From b890b575402631e9b53a4cb242e7081712edc1aa Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 26 Oct 2026 10:07:15 +0100 Subject: [PATCH] =?UTF-8?q?v0.166.0=20released=20and=20vouched=20by=20the?= =?UTF-8?q?=20operator=20(10:04:55=20CET):=20CHANGELOG=20header=20(R-1280?= =?UTF-8?q?=20live,=20R-1285=20back=20to=20OPEN=20=E2=80=94=20the=20bundle?= =?UTF-8?q?=20job=20runs=20in=20the=20old=20process);=20D50=20day0=5Fagent?= =?UTF-8?q?=20pin=20=E2=86=92=200.166.0.=20Docs=20only.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 20 +++++++++++++++++--- scripts/retention-policy.json | 6 +++--- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0e3fc97..e6f8caa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,18 @@ -## 2026-10-25 (night, unattended) — a BYO host loses our SSH drop-in in ONE update (R-1285) — committed, NOT released +## v0.166.0 (2026-10-26) — a signed job's window is at most 24 h (R-1280); the policy pass after each bundle (R-1285); the published gate follows D50 (R-1290) — released in the attended release run; **VOUCHED by the operator 2026-10-26 10:04:55 CET** (binary `3f22c65b…`, bundle `093772c1…`) + +Released from a clean clone at `aa69114` (tag `v0.166.0`; binary sha256 `3f22c65b78914632fa476292f6b58e5af3ed9e9900f3a5a7a347a9c0bfea9c5c`, +bundle `093772c1bda8b974e86ed45472f8fadc8992f247563f5739876102a5156003a3`); delivered to Tester 1, demo-hp and demo-felhom +by signed `agent_update` + `agent_config_update` (each: COMPLETED, bundle INSTALLED, self-check 76/76, update committed). +Live: a 25 h signed job REJECTED on demo-hp („op validity window too long"), a 30 min one ran; `felhom-opsign -ttl 25h` +refuses. D50 pin `day0_agent` → 0.166.0 (`scripts/retention-policy.json`). Evidence: felhom.eu +`documentation/audits/release-monday-2026-10-26/agent-0166/`. + +**Found at the release (felhom.eu R-1285, back to OPEN):** in the normal two-job delivery the bundle job runs in the OLD +process (0.165.0) before the restart into 0.166.0, so the policy pass does not run on that bundle — a BYO host coming +from 0.164.0 still loses our drop-in one release late. The pass itself is wired: under 0.166.0 a later bundle logged +„BUNDLE POLICY DONE install_mode=appliance removed=0". + +### 2026-10-25 (night, unattended) — a BYO host loses our SSH drop-in in ONE update (R-1285) — committed, NOT released - **The cause, measured 2026-10-25 on a BYO test host:** the bundle that brings a new `felhom-os-apply` is planned by the OLD one on disk, which did not know D43's appliance-only policy — so a BYO host upgraded from 0.164.0 kept our @@ -13,7 +27,7 @@ `ByoKeepsItsSSH.test_the_policy_pass_*` (three). Red-proofs: felhom.eu `documentation/audits/night-2026-10-25/redproof-r1285.txt`. -## 2026-10-25 (night, unattended) — a signed job's window is at most 24 h (R-1280, D44 #22) — committed, NOT released (rides the next agent release; the vouch is the operator's) +### 2026-10-25 (night, unattended) — a signed job's window is at most 24 h (R-1280, D44 #22) — committed, NOT released (rides the next agent release; the vouch is the operator's) - `internal/authz/verifier.go`: `MaxWindow = 24h`; a blob whose `expires_at - issued_at` is longer is refused (`ErrWindowTooLong`) before the expiry and nonce checks — a job signed with a long window by mistake no longer stays @@ -25,7 +39,7 @@ `test_felhom_os_apply.DockerLane.test_a_window_longer_than_24h_is_refused` / `…_of_24h_is_accepted`. Both refusals seen failing with their check switched off: felhom.eu `documentation/audits/night-2026-10-25/redproof-r1280.txt`. -## 2026-10-25 (evening, attended) — the `published` gate follows D50 = A: the newest 5 plus the pinned MinAgent and day-0 agent (R-1290; no binary change) +### 2026-10-25 (evening, attended) — the `published` gate follows D50 = A: the newest 5 plus the pinned MinAgent and day-0 agent (R-1290; no binary change) - **D50 = A** (operator, 2026-10-25): the registry keeps the newest 5 released agent versions, the hub's MinAgent floor and the day-0 manifest's agent. `scripts/retention-policy.json`: `generic_versions_kept` 10 → 5, new `pinned` diff --git a/scripts/retention-policy.json b/scripts/retention-policy.json index e1b0d17..52f2f29 100644 --- a/scripts/retention-policy.json +++ b/scripts/retention-policy.json @@ -24,10 +24,10 @@ "readers": [ "scripts/check-published-versions.py — asserts the newest N versions plus every pinned version" ], - "recorded": "2026-10-25", - "recorded_by": "CC 2026-10-25, D50 = A (operator); earlier history: R-287 (2026-08-09), R-291 (2026-10-05)", + "recorded": "2026-10-26", + "recorded_by": "CC 2026-10-26: day0_agent 0.166.0 (operator vouch 2026-10-26 10:04:55 CET); D50 = A (operator 2026-10-25); earlier history: R-287 (2026-08-09), R-291 (2026-10-05)", "pinned": { "hub_min_agent": "0.158.1", - "day0_agent": "0.165.0" + "day0_agent": "0.166.0" } }