v0.165.0 vouched by the operator (18:38:49 CET); REPORT: release, delivery to four hosts, the BYO proof (removal one bundle late, felhom.eu R-1285). Docs only.

CHANGELOG.md

@@ -1,4 +1,6 @@
-## v0.165.0 (2026-10-25) — D43 = A: BYO hosts keep their own SSH settings (R-1257); the line test for a box that seeds all day (R-1250) — released in the attended release run; the vouch is the operator's
+## v0.165.0 (2026-10-25) — D43 = A: BYO hosts keep their own SSH settings (R-1257); the line test for a box that seeds all day (R-1250) — released in the attended release run; **VOUCHED by the operator 2026-10-25 18:38:49 CET** (binary `e9d04a47…`, bundle `8dea1f34…`)
+
+**Found at the release (felhom.eu R-1285, P4):** on a BYO host upgraded from 0.164.0 the drop-in is removed only on the bundle run AFTER the one that installs this wrapper — the first run is planned by the old wrapper. Proven on a BYO test host (VM 9371 on demo-hp): the second `agent_config_update` logged `BUNDLE REMOVED … (ours, on a BYO host — D43)`.
 
 ### BYO hosts keep their own SSH settings (R-1257, D43 = A) — 2026-10-24 night
 

REPORT.md

@@ -1,16 +1,21 @@
-# REPORT — D43 = A: BYO hosts keep their own SSH settings (R-1257), 2026-10-24 night (unattended; commit only)
+# REPORT — agent v0.165.0 released and vouched (2026-10-25, attended release run)
 
-Brief: the restore-holes run, Part 4. Starting the run was the operator's ruling **D43 = A**. Previous report (R-1250's
-line hold, attended, same day): `git show f5c3d77:REPORT.md`.
+**Plain words first.** Agent 0.165.0 runs on all four hosts (Tester 1, demo-hp, demo-felhom, and a BYO test host built
+for this proof). The operator vouched it at 18:38:49 CET, so new installs get it. On an appliance the SSH key-only rule
+stays in force; on a BYO host nothing is written and our old file is removed — one bundle run late (R-1285).
 
-- **`configs/felhom-os-apply` (commit `c8d3c17`):** the root-key-only sshd drop-in is an `appliance`-policy file —
-  written only when the root-owned install record says `appliance`; on `byo` nothing is written and a copy we wrote
-  (exact path, our header line) is removed (the previous copy kept for the undo, then `sshd -t` and a reload); a box
-  whose record proves nothing is left as it is. **X3:** the in-force check asks `sshd -T` for each of the host's own
-  global IPv4 addresses. **X4:** a failing `sshd -t` puts back only the SSH file (`sshd_step_undone` in the report);
-  the rest of the bundle stays.
-- **Tests:** `configs/test_felhom_config_bundle.py` class `ByoKeepsItsSSH` (7), each rule seen failing with it taken out
-  (policy back to `replace`; the probe back to 192.0.2.1; `sshd -t` back to `must`). The fake box now carries an
-  appliance record by default; all 68 bundle tests and 146 os-apply tests pass; `agent_gates.py --fast` OK.
-- **Not done here (Monday):** the agent release v0.165.0 and the operator's vouch; a signed bundle on a BYO test host.
-- Docs: felhom.eu `03` (the D4 paragraph) and `11` §1 carry the ruling; register R-1257 → VERIFY.
+- **Release:** `scripts/release-agent.sh 0.165.0` from a clean clone; binary sha256
+  `e9d04a47ee85222ce6c472633ecdcebe1baa88d6836848f9a7da6435a9adb7d3`, bundle sha256
+  `8dea1f34d77ba40aa44c5461c3728c2ca94bab46854a6bd8b86191f520dfe85a`; CHANGELOG `4697f8a` (after the release, as the
+  pre-push `release-complete` gate wants).
+- **Delivery:** signed `agent_update` + `agent_config_update` per host through the hub. Each: `signed op COMPLETED`,
+  `BUNDLE DONE … self-check=ok`, `selfupdate: update committed`; capability self-check 76/76.
+- **Appliance (D43):** `sshd -T` → `permitrootlogin without-password` with our drop-in on Tester 1 and demo-hp.
+- **BYO host:** VM 9371 on demo-hp, plain Proxmox VE 9.2 from an answer-file ISO, Felhom installed with
+  `--mode byo` as customer Tester4 (`Tester4-f967d4`). Our 0.164.0 drop-in planted first (sha256 `f0485da5…`). After the
+  0.165.0 update it was still there (the old wrapper planned that run); a second `agent_config_update` removed it,
+  wrote nothing, and `sshd -T` read the owner's own `permitrootlogin yes`. Evidence: felhom.eu
+  `documentation/audits/release-2026-10-26/byo/`.
+- **R-1250:** released; the live proof is a dated check on 2026-10-27 (the agent tests only on its due Tuesday,
+  10:00–15:59 local).
+- **Not changed:** no code in this repo this run.