REPORT: the 2026-10-26 afternoon run. Docs only.

REPORT.md

@@ -1,26 +1,21 @@
-# REPORT — agent v0.166.0 released and vouched (2026-10-26, attended release run)
+# REPORT — R-1285: the BYO SSH clean-up in the same update — committed, NOT released (2026-10-26 afternoon)
 
-**Plain words first.** Agent 0.166.0 runs on Tester 1, demo-hp and demo-felhom, and the operator vouched it at 10:04:55
-CET, so new installs get it (a fresh install today fetched it). A signed job's window is now at most 24 hours — seen
-live. One part is not done: on a BYO host the SSH clean-up still comes one release late (R-1285, back to OPEN).
+**Plain words first.** A BYO box coming from 0.164.0 kept our SSH file one release too long: in the normal update the
+OLD agent installs the config bundle, so the new agent's clean-up pass never ran on it. Now the new agent runs that pass
+once, right after its self-update commits. Not released today (operator: „not today"); its live proof needs a BYO box on
+0.164.0, which rides the next agent release.
 
-## Release
+## The fix (`b1bc63d`, CI 2363 ✓)
 
-- From a clean clone at `aa69114` (CI 2351 ✓): tag `v0.166.0`; binary sha256
-  `3f22c65b78914632fa476292f6b58e5af3ed9e9900f3a5a7a347a9c0bfea9c5c`; bundle
-  `093772c1bda8b974e86ed45472f8fadc8992f247563f5739876102a5156003a3`; verified by independent download.
-- Delivered by signed `agent_update` + `agent_config_update`: each box COMPLETED, bundle INSTALLED, self-check 76/76,
-  update committed.
-- D50 pin `day0_agent` → 0.166.0 (`b890b57`, CI 2356 ✓); the published gate green.
+- `internal/selfupdate/commit.go`: `Manager.SetOnCommitted` — a hook run once after „update committed".
+- `internal/osupdate/bundle.go`: `ConfigUpdateExecutor.PolicyPassAfterUpdate` (the wrapper's `bundle-policy` mode, host
+  layer, no envelope); `cmd/felhom-agent/main.go` `wireBundlePolicyAfterCommit` hooks it on.
+- The smaller of the two fixes: agent-only — holding the bundle job until the commit would need new hub queue logic.
 
-## Live checks
+## Proof
 
-- **R-1280 (closed):** a 25 h signed job on demo-hp → „REJECTED signed op — executor not called … op validity window too
-  long (25h0m0s)"; a 30 min job ran. `felhom-opsign -ttl 25h` refuses (rc 2); 24 h accepted.
-- **R-1285 (back to OPEN):** in the normal two-job delivery the bundle job runs in the OLD 0.165.0 process (demo-hp: bundle
-  09:03:07–09:03:09 CET, restart into 0.166.0 at 09:03:10), so no policy pass ran on that bundle. Under 0.166.0 a later
-  bundle logged „BUNDLE POLICY DONE install_mode=appliance removed=0" — the pass is wired; its delivery order is not.
-  No BYO host is in the fleet. Fix options in the row.
-- **R-1289 (hub):** the vouch logged „behind the fleet's 0.344.0" — a release version.
-
-Evidence: felhom.eu `documentation/audits/release-monday-2026-10-26/agent-0166/`.
+- `cmd/felhom-agent/r1285_policy_after_commit_test.go`, in the real order: a pending marker for the running version →
+  `commit`, then exactly one `bundle-policy` plan; no marker / a mismatched marker → nothing. Red-proved (the hook call
+  removed → commit only, no pass — the demo-hp symptom of 2026-10-26).
+- **Not live:** only a box coming FROM 0.164.0 can show it (0.165.0's wrapper already applies D43 at plan time), which
+  needs a signed downgrade chain on a BYO box.