felhom-agent/REPORT.md

REPORT — v0.172.1 released, NOT vouched (2026-11-07, attended)

Plain words first. Since 2026-11-05 the N100 refused its nightly Proxmox updates. One GRUB package (proxmox-grub) was in the wrong update group, and it pulled the main GRUB package with it. A safety check then stopped the whole group. Agent 0.172.1 puts proxmox-grub with the other boot packages. It is published. It waits for the operator's vouch and two signed jobs per box.

Built from	39db030, release-agent.sh (gates green; tag v0.172.1 pushed)
Agent sha256	505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8
Bundle sha256	3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3
Re-checked	both downloaded again and hashed; the binary prints felhom-agent 0.172.1; the bundle's felhom-os-apply holds the fix
Bundle vs 0.170.0	no path added or removed; only felhom-os-apply changed — no step bundle needed (R-880)
Test	test_ring0_pending_pve_leaves_proxmox_grub_out — red before the fix, green after; wrapper suite 149/149; go test -count=1 ./internal/osupdate/ ok
Design	felhom.eu/documentation/architecture/11-os-updates.md (the lanes, §5.4.2 bundle)

Evidence. felhom.eu/documentation/audits/demo-check-2026-11-07/n100-pve-step-R6.txt: the three nights' refusals and a read-only apt-get -s that shows proxmox-grub pulling grub-efi-amd64.

For the operator — deliver it (PowerShell, on the Windows machine)

0. Hub → Configuration → Day-0 artifacts: vouch agent 0.172.1 (sha and bundle above).
1. Check the key. The last word before the comment must be …B63tlLw+ (the pinned signer felhom-op-1):

   Get-Content $HOME\.ssh\felhom-op-operational.pub
   

2. Set up (the hub key is the hub's global key, the report-api one; it is asked, not typed on a line):

   cd $HOME\.ssh
   $Hub    = "https://hub.felhom.eu"
   $Ver    = "0.172.1"
   $Sha    = "505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8"
   $Bundle = "3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3"
   $Key    = "$HOME\.ssh\felhom-op-operational"
   $Boxes  = "demo-felhom-8363b5", "demo-hp-bb76ea", "tester-1-d70be4"
   $s      = Read-Host "Hub global key" -AsSecureString
   $HubKey = [System.Net.NetworkCredential]::new("", $s).Password
   

3. The agent (each box takes it in 4–15 min):

   foreach ($b in $Boxes) { .\felhom-opsign.exe -op agent_update -host $b -key-id felhom-op-1 -key $Key -agent-version $Ver -sha256 $Sha -ttl 45m -upload $Hub -hub-key $HubKey }
   

4. Wait until the hub's System page shows agent 0.172.1 on all three (about 15 min). Then the root files:

   foreach ($b in $Boxes) { .\felhom-opsign.exe -op agent_config_update -host $b -key-id felhom-op-1 -key $Key -agent-version $Ver -bundle-sha256 $Bundle -ttl 45m -upload $Hub -hub-key $HubKey }
   

5. Clean up: Remove-Variable HubKey, s

After the vouch (CC, D50): set pinned.day0_agent = 0.172.1 in scripts/retention-policy.json.

Also in this session (no agent change)

• demo-hp: the whole-guest LOCAL tier had been refused by the space preflight for 9 days. With the operator's yes, the journal was shrunk to 500 MB (whole journal saved first, off-git on DooPlex) and the August test archive of guest 9100 removed: 9.5 GB → 14 GB free. Recorded under R-548 (the product half stays open).