@askexenow/exe-os 0.9.411 → 0.9.412

package/delivery/catalog.json

@@ -46,13 +46,6 @@
           "state": "active",
           "purpose": "release"
         },
-        {
-          "path": ".github/workflows/release-dashboard-image.yml",
-          "workflowId": 338670900,
-          "name": "Release dashboard image",
-          "state": "active",
-          "purpose": "release"
-        },
         {
           "path": ".github/workflows/release-service.yml",
           "workflowId": 338790318,
@@ -61,7 +54,7 @@
           "purpose": "reusable-lane"
         }
       ],
-      "note": "Publishes FOUR distinct release artifacts through THREE different workflows. The legacy lists record one workflow for the whole repository, which is why the npm tarball and the dashboard image have no traceable producer in any of them."
+      "note": "Publishes the npm package, core image and worker image. Dashboard publication has moved to AskExe/exe-dashboard; the historical local dashboard callers are retired."
     },
     {
       "id": 1218739164,
@@ -249,15 +242,26 @@
       "id": 1340595948,
       "name": "AskExe/exe-dashboard",
       "defaultBranch": "main",
-      "releaseAdapter": "internal",
+      "releaseAdapter": "container",
       "ownerRole": "cto",
-      "compatibilityGroup": "none",
-      "deployable": false,
-      "nonDeployableReason": "Extraction from exe-os dashboard-page/ is INCOMPLETE: this repository has ZERO Actions workflows (verified via the GitHub API), so it publishes nothing and cannot. The single active source of the dashboard image is AskExe/exe-os via .github/workflows/release-dashboard-image.yml. Registered explicitly, per plan sequence 8 and 11, so that 'both repos might publish the same package' is answered on the record rather than by silence. Flip this entry to a container adapter in the same PR that moves the caller workflow — never before, and never leaving both wired.",
+      "compatibilityGroup": "stack-0.9",
+      "deployable": true,
       "requiredSuites": [
-        "ci"
+        "ci",
+        "image-identity",
+        "health-probe",
+        "scan"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/release-dashboard-image.yml",
+          "workflowId": 358278599,
+          "name": "Release dashboard image",
+          "state": "active",
+          "purpose": "release"
+        }
       ],
-      "workflows": []
+      "note": "Standalone publisher. Verified v0.9.400 source 0e389f1acf35b34c648a846abdc4bcca4d2cd816 is the dashboard selected by customer stack 0.9.77."
     },
     {
       "id": 1259904143,
@@ -443,11 +447,11 @@
     },
     {
       "componentId": "exe-dashboard-image",
-      "repository": "AskExe/exe-os",
+      "repository": "AskExe/exe-dashboard",
       "type": "oci-image",
       "origin": "first-party",
       "publishRepository": "ghcr.io/askexe/exe-dashboard",
-      "pullRepository": "ghcr.io/askexe/exe-dashboard",
+      "pullRepository": "update.askexe.com/askexe/exe-dashboard",
       "releaseWorkflow": ".github/workflows/release-dashboard-image.yml",
       "platforms": [
         "linux/amd64"
@@ -472,16 +476,17 @@
         "scan"
       ],
       "healthProbe": {
-        "type": "none",
-        "gap": "No real JSON health route exists yet; an SPA fallback must not be allowed to pass health (plan sequence 8)."
+        "type": "http",
+        "url": "http://127.0.0.1:3301/health",
+        "verified": true
       },
       "legacy": {
         "stackServiceKey": "dashboard",
-        "stackReleaseServiceKey": null,
+        "stackReleaseServiceKey": "dashboard",
         "contractServiceId": "dashboard",
         "manifestService": "dashboard"
       },
-      "note": "THE INCIDENT THIS CATALOG EXISTS FOR: built from exe-os dashboard-page/, absent from stack-release-repos.mjs entirely, and production ran a four-builds-stale image traceable only by luck. Source repository is AskExe/exe-os — NOT AskExe/exe-dashboard, which has no workflows at all."
+      "note": "Built by the standalone repository. Customer stack 0.9.77 and stack.release.json select the same verified immutable v0.9.400 image; previous signed stack entries retain their original pins."
     },
     {
       "componentId": "exe-gateway-image",
@@ -625,7 +630,7 @@
       "healthProbe": {
         "type": "http",
         "url": "http://127.0.0.1:8069/api/method/ping",
-        "host": "erp.askexe.com",
+        "host": "${ERP_SITE_NAME:-erp.localhost}",
         "statusField": "message",
         "verified": true
       },
@@ -1180,13 +1185,6 @@
     }
   ],
   "legacyDivergences": [
-    {
-      "list": "STACK_SERVICE_SPECS",
-      "subject": "auth",
-      "field": "healthUrl",
-      "reason": "STACK_SERVICE_SPECS still probes /api/health. exe-auth 404s that path DELIBERATELY — nginx.conf adds an exact location so GoTrue version strings are not exposed — and probing it triggered the all-or-nothing production rollback of 2026-09-08 that reverted ERP, CRM, wiki and exe-os along with auth. CONTRACT_SERVICES was corrected to / ; STACK_SERVICE_SPECS was not. The catalog carries the verified value (/ -> 200).",
-      "retiredBy": "ARC-1 Track: retire STACK_SERVICE_SPECS in favour of deriveStackServiceSpecs(). Until then this list is stale and the catalog is authoritative."
-    },
     {
       "list": "STACK_SERVICE_SPECS",
       "subject": "erp",
@@ -1239,16 +1237,9 @@
     {
       "list": "CONTRACT_SERVICES",
       "subject": "dashboard",
-      "field": "ghRepo",
-      "reason": "CONTRACT_SERVICES points dashboard at AskExe/exe-dashboard on the assumption the extraction completed. It has not: that repository has ZERO Actions workflows (verified via the GitHub API), so it publishes nothing. The single active source is AskExe/exe-os via release-dashboard-image.yml. Plan sequence 8 requires exactly one active source and forbids two publishers for one package; the catalog states which one it is.",
-      "retiredBy": "Plan sequence 8: flip the catalog repository entry and this field together in the PR that moves the caller workflow to AskExe/exe-dashboard — never separately."
-    },
-    {
-      "list": "CONTRACT_SERVICES",
-      "subject": "dashboard",
-      "field": "healthPath",
-      "reason": "CONTRACT_SERVICES declares /health, but no real JSON health route exists yet — plan sequence 8 lists baking one as outstanding work, and warns an SPA fallback must not be allowed to pass health. A declared path with nothing behind it is what lets a stale dashboard look healthy, so the catalog records the gap instead.",
-      "retiredBy": "Plan sequence 8: set healthProbe when the JSON health route ships."
+      "field": "releaseWorkflow",
+      "reason": "This legacy offline conformance list still reads the retired local shared-lane caller. The actual producer is the standalone workflow registered in the catalog; deriveContractServices omits paths outside exe-os by convention. The local caller cannot publish.",
+      "retiredBy": "Retire CONTRACT_SERVICES in favor of the catalog and repository-aware workflow conformance."
     }
   ]
 }

package/deploy/compose/.env.customer.example

@@ -69,7 +69,7 @@ SMTP_PASS=
 # --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG.
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.13@sha256:a21ed370706b7ffce200af782471511402ca5dc3e3fd0fcc51996f08dc79a981
 # Bug 379e5c13: server_name / CORS from the CONFIGURED apex domain, not by naive
 # last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -124,7 +124,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.75@sha256:9ac890b74e8e31cb91d7aee1bba5a604e8494372d7aa71590ced76b22424a6f6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 # Public DEMO is opt-in after a separate synthetic-data workspace is
@@ -143,7 +143,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.42@sha256:af7aaa0669788f5e593f04b3b89691f9c7a909067c9895f78e288f6bcd72d5dc
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -181,7 +181,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.396@sha256:faca74fa9207d79b6156d64d737247b58b3ba6083c669ff23e20763059815554
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=CHANGEME_DEVICE_ID
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -191,7 +191,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- ERP (Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363
+ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.3.24@sha256:b0f38298da1818931caf08aec52ba87f75687c4760c08863bb7892b1ca6b70a9
 # Administrator password for the ERPNext site (created on first boot).
 # bug 43854b31: this only applies at FIRST boot. To rotate it later you must also
 # run `bench --site $ERP_SITE_NAME set-admin-password <new>` inside exe-erp —

package/deploy/compose/.env.default

@@ -13,10 +13,10 @@ EXE_LICENSE_KEY=CHANGEME_EXE_LICENSE_KEY
 # ------------------------------------------------------------------
 # Image tags (per-client pinning — never use :latest in production)
 # ------------------------------------------------------------------
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.51
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.26
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.311
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.24
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.75@sha256:9ac890b74e8e31cb91d7aee1bba5a604e8494372d7aa71590ced76b22424a6f6
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.42@sha256:af7aaa0669788f5e593f04b3b89691f9c7a909067c9895f78e288f6bcd72d5dc
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.396@sha256:faca74fa9207d79b6156d64d737247b58b3ba6083c669ff23e20763059815554
+GATEWAY_IMAGE_TAG=update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105
 
 # ------------------------------------------------------------------
 # Postgres (shared by CRM + wiki)

package/deploy/compose/.env.example

@@ -98,7 +98,7 @@ SMTP_PASS=
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG. exe-auth
 # ships only from the private update.askexe.com registry (no GHCR mirror).
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.13@sha256:a21ed370706b7ffce200af782471511402ca5dc3e3fd0fcc51996f08dc79a981
 # Bug 379e5c13: server_name / CORS derived from the CONFIGURED apex domain,
 # not by naive last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -158,7 +158,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.75@sha256:9ac890b74e8e31cb91d7aee1bba5a604e8494372d7aa71590ced76b22424a6f6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 # Public DEMO is opt-in after a separate synthetic-data workspace is
@@ -176,7 +176,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.42@sha256:af7aaa0669788f5e593f04b3b89691f9c7a909067c9895f78e288f6bcd72d5dc
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -214,7 +214,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.396@sha256:faca74fa9207d79b6156d64d737247b58b3ba6083c669ff23e20763059815554
 
 # Infra image pins — manifest-derived. Compose has no fallback default for
 # these: a missing pin ABORTS the deploy instead of substituting an old image.
@@ -269,7 +269,7 @@ ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
 
 # --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363
+ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.3.24@sha256:b0f38298da1818931caf08aec52ba87f75687c4760c08863bb7892b1ca6b70a9
 ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD
 EXE_ERP_ADMIN_TOKEN=CHANGEME_EXE_ERP_ADMIN_TOKEN
 # Frappe site name — must match the erp.<domain> the customer serves (bug e61ad373).

package/deploy/compose/docker-compose.yml

@@ -768,7 +768,7 @@ services:
       # overridden back to exeOsMcp — see bug c604df37 above before doing that;
       # the spawn args below currently point at the wrong CLI entrypoint.
       EXE_OS_MCP_COMMAND: ${WIKI_EXE_OS_MCP_COMMAND:-npx}
-      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.382} mcp}
+      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.412} mcp}
       BRANDING_CONFIG_PATH: /app/branding.json
     ports:
       - "127.0.0.1:${WIKI_HOST_PORT:-3001}:3001"

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.38",
+  "latest": "0.9.78",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -8117,11 +8117,272 @@
         "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
         "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
       }
+    },
+    "0.9.77": {
+      "version": "0.9.77",
+      "releasedAt": "2026-10-14T02:33:51.429Z",
+      "notes": "Customer GA release with private HTML/CSS/JavaScript reports and dashboards in Wiki Files (self-contained HTML up to 5 MiB; workspace access required) and the verified standalone Dashboard v0.9.400. Other service images match the approved stack 0.9.76 bundle. Customer health probes use the configured ERP site. Existing installations upgrade explicitly with --target 0.9.77; new installs select this general release by default.",
+      "npmVersion": "0.9.409",
+      "breakingChanges": [],
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.396@sha256:faca74fa9207d79b6156d64d737247b58b3ba6083c669ff23e20763059815554",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.75@sha256:9ac890b74e8e31cb91d7aee1bba5a604e8494372d7aa71590ced76b22424a6f6",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "87b50b8ca7eb3a451251aeb133e98bff20e7f333",
+          "description": "Central GoTrue authentication and same-host Exe/DEMO workspace switching for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.42@sha256:af7aaa0669788f5e593f04b3b89691f9c7a909067c9895f78e288f6bcd72d5dc",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "ff61711880ce2e52c9e9ee1eae6118e9761322cc"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.13@sha256:a21ed370706b7ffce200af782471511402ca5dc3e3fd0fcc51996f08dc79a981",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "133705a4ada5b900a754aab4cd5fca4c56d55fad"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.24@sha256:b0f38298da1818931caf08aec52ba87f75687c4760c08863bb7892b1ca6b70a9",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "${ERP_SITE_NAME:-erp.localhost}",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "667fe09964bec1169f0b9945df4451c79a6e4c87"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.400@sha256:d6963463d623f2e07b8b1b6cdaa5662b8a7219aa237cd315cfbabcad84f06ee1",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "0e389f1acf35b34c648a846abdc4bcca4d2cd816"
+        }
+      },
+      "rolloutStage": "ga"
+    },
+    "0.9.78": {
+      "version": "0.9.78",
+      "releasedAt": "2026-10-14T13:00:58.884Z",
+      "notes": "Customer upgrade repair for legacy stack 0.9.27 layouts. exe-os CLI 0.9.412 makes check/dry-run previews non-mutating, migrates the unused shipped embeddings-worker fallback only after verifying it is disabled and absent, and completes version-only upgrades when images already match. Strict digest/signature/delivery checks remain enabled. Application image pins match the accepted 0.9.77 bundle, including private self-contained HTML/CSS/JS reports in Wiki Files. Supplies the signed optional telemetry image setting required when old installations adopt the current Compose template.",
+      "npmVersion": "0.9.412",
+      "breakingChanges": [],
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.396@sha256:faca74fa9207d79b6156d64d737247b58b3ba6083c669ff23e20763059815554",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.75@sha256:9ac890b74e8e31cb91d7aee1bba5a604e8494372d7aa71590ced76b22424a6f6",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "87b50b8ca7eb3a451251aeb133e98bff20e7f333",
+          "description": "Central GoTrue authentication and same-host Exe/DEMO workspace switching for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.42@sha256:af7aaa0669788f5e593f04b3b89691f9c7a909067c9895f78e288f6bcd72d5dc",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "ff61711880ce2e52c9e9ee1eae6118e9761322cc"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.13@sha256:a21ed370706b7ffce200af782471511402ca5dc3e3fd0fcc51996f08dc79a981",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "133705a4ada5b900a754aab4cd5fca4c56d55fad"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.24@sha256:b0f38298da1818931caf08aec52ba87f75687c4760c08863bb7892b1ca6b70a9",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "${ERP_SITE_NAME:-erp.localhost}",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "667fe09964bec1169f0b9945df4451c79a6e4c87"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra",
+          "env": "OTEL_COLLECTOR_IMAGE"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.400@sha256:d6963463d623f2e07b8b1b6cdaa5662b8a7219aa237cd315cfbabcad84f06ee1",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "0e389f1acf35b34c648a846abdc4bcca4d2cd816"
+        }
+      },
+      "rolloutStage": "ga"
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "lAdHfzdtUH7vuuTZKXHSvUYvu5X1OQGvaorzArgQ8F0kSns65Su91A81Ckv+qp6B6Nvf+asTnz/Hrfxo3zpmBw=="
+    "signature": "gRov8680kM1tJ8fHILxtmpKgQrSNPTCp1xUONk5F1fCrdapSQzOH41PEZtlmZ1fozP9nG5q/sahTP4G3eGTFDw=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-10-12T18:45:24.474Z",
-  "manifest_sha256": "80868da720af5de46832ff0166f30145226105cfbef88661d1b7e43ee80d68fa",
-  "package_version": "0.9.411"
+  "verified_at": "2026-10-14T20:24:45.008Z",
+  "manifest_sha256": "d122346741db80b81598e2e493f830003ab58345842a20cff55bef76867a8375",
+  "package_version": "0.9.412"
 }

package/dist/bin/cli.js

@@ -798,14 +798,14 @@ ${JSON.stringify(stormAlert, null, 2)}`);
   const { runStackUpdateCli } = await import("./stack-update.js");
   await runStackUpdateCli(args.slice(1));
 } else if (args[0] === "release") {
-  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-S37R57XC.js");
+  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-64UJ6Y4W.js");
   const releaseFlags = parseReleaseArgs(args.slice(1));
   await runStackRelease(releaseFlags);
 } else if (args[0] === "stack-promote") {
-  const { runStackPromoteCli } = await import("../stack-promote-MJF436JD.js");
+  const { runStackPromoteCli } = await import("../stack-promote-BMGEY6SQ.js");
   await runStackPromoteCli(args.slice(1));
 } else if (args[0] === "stack-generate-manifest") {
-  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-SU6OFFY7.js");
+  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-MVJDTU4F.js");
   process.exit(await runStackGenerateManifestCli(args.slice(1)));
 } else if (args[0] === "repo-truth") {
   const { runRepoTruthCli } = await import("./exe-repo-truth.js");

package/dist/bin/registry-proxy.js

@@ -2,7 +2,7 @@
 import {
   registryProxyOptionsFromEnv,
   runRegistryProxy
-} from "../chunk-54STF27U.js";
+} from "../chunk-W3ABSZ6G.js";
 import {
   isMainModule
 } from "../chunk-6Y4B3QF6.js";