@askexenow/exe-os 0.9.384 → 0.9.389

package/src/commands/exe.md

@@ -1,12 +1,19 @@
 ---
 description: Boot the COO with organizational status brief
-allowed-tools: Bash, AskUserQuestion, Write, Read, Edit, Glob, Grep, recall_my_memory, ask_team_memory, get_session_context, store_memory, create_task, resume_employee
+allowed-tools: Bash, AskUserQuestion, Write, Read, Edit, Glob, Grep, recall_my_memory, ask_team_memory, get_session_context, store_memory, create_task
 ---
 
 > Compact boot skill (feature fb5138fd). Banners, first-boot guide, and extended
 > rationale live in `~/.claude/skills/exe/reference.md` — read on demand, never at boot.
 
-## tmux gate (mandatory)
+## Session-identity gate (mandatory)
+
+The COORDINATOR'S OWN session still needs a stable name: the boot script, task
+scoping and every `session_scope` filter derive the coordinator session id from
+the terminal multiplexer. That is session IDENTITY, not orchestration — nothing
+here dispatches anyone. PR-B replaces it with the subagent ledger; until then the
+gate stays, because a coordinator without a resolvable session writes tasks nobody
+can scope.
 
 ```bash
 # Robust tmux detection — handles su/sudo login shells (env vars stripped)
@@ -45,19 +52,13 @@ Route by role.
 3. **Design / content / marketing** → the configured CMO (content, social media,
    slide design, brand, SEO/AEO, visual assets — NOT code, architecture, debugging).
 
-**Dispatch — stop at the lowest rung that fits:** (1) do it yourself; (2) **named
-subagent = the DEFAULT** for delegation — `Agent(subagent_type: "<employee>")`
-wears that identity, worktree for code, cap 2-3; persist results into a default
-`create_task` checklist row + memory before finishing.
-(3) **`create_task(execution_mode="durable_tmux")` → tmux = LEGACY**, only for
-work outliving this session or spanning sessions/projects — the ONLY tmux path,
-never spawn manually. Only this explicit mode auto-dispatches — do NOT manually
-run `exe-dispatch.js` after (causes double intercoms). Parse the dispatch status
-from its output:
-- `Dispatched: spawned {sessionName}` → "Dispatched to {sessionName} — booting up."
-- `Dispatched: intercom sent` → "Dispatched — already working, notified."
-- `Dispatch failed: {error}` → report the error; do NOT tell the founder to open
-  a session manually.
+**Dispatch — two rungs, stop at the lower one that fits:** (1) do it yourself;
+(2) **named subagent — the ONLY delegation path** — `Agent(subagent_type: "<employee>")`
+wears that identity, worktree isolation for code, cap 2-3 concurrent. Brief it with
+a file fence, acceptance criteria and the guardrails; read its result rather than
+trusting its summary; persist that result into a `create_task` checklist row +
+memory before you finish. There is no background-session rung: `create_task` is a
+durable checklist row and never dispatches anyone.
 
 Multi-phase work: CTO task = technical phase only; separate task for the CMO.
 Deliverables go to `exe/output/` (e.g. "Write analysis to exe/output/repo-audit.md"),
@@ -65,9 +66,9 @@ and the CMO reads from `exe/output/` where those technical deliverables were lef
 
 ## Task rules
 
-- **When rung 3 applies, `create_task(execution_mode="durable_tmux")` is the
-  only way to assign it.** Never modify an in-progress task (race conditions).
-  Scope change / added work? Create a NEW task — the employee auto-chains to it.
+- **`create_task` records the work; `Agent(subagent_type: "<employee>")` does it.**
+  Never modify an in-progress task (race conditions). Scope change / added work?
+  Create a NEW task row and brief a new subagent against it.
 - **`close_task`** only when you are acting as reviewer/coordinator finalizing
   a reviewed task — employees report done via `update_task`, which is
   low-level: status transitions and edge cases only.
@@ -76,16 +77,6 @@ and the CMO reads from `exe/output/` where those technical deliverables were lef
 - After employees finish: pull their work via `ask_team_memory`, verify (tests
   run? is it what was asked?), present results to the founder.
 
-## Context-full intercom
-
-On `context-full: <name> hit capacity. Checkpoint saved. Resume task <task-id>.`:
-1. `tmux kill-session -t <name>-<coordinator-session>`
-2. Call the `resume_employee` MCP tool: `{ agent_id: "<name>", project_name: "<project>" }`
-   — the only dedupe-safe path; it auto-dispatches. NEVER `create_task` with a
-   `RESUME:` title (bypasses dedupe, accumulates phantom rows).
-3. Report: "<Name> hit context capacity mid-task. Killed and relaunched — will
-   resume from checkpoint."
-
 ## Review chaining (mandatory)
 
 After completing a review (or batch of reviews), re-check for new reviews:

package/stack.release.json

@@ -4,23 +4,23 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.383",
-  "image": "ghcr.io/askexe/exe-os:v0.9.383",
+  "version": "0.9.389",
+  "image": "ghcr.io/askexe/exe-os:v0.9.389",
   "imageEnv": "EXE_OS_IMAGE_TAG",
-  "imageDigestTodo": "TODO(bug 32d6e02f), NARROWED by bug 81ca8903. The top-level `image` is tag-only BY CONSTRUCTION and that is correct: it names the tag the release run is about to build, whose digest does not exist until the push (see the 'Cross-check built digest against the manifest pin' step in .github/workflows/release-stack-image.yml). Demanding a digest here is unsatisfiable, which is why this TODO kept surviving. The one genuinely resolvable case it also covered — components.erp, built in a DIFFERENT repo and therefore already sitting in the registry — is now resolved and digest-pinned below. What remains open is ONLY components.dashboard, and not for the reason this TODO claimed: ghcr.io/askexe/exe-dashboard:v0.9.372 DOES NOT EXIST. .github/workflows/release-dashboard-image.yml has produced exactly one run in its lifetime (id 32405074431, 2026-08-20, tag v0.9.374) and that run FAILED, so the dashboard release lane has never emitted a single v* tag — the only refs in ghcr.io/askexe/exe-dashboard are the floating :main and :sha-<sha> dev refs from dashboard-image.yml. The dashboard pin is therefore a PHANTOM, not an unresolved digest, and it is deliberately left tag-only here rather than silently repointed at a :main digest, because choosing which dashboard bytes constitute a release is a release decision, not a lint fix. FAIL-CLOSED still holds and is enforced where it bites: scripts/publish-stack-release.mjs verifyServicePin() refuses to publish any tag-only app image into the customer manifest.",
+  "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
     "erp": {
       "image": "ghcr.io/askexe/exe-erp:v0.3.4@sha256:7e21680fdb2bf488010edbbd5cc09dcc15fa677f466326c35e1439b1c5f8a820",
       "env": "ERP_IMAGE_TAG",
       "composeService": "exe-erp",
-      "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` — a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
+      "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` \u2014 a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
     },
     "dashboard": {
-      "image": "ghcr.io/askexe/exe-dashboard:v0.9.383",
+      "image": "ghcr.io/askexe/exe-dashboard:v0.9.382@sha256:43c4eb52d89d977021d29df73bcfa6f9d769ab4debf90e81240b59a4c165bab0",
       "env": "DASHBOARD_IMAGE_TAG",
       "composeService": "exe-dashboard",
-      "versionLockstep": true,
-      "note": "The customer dashboard served at dashboard.<apex> (credits, usage, API keys, billing). Built from THIS repo — context dashboard-page/, a static nginx image — by .github/workflows/release-dashboard-image.yml on a release tag, so it ships in lockstep with exe-os. `versionLockstep: true` is what now authorises bumpVersions() to rebase this tag: after bug 81ca8903 the rebase is opt-in per component instead of applying to everything. Before 2026-08-20 it was outside the release lane entirely: only .github/workflows/dashboard-image.yml built it, publishing floating :main / :sha-<sha> refs with no org.opencontainers.image.version, and no descriptor pinned it. Production consequently ran sha256:950699473914… from commit 1d5b69cffa8d (#703, 2026-08-13) — three builds stale — with nothing able to detect or correct it. OPEN (bug 81ca8903): that is STILL the situation. This tag is a phantom — see imageDigestTodo. The release lane exists but has never completed a run, so no v* dashboard image exists to pin. Fixing the lane is tracked separately; do not paper over it by pinning a :main digest here."
+      "versionLockstep": false,
+      "note": "Dashboard is independently versioned after the standalone repository handoff. Preserve the verified image already pinned by the customer stack until the first AskExe/exe-dashboard release passes provenance checks. Update this digest and current-image source mappings together at cutover; exe-os version bumps must not rewrite this tag."
     },
     "exe-db": {
       "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
@@ -47,13 +47,13 @@
       "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
       "composeService": "cloudflared",
       "category": "infra",
-      "note": "Bug 4948fc48: digest-pinned tunnel — no env override, managed in compose."
+      "note": "Bug 4948fc48: digest-pinned tunnel \u2014 no env override, managed in compose."
     },
     "exe-sso-edge": {
       "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
       "composeService": "exe-sso-edge",
       "category": "infra",
-      "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP — uses stock nginx:alpine."
+      "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP \u2014 uses stock nginx:alpine."
     },
     "exe-otel-collector": {
       "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
@@ -66,7 +66,7 @@
       "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
       "composeService": "gotrue",
       "category": "infra",
-      "note": "Bug 4948fc48: GoTrue auth backend — digest-pinned in compose."
+      "note": "Bug 4948fc48: GoTrue auth backend \u2014 digest-pinned in compose."
     }
   },
   "stackParticipation": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.383"
+  "sourceVersion": "0.9.389"
 }

package/dist/chunk-3B6FLNLV.js

@@ -1,30 +0,0 @@
-import {
-  SUPPORT_PRODUCTS,
-  isWellFormedCommit,
-  isWellFormedSupportId,
-  isWellFormedVersion
-} from "./chunk-ELEGH4DX.js";
-
-// src/lib/support-schemas.ts
-import { z } from "zod";
-var supportProductSchema = z.enum(SUPPORT_PRODUCTS);
-var supportIdSchema = z.string().refine(isWellFormedSupportId, {
-  message: "id must be a canonical UUID (8-4-4-4-12 hex) or an 8-character hex prefix"
-});
-var supportVersionSchema = z.string().refine(isWellFormedVersion, {
-  message: "version must look like 1.2.3 (optionally v-prefixed, optional -prerelease), max 40 chars"
-});
-var supportCommitSchema = z.string().refine(isWellFormedCommit, {
-  message: "commit must be a 7\u201340 character hex SHA"
-});
-var supportTaskIdSchema = z.string().refine(isWellFormedSupportId, {
-  message: "linked_task_id must be a canonical UUID or an 8-character hex prefix"
-});
-
-export {
-  supportProductSchema,
-  supportIdSchema,
-  supportVersionSchema,
-  supportCommitSchema,
-  supportTaskIdSchema
-};

package/dist/chunk-FXU7JOXK.js

@@ -1,6 +0,0 @@
-// src/types/memory.ts
-var EMBEDDING_DIM = 1024;
-
-export {
-  EMBEDDING_DIM
-};