host-install v1.16.0 (FELHOM_ESCROW via canonical sudoers fetch; hub hostInstallVersion synced, no deploy) + RUNBOOK-escrow-ceremony rewrite: controller wizard PRIMARY, CLI operator fallback, F1 threat-model paragraph (R over CF tunnel accepted 2026-07-13), stale-blob/supersede/void semantics

scripts/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install v1.16.0 — FELHOM_ESCROW rides the canonical sudoers (2026-07-13)
+
+Companion to agent v0.88.0 + controller v0.127.0 (the controller-driven escrow ceremony wizard).
+No new installer STEP: the `FELHOM_ESCROW` sudoers alias (the wizard's fixed-argv sudo
+self-invocation grant) ships via the existing canonical-sudoers fetch
+(`configs/felhom-agent.sudoers` from the agent repo, `visudo -cf`-gated before install) — the
+bump documents that every ≥1.16.0 install/update carries it. Hub `hostInstallVersion` bumped in
+the same commit (hostinstall_gates.py asserts equality); the hub deploy rides the next hub train
+(display-only lag, accepted). EXISTING hosts get the refreshed sudoers with the agent-0.88.0
+deploy (ship-configs step), not from this script.
+
 ## manifest_bearer_gate.py — new gate: no bearer-shaped literals in manifests/ (2026-07-13)
 
 Part of the hub v0.53.0 bearer de-git. Greps every `manifests/*.yaml` for 64-hex literals

scripts/felhom-host-install.sh

@@ -182,9 +182,13 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="1.15.0"   # the SINGLE version source (F-1): -h, the run banners, and the hub
+SCRIPT_VERSION="1.16.0"   # the SINGLE version source (F-1): -h, the run banners, and the hub
                           # Setup-tab copy (hub internal/web/configs.go hostInstallVersion —
                           # scripts/hostinstall_gates.py asserts the two stay equal) all follow it.
+                          # 1.16.0: the FELHOM_ESCROW sudoers alias (controller-driven escrow
+                          # ceremony, agent v0.88.0) ships on every install/update — it rides the
+                          # CANONICAL sudoers fetch below (configs/felhom-agent.sudoers from the
+                          # agent repo, visudo-gated), no separate installer step.
 
 # Operator signing keys pinned at day-0 (GL-4; doc 04 §3 two-key model). EMPTY by default — the pin
 # CEREMONY is an operator step: generate the real keypairs OFFLINE, then fill these four constants