# REPORT — Agent-only publish train 0.93.0 executed (operational run, docs-only in this repo)

**Date:** 2026-07-22 · **Repo:** `felhom.eu` (runbook record + §A5 discharge; no code, no version
bump, no hub deploy) · **Full record:** `documentation/pilot/RUNBOOK-publish-agent-0.93-2026-07-22.md`

## What happened

felhom-agent **v0.93.0** (hyphen-free escrow wordlist, source-only since 2026-07-21 at `a452dc33`)
was **built, published, manifest-vouched and deployed to both fleet boxes** by CC, with one
password-gated STOP → Viktor (the Day-0 manifest save, verified by CC in the hub DB **before** any
box moved — publish-train rule 1).

- **Artifact:** sha256 `a68b2ff73200622ea9e23aed71a0a8ff885808626cab9e9d554a5a5df5ced28f`
  (13 817 690 bytes), sha-chain identical: built binary → Gitea package (PUT 201) → independent
  anonymous GET.
- **Manifest:** agent 0.92.1→**0.93.0** + new sha. Golden (0.153.0), floor (**0.156.0**) and
  wrapper sha **byte-identical before/after**. **Deviation, ruled:** MinAgent moved 0.92.1→0.93.0
  at the operator save (spec said do-not-touch); flagged before deploy, Viktor ruled leave it —
  the held-floor window was transient (minutes) and harmless.
- **Deploys** (felhom-pve first, then demo-hp over G1 break-glass — secret file→file, shredded):
  both boxes clean-restart **5/5** — active/NRestarts=0, capabilities **68/68 degraded=0**,
  ReassertGuestBinds touched only enrolled drives, guestnet sweeps quiet (0 ERROR/WARN), hub
  `hosts.agent_version` = **0.93.0** for both (06:56:52Z / 06:57:52Z). `.bak-0.92.1` retained on
  both; escape hatch not needed.
- **Green gate** on the exact HEAD: build/vet/test green; the ex-flaky escrow package **10/10**
  fresh runs (`-count=10`) — that flake was this defect, so the clean run is itself evidence.

## Changes in this repo

1. **`documentation/pilot/RUNBOOK-publish-agent-0.93-2026-07-22.md`** — the executed record
   (timestamps, hashes, per-box evidence, the MinAgent deviation + ruling, observations).
2. **`documentation/runbooks/RUNBOOK-onboarding-draft-v4.md`** §A item 5 — the "agent ≥ 0.93.0
   box-side before the first real escrow ceremony" gate marked **DISCHARGED 2026-07-22**, citing
   the runbook record. (The spec pointed at a ROADMAP "wordlist row" — **none exists**; the gate's
   real home is §A5, so the annotation went there. Recorded as a deviation, not improvised into a
   new ROADMAP row.)

## Fleet after this train

Both boxes agent **0.93.0**; Day-0 manifest agent 0.93.0 / MinAgent 0.93.0 / golden 0.153.0 /
floor 0.156.0. `peti-felhom` untouched by design — Friday's reinstall pulls the vouched manifest
and lands on 0.93.0.

## Observations (not acted on)

- demo-hp's 1TB NVMe is now **enrolled** (`/mnt/nvme-1tb`, reasserted into 9201) — TASK-H's
  "unenrolled/NTFS" note is outdated; `operations/nodes.md` may want a refresh.
- demo-hp still key-less (break-glass worked cleanly); tailnet key-expiry toggle still open.
- Host journals are CEST; all runbook evidence stamps note the offset.