@askexenow/exe-os 0.9.392 → 0.9.394

package/deploy/stack-manifests/v0.9.json

@@ -4909,11 +4909,410 @@
         "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
         "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
       }
+    },
+    "0.9.53": {
+      "version": "0.9.53",
+      "releasedAt": "2026-09-23T21:55:18.488Z",
+      "npmVersion": "0.9.393",
+      "notes": "Dashboard-only Exe dogfood canary replacing unapplied 0.9.52: npm 0.9.393 scopes retained-Compose health to Dashboard, required core, and rendered dependencies while recording unchanged unrelated red containers and failing new regressions. From live stack 0.9.50, update only Dashboard to v0.9.392. Preserve CRM v0.9.66, Auth v0.6.10, and every other service pin. Signed live base and override Compose bytes are unchanged; no config assets are delivered. Public DEMO remains disabled pending separate CRM rollout.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.66@sha256:38bbae74ddd33dbbd62175a46ad0d3f99ef6c671b0c2187e35398ca9c504c3eb",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "a3d107483304d10b05c9f1ee5e1b0182c4628e65",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.392@sha256:d151441554c00e216084bd1caf2278e8c41fde188c039e0f167e158a511cbeec",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "e11b25ad567389440da8ed5e566a9c59bce24123"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
+        "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
+      }
+    },
+    "0.9.54": {
+      "version": "0.9.54",
+      "releasedAt": "2026-09-23T22:31:53.000Z",
+      "npmVersion": "0.9.393",
+      "notes": "CRM DEMO routing canary from the applied Dashboard 0.9.53 baseline. Update only CRM web and worker to v0.9.67 with signed DEMO workspace routing; preserve Dashboard v0.9.392, Auth v0.6.10, and all other pins. Operator DEMO bootstrap remains a separate scoped step after image acceptance.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.67@sha256:56452b7df4361e157e4d727dd71c8ed3f1cffd4b345bbddecf651609c0de9b48",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "9127619259b7ba2ff8963fbf302827e3cf518ece",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.392@sha256:d151441554c00e216084bd1caf2278e8c41fde188c039e0f167e158a511cbeec",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "e11b25ad567389440da8ed5e566a9c59bce24123"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
+        "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
+      }
+    },
+    "0.9.55": {
+      "version": "0.9.55",
+      "releasedAt": "2026-09-23T23:14:06.000Z",
+      "npmVersion": "0.9.394",
+      "notes": "CRM DEMO routing canary superseding unapplied stack 0.9.54. The scoped updater now validates, restarts, witnesses, and rolls back CRM web and worker together under the one signed CRM_IMAGE_TAG. From the applied Dashboard 0.9.53 baseline, update only CRM to v0.9.67; preserve Dashboard v0.9.392, Auth v0.6.10, and every other image pin. Operator DEMO bootstrap remains separate after image acceptance.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.67@sha256:56452b7df4361e157e4d727dd71c8ed3f1cffd4b345bbddecf651609c0de9b48",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "9127619259b7ba2ff8963fbf302827e3cf518ece",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.392@sha256:d151441554c00e216084bd1caf2278e8c41fde188c039e0f167e158a511cbeec",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "e11b25ad567389440da8ed5e566a9c59bce24123"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
+        "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
+      }
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "xdgiq8L3up4Mr/AAKup4KFb0istz4Mw80ACvfp1K69hy5NXCou/JX3/eyCfgp0ZP20nbzjjEDfYvHATXQ36XCQ=="
+    "signature": "BTPhDNOLpsQWb4XWYhc4B76lw+lAa0+t6RP1wC9B5D/9NNvkFcRTPrrf56YxL2bjBgx1IMWaBi4eM5Fbv2WEDA=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-23T21:11:44.589Z",
-  "manifest_sha256": "7001b01788ede1ea0aca7f3688cacaa8a618cac6faf6aa49894111e38765e4c5",
-  "package_version": "0.9.392"
+  "verified_at": "2026-09-23T23:35:24.863Z",
+  "manifest_sha256": "6448e6d55002816a5c2c682844a5a0d84f5f006dc21386948f690951ae6ad15f",
+  "package_version": "0.9.394"
 }

package/dist/bin/cli.js

@@ -798,14 +798,14 @@ ${JSON.stringify(stormAlert, null, 2)}`);
   const { runStackUpdateCli } = await import("./stack-update.js");
   await runStackUpdateCli(args.slice(1));
 } else if (args[0] === "release") {
-  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-7YHSLY7J.js");
+  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-YCNRPK6R.js");
   const releaseFlags = parseReleaseArgs(args.slice(1));
   await runStackRelease(releaseFlags);
 } else if (args[0] === "stack-promote") {
-  const { runStackPromoteCli } = await import("../stack-promote-26RFMNSB.js");
+  const { runStackPromoteCli } = await import("../stack-promote-4EF7RNIV.js");
   await runStackPromoteCli(args.slice(1));
 } else if (args[0] === "stack-generate-manifest") {
-  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-QWU7Q4MJ.js");
+  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-H6LJQ2HV.js");
   process.exit(await runStackGenerateManifestCli(args.slice(1)));
 } else if (args[0] === "repo-truth") {
   const { runRepoTruthCli } = await import("./exe-repo-truth.js");

package/dist/bin/registry-proxy.js

@@ -2,7 +2,7 @@
 import {
   registryProxyOptionsFromEnv,
   runRegistryProxy
-} from "../chunk-PRCJG3PK.js";
+} from "../chunk-RLUDQYOA.js";
 import {
   isMainModule
 } from "../chunk-6Y4B3QF6.js";

package/dist/bin/stack-update.js

@@ -7,6 +7,7 @@ import {
   assertRetainedComposeRenderedImage,
   assertRetainedComposeRunningService,
   assertSignedManifestDeliveryGate,
+  assessRetainedHealthBefore,
   backupStackConfig,
   bootstrapStackHost,
   builtinStackManifestPublicKeyPath,
@@ -17,12 +18,14 @@ import {
   defaultStackPaths,
   detectDanglingVolumes,
   detectMissingRequiredEnvVars,
+  expandComposeServicesWithSidecars,
   listAvailableVersions,
   listHostComposeServices,
   loadServiceSelection,
   loadStackManifestWithFallback,
   parseComposeVolumeNames,
   parseEnv,
+  parseRetainedContainerHealth,
   patchEnv,
   printDanglingVolumes,
   printVolumeCleanupResult,
@@ -33,6 +36,9 @@ import {
   reportStackManifestSource,
   requiredImagePinKeys,
   resolveComposeProjectName,
+  retainedCompletedDependencies,
+  retainedContainerIsHealthy,
+  retainedCriticalServices,
   runScopedServiceSelection,
   runStackUpdate,
   saveServiceSelection,
@@ -41,7 +47,7 @@ import {
   verifyManifestImagesAvailable,
   warnUnmanagedManifestServices,
   withStackUpdateOperationLock
-} from "../chunk-3SXU7KLW.js";
+} from "../chunk-DYFTZWG2.js";
 import "../chunk-EC5H53YD.js";
 import {
   runVerifyStack
@@ -57,7 +63,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-33CHRORT.js";
+} from "../chunk-5OWHYOIF.js";
 import "../chunk-L25OAFOU.js";
 import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
@@ -2076,7 +2082,25 @@ function readInstalledVersion(lockFile) {
     return void 0;
   }
 }
-function printChanges(changes, composeFile, envFile) {
+function printChanges(changes, composeFile, envFile, retainedHealth) {
+  if (retainedHealth) {
+    if (changes.length > 0) {
+      console.log("Planned image tag changes:");
+      for (const c of changes) console.log(`  - ${c.service}: ${c.key}
+      ${c.before ?? "<unset>"} \u2192 ${c.after}`);
+    }
+    console.log("\nCurrent container health (selected service and required dependencies are gates):");
+    for (const [service, container] of retainedHealth.containers) {
+      const critical = retainedHealth.critical.has(service);
+      const healthy = retainedContainerIsHealthy(container, retainedHealth.completedDependencies?.has(service));
+      const label = critical ? "required for this update" : "unrelated, unchanged baseline";
+      console.log(`  ${healthy ? "\u2705" : critical ? "\u274C" : "\u26A0\uFE0F"} ${service}: ${container.state}${container.health ? ` (health: ${container.health})` : ""} \u2014 ${label}`);
+    }
+    const failures = assessRetainedHealthBefore(retainedHealth);
+    if (failures.length > 0) console.log(`
+\u{1F534} Retained-Compose health gate failed: ${failures.join(", ")}`);
+    return failures.length;
+  }
   if (changes.length === 0) {
     const running2 = areCliContainersRunning(composeFile, envFile);
     if (running2) {
@@ -2111,6 +2135,24 @@ function printChanges(changes, composeFile, envFile) {
   }
   return 0;
 }
+function captureRetainedHealthForCli(composeFile, envFile, selectedService, requiredCore) {
+  const args = composeArgsForStack(composeFile, envFile);
+  const config = spawnSync3("docker", [...args, "config", "--format", "json"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 2e4
+  });
+  const companions = expandComposeServicesWithSidecars([selectedService]).slice(1);
+  const critical = retainedCriticalServices(config.status === 0 ? config.stdout : null, selectedService, requiredCore, companions);
+  const completedDependencies = retainedCompletedDependencies(config.stdout, critical, selectedService, requiredCore, companions);
+  const ps = spawnSync3("docker", [...args, "ps", "--all", "--format", "json"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 2e4
+  });
+  const containers = parseRetainedContainerHealth(ps.status === 0 ? ps.stdout : null);
+  return { critical, completedDependencies, containers };
+}
 function areCliContainersRunning(composeFile, envFile) {
   try {
     const result = spawnSync3("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
@@ -2411,20 +2453,20 @@ async function main(args = process.argv.slice(2)) {
     }, plan, liveComposeRaw, envRaw, process.env, retainedComposeFiles.override);
     console.log(`[stack-update] Signed live compose retained: base SHA256 ${manifest.stacks[plan.targetVersion]?.config?.composeSha256}` + (retainedComposeFiles.override === null ? " (no override)" : `, override SHA256 ${manifest.stacks[plan.targetVersion]?.config?.composeOverrideSha256}`));
     const selectedService = Object.values(plan.release.services)[0];
-    assertRetainedComposeRunningService(
-      composeArgsForStack(opts.composeFile, opts.envFile),
-      selectedService.composeService ?? opts.serviceName
-    );
-    assertRetainedComposeRenderedImage(
-      composeArgsForStack(opts.composeFile, opts.envFile),
-      selectedService.composeService ?? opts.serviceName,
-      selectedService.env,
-      plan.changes[0].after,
-      void 0,
-      { ...process.env, [selectedService.env]: plan.changes[0].after }
-    );
+    const composeTargets = expandComposeServicesWithSidecars([selectedService.composeService ?? opts.serviceName]);
+    for (const target of composeTargets) {
+      assertRetainedComposeRunningService(composeArgsForStack(opts.composeFile, opts.envFile), target);
+      assertRetainedComposeRenderedImage(
+        composeArgsForStack(opts.composeFile, opts.envFile),
+        target,
+        selectedService.env,
+        plan.changes[0].after,
+        void 0,
+        { ...process.env, [selectedService.env]: plan.changes[0].after }
+      );
+    }
     console.log(
-      `[stack-update] If applied: back up stack config and attempt the configured database/off-host backups; write only ${selectedService.env} in the stack .env; update the stack lock and deploy audit; pull and recreate only ${selectedService.composeService ?? opts.serviceName}. Compose, bind-mounted assets, gateway overlays, host hardening, and service selection remain unchanged.`
+      `[stack-update] If applied: back up stack config and attempt the configured database/off-host backups; write only ${selectedService.env} in the stack .env; update the stack lock and deploy audit; pull and recreate only ${composeTargets.join(", ")}. Compose, bind-mounted assets, gateway overlays, host hardening, and service selection remain unchanged.`
     );
   }
   const targetRelease = manifest.stacks[plan.targetVersion];
@@ -2511,7 +2553,16 @@ async function main(args = process.argv.slice(2)) {
       console.log("");
     }
   }
-  const unhealthyCount = printChanges(plan.changes, opts.composeFile, opts.envFile);
+  const retainedHealth = opts.retainCompose && targetRelease ? captureRetainedHealthForCli(
+    opts.composeFile,
+    opts.envFile,
+    Object.values(plan.release.services)[0].composeService ?? opts.serviceName,
+    Object.entries(targetRelease.services).filter(([, service]) => service.required === true && service.category === "core").map(([name, service]) => service.composeService ?? name)
+  ) : void 0;
+  const unhealthyCount = printChanges(plan.changes, opts.composeFile, opts.envFile, retainedHealth);
+  if (opts.retainCompose && unhealthyCount > 0 && !opts.check && !opts.dryRun) {
+    throw new Error("--retain-compose refused: selected service or required dependency is unhealthy");
+  }
   printBreaking(plan.breakingChanges);
   if (opts.verifyImages) {
     const started = Date.now();
@@ -2704,6 +2755,7 @@ export {
   isProductionControlPlaneApply,
   manifestSignatureSkipBanner,
   parseArgs as parseStackUpdateArgs,
+  printChanges,
   reportPartialRun,
   resolveManifestSignaturePolicy,
   main as runStackUpdateCli,

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-33CHRORT.js";
+} from "../chunk-5OWHYOIF.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,