felhom-agent/REPORT.md

REPORT — two agent fixes on main, NOT released (night 2026-10-28 → 29, unattended)

Plain words first. Two changes are on main and tested. Neither is released: an agent release needs the operator's vouch, and the night brief allowed no release. Both go on the morning list.

What changed

• R-528 — the OOM counter (6f933d6, CI run id 2473 / #284 green). New local-API route GET /guest/oom-kills. It reads the kernel's oom_kill count of each Docker container of the token's own guest, on the host, from /sys/fs/cgroup/lxc/<vmid>/ns/system.slice/docker-<id>.scope/memory.events (mode 0444, readable by the non-root agent user). Docker inside an LXC guest does not see these kills (OOMKilled stays false). The controller reads the route every 30 s (controller eed23e7). Tests TestR528_*, red first by mutation (another guest's container served; oom parsed for oom_kill).
• R-1254 — the escrow ceremony half (5ddd124, CI run id 2471 / #283 green). After an escrow upload that fails, the agent asks the hub which package it holds (the identity blob compared): the new one → success; another one → 502 and „the previous code still works"; no answer → 504, which promises nothing. Tests TestR1254_*, red first.

Live proof

• R-528, 2026-10-28 23:27 UTC on Tester 1 with a test build of this agent (put back after: 0.167.0, sha256 28bdd282…). A Radicale capped at 128 MB, a memory hog inside it killed: the host counter 0 → 1, one app_oom „seen by docker,cgroup", one mail to the operator with "source":"docker,cgroup". Evidence: felhom.eu documentation/audits/night-2026-10-28/r528-oom/.
• R-1254: no live proof. It needs a hub answer lost on purpose; that is a hub change, and no hub deploy runs at night.

Next

The agent release (the operator's vouch), then pinned.day0_agent in scripts/retention-policy.json (D50). The controller needs no MinAgent change for R-528: an old agent answers 404, and the controller then waits 10 minutes before it asks again.