felhom-agent/REPORT.md

REPORT — v0.173.0 released, vouched and delivered to the three test boxes (2026-11-10, attended)

Plain words first. Each agent update left its downloaded file on the box for ever. Version 0.173.0 removes the old files after an update that ended well. It is released and it runs on the three test boxes. The folders went from 49, 48 and 33 files to 1 file each. A rollback still works after the clean-up. The operator vouched it at 16:29 CET.

The full report of the run is in felhom.eu: REPORT-release-space-fixes-2026-11-10.md.

One claim that was wrong

The CHANGELOG entry and the report of the morning said: a box cleans its folder at the first good update AFTER the release. That was wrong. The commit runs in the new binary. So the box cleans the folder at the commit of the update that brings the code. Measured on three boxes; the CHANGELOG entry is corrected.

The release

Version	0.173.0, scripts/release-agent.sh from a clean clone of 776025c8 (tag v0.173.0)
Agent sha256	752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea
Bundle sha256	51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1
CI	776025c8: run 2608, gates #311, success (read by commit on the public Actions page)
Delivery	one signed agent_update per box. No bundle job: configs/ did not change since v0.172.1
Vouch	the operator, 2026-11-10 16:29:16 CET. Read from the hub log: Artifact manifest set: agent=0.173.0, bundle sha = the release. pinned.day0_agent = 0.173.0 (D50)

The folder /var/lib/felhom-agent/selfupdate, before and after

Box	Before (on 0.172.1)	After the commit of 0.173.0	Commit (UTC)
demo-hp	49 entries, 722,596 KB	1 entry, 16,028 KB	14:59:19, removed=49
demo-felhom	48 entries, 706,968 KB	1 entry, 16,028 KB	14:51:50, removed=48
Tester 1	33 entries, 497,244 KB	1 entry, 16,028 KB	15:00:19, removed=33

After each commit: pending.json absent, /usr/local/bin/felhom-agent.prev = 0.172.1, the unit active, no restart.

The rollback proof (Tester 1)

1. A signed agent_update to 0.172.1 (the vouched version) was uploaded at 15:01:19 UTC. The box took it at its next report, 15:14:31 UTC. The wrapper installed 0.172.1 and wrote the pending marker.
2. At 15:14:40 UTC, inside the 60-second dwell, one systemctl kill -s SEGV hit the agent's main process.
3. The unit's OnFailure ran the wrapper's rollback. Journal: rolled back to previous binary and restarted felhom-agent.service. 0.173.0 started at 15:14:40 UTC.
4. Read at 15:15:56 UTC: agent 0.173.0, active, pending.json absent, no failed unit. The folder holds 2 files (32,040 KB): the running version's and the failed 0.172.1. The failed file stays by design, until the next good update.

This is the path the repo already has. No second version was released for the proof.

What stays open

• /usr/local/bin/felhom-agent.bak-* (R-1368 part 4): demo-felhom holds 11 such files, demo-hp 1. The agent cannot reach them.
• After a rollback, /usr/local/bin/felhom-agent.prev holds the same version as the running binary. That is how the wrapper works; it is not new.

Evidence: felhom.eu documentation/audits/release-space-fixes-2026-11-10/agent/.