v0.167.0 RELEASED (not vouched yet): CHANGELOG header, REPORT

CHANGELOG.md

@@ -1,4 +1,4 @@
-## Unreleased (next: v0.167.0) — the BYO SSH clean-up in the SAME update (R-1285); a reinstalled box's whole-guest tier is due at once (R-1232); Go 1.27.3 (R-972) — committed, not released
+## v0.167.0 (2026-10-27) — the BYO SSH clean-up in the SAME update (R-1285); a reinstalled box's whole-guest tier is due at once (R-1232); Go 1.27.3 (R-972) — RELEASED (release-agent.sh from a clean clone; agent sha256 28bdd282…d826f0, bundle 9d034416…ed1268; signed updates committed on demo-felhom, Tester 1, demo-hp; NOT vouched yet)
 
 - **R-972: Go 1.27.3** (`go.mod`; released 2026-10-19 with a security fix to `crypto/x509`). `govulncheck` v1.8.0 before:
   1 called vulnerability (GO-2026-6809, `crypto/x509@go1.27.2`); after: 0. `golang.org/x/crypto` v0.58.0 is already the

REPORT.md

@@ -1,21 +1,22 @@
-# REPORT — R-1285: the BYO SSH clean-up in the same update — committed, NOT released (2026-10-26 afternoon)
+# REPORT — agent v0.167.0 RELEASED, not vouched yet (2026-10-27, attended)
 
-**Plain words first.** A BYO box coming from 0.164.0 kept our SSH file one release too long: in the normal update the
-OLD agent installs the config bundle, so the new agent's clean-up pass never ran on it. Now the new agent runs that pass
-once, right after its self-update commits. Not released today (operator: „not today"); its live proof needs a BYO box on
-0.164.0, which rides the next agent release.
+**Plain words first.** Agent 0.167.0 is published and runs on all three test boxes. It carries: a reinstalled box's
+first whole-box copy is no longer a week late (R-1232); the BYO SSH clean-up runs in the same update (R-1285); Go
+1.27.3 (R-972). The operator still has to vouch it for new installs.
 
-## The fix (`b1bc63d`, CI 2363 ✓)
+## Release
 
-- `internal/selfupdate/commit.go`: `Manager.SetOnCommitted` — a hook run once after „update committed".
-- `internal/osupdate/bundle.go`: `ConfigUpdateExecutor.PolicyPassAfterUpdate` (the wrapper's `bundle-policy` mode, host
-  layer, no envelope); `cmd/felhom-agent/main.go` `wireBundlePolicyAfterCommit` hooks it on.
-- The smaller of the two fixes: agent-only — holding the bundle job until the commit would need new hub queue logic.
+- `scripts/release-agent.sh 0.167.0` from a clean clone of `54d3a10` (CI 2400 and 2420 green): built, tagged `v0.167.0`,
+  published, verified by an independent download. Agent sha256
+  `28bdd2826f45f3767880fcff4d3105afb7247c09c0ced99d78b3a978d8d826f0`; bundle
+  `9d0344164b22634159984bfbcdaf77c53e6d2423812973ed8b4f2135a7ed1268`.
+- Signed `agent_update` per box (configs/ unchanged since 0.166.0, so no bundle job): demo-felhom committed 10:26 CET,
+  Tester 1 10:32, demo-hp 13:49 (held back until its line test had run). On all three the R-1285 pass ran right after
+  the commit in the NORMAL delivery (`BUNDLE POLICY DONE install_mode=appliance removed=0`) — yesterday it did not.
+  Not proven: the removal itself on a BYO box coming from 0.164.0 (none in the fleet); R-1285 stays VERIFY.
+- Tester 1's weekly line test ran on 0.167.0 (13:33 CET, 94.0 Mbit/s); demo-hp's ran through the controller's hold
+  (94.5 Mbit/s; felhom.eu `audits/linetest-2026-10-27/`).
+- **Waiting:** the operator's vouch (hub → Configs → Day-0 artifacts). After it: `pinned.day0_agent` = 0.167.0 in
+  `scripts/retention-policy.json` (D50, `09` §3 decision 262).
 
-## Proof
-
-- `cmd/felhom-agent/r1285_policy_after_commit_test.go`, in the real order: a pending marker for the running version →
-  `commit`, then exactly one `bundle-policy` plan; no marker / a mismatched marker → nothing. Red-proved (the hook call
-  removed → commit only, no pass — the demo-hp symptom of 2026-10-26).
-- **Not live:** only a box coming FROM 0.164.0 can show it (0.165.0's wrapper already applies D43 at plan time), which
-  needs a signed downgrade chain on a BYO box.
+Evidence: felhom.eu `documentation/audits/release-2026-10-27/` (`agent-rel-0167.txt`, `agent-0167-tester1-demofelhom.txt`).