@askexenow/exe-os 0.9.394 → 0.9.396

package/release-notes.json

@@ -1,70 +1,19 @@
 {
-  "current": "0.9.394",
+  "current": "0.9.396",
   "notes": {
-    "0.9.394": {
-      "version": "0.9.394",
-      "date": "2026-09-23",
-      "features": [
-        "local CI triage — classify failing checks at zero token cost (#1441)",
-        "declare the runner fleet instead of remembering it (#1179)",
-        "ARC-1 release ledger, part 1 of 4 — core, leases and transitions (#1229)",
-        "bug census source of truth — per-status/per-product counts, surfaced at boot (#1270)",
-        "--scope flag reaches DEAD coordinator lanes' zombie queues (follow-up to bug 81c63b67) (#1405)",
-        "sign recoverable B3 invite proofs with native keys"
-      ],
+    "0.9.396": {
+      "version": "0.9.396",
+      "date": "2026-09-24",
+      "features": [],
       "fixes": [
-        "honor omitted default no-restart policy",
-        "honor completed one-shot dependencies in retained health",
-        "require critical container identity and preserve missing restart data",
-        "scope retained health to selected service and critical dependencies",
-        "compare override drift to signed snapshot",
-        "attest retained Compose override for scoped releases",
-        "no_raw excludes captured searches (bug 37353c88 residual a) (#1509)",
-        "cited-bug-id integrity guard (bug 2b74a91c); no pin change for bug 1f0fba70 (#1365)",
-        "an unreadable licence key or grandfather marker is not an absent one (bug d11c5049, G8) (#1321)",
-        "warm global-procedures cache on exe-call/exe-agent paths + durable guard (#1472)",
-        "purely additive target-keyed enforcement for every mutating tool (bug 4d7961b3) (#1279)",
-        "enforce shared-master exclusion at join, not only at publish (#1199 follow-up) (#1507)",
-        "supersession hygiene propagates importance in chain order (bug 692bd251) (#1508)",
-        "mix process.pid into the test-mode lock port (reopens 3c72aa45) (#1496)",
-        "linear f-string scan in policy evaluation (PR #1471 follow-up) (#1483)",
-        "quote-aware segment split in the ledger guard (bug bea7b411) (#1487)",
-        "make revoking an admin cryptographic — Org Key epochs (bug 129e1e4d) (#1199)",
-        "fail closed on non-literal shell values, pin exemption allowlist partition (031fd768) (#1499)",
-        "pre-push guard correlates rename/rename resolutions to a third path (#1255 follow-up) (#1485)",
-        "gen-5 model pricing/routing in api-router + token-spend (281189b4, b91203c5) (#1497)",
-        "stop crediting three shapes that never actually run the guard (#1216 follow-up) (#1491)",
-        "extract-review-findings.sh fails loudly on a broken comments lookup (#1441 follow-up) (#1493)",
-        "report duplicate hook entries as a --check failure, not just --apply (#1179 follow-up) (#1492)",
-        "ledger mutations commit atomically without a cross-await transaction (#1229 follow-up) (#1490)",
-        "memory/DB layer lifecycle cluster — all 10 bugs (#1473)"
+        "isolate git subprocess tests in required PR and main gates",
+        "refresh vulnerable packages and image runtime for v0.9.396"
       ],
       "security": [],
       "other": [
-        "Prepare signed CRM companion canary stack 0.9.55",
-        "Allow signed retained CRM web and worker image group",
-        "Prepare signed CRM DEMO canary stack 0.9.54",
-        "Add fixed-source npm-only publisher for exe-os 0.9.393",
-        "Prepare signed Dashboard canary stack 0.9.53 with scoped updater 0.9.393",
-        "assert required core failure in retained scope",
-        "release(npm): publish 0.9.392 from exact green main source",
-        "release(stack): sign Dashboard topology canary 0.9.52",
-        "release(stack): pin Dashboard v0.9.392 in canary 0.9.51 (#1511)",
-        "release: use declared control runner lane",
-        "release: run fixed-source npm gate on control lane",
-        "release: add fixed-source npm canary publisher",
-        "release(stack): pin CRM v0.9.66 in DEMO canary",
-        "remove three mac CI flakes (bugs 4fd3f86e, 3c72aa45, e8a0c254) (#1482)",
-        "Retain signed live compose for targeted image updates (#1478)",
-        "use valid X25519 keys in B3 fixtures",
-        "use HTTP/1.1 for full-history provenance checkout (#1480)",
-        "release(stack): add CRM DEMO canary 0.9.50 (#1475)",
-        "bound lock-owner waits on failure",
-        "sign targeted SSO edge asset v0.9.49"
+        "require isolated git tests in both workflow gates"
       ],
-      "migration_notes": [
-        "recall, query: deployment` let the skip group consume the real"
-      ]
+      "migration_notes": []
     },
     "0.9.371": {
       "version": "0.9.371",

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.391",
-  "image": "ghcr.io/askexe/exe-os:v0.9.391",
+  "version": "0.9.396",
+  "image": "ghcr.io/askexe/exe-os:v0.9.396",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.391"
+  "sourceVersion": "0.9.396"
 }

package/dist/{chunk-JK7SDSPK.js → chunk-3GEHMT7V.js}

@@ -5,12 +5,12 @@ import {
   ensureDaemonToken,
   readDaemonToken
 } from "./chunk-PCV52RYM.js";
-import {
-  computeDaemonHeapCapMb
-} from "./chunk-NLEW62VC.js";
 import {
   sanitizeDaemonKeyCustodyEnv
 } from "./chunk-IMYGYIAI.js";
+import {
+  computeDaemonHeapCapMb
+} from "./chunk-NLEW62VC.js";
 import {
   killIfSameProcess,
   processStartedAt,