rig/changelog.d/162.md

### Fixed

- Agent tenant boxes ship cron — binary asserted, service enabled and active — so the duty engine can arm its timer (#162)
fix: arm cron on agent tenant boxes Agent tenants exist to run the cron-driven duty engine, and the engine's installer runs unprivileged — it can detect a missing cron but never apt-get it. Install cron with the shared toolbelt, then assert the effective state, not the package: crontab on PATH AND cron.service enabled and active, converging (unmask/enable/start) best-effort first. A masked daemon with the binary present is exactly the silent-inert box the issue reports, so the service asserts are the authority and either failing dies naming cron. staging-box stays exempt with the rest of the agent-assert block: no agent, no duty engine. Machine roles (bootstrap.sh) are deliberately not widened — the issue names tenants as the demonstrated gap. Closes #162 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> 2026-07-25 18:54:27 +00:00			`### Fixed`

			`- Agent tenant boxes ship cron — binary asserted, service enabled and active — so the duty engine can arm its timer (#162)`