@askexenow/exe-os 0.9.389 → 0.9.391

package/deploy/compose/.env.customer.example

@@ -127,6 +127,11 @@ EXE_ORG_WORKSPACE_ID=
 CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
+# Public DEMO is opt-in after a separate synthetic-data workspace is
+# bootstrapped. Set both values together: GoTrue API base must be HTTPS.
+# The auth SPA root is not the GoTrue API; on Exe's auth gateway it is /api.
+EXE_CRM_GOTRUE_URL=
+EXE_DEMO_WORKSPACE_ID=
 # The CRM's first admin — seeded at boot by WorkspaceBootstrapService, which is
 # what makes that person an EXISTING user whose sign-in is allowed while every
 # other unmanaged first login is refused (e51ca54c §10.6b). Must be a real

package/deploy/compose/.env.example

@@ -161,6 +161,11 @@ EXE_ORG_WORKSPACE_ID=
 CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
+# Public DEMO is opt-in after a separate synthetic-data workspace is
+# bootstrapped. Set both values together: GoTrue API base must be HTTPS.
+# The auth SPA root is not the GoTrue API; on Exe's auth gateway it is /api.
+EXE_CRM_GOTRUE_URL=
+EXE_DEMO_WORKSPACE_ID=
 EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
 # The CRM's first admin — seeded at boot by WorkspaceBootstrapService, which
 # is what makes that person an EXISTING user whose sign-in is allowed while

package/deploy/compose/docker-compose.yml

@@ -442,8 +442,12 @@ services:
       # so its id is unknowable at install time. Bootstrap first, then adopt.
       EXE_ORG_ID: ${EXE_ORG_ID:-}
       EXE_ORG_WORKSPACE_ID: ${EXE_ORG_WORKSPACE_ID:-}
-      GOTRUE_URL: http://gotrue:9999
-      # Bug 51086951: the EXPECTED JWT issuer. GOTRUE_URL above is the INTERNAL
+      # Public DEMO admission needs an HTTPS GoTrue API endpoint for fresh
+      # authenticated identity checks. Keep the private-stack internal default
+      # until the operator explicitly configures the HTTPS API proxy.
+      GOTRUE_URL: ${EXE_CRM_GOTRUE_URL:-http://gotrue:9999}
+      EXE_DEMO_WORKSPACE_ID: ${EXE_DEMO_WORKSPACE_ID:-}
+      # Bug 51086951: the EXPECTED JWT issuer. GOTRUE_URL above is the API
       # address used to call GoTrue, but browser tokens are signed with the PUBLIC
       # auth-url issuer (pinned as GOTRUE_JWT_ISSUER on the gotrue service). Hand the
       # SAME public value here so issuer validation accepts real browser sessions

package/deploy/compose/generate-env.ts

@@ -367,6 +367,11 @@ export function generateEnv(options: GenerateEnvOptions): string {
     `CRM_IMAGE_TAG=${CRM_IMAGE_TAG}`,
     `CRM_SERVER_URL=https://crm.${normalizedDomain}`,
     `CRM_APP_SECRET=${randomSecret(RANDOM_SECRET_48)}`,
+    "# Keep DEMO disabled by default. After bootstrapping a separate synthetic-data",
+    "# DEMO workspace, set its exact ID and an HTTPS GoTrue API base. The auth SPA",
+    "# root is not the API; on Exe's auth gateway the API base is /api.",
+    "EXE_CRM_GOTRUE_URL=",
+    "EXE_DEMO_WORKSPACE_ID=",
     `EXE_CRM_ADMIN_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
     // The CRM's first admin. Seeded into core."user" at boot by
     // WorkspaceBootstrapService, which is what makes that person an EXISTING
@@ -706,6 +711,11 @@ export function generateExampleEnv(): string {
     `CRM_IMAGE_TAG=${CRM_IMAGE_TAG}`,
     "CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN",
     "CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET",
+    "# Public DEMO is opt-in after a separate synthetic-data workspace is",
+    "# bootstrapped. Set both values together: GoTrue API base must be HTTPS.",
+    "# The auth SPA root is not the GoTrue API; on Exe's auth gateway it is /api.",
+    "EXE_CRM_GOTRUE_URL=",
+    "EXE_DEMO_WORKSPACE_ID=",
     "EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN",
     "# The CRM's first admin — seeded at boot by WorkspaceBootstrapService, which",
     "# is what makes that person an EXISTING user whose sign-in is allowed while",

package/deploy/stack-manifests/v0.9.json

@@ -4217,11 +4217,438 @@
         }
       },
       "rolloutStage": "canary"
+    },
+    "0.9.48": {
+      "version": "0.9.48",
+      "releasedAt": "2026-09-22T19:52:27.677Z",
+      "npmVersion": "0.9.389",
+      "notes": "Authenticated config-only canary from stack 0.9.47. Deliver the reviewed SSO edge redirect fix using exe-os v0.9.389 config apply: the signed release covers the exact packaged compose template and every packaged bind-mounted config asset. Preserve every image pin from 0.9.47; no image movement is authorized. Apply only after registry tarball integrity and installed updater bytes are verified, with backups, strict dependency-ordered health checks, and rollback.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.62@sha256:584113f88ce09f5ea3b93b7b5e8960ebb8a00e34adaa205c92d964b46525b7a8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "60f8f08faa5d8fe86b92a87eda93eb0d051a6353",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.391@sha256:272f3440fa0f93bd19b3a0b53983c488d90b9731f252a1fb9120c9516566b4a5",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "ce76474b7af9476846549a5ae2eb272dc182e9cf"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "4a648434eef4f194de15cc742684dfd3220be2334035333257dd37faa4828b3d",
+        "assets": {
+          "sso-edge/default.conf.template": "fac3627a51989bbb62b8cba1f2dfd4aab69555b998fd48c0a1a67deb5889f29f",
+          "sso-edge/entrypoint.sh": "2281fc9382ee1f80dbf306a380d165d0afe1fcc37f5b752925e34f5a06419ce9",
+          "sso-edge/error-pages/404.html": "d9a163356479204cf0c200d1cf483a986d3ef4c46c53e02d97bfe128d25e833f",
+          "sso-edge/error-pages/500.html": "82972c5fbb237047f532c95d8757a2bcc696ca9466e70c73debf64e8b58689a7",
+          "sso-edge/error-pages/503.html": "58f73f74cabff1a8faa63b11af36aa643c78ac740c9a31378f8a8ee6aa572cf8",
+          "sso-edge/sso-redirect.conf": "d9e1036ba2129450372caff3f09d5ad8894b3b774ab50fe0807322e0f8896d7b",
+          "erp-nginx/nginx.conf": "918d3e3b9c854c3c2bfefaab48ea4e41c4430dd92429e9f035676783d7136ab7",
+          "observability/otel-collector-config.yaml": "01fcd1192e695455fdf85029e60074bee96ff9565da05f4c01b3428b264fe4d5",
+          "cloudflared/config.yml.example": "c60e28c67d8c13e54d4d15f4a79ed3f4ad8723f6345138b084a1925c871b529a"
+        }
+      }
+    },
+    "0.9.49": {
+      "version": "0.9.49",
+      "releasedAt": "2026-09-23T01:05:10.332Z",
+      "npmVersion": "0.9.390",
+      "notes": "Exe dogfood signed targeted SSO edge asset delivery from live stack 0.9.47. Replace only the mounted sso-redirect.conf after verifying its exact live base hash; recreate only exe-sso-edge with no image pull or build. Preserve live compose, env, service topology, all image pins and unrelated assets. Require verified npm updater v0.9.390, authenticated audit, backup, strict health and rollback. Stack 0.9.46 and 0.9.48 remain unapplied; latest remains 0.9.38.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.62@sha256:584113f88ce09f5ea3b93b7b5e8960ebb8a00e34adaa205c92d964b46525b7a8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "60f8f08faa5d8fe86b92a87eda93eb0d051a6353",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.391@sha256:272f3440fa0f93bd19b3a0b53983c488d90b9731f252a1fb9120c9516566b4a5",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "ce76474b7af9476846549a5ae2eb272dc182e9cf"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "assetPatches": {
+          "sso-edge/sso-redirect.conf": {
+            "fromSha256": "b6b4ed60ddece4ed960c827300af0660c70ee5aeb79ed26f7d796c3da509ddff",
+            "toSha256": "d9e1036ba2129450372caff3f09d5ad8894b3b774ab50fe0807322e0f8896d7b",
+            "consumers": [
+              "exe-sso-edge"
+            ],
+            "mode": 420
+          }
+        }
+      }
+    },
+    "0.9.50": {
+      "version": "0.9.50",
+      "releasedAt": "2026-09-23T16:04:13.000Z",
+      "npmVersion": "0.9.391",
+      "notes": "Targeted Exe dogfood canary from signed live stack 0.9.47: update CRM web and worker to v0.9.66 with verified-email read-only DEMO admission and GoTrue-authoritative owner bootstrap. CRM image source a3d107483304d10b05c9f1ee5e1b0182c4628e65 passed exact-source CI and release run 35882310879, including provenance and mandatory Trivy. Preserve every other live image pin. exe-os npm 0.9.391 provides the signed compose template and packaged assets for normal config delivery; public DEMO remains disabled until the separate synthetic workspace is bootstrapped and CRM is configured with an HTTPS GoTrue API base.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.66@sha256:38bbae74ddd33dbbd62175a46ad0d3f99ef6c671b0c2187e35398ca9c504c3eb",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "a3d107483304d10b05c9f1ee5e1b0182c4628e65",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.391@sha256:272f3440fa0f93bd19b3a0b53983c488d90b9731f252a1fb9120c9516566b4a5",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "ce76474b7af9476846549a5ae2eb272dc182e9cf"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "c793630a000b86a3f6790305ef28e2637b172b7186117a115503a83716874e96",
+        "assets": {
+          "sso-edge/default.conf.template": "fac3627a51989bbb62b8cba1f2dfd4aab69555b998fd48c0a1a67deb5889f29f",
+          "sso-edge/entrypoint.sh": "2281fc9382ee1f80dbf306a380d165d0afe1fcc37f5b752925e34f5a06419ce9",
+          "sso-edge/error-pages/404.html": "d9a163356479204cf0c200d1cf483a986d3ef4c46c53e02d97bfe128d25e833f",
+          "sso-edge/error-pages/500.html": "82972c5fbb237047f532c95d8757a2bcc696ca9466e70c73debf64e8b58689a7",
+          "sso-edge/error-pages/503.html": "58f73f74cabff1a8faa63b11af36aa643c78ac740c9a31378f8a8ee6aa572cf8",
+          "sso-edge/sso-redirect.conf": "d9e1036ba2129450372caff3f09d5ad8894b3b774ab50fe0807322e0f8896d7b",
+          "erp-nginx/nginx.conf": "918d3e3b9c854c3c2bfefaab48ea4e41c4430dd92429e9f035676783d7136ab7",
+          "observability/otel-collector-config.yaml": "01fcd1192e695455fdf85029e60074bee96ff9565da05f4c01b3428b264fe4d5",
+          "cloudflared/config.yml.example": "c60e28c67d8c13e54d4d15f4a79ed3f4ad8723f6345138b084a1925c871b529a"
+        }
+      }
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "X/Du82ErExS0sQRLflix8CLUhHLEqGC6QAYxsUT0o/1HUPOhJhM4KiY64sB/zXN9eK6EcYOxtFjyyn2Lyq0nAg=="
+    "signature": "XqZerXDGjW99WoFfaDkjHwrCG1o5ATX4kj+n6kck77OvQLmojdrNnXlcgwF1zWSkCqzRYUmrm2FmQCGSituMCQ=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-22T20:51:50.033Z",
-  "manifest_sha256": "3405a6349892bd3f95a497ecce5aa6d6cf25376f6dd35a7eb24a82e50c463d6f",
-  "package_version": "0.9.389"
+  "verified_at": "2026-09-23T19:32:14.235Z",
+  "manifest_sha256": "b44495e6f8195b1bde7eecf6455a05dc4675fd82c407d0e3240186becae7cb34",
+  "package_version": "0.9.391"
 }

package/dist/{active-agent-RZ24KSJN.js → active-agent-NJRC6ID4.js}

@@ -8,17 +8,17 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-B4XJQBQB.js";
+} from "./chunk-YVLNEGRA.js";
 import "./chunk-NRLJOV7M.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-3UD3OF3X.js";
+import "./chunk-GCPHAZRX.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
+import "./chunk-AO766ADJ.js";
+import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-LUA4SLJY.js";
-import "./chunk-5ONMHTNI.js";
-import "./chunk-RBQUXHYK.js";
+import "./chunk-BSNDVCKM.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-WAAGVFFN.js";
 import "./chunk-QH5ZQ5SJ.js";

package/dist/{active-agent-YWSWPIEA.js → active-agent-Z3742YWW.js}

@@ -7,17 +7,17 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-B4XJQBQB.js";
+} from "./chunk-YVLNEGRA.js";
 import "./chunk-NRLJOV7M.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-3UD3OF3X.js";
+import "./chunk-GCPHAZRX.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
+import "./chunk-AO766ADJ.js";
+import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-LUA4SLJY.js";
-import "./chunk-5ONMHTNI.js";
-import "./chunk-RBQUXHYK.js";
+import "./chunk-BSNDVCKM.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-WAAGVFFN.js";
 import "./chunk-QH5ZQ5SJ.js";

package/dist/{agent-defs-generator-GY3UBREJ.js → agent-defs-generator-TGXGWFOH.js}

@@ -5,13 +5,13 @@ import "./chunk-AM7S2TY6.js";
 import {
   loadEmployeesSync,
   validateEmployeeName
-} from "./chunk-3UD3OF3X.js";
+} from "./chunk-GCPHAZRX.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
+import "./chunk-AO766ADJ.js";
+import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-LUA4SLJY.js";
-import "./chunk-5ONMHTNI.js";
-import "./chunk-RBQUXHYK.js";
+import "./chunk-BSNDVCKM.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-WAAGVFFN.js";
 import "./chunk-QH5ZQ5SJ.js";

package/dist/{agent-loop-HPNCH3HK.js → agent-loop-32B6KOGH.js}

@@ -1,6 +1,6 @@
 import {
   agentLoop
-} from "./chunk-U44Y7RC7.js";
+} from "./chunk-J2SIJM4Q.js";
 import "./chunk-JRLNE3T2.js";
 import "./chunk-2O2UKMUE.js";
 import "./chunk-HF25XPZE.js";

package/dist/{agentic-ontology-RHYNXEKE.js → agentic-ontology-FK74XJIT.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-LZXYPTY4.js";
+} from "./chunk-I6H2ZBLR.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{artifact-backup-HGUFSIJH.js → artifact-backup-5BB5UN55.js}

@@ -7,10 +7,10 @@ import {
 import {
   artifactObjectId,
   encryptSyncBlob
-} from "./chunk-CL3AB7Z2.js";
+} from "./chunk-3YYXMI6R.js";
 import "./chunk-TWMWHDOY.js";
-import "./chunk-CL2MU3OX.js";
-import "./chunk-TA3B4N24.js";
+import "./chunk-U5NYIYRN.js";
+import "./chunk-DDWRVR6E.js";
 import {
   EXE_AI_DIR,
   loadConfigSync