@askexenow/exe-os 0.9.383 → 0.9.384

package/delivery/catalog.json

@@ -0,0 +1,1254 @@
+{
+  "schemaVersion": 1,
+  "contract": "ARC-1",
+  "note": "THE canonical inventory of every first-party source repository and artifact. Master plan exe/output/cicd-master-plan-2026-09-08.md section 6.1. src/lib/delivery-catalog.ts derives the three legacy hand-maintained lists from this file; scripts/check-delivery-catalog.mjs fails when they disagree in a way not recorded under legacyDivergences. This file carries NO timestamps: an unchanged inventory must hash identically so a no-op reconciliation cannot mint a new composition.",
+  "registryAliases": [
+    {
+      "canonical": "ghcr.io/askexe/exe-os",
+      "alias": "ghcr.io/askexe/exed",
+      "role": "commit-tag",
+      "reason": "release-stack-image.yml pushes the VERSION tag to ghcr.io/askexe/exe-os and the commit-addressed sha-<commit> tag to ghcr.io/askexe/exed from the same build. Master plan sequence 2 requires this be an explicit catalog mapping, not an implicit commit-tag lookup that silently resolves nothing."
+    },
+    {
+      "canonical": "ghcr.io/askexe/exe-os",
+      "alias": "update.askexe.com/askexe/exe-os",
+      "role": "pull-through",
+      "reason": "The customer stack pulls through update.askexe.com. A digest is registry-independent, so the bytes are identical; only the source registry carries the tags and labels that prove provenance."
+    }
+  ],
+  "repositories": [
+    {
+      "id": 1181656281,
+      "name": "AskExe/exe-os",
+      "defaultBranch": "main",
+      "releaseAdapter": "container",
+      "ownerRole": "cto",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "typecheck",
+        "unit",
+        "image-identity",
+        "scan"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release-stack-image.yml",
+          "workflowId": 274190265,
+          "name": "Release stack image",
+          "state": "active",
+          "purpose": "release"
+        },
+        {
+          "path": ".github/workflows/publish.yml",
+          "name": "Publish to npm",
+          "state": "active",
+          "purpose": "release"
+        },
+        {
+          "path": ".github/workflows/release-dashboard-image.yml",
+          "workflowId": 338670900,
+          "name": "Release dashboard image",
+          "state": "active",
+          "purpose": "release"
+        },
+        {
+          "path": ".github/workflows/release-service.yml",
+          "workflowId": 338790318,
+          "name": "Shared release contract (reusable)",
+          "state": "active",
+          "purpose": "reusable-lane"
+        }
+      ],
+      "note": "Publishes FOUR distinct release artifacts through THREE different workflows. The legacy lists record one workflow for the whole repository, which is why the npm tarball and the dashboard image have no traceable producer in any of them."
+    },
+    {
+      "id": 1218739164,
+      "name": "AskExe/exe-gateway",
+      "defaultBranch": "main",
+      "releaseAdapter": "container",
+      "ownerRole": "cto",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release-image.yml",
+          "workflowId": 274020481,
+          "name": "Release image",
+          "state": "disabled_manually",
+          "purpose": "release"
+        }
+      ],
+      "note": "ARC-1 pilot (plan sequence 1). Producer is named 'Release image', not 'Release stack image' like its siblings — a name pattern would not match it. Its live tags are calendar-stamped (v2026.08.07-<sha>-stamped) and cannot be ordered against askexe-vX.Y.Z; they map to a legacy epoch."
+    },
+    {
+      "id": 1210246600,
+      "name": "AskExe/exe-crm",
+      "defaultBranch": "main",
+      "releaseAdapter": "container",
+      "ownerRole": "cto",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release-stack-image.yml",
+          "workflowId": 274190278,
+          "name": "Release stack image",
+          "state": "active",
+          "purpose": "release"
+        }
+      ],
+      "note": "PROVEN UNTRUSTWORTHY PROVENANCE: image tag v0.9.54 was built from a different commit than git tag v0.9.54. No existing tag may be reused when this repo adopts ARC-1."
+    },
+    {
+      "id": 1257169247,
+      "name": "AskExe/exe-erp",
+      "defaultBranch": "main",
+      "releaseAdapter": "container",
+      "ownerRole": "cto",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan",
+        "migration-safety"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release-stack-image.yml",
+          "workflowId": 290691457,
+          "name": "Release stack image",
+          "state": "active",
+          "purpose": "release"
+        }
+      ],
+      "note": "Native amd64 only (plan sequence 7). One image runs four roles; irreversible migrations must never trigger generic auto-rollback."
+    },
+    {
+      "id": 1204431392,
+      "name": "AskExe/exe-wiki",
+      "defaultBranch": "master",
+      "releaseAdapter": "container",
+      "ownerRole": "cto",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release-stack-image.yml",
+          "workflowId": 274190292,
+          "name": "Release stack image",
+          "state": "active",
+          "purpose": "release"
+        }
+      ],
+      "note": "DEFAULT BRANCH IS master, verified against the GitHub API, not main. An Outline fork carrying inherited upstream tags that must never enter ARC-1 selection."
+    },
+    {
+      "id": 1233587946,
+      "name": "AskExe/exe-monitor",
+      "defaultBranch": "main",
+      "releaseAdapter": "container",
+      "ownerRole": "cto",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "scan"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release-stack-images.yml",
+          "workflowId": 274190320,
+          "name": "Release stack images",
+          "state": "disabled_manually",
+          "purpose": "release"
+        }
+      ],
+      "note": "Filename is release-stack-imageS.yml (plural) and the workflow is DISABLED — verified via the GitHub API. One workflow publishes both the hub and the agent image; one failed artifact blocks the release of both."
+    },
+    {
+      "id": 1240250368,
+      "name": "AskExe/exe-build",
+      "defaultBranch": "main",
+      "releaseAdapter": "binary",
+      "ownerRole": "cto",
+      "compatibilityGroup": "control-plane",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "checksum",
+        "platform-matrix"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release.yml",
+          "workflowId": 277639479,
+          "name": "Release",
+          "state": "active",
+          "purpose": "release"
+        },
+        {
+          "path": ".github/workflows/docker.yml",
+          "workflowId": 290422039,
+          "name": "Docker Build",
+          "state": "active",
+          "purpose": "release"
+        }
+      ],
+      "note": "Removed from the customer stack; runs on askexe-control-plane. Ships six binary targets plus an npm package and an image."
+    },
+    {
+      "id": 1273247286,
+      "name": "AskExe/exe-auth",
+      "defaultBranch": "main",
+      "releaseAdapter": "container",
+      "ownerRole": "cto",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan",
+        "sso-contract"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/ci.yml",
+          "workflowId": 298190652,
+          "name": "CI",
+          "state": "active",
+          "purpose": "release"
+        }
+      ],
+      "note": "Has NO dedicated release workflow — it publishes from ci.yml on a push:tags trigger. Verified via the GitHub API. Publishes ONLY to update.askexe.com; it is not mirrored to GHCR, so provenance is read from the one registry the artifact exists in."
+    },
+    {
+      "id": 1340595948,
+      "name": "AskExe/exe-dashboard",
+      "defaultBranch": "main",
+      "releaseAdapter": "internal",
+      "ownerRole": "cto",
+      "compatibilityGroup": "none",
+      "deployable": false,
+      "nonDeployableReason": "Extraction from exe-os dashboard-page/ is INCOMPLETE: this repository has ZERO Actions workflows (verified via the GitHub API), so it publishes nothing and cannot. The single active source of the dashboard image is AskExe/exe-os via .github/workflows/release-dashboard-image.yml. Registered explicitly, per plan sequence 8 and 11, so that 'both repos might publish the same package' is answered on the record rather than by silence. Flip this entry to a container adapter in the same PR that moves the caller workflow — never before, and never leaving both wired.",
+      "requiredSuites": [
+        "ci"
+      ],
+      "workflows": []
+    },
+    {
+      "id": 1259904143,
+      "name": "AskExe/exe-chat",
+      "defaultBranch": "main",
+      "releaseAdapter": "desktop",
+      "ownerRole": "cto",
+      "compatibilityGroup": "standalone",
+      "deployable": true,
+      "requiredSuites": [
+        "ci",
+        "signing",
+        "updater-manifest"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/tauri-release.yml",
+          "workflowId": 290180062,
+          "name": "Tauri Release",
+          "state": "disabled_manually",
+          "purpose": "release"
+        },
+        {
+          "path": ".github/workflows/release-readiness.yml",
+          "workflowId": 333252217,
+          "name": "Release Readiness",
+          "state": "disabled_manually",
+          "purpose": "gate"
+        }
+      ],
+      "note": "Both release lanes are DISABLED. macOS signing/notarization credentials belong to a separate trusted packaging service, distinct from the stack signing key."
+    },
+    {
+      "id": 1134969150,
+      "name": "AskExe/exe-create",
+      "defaultBranch": "main",
+      "releaseAdapter": "internal",
+      "ownerRole": "cto",
+      "compatibilityGroup": "none",
+      "deployable": false,
+      "nonDeployableReason": "No distributable exists and none is expected today: the repository has only ci.yml (verified via the GitHub API). Registered explicitly rather than omitted, per plan sequence 11 — silent omission is the defect this catalog removes. CI remains enforced. Adding a real customer artifact requires adding the appropriate adapter here in the same change.",
+      "requiredSuites": [
+        "ci"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/ci.yml",
+          "workflowId": 229613863,
+          "name": "CI",
+          "state": "active",
+          "purpose": "ci"
+        }
+      ]
+    }
+  ],
+  "artifacts": [
+    {
+      "componentId": "exe-os-npm",
+      "repository": "AskExe/exe-os",
+      "type": "npm-package",
+      "origin": "first-party",
+      "packageName": "@askexenow/exe-os",
+      "registry": "https://registry.npmjs.org",
+      "releaseWorkflow": ".github/workflows/publish.yml",
+      "environments": [
+        "customer-cli"
+      ],
+      "platforms": [],
+      "requiredSuites": [
+        "ci",
+        "typecheck",
+        "unit"
+      ],
+      "healthProbe": {
+        "type": "cli-version",
+        "command": "exe-os --version --json"
+      },
+      "legacy": {
+        "stackServiceKey": null,
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": null
+      },
+      "note": "The npm tarball is a first-class release artifact and appears in NONE of the three legacy lists. Its producer is publish.yml, not release-stack-image.yml — no legacy list records that. Per plan section 6.3 the stable dist-tag moves only after the corresponding stable promotion succeeds."
+    },
+    {
+      "componentId": "exe-os-core-image",
+      "repository": "AskExe/exe-os",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-os",
+      "commitRepository": "ghcr.io/askexe/exed",
+      "pullRepository": "update.askexe.com/askexe/exe-os",
+      "releaseWorkflow": ".github/workflows/release-stack-image.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack",
+        "askexe-update-service"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-os",
+          "role": "daemon",
+          "envVar": "EXE_OS_SERVER_IMAGE_TAG"
+        },
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-update",
+          "role": "updater",
+          "envVar": "EXE_OS_IMAGE_TAG"
+        },
+        {
+          "environment": "askexe-update-service",
+          "host": "update.askexe.com",
+          "role": "update-service"
+        }
+      ],
+      "envVar": "EXE_OS_IMAGE_TAG",
+      "required": true,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "url": "http://127.0.0.1:8765/health",
+        "verified": true
+      },
+      "legacy": {
+        "stackServiceKey": "exe-os",
+        "stackReleaseServiceKey": "exe-os",
+        "contractServiceId": "exe-os",
+        "manifestService": "exe-os",
+        "primary": true
+      },
+      "note": "One image, three deployments. The update service is a DEPLOYMENT of these bytes, not a separate artifact — inventing a fourth component would be the same duplication this catalog removes."
+    },
+    {
+      "componentId": "exe-os-worker-image",
+      "repository": "AskExe/exe-os",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-os-worker",
+      "pullRepository": "update.askexe.com/askexe/exe-os-worker",
+      "releaseWorkflow": ".github/workflows/release-stack-image.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-os-worker",
+          "role": "worker",
+          "envVar": "EXE_OS_WORKER_IMAGE_TAG"
+        }
+      ],
+      "envVar": "EXE_OS_WORKER_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "none",
+        "gap": "The worker exposes no liveness endpoint; compose has no healthcheck for it. Recorded as a gap, not waived."
+      },
+      "legacy": {
+        "stackServiceKey": "exe-os",
+        "stackReleaseServiceKey": "exe-os",
+        "contractServiceId": "exe-os",
+        "manifestService": "exe-os"
+      },
+      "note": "docker-compose.yml pins exe-os-worker from its OWN variable, EXE_OS_WORKER_IMAGE_TAG, which no legacy list carries — STACK_SERVICE_SPECS folds exe-os-worker into the core image's single EXE_OS_IMAGE_TAG pin. A separately-built worker image with no separate pin is the exact shape of the dashboard incident."
+    },
+    {
+      "componentId": "exe-dashboard-image",
+      "repository": "AskExe/exe-os",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-dashboard",
+      "pullRepository": "ghcr.io/askexe/exe-dashboard",
+      "releaseWorkflow": ".github/workflows/release-dashboard-image.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-dashboard",
+          "role": "web",
+          "envVar": "DASHBOARD_IMAGE_TAG"
+        }
+      ],
+      "envVar": "DASHBOARD_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "none",
+        "gap": "No real JSON health route exists yet; an SPA fallback must not be allowed to pass health (plan sequence 8)."
+      },
+      "legacy": {
+        "stackServiceKey": "dashboard",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": "dashboard",
+        "manifestService": "dashboard"
+      },
+      "note": "THE INCIDENT THIS CATALOG EXISTS FOR: built from exe-os dashboard-page/, absent from stack-release-repos.mjs entirely, and production ran a four-builds-stale image traceable only by luck. Source repository is AskExe/exe-os — NOT AskExe/exe-dashboard, which has no workflows at all."
+    },
+    {
+      "componentId": "exe-gateway-image",
+      "repository": "AskExe/exe-gateway",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-gateway",
+      "pullRepository": "update.askexe.com/askexe/exe-gateway",
+      "releaseWorkflow": ".github/workflows/release-image.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-gateway",
+          "role": "web",
+          "envVar": "GATEWAY_IMAGE_TAG"
+        }
+      ],
+      "envVar": "GATEWAY_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "url": "http://127.0.0.1:3100/health",
+        "verified": true
+      },
+      "legacy": {
+        "stackServiceKey": "gateway",
+        "stackReleaseServiceKey": "gateway",
+        "contractServiceId": "gateway",
+        "manifestService": "gateway"
+      }
+    },
+    {
+      "componentId": "exe-crm-image",
+      "repository": "AskExe/exe-crm",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-crm",
+      "pullRepository": "update.askexe.com/askexe/exe-crm",
+      "releaseWorkflow": ".github/workflows/release-stack-image.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-crm",
+          "role": "web",
+          "envVar": "CRM_IMAGE_TAG"
+        },
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-crm-worker",
+          "role": "worker",
+          "envVar": "CRM_IMAGE_TAG"
+        }
+      ],
+      "envVar": "CRM_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "url": "http://127.0.0.1:3000/healthz",
+        "verified": true
+      },
+      "legacy": {
+        "stackServiceKey": "crm",
+        "stackReleaseServiceKey": "crm",
+        "contractServiceId": "crm",
+        "manifestService": "crm"
+      }
+    },
+    {
+      "componentId": "exe-erp-image",
+      "repository": "AskExe/exe-erp",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-erp",
+      "pullRepository": "update.askexe.com/askexe/exe-erp",
+      "releaseWorkflow": ".github/workflows/release-stack-image.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-erp",
+          "role": "web",
+          "envVar": "ERP_IMAGE_TAG"
+        },
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-erp-websocket",
+          "role": "websocket",
+          "envVar": "ERP_IMAGE_TAG"
+        },
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-erp-queue",
+          "role": "worker",
+          "envVar": "ERP_IMAGE_TAG"
+        },
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-erp-scheduler",
+          "role": "scheduler",
+          "envVar": "ERP_IMAGE_TAG"
+        }
+      ],
+      "envVar": "ERP_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan",
+        "migration-safety"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "url": "http://127.0.0.1:8069/api/method/ping",
+        "host": "erp.askexe.com",
+        "statusField": "message",
+        "verified": true
+      },
+      "legacy": {
+        "stackServiceKey": "erp",
+        "stackReleaseServiceKey": "erp",
+        "contractServiceId": "erp",
+        "manifestService": "erp"
+      },
+      "note": "FOUR compose services share these bytes; the health probe targets the web role only. exe-erp-nginx does NOT run this image — it runs upstream nginx and is registered under upstream-nginx."
+    },
+    {
+      "componentId": "exe-wiki-image",
+      "repository": "AskExe/exe-wiki",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-wiki",
+      "pullRepository": "update.askexe.com/askexe/exe-wiki",
+      "releaseWorkflow": ".github/workflows/release-stack-image.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-wiki",
+          "role": "web",
+          "envVar": "WIKI_IMAGE_TAG"
+        }
+      ],
+      "envVar": "WIKI_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "url": "http://127.0.0.1:3001/api/ping",
+        "verified": true
+      },
+      "legacy": {
+        "stackServiceKey": "wiki",
+        "stackReleaseServiceKey": "wiki",
+        "contractServiceId": "wiki",
+        "manifestService": "wiki"
+      }
+    },
+    {
+      "componentId": "exe-monitor-hub-image",
+      "repository": "AskExe/exe-monitor",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-monitor-hub",
+      "pullRepository": "update.askexe.com/askexe/exe-monitor-hub",
+      "releaseWorkflow": ".github/workflows/release-stack-images.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-monitor-hub",
+          "role": "hub",
+          "envVar": "MONITOR_HUB_IMAGE_TAG"
+        }
+      ],
+      "envVar": "MONITOR_HUB_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "path": "/api/health",
+        "verified": false,
+        "gap": "Declared by the release contract but absent from the stack manifest, so no port is asserted here. A path with no observed probe is recorded as unverified, never as passing."
+      },
+      "legacy": {
+        "stackServiceKey": "monitorHub",
+        "stackReleaseServiceKey": "monitor-hub",
+        "contractServiceId": "monitor-hub",
+        "manifestService": "monitorHub"
+      },
+      "note": "Everything at or below v0.9.5 is provenance-unknown: v0.9.4 and v0.9.5 were hand-built from a workstation and v0.9.4 carries no labels at all. Those tags are never re-stamped."
+    },
+    {
+      "componentId": "exe-monitor-agent-image",
+      "repository": "AskExe/exe-monitor",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-monitor-agent",
+      "pullRepository": "update.askexe.com/askexe/exe-monitor-agent",
+      "releaseWorkflow": ".github/workflows/release-stack-images.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-monitor-agent",
+          "role": "agent",
+          "envVar": "MONITOR_AGENT_IMAGE_TAG"
+        }
+      ],
+      "envVar": "MONITOR_AGENT_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "none",
+        "gap": "Genuinely absent. The agent exposes no liveness endpoint and cannot safely expose HTTP; an authenticated heartbeat or CLI readiness check must be added before it can be marked conforming. Reported, never waived — 'it is only an agent' is the reasoning that left the dashboard unpinned."
+      },
+      "legacy": {
+        "stackServiceKey": "monitorAgent",
+        "stackReleaseServiceKey": "monitor-agent",
+        "contractServiceId": "monitor-agent",
+        "manifestService": "monitorAgent"
+      },
+      "note": "Second image out of the SAME repository and the SAME workflow as the hub. Hub and agent release together; one failed artifact blocks both."
+    },
+    {
+      "componentId": "exe-auth-image",
+      "repository": "AskExe/exe-auth",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "update.askexe.com/askexe/exe-auth",
+      "pullRepository": "update.askexe.com/askexe/exe-auth",
+      "releaseWorkflow": ".github/workflows/ci.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-auth",
+          "role": "web",
+          "envVar": "AUTH_IMAGE_TAG"
+        }
+      ],
+      "envVar": "AUTH_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan",
+        "sso-contract"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "url": "http://127.0.0.1:3300/",
+        "verified": true,
+        "note": "NOT /api/health — nginx.conf 404s that path deliberately so GoTrue's version string is not exposed. Probing /api/health cost a full production rollback on 2026-09-08."
+      },
+      "legacy": {
+        "stackServiceKey": "auth",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": "auth",
+        "manifestService": "auth"
+      },
+      "note": "The ONLY first-party image with no GHCR mirror: publish and pull are the same private registry. Absent from STACK_RELEASE_REPO_CONFIGS; it survives only via the STACK_RECONCILE_APP_IMAGE_REPOS escape list."
+    },
+    {
+      "componentId": "exe-build-image",
+      "repository": "AskExe/exe-build",
+      "type": "oci-image",
+      "origin": "first-party",
+      "publishRepository": "ghcr.io/askexe/exe-build",
+      "pullRepository": "update.askexe.com/askexe/exe-build",
+      "releaseWorkflow": ".github/workflows/docker.yml",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "askexe-control-plane"
+      ],
+      "deployments": [
+        {
+          "environment": "askexe-control-plane",
+          "host": "askexe-control-plane",
+          "role": "runtime"
+        }
+      ],
+      "envVar": "EXE_BUILD_IMAGE_TAG",
+      "required": false,
+      "requiredSuites": [
+        "ci",
+        "image-identity",
+        "scan"
+      ],
+      "healthProbe": {
+        "type": "none",
+        "gap": "Control-plane only; no customer-facing endpoint. No probe defined."
+      },
+      "legacy": {
+        "stackServiceKey": "exe-build",
+        "stackReleaseServiceKey": "exe-build",
+        "contractServiceId": null,
+        "manifestService": null
+      },
+      "note": "Removed from the customer stack. Its producer is docker.yml, NOT the release.yml that ships the binaries — the legacy lists name a single workflow per repo and so cannot express a repo with two producers."
+    },
+    {
+      "componentId": "exe-build-binaries",
+      "repository": "AskExe/exe-build",
+      "type": "binary",
+      "origin": "first-party",
+      "releaseAssetPrefix": "exe-",
+      "releaseWorkflow": ".github/workflows/release.yml",
+      "platforms": [
+        "linux/amd64",
+        "linux/arm64",
+        "darwin/arm64",
+        "darwin/amd64"
+      ],
+      "unverifiedPlatforms": [
+        {
+          "platform": "windows/amd64",
+          "reason": "Built on a GitHub-hosted windows-latest runner. The hardware list contains no owned Windows machine, so this is not native execution testing on owned hardware and must not be advertised as verified coverage."
+        },
+        {
+          "platform": "windows/arm64",
+          "reason": "Built on a GitHub-hosted windows-11-arm runner with reduced features (--no-default-features --features pdf). Same accounting as windows/amd64."
+        }
+      ],
+      "environments": [
+        "customer-cli"
+      ],
+      "requiredSuites": [
+        "ci",
+        "checksum",
+        "platform-matrix"
+      ],
+      "healthProbe": {
+        "type": "cli-version",
+        "command": "exe --version --json"
+      },
+      "legacy": {
+        "stackServiceKey": null,
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": null
+      },
+      "note": "Six advertised targets. Listed as verified only for the four built on owned or genuinely native lanes; the two Windows targets are recorded as advertised-but-unverified rather than dropped or silently promoted."
+    },
+    {
+      "componentId": "exe-chat-desktop",
+      "repository": "AskExe/exe-chat",
+      "type": "desktop-bundle",
+      "origin": "first-party",
+      "releaseAssetPrefix": "exe-chat-",
+      "releaseWorkflow": ".github/workflows/tauri-release.yml",
+      "platforms": [
+        "darwin/arm64",
+        "darwin/amd64"
+      ],
+      "unverifiedPlatforms": [
+        {
+          "platform": "linux/amd64",
+          "reason": "Advertised by the Tauri matrix but not validated on owned hardware."
+        },
+        {
+          "platform": "windows/amd64",
+          "reason": "No owned Windows host exists. A workflow name is not proof of a supported target."
+        }
+      ],
+      "environments": [
+        "customer-desktop"
+      ],
+      "requiredSuites": [
+        "ci",
+        "signing",
+        "updater-manifest"
+      ],
+      "healthProbe": {
+        "type": "none",
+        "gap": "Desktop bundle; readiness is installer and updater verification, not an endpoint."
+      },
+      "signed": true,
+      "legacy": {
+        "stackServiceKey": null,
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": null
+      },
+      "note": "Release lane is currently DISABLED. macOS signing/notarization credentials live in a separate trusted packaging service, never with the stack signing key."
+    },
+    {
+      "componentId": "upstream-pgvector",
+      "repository": null,
+      "type": "oci-image",
+      "origin": "upstream-pinned",
+      "pullRepository": "update.askexe.com/askexe/pgvector",
+      "pinnedImage": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-db",
+          "role": "database",
+          "envVar": "EXE_DB_IMAGE"
+        },
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-wiki-schema-guard",
+          "role": "migration-guard",
+          "envVar": "EXE_DB_IMAGE"
+        }
+      ],
+      "envVar": "EXE_DB_IMAGE",
+      "required": true,
+      "requiredSuites": [
+        "dependency-policy"
+      ],
+      "legacy": {
+        "stackServiceKey": "exe-db",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": "exe-db"
+      }
+    },
+    {
+      "componentId": "upstream-gotrue",
+      "repository": null,
+      "type": "oci-image",
+      "origin": "upstream-pinned",
+      "pullRepository": "update.askexe.com/askexe/gotrue",
+      "pinnedImage": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "gotrue",
+          "role": "auth",
+          "envVar": null
+        }
+      ],
+      "required": false,
+      "requiredSuites": [
+        "dependency-policy"
+      ],
+      "healthProbe": {
+        "type": "http",
+        "url": "http://127.0.0.1:9999/health",
+        "verified": true
+      },
+      "legacy": {
+        "stackServiceKey": "gotrue",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": "gotrue"
+      }
+    },
+    {
+      "componentId": "upstream-redis",
+      "repository": null,
+      "type": "oci-image",
+      "origin": "upstream-pinned",
+      "pullRepository": "update.askexe.com/askexe/redis",
+      "pinnedImage": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "redis",
+          "role": "cache",
+          "envVar": null
+        }
+      ],
+      "required": false,
+      "requiredSuites": [
+        "dependency-policy"
+      ],
+      "legacy": {
+        "stackServiceKey": "redis",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": "redis"
+      }
+    },
+    {
+      "componentId": "upstream-clickhouse",
+      "repository": null,
+      "type": "oci-image",
+      "origin": "upstream-pinned",
+      "pullRepository": "update.askexe.com/askexe/clickhouse-server",
+      "pinnedImage": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "clickhouse",
+          "role": "analytics",
+          "envVar": null
+        }
+      ],
+      "required": false,
+      "requiredSuites": [
+        "dependency-policy"
+      ],
+      "legacy": {
+        "stackServiceKey": "clickhouse",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": "clickhouse"
+      }
+    },
+    {
+      "componentId": "upstream-cloudflared",
+      "repository": null,
+      "type": "oci-image",
+      "origin": "upstream-pinned",
+      "pullRepository": "update.askexe.com/askexe/cloudflared",
+      "pinnedImage": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "cloudflared",
+          "role": "ingress",
+          "envVar": null
+        }
+      ],
+      "required": false,
+      "requiredSuites": [
+        "dependency-policy"
+      ],
+      "legacy": {
+        "stackServiceKey": "cloudflared",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": "cloudflared"
+      }
+    },
+    {
+      "componentId": "upstream-nginx",
+      "repository": null,
+      "type": "oci-image",
+      "origin": "upstream-pinned",
+      "pullRepository": "update.askexe.com/askexe/nginx",
+      "pinnedImage": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-sso-edge",
+          "role": "edge-proxy",
+          "envVar": null
+        },
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-erp-nginx",
+          "role": "erp-proxy",
+          "envVar": null
+        }
+      ],
+      "required": false,
+      "requiredSuites": [
+        "dependency-policy"
+      ],
+      "legacy": {
+        "stackServiceKey": "exe-sso-edge",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": "exe-sso-edge"
+      },
+      "note": "TWO compose services run these identical upstream bytes. STACK_SERVICE_SPECS lists exe-erp-nginx under the ERP entry, which makes ERP's coverage look complete while attributing an upstream nginx container to a first-party image. Recorded under legacyDivergences."
+    },
+    {
+      "componentId": "upstream-otel-collector",
+      "repository": null,
+      "type": "oci-image",
+      "origin": "upstream-pinned",
+      "pullRepository": "update.askexe.com/askexe/otel-collector-contrib",
+      "pinnedImage": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "environments": [
+        "customer-stack"
+      ],
+      "deployments": [
+        {
+          "environment": "customer-stack",
+          "composeService": "exe-otel-collector",
+          "role": "telemetry",
+          "envVar": "OTEL_COLLECTOR_IMAGE"
+        }
+      ],
+      "envVar": "OTEL_COLLECTOR_IMAGE",
+      "required": false,
+      "requiredSuites": [
+        "dependency-policy"
+      ],
+      "legacy": {
+        "stackServiceKey": "exe-otel-collector",
+        "stackReleaseServiceKey": null,
+        "contractServiceId": null,
+        "manifestService": "exe-otel-collector"
+      }
+    }
+  ],
+  "legacyDivergences": [
+    {
+      "list": "STACK_SERVICE_SPECS",
+      "subject": "auth",
+      "field": "healthUrl",
+      "reason": "STACK_SERVICE_SPECS still probes /api/health. exe-auth 404s that path DELIBERATELY — nginx.conf adds an exact location so GoTrue version strings are not exposed — and probing it triggered the all-or-nothing production rollback of 2026-09-08 that reverted ERP, CRM, wiki and exe-os along with auth. CONTRACT_SERVICES was corrected to / ; STACK_SERVICE_SPECS was not. The catalog carries the verified value (/ -> 200).",
+      "retiredBy": "ARC-1 Track: retire STACK_SERVICE_SPECS in favour of deriveStackServiceSpecs(). Until then this list is stale and the catalog is authoritative."
+    },
+    {
+      "list": "STACK_SERVICE_SPECS",
+      "subject": "erp",
+      "field": "composeServices",
+      "reason": "STACK_SERVICE_SPECS attributes exe-erp-nginx to the ERP image. Compose runs it from upstream nginx:alpine pinned inline, not from ERP_IMAGE_TAG. The legacy attribution makes ERP coverage look complete while an upstream container is counted as first-party bytes.",
+      "retiredBy": "Same retirement as above; the catalog registers exe-erp-nginx under upstream-nginx where it actually belongs."
+    },
+    {
+      "list": "STACK_SERVICE_SPECS",
+      "subject": "exe-sso-edge",
+      "field": "composeServices",
+      "reason": "The mirror of the erp divergence: two compose services (exe-sso-edge and exe-erp-nginx) run the identical upstream nginx bytes, and only one is listed. A single dependency-policy bump must move both.",
+      "retiredBy": "Same retirement as above."
+    },
+    {
+      "list": "STACK_SERVICE_SPECS",
+      "subject": "exe-build",
+      "field": "releaseWorkflowFile",
+      "reason": "STACK_SERVICE_SPECS names release.yml as the producer of the exe-build IMAGE. Verified via the GitHub API and the workflow source: release.yml builds the six binary targets, and docker.yml (line 153) is what pushes ghcr.io/askexe/exe-build. The legacy shape allows one workflow per repository and so cannot express a repository with two producers.",
+      "retiredBy": "Same retirement as above; the catalog splits exe-build-image and exe-build-binaries."
+    },
+    {
+      "list": "STACK_SERVICE_SPECS",
+      "subject": "exe-build",
+      "field": "sourceImageName",
+      "reason": "The legacy entry carries no sourceImageName, so provenance would be read from the pull-through proxy rather than from ghcr.io where the build actually published and where the tags and labels live. Verified in docker.yml line 153.",
+      "retiredBy": "Same retirement as above."
+    },
+    {
+      "list": "STACK_RELEASE_REPO_CONFIGS",
+      "subject": "monitor-hub",
+      "field": "releaseWorkflow",
+      "reason": "The file is release-stack-imageS.yml (plural, workflow id 274190320, currently disabled_manually) — verified via the GitHub API. STACK_RELEASE_REPO_CONFIGS names the singular release-stack-image.yml, which does not exist in AskExe/exe-monitor, so any gate querying it resolves nothing and cannot fail loudly.",
+      "retiredBy": "ARC-1 Track: retire STACK_RELEASE_REPO_CONFIGS in favour of deriveStackReleaseRepoConfigs()."
+    },
+    {
+      "list": "STACK_RELEASE_REPO_CONFIGS",
+      "subject": "monitor-agent",
+      "field": "releaseWorkflow",
+      "reason": "Same wrong filename as monitor-hub; both images come from the same plural-named workflow.",
+      "retiredBy": "Same retirement as monitor-hub."
+    },
+    {
+      "list": "STACK_RELEASE_REPO_CONFIGS",
+      "subject": "exe-build",
+      "field": "releaseWorkflow",
+      "reason": "STACK_RELEASE_REPO_CONFIGS names release-stack-image.yml, which does not exist in AskExe/exe-build at all (its workflows are ci.yml, docker.yml, release.yml, python-smoke.yml, windows-smoke.yml, auto-retry-classified.yml — verified via the GitHub API). The image producer is docker.yml.",
+      "retiredBy": "Same retirement as monitor-hub."
+    },
+    {
+      "list": "CONTRACT_SERVICES",
+      "subject": "dashboard",
+      "field": "ghRepo",
+      "reason": "CONTRACT_SERVICES points dashboard at AskExe/exe-dashboard on the assumption the extraction completed. It has not: that repository has ZERO Actions workflows (verified via the GitHub API), so it publishes nothing. The single active source is AskExe/exe-os via release-dashboard-image.yml. Plan sequence 8 requires exactly one active source and forbids two publishers for one package; the catalog states which one it is.",
+      "retiredBy": "Plan sequence 8: flip the catalog repository entry and this field together in the PR that moves the caller workflow to AskExe/exe-dashboard — never separately."
+    },
+    {
+      "list": "CONTRACT_SERVICES",
+      "subject": "dashboard",
+      "field": "healthPath",
+      "reason": "CONTRACT_SERVICES declares /health, but no real JSON health route exists yet — plan sequence 8 lists baking one as outstanding work, and warns an SPA fallback must not be allowed to pass health. A declared path with nothing behind it is what lets a stale dashboard look healthy, so the catalog records the gap instead.",
+      "retiredBy": "Plan sequence 8: set healthProbe when the JSON health route ships."
+    }
+  ]
+}