@askexenow/exe-os 0.9.382 → 0.9.384

package/dist/{session-scope-UB3HA5E7.js → session-scope-XG5R3P3D.js}

@@ -1,10 +1,10 @@
 import {
   resolveExeSession
-} from "./chunk-ZVBVPX4W.js";
-import "./chunk-JUKDL5MF.js";
-import "./chunk-SFFXAPYK.js";
-import "./chunk-UJWZYK46.js";
+} from "./chunk-7UHZBVP3.js";
+import "./chunk-6BJCDWSM.js";
+import "./chunk-JDDM6C57.js";
 import "./chunk-ZKGWHT56.js";
+import "./chunk-QNZ4562V.js";
 import "./chunk-WT4RI36X.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-TDF2XKLK.js";
@@ -12,54 +12,55 @@ import "./chunk-EIKATSE4.js";
 import "./chunk-MJCSEIFI.js";
 import {
   listSessions
-} from "./chunk-NPGV4MZ3.js";
+} from "./chunk-ALRHGEAJ.js";
+import "./chunk-PUBA5B4M.js";
 import "./chunk-VI4ATC6I.js";
 import "./chunk-A27Q27CT.js";
-import "./chunk-BZ546I4Q.js";
-import "./chunk-VUOAPKPI.js";
-import "./chunk-XU57KFD6.js";
-import "./chunk-AZBJXATK.js";
-import "./chunk-GZOG2MAX.js";
+import "./chunk-LSNBTGW4.js";
+import "./chunk-T5SM4RXY.js";
+import "./chunk-VJEJ7JNB.js";
+import "./chunk-L5EPGGDP.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-4CF5KUWH.js";
+import "./chunk-BPVFZ6Q4.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-WJC6AAJN.js";
-import "./chunk-4IK2K3B3.js";
-import "./chunk-ZKJ5S23O.js";
-import "./chunk-GPUOUUHA.js";
+import "./chunk-ANVHWV2X.js";
+import "./chunk-HME6ITKV.js";
+import "./chunk-MFAOAIUE.js";
+import "./chunk-PCV52RYM.js";
 import "./chunk-BTSWFMEH.js";
-import "./chunk-ZG62LIK3.js";
-import "./chunk-IMYGYIAI.js";
+import "./chunk-CIPDQRFO.js";
 import "./chunk-NLEW62VC.js";
-import "./chunk-GPJIBLP4.js";
-import "./chunk-V3WLC5TJ.js";
+import "./chunk-IMYGYIAI.js";
+import "./chunk-3DAEZILW.js";
+import "./chunk-DRTJCG6B.js";
 import {
   getProjectName
-} from "./chunk-22LNFCDF.js";
+} from "./chunk-UX2EO653.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
+import "./chunk-YRUZK2QA.js";
 import {
   isCoordinatorName
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-5DFE2NAF.js";
+import "./chunk-TNS63ATU.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-O34F5EP5.js";
+import "./chunk-DZN7SDY2.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{setup-wizard-6XULOT3L.js → setup-wizard-7QFLZIKT.js}

@@ -10,16 +10,16 @@ import {
   runSetupWizard,
   validateModel,
   wslKeyCustodyLines
-} from "./chunk-76YRJKKF.js";
+} from "./chunk-D3LXVAIQ.js";
 import "./chunk-J6KMGEJW.js";
-import "./chunk-7RI2CNXJ.js";
+import "./chunk-7OTR2OET.js";
 import "./chunk-SO7KTH3Q.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-AVMLC2MR.js";
+import "./chunk-5U2IJBFV.js";
 import "./chunk-ARX6TAGN.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{shard-manager-DYEJ6ETD.js → shard-manager-HHHHV2KZ.js}

@@ -12,12 +12,12 @@ import {
   isShardingEnabled,
   listShards,
   shardExists
-} from "./chunk-RV2FFCDS.js";
+} from "./chunk-MUAWCFW6.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{skill-refinement-MKBQIWZ6.js → skill-refinement-I5RMAHSC.js}

@@ -2,20 +2,20 @@ import {
   incrementSkillSuccess,
   incrementSkillUsage,
   runSkillRefinement
-} from "./chunk-AZBJXATK.js";
-import "./chunk-AY2U4NZ5.js";
+} from "./chunk-VJEJ7JNB.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{stack-generate-manifest-7ODQ6W2O.js → stack-generate-manifest-AKMZ3AUX.js}

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-FHSV4BSW.js";
-import "./chunk-NY74W3S4.js";
+} from "./chunk-MOANZQXF.js";
+import "./chunk-ZBPZDADW.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-5DFE2NAF.js";
+import "./chunk-LFUBEHFW.js";
+import "./chunk-TNS63ATU.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-O34F5EP5.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-DZN7SDY2.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
@@ -33,6 +34,12 @@ var STACK_SERVICE_SPECS = Object.freeze([
     origin: "askexe-release",
     deployment: "stack",
     ghRepo: "AskExe/exe-os",
+    // Confirmed via `gh api repos/AskExe/exe-os/actions/workflows` (2026-09-08):
+    // id 274190265, path .github/workflows/release-stack-image.yml. exe-os's
+    // repo ALSO runs "Release dashboard image" (id 338670900) at the same tag
+    // commit during a stack release — the exact sibling-workflow ambiguity
+    // this field exists to eliminate for dashboard below.
+    releaseWorkflowFile: "release-stack-image.yml",
     imageName: "update.askexe.com/askexe/exe-os",
     sourceImageName: "ghcr.io/askexe/exe-os",
     // The version tag and the commit tag live in DIFFERENT ghcr repositories:
@@ -51,6 +58,8 @@ var STACK_SERVICE_SPECS = Object.freeze([
     origin: "askexe-release",
     deployment: "stack",
     ghRepo: "AskExe/exe-crm",
+    // Confirmed via `gh api repos/AskExe/exe-crm/actions/workflows` (2026-09-08).
+    releaseWorkflowFile: "release-stack-image.yml",
     imageName: "update.askexe.com/askexe/exe-crm",
     sourceImageName: "ghcr.io/askexe/exe-crm",
     env: "CRM_IMAGE_TAG",
@@ -65,6 +74,8 @@ var STACK_SERVICE_SPECS = Object.freeze([
     origin: "askexe-release",
     deployment: "stack",
     ghRepo: "AskExe/exe-wiki",
+    // Confirmed via `gh api repos/AskExe/exe-wiki/actions/workflows` (2026-09-08).
+    releaseWorkflowFile: "release-stack-image.yml",
     imageName: "update.askexe.com/askexe/exe-wiki",
     sourceImageName: "ghcr.io/askexe/exe-wiki",
     env: "WIKI_IMAGE_TAG",
@@ -77,6 +88,11 @@ var STACK_SERVICE_SPECS = Object.freeze([
     origin: "askexe-release",
     deployment: "stack",
     ghRepo: "AskExe/exe-gateway",
+    // Confirmed via `gh api repos/AskExe/exe-gateway/actions/workflows`
+    // (2026-09-08): the producer here is named "Release image", NOT "Release
+    // stack image" like its siblings — exactly why this is a file, not a name
+    // pattern shared across the roster.
+    releaseWorkflowFile: "release-image.yml",
     imageName: "update.askexe.com/askexe/exe-gateway",
     sourceImageName: "ghcr.io/askexe/exe-gateway",
     env: "GATEWAY_IMAGE_TAG",
@@ -96,6 +112,12 @@ var STACK_SERVICE_SPECS = Object.freeze([
     // AUTH_REGISTRY constant). Probing ghcr.io for its `sha-*`/version tags
     // resolves nothing, so provenance is read from — and the pin emitted for —
     // the one registry the artifact actually exists in.
+    // Confirmed via `gh api repos/AskExe/exe-auth/actions/workflows`
+    // (2026-09-08): exe-auth has no dedicated release workflow at all — it
+    // publishes from its `ci.yml` ("CI") on a `push: tags: ['v*']` trigger.
+    // A name pattern would NEVER have matched this producer even before this
+    // fix; scoping by file is what makes it checkable at all.
+    releaseWorkflowFile: "ci.yml",
     imageName: "update.askexe.com/askexe/exe-auth",
     env: "AUTH_IMAGE_TAG",
     healthUrl: "http://127.0.0.1:3300/api/health",
@@ -108,6 +130,13 @@ var STACK_SERVICE_SPECS = Object.freeze([
     origin: "askexe-release",
     deployment: "stack",
     ghRepo: "AskExe/exe-erp",
+    // Confirmed via `gh api repos/AskExe/exe-erp/actions/workflows`
+    // (2026-09-08). NOTE (bug e49ac42b adversarial review): this workflow's
+    // build-push-action step pushes BOTH the version tag and `sha-<sha>` in
+    // one step, then a LATER "Enforce digest pins (fail closed)" step can
+    // still fail the run — so `digestByTag` resolving must never be read as
+    // "this run's gates passed" (see Guard 5b).
+    releaseWorkflowFile: "release-stack-image.yml",
     imageName: "update.askexe.com/askexe/exe-erp",
     sourceImageName: "ghcr.io/askexe/exe-erp",
     env: "ERP_IMAGE_TAG",
@@ -123,6 +152,13 @@ var STACK_SERVICE_SPECS = Object.freeze([
     origin: "askexe-release",
     deployment: "stack",
     ghRepo: "AskExe/exe-monitor",
+    // Confirmed via `gh api repos/AskExe/exe-monitor/actions/workflows`
+    // (2026-09-08). NOTE (bug e49ac42b adversarial review): this workflow
+    // triggers on `push` tags AND `workflow_run` (CI completion) AND
+    // `schedule` AND `workflow_dispatch` — querying only `event=push` would
+    // exclude the very trigger paths PR #42 deliberately publishes through.
+    // Guard queries this workflow file with no `event=` filter at all.
+    releaseWorkflowFile: "release-stack-images.yml",
     imageName: "update.askexe.com/askexe/exe-monitor-hub",
     sourceImageName: "ghcr.io/askexe/exe-monitor-hub",
     env: "MONITOR_HUB_IMAGE_TAG",
@@ -134,6 +170,8 @@ var STACK_SERVICE_SPECS = Object.freeze([
     origin: "askexe-release",
     deployment: "stack",
     ghRepo: "AskExe/exe-monitor",
+    // Same producer as monitorHub — one workflow builds both images.
+    releaseWorkflowFile: "release-stack-images.yml",
     imageName: "update.askexe.com/askexe/exe-monitor-agent",
     sourceImageName: "ghcr.io/askexe/exe-monitor-agent",
     env: "MONITOR_AGENT_IMAGE_TAG",
@@ -153,12 +191,31 @@ var STACK_SERVICE_SPECS = Object.freeze([
     // `:sha-<sha>` and `:main`, sets no org.opencontainers.image.version, and
     // neither stack.release.json nor the stack manifest mentions it. Production
     // is three builds stale and nothing auto-deploys it.
+    // FAIL-CLOSED DEFAULT ONLY (bug 61e7096e) — this is stale as of
+    // 2026-09-08: release-dashboard-image.yml now calls release-service.yml@v1
+    // and stack.release.json's `components.dashboard` describes it. Leaving
+    // "none" here is deliberate anyway: a constant like this one is exactly
+    // what went stale last time, so it must never by itself be trusted to stay
+    // OPEN — it is trusted only to stay CLOSED. The CLI derives the real
+    // answer from stack.release.json at run time (`releaseLaneWired` in
+    // ServiceFacts) and that is what actually decides Guard 2. If the
+    // descriptor entry is ever removed, this default is what re-closes the
+    // gate without anyone having to remember to flip a flag back.
     releaseLane: "none",
+    // Wired ahead of the release lane itself (bug e49ac42b): once dashboard is
+    // flipped into the release lane, its producer is `.github/workflows/
+    // release-dashboard-image.yml` ("Release dashboard image", id 338670900) —
+    // a DIFFERENT workflow than exe-os's own "Release stack image"
+    // (id 274190265), even though both live in this repo, both match
+    // /release/i, and both can run at the same tag commit during a stack
+    // release. This is the concrete scenario adversarial review flagged: name
+    // matching would let exe-os's release stand in for dashboard's own.
+    releaseWorkflowFile: "release-dashboard-image.yml",
     imageName: "ghcr.io/askexe/exe-dashboard",
     env: "DASHBOARD_IMAGE_TAG",
     category: "app",
     description: "Customer dashboard (credits, usage, keys, billing)",
-    note: "BLOCKED \u2014 NOT WIRED INTO THE RELEASE LANE (2026-08-20). Give dashboard-image.yml a versioned release tag + org.opencontainers.image.version/.revision stamps, and add it to stack.release.json, then it flows through the identical path as every other service."
+    note: "Release lane wiring is now DERIVED from stack.release.json's components.dashboard entry (bug 61e7096e), not asserted here. Dashboard may still fail generation for other, real reasons \u2014 e.g. bug d85b98c7 (the release stamp step refuses to publish from an unclean tree, so no v* dashboard image has ever actually been produced) \u2014 but it will fail with an accurate reason from a later guard, not with a stale claim that the lane doesn't exist."
   },
   {
     key: "exe-build",
@@ -169,6 +226,9 @@ var STACK_SERVICE_SPECS = Object.freeze([
     // customer manifest is a decision on the record, not an omission.
     deployment: "control-plane",
     ghRepo: "AskExe/exe-build",
+    // Confirmed via `gh api repos/AskExe/exe-build/actions/workflows`
+    // (2026-09-08): named "Release" (path release.yml).
+    releaseWorkflowFile: "release.yml",
     imageName: "update.askexe.com/askexe/exe-build",
     env: "EXE_BUILD_IMAGE_TAG",
     category: "control-plane"
@@ -281,10 +341,18 @@ function parseVersionCore(tag) {
   }
   return nums.length > 0 ? nums : null;
 }
+function classifyVersionScheme(tag) {
+  const core = parseVersionCore(tag);
+  if (!core) return null;
+  const looksStamped = typeof tag === "string" && /-stamped\s*$/i.test(tag.trim());
+  const firstComponentLooksLikeAYear = (core[0] ?? 0) >= 1e3;
+  return looksStamped || firstComponentLooksLikeAYear ? "date-stamped" : "semver";
+}
 function compareVersionTags(a, b) {
   const ca = parseVersionCore(a);
   const cb = parseVersionCore(b);
   if (!ca || !cb) return null;
+  if (classifyVersionScheme(a) !== classifyVersionScheme(b)) return null;
   const len = Math.max(ca.length, cb.length);
   for (let i = 0; i < len; i++) {
     const x = ca[i] ?? 0;
@@ -298,6 +366,9 @@ var REQUIRED_IMAGE_LABELS = Object.freeze([
   "org.opencontainers.image.version",
   "org.opencontainers.image.revision"
 ]);
+function isReleaseLaneWired(spec, facts) {
+  return spec.releaseLane !== "none" || facts.releaseLaneWired === true;
+}
 function evaluateService(spec, facts = {}, options = {}) {
   const refuse = (reason) => ({ ok: false, service: spec.key, reason });
   const sourceName = spec.sourceImageName ?? spec.imageName;
@@ -343,7 +414,7 @@ function evaluateService(spec, facts = {}, options = {}) {
       `no source repo identified \u2014 ${spec.key} is deployed from ${spec.imageName} but no repository in the AskExe org builds it. Identify (or create) the source repo and cut a tagged release. This is a block, not an exemption: the repo name must not be guessed.`
     );
   }
-  if (spec.releaseLane === "none") {
+  if (!isReleaseLaneWired(spec, facts)) {
     return refuse(
       `not wired into the release lane \u2014 ${spec.ghRepo} builds ${spec.imageName}, but only as floating refs (:main / :sha-<sha>) with no version stamp, and no release descriptor references it. There is no released artifact to pin. Give its workflow a versioned tag plus org.opencontainers.image.version/.revision stamps and add it to the release descriptor.`
     );
@@ -385,10 +456,45 @@ function evaluateService(spec, facts = {}, options = {}) {
   }
   const resolvedDigest = facts.digestByCommit ?? facts.digestByTag;
   if (!resolvedDigest || !/^sha256:[0-9a-f]{64}$/i.test(resolvedDigest)) {
+    const refEntries = [
+      { label: `${commitName}:sha-${facts.tagCommit} (commit-addressed)`, classification: facts.digestByCommitClassification },
+      { label: `${sourceName}:${facts.latestTag} (version tag)`, classification: facts.digestByTagClassification }
+    ];
+    const classifiedEntries = refEntries.filter(
+      (e) => e.classification !== void 0
+    );
+    const missingEntries = classifiedEntries.filter((e) => e.classification.classification === "missing");
+    const uncertainEntries = classifiedEntries.filter((e) => e.classification.classification !== "missing");
+    const kindPhrase = (kind) => kind === "authentication" ? "AUTHENTICATION FAILURE" : "UNAVAILABLE";
+    const uncertainDetail = (e) => `${e.label}: ${kindPhrase(e.classification.classification)} \u2014 ${e.classification.detail}`;
+    const credentialHint = `Set the matching credential (EXE_REGISTRY_PROXY_PULL_TOKENS or EXE_LICENSE_KEY for update.askexe.com; GHCR_TOKEN for ghcr.io) and re-run before concluding anything about the release workflow.`;
+    if (classifiedEntries.length > 0 && missingEntries.length === 0) {
+      return refuse(
+        `UNVERIFIED, not missing: could not determine whether an artifact exists for release ${facts.latestTag} \u2014 ${uncertainEntries.map(uncertainDetail).join("; ")}. A rejected credential or an unreachable/erroring registry is NOT evidence the release has no artifact. ${credentialHint}`
+      );
+    }
+    if (missingEntries.length > 0 && uncertainEntries.length > 0) {
+      return refuse(
+        `PARTIALLY VERIFIED for release ${facts.latestTag}: ${missingEntries.map((e) => `${e.label} is confirmed MISSING (${e.classification.detail})`).join("; ")}; ${uncertainEntries.map(uncertainDetail).join("; ")}. Refusing to publish either way (fail-closed), but this is NOT proof that neither artifact exists \u2014 only that one ref does not, and the other could not be checked. ${credentialHint}`
+      );
+    }
     return refuse(
       `no resolvable image for release ${facts.latestTag}: neither ${commitName}:sha-${facts.tagCommit} (commit-addressed) nor ${sourceName}:${facts.latestTag} could be resolved to a digest. A release with no artifact cannot be deployed \u2014 fix the release workflow rather than hand-pinning an older image.`
     );
   }
+  {
+    const gate = facts.releaseGateStatus;
+    if (!gate || gate.classification === "unverified") {
+      return refuse(
+        `UNVERIFIED, not passed: could not determine whether the release that produced ${resolvedDigest} (${commitName}:sha-${facts.tagCommit}${facts.digestByTag ? `, also tagged ${sourceName}:${facts.latestTag}` : ""}) passed its gates \u2014 ${gate?.detail ?? "no release-gate check was performed for this candidate."} This is NOT evidence the release gates passed \u2014 the question was never actually answered. Fix the missing credential (gh CLI auth / GH_TOKEN with 'actions:read' on ${spec.ghRepo}) or, if unverified because no producer workflow is identified for this service, set releaseWorkflowFile in the roster \u2014 and re-run before concluding anything about this release.`
+      );
+    }
+    if (gate.classification !== "passed") {
+      return refuse(
+        `RELEASE GATES DID NOT PASS for ${resolvedDigest} (${commitName}:sha-${facts.tagCommit}): ${gate.detail} ${facts.digestByTag ? `The version tag ${facts.latestTag} resolving does NOT mean this run's gates passed \u2014 a tag can be pushed by a step that runs before later checks in the same job fail it closed.` : `The version tag ${facts.latestTag} was never published for ${spec.ghRepo} \u2014 that omission IS the gate working as designed, not a resolution failure to fall back past.`} Fix the finding the release gate flagged and cut a new release; a rejected artifact does not become pinnable because SOME reference to it still resolves in the registry.`
+      );
+    }
+  }
   if (facts.digestByTag && facts.digestByCommit && facts.digestByTag.toLowerCase() !== facts.digestByCommit.toLowerCase()) {
     return refuse(
       `TAG/COMMIT MISMATCH: the image tagged ${facts.latestTag} is ${facts.digestByTag}, but the image built from the commit that tag names (${facts.tagCommit}) is ${facts.digestByCommit}. The image called ${facts.latestTag} was not built from the commit called ${facts.latestTag}. A version tag in this registry is not provenance \u2014 refusing to pin either until the release workflow is fixed so the two agree.`
@@ -566,6 +672,27 @@ function repoRoot() {
   }
   return process.cwd();
 }
+var OWN_REPO = "AskExe/exe-os";
+var cachedReleaseDescriptorComponents;
+function ownReleaseDescriptorComponents(root = repoRoot()) {
+  if (cachedReleaseDescriptorComponents) return cachedReleaseDescriptorComponents;
+  const descriptorPath = path.join(root, "stack.release.json");
+  try {
+    const parsed = JSON.parse(readFileSync(descriptorPath, "utf8"));
+    cachedReleaseDescriptorComponents = new Set(Object.keys(parsed.components ?? {}));
+  } catch (err) {
+    process.stderr.write(
+      `[stack-generate-manifest] WARNING: could not read/parse ${descriptorPath} to derive release-lane wiring (${err instanceof Error ? err.message : String(err)}); treating no service as newly wired.
+`
+    );
+    cachedReleaseDescriptorComponents = /* @__PURE__ */ new Set();
+  }
+  return cachedReleaseDescriptorComponents;
+}
+function deriveReleaseLaneWiring(spec, root) {
+  if (spec.ghRepo !== OWN_REPO) return void 0;
+  return ownReleaseDescriptorComponents(root).has(spec.key);
+}
 function parseGenerateArgs(argv, root = repoRoot()) {
   const opts = {
     manifestPath: path.join(root, "deploy", "stack-manifests", "v0.9.json"),
@@ -597,6 +724,14 @@ async function run(cmd, args) {
     return { ok: false, stdout: "" };
   }
 }
+async function runWithDiagnostics(cmd, args) {
+  try {
+    const { stdout } = await execFile(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
+    return { ok: true, stdout: stdout.toString().trim() };
+  } catch (err) {
+    return { ok: false, stdout: "", error: err instanceof Error ? err.message : String(err) };
+  }
+}
 var MAX_TAG_PROBES = 50;
 async function tagCreatorEmail(ghRepo, tag) {
   const ref = await run("gh", [
@@ -709,6 +844,38 @@ async function resolveImageDigest(ref) {
   const match = res.stdout.match(/^\s*Digest:\s*(sha256:[0-9a-f]{64})\s*$/m);
   return match?.[1];
 }
+async function classifyUnresolvedImage(ref, {
+  env = process.env,
+  fetchImpl = globalThis.fetch
+} = {}) {
+  const { checkImagePullability, credentialHintForRegistry } = await import("./check-image-pullability-2AIVB4BX.js");
+  const result = await checkImagePullability({ ref }, { fetchImpl, env });
+  if (result.classification === "unverified") {
+    return {
+      classification: "unavailable",
+      detail: `${ref}: ${result.error ?? `no credential was available to check it (${credentialHintForRegistry(result.registry)})`}`
+    };
+  }
+  if (result.classification === "drift") {
+    if (result.credentialOffered && (result.status === 401 || result.status === 403)) {
+      return {
+        classification: "authentication",
+        detail: `${ref}: registry rejected the credential it was offered (HTTP ${result.status}) \u2014 this proves the credential is bad, not that the image is missing`
+      };
+    }
+    if (result.status >= 500) {
+      return {
+        classification: "unavailable",
+        detail: `${ref}: registry returned a server error (HTTP ${result.status})`
+      };
+    }
+    return { classification: "missing", detail: `${ref}: registry returned HTTP ${result.status}` };
+  }
+  return {
+    classification: "unavailable",
+    detail: `${ref}: registry HEAD succeeded (HTTP ${result.status}) but docker buildx could not resolve a digest`
+  };
+}
 async function readProvenanceLabels(ref) {
   const { resolveImageLabels } = await import("./resolve-image-labels-N27XXTUG.js");
   return resolveImageLabels(ref, [
@@ -725,30 +892,93 @@ function loadDeployedState(filePath) {
   return JSON.parse(readFileSync(filePath, "utf8"));
 }
 function unsampledPinnedServices(specs, deployed) {
-  return specs.filter((spec) => spec.origin !== "upstream-pinned" && spec.ghRepo && spec.releaseLane !== "none").filter((spec) => {
+  return specs.filter(
+    (spec) => spec.origin !== "upstream-pinned" && spec.ghRepo && isReleaseLaneWired(spec, { releaseLaneWired: deriveReleaseLaneWiring(spec) === true })
+  ).filter((spec) => {
     const entry = deployed[spec.key];
     if (entry?.ref) return false;
     if (entry?.absent) return false;
     return true;
   }).map((spec) => spec.key);
 }
+async function checkReleaseGatePassed(ghRepo, workflowFile, tagCommit, latestTag) {
+  if (!workflowFile) {
+    return {
+      classification: "unverified",
+      detail: `no producer workflow is identified for ${ghRepo} (releaseWorkflowFile unset in the service roster). Matching runs by NAME (e.g. anything matching /release/i) is not provenance \u2014 this org has multiple workflows whose names match that pattern in the same repository. Identify the exact .github/workflows file that publishes this service's artifact and set releaseWorkflowFile before this can be verified.`
+    };
+  }
+  const res = await runWithDiagnostics("gh", [
+    "api",
+    `repos/${ghRepo}/actions/workflows/${encodeURIComponent(workflowFile)}/runs?head_sha=${tagCommit}&per_page=100`
+  ]);
+  if (!res.ok) {
+    return {
+      classification: "unverified",
+      detail: `could not query GitHub Actions runs for ${ghRepo}'s ${workflowFile}@${tagCommit}: ${res.error ?? "gh api call failed"}. Likely missing credential: gh CLI auth (GH_TOKEN / GH_PAT) with 'actions:read' on ${ghRepo} \u2014 or ${workflowFile} does not exist in ${ghRepo} at all (roster drift).`
+    };
+  }
+  let runs;
+  try {
+    const parsed = JSON.parse(res.stdout || "{}");
+    runs = parsed.workflow_runs ?? [];
+  } catch {
+    return {
+      classification: "unverified",
+      detail: `GitHub Actions API returned unparseable output for ${ghRepo}'s ${workflowFile}@${tagCommit}.`
+    };
+  }
+  if (runs.length === 0) {
+    return {
+      classification: "no-run-found",
+      detail: `no run of ${workflowFile} (the producer workflow for ${ghRepo}) was found at commit ${tagCommit} (tag ${latestTag}). An image with no producer run behind it cannot be attributed to a release that passed anything.`
+    };
+  }
+  const succeeded = runs.some((r) => r.status === "completed" && r.conclusion === "success");
+  if (succeeded) {
+    return {
+      classification: "passed",
+      detail: `${workflowFile} (${ghRepo}) concluded successfully for commit ${tagCommit}.`
+    };
+  }
+  const newest = runs[0];
+  return {
+    classification: "gate-failed",
+    detail: `${workflowFile} (${ghRepo}, event=${newest.event ?? "unknown"}) for commit ${tagCommit} (tag ${latestTag}) did not conclude successfully (status=${newest.status ?? "unknown"}, conclusion=${newest.conclusion ?? "n/a"}${newest.html_url ? `, ${newest.html_url}` : ""}).`
+  };
+}
 async function gatherFacts(spec, previous, deployed) {
   const facts = {
     previousImageRef: previous[spec.key],
     // An `{ absent: true }` marker records that the host is NOT running this
     // service. It is an answer to the coverage question, not an image, so it
     // must not flow into the deployed-provenance guards as one.
-    deployed: deployed[spec.key]?.ref ? deployed[spec.key] : void 0
+    deployed: deployed[spec.key]?.ref ? deployed[spec.key] : void 0,
+    // Derived from the repo's own release descriptor, never asserted (bug
+    // 61e7096e) — see `deriveReleaseLaneWiring` and `isReleaseLaneWired`.
+    releaseLaneWired: deriveReleaseLaneWiring(spec)
   };
-  if (spec.origin === "upstream-pinned" || !spec.ghRepo || spec.releaseLane === "none") return facts;
+  if (spec.origin === "upstream-pinned" || !spec.ghRepo || !isReleaseLaneWired(spec, facts)) return facts;
   facts.latestTag = await fetchLatestTag(spec.ghRepo);
   if (!facts.latestTag) return facts;
   facts.tagCommit = await resolveTagCommit(spec.ghRepo, facts.latestTag);
   if (!facts.tagCommit) return facts;
   const source = spec.sourceImageName ?? spec.imageName;
   const commitSource = spec.commitImageName ?? source;
-  facts.digestByCommit = await resolveImageDigest(`${commitSource}:sha-${facts.tagCommit}`);
-  facts.digestByTag = await resolveImageDigest(`${source}:${facts.latestTag}`);
+  const commitRef = `${commitSource}:sha-${facts.tagCommit}`;
+  facts.digestByCommit = await resolveImageDigest(commitRef);
+  if (!facts.digestByCommit) facts.digestByCommitClassification = await classifyUnresolvedImage(commitRef);
+  const tagRef = `${source}:${facts.latestTag}`;
+  facts.digestByTag = await resolveImageDigest(tagRef);
+  if (!facts.digestByTag) facts.digestByTagClassification = await classifyUnresolvedImage(tagRef);
+  if (facts.digestByCommit || facts.digestByTag) {
+    facts.releaseGateStatus = await checkReleaseGatePassed(
+      spec.ghRepo,
+      spec.releaseWorkflowFile,
+      facts.tagCommit,
+      facts.latestTag
+    );
+  }
   const resolved = facts.digestByCommit ?? facts.digestByTag;
   if (!resolved) return facts;
   facts.labels = await readProvenanceLabels(
@@ -941,8 +1171,11 @@ if (isMainModule(import.meta.url) && process.argv[1]?.includes("stack-generate-m
   });
 }
 export {
+  checkReleaseGatePassed,
+  classifyUnresolvedImage,
   commitIsAncestorOfTag,
   deployedTagIsOurRelease,
+  deriveReleaseLaneWiring,
   fetchLatestTag,
   fetchReleaseTags,
   gatherFacts,