ${GOTRUE_API_PORT:-9999}
       GOTRUE_DB_DRIVER: postgres
       GOTRUE_DB_DATABASE_URL: postgres://${POSTGRES_USER:-exe}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@exe-db:5432/${POSTGRES_DB:-exedb}?sslmode=disable&search_path=auth
+      # Bug 5c3023a2: GoTrue's DB pool kept connections forever (Go database/sql
+      # ConnMaxLifetime defaults to 0). When exe-db (Postgres) restarts during a
+      # deploy, GoTrue reused a dead pooled socket for the next `error finding
+      # user` query → "write tcp ... broken pipe" → random 500 on /token
+      # (founder-visible sign-in failure). exe-db sets NO finite server-side idle
+      # timeout, so these bounds sit well below Postgres's ceiling and below any
+      # network idle reap: recycle every connection within 5m and drop an idle
+      # one after 60s, so a connection killed by a restart is retired, not reused.
+      GOTRUE_DB_MAX_POOL_SIZE: ${GOTRUE_DB_MAX_POOL_SIZE:-10}
+      GOTRUE_DB_CONN_MAX_LIFETIME: ${GOTRUE_DB_CONN_MAX_LIFETIME:-300s}
+      GOTRUE_DB_CONN_MAX_IDLE_TIME: ${GOTRUE_DB_CONN_MAX_IDLE_TIME:-60s}
       # Bug ae113b23: never fall back to a hardcoded domain here.
       # GOTRUE_SITE_URL must be set in .env by generate-env.ts. An empty/missing
       # value is intentionally rejected at runtime so misconfigured stacks fail
@@ -267,7 +278,7 @@ services:
     # is what the signed apps manifest (deploy/stack-manifests/v0.9.30-apps.json)
     # and exe-monitor's own stack.release.json pin. Do not reintroduce the bad
     # digest.
-    image: ${MONITOR_HUB_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-hub:v0.9.4@sha256:d593bec5a4b248388d0d85353fae1ba8f93cab628a03833aa79acd0632fd11cb}
+    image: ${MONITOR_HUB_IMAGE_TAG:?MONITOR_HUB_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-monitor-hub
     restart: unless-stopped
     # bug d3d49101 / 1fdb8be9: PocketBase's data dir for this hub is a RELATIVE
@@ -319,7 +330,11 @@ services:
       # the live exe-db-jkt container (image v0.9.4): /app/beszel exists,
       # /beszel does not → the old `/beszel` healthcheck failed on every probe
       # (permanent false-unhealthy). Match the image's own HEALTHCHECK path.
-      test: ["CMD", "/app/beszel", "health", "--url", "http://127.0.0.1:8090"]
+      # bug f9fc272b: the healthcheck binary is coupled to the image generation.
+      # stack-update writes MONITOR_HUB_HEALTH_BIN from the pinned manifest image
+      # so the probe follows the deployed generation; the default matches the
+      # v0.9.4 compose-default image.
+      test: ["CMD", "${MONITOR_HUB_HEALTH_BIN:-/app/beszel}", "health", "--url", "http://127.0.0.1:8090"]
       interval: 30s
       timeout: 5s
       start_period: 15s
@@ -345,7 +360,7 @@ services:
   # ------------------------------------------------------------------
 
   exe-crm:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.51@sha256:73864ce14aaac06b73d67100bbf88e669fd13c7da39edd9644107037211559b7}
+    image: ${CRM_IMAGE_TAG:?CRM_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-crm
     restart: unless-stopped
     # bug ad4471ad: NO compose `command` override. The image entrypoint
@@ -471,7 +486,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-crm-worker:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.51@sha256:73864ce14aaac06b73d67100bbf88e669fd13c7da39edd9644107037211559b7}
+    image: ${CRM_IMAGE_TAG:?CRM_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-crm-worker
     restart: unless-stopped
     command: ["yarn", "worker:prod"]
@@ -537,7 +552,7 @@ services:
   # erroring, so "wiki looks wiped" and "wiki is misconfigured" are indistinguishable
   # at a glance, and the wrong diagnosis (restore from backup) destroys real data.
   exe-wiki-schema-guard:
-    image: ${EXE_DB_IMAGE:-pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9}
+    image: ${EXE_DB_IMAGE:?EXE_DB_IMAGE must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-wiki-schema-guard
     restart: "no"
     depends_on:
@@ -573,7 +588,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-wiki:
-    image: ${WIKI_IMAGE_TAG:-ghcr.io/askexe/exe-wiki:v0.9.26@sha256:c0d61d183b274a67977fdfb1b40d5e4736559a9d90507843183e5642da2a959d}
+    image: ${WIKI_IMAGE_TAG:?WIKI_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-wiki
     restart: unless-stopped
     # Wiki uses Prisma — runs migrate on boot via built-in entrypoint.
@@ -713,7 +728,15 @@ services:
   # to pin the split server image; falls back to the combined EXE_OS_IMAGE_TAG
   # for backward compatibility with existing manifests.
   exe-os:
-    image: ${EXE_OS_SERVER_IMAGE_TAG:-${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.311@sha256:011730042f55277724dbe83fde1a6416db2f3e8bf62d3254738d68d8de33e1f9}}}
+    # FAIL-CLOSED PIN. The signed stack manifest is the single source of truth for
+    # this image; stack-update writes EXE_OS_IMAGE_TAG from it. The legacy aliases are
+    # kept so an older .env keeps working, and the chain terminates EMPTY on purpose:
+    # docker compose evaluates nested defaults eagerly, so `:?` inside a chain would
+    # fire even when an alias IS set. With no pin at all compose aborts with
+    # "has neither an image nor a build context specified" — loud, not a silent
+    # substitution of a stale hard-coded version (which is how auth nearly shipped a
+    # four-minor-version downgrade).
+    image: ${EXE_OS_SERVER_IMAGE_TAG:-${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-}}}
     container_name: exe-os
     restart: unless-stopped
     # bug debf4a39 / 93ddfa27: the daemon connects to exe-db at boot
@@ -832,7 +855,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-gateway:
-    image: ${GATEWAY_IMAGE_TAG:-ghcr.io/askexe/exe-gateway:v0.9.24@sha256:9cda7c00d886b4ab16a3b88aa953aa45c991f2977084ea8532f55fcaf75e8f37}
+    image: ${GATEWAY_IMAGE_TAG:?GATEWAY_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-gateway
     restart: unless-stopped
     # Gateway needs 45s to flush outbound queues + disconnect Baileys adapters.
@@ -879,6 +902,16 @@ services:
       # with (pinned on the gotrue service), NOT the internal GOTRUE_URL above, so
       # the gateway accepts real browser SSO tokens. Same public value, one default.
       GOTRUE_JWT_ISSUER: ${GOTRUE_JWT_ISSUER:-${GOTRUE_EXTERNAL_URL:?GOTRUE_EXTERNAL_URL is required — set to https://auth.<your-domain> in .env}}
+      # Bug 550d6ab7, third occurrence of the same defect (after exe-wiki
+      # 0c0d5187 and exe-crm). The gateway verifies GoTrue tokens IN-PROCESS:
+      # src/gotrue-auth.ts verifyGoTrueJWT reads the JWKS first and, because our
+      # GoTrue signs symmetrically and therefore publishes `{"keys":[]}` by
+      # design, falls back to getSymmetricKey() — which returns null unless
+      # GOTRUE_JWT_SECRET is in this container's environment. Without this line
+      # the fallback that makes gateway SSO possible at all is unsatisfiable in
+      # the stack customers actually run, and every token is rejected by a
+      # silent `return null`. Fail loud rather than boot with no key material.
+      GOTRUE_JWT_SECRET: ${GOTRUE_JWT_SECRET:?GOTRUE_JWT_SECRET is required}
       EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN: ${EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN:?EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN is required}
       EXE_GATEWAY_WS_RELAY_ENABLED: "true"
       EXE_GATEWAY_WS_RELAY_HOST: "0.0.0.0"
@@ -986,7 +1019,7 @@ services:
     # v0.9.5 default contradicted that healthcheck, so the agent was
     # permanently unhealthy from the first recreate. Matches the signed apps
     # manifest and exe-monitor's stack.release.json.
-    image: ${MONITOR_AGENT_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-agent:v0.9.4@sha256:9ca4e75577b2ff2abb754140ccfaf8df19161bcef601faf37d1fce743fe814fc}
+    image: ${MONITOR_AGENT_IMAGE_TAG:?MONITOR_AGENT_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-monitor-agent
     # Host-access consent gate: only starts when the operator has
     # acknowledged the host-access scope (COMPOSE_PROFILES=monitor-agent).
@@ -1060,7 +1093,11 @@ services:
       # The binary-native `health` subcommand checks the freshness of the
       # agent's health file, which only stays fresh while it is actively
       # reporting to the hub.
-      test: ["CMD", "/app/beszel-agent", "health"]
+      # bug f9fc272b: the healthcheck binary is coupled to the image generation.
+      # stack-update writes MONITOR_AGENT_HEALTH_BIN from the pinned manifest image
+      # so the probe follows the deployed generation; the default matches the
+      # v0.9.4 compose-default image.
+      test: ["CMD", "${MONITOR_AGENT_HEALTH_BIN:-/app/beszel-agent}", "health"]
       interval: 30s
       timeout: 5s
       start_period: 30s
@@ -1087,7 +1124,15 @@ services:
   # Without a token the binary exits 0 (no crash-loop). (bug 3416cead)
   # ------------------------------------------------------------------
   exe-update:
-    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.311@sha256:011730042f55277724dbe83fde1a6416db2f3e8bf62d3254738d68d8de33e1f9}}
+    # FAIL-CLOSED PIN. The signed stack manifest is the single source of truth for
+    # this image; stack-update writes EXE_OS_IMAGE_TAG from it. The legacy aliases are
+    # kept so an older .env keeps working, and the chain terminates EMPTY on purpose:
+    # docker compose evaluates nested defaults eagerly, so `:?` inside a chain would
+    # fire even when an alias IS set. With no pin at all compose aborts with
+    # "has neither an image nor a build context specified" — loud, not a silent
+    # substitution of a stale hard-coded version (which is how auth nearly shipped a
+    # four-minor-version downgrade).
+    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-}}
     container_name: exe-update
     profiles: ["registry-proxy", "askexe-control-plane"]
     restart: unless-stopped
@@ -1296,7 +1341,7 @@ services:
   # 4 services: gunicorn API, websocket, RQ worker, scheduler.
 
   exe-erp:
-    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.2@sha256:00fecc790ff848bfd4b7d87f42f859edfeb6090a7ca26bf2359dc6cb96767afb}
+    image: ${ERP_IMAGE_TAG:?ERP_IMAGE_TAG must be set by stack-update (the digest-pinned ERP image from the signed manifest) — refusing to fall back to an untested image}
     container_name: exe-erp
     restart: unless-stopped
     entrypoint: ["/usr/local/bin/entrypoint.sh"]
@@ -1437,7 +1482,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-erp-websocket:
-    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.2@sha256:00fecc790ff848bfd4b7d87f42f859edfeb6090a7ca26bf2359dc6cb96767afb}
+    image: ${ERP_IMAGE_TAG:?ERP_IMAGE_TAG must be set by stack-update (the digest-pinned ERP image from the signed manifest) — refusing to fall back to an untested image}
     container_name: exe-erp-websocket
     restart: unless-stopped
     entrypoint: []
@@ -1499,7 +1544,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-erp-queue:
-    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.2@sha256:00fecc790ff848bfd4b7d87f42f859edfeb6090a7ca26bf2359dc6cb96767afb}
+    image: ${ERP_IMAGE_TAG:?ERP_IMAGE_TAG must be set by stack-update (the digest-pinned ERP image from the signed manifest) — refusing to fall back to an untested image}
     container_name: exe-erp-queue
     restart: unless-stopped
     entrypoint: []
@@ -1579,7 +1624,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-erp-scheduler:
-    image: ${ERP_IMAGE_TAG:-ghcr.io/askexe/exe-erp:v0.2.2@sha256:00fecc790ff848bfd4b7d87f42f859edfeb6090a7ca26bf2359dc6cb96767afb}
+    image: ${ERP_IMAGE_TAG:?ERP_IMAGE_TAG must be set by stack-update (the digest-pinned ERP image from the signed manifest) — refusing to fall back to an untested image}
     container_name: exe-erp-scheduler
     restart: unless-stopped
     entrypoint: []
@@ -1646,7 +1691,7 @@ services:
   exe-otel-collector:
     # bug 32d6e02f: digest-pinned default (was tag-only) — matches the
     # stack manifest pin for otel/opentelemetry-collector-contrib:0.114.0.
-    image: ${OTEL_COLLECTOR_IMAGE:-otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197}
+    image: ${OTEL_COLLECTOR_IMAGE:?OTEL_COLLECTOR_IMAGE must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-otel-collector
     restart: unless-stopped
     command: ["--config=/etc/otelcol-contrib/config.yaml"]
@@ -1714,7 +1759,7 @@ services:
     # a fresh/migrated install boots an old image while the manifest reads "latest".
     # generate-env.ts now always writes AUTH_IMAGE_TAG, and this default mirrors the
     # pin as defense-in-depth — keep BOTH in lockstep on every auth release.
-    image: ${AUTH_IMAGE_TAG:-update.askexe.com/askexe/exe-auth:v0.5.0@sha256:ecc57f92b1f2c2d9df4fafe648622fe1fdd87c27012048d950e3f6b82086ccf9}
+    image: ${AUTH_IMAGE_TAG:?AUTH_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-auth
     restart: unless-stopped
     environment:
@@ -1784,6 +1829,79 @@ services:
       driver: json-file
       options: { max-size: "10m", max-file: "3" }
 
+  # ------------------------------------------------------------------
+  # Dashboard — customer dashboard at dashboard.yourdomain.com
+  # Static nginx image built from dashboard-page/ in the exe-os repo.
+  # ------------------------------------------------------------------
+  #
+  # WHY THIS IS HERE AT ALL (2026-08-20). exe-dashboard has been running in
+  # production for months WITHOUT a service in this file. Its only compose
+  # definition was dashboard-page/docker-compose.yml — a standalone side-car
+  # that carried `build: .` and a hardcoded `image: …:v0.1.0`, joined the
+  # external `exe-net` network, and answered the `upstream sso_dashboard`
+  # in sso-edge/default.conf.template. Nothing in the stack manifest could pin
+  # a service the stack compose did not define, which is exactly why the
+  # dashboard drifted three builds behind main with nobody able to see it.
+  # This entry makes it a first-class, manifest-governed stack service.
+  #
+  # OPT-IN VIA PROFILE. `profiles: ["dashboard"]` keeps this off for every
+  # existing deployment that has not opted in. That is deliberate and it is why
+  # the image pin uses the empty-default form and NOT the required-variable
+  # (colon-question-mark) form: compose interpolates the WHOLE file before it
+  # filters by profile (verified on Docker 28.5.1 — a required-variable
+  # reference inside an INACTIVE profile still aborts `docker compose config`),
+  # so that form here would break every customer who never asked for the
+  # dashboard. The empty terminator gets the same fail-loud
+  # behaviour exactly where it belongs: with the profile ACTIVE and the variable
+  # unset, compose refuses with `service "exe-dashboard" has neither an image nor
+  # a build context specified` instead of silently substituting a stale literal.
+  exe-dashboard:
+    image: ${DASHBOARD_IMAGE_TAG:-}
+    profiles: ["dashboard"]
+    container_name: exe-dashboard
+    restart: unless-stopped
+    environment:
+      # Customer apex domain — templates server_name, CSP and the SPA's API/auth
+      # URLs at container start via dashboard-page/docker-entrypoint.sh. Never
+      # falls back to askexe.com.
+      DOMAIN: ${DOMAIN:?DOMAIN is required — set to your customer apex domain (e.g. hygo.co)}
+      # Optional explicit overrides; each defaults to the matching *.${DOMAIN}.
+      DASH_DOMAIN: ${DASH_DOMAIN:-}
+      DASH_API_URL: ${DASH_API_URL:-}
+      DASH_AUTH_URL: ${DASH_AUTH_URL:-}
+      DASH_DASHBOARD_URL: ${DASH_DASHBOARD_URL:-}
+    ports:
+      - "127.0.0.1:${DASHBOARD_PORT:-3301}:80"
+    networks:
+      # `backend` so exe-sso-edge can resolve `exe-dashboard` for its
+      # `upstream sso_dashboard { server exe-dashboard:80; }`; `frontend` so the
+      # cloudflared tunnel can reach it. Same pair as exe-auth/exe-crm/exe-wiki.
+      #
+      # NOTE: exe-sso-edge deliberately does NOT list this service in its
+      # depends_on. The edge must keep starting on deployments that never enable
+      # the dashboard profile, and a depends_on would make the edge unstartable
+      # for them.
+      - backend
+      - frontend
+    healthcheck:
+      # dashboard-page/nginx.conf serves `location = /health` as a literal 200.
+      # This is the same URL the stack manifest's healthUrl names, so the deploy
+      # gate and the container agree on what "up" means. Before this existed,
+      # /health fell through to the SPA `location /` and returned the index page
+      # with a 200 — a probe that could not fail while nginx was running at all.
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1/health"]
+      interval: 30s
+      timeout: 5s
+      start_period: 5s
+      retries: 3
+    deploy:
+      resources:
+        limits:
+          memory: 128M
+    logging:
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+
 # ------------------------------------------------------------------
 # Volumes
 # ------------------------------------------------------------------