Upgrade or remove an agent

Upgrades should preserve the host's durable mTLS identity and managed state. Removing a host should revoke its Tenvyr identity before local files are discarded.

Upgrade

1. Verify the new package and read its compatibility notes.
2. Test upgrade and rollback in the lab.
3. Confirm a recovery SSH path.
4. Stop the agent service.
5. Back up its root-owned state using your approved secure process.
6. Upgrade the package without replacing identity.json.
7. Start the service and confirm heartbeat and reconciliation.
8. Validate sshd and perform a canary SSH connection.

If the package changes the managed manifest key or root, qualify the migration as a configuration change rather than a routine binary upgrade.

Roll back

Roll back the executable and service definition while preserving the compatible host identity. Restore the last known-good managed SSH configuration, validate it, and reload OpenSSH. If identity compatibility is uncertain, contain the host in Tenvyr and use the independent recovery path.

Remove

1. Remove the host from active access policies or contain it.
2. Stop and disable the agent.
3. Restore or remove Tenvyr-managed SSH configuration.
4. Validate and reload OpenSSH.
5. Revoke or remove the host identity in Tenvyr.
6. Remove package, service, state, and empty enrollment placeholder according to your retention policy.
7. Confirm the host no longer accepts Tenvyr-issued access.

Deleting only the local package is not a complete offboarding workflow.