agent 0.130.0 published and vouched; R-347 closed, R-349 + R-350 filed

Released via scripts/release-agent.sh: tag v0.130.0 at 7569f34, sha256 a56a92a7bd68f5b46736eaec4806c3d26c16ccb35118c4ac0e3d8094eaefabc3, verified by independent download and reproducible byte for byte with -trimpath -buildvcs=false. Vouched agent 0.129.0 -> 0.130.0 in the Day-0 manifest. Only the agent fields changed: min_agent stays 0.129.0 because it states what the GOLDEN CONTROLLER requires, and raising it would have HELD the floor for every box below 0.130.0. Global floor untouched at 0.216.0 -- and on hub v0.106.0 it is a separate form with its own action, so publish-train rule 2's hazard no longer exists in the shape its incident describes. No --no-verify: the CHANGELOG heading was flipped only after the tag and package existed, so release-complete passes on the real artifact. R-349: the fleet was running a DIFFERENT binary under the same version name -- the proof deploy was a hand build, the release is -trimpath. Self-update could never have corrected it, because every version check compares the string. Both boxes reinstalled from the downloaded package. The proper fix exists in miniature as wrapper_sha256 and was never extended to the agent's own binary. R-350: I printed the hub password into the session transcript via curl -w '%{redirect_url}' -- the hub answers 303 and curl re-attaches the credential. Not in git, not in any committed file, not in the evidence directory. Rotation is the operator's call. ep0 closes at fd 17, ESTAB 0, CLOSE-WAIT 0 -- its t0 baseline -- and was read-only for this entire arc.
2026-08-20 12:54:54 +02:00
parent 47268ad1c4
commit 910fd91124
6 changed files with 184 additions and 9 deletions
@@ -1,8 +1,10 @@
 # REPORT — R-344: the agent's leaked PBS connections, fixed and proven on both boxes (2026-08-20)

-**Outcome: the fix works, measured three independent ways, and ep0 is back to its baseline of 17 file
-descriptors from 415.** Both demo boxes now run agent **0.130.0**. **Nothing is published** — that is
-the one decision left, filed as R-347.
+**Outcome: the fix works, measured three independent ways; ep0 is back to its baseline of 17 file
+descriptors from 415; and 0.130.0 is now published and vouched.** Both demo boxes run the **byte-exact
+published artifact**. R-347 is CLOSED. Two new findings came out of the release itself — **R-349**
+(the fleet was briefly running a different binary under the same version name) and **R-350** (I printed
+the hub password into the transcript; rotation is your call).

 ## 1. Confirmed baselines

@@ -179,6 +181,52 @@ t=10:40:23Z pid=551655 fd=17 estab=0 ctrl(.2)=0 fix(.3)=0 CLOSE-WAIT=0
 `CLOSE-WAIT 0`, `ESTAB` in the low single digits, `fd` at the baseline, proxy PID **551655** — the same
 process that has been running since 2026-08-18 09:51:04, never restarted by this work.

+## 11b. The release (R-347, CLOSED)
+
+`bash scripts/release-agent.sh 0.130.0` — the one documented way (R-115): build, tag, publish, and
+**verify by independent download**.
+
+| | |
+|---|---|
+| tag | `v0.130.0` at `7569f34` |
+| sha256 | **`a56a92a7bd68f5b46736eaec4806c3d26c16ccb35118c4ac0e3d8094eaefabc3`** |
+| size | 14,141,158 bytes |
+| reproducible | **yes, checked** — `-trimpath -buildvcs=false` rebuild matches byte for byte |
+
+**Vouched** in the Day-0 artifact manifest: agent 0.129.0 → **0.130.0** + its sha. **Only the agent
+fields changed.**
+
+- **`min_agent` left at 0.129.0** — it states what the **golden controller** needs. Raising it to
+  0.130.0 would have made the hub **HOLD the floor** for every box below 0.130.0, which is the
+  opposite of shipping a fix.
+- **Global floor never touched** (0.216.0). On hub v0.106.0 it is a *separate form with its own
+  action*, so publish-train rule 2's "save the floor last" hazard no longer exists in the shape its
+  incident describes — the rule's reasoning holds, its mechanism has moved.
+- After: no `floor held`, no `*_unreachable`, both boxes reporting 0.130.0, artifact downloading
+  anonymously at the vouched sha.
+
+**No `--no-verify` in the train.** The heading was flipped to `## v0.130.0` only after tag and package
+existed. Flipping first and bypassing would have produced a red CI run and an alarm mail for a release
+that worked — R-168's failure mode.
+
+## 11c. Two findings from the release
+
+**R-349 — the fleet was running a different binary under the same version name.** The proof deploy was
+a hand build; the release builds `-trimpath -buildvcs=false`. Same source, same version string,
+different bytes (`256e0829…` vs `a56a92a7…`). **Self-update could never have corrected it** — the boxes
+already reported 0.130.0, so the vouched version looked installed. Every version check in the system
+compares the *string*. Fixed by installing the **downloaded** artifact on both. The proper fix already
+exists in miniature: `wrapper_sha256` does exactly this drift detection for the PBS wrapper and was
+never extended to the agent's own binary.
+
+**R-350 — I printed the hub password into the transcript.** Confirming the vouch used
+`curl -w '%{redirect_url}'`; the hub answers 303 and curl re-attaches the basic-auth credential to the
+redirect target it prints. **Not in git, not in any committed file** (checked by content), not in the
+evidence directory — it is in the session transcript on DooPlex. Every other call printed only the
+length; this came through curl's own formatting. **Rotation is your call** — I did not do it
+unilaterally, and I can do it file-to-file without printing the new value if you want. The reusable
+half: `%{redirect_url}`, `-v` and `--libcurl` all re-render a basic-auth credential.
+
 ## 12. Observations

 - **The closure refactor is not worth doing — recommend leaving it.** With the idle timeout restored an