docs(pilot): agent 0.93.0 publish train record + onboarding §A5 gate discharged

REPORT.md

@@ -1,56 +1,49 @@
-# REPORT — Runbook refresh: RUNBOOK-onboarding-draft v3 → v4 (docs-only, XS)
+# REPORT — Agent-only publish train 0.93.0 executed (operational run, docs-only in this repo)
 
-**Date:** 2026-07-22 · **Repo:** `felhom.eu` · **Scope:** documentation only — no code, no version
-bump, no deploy. The onboarding runbook was refreshed against what shipped 2026-07-18..21 and
-against the second full onboarding on virgin hardware (HP t740, 2026-07-21).
+**Date:** 2026-07-22 · **Repo:** `felhom.eu` (runbook record + §A5 discharge; no code, no version
+bump, no hub deploy) · **Full record:** `documentation/pilot/RUNBOOK-publish-agent-0.93-2026-07-22.md`
 
-## What changed
+## What happened
 
-`documentation/runbooks/RUNBOOK-onboarding-draft-v3.md` → **`RUNBOOK-onboarding-draft-v4.md`**
-(git mv, one commit), per the project-Claude refresh brief of 2026-07-21:
+felhom-agent **v0.93.0** (hyphen-free escrow wordlist, source-only since 2026-07-21 at `a452dc33`)
+was **built, published, manifest-vouched and deployed to both fleet boxes** by CC, with one
+password-gated STOP → Viktor (the Day-0 manifest save, verified by CC in the hub DB **before** any
+box moved — publish-train rule 1).
 
-1. **R-39 interim blocks DELETED** (B4 descriptor caveat + E1 manual `pvesm status` check) —
-   replaced with one sentence each: the DR tier self-detects a dead credential (loud `auth_failed`)
-   and self-heals via damped re-issue; the hub gauge is trustworthy. Cited: `backlog/ROADMAP.md`
-   R-39 (CLOSED, proven live 2026-07-21, hub 0.68.1 + agent 0.91.2, 13 s chain
-   `applied → auth_failed → applied`).
-2. **R-36 workaround block in C4 DELETED** (re-onboarding manual-Save) — replaced with the shipped
-   behaviour: enabled-but-unprovisioned raises an amber banner (hub v0.67.0). R-31 (Save-once/504)
-   and the R-32 orphan-card note KEPT. Consistency follow-through: A1 and the B3 note now say the
-   self-bind link is **auto-minted at create/RESET** (also R-36) — the manual mint is the re-mint
-   fallback.
-3. **C1 freemail gate** — freemail.hu PROVEN 2026-07-21 (operator test-send received; R-4 COMPLETE
-   per `backlog/ROADMAP.md`); the check-spam habit line kept.
-4. **A1 golden note** — golden 0.153.0 carries all four infra images; floor-lift proven on TWO
-   shapes (rehearsal 0.143→0.145 in 5 s; virgin HP t740 0.153.0→0.156.0 during day-0, `CONTEXT.md`).
-   "Rebuild before first tester" softened to a pointer at the standing rule in F.
-5. **A3 loader note** — the single F1 line replaced with the loader table. **Deviation from the
-   brief, on the record's side:** the brief said "N100/AMI = shim"; the record
-   (`operations/nodes.md` + `tests/VALIDATION-n100-baremetal-2026-07-16.md` F1) says the N100
-   installed with **mkimage, SB off** — the AMI AN3PLUS firmware cannot relocate the signed GRUB,
-   which is exactly why shim was not usable there. Table written per the record, as the brief's
-   "(SB state as recorded)" directs. HP t740 = shim with Secure Boot ENABLED (2026-07-21).
-6. **B2/B3 second datapoint** — the HP onboarding walked register → pairing banner → unclaimed
-   list → self-bind (code + passphrase) → day-0 → dashboard on never-seen hardware (cited
-   `CONTEXT.md` + `operations/nodes.md`). New B2 gotcha: on multi-NIC boards verify the CABLED
-   port got the lease during install (the t740 4-port trap; R-59/R-60 pending).
-7. **New A5 checklist item** — agent train ≥ v0.93.0 (hyphen-free recovery wordlist,
-   `felhom-agent/CHANGELOG.md`) must be BUILT + DEPLOYED to the customer's box before the FIRST
-   real tester's escrow ceremony; ceremonies run box-side, source-only does not count.
-8. **D offboarding pointer** — R-25b ruling noted: full teardown = DELETE cascade (TASK-I),
-   RESET = identity-preserving re-onboarding; pointer to §G.
-9. **KEPT unchanged:** DRAFT status, the C7 graduation-gate paragraph (still the last unwalked
-   step), all reference wall-clocks, all F rules, all of §G.
+- **Artifact:** sha256 `a68b2ff73200622ea9e23aed71a0a8ff885808626cab9e9d554a5a5df5ced28f`
+  (13 817 690 bytes), sha-chain identical: built binary → Gitea package (PUT 201) → independent
+  anonymous GET.
+- **Manifest:** agent 0.92.1→**0.93.0** + new sha. Golden (0.153.0), floor (**0.156.0**) and
+  wrapper sha **byte-identical before/after**. **Deviation, ruled:** MinAgent moved 0.92.1→0.93.0
+  at the operator save (spec said do-not-touch); flagged before deploy, Viktor ruled leave it —
+  the held-floor window was transient (minutes) and harmless.
+- **Deploys** (felhom-pve first, then demo-hp over G1 break-glass — secret file→file, shredded):
+  both boxes clean-restart **5/5** — active/NRestarts=0, capabilities **68/68 degraded=0**,
+  ReassertGuestBinds touched only enrolled drives, guestnet sweeps quiet (0 ERROR/WARN), hub
+  `hosts.agent_version` = **0.93.0** for both (06:56:52Z / 06:57:52Z). `.bak-0.92.1` retained on
+  both; escape hatch not needed.
+- **Green gate** on the exact HEAD: build/vet/test green; the ex-flaky escrow package **10/10**
+  fresh runs (`-count=10`) — that flake was this defect, so the clean run is itself evidence.
 
-Also: `backlog/ROADMAP.md` R-25b's live pointer updated `…draft-v3.md` → `…draft-v4.md` so the
-citation resolves (historical references in the rehearsal validation doc and past REPORTs left
-as-is — they describe the file as it was named then).
+## Changes in this repo
 
-## Not done / unchanged
+1. **`documentation/pilot/RUNBOOK-publish-agent-0.93-2026-07-22.md`** — the executed record
+   (timestamps, hashes, per-box evidence, the MinAgent deviation + ruling, observations).
+2. **`documentation/runbooks/RUNBOOK-onboarding-draft-v4.md`** §A item 5 — the "agent ≥ 0.93.0
+   box-side before the first real escrow ceremony" gate marked **DISCHARGED 2026-07-22**, citing
+   the runbook record. (The spec pointed at a ROADMAP "wordlist row" — **none exists**; the gate's
+   real home is §A5, so the annotation went there. Recorded as a deviation, not improvised into a
+   new ROADMAP row.)
 
-- C7 not flipped; the capability-map row untouched; no other runbook touched.
-- No CHANGELOG entry: this repo's changelogs are per-area (`hub/`, `scripts/`, `website/`) and none
-  of those areas changed; prior docs-only commits (e.g. TASK-H nodes.md) followed the same pattern.
+## Fleet after this train
 
-*(Previous REPORT — TASK-I, hub v0.69.0/v0.70.0 DELETE cascade — preserved in git history at
-`9b3381b` and summarized in `backlog/ROADMAP.md` R-25b.)*
+Both boxes agent **0.93.0**; Day-0 manifest agent 0.93.0 / MinAgent 0.93.0 / golden 0.153.0 /
+floor 0.156.0. `peti-felhom` untouched by design — Friday's reinstall pulls the vouched manifest
+and lands on 0.93.0.
+
+## Observations (not acted on)
+
+- demo-hp's 1TB NVMe is now **enrolled** (`/mnt/nvme-1tb`, reasserted into 9201) — TASK-H's
+  "unenrolled/NTFS" note is outdated; `operations/nodes.md` may want a refresh.
+- demo-hp still key-less (break-glass worked cleanly); tailnet key-expiry toggle still open.
+- Host journals are CEST; all runbook evidence stamps note the offset.