@askexenow/exe-os 0.9.382 → 0.9.384

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.36",
+  "latest": "0.9.38",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -2806,11 +2806,263 @@
         }
       },
       "rolloutStage": "ga"
+    },
+    "0.9.37": {
+      "version": "0.9.37",
+      "releasedAt": "2026-09-08T06:48:53.529Z",
+      "npmVersion": "0.9.382",
+      "notes": "exe-os v0.9.382, exe-crm v0.9.59 and exe-erp v0.3.11 reach customers. exe-os was pinned at v0.9.324 — 58 versions of merged work that no install could see. exe-crm v0.9.59 carries the shared EXE design tokens plus the @faker-js/faker CVE-2026-73231 fix (the vulnerable image was built but its release tag was correctly withheld, so it never shipped). exe-erp v0.3.11 is the first ERP image driving Frappe's own Espresso design system with EXE brand tokens instead of an override stylesheet, and the first built natively on x86_64 with QEMU removed from the release path. wiki v0.9.33 and auth v0.6.5 pins are unchanged — already current.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "exe-wiki v0.9.33 — typography unified onto the shared @askexenow/exe-theme tokens. plus-jakarta-sans removed repo-wide, and a latent bug fixed: font-headline was defined in Tailwind but no rule ever applied it, so h1-h6 had silently inherited the body font and wiki headings had never once rendered in Epilogue. Also dark first paint before stylesheets load, so switching between CRM, wiki and ERP no longer flashes white.",
+          "gitSha": "3f35bd9c52543987e2ebaec9e5876cc6c6fd8f3a"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth",
+          "description": "exe-auth v0.6.5 — an already-authenticated user switching between ERP, wiki and CRM no longer sees the login page flash. The session is now validated SERVER-SIDE before any login markup is sent, so an authenticated request gets a bare 302 (bug 910ff2a5). A forged exe_access_token sentinel still receives the login page, so this is not an auth bypass. Also strips the leading dot from AUTH_COOKIE_DOMAIN (bug ee4b831d).",
+          "gitSha": "e119d1fa1fd08f2faf951f9998fe33393cf8b258"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning",
+          "gitSha": "d185286873dcfa11e4b3f9672c4e23efea240cc5"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.382@sha256:43c4eb52d89d977021d29df73bcfa6f9d769ab4debf90e81240b59a4c165bab0",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing"
+        }
+      },
+      "rolloutStage": "ga"
+    },
+    "0.9.38": {
+      "version": "0.9.38",
+      "releasedAt": "2026-09-08T14:38:52.000Z",
+      "npmVersion": "0.9.382",
+      "notes": "Corrects the auth healthUrl only; every image pin is identical to 0.9.37. 0.9.37 probed auth at /api/health, which exe-auth returns 404 for BY DESIGN: nginx.conf adds an exact `location = /api/health` that 404s so GoTrue's version is not exposed to the public internet (fingerprinting), and its comment states health of the container is the compose healthcheck on `/`. The manifest was never updated to match, so deploying auth aborted with 'Health check failed for auth (http://127.0.0.1:3300/api/health): HTTP 404' and rolled the whole stack back. Verified live on the running service: / -> 200, /__version -> 200, /api/health -> 404. Points at `/`, matching the container's own healthcheck (wget --spider http://127.0.0.1:80/).",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "exe-wiki v0.9.33 — typography unified onto the shared @askexenow/exe-theme tokens. plus-jakarta-sans removed repo-wide, and a latent bug fixed: font-headline was defined in Tailwind but no rule ever applied it, so h1-h6 had silently inherited the body font and wiki headings had never once rendered in Epilogue. Also dark first paint before stylesheets load, so switching between CRM, wiki and ERP no longer flashes white.",
+          "gitSha": "3f35bd9c52543987e2ebaec9e5876cc6c6fd8f3a"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "exe-auth v0.6.5 — an already-authenticated user switching between ERP, wiki and CRM no longer sees the login page flash. The session is now validated SERVER-SIDE before any login markup is sent, so an authenticated request gets a bare 302 (bug 910ff2a5). A forged exe_access_token sentinel still receives the login page, so this is not an auth bypass. Also strips the leading dot from AUTH_COOKIE_DOMAIN (bug ee4b831d).",
+          "gitSha": "e119d1fa1fd08f2faf951f9998fe33393cf8b258"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning",
+          "gitSha": "d185286873dcfa11e4b3f9672c4e23efea240cc5"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.382@sha256:43c4eb52d89d977021d29df73bcfa6f9d769ab4debf90e81240b59a4c165bab0",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing"
+        }
+      },
+      "rolloutStage": "ga"
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "UAQm9FB5Ai8KaBSGe6LEkBfXZ3XtBFT/5/8DozCK1v7f8llD33AhrAF11HEttf33z3w/weWhxZEXG3yGIWw/Dg=="
+    "signature": "slzGaEhMxBaItfNzC80+bNJs4C3skBapi8TbSsVRRf7iWa/WFowmc9vvnnluoLKdWdsi8gqxdFUSFaxkul5sAg=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-08T06:05:51.783Z",
-  "manifest_sha256": "248ed33b157957ea2338ad0ca171fbeb8d52540b70a255a843aa9a3f0651baf7",
-  "package_version": "0.9.382"
+  "verified_at": "2026-09-10T04:33:27.784Z",
+  "manifest_sha256": "bc5eed1f8fc614320e0c43011f62df3b11fb4e6c07324618a1eaa44feaa4d45c",
+  "package_version": "0.9.384"
 }

package/dist/{active-agent-GFUUCFLD.js → active-agent-F5V4E4UL.js}

@@ -8,23 +8,23 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-F6H7GP2O.js";
-import "./chunk-K4ESASPL.js";
+} from "./chunk-F4BBMIPG.js";
+import "./chunk-MUCNYSJP.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-AY2U4NZ5.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{active-agent-LE6FE6SO.js → active-agent-YTBB4ZQM.js}

@@ -7,23 +7,23 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-F6H7GP2O.js";
-import "./chunk-K4ESASPL.js";
+} from "./chunk-F4BBMIPG.js";
+import "./chunk-MUCNYSJP.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-AY2U4NZ5.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{agent-defs-generator-EIUA3SH5.js → agent-defs-generator-7TFISIJQ.js}

@@ -1,24 +1,24 @@
 import {
   loadAgentConfig
-} from "./chunk-GZOG2MAX.js";
+} from "./chunk-L5EPGGDP.js";
 import "./chunk-AM7S2TY6.js";
 import {
   loadEmployeesSync,
   validateEmployeeName
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{agent-loop-7ZRH56EX.js → agent-loop-EZ7LDAGD.js}

@@ -1,6 +1,6 @@
 import {
   agentLoop
-} from "./chunk-KBR5LIWD.js";
+} from "./chunk-TKS5GMYA.js";
 import "./chunk-JRLNE3T2.js";
 import "./chunk-2O2UKMUE.js";
 import "./chunk-HF25XPZE.js";

package/dist/{agentic-ontology-67JGSP7G.js → agentic-ontology-XVTUVV7W.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-FWA4MYTA.js";
+} from "./chunk-JRIH6I7D.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{artifact-backup-NYXAYASJ.js → artifact-backup-TF6YWQT2.js}

@@ -7,16 +7,16 @@ import {
 import {
   artifactObjectId,
   encryptSyncBlob
-} from "./chunk-MP4ST7RO.js";
+} from "./chunk-ZPP63JSQ.js";
 import "./chunk-TWMWHDOY.js";
-import "./chunk-4GZTBLJG.js";
-import "./chunk-AVMLC2MR.js";
+import "./chunk-4AR5XKCH.js";
+import "./chunk-5U2IJBFV.js";
 import {
   EXE_AI_DIR,
   loadConfigSync
-} from "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+} from "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{backfill-gate-KWJQ35YX.js → backfill-gate-FWYLCGNJ.js}

@@ -5,10 +5,10 @@ import {
   backfillKillSwitchEnabled,
   computeBackfillDisabled,
   countActionableNullVectors
-} from "./chunk-IHXW4VUI.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+} from "./chunk-5IADGFGR.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{backfill-metadata-RQYG2WUJ.js → backfill-metadata-J6MXIDCW.js}

@@ -2,36 +2,36 @@
 import {
   disposeStore,
   initStore
-} from "./chunk-CO5ZVE3D.js";
-import "./chunk-ZEGEFBZV.js";
+} from "./chunk-UOPCVFVR.js";
+import "./chunk-AWWDKF22.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-M2B35MUK.js";
+import "./chunk-VHHX4UCP.js";
 import "./chunk-5MOYSU5A.js";
-import "./chunk-5QCIWWFA.js";
+import "./chunk-ELEGH4DX.js";
 import "./chunk-76CJBM36.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient,
   getEmployeeNamesByRole,
   loadEmployeesSync
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-AVMLC2MR.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-5U2IJBFV.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{background-jobs-6VMD55PK.js → background-jobs-V3DZRFKU.js}

@@ -9,10 +9,10 @@ import {
   releaseJobLock,
   reniceCurrentProcess,
   startManagedJob
-} from "./chunk-M7O7TGGU.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+} from "./chunk-2NW4LRDU.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{backup-verify-HC4YDSGN.js → backup-verify-6DVBQMDP.js}

@@ -4,11 +4,11 @@ import {
 import {
   getLatestBackup,
   reasonFromBackupName
-} from "./chunk-FU5O2REK.js";
+} from "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
@@ -29,6 +29,13 @@ function manifestWriteEnabled() {
 function dailyVerifyEnabled() {
   return /^(1|true|yes|on)$/i.test(process.env.EXE_BACKUP_VERIFY_DAILY ?? "0");
 }
+function describeDailyVerifyPosture() {
+  const enabled = dailyVerifyEnabled();
+  return {
+    enabled,
+    detail: enabled ? "Post-capture restore verification is ON (EXE_BACKUP_VERIFY_DAILY): the daily backup is re-opened from a throwaway copy and integrity-checked after capture." : "Post-capture restore verification is OFF (set EXE_BACKUP_VERIFY_DAILY=1 to enable). Every backup is still proven readable AT CAPTURE by the artifact read-back, but backups are not re-checked afterwards, so at-rest degradation between capture and a restore would not be detected."
+  };
+}
 function liveHardEnabled() {
   return /^(1|true|yes|on)$/i.test(process.env.EXE_BACKUP_VERIFY_LIVE_HARD ?? "0");
 }
@@ -115,15 +122,25 @@ async function resolveBackupKeyHex() {
 function manifestPathFor(backupPath) {
   return `${backupPath}.manifest.json`;
 }
-async function writeBackupManifest(backupPath, dbName, opts = {}) {
+async function readBackBackupArtifact(backupPath, dbName, opts = {}) {
   let scratch = null;
   let ownedClient = null;
   try {
     let client = opts.client;
     if (!client) {
-      scratch = await mkdtemp(path.join(tmpdir(), "exe-bkmanifest-"));
-      const scratchDb = path.join(scratch, path.basename(backupPath));
-      await copyFile(backupPath, scratchDb);
+      let scratchDb;
+      try {
+        scratch = await mkdtemp(path.join(tmpdir(), "exe-bkmanifest-"));
+        scratchDb = path.join(scratch, path.basename(backupPath));
+        await copyFile(backupPath, scratchDb);
+      } catch (err) {
+        return {
+          artifact: "not-checked",
+          manifestWritten: false,
+          manifest: null,
+          detail: `could not stage the artifact read-back: ${errMsg(err)}`
+        };
+      }
       for (const sfx of ["-wal", "-shm"]) {
         if (existsSync(backupPath + sfx)) {
           try {
@@ -137,25 +154,51 @@ async function writeBackupManifest(backupPath, dbName, opts = {}) {
         keyHex ? { url: `file:${scratchDb}`, encryptionKey: keyHex } : { url: `file:${scratchDb}` }
       );
       recordDbOpen({ dbPath: scratchDb, source: "backup-verify-scratch", writeCapable: true, checkpointTimer: false });
-      await ownedClient.execute(BACKUP_OPEN_PROBE_SQL);
       client = ownedClient;
     }
-    const schemaTables = await collectSchemaTables(client);
-    const schemaHash = computeSchemaHash(schemaTables);
-    const tables = await collectCounts(client, schemaTables.map((t) => t.name));
-    const keyEpoch = opts.keyEpoch !== void 0 ? opts.keyEpoch : await computeKeyEpoch(opts.keyHex);
+    let schemaHash;
+    let tables;
+    try {
+      await client.execute(BACKUP_OPEN_PROBE_SQL);
+      const schemaTables = await collectSchemaTables(client);
+      schemaHash = computeSchemaHash(schemaTables);
+      tables = await collectCounts(client, schemaTables.map((t) => t.name));
+    } catch (err) {
+      return {
+        artifact: "unreadable",
+        manifestWritten: false,
+        manifest: null,
+        detail: `the COPIED artifact could not be read back: ${errMsg(err)}`
+      };
+    }
     const manifest = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       dbName,
       schemaHash,
       tables,
-      keyEpoch
+      keyEpoch: opts.keyEpoch !== void 0 ? opts.keyEpoch : await computeKeyEpoch(opts.keyHex)
+    };
+    const rows = Object.values(tables).reduce((n, c) => n + c, 0);
+    const readDetail = `artifact read back: ${Object.keys(tables).length} table(s), ${rows} row(s)`;
+    try {
+      await writeFile(manifestPathFor(backupPath), JSON.stringify(manifest, null, 2), "utf-8");
+    } catch (err) {
+      return {
+        artifact: "readable",
+        manifestWritten: false,
+        manifest,
+        detail: `${readDetail}, but the manifest sidecar could not be written: ${errMsg(err)}`
+      };
+    }
+    return { artifact: "readable", manifestWritten: true, manifest, detail: readDetail };
+  } catch (err) {
+    return {
+      artifact: "not-checked",
+      manifestWritten: false,
+      manifest: null,
+      detail: `artifact read-back did not complete: ${errMsg(err)}`
     };
-    await writeFile(manifestPathFor(backupPath), JSON.stringify(manifest, null, 2), "utf-8");
-    return manifest;
-  } catch {
-    return null;
   } finally {
     try {
       ownedClient?.close?.();
@@ -169,6 +212,10 @@ async function writeBackupManifest(backupPath, dbName, opts = {}) {
     }
   }
 }
+async function writeBackupManifest(backupPath, dbName, opts = {}) {
+  const res = await readBackBackupArtifact(backupPath, dbName, opts);
+  return res.manifestWritten ? res.manifest : null;
+}
 async function readManifest(backupPath) {
   const p = manifestPathFor(backupPath);
   if (!existsSync(p)) return null;
@@ -326,7 +373,7 @@ async function recordVerdict(res, absolutePath) {
     }
   }
   try {
-    const { recordDbRestoreEvent } = await import("./db-restore-events-G6NOQOVE.js");
+    const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
     if (res.ok) {
       recordDbRestoreEvent({
         kind: "restore-verify-pass",
@@ -500,11 +547,13 @@ async function maybeVerifyDailyBackup(backupPath) {
 export {
   computeKeyEpoch,
   dailyVerifyEnabled,
+  describeDailyVerifyPosture,
   isCrashLoopBackup,
   liveHardEnabled,
   manifestPathFor,
   manifestWriteEnabled,
   maybeVerifyDailyBackup,
+  readBackBackupArtifact,
   readManifest,
   verifyBackup,
   writeBackupManifest