felhom-agent/REPORT.md

REPORT — night 2026-10-22: one change on main, one ready patch, nothing released

What: the night brief's agent parts. No agent release, no vouch (both forbidden tonight). Design read: 03-host-agent.md (the WireGuard tunnel, the config bundle), 06-offsite-connectivity.md.

• R-1204, a0c88e5 (on main, unreleased). The heartbeat's wireguard block gains handshake_future_s when the last handshake lies more than 60 s in the future (wgtunnel.handshakeFuture) — the clock-ahead lock-out that the clamped last_handshake_age_s hid. Red-proved (TestR1204_AFutureHandshakeIsReported). The hub's alarm on it is hub 0.166.0 (felhom.eu, built, not deployed).
• R-982 / D4 (operator 15:47: root SSH from the LAN by key only) — a ready patch, NOT on main (7651461 moved it out). A bundle drop-in /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf (PermitRootLogin prohibit-password), checked and reloaded by felhom-os-apply; proven on a fresh install from ISO 1.30.0 (nested VM 9343, destroyed): password SSH refused, key works, the console and the PVE web login keep the password. Patches: felhom.eu audits/night-2026-10-22/P2-D4/felhom-agent-bundle-D4.patch + felhom.eu-installer-D4.patch. They ship with the next agent release (the operator's vouch) and the next installer tag.
• Correction: the CHANGELOG first said a push of the installer would publish it. Wrong: /scripts/ is served from the tag installer-v1.35.0 (R-110). The decision to keep D4 as a patch stands on the other two reasons.
• Gates: agent_gates.py --fast green before each push. CI by commit: felhom.eu REPORT-night-2026-10-22.md.
• Teardown: VM 9343 destroyed on demo-hp (own id); its hub appliance (id 49) waits for the operator's Discard.