# REPORT — v0.172.1 released, NOT vouched (2026-11-07, attended)

**Plain words first.** Since 2026-11-05 the N100 refused its nightly Proxmox updates. One GRUB package
(`proxmox-grub`) was in the wrong update group, and it pulled the main GRUB package with it. A safety check then
stopped the whole group. Agent 0.172.1 puts `proxmox-grub` with the other boot packages. It is published. It waits
for the operator's vouch and two signed jobs per box.

| | |
|---|---|
| Built from | `39db030`, `release-agent.sh` (gates green; tag `v0.172.1` pushed) |
| Agent sha256 | `505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8` |
| Bundle sha256 | `3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3` |
| Re-checked | both downloaded again and hashed; the binary prints `felhom-agent 0.172.1`; the bundle's `felhom-os-apply` holds the fix |
| Bundle vs 0.170.0 | no path added or removed; only `felhom-os-apply` changed — no step bundle needed (R-880) |
| Test | `test_ring0_pending_pve_leaves_proxmox_grub_out` — red before the fix, green after; wrapper suite 149/149; `go test -count=1 ./internal/osupdate/` ok |
| Design | `felhom.eu/documentation/architecture/11-os-updates.md` (the lanes, §5.4.2 bundle) |

**Evidence.** `felhom.eu/documentation/audits/demo-check-2026-11-07/n100-pve-step-R6.txt`: the three nights' refusals
and a read-only `apt-get -s` that shows `proxmox-grub` pulling `grub-efi-amd64`.

## For the operator — deliver it (PowerShell, on the Windows machine)

0. Hub → Configuration → Day-0 artifacts: vouch agent **0.172.1** (sha and bundle above).
1. Check the key. The last word before the comment must be `…B63tlLw+` (the pinned signer `felhom-op-1`):
   ```powershell
   Get-Content $HOME\.ssh\felhom-op-operational.pub
   ```
2. Set up (the hub key is the hub's global key, the `report-api` one; it is asked, not typed on a line):
   ```powershell
   cd $HOME\.ssh
   $Hub    = "https://hub.felhom.eu"
   $Ver    = "0.172.1"
   $Sha    = "505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8"
   $Bundle = "3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3"
   $Key    = "$HOME\.ssh\felhom-op-operational"
   $Boxes  = "demo-felhom-8363b5", "demo-hp-bb76ea", "tester-1-d70be4"
   $s      = Read-Host "Hub global key" -AsSecureString
   $HubKey = [System.Net.NetworkCredential]::new("", $s).Password
   ```
3. The agent (each box takes it in 4–15 min):
   ```powershell
   foreach ($b in $Boxes) { .\felhom-opsign.exe -op agent_update -host $b -key-id felhom-op-1 -key $Key -agent-version $Ver -sha256 $Sha -ttl 45m -upload $Hub -hub-key $HubKey }
   ```
4. Wait until the hub's System page shows agent 0.172.1 on all three (about 15 min). Then the root files:
   ```powershell
   foreach ($b in $Boxes) { .\felhom-opsign.exe -op agent_config_update -host $b -key-id felhom-op-1 -key $Key -agent-version $Ver -bundle-sha256 $Bundle -ttl 45m -upload $Hub -hub-key $HubKey }
   ```
5. Clean up: `Remove-Variable HubKey, s`

**After the vouch (CC, D50):** set `pinned.day0_agent` = 0.172.1 in `scripts/retention-policy.json`.

## Also in this session (no agent change)

- demo-hp: the whole-guest LOCAL tier had been refused by the space preflight for 9 days. With the operator's yes,
  the journal was shrunk to 500 MB (whole journal saved first, off-git on DooPlex) and the August test archive of
  guest 9100 removed: 9.5 GB → 14 GB free. Recorded under R-548 (the product half stays open).