felhom-agent/REPORT.md

REPORT — night 2026-10-22 → 23: D30 on main, the D4 patches v2, nothing released

What: the night brief's agent parts. No release, no vouch. Design read: 03-host-agent.md (the tunnel, the key, the bundle), 06-offsite-connectivity.md (the full-list push to ep0).

• D30 (ae69ad4, hardened 39fb9cb, b9b831f): a handshake stamped in the future for 15 min → a new key pair, registered on POST /hosts/<id>/wg (the hub re-keys in place; its full-list push swaps the key on ep0 — nothing new on ep0). The key file is replaced by an fsynced rename over it (never missing or empty); the first old key stays private.key.prev, later ones dated (3 kept); the once-an-hour bound survives a restart; a wait stamp dated after now is dropped. Tests TestD30_* (7), each red-proved.
• Live (felhom.eu audits/night-2026-10-23/P2-D30/, test box Tester4-16fdef, fixture ae69ad4): with ep0 free to start a handshake, a 2-hour clock jump healed by itself and no re-key ran (correct); with ep0's starts dropped on the box, the tunnel stayed dead, the agent re-keyed at 15 min, the hub took the key (existed=false generation=3 sync=ok), the box switched at its next desired-state fetch and shook hands with the new key.
• D4 patches v2 (felhom.eu audits/night-2026-10-23/P3-review/), after a fresh review (A1–A7): try-reload-or-restart, an sshd -T read-back reported as sshd_dropin_not_in_force, a reload in undo, the right citation; installer: a warning when the reload fails. RootKeyOnly 6/6 (two new, red-proved); installer tests 40/40 with the patch. Both apply to tonight's mains. Live by hand on the test box: root password SSH refused, key works, web password 200.
• Gap filed: a reboot after the clock was corrected forgets the future stamp (felhom.eu R-1223).

CI by commit: ae69ad4 2229, 39fb9cb 2235 green; b9b831f and this docs commit: see felhom.eu REPORT-night-2026-10-23.md. Fixture names on the test box: 0.163.0-night.1 (= ae69ad4), then 0.162.99 (= b9b831f; a plain number, because the controller cannot compare a pre-release string — the off-site unlock refused).