felhom-agent/REPORT.md

REPORT — agent v0.166.0 released and vouched (2026-10-26, attended release run)

Plain words first. Agent 0.166.0 runs on Tester 1, demo-hp and demo-felhom, and the operator vouched it at 10:04:55 CET, so new installs get it (a fresh install today fetched it). A signed job's window is now at most 24 hours — seen live. One part is not done: on a BYO host the SSH clean-up still comes one release late (R-1285, back to OPEN).

Release

• From a clean clone at aa69114 (CI 2351 ✓): tag v0.166.0; binary sha256 3f22c65b78914632fa476292f6b58e5af3ed9e9900f3a5a7a347a9c0bfea9c5c; bundle 093772c1bda8b974e86ed45472f8fadc8992f247563f5739876102a5156003a3; verified by independent download.
• Delivered by signed agent_update + agent_config_update: each box COMPLETED, bundle INSTALLED, self-check 76/76, update committed.
• D50 pin day0_agent → 0.166.0 (b890b57, CI 2356 ✓); the published gate green.

Live checks

• R-1280 (closed): a 25 h signed job on demo-hp → „REJECTED signed op — executor not called … op validity window too long (25h0m0s)"; a 30 min job ran. felhom-opsign -ttl 25h refuses (rc 2); 24 h accepted.
• R-1285 (back to OPEN): in the normal two-job delivery the bundle job runs in the OLD 0.165.0 process (demo-hp: bundle 09:03:07–09:03:09 CET, restart into 0.166.0 at 09:03:10), so no policy pass ran on that bundle. Under 0.166.0 a later bundle logged „BUNDLE POLICY DONE install_mode=appliance removed=0" — the pass is wired; its delivery order is not. No BYO host is in the fleet. Fix options in the row.
• R-1289 (hub): the vouch logged „behind the fleet's 0.344.0" — a release version.

Evidence: felhom.eu documentation/audits/release-monday-2026-10-26/agent-0166/.