@askexenow/exe-os 0.9.389 → 0.9.390

package/deploy/stack-manifests/v0.9.json

@@ -4217,11 +4217,154 @@
         }
       },
       "rolloutStage": "canary"
+    },
+    "0.9.48": {
+      "version": "0.9.48",
+      "releasedAt": "2026-09-22T19:52:27.677Z",
+      "npmVersion": "0.9.389",
+      "notes": "Authenticated config-only canary from stack 0.9.47. Deliver the reviewed SSO edge redirect fix using exe-os v0.9.389 config apply: the signed release covers the exact packaged compose template and every packaged bind-mounted config asset. Preserve every image pin from 0.9.47; no image movement is authorized. Apply only after registry tarball integrity and installed updater bytes are verified, with backups, strict dependency-ordered health checks, and rollback.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.62@sha256:584113f88ce09f5ea3b93b7b5e8960ebb8a00e34adaa205c92d964b46525b7a8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "60f8f08faa5d8fe86b92a87eda93eb0d051a6353",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.391@sha256:272f3440fa0f93bd19b3a0b53983c488d90b9731f252a1fb9120c9516566b4a5",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "ce76474b7af9476846549a5ae2eb272dc182e9cf"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "4a648434eef4f194de15cc742684dfd3220be2334035333257dd37faa4828b3d",
+        "assets": {
+          "sso-edge/default.conf.template": "fac3627a51989bbb62b8cba1f2dfd4aab69555b998fd48c0a1a67deb5889f29f",
+          "sso-edge/entrypoint.sh": "2281fc9382ee1f80dbf306a380d165d0afe1fcc37f5b752925e34f5a06419ce9",
+          "sso-edge/error-pages/404.html": "d9a163356479204cf0c200d1cf483a986d3ef4c46c53e02d97bfe128d25e833f",
+          "sso-edge/error-pages/500.html": "82972c5fbb237047f532c95d8757a2bcc696ca9466e70c73debf64e8b58689a7",
+          "sso-edge/error-pages/503.html": "58f73f74cabff1a8faa63b11af36aa643c78ac740c9a31378f8a8ee6aa572cf8",
+          "sso-edge/sso-redirect.conf": "d9e1036ba2129450372caff3f09d5ad8894b3b774ab50fe0807322e0f8896d7b",
+          "erp-nginx/nginx.conf": "918d3e3b9c854c3c2bfefaab48ea4e41c4430dd92429e9f035676783d7136ab7",
+          "observability/otel-collector-config.yaml": "01fcd1192e695455fdf85029e60074bee96ff9565da05f4c01b3428b264fe4d5",
+          "cloudflared/config.yml.example": "c60e28c67d8c13e54d4d15f4a79ed3f4ad8723f6345138b084a1925c871b529a"
+        }
+      }
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "X/Du82ErExS0sQRLflix8CLUhHLEqGC6QAYxsUT0o/1HUPOhJhM4KiY64sB/zXN9eK6EcYOxtFjyyn2Lyq0nAg=="
+    "signature": "tyRpYIwHzjT4eixgdAqouFG/9rNSBi9QG0lwOkDgCYlxlr7FHePfIW/2s/DiR35f4eUsIJjJWUJltbhe8Nv8Dw=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-22T20:51:50.033Z",
-  "manifest_sha256": "3405a6349892bd3f95a497ecce5aa6d6cf25376f6dd35a7eb24a82e50c463d6f",
-  "package_version": "0.9.389"
+  "verified_at": "2026-09-23T01:55:53.298Z",
+  "manifest_sha256": "adc75c50c1588490f5f4f0fdeadc2197fe248394ad1dd56f5a4766693ad7af93",
+  "package_version": "0.9.390"
 }

package/dist/bin/cli.js

@@ -792,14 +792,14 @@ ${JSON.stringify(stormAlert, null, 2)}`);
   const { runStackUpdateCli } = await import("./stack-update.js");
   await runStackUpdateCli(args.slice(1));
 } else if (args[0] === "release") {
-  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-2CXFYVWM.js");
+  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-RQ2DYYD5.js");
   const releaseFlags = parseReleaseArgs(args.slice(1));
   await runStackRelease(releaseFlags);
 } else if (args[0] === "stack-promote") {
-  const { runStackPromoteCli } = await import("../stack-promote-6N23OGZY.js");
+  const { runStackPromoteCli } = await import("../stack-promote-DFXJDHVA.js");
   await runStackPromoteCli(args.slice(1));
 } else if (args[0] === "stack-generate-manifest") {
-  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-AXI55MEQ.js");
+  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-VWNDIMZ2.js");
   process.exit(await runStackGenerateManifestCli(args.slice(1)));
 } else if (args[0] === "repo-truth") {
   const { runRepoTruthCli } = await import("./exe-repo-truth.js");

package/dist/bin/registry-proxy.js

@@ -2,7 +2,7 @@
 import {
   registryProxyOptionsFromEnv,
   runRegistryProxy
-} from "../chunk-PZR54BEI.js";
+} from "../chunk-YI4D6E75.js";
 import {
   isMainModule
 } from "../chunk-6Y4B3QF6.js";

package/dist/bin/stack-update.js

@@ -35,8 +35,9 @@ import {
   serviceSelectionPath,
   verifyComposeServicesRunning,
   verifyManifestImagesAvailable,
-  warnUnmanagedManifestServices
-} from "../chunk-UWVXQEQQ.js";
+  warnUnmanagedManifestServices,
+  withStackUpdateOperationLock
+} from "../chunk-DZPSBA4B.js";
 import "../chunk-EC5H53YD.js";
 import {
   runVerifyStack
@@ -52,7 +53,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-J4UVI652.js";
+} from "../chunk-WQN2XK4V.js";
 import "../chunk-L25OAFOU.js";
 import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
@@ -566,7 +567,7 @@ if (process.argv[1]?.endsWith("preflight.ts") || process.argv[1]?.endsWith("pref
 // src/lib/stack-config-update.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { createHash } from "crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync, readFileSync as readFileSync2, readdirSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { chmodSync, chownSync, existsSync as existsSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync2, mkdtempSync, readFileSync as readFileSync2, readdirSync, renameSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
 import path2 from "path";
 function computeConfigDigest(raw) {
@@ -587,6 +588,130 @@ function collectConfigAssetDigests(configDir, subdirs = CONFIG_ASSET_DIRS) {
   return digests;
 }
 var CONFIG_ASSET_DIRS = ["sso-edge", "erp-nginx", "observability", "cloudflared"];
+function assertSafeAssetRelativePath(rel) {
+  if (!rel || path2.isAbsolute(rel) || rel.includes("\\") || path2.posix.normalize(rel) !== rel || rel.startsWith("../") || rel.includes("/../")) {
+    throw new Error(`Targeted config asset path is not a canonical relative path: ${rel}`);
+  }
+  const root = rel.split("/")[0];
+  if (!CONFIG_ASSET_DIRS.includes(root)) {
+    throw new Error(`Targeted config asset is outside the canonical asset roots: ${rel}`);
+  }
+}
+function assertNoSymlinkPath(root, rel, requireLeaf) {
+  let current = root;
+  for (const [index, part] of rel.split("/").entries()) {
+    current = path2.join(current, part);
+    if (!existsSync2(current)) {
+      if (requireLeaf || index < rel.split("/").length - 1) throw new Error(`Targeted config asset path is missing: ${current}`);
+      continue;
+    }
+    const st = lstatSync2(current);
+    if (st.isSymbolicLink()) throw new Error(`Targeted config asset path traverses a symlink: ${current}`);
+    if (index === rel.split("/").length - 1) {
+      if (!st.isFile()) throw new Error(`Targeted config asset is not a regular file: ${current}`);
+      if (st.nlink !== 1) throw new Error(`Targeted config asset has unexpected hard links: ${current}`);
+    } else if (!st.isDirectory()) {
+      throw new Error(`Targeted config asset parent is not a directory: ${current}`);
+    }
+  }
+}
+function validateTargetedAssetPatches(input) {
+  if (input.config.composeSha256 || input.config.assets) {
+    throw new Error("Signed config assetPatches are mutually exclusive with composeSha256/assets");
+  }
+  const entries = Object.entries(input.config.assetPatches ?? {});
+  if (entries.length === 0) throw new Error("Signed config assetPatches is empty");
+  const normalized = /* @__PURE__ */ new Set();
+  return entries.sort(([a], [b]) => a.localeCompare(b)).map(([rel, patch]) => {
+    assertSafeAssetRelativePath(rel);
+    const norm = path2.posix.normalize(rel);
+    if (normalized.has(norm)) throw new Error(`Duplicate normalized targeted asset path: ${rel}`);
+    normalized.add(norm);
+    if (!/^[a-f0-9]{64}$/.test(patch.fromSha256) || !/^[a-f0-9]{64}$/.test(patch.toSha256)) {
+      throw new Error(`Targeted config asset hashes must be lowercase sha256: ${rel}`);
+    }
+    if (patch.fromSha256 === patch.toSha256) throw new Error(`Targeted config asset transition must change bytes: ${rel}`);
+    if (patch.mode !== void 0 && (!Number.isInteger(patch.mode) || patch.mode < 0 || patch.mode > 4095)) {
+      throw new Error(`Targeted config asset mode is outside 0000..7777: ${rel}`);
+    }
+    const consumers = [...new Set(patch.consumers)].sort();
+    if (consumers.length === 0 || consumers.length !== patch.consumers.length || consumers.some((v) => !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(v))) {
+      throw new Error(`Targeted config asset consumers are invalid or duplicated: ${rel}`);
+    }
+    const source = path2.join(input.packagedRoot, rel);
+    const target = path2.join(input.liveRoot, rel);
+    assertNoSymlinkPath(input.packagedRoot, rel, true);
+    assertNoSymlinkPath(input.liveRoot, rel, true);
+    const sourceHash = computeConfigDigest(readFileSync2(source));
+    const targetHash = computeConfigDigest(readFileSync2(target));
+    if (sourceHash !== patch.toSha256) throw new Error(`Packaged targeted asset does not match signed target hash: ${rel}`);
+    if (targetHash !== patch.fromSha256 && targetHash !== patch.toSha256) throw new Error(`Live targeted asset does not match signed base or target hash: ${rel}`);
+    return {
+      rel,
+      packagedRoot: input.packagedRoot,
+      liveRoot: input.liveRoot,
+      source,
+      target,
+      ...patch,
+      consumers,
+      state: targetHash === patch.toSha256 ? "to" : "from"
+    };
+  });
+}
+function assertTargetedAssetConsumers(patches, renderedConfigJson, liveRoot) {
+  const selected = /* @__PURE__ */ new Set();
+  for (const patch of patches) {
+    const observed = servicesMountingPaths(renderedConfigJson, liveRoot, [patch.rel]).sort();
+    const expected = [...patch.consumers].sort();
+    if (JSON.stringify(observed) !== JSON.stringify(expected)) {
+      throw new Error(
+        `Targeted config asset consumer mismatch for ${patch.rel}: signed [${expected.join(", ")}], live compose [${observed.join(", ")}]`
+      );
+    }
+    for (const service of observed) selected.add(service);
+  }
+  return [...selected].sort();
+}
+function atomicReplaceTargetedAsset(patch) {
+  assertNoSymlinkPath(patch.packagedRoot, patch.rel, true);
+  assertNoSymlinkPath(patch.liveRoot, patch.rel, true);
+  const sourceBytes = readFileSync2(patch.source);
+  if (computeConfigDigest(sourceBytes) !== patch.toSha256) throw new Error(`Packaged targeted asset changed before apply: ${patch.rel}`);
+  const liveHash = computeConfigDigest(readFileSync2(patch.target));
+  if (liveHash !== patch.fromSha256 && liveHash !== patch.toSha256) throw new Error(`Live targeted asset changed before apply: ${patch.rel}`);
+  const prior = statSync(patch.target);
+  const temporary = `${patch.target}.exe-targeted-${process.pid}`;
+  let created = false;
+  try {
+    writeFileSync2(temporary, sourceBytes, { mode: 384, flag: "wx" });
+    created = true;
+    chownSync(temporary, prior.uid, prior.gid);
+    const expectedMode = patch.mode ?? prior.mode & 4095;
+    chmodSync(temporary, expectedMode);
+    if ((statSync(temporary).mode & 4095) !== expectedMode) {
+      throw new Error(`Targeted config asset mode could not be applied: ${patch.rel}`);
+    }
+    renameSync(temporary, patch.target);
+  } finally {
+    if (created) rmSync2(temporary, { force: true });
+  }
+}
+function atomicRestoreAsset(target, prior) {
+  const temporary = `${target}.exe-rollback-${process.pid}`;
+  let created = false;
+  try {
+    writeFileSync2(temporary, prior.bytes, { mode: 384, flag: "wx" });
+    created = true;
+    chownSync(temporary, prior.uid, prior.gid);
+    chmodSync(temporary, prior.mode);
+    if ((statSync(temporary).mode & 4095) !== prior.mode) {
+      throw new Error(`Targeted config rollback mode could not be applied: ${target}`);
+    }
+    renameSync(temporary, target);
+  } finally {
+    if (created) rmSync2(temporary, { force: true });
+  }
+}
 function collectConfigAssetModes(configDir, subdirs = CONFIG_ASSET_DIRS) {
   const modes = {};
   for (const subdir of subdirs) {
@@ -1042,6 +1167,9 @@ function defaultComposeCapture(args) {
   return result.stdout ?? "";
 }
 async function runStackConfigUpdate(options) {
+  return withStackUpdateOperationLock(options.envFile, () => runStackConfigUpdateUnlocked(options));
+}
+async function runStackConfigUpdateUnlocked(options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const exec = options.exec ?? ((cmd, args) => {
     const result2 = spawnSync2(cmd, args, { stdio: "inherit", timeout: 6e5 });
@@ -1062,19 +1190,41 @@ async function runStackConfigUpdate(options) {
     );
   }
   const { release, stackVersion, stackVersionSource } = await resolveSignedRelease(options);
-  const stagedComposeRaw = readFileSync2(templatePath, "utf8");
-  const stagedAssetDigests = collectConfigAssetDigests(path2.dirname(templatePath));
-  assertStagedConfigMatchesManifest({
-    release,
-    composeRaw: stagedComposeRaw,
-    assetDigests: stagedAssetDigests,
-    // Applying bytes requires the signed release to cover every byte this mode
-    // can write. Planning may inspect legacy releases, but apply never does.
-    strict: options.dryRun ? options.requireConfigDigest ?? process.env.EXE_STACK_REQUIRE_CONFIG_DIGEST === "1" : true
-  });
   const currentComposeRaw = readFileSync2(options.composeFile, "utf8");
   const currentEnvRaw = readFileSync2(options.envFile, "utf8");
-  const envPlan = planConfigOnlyEnv({ stagedComposeRaw, envRaw: currentEnvRaw, release });
+  const targeted = release?.config?.assetPatches ? validateTargetedAssetPatches({
+    config: release.config,
+    packagedRoot: path2.dirname(templatePath),
+    liveRoot: configDir
+  }) : void 0;
+  if (targeted && !options.dryRun && !options.auditUrl) {
+    throw new Error("Targeted config delivery requires an authenticated audit URL");
+  }
+  const targetedControlHashes = targeted ? new Map([
+    [options.composeFile, computeConfigDigest(currentComposeRaw)],
+    [options.envFile, computeConfigDigest(currentEnvRaw)],
+    ...options.lockFile && existsSync2(options.lockFile) ? [[options.lockFile, computeConfigDigest(readFileSync2(options.lockFile))]] : []
+  ]) : void 0;
+  const assertTargetedControlFilesUnchanged = () => {
+    for (const [file, expected] of targetedControlHashes ?? []) {
+      if (!existsSync2(file) || computeConfigDigest(readFileSync2(file)) !== expected) {
+        throw new Error(`Targeted config delivery refused: immutable control file changed during the run: ${file}`);
+      }
+    }
+  };
+  const stagedComposeRaw = targeted ? currentComposeRaw : readFileSync2(templatePath, "utf8");
+  const stagedAssetDigests = targeted ? Object.fromEntries(targeted.map((p) => [p.rel, p.toSha256])) : collectConfigAssetDigests(path2.dirname(templatePath));
+  if (!targeted) {
+    assertStagedConfigMatchesManifest({
+      release,
+      composeRaw: stagedComposeRaw,
+      assetDigests: stagedAssetDigests,
+      // Applying bytes requires the signed release to cover every byte this mode
+      // can write. Planning may inspect legacy releases, but apply never does.
+      strict: options.dryRun ? options.requireConfigDigest ?? process.env.EXE_STACK_REQUIRE_CONFIG_DIGEST === "1" : true
+    });
+  }
+  const envPlan = targeted ? { derived: {}, missingImagePins: [], unresolvable: [] } : planConfigOnlyEnv({ stagedComposeRaw, envRaw: currentEnvRaw, release });
   let adopted = {};
   if (envPlan.missingImagePins.length > 0 && options.adoptDeployedPins) {
     const deployedImages = parseDeployedImages(capture([...composeArgs, "ps", "--format", "json"]));
@@ -1098,13 +1248,40 @@ async function runStackConfigUpdate(options) {
   const beforeHashes = parseComposeConfigHashes(capture([...composeArgs, "config", "--hash=*"]));
   const beforeImages = parseComposeImages(capture([...composeArgs, "config", "--format", "json"]));
   const beforeConfigJson = capture([...composeArgs, "config", "--format", "json"]);
+  let deployedBeforeJson = capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]);
+  const assertTargetedRuntimeGates = () => {
+    if (!targeted) return;
+    const consumers = assertTargetedAssetConsumers(targeted, beforeConfigJson, configDir);
+    assertRollbackConfigMatchesDeployed(
+      beforeHashes,
+      parseDeployedConfigHashes(deployedBeforeJson),
+      consumers
+    );
+    assertNoPendingImageMovement(
+      beforeImages,
+      parseDeployedImages(deployedBeforeJson),
+      consumers
+    );
+  };
+  assertTargetedRuntimeGates();
   const hostAssetDigests = collectConfigAssetDigests(configDir);
+  const hostAssetModes = collectConfigAssetModes(configDir);
+  const stagedAssetModes = targeted ? Object.fromEntries(targeted.map((patch) => [patch.rel, patch.mode ?? hostAssetModes[patch.rel]])) : collectConfigAssetModes(path2.dirname(templatePath));
   const assetChanges = diffConfigAssets(stagedAssetDigests, hostAssetDigests, {
-    packaged: collectConfigAssetModes(path2.dirname(templatePath)),
-    host: collectConfigAssetModes(configDir)
+    packaged: stagedAssetModes,
+    host: hostAssetModes
   });
+  for (const patch of targeted?.filter((p) => p.state === "to") ?? []) {
+    if (!assetChanges.some((change) => change.rel === patch.rel)) {
+      assetChanges.push({ rel: patch.rel, kind: "changed", reason: "bytes" });
+    }
+  }
   const composeChanged = stagedComposeRaw !== currentComposeRaw;
   if (!composeChanged && assetChanges.length === 0) {
+    if (targeted) {
+      assertTargetedAssetConsumers(targeted, beforeConfigJson, configDir);
+      assertTargetedControlFilesUnchanged();
+    }
     const envVerdict = collectRenderedEnvDrift(
       beforeConfigJson,
       readDeployedServiceEnv(capture, capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]))
@@ -1135,6 +1312,12 @@ async function runStackConfigUpdate(options) {
     };
   }
   console.log(`[stack-config-update] Compose template: ${composeChanged ? "REFRESH" : "already current"}`);
+  if (targeted) {
+    console.log("[stack-config-update] Signed targeted asset-only transition; compose, env and lock are immutable:");
+    for (const patch of targeted) {
+      console.log(`  - ${patch.rel}: ${patch.fromSha256} \u2192 ${patch.toSha256}; consumers: ${patch.consumers.join(", ")}`);
+    }
+  }
   if (assetChanges.length > 0) {
     console.log(`[stack-config-update] Config assets to deliver (${assetChanges.length}):`);
     for (const a of assetChanges) {
@@ -1166,6 +1349,12 @@ async function runStackConfigUpdate(options) {
       const psJson = capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]);
       const envVerdict = collectRenderedEnvDrift(afterConfigJson, readDeployedServiceEnv(capture, psJson));
       const assetServices = assetChanges.length > 0 ? servicesMountingPaths(afterConfigJson, configDir, assetChanges.map((a) => a.rel)) : [];
+      if (targeted) {
+        const authenticatedConsumers = assertTargetedAssetConsumers(targeted, afterConfigJson, configDir);
+        if (JSON.stringify([...assetServices].sort()) !== JSON.stringify(authenticatedConsumers)) {
+          throw new Error("Targeted config plan selected consumers outside the signed consumer set");
+        }
+      }
       const wouldRecreate = [.../* @__PURE__ */ new Set([...changeSet.changed, ...assetServices])].sort();
       const pending = collectPendingImageMovements(
         parseComposeImages(afterConfigJson),
@@ -1216,7 +1405,16 @@ async function runStackConfigUpdate(options) {
       rmSync2(scratch, { recursive: true, force: true });
     }
   }
-  const deployedBeforeJson = capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]);
+  if (targeted) validateTargetedAssetPatches({
+    config: release.config,
+    packagedRoot: path2.dirname(templatePath),
+    liveRoot: configDir
+  });
+  assertTargetedControlFilesUnchanged();
+  if (targeted) {
+    deployedBeforeJson = capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]);
+    assertTargetedRuntimeGates();
+  }
   const backup = backupStackConfig(stackDir, options.composeFile, currentEnvRaw, now);
   console.log(`[stack-config-update] Backed up compose + env to ${backup.updateBackupDir}`);
   const assetRollback = /* @__PURE__ */ new Map();
@@ -1224,8 +1422,13 @@ async function runStackConfigUpdate(options) {
   const addedRels = [];
   for (const change of assetChanges) {
     const target = path2.join(configDir, change.rel);
-    const priorMode = existsSync2(target) ? statSync(target).mode & 511 : void 0;
-    const prior = priorMode === void 0 ? null : { bytes: readFileSync2(target), mode: priorMode };
+    const priorStat = existsSync2(target) ? statSync(target) : void 0;
+    const prior = priorStat === void 0 ? null : {
+      bytes: readFileSync2(target),
+      mode: priorStat.mode & 4095,
+      uid: priorStat.uid,
+      gid: priorStat.gid
+    };
     assetRollback.set(change.rel, prior);
     if (prior === null) {
       addedRels.push(change.rel);
@@ -1260,8 +1463,8 @@ ${addedRels.map((r) => `${r}
         return false;
       }
     };
-    const composeRestored = step(`restore ${options.composeFile}`, () => writeFileSync2(options.composeFile, currentComposeRaw));
-    const envRestored = step(`restore ${options.envFile}`, () => writeFileSync2(options.envFile, currentEnvRaw));
+    const composeRestored = targeted ? step(`verify unchanged ${options.composeFile}`, assertTargetedControlFilesUnchanged) : step(`restore ${options.composeFile}`, () => writeFileSync2(options.composeFile, currentComposeRaw));
+    const envRestored = targeted ? composeRestored : step(`restore ${options.envFile}`, () => writeFileSync2(options.envFile, currentEnvRaw));
     const unsafeServices = /* @__PURE__ */ new Set();
     for (const [rel, prior] of assetRollback) {
       const restored = step(`restore asset ${rel}`, () => {
@@ -1270,8 +1473,9 @@ ${addedRels.map((r) => `${r}
           rmSync2(target, { force: true });
           return;
         }
-        writeFileSync2(target, prior.bytes);
-        chmodSync(target, prior.mode);
+        if (targeted) atomicRestoreAsset(target, prior);
+        else writeFileSync2(target, prior.bytes);
+        if (!targeted) chmodSync(target, prior.mode);
       });
       if (!restored) {
         for (const service of servicesMountingPaths(beforeConfigJson, configDir, [rel])) {
@@ -1354,8 +1558,10 @@ ${addedRels.map((r) => `${r}
       const target = path2.join(configDir, change.rel);
       const source = path2.join(path2.dirname(templatePath), change.rel);
       mkdirSync2(path2.dirname(target), { recursive: true });
-      writeFileSync2(target, readFileSync2(source));
-      chmodSync(target, statSync(source).mode & 511);
+      const targetedPatch = targeted?.find((p) => p.rel === change.rel);
+      if (targetedPatch) atomicReplaceTargetedAsset(targetedPatch);
+      else writeFileSync2(target, readFileSync2(source));
+      if (!targetedPatch) chmodSync(target, statSync(source).mode & 511);
     }
     const afterConfigJson = capture([...composeArgs, "config", "--format", "json"]);
     const afterImages = parseComposeImages(afterConfigJson);
@@ -1381,6 +1587,12 @@ ${addedRels.map((r) => `${r}
       for (const d of envVerdict.drift) console.log(`  - ${d.service}: ${d.missingKeys.join(", ")}`);
     }
     const assetServices = assetChanges.length > 0 ? servicesMountingPaths(afterConfigJson, configDir, assetChanges.map((a) => a.rel)) : [];
+    if (targeted) {
+      const authenticatedConsumers = assertTargetedAssetConsumers(targeted, afterConfigJson, configDir);
+      if (JSON.stringify([...assetServices].sort()) !== JSON.stringify(authenticatedConsumers)) {
+        throw new Error("Targeted config apply selected consumers outside the signed consumer set");
+      }
+    }
     const orphanAssets = assetChanges.length > 0 && assetServices.length === 0;
     if (orphanAssets) {
       console.warn(
@@ -1436,6 +1648,24 @@ ${addedRels.map((r) => `${r}
       }
       result = { status: "applied", stackVersion, stackVersionSource, changed: changeSet.changed, added: [], removed: changeSet.removed, envDrift: envVerdict.drift, envUnverified: envVerdict.unverified, assets: assetChanges, backup };
     }
+    if (targeted) {
+      assertTargetedControlFilesUnchanged();
+      const consumers = assertTargetedAssetConsumers(targeted, beforeConfigJson, configDir);
+      const deployedAfterJson = capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]);
+      assertNoPendingImageMovement(beforeImages, parseDeployedImages(deployedAfterJson), consumers);
+      assertRollbackConfigMatchesDeployed(beforeHashes, parseDeployedConfigHashes(deployedAfterJson), consumers);
+      await postConfigAudit(options, "succeeded", stackVersion, void 0, {
+        changedServices: result.changed,
+        configAssets: targeted.map((p) => ({
+          path: p.rel,
+          fromSha256: p.fromSha256,
+          toSha256: p.toSha256,
+          consumers: p.consumers
+        })),
+        backupDir: result.backup?.updateBackupDir,
+        targetedAssetOnly: true
+      }, true);
+    }
   } catch (err) {
     const original = err instanceof Error ? err : new Error(String(err));
     const rollback = await restore();
@@ -1458,18 +1688,23 @@ ${addedRels.map((r) => `${r}
     }
     throw original;
   }
-  await postConfigAudit(options, "succeeded", stackVersion, void 0, {
-    changedServices: result.changed,
-    removedFromTemplate: result.removed,
-    // Keys only — never values.
-    renderedEnvKeysAdded: result.envDrift,
-    configAssets: result.assets,
-    backupDir: result.backup?.updateBackupDir
-  });
+  if (!targeted) {
+    await postConfigAudit(options, "succeeded", stackVersion, void 0, {
+      changedServices: result.changed,
+      removedFromTemplate: result.removed,
+      // Keys only — never values.
+      renderedEnvKeysAdded: result.envDrift,
+      configAssets: result.assets,
+      backupDir: result.backup?.updateBackupDir
+    });
+  }
   return result;
 }
-async function postConfigAudit(options, status, stackVersion, error, metadata) {
-  if (!options.auditUrl) return;
+async function postConfigAudit(options, status, stackVersion, error, metadata, required = false) {
+  if (!options.auditUrl) {
+    if (required) throw new Error("Targeted config delivery requires an authenticated audit URL");
+    return;
+  }
   const postJson = options.postJson ?? defaultPostJson;
   try {
     await postJson(options.auditUrl, {
@@ -1483,6 +1718,7 @@ async function postConfigAudit(options, status, stackVersion, error, metadata) {
     }, options.manifestAuthToken);
   } catch (err) {
     console.warn(`[stack-config-update] deploy audit failed: ${err instanceof Error ? err.message : String(err)}`);
+    if (required) throw err;
   }
 }
 function resolvePackagedComposeDir() {

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-J4UVI652.js";
+} from "../chunk-WQN2XK4V.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-09-22T20:51:49.983Z",
+  "generated_at": "2026-09-23T01:55:53.241Z",
   "files": [
     {
       "path": "active-agent-RZ24KSJN.js",
@@ -179,7 +179,7 @@
     },
     {
       "path": "bin/cli.js",
-      "sha256": "05f8a09a0f14f21df25173acd1a7eac0fa290596d5d7ebdbb03f90c022e3bf80",
+      "sha256": "f28c012345311069b7b0cf118ffd90f721a35bc1caae17389c4973866a1e631e",
       "bytes": 69528
     },
     {
@@ -524,7 +524,7 @@
     },
     {
       "path": "bin/registry-proxy.js",
-      "sha256": "66475d895940f4aa154f442ec1edf5037c38c384d92d8c8073b81566eccfa781",
+      "sha256": "f6863591b7274a3e5762805442d0d398b0245d2da9a8c8db3cd53be89dda9a5f",
       "bytes": 1885
     },
     {
@@ -549,8 +549,8 @@
     },
     {
       "path": "bin/stack-update.js",
-      "sha256": "c19f626a648a8466562b3908436973f5bfd34a444b1b2e5e17a7c75250cdc049",
-      "bytes": 112940
+      "sha256": "ac357db942b991e27bd9ecfa8396bfbceec2a636472d993247ea04e6b1e8026e",
+      "bytes": 124422
     },
     {
       "path": "bin/update.js",
@@ -569,7 +569,7 @@
     },
     {
       "path": "bin/vps-health-gate.js",
-      "sha256": "d05d9a67c0834f36724579acfe5497d5393f6711e7fbb57222ab0d039524411c",
+      "sha256": "6f1523300863a2955319c458138533e788a090a976ba5e4e23d0bace31617480",
       "bytes": 333
     },
     {
@@ -1087,6 +1087,11 @@
       "sha256": "cf3ce4cf6c9cdba17a8a5e3d9f0c78ae42f1cb72f1a06608cc8da1fb27f06a76",
       "bytes": 3292
     },
+    {
+      "path": "chunk-DZPSBA4B.js",
+      "sha256": "10ad560a524f111988594bc6b060e31f7eff292836561b19d520595b77c60662",
+      "bytes": 217772
+    },
     {
       "path": "chunk-E23LNUWJ.js",
       "sha256": "6d692be7ac73bf481e7013c4b948b70acd8282234f645d562457754afaa7a02e",
@@ -1242,6 +1247,11 @@
       "sha256": "0e8678ecd10db44714ef9a25fcab116b0cb3f86b6de9e384ac5bf2effb0dc3c0",
       "bytes": 2405
     },
+    {
+      "path": "chunk-HJNQAEZV.js",
+      "sha256": "0ca99c9f7c52613ebee3db4f210a65094c9afd7b3abceb09ba4638c216ce9078",
+      "bytes": 3766
+    },
     {
       "path": "chunk-HME6ITKV.js",
       "sha256": "d820c2d874d6841b5c9c1186ba98c24aa25d559b9be05a29ae2373e7f70e7960",
@@ -1302,11 +1312,6 @@
       "sha256": "c0b3a6372de1ceaaa0ee8077beab90baddb26d44c0fbf933543b963927819e16",
       "bytes": 57011
     },
-    {
-      "path": "chunk-J4UVI652.js",
-      "sha256": "3f9abccde5d49dcc844f16c00b04dd9c4166c72c09da21aba1d77c13c48e833e",
-      "bytes": 7587
-    },
     {
       "path": "chunk-J6KMGEJW.js",
       "sha256": "4ed2938b62c86ebc41d12ac03a4217103a1ae035764b21707a6f4dc301df3d5d",
@@ -1582,11 +1587,6 @@
       "sha256": "3dbde846e7f1326185966deb9f0b3f9a476e5eee8185707e841e6e032c4e3cb3",
       "bytes": 3317
     },
-    {
-      "path": "chunk-PZR54BEI.js",
-      "sha256": "a4d5d925118925edec323fd27179e708a905b6967c0b5fa17906b4907e8bfaec",
-      "bytes": 40844
-    },
     {
       "path": "chunk-Q3V7K4ME.js",
       "sha256": "da852c37b5a75dd01c94885d382a0e940438d0c1c2c4eacef5b354edf5e6468e",
@@ -1742,11 +1742,6 @@
       "sha256": "032609f5317492d3118b5e8c3d7392dccc7b7b628996f78167c0d108cde68130",
       "bytes": 13671
     },
-    {
-      "path": "chunk-SLMKLEU6.js",
-      "sha256": "dbcd057bc0b493c6aa1912c794ff7177a6e045c978dfd05370427cb3e8ee94ff",
-      "bytes": 3766
-    },
     {
       "path": "chunk-SNHYZYGZ.js",
       "sha256": "f0b853b3055ffc0f869ade14fa735d7e7457c6d77c78f58244bcaa9c0b8a2b36",
@@ -1857,11 +1852,6 @@
       "sha256": "ae7f759300bb873272d6570df8f4e898f1cb08a7411543a35ce80e3f00f0bb43",
       "bytes": 7964
     },
-    {
-      "path": "chunk-UWVXQEQQ.js",
-      "sha256": "349cfc7abc14b5a1a1abbc73aa756368f6644e43e0257d5949b927f7027cd6e4",
-      "bytes": 216205
-    },
     {
       "path": "chunk-V4TZI6EO.js",
       "sha256": "697ecdef6991c061baab1e9759bc14aecd28631954b2edfdb721c98c72d41c82",
@@ -1932,6 +1922,11 @@
       "sha256": "4a905397d309c73ed4ad5d1ec488309541be3eec2fc6021d275f433ca92cc7a9",
       "bytes": 2265
     },
+    {
+      "path": "chunk-WQN2XK4V.js",
+      "sha256": "802b24d979abc8934743af0537c96194aed4b4965ecec08b64c39cc58121427e",
+      "bytes": 7587
+    },
     {
       "path": "chunk-WT4RI36X.js",
       "sha256": "7ce4fd5dee79504398f6549a7fadeceafaadaea2cd94ef9bcc310280306147c6",
@@ -2007,6 +2002,11 @@
       "sha256": "176e0aa963a006bc1b64eef84c5ec6eeb4c80ab70ee8dddeb578f4448e48a769",
       "bytes": 19304
     },
+    {
+      "path": "chunk-YI4D6E75.js",
+      "sha256": "5d05ebae4399895f6857bcc6f3cba70bcdee9d2113faf2b6d5e522d647b10ab2",
+      "bytes": 40844
+    },
     {
       "path": "chunk-YMRQIENV.js",
       "sha256": "5590051acf78d41e8e1901a3293246b3fceadd28b972b2ff895889df80fbdab9",
@@ -2539,7 +2539,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "9d226f76a97ba6f06dac48c634b73ec2e6625b1b5bd45a4cd541ce8939b666cb",
+      "sha256": "d14c91374638ec9d80f35caf6f5666a7e39718c256396130c8817e1f7a6dfdec",
       "bytes": 1841
     },
     {
@@ -2839,7 +2839,7 @@
     },
     {
       "path": "lib/registry-proxy.js",
-      "sha256": "d575fb83615a1f7a22b1b9bc6c6ef9d96d093e3d690c13f9536dcacc455dcab5",
+      "sha256": "988a25b33ecca19b40cbdb9111bdc500003c1503951fc39c043a68a73d7e8f49",
       "bytes": 749
     },
     {
@@ -3413,8 +3413,8 @@
       "bytes": 111
     },
     {
-      "path": "stack-generate-manifest-AXI55MEQ.js",
-      "sha256": "bfed7a6f7cbba732e9060537ee1cc1b129bdc1662456d9aea9bd5b2672693f42",
+      "path": "stack-generate-manifest-VWNDIMZ2.js",
+      "sha256": "4add4b1efd40afc672c5548604be13f6cb631d2804f43081278604529054ccef",
       "bytes": 56960
     },
     {
@@ -3423,19 +3423,19 @@
       "bytes": 4761
     },
     {
-      "path": "stack-promote-6N23OGZY.js",
-      "sha256": "78e1589c72312681e95f44a643e0c68ba8414587324f43464a26332ae191ff5d",
+      "path": "stack-promote-DFXJDHVA.js",
+      "sha256": "d401050d81af3fa38a53044a3e7e51956d79bbf6b3e6f042b026a1d979ee42ce",
       "bytes": 7425
     },
     {
-      "path": "stack-release-2CXFYVWM.js",
-      "sha256": "f7bb67a4defdc1dcc9f5f2bedf2c743a8cc671271b98c94fca59322be2d15673",
+      "path": "stack-release-RQ2DYYD5.js",
+      "sha256": "5b3f61e3c60c6ad2bf17d13a93b8925cb9eb8f1e0638aa63ec7314aab1286f1a",
       "bytes": 117550
     },
     {
-      "path": "stack-update-U53FBVCQ.js",
-      "sha256": "e025823418b831fe8237ae2204777695ef7b37dc8960d2e01e94c6658c7803ad",
-      "bytes": 6839
+      "path": "stack-update-MVGCN3C4.js",
+      "sha256": "00460b684d4ee48912250328a7b1d90231a120b66e60e7024f03b43c49382257",
+      "bytes": 6967
     },
     {
       "path": "stalled-dispatch-escalation-MHLYH2PT.js",

package/dist/{chunk-UWVXQEQQ.js → chunk-DZPSBA4B.js}

@@ -22,8 +22,8 @@ import {
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";
-import { createVerify, randomBytes, verify as verifySignature } from "crypto";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { createHash, createVerify, randomBytes, verify as verifySignature } from "crypto";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, realpathSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 import http from "http";
 import https from "https";
 import net from "net";
@@ -3142,7 +3142,44 @@ function isFatalLiveArtifactFailure(result) {
   if (!result.verdicts) return true;
   return (result.verdicts.disagrees ?? 0) > 0;
 }
+function stackUpdateOperationLockPort(envFile) {
+  let ancestor = path.resolve(envFile);
+  const suffix = [];
+  while (!existsSync(ancestor)) {
+    const parent = path.dirname(ancestor);
+    if (parent === ancestor) throw new Error(`Cannot canonicalize stack update path: ${envFile}`);
+    suffix.unshift(path.basename(ancestor));
+    ancestor = parent;
+  }
+  const canonical = path.join(realpathSync(ancestor), ...suffix);
+  const digest = createHash("sha256").update(canonical).digest();
+  return 4e4 + digest.readUInt32BE(0) % 2e4;
+}
+async function withStackUpdateOperationLock(envFile, operation) {
+  const port = stackUpdateOperationLockPort(envFile);
+  const server = net.createServer();
+  server.on("connection", (socket) => socket.destroy());
+  await new Promise((resolve, reject) => {
+    const onError = (err) => {
+      server.close();
+      reject(err.code === "EADDRINUSE" ? new Error(`Another stack update operation holds 127.0.0.1:${port}; refusing concurrent mutation`) : err);
+    };
+    server.once("error", onError);
+    server.listen({ host: "127.0.0.1", port, exclusive: true }, () => {
+      server.off("error", onError);
+      resolve();
+    });
+  });
+  try {
+    return await operation();
+  } finally {
+    await new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve()));
+  }
+}
 async function runStackUpdate(options) {
+  return withStackUpdateOperationLock(options.envFile, () => runStackUpdateUnlocked(options));
+}
+async function runStackUpdateUnlocked(options) {
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const phaseDurations = [];
@@ -4845,6 +4882,8 @@ export {
   hardenHost,
   LIVE_ARTIFACT_MATCHES_MANIFEST_CHECK,
   isFatalLiveArtifactFailure,
+  stackUpdateOperationLockPort,
+  withStackUpdateOperationLock,
   runStackUpdate,
   readCurrentStackVersion,
   listAvailableVersions,

package/dist/{chunk-SLMKLEU6.js → chunk-HJNQAEZV.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-UWVXQEQQ.js";
+} from "./chunk-DZPSBA4B.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-J4UVI652.js → chunk-WQN2XK4V.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-U53FBVCQ.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-MVGCN3C4.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-PZR54BEI.js → chunk-YI4D6E75.js}

@@ -138,7 +138,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-U53FBVCQ.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-MVGCN3C4.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-22T20:51:49.799Z",
+  "generatedAt": "2026-09-23T01:55:53.027Z",
   "hashes": {
     "bug-report-worker.js": "e114760c0e7c5c3637bfa9a9041a4390760d541dcdacb9c7d751c9fc1d8311af",
     "codex-stop-task-finalizer.js": "1a465be64326faca8789b113ec2a1d6b8f9020d97dd1ac0a01fec30447d8b2eb",

package/dist/lib/registry-proxy.js

@@ -11,7 +11,7 @@ import {
   resolveRegistryProxyBuildIdentity,
   resolveStackManifestChannel,
   runRegistryProxy
-} from "../chunk-PZR54BEI.js";
+} from "../chunk-YI4D6E75.js";
 import "../chunk-MLKGABMK.js";
 export {
   SERVED_VERSION_PATH,

package/dist/{stack-generate-manifest-AXI55MEQ.js → stack-generate-manifest-VWNDIMZ2.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-SLMKLEU6.js";
-import "./chunk-UWVXQEQQ.js";
+} from "./chunk-HJNQAEZV.js";
+import "./chunk-DZPSBA4B.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-B7WVYLAQ.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-promote-6N23OGZY.js → stack-promote-DFXJDHVA.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-SLMKLEU6.js";
-import "./chunk-UWVXQEQQ.js";
+} from "./chunk-HJNQAEZV.js";
+import "./chunk-DZPSBA4B.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-B7WVYLAQ.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-release-2CXFYVWM.js → stack-release-RQ2DYYD5.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-SLMKLEU6.js";
-import "./chunk-UWVXQEQQ.js";
+} from "./chunk-HJNQAEZV.js";
+import "./chunk-DZPSBA4B.js";
 import "./chunk-EC5H53YD.js";
 import {
   assertPreflightGate,
@@ -2028,7 +2028,7 @@ async function warmProxyCache(imageRef) {
 async function resolveImageGitShaLabel(ref, dryRun) {
   if (!ref || dryRun) return void 0;
   try {
-    const { readProvenanceLabels } = await import("./stack-generate-manifest-AXI55MEQ.js");
+    const { readProvenanceLabels } = await import("./stack-generate-manifest-VWNDIMZ2.js");
     const labels = await readProvenanceLabels(ref);
     return labels["org.exe.git_sha"] ?? labels["org.opencontainers.image.revision"];
   } catch (err) {

package/dist/{stack-update-U53FBVCQ.js → stack-update-MVGCN3C4.js}

@@ -103,6 +103,7 @@ import {
   saveServiceSelection,
   serviceSelectionPath,
   snapshotComposeImageDefaults,
+  stackUpdateOperationLockPort,
   stripImageDigest,
   syncImagePinsWithProcessEnv,
   unmanagedManifestServices,
@@ -115,8 +116,9 @@ import {
   verifySsoGatedIngressRouting,
   verifyStackManifestSignature,
   waitForHttpOk,
-  warnUnmanagedManifestServices
-} from "./chunk-UWVXQEQQ.js";
+  warnUnmanagedManifestServices,
+  withStackUpdateOperationLock
+} from "./chunk-DZPSBA4B.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-B7WVYLAQ.js";
 import "./chunk-L25OAFOU.js";
@@ -234,6 +236,7 @@ export {
   saveServiceSelection,
   serviceSelectionPath,
   snapshotComposeImageDefaults,
+  stackUpdateOperationLockPort,
   stripImageDigest,
   syncImagePinsWithProcessEnv,
   unmanagedManifestServices,
@@ -246,5 +249,6 @@ export {
   verifySsoGatedIngressRouting,
   verifyStackManifestSignature,
   waitForHttpOk,
-  warnUnmanagedManifestServices
+  warnUnmanagedManifestServices,
+  withStackUpdateOperationLock
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.389",
+  "version": "0.9.390",
   "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,15 +1,20 @@
 {
-  "current": "0.9.389",
+  "current": "0.9.390",
   "notes": {
-    "0.9.389": {
-      "version": "0.9.389",
-      "date": "2026-09-22",
-      "features": [],
+    "0.9.390": {
+      "version": "0.9.390",
+      "date": "2026-09-23",
+      "features": [
+        "add signed targeted assets, kernel locking, rollback, and regressions"
+      ],
       "fixes": [
-        "record integrity after orphan pruning"
+        "serialize aliases and preflight targeted audit"
       ],
       "security": [],
-      "other": [],
+      "other": [
+        "prepare updater v0.9.390",
+        "signed config-only canary v0.9.48"
+      ],
       "migration_notes": []
     },
     "0.9.371": {

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.389",
-  "image": "ghcr.io/askexe/exe-os:v0.9.389",
+  "version": "0.9.390",
+  "image": "ghcr.io/askexe/exe-os:v0.9.390",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.389"
+  "sourceVersion": "0.9.390"
 }