v0.168.0 released and vouched: CONTEXT, REPORT

CONTEXT.md

@@ -1,5 +1,11 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-10-29 (attended release run) — v0.168.0 RELEASED and VOUCHED (10:21:56 CET).** `release-agent.sh` from a clean
+> clone of `91bd96c` (agent `1e70196c…`, bundle `3415c034…`, tag `v0.168.0`); no configs/ change → binary-only signed
+> `agent_update` to demo-hp, Tester 1, demo-felhom, each committed, self-check 76/76; `pinned.day0_agent` = 0.168.0 (D50).
+> R-528 proven on the release (Tester 1: one `app_oom` „seen by docker,cgroup", host counter 1). R-1254: the happy path ran
+> live (a ceremony on 0.168.0 + controller 0.347.0); the lost-answer branch has tests only.
+
 > **2026-10-28 night (unattended) — R-528 + R-1254 on `main` (`6f933d6`, `5ddd124`), NOT released (the next agent
 > release, the operator's vouch).** `GET /guest/oom-kills` (`internal/localapi/guest_oom.go`): the host-side `oom_kill`
 > of each Docker container of the token's guest (`Server.cgroupRoot` is the test seam); proven on Tester 1 with a test

REPORT.md

@@ -1,30 +1,18 @@
-# REPORT — two agent fixes on main, NOT released (night 2026-10-28 → 29, unattended)
+# REPORT — v0.168.0 released and vouched (2026-10-29, attended)
 
-**Plain words first.** Two changes are on main and tested. Neither is released: an agent release needs the operator's
-vouch, and the night brief allowed no release. Both go on the morning list.
+**Plain words first.** The agent 0.168.0 is out, on the three test boxes, and vouched by the operator — new boxes install
+it. It carries R-528 (the host's per-container OOM count) and R-1254's ceremony half.
 
-## What changed
+- **Release:** `release-agent.sh` from a clean clone of `91bd96c` (CI 2479 green): agent sha256
+  `1e70196c51346cf10e3f04f51975de5899b5dc6baa5a45ec1d17bc248830d2ca`, bundle
+  `3415c034955d46c59ca3f7b284a648abf852b1257b77cc49bd6ea9994a7b8cb8`, tag `v0.168.0`, verified by independent download.
+- **Delivery:** no configs/ change since v0.167.0 → one signed `agent_update` per box: demo-hp 09:56, Tester 1 09:57,
+  demo-felhom 10:04 CET — each „signed op COMPLETED", self-check 76/76, „update committed"; the binary's sha256 matches on
+  all three.
+- **Proof:** on Tester 1 (controller 0.347.0) a 128 MB Gokapi had a memory hog killed: host counter 1, one `app_oom`
+  „seen by docker,cgroup", one operator mail. R-1254: a ceremony ran on 0.168.0 (the happy path); the lost-answer branch
+  has tests only.
+- **Vouch:** the operator, 10:21:56 CET (hub log: agent=0.168.0, the bundle sha above). `pinned.day0_agent` = 0.168.0
+  (`6b0b093`).
 
-- **R-528 — the OOM counter (`6f933d6`, CI run id 2473 / #284 green).** New local-API route `GET /guest/oom-kills`. It
-  reads the kernel's `oom_kill` count of each Docker container of the token's own guest, on the host, from
-  `/sys/fs/cgroup/lxc/<vmid>/ns/system.slice/docker-<id>.scope/memory.events` (mode 0444, readable by the non-root
-  agent user). Docker inside an LXC guest does not see these kills (`OOMKilled` stays false). The controller reads the
-  route every 30 s (controller `eed23e7`). Tests `TestR528_*`, red first by mutation (another guest's container served;
-  `oom` parsed for `oom_kill`).
-- **R-1254 — the escrow ceremony half (`5ddd124`, CI run id 2471 / #283 green).** After an escrow upload that fails, the
-  agent asks the hub which package it holds (the identity blob compared): the new one → success; another one → 502 and
-  „the previous code still works"; no answer → 504, which promises nothing. Tests `TestR1254_*`, red first.
-
-## Live proof
-
-- R-528, 2026-10-28 23:27 UTC on Tester 1 with a test build of this agent (put back after: 0.167.0, sha256 `28bdd282…`).
-  A Radicale capped at 128 MB, a memory hog inside it killed: the host counter 0 → 1, one `app_oom` „seen by
-  docker,cgroup", one mail to the operator with `"source":"docker,cgroup"`. Evidence: felhom.eu
-  `documentation/audits/night-2026-10-28/r528-oom/`.
-- R-1254: no live proof. It needs a hub answer lost on purpose; that is a hub change, and no hub deploy runs at night.
-
-## Next
-
-The agent release (the operator's vouch), then `pinned.day0_agent` in `scripts/retention-policy.json` (D50).
-The controller needs no MinAgent change for R-528: an old agent answers 404, and the controller then waits 10 minutes
-before it asks again.
+Evidence: felhom.eu `documentation/audits/d63-2026-10-29/` (`opsign-agent.txt`, `agent-delivery*.txt`, `run-p4-oom.log`).