REPORT: the 2026-10-25 night — committed fixes, CI by hash, teardown. Docs only.

REPORT.md

@@ -1,21 +1,26 @@
-# REPORT — agent v0.165.0 released and vouched (2026-10-25, attended release run)
+# REPORT — D50 retention gate, R-1280, R-1285: committed, not released (2026-10-25 night)
 
-**Plain words first.** Agent 0.165.0 runs on all four hosts (Tester 1, demo-hp, demo-felhom, and a BYO test host built
-for this proof). The operator vouched it at 18:38:49 CET, so new installs get it. On an appliance the SSH key-only rule
-stays in force; on a BYO host nothing is written and our old file is removed — one bundle run late (R-1285).
+**Plain words first.** Three agent changes are on `main`. None is released. The release (v0.166.0) is Monday's and
+waits for the operator's vouch (felhom.eu `STATUS.md`, the Monday list).
 
-- **Release:** `scripts/release-agent.sh 0.165.0` from a clean clone; binary sha256
-  `e9d04a47ee85222ce6c472633ecdcebe1baa88d6836848f9a7da6435a9adb7d3`, bundle sha256
-  `8dea1f34d77ba40aa44c5461c3728c2ca94bab46854a6bd8b86191f520dfe85a`; CHANGELOG `4697f8a` (after the release, as the
-  pre-push `release-complete` gate wants).
-- **Delivery:** signed `agent_update` + `agent_config_update` per host through the hub. Each: `signed op COMPLETED`,
-  `BUNDLE DONE … self-check=ok`, `selfupdate: update committed`; capability self-check 76/76.
-- **Appliance (D43):** `sshd -T` → `permitrootlogin without-password` with our drop-in on Tester 1 and demo-hp.
-- **BYO host:** VM 9371 on demo-hp, plain Proxmox VE 9.2 from an answer-file ISO, Felhom installed with
-  `--mode byo` as customer Tester4 (`Tester4-f967d4`). Our 0.164.0 drop-in planted first (sha256 `f0485da5…`). After the
-  0.165.0 update it was still there (the old wrapper planned that run); a second `agent_config_update` removed it,
-  wrote nothing, and `sshd -T` read the owner's own `permitrootlogin yes`. Evidence: felhom.eu
-  `documentation/audits/release-2026-10-26/byo/`.
-- **R-1250:** released; the live proof is a dated check on 2026-10-27 (the agent tests only on its due Tuesday,
-  10:00–15:59 local).
-- **Not changed:** no code in this repo this run.
+## Each change, before → after
+
+| Row | Commit | Before | After | Proof |
+|---|---|---|---|---|
+| R-1290 (D50 = A) | `feaaa0e` | the published-versions gate knew no keep rule | it asserts the newest 5 released versions plus the pinned MinAgent floor (0.158.1) and the day-0 agent (0.165.0) in `scripts/retention-policy.json`; a pin with no tag fails | decoys seen failing; CI 2339 ✓ |
+| R-1280 | `d912307` | a signed job's window could be any length | at most 24 h — the verifier (`ErrWindowTooLong`), the root wrapper (`MAX_WINDOW_S`) and `felhom-opsign -ttl`; exactly 24 h is accepted | red-proof; unit tests; not live |
+| R-1285 | `abcc1e6` | a BYO host upgraded from an old wrapper kept our SSH drop-in until its NEXT bundle (the old wrapper planned the new bundle) | after every bundle install the agent runs the new wrapper's `bundle-policy` pass; the file is removed in one update; a failing `sshd -t` puts it back | red-proof; live on a BYO test VM: one signed run gave `BUNDLE POLICY REMOVED`; the test package was deleted after (204, then 404) |
+
+## CI (by commit hash, `jobs` endpoint)
+
+`feaaa0e` 2339 ✓ · `d912307` 2344 ✓ · `abcc1e6` 2345 ✓ — all `run_attempt` 1.
+
+## Teardown
+
+The BYO test VM (demo-hp 9372) was uninstalled through the product and destroyed. Its hub host record needs the
+operator's delete (felhom.eu `STATUS.md`).
+
+## Evidence
+
+felhom.eu `documentation/audits/night-2026-10-25/` (`redproof-d50.txt`, `redproof-r1280.txt`, `redproof-r1285.txt`,
+`rig/r1285-live.txt`).