Glad to hear your experience with TKL has been off to such a good start.

To answer your first question...

Short answer: The daily updates are limited to Debian security updates. So they are the Core OS updates. However they will also include security updates to any TKL components that comes directly from the Debian repositories. As Canvas is installed from upstream it will not be included in these daily updates.

Long answer: (aka offtopic ramble) Continuing on from the short answer... You can get a hint on what components will be automatically updated with security updates from the appliance changelog and the manifest (FYI both of these resources are linked to from the appliance page). So from this you can clearly see that Apache and MySQL both come straight from the Debian repos (note 'squeeze' in the version name - that is the codename for Debian 6.0 - the basis of TKL v12.x). As most of the other packages are installed by apt (note that AFAIK only apt installed packages show up in the manifest) I strongly suspect that they too come from the Debian repos. This suspicion can be confirmed (or rejected) with the 'apt-cache policy <packagename>' command. Eg:

# apt-cache policy ruby
ruby:
  Installed: 4.5
  Candidate: 4.5
  Version table:
 *** 4.5 0
        500 http://ftp.debian.org/debian/ squeeze/main i386 Packages
        100 /var/lib/dpkg/status

From this we can see that Ruby v4.5 is installed and the same version is an installation candidate (ie what would be installed by 'apt-get upgrade' - in this case nothing as it's the same version). Also we can see that this version is offered by the squeeze/main repo. From this info we can safely assume that this the is the version installed by the TKL devs.

To go right off on a tangent, the only (apt) package that I suspect doesn't come from the default Debian repos is the backported redis-server package. Let's see what apt-cache policy says:

# apt-cache policy redis-server
redis-server:
  Installed: 2:2.4.15-1~bpo60+2
  Candidate: 2:2.4.15-1~bpo60+2
  Version table:
 *** 2:2.4.15-1~bpo60+2 0
        100 /var/lib/dpkg/status
     2:1.2.6-1 0
        500 http://ftp.debian.org/debian/ squeeze/main i386 Packages

Ah-ha! So looks like I was right! The (backported) version isn't available from any (enabled) repo; the version provided by Debian repos is 1.2.6, but the installed version is 2.4.15.

Out of interest the only other component that jumps out at me as not being from the repos is Rails. However I know that Rails is provided by Ruby via it's Gem package management (vaguely similar to apt).

Anyway, to get back on topic... I am unfamiliar with Canvas and have no idea exactly how the devs installed it, although the Canvas appliance changelog makes me suspect that it was installed from an archive ("revision db0034c (upstream archive)") rather than directly from git.

So unfortunately I can't directly answer the second part of your question, although as it is easy to set up an appliance, you could always do a test installation (to a VM) and have a play with different upgrade methods and see how you go. Make sure you carefully document your progress (so you can repeat it - and also so you can be a good open source citizen and share your findings! :D). Once you have a method that works then try it with some data in there (obviously backup anything that you wouldn't want to lose! - TKLBAM is good for that!)

I just installed and had a qucik play with updating Canvas by writing the current git branch over the top of the installed version but that didn't go well at all (I've totally broken it... :( But I did accidentally overwrite it with 'master' rather than 'stable' so I'm hoping thats the issue. I'll try again another time but using the 'stable' branch.

My suspicion though is that although it may work, it probably won't be a reliable way to go. In my google travels I came across someone else who possibly tried to do what I did and someone responded saying that it sounded like an old version had had a new one copied over the top (which is basically what I did...) so it just may not be a goer...

I'll play some more...