felhom-agent/REPORT.md

REPORT — day 2026-10-23: agent 0.163.0 released, delivered to the three test boxes, vouched by the operator

What: the day brief's Part 2. Design read: 03-host-agent.md (the tunnel, the bundle), 11 §5.4.2 (the step bundle, R-880).

Release

• Code: 1109092 (D4 v2: the sshd drop-in /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf, PermitRootLogin prohibit-password, try-reload-or-restart, an sshd -T read-back; RootKeyOnly 6 tests). CI 2246 success. CHANGELOG b4721ee (v0.163.0 header, both sha256), CI 2249 success.
• scripts/release-agent.sh 0.163.0: binary sha256 561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c, config bundle sha256 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8; tag v0.163.0; verified by an independent download.
• Vouched by the operator 07:58:46 UTC — read back from the hub DB (with its WAL) and from the running hub's /configuration page: agent 0.163.0, both sha256 as above.

Delivery — three signed jobs per box (felhom-opsign, key felhom-op-1)

The D4 drop-in is a NEW bundle path, and the boxes ran bundle 0.160.0 (sha256 6b0609…), so: agent_update 0.163.0 → agent_config_update 0.163.0-step1 (built with scripts/build-step-bundle.py from 0.160.0: only felhom-os-apply replaced; sha256 6cbc0669…, uploaded and read back) → agent_config_update 0.163.0.

Box	agent	bundle	self-check	swap = RAM (pool guest 9201)	drop-in, sshd -T	sshd reloaded	key login	felhom-sshd
Tester 1	0.163.0	0.163.0	ok	4096 / 4096	in place, without-password	09:27:38 SIGHUP	ok	active, listening, sshd -t ok
demo-hp	0.163.0	0.163.0	ok	25898 / 25898	in place, without-password	09:19:44 SIGHUP	ok	active, listening, sshd -t ok
demo-felhom	0.163.0	0.163.0	ok	12288 / 12288	in place, without-password	09:24:42 SIGHUP	ok	active, listening, sshd -t ok

Not proven, said plainly: the real root password over SSH was not tried (CC does not hold it); a dummy password is refused, but OpenSSH logs that only as „Failed password", so the policy proof is sshd -T + the reload. felhom-sshd (:8822) admits only the operator peer over the tunnel, so a connection from DooPlex times out by design. The console login is not touched by the drop-in (passwd -S root = P on all three); not tried at a physical console.

Installer 1.36.0 (the uninstall removes the drop-in) was published the same day (felhom.eu). R-982 and R-1204 closed. Evidence: felhom.eu documentation/audits/day-2026-10-23/07-agent-0163-boxes.txt, 10-vouch-readback.txt, 11-installer-1360.txt.