felhom-agent/REPORT.md

REPORT — D43 = A: BYO hosts keep their own SSH settings (R-1257), 2026-10-24 night (unattended; commit only)

Brief: the restore-holes run, Part 4. Starting the run was the operator's ruling D43 = A. Previous report (R-1250's line hold, attended, same day): git show f5c3d77:REPORT.md.

• configs/felhom-os-apply (commit c8d3c17): the root-key-only sshd drop-in is an appliance-policy file — written only when the root-owned install record says appliance; on byo nothing is written and a copy we wrote (exact path, our header line) is removed (the previous copy kept for the undo, then sshd -t and a reload); a box whose record proves nothing is left as it is. X3: the in-force check asks sshd -T for each of the host's own global IPv4 addresses. X4: a failing sshd -t puts back only the SSH file (sshd_step_undone in the report); the rest of the bundle stays.
• Tests: configs/test_felhom_config_bundle.py class ByoKeepsItsSSH (7), each rule seen failing with it taken out (policy back to replace; the probe back to 192.0.2.1; sshd -t back to must). The fake box now carries an appliance record by default; all 68 bundle tests and 146 os-apply tests pass; agent_gates.py --fast OK.
• Not done here (Monday): the agent release v0.165.0 and the operator's vouch; a signed bundle on a BYO test host.
• Docs: felhom.eu 03 (the D4 paragraph) and 11 §1 carry the ruling; register R-1257 → VERIFY.