felhom.eu/REPORT.md

REPORT — Agent-only publish train 0.93.0 executed (operational run, docs-only in this repo)

Date: 2026-07-22 · Repo: felhom.eu (runbook record + §A5 discharge; no code, no version bump, no hub deploy) · Full record: documentation/pilot/RUNBOOK-publish-agent-0.93-2026-07-22.md

What happened

felhom-agent v0.93.0 (hyphen-free escrow wordlist, source-only since 2026-07-21 at a452dc33) was built, published, manifest-vouched and deployed to both fleet boxes by CC, with one password-gated STOP → Viktor (the Day-0 manifest save, verified by CC in the hub DB before any box moved — publish-train rule 1).

• Artifact: sha256 a68b2ff73200622ea9e23aed71a0a8ff885808626cab9e9d554a5a5df5ced28f (13 817 690 bytes), sha-chain identical: built binary → Gitea package (PUT 201) → independent anonymous GET.
• Manifest: agent 0.92.1→0.93.0 + new sha. Golden (0.153.0), floor (0.156.0) and wrapper sha byte-identical before/after. Deviation, ruled: MinAgent moved 0.92.1→0.93.0 at the operator save (spec said do-not-touch); flagged before deploy, Viktor ruled leave it — the held-floor window was transient (minutes) and harmless.
• Deploys (felhom-pve first, then demo-hp over G1 break-glass — secret file→file, shredded): both boxes clean-restart 5/5 — active/NRestarts=0, capabilities 68/68 degraded=0, ReassertGuestBinds touched only enrolled drives, guestnet sweeps quiet (0 ERROR/WARN), hub hosts.agent_version = 0.93.0 for both (06:56:52Z / 06:57:52Z). .bak-0.92.1 retained on both; escape hatch not needed.
• Green gate on the exact HEAD: build/vet/test green; the ex-flaky escrow package 10/10 fresh runs (-count=10) — that flake was this defect, so the clean run is itself evidence.

Changes in this repo

1. documentation/pilot/RUNBOOK-publish-agent-0.93-2026-07-22.md — the executed record (timestamps, hashes, per-box evidence, the MinAgent deviation + ruling, observations).
2. documentation/runbooks/RUNBOOK-onboarding-draft-v4.md §A item 5 — the "agent ≥ 0.93.0 box-side before the first real escrow ceremony" gate marked DISCHARGED 2026-07-22, citing the runbook record. (The spec pointed at a ROADMAP "wordlist row" — none exists; the gate's real home is §A5, so the annotation went there. Recorded as a deviation, not improvised into a new ROADMAP row.)

Fleet after this train

Both boxes agent 0.93.0; Day-0 manifest agent 0.93.0 / MinAgent 0.93.0 / golden 0.153.0 / floor 0.156.0. peti-felhom untouched by design — Friday's reinstall pulls the vouched manifest and lands on 0.93.0.

Observations (not acted on)

• demo-hp's 1TB NVMe is now enrolled (/mnt/nvme-1tb, reasserted into 9201) — TASK-H's "unenrolled/NTFS" note is outdated; operations/nodes.md may want a refresh.
• demo-hp still key-less (break-glass worked cleanly); tailnet key-expiry toggle still open.
• Host journals are CEST; all runbook evidence stamps note the offset.