@askexenow/exe-os 0.9.373 → 0.9.374

package/deploy/compose/.env.customer.example

@@ -10,7 +10,12 @@ DOMAIN=CHANGEME_DOMAIN
 # bug 8dc31733: EXE_DB_IMAGE overrides the Postgres image tag in compose.
 # The manifest declares env: "EXE_DB_IMAGE" — keep this in sync with the
 # stack manifest pin. Defaults to pgvector/pgvector:0.8.0-pg16 in compose.
-# EXE_DB_IMAGE=pgvector/pgvector:0.8.0-pg16
+EXE_DB_IMAGE=update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9
+
+# --- Observability ---
+# OTLP collector image. Compose carries no fallback default: a missing pin
+# ABORTS the deploy rather than substituting an old image.
+OTEL_COLLECTOR_IMAGE=update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197
 POSTGRES_USER=exe
 POSTGRES_PASSWORD=CHANGEME_POSTGRES_PASSWORD
 POSTGRES_DB=exedb
@@ -33,7 +38,12 @@ GOTRUE_EXTERNAL_URL=https://auth.CHANGEME_DOMAIN
 # tokens are rejected as iss-mismatch. Keep equal to GOTRUE_EXTERNAL_URL.
 GOTRUE_JWT_ISSUER=https://auth.CHANGEME_DOMAIN
 # SSO redirect allow-list (bug 66f8e10a) — app origins for unified SSO.
-GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN
+# Must list EVERY origin the SPA can redirect back to, including the opt-in
+# dashboard: dashboard-page sends ?redirect=https://dashboard.<domain> through
+# auth, and GoTrue rejects any redirect_to that is not on this list. Kept in
+# lockstep with generate-env.ts and .env.example — a customer who enables the
+# dashboard profile must not have to discover this entry themselves.
+GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN,https://dashboard.CHANGEME_DOMAIN,https://gateway.CHANGEME_DOMAIN
 # Bug 0327b017: parent-domain session cookie → shared across all subdomains.
 GOTRUE_COOKIE_DOMAIN=.CHANGEME_DOMAIN
 GOTRUE_COOKIE_KEY=exe-auth
@@ -48,10 +58,18 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASS=
 
+# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---
+# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`.
+# No default is written here on purpose — the pin comes from the signed stack
+# manifest (services.dashboard.image), so .env stays derived rather than
+# becoming a competing source of truth that outranks it once it goes stale.
+#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...
+#DASHBOARD_PORT=3301
+
 # --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG.
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.5.0
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941
 # Bug 379e5c13: server_name / CORS from the CONFIGURED apex domain, not by naive
 # last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -106,7 +124,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.51
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 # The CRM's first admin — seeded at boot by WorkspaceBootstrapService, which is
@@ -120,7 +138,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.26
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -143,7 +161,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.311
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=CHANGEME_DEVICE_ID
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -153,7 +171,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- ERP (Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.2.2
+ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
 # Administrator password for the ERPNext site (created on first boot).
 # bug 43854b31: this only applies at FIRST boot. To rotate it later you must also
 # run `bench --site $ERP_SITE_NAME set-admin-password <new>` inside exe-erp —
@@ -169,7 +187,7 @@ ERP_WS_PORT=9069
 ERP_SENTRY_DSN=
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v0.9.24
+GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -190,7 +208,7 @@ CRM_GRAPHQL_URL=http://exe-crm:3000/graphql
 # bug 633995f1: v0.9.5 is a QUARANTINED build that crashloops on any existing
 # deployment; v0.9.4 is the last known-good generation and matches the signed
 # apps manifest. See deploy/known-bad-images.json.
-MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v0.9.4
+MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97
 MONITOR_HUB_PORT=8090
 # Bootstrap superuser created on first start. Use your admin email + a strong password.
 # After first boot these values are no longer used (stored in pb_data volume).
@@ -224,7 +242,7 @@ GATEWAY_ALERT_URL=http://exe-gateway:3100/api/alerts/error-spike
 # Full scope details: deploy/monitor/HOST-ACCESS-CONSENT.md
 # COMPOSE_PROFILES=monitor-agent
 # bug 633995f1 / 9ce2a68b: the agent healthcheck is coupled to this generation.
-MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v0.9.4
+MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a
 # Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
 # bug dacf0042: TOKEN and KEY MUST start EMPTY (the safe "unpaired" state) — NOT a

package/deploy/compose/.env.example

@@ -76,11 +76,26 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASS=
 
+# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---
+# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`
+# and is off unless you run `docker compose --profile dashboard ...`.
+# DELIBERATELY UNSET AND COMMENTED OUT. Unlike the older *_IMAGE_TAG lines
+# above/below, this one carries no hardcoded literal: a pinned default here is
+# a second source of truth that silently outranks the manifest the moment it
+# goes stale. Take the value from the signed stack manifest
+# (deploy/stack-manifests/v0.9.json -> services.dashboard.image), digest and all.
+# Leave it unset and compose refuses the dashboard loudly ("has neither an image
+# nor a build context specified") instead of booting something arbitrary.
+#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...
+# Host port for the dashboard container (bound to 127.0.0.1; the tunnel and the
+# SSO edge reach it over the docker network, not this port).
+#DASHBOARD_PORT=3301
+
 # --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG. exe-auth
 # ships only from the private update.askexe.com registry (no GHCR mirror).
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.5.0
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941
 # Bug 379e5c13: server_name / CORS derived from the CONFIGURED apex domain,
 # not by naive last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -140,7 +155,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.51
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
@@ -153,7 +168,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.26
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -176,7 +191,12 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.311
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
+
+# Infra image pins — manifest-derived. Compose has no fallback default for
+# these: a missing pin ABORTS the deploy instead of substituting an old image.
+EXE_DB_IMAGE=update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9
+OTEL_COLLECTOR_IMAGE=update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=vps-default
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -186,7 +206,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.24
+GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
@@ -226,7 +246,7 @@ ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
 
 # --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.2.2
+ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
 ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD
 EXE_ERP_ADMIN_TOKEN=CHANGEME_EXE_ERP_ADMIN_TOKEN
 # Frappe site name — must match the erp.<domain> the customer serves (bug e61ad373).
@@ -248,7 +268,7 @@ EXE_BUILD_HTTP_PORT=9222
 # data dir and entrypoint all changed) and crashloops on any existing
 # deployment. v0.9.4 is the last known-good generation and is what the signed
 # apps manifest pins. See deploy/known-bad-images.json.
-MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.4
+MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97
 MONITOR_HUB_PORT=8090
 # Bootstrap superuser created on first start. Use your admin email + a strong password.
 # After first boot these values are no longer used (stored in pb_data volume).
@@ -268,7 +288,7 @@ MONITOR_HUB_ADMIN_PASSWORD=CHANGEME_MONITOR_HUB_ADMIN_PASSWORD
 # COMPOSE_PROFILES=monitor-agent
 # bug 633995f1 / 9ce2a68b: keep the agent on the v0.9.4 generation — the
 # compose healthcheck (`/app/beszel-agent health`) is coupled to it.
-MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.4
+MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a
 # Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
 # bug dacf0042: TOKEN and KEY MUST start EMPTY (the safe "unpaired" state) —

package/deploy/compose/docker-compose.yml

@@ -29,7 +29,7 @@ services:
     # bug ee16e7ef: pin a versioned tag, not the mutable :pg16 rolling tag.
     # pgvector/pgvector:pg16 can change upstream without notice; 0.8.0-pg16
     # is the tested stable release. Override via EXE_DB_IMAGE in .env.
-    image: ${EXE_DB_IMAGE:-pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9}
+    image: ${EXE_DB_IMAGE:?EXE_DB_IMAGE must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-db
     restart: unless-stopped
     # SECURITY (bug 67d62490): no blanket `env_file: .env`. Each service
@@ -278,7 +278,7 @@ services:
     # is what the signed apps manifest (deploy/stack-manifests/v0.9.30-apps.json)
     # and exe-monitor's own stack.release.json pin. Do not reintroduce the bad
     # digest.
-    image: ${MONITOR_HUB_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-hub:v0.9.4@sha256:d593bec5a4b248388d0d85353fae1ba8f93cab628a03833aa79acd0632fd11cb}
+    image: ${MONITOR_HUB_IMAGE_TAG:?MONITOR_HUB_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-monitor-hub
     restart: unless-stopped
     # bug d3d49101 / 1fdb8be9: PocketBase's data dir for this hub is a RELATIVE
@@ -360,7 +360,7 @@ services:
   # ------------------------------------------------------------------
 
   exe-crm:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.51@sha256:73864ce14aaac06b73d67100bbf88e669fd13c7da39edd9644107037211559b7}
+    image: ${CRM_IMAGE_TAG:?CRM_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-crm
     restart: unless-stopped
     # bug ad4471ad: NO compose `command` override. The image entrypoint
@@ -486,7 +486,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-crm-worker:
-    image: ${CRM_IMAGE_TAG:-ghcr.io/askexe/exe-crm:v0.9.51@sha256:73864ce14aaac06b73d67100bbf88e669fd13c7da39edd9644107037211559b7}
+    image: ${CRM_IMAGE_TAG:?CRM_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-crm-worker
     restart: unless-stopped
     command: ["yarn", "worker:prod"]
@@ -552,7 +552,7 @@ services:
   # erroring, so "wiki looks wiped" and "wiki is misconfigured" are indistinguishable
   # at a glance, and the wrong diagnosis (restore from backup) destroys real data.
   exe-wiki-schema-guard:
-    image: ${EXE_DB_IMAGE:-pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9}
+    image: ${EXE_DB_IMAGE:?EXE_DB_IMAGE must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-wiki-schema-guard
     restart: "no"
     depends_on:
@@ -588,7 +588,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-wiki:
-    image: ${WIKI_IMAGE_TAG:-ghcr.io/askexe/exe-wiki:v0.9.26@sha256:c0d61d183b274a67977fdfb1b40d5e4736559a9d90507843183e5642da2a959d}
+    image: ${WIKI_IMAGE_TAG:?WIKI_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-wiki
     restart: unless-stopped
     # Wiki uses Prisma — runs migrate on boot via built-in entrypoint.
@@ -728,7 +728,15 @@ services:
   # to pin the split server image; falls back to the combined EXE_OS_IMAGE_TAG
   # for backward compatibility with existing manifests.
   exe-os:
-    image: ${EXE_OS_SERVER_IMAGE_TAG:-${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.311@sha256:011730042f55277724dbe83fde1a6416db2f3e8bf62d3254738d68d8de33e1f9}}}
+    # FAIL-CLOSED PIN. The signed stack manifest is the single source of truth for
+    # this image; stack-update writes EXE_OS_IMAGE_TAG from it. The legacy aliases are
+    # kept so an older .env keeps working, and the chain terminates EMPTY on purpose:
+    # docker compose evaluates nested defaults eagerly, so `:?` inside a chain would
+    # fire even when an alias IS set. With no pin at all compose aborts with
+    # "has neither an image nor a build context specified" — loud, not a silent
+    # substitution of a stale hard-coded version (which is how auth nearly shipped a
+    # four-minor-version downgrade).
+    image: ${EXE_OS_SERVER_IMAGE_TAG:-${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-}}}
     container_name: exe-os
     restart: unless-stopped
     # bug debf4a39 / 93ddfa27: the daemon connects to exe-db at boot
@@ -847,7 +855,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exe-gateway:
-    image: ${GATEWAY_IMAGE_TAG:-ghcr.io/askexe/exe-gateway:v0.9.24@sha256:9cda7c00d886b4ab16a3b88aa953aa45c991f2977084ea8532f55fcaf75e8f37}
+    image: ${GATEWAY_IMAGE_TAG:?GATEWAY_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-gateway
     restart: unless-stopped
     # Gateway needs 45s to flush outbound queues + disconnect Baileys adapters.
@@ -1011,7 +1019,7 @@ services:
     # v0.9.5 default contradicted that healthcheck, so the agent was
     # permanently unhealthy from the first recreate. Matches the signed apps
     # manifest and exe-monitor's stack.release.json.
-    image: ${MONITOR_AGENT_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-agent:v0.9.4@sha256:9ca4e75577b2ff2abb754140ccfaf8df19161bcef601faf37d1fce743fe814fc}
+    image: ${MONITOR_AGENT_IMAGE_TAG:?MONITOR_AGENT_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-monitor-agent
     # Host-access consent gate: only starts when the operator has
     # acknowledged the host-access scope (COMPOSE_PROFILES=monitor-agent).
@@ -1116,7 +1124,15 @@ services:
   # Without a token the binary exits 0 (no crash-loop). (bug 3416cead)
   # ------------------------------------------------------------------
   exe-update:
-    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-ghcr.io/askexe/exe-os:v0.9.311@sha256:011730042f55277724dbe83fde1a6416db2f3e8bf62d3254738d68d8de33e1f9}}
+    # FAIL-CLOSED PIN. The signed stack manifest is the single source of truth for
+    # this image; stack-update writes EXE_OS_IMAGE_TAG from it. The legacy aliases are
+    # kept so an older .env keeps working, and the chain terminates EMPTY on purpose:
+    # docker compose evaluates nested defaults eagerly, so `:?` inside a chain would
+    # fire even when an alias IS set. With no pin at all compose aborts with
+    # "has neither an image nor a build context specified" — loud, not a silent
+    # substitution of a stale hard-coded version (which is how auth nearly shipped a
+    # four-minor-version downgrade).
+    image: ${EXE_OS_IMAGE_TAG:-${EXED_IMAGE_TAG:-}}
     container_name: exe-update
     profiles: ["registry-proxy", "askexe-control-plane"]
     restart: unless-stopped
@@ -1675,7 +1691,7 @@ services:
   exe-otel-collector:
     # bug 32d6e02f: digest-pinned default (was tag-only) — matches the
     # stack manifest pin for otel/opentelemetry-collector-contrib:0.114.0.
-    image: ${OTEL_COLLECTOR_IMAGE:-otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197}
+    image: ${OTEL_COLLECTOR_IMAGE:?OTEL_COLLECTOR_IMAGE must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-otel-collector
     restart: unless-stopped
     command: ["--config=/etc/otelcol-contrib/config.yaml"]
@@ -1743,7 +1759,7 @@ services:
     # a fresh/migrated install boots an old image while the manifest reads "latest".
     # generate-env.ts now always writes AUTH_IMAGE_TAG, and this default mirrors the
     # pin as defense-in-depth — keep BOTH in lockstep on every auth release.
-    image: ${AUTH_IMAGE_TAG:-update.askexe.com/askexe/exe-auth:v0.5.0@sha256:ecc57f92b1f2c2d9df4fafe648622fe1fdd87c27012048d950e3f6b82086ccf9}
+    image: ${AUTH_IMAGE_TAG:?AUTH_IMAGE_TAG must be set from the signed stack manifest (digest-pinned) — refusing to fall back to a stale hard-coded image}
     container_name: exe-auth
     restart: unless-stopped
     environment:
@@ -1813,6 +1829,79 @@ services:
       driver: json-file
       options: { max-size: "10m", max-file: "3" }
 
+  # ------------------------------------------------------------------
+  # Dashboard — customer dashboard at dashboard.yourdomain.com
+  # Static nginx image built from dashboard-page/ in the exe-os repo.
+  # ------------------------------------------------------------------
+  #
+  # WHY THIS IS HERE AT ALL (2026-08-20). exe-dashboard has been running in
+  # production for months WITHOUT a service in this file. Its only compose
+  # definition was dashboard-page/docker-compose.yml — a standalone side-car
+  # that carried `build: .` and a hardcoded `image: …:v0.1.0`, joined the
+  # external `exe-net` network, and answered the `upstream sso_dashboard`
+  # in sso-edge/default.conf.template. Nothing in the stack manifest could pin
+  # a service the stack compose did not define, which is exactly why the
+  # dashboard drifted three builds behind main with nobody able to see it.
+  # This entry makes it a first-class, manifest-governed stack service.
+  #
+  # OPT-IN VIA PROFILE. `profiles: ["dashboard"]` keeps this off for every
+  # existing deployment that has not opted in. That is deliberate and it is why
+  # the image pin uses the empty-default form and NOT the required-variable
+  # (colon-question-mark) form: compose interpolates the WHOLE file before it
+  # filters by profile (verified on Docker 28.5.1 — a required-variable
+  # reference inside an INACTIVE profile still aborts `docker compose config`),
+  # so that form here would break every customer who never asked for the
+  # dashboard. The empty terminator gets the same fail-loud
+  # behaviour exactly where it belongs: with the profile ACTIVE and the variable
+  # unset, compose refuses with `service "exe-dashboard" has neither an image nor
+  # a build context specified` instead of silently substituting a stale literal.
+  exe-dashboard:
+    image: ${DASHBOARD_IMAGE_TAG:-}
+    profiles: ["dashboard"]
+    container_name: exe-dashboard
+    restart: unless-stopped
+    environment:
+      # Customer apex domain — templates server_name, CSP and the SPA's API/auth
+      # URLs at container start via dashboard-page/docker-entrypoint.sh. Never
+      # falls back to askexe.com.
+      DOMAIN: ${DOMAIN:?DOMAIN is required — set to your customer apex domain (e.g. hygo.co)}
+      # Optional explicit overrides; each defaults to the matching *.${DOMAIN}.
+      DASH_DOMAIN: ${DASH_DOMAIN:-}
+      DASH_API_URL: ${DASH_API_URL:-}
+      DASH_AUTH_URL: ${DASH_AUTH_URL:-}
+      DASH_DASHBOARD_URL: ${DASH_DASHBOARD_URL:-}
+    ports:
+      - "127.0.0.1:${DASHBOARD_PORT:-3301}:80"
+    networks:
+      # `backend` so exe-sso-edge can resolve `exe-dashboard` for its
+      # `upstream sso_dashboard { server exe-dashboard:80; }`; `frontend` so the
+      # cloudflared tunnel can reach it. Same pair as exe-auth/exe-crm/exe-wiki.
+      #
+      # NOTE: exe-sso-edge deliberately does NOT list this service in its
+      # depends_on. The edge must keep starting on deployments that never enable
+      # the dashboard profile, and a depends_on would make the edge unstartable
+      # for them.
+      - backend
+      - frontend
+    healthcheck:
+      # dashboard-page/nginx.conf serves `location = /health` as a literal 200.
+      # This is the same URL the stack manifest's healthUrl names, so the deploy
+      # gate and the container agree on what "up" means. Before this existed,
+      # /health fell through to the SPA `location /` and returned the index page
+      # with a 200 — a probe that could not fail while nginx was running at all.
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1/health"]
+      interval: 30s
+      timeout: 5s
+      start_period: 5s
+      retries: 3
+    deploy:
+      resources:
+        limits:
+          memory: 128M
+    logging:
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+
 # ------------------------------------------------------------------
 # Volumes
 # ------------------------------------------------------------------

package/deploy/compose/generate-env.ts

@@ -1,40 +1,89 @@
 import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+// ---------------------------------------------------------------------------
+// IMAGE PINS — DERIVED FROM THE SIGNED MANIFEST. NEVER HAND-TYPED.
+//
+// .env used to be an INDEPENDENT source of pins: a block of hand-edited
+// `*_RELEASE_TAG` constants that had to be "kept in sync" with
+// deploy/stack-manifests/v0.9.json. It was not kept in sync. On 2026-08-20 the
+// manifest, /opt/exe-stack/.env and the compose fallback defaults disagreed on
+// 5 of 7 apps in production.
+//
+// One direction only: each repo cuts a release -> the manifest is generated
+// from those releases -> .env is DERIVED from the manifest -> the VPS pulls what
+// .env says. The version AND digest of every pin below now come from the
+// manifest and nowhere else, so drift is unrepresentable rather than merely
+// discouraged.
+//
+// The registry HOST is deployment topology, not a pin: .env.example targets
+// GHCR so local simulation runs without private update.askexe.com credentials,
+// while the same tag@digest is served by the pull-through proxy. Re-hosting
+// preserves the digest, so the artifact is identical either way.
+// ---------------------------------------------------------------------------
 const REGISTRY = "ghcr.io/askexe";
 // exe-auth (the shared SSO sign-in/sign-up SPA) ships only from the private
 // update.askexe.com registry — it is not mirrored to GHCR — so it carries its
 // own registry constant rather than reusing REGISTRY (bug 58840873).
 const AUTH_REGISTRY = "update.askexe.com/askexe";
 
-// Keep these defaults in sync with deploy/stack-manifests/v0.9.json latest.
-// deploy/compose/.env.example intentionally uses GHCR fallbacks so local
-// simulation can run without private update.askexe.com registry credentials.
-const CRM_RELEASE_TAG = "v0.9.51";
-const WIKI_RELEASE_TAG = "v0.9.26";
-const EXED_RELEASE_TAG = "v0.9.311";
-const GATEWAY_RELEASE_TAG = "v0.9.24";
-// Bug 633995f1: v0.9.5 is a quarantined build — it regressed to stock Beszel
-// (runtime uid 1001 -> 65532, data dir -> /beszel_data, entrypoint -> /beszel),
-// so it crashloops on any deployment carrying an existing monitor_hub_data
-// volume, and its agent half contradicts the generation-coupled compose
-// healthcheck. Generated .env files must never hand a customer that tag — a
-// generated .env overrides the compose default outright, so leaving this stale
-// would have silently defeated the compose pin. v0.9.4 is the last known-good
-// build. See deploy/known-bad-images.json.
-const MONITOR_RELEASE_TAG = "v0.9.4";
-const ERP_RELEASE_TAG = "v0.2.2";
-const EXE_BUILD_RELEASE_TAG = "v0.1.0";
-// Bug 58840873: pin exe-auth to the manifest-pinned tag so a generated .env never
-// lets compose fall back to its (stale) hardcoded default image. MUST equal the
-// AUTH_IMAGE_TAG tag in deploy/stack-manifests/v0.9.json and the compose default.
-const AUTH_RELEASE_TAG = "v0.5.0";
+const MANIFEST_PATH = new URL("../stack-manifests/v0.9.json", import.meta.url);
+
+type ManifestFile = {
+  latest: string;
+  stacks: Record<string, { services?: Record<string, { image?: string }> }>;
+};
+
+function loadManifestServices(): Record<string, { image?: string }> {
+  const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8")) as ManifestFile;
+  const services = manifest.stacks?.[manifest.latest]?.services;
+  if (!services) {
+    throw new Error(
+      `generate-env: stack manifest ${MANIFEST_PATH.pathname} has no services for latest="${manifest.latest}". ` +
+        `Refusing to generate a .env with no pins — that is exactly the silent-substitution failure ` +
+        `the manifest-as-single-source-of-truth change exists to prevent.`,
+    );
+  }
+  return services;
+}
+
+const MANIFEST_SERVICES = loadManifestServices();
+
+/**
+ * The manifest's pin for a service, re-hosted onto `registry`. FAILS LOUDLY
+ * when the manifest does not govern the service, or governs it without a
+ * digest: a missing pin must abort generation, never fall back to a literal.
+ */
+function pin(serviceKey: string, registry: string, imageName: string): string {
+  const image = MANIFEST_SERVICES[serviceKey]?.image;
+  if (!image) {
+    throw new Error(
+      `generate-env: the stack manifest does not pin "${serviceKey}". Every service .env pins must be ` +
+        `manifest-governed — add it to the manifest (exe-os stack-generate-manifest) rather than ` +
+        `hard-coding a version here.`,
+    );
+  }
+  const at = image.indexOf("@");
+  if (at === -1) {
+    throw new Error(
+      `generate-env: the manifest pin for "${serviceKey}" (${image}) carries no @sha256 digest. ` +
+        `Tags move, digests do not — refusing to emit an unpinned .env value.`,
+    );
+  }
+  const digest = image.slice(at + 1);
+  const beforeDigest = image.slice(0, at);
+  const colon = beforeDigest.lastIndexOf(":");
+  const slash = beforeDigest.lastIndexOf("/");
+  const tag = colon > slash ? beforeDigest.slice(colon + 1) : "";
+  return tag ? `${registry}/${imageName}:${tag}@${digest}` : `${registry}/${imageName}@${digest}`;
+}
 
 const POSTGRES_USER = "exe";
 const POSTGRES_DB = "exedb";
 const CLICKHOUSE_DB = "default";
 const CLICKHOUSE_USER = "exe";
-export const CRM_IMAGE_TAG = `${REGISTRY}/exe-crm:${CRM_RELEASE_TAG}`;
+export const CRM_IMAGE_TAG = pin("crm", REGISTRY, "exe-crm");
 const CRM_HOST_PORT = "3000";
-export const WIKI_IMAGE_TAG = `${REGISTRY}/exe-wiki:${WIKI_RELEASE_TAG}`;
+export const WIKI_IMAGE_TAG = pin("wiki", REGISTRY, "exe-wiki");
 // Bug 2a8d3003: the wiki's data lives in `public` and generated .env files must say
 // so. This constant used to be "wiki", which meant every freshly generated stack
 // pinned the wiki to an empty schema — Prisma bootstraps it silently rather than
@@ -42,13 +91,22 @@ export const WIKI_IMAGE_TAG = `${REGISTRY}/exe-wiki:${WIKI_RELEASE_TAG}`;
 const WIKI_DB_SCHEMA = "public";
 const WIKI_VECTOR_DB = "exeOsMcp";
 const WIKI_HOST_PORT = "3001";
-export const EXE_OS_IMAGE_TAG = `${REGISTRY}/exe-os:${EXED_RELEASE_TAG}`;
-export const GATEWAY_IMAGE_TAG = `${REGISTRY}/exe-gateway:${GATEWAY_RELEASE_TAG}`;
-export const MONITOR_AGENT_IMAGE_TAG = `${REGISTRY}/exe-monitor-agent:${MONITOR_RELEASE_TAG}`;
-export const MONITOR_HUB_IMAGE_TAG = `${REGISTRY}/exe-monitor-hub:${MONITOR_RELEASE_TAG}`;
-export const ERP_IMAGE_TAG = `${REGISTRY}/exe-erp:${ERP_RELEASE_TAG}`;
-export const EXE_BUILD_IMAGE_TAG = `${REGISTRY}/exe-build:${EXE_BUILD_RELEASE_TAG}`;
-export const AUTH_IMAGE_TAG = `${AUTH_REGISTRY}/exe-auth:${AUTH_RELEASE_TAG}`;
+export const EXE_OS_IMAGE_TAG = pin("exe-os", REGISTRY, "exe-os");
+export const GATEWAY_IMAGE_TAG = pin("gateway", REGISTRY, "exe-gateway");
+export const MONITOR_AGENT_IMAGE_TAG = pin("monitorAgent", REGISTRY, "exe-monitor-agent");
+export const MONITOR_HUB_IMAGE_TAG = pin("monitorHub", REGISTRY, "exe-monitor-hub");
+export const ERP_IMAGE_TAG = pin("erp", REGISTRY, "exe-erp");
+// exe-build is control-plane only (not part of the customer stack), so the
+// manifest does not govern it and there is nothing to derive. It is emitted
+// as an opt-in for askexe-control-plane hosts.
+export const EXE_BUILD_IMAGE_TAG = `${REGISTRY}/exe-build:v0.1.0`;
+export const AUTH_IMAGE_TAG = pin("auth", AUTH_REGISTRY, "exe-auth");
+// Infra pins. Compose no longer carries fallback defaults for these either, so
+// the generated .env must state them — derived from the manifest like the rest.
+// Third-party artifacts are served from the same pull-through proxy the manifest
+// names, so they are NOT re-hosted onto GHCR.
+export const EXE_DB_IMAGE = pin("exe-db", "update.askexe.com/askexe", "pgvector");
+export const OTEL_COLLECTOR_IMAGE = pin("exe-otel-collector", "update.askexe.com/askexe", "otel-collector-contrib");
 const GATEWAY_HTTP_HOST_PORT = "3100";
 const GATEWAY_WS_HOST_PORT = "3101";
 const RANDOM_SECRET_16 = 16;
@@ -201,6 +259,14 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "SMTP_USER=",
     "SMTP_PASS=",
     "",
+    "# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---",
+    "# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`.",
+    "# No default is written here on purpose — the pin comes from the signed stack",
+    "# manifest (services.dashboard.image), so .env stays derived rather than",
+    "# becoming a competing source of truth that outranks it once it goes stale.",
+    "#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...",
+    "#DASHBOARD_PORT=3301",
+    "",
     "# --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---",
     "# Bug 58840873: pin the auth image in .env so compose never falls back to its",
     "# stale hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG.",
@@ -262,6 +328,11 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "",
     "# --- exe-os ---",
     `EXE_OS_IMAGE_TAG=${EXE_OS_IMAGE_TAG}`,
+    "",
+    "# Infra image pins — manifest-derived. Compose has no fallback default for",
+    "# these: a missing pin ABORTS the deploy instead of substituting an old image.",
+    `EXE_DB_IMAGE=${EXE_DB_IMAGE}`,
+    `OTEL_COLLECTOR_IMAGE=${OTEL_COLLECTOR_IMAGE}`,
     `EXED_MCP_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
     `EXED_DEVICE_ID=vps-${normalizedClientName}`,
     `EXE_MCP_HOST_BIND=${DEFAULT_EXE_MCP_HOST_BIND}`,
@@ -483,6 +554,21 @@ export function generateExampleEnv(): string {
     "SMTP_USER=",
     "SMTP_PASS=",
     "",
+    "# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---",
+    "# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`",
+    "# and is off unless you run `docker compose --profile dashboard ...`.",
+    "# DELIBERATELY UNSET AND COMMENTED OUT. Unlike the older *_IMAGE_TAG lines",
+    "# above/below, this one carries no hardcoded literal: a pinned default here is",
+    "# a second source of truth that silently outranks the manifest the moment it",
+    "# goes stale. Take the value from the signed stack manifest",
+    "# (deploy/stack-manifests/v0.9.json -> services.dashboard.image), digest and all.",
+    "# Leave it unset and compose refuses the dashboard loudly (\"has neither an image",
+    "# nor a build context specified\") instead of booting something arbitrary.",
+    "#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...",
+    "# Host port for the dashboard container (bound to 127.0.0.1; the tunnel and the",
+    "# SSO edge reach it over the docker network, not this port).",
+    "#DASHBOARD_PORT=3301",
+    "",
     "# --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---",
     "# Bug 58840873: pin the auth image so compose never falls back to its stale",
     "# hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG. exe-auth",
@@ -559,6 +645,11 @@ export function generateExampleEnv(): string {
     "",
     "# --- exe-os ---",
     `EXE_OS_IMAGE_TAG=${EXE_OS_IMAGE_TAG}`,
+    "",
+    "# Infra image pins — manifest-derived. Compose has no fallback default for",
+    "# these: a missing pin ABORTS the deploy instead of substituting an old image.",
+    `EXE_DB_IMAGE=${EXE_DB_IMAGE}`,
+    `OTEL_COLLECTOR_IMAGE=${OTEL_COLLECTOR_IMAGE}`,
     "EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN",
     "EXED_DEVICE_ID=vps-default",
     `EXE_MCP_HOST_BIND=${DEFAULT_EXE_MCP_HOST_BIND}`,