# REPORT — agent v0.165.0 released and vouched (2026-10-25, attended release run)

**Plain words first.** Agent 0.165.0 runs on all four hosts (Tester 1, demo-hp, demo-felhom, and a BYO test host built
for this proof). The operator vouched it at 18:38:49 CET, so new installs get it. On an appliance the SSH key-only rule
stays in force; on a BYO host nothing is written and our old file is removed — one bundle run late (R-1285).

- **Release:** `scripts/release-agent.sh 0.165.0` from a clean clone; binary sha256
  `e9d04a47ee85222ce6c472633ecdcebe1baa88d6836848f9a7da6435a9adb7d3`, bundle sha256
  `8dea1f34d77ba40aa44c5461c3728c2ca94bab46854a6bd8b86191f520dfe85a`; CHANGELOG `4697f8a` (after the release, as the
  pre-push `release-complete` gate wants).
- **Delivery:** signed `agent_update` + `agent_config_update` per host through the hub. Each: `signed op COMPLETED`,
  `BUNDLE DONE … self-check=ok`, `selfupdate: update committed`; capability self-check 76/76.
- **Appliance (D43):** `sshd -T` → `permitrootlogin without-password` with our drop-in on Tester 1 and demo-hp.
- **BYO host:** VM 9371 on demo-hp, plain Proxmox VE 9.2 from an answer-file ISO, Felhom installed with
  `--mode byo` as customer Tester4 (`Tester4-f967d4`). Our 0.164.0 drop-in planted first (sha256 `f0485da5…`). After the
  0.165.0 update it was still there (the old wrapper planned that run); a second `agent_config_update` removed it,
  wrote nothing, and `sshd -T` read the owner's own `permitrootlogin yes`. Evidence: felhom.eu
  `documentation/audits/release-2026-10-26/byo/`.
- **R-1250:** released; the live proof is a dated check on 2026-10-27 (the agent tests only on its due Tuesday,
  10:00–15:59 local).
- **Not changed:** no code in this repo this run.