felhom-agent/REPORT.md

REPORT — agent v0.165.0 released and vouched (2026-10-25, attended release run)

Plain words first. Agent 0.165.0 runs on all four hosts (Tester 1, demo-hp, demo-felhom, and a BYO test host built for this proof). The operator vouched it at 18:38:49 CET, so new installs get it. On an appliance the SSH key-only rule stays in force; on a BYO host nothing is written and our old file is removed — one bundle run late (R-1285).

• Release: scripts/release-agent.sh 0.165.0 from a clean clone; binary sha256 e9d04a47ee85222ce6c472633ecdcebe1baa88d6836848f9a7da6435a9adb7d3, bundle sha256 8dea1f34d77ba40aa44c5461c3728c2ca94bab46854a6bd8b86191f520dfe85a; CHANGELOG 4697f8a (after the release, as the pre-push release-complete gate wants).
• Delivery: signed agent_update + agent_config_update per host through the hub. Each: signed op COMPLETED, BUNDLE DONE … self-check=ok, selfupdate: update committed; capability self-check 76/76.
• Appliance (D43): sshd -T → permitrootlogin without-password with our drop-in on Tester 1 and demo-hp.
• BYO host: VM 9371 on demo-hp, plain Proxmox VE 9.2 from an answer-file ISO, Felhom installed with --mode byo as customer Tester4 (Tester4-f967d4). Our 0.164.0 drop-in planted first (sha256 f0485da5…). After the 0.165.0 update it was still there (the old wrapper planned that run); a second agent_config_update removed it, wrote nothing, and sshd -T read the owner's own permitrootlogin yes. Evidence: felhom.eu documentation/audits/release-2026-10-26/byo/.
• R-1250: released; the live proof is a dated check on 2026-10-27 (the agent tests only on its due Tuesday, 10:00–15:59 local).
• Not changed: no code in this repo this run.