docs: record SSH operations and daytime call evidence

AGENTS.md

@@ -26,7 +26,11 @@
 7. 创建使用持久化 ClientToken；创建后绑定失败保留实例ID供恢复，不自动再创建一台、不自动删除实例。竞价回收不等于自动迁移活动通话。
 8. 使用 `aliyun` CLI 创建竞价 ECS 进行测试时，测试完成必须先询问用户是否清理。未获得明确清理指令时，保留唯一 `project=agent-call` 可用/运行实例，不自动删除或并行创建第二台；用户明确要求清理后，只停止并删除本次创建的实例，不删除、释放或解绑指定 IP/EIP。
 9. 不把 AK/Secret、ASR Key、ARI 密码、SSH 私钥放入代码、文档、日志或聊天。优先配置 CLI RAM Role/STS，运行时通过环境或受控文件注入。
-10. 用户已确认：下次创建主机时可开放 TCP 22 供直接 SSH；不要求按用户当前源 IP 限制，SSH 仅允许证书/密钥认证，禁止密码登录。使用预置 SSH KeyPair/受控证书，不因开放 22 而放宽其他端口。
+10. 创建主机时必须开通 TCP 22 供后续 SSH 运维；不要求按用户当前源 IP 限制，但不得因此放宽其他端口。创建后必须建立用户 `rogee`，禁止 root 直接 SSH 登录，并在系统级关闭 root 和普通用户的密码/键盘交互登录（`PasswordAuthentication no`、`KbdInteractiveAuthentication no`、`PermitRootLogin no`）。仅安装以下用户提供的 rogee 公钥，后续命令必须通过 SSH 以 `rogee` 用户执行，需要特权时使用受控 `sudo`：
+
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPoGJTH1JrXbWu+ZhIgaHMhume0oWQiWmadhTwbk75Ny rogee@ipao.vip
+
+    不得把对应私钥写入代码、文档、日志或聊天；使用受控本地私钥/SSH agent。不得用密码登录或以 root 作为后续常规命令入口。
 
 ## SIP 接入信息
 

docs/evidence/real-cell-call-20260915-daylight.json

@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.0",
+  "status": "FAIL",
+  "mode": "real",
+  "authorization": {
+    "scope": "one controlled daytime real outbound call",
+    "callee": "15003164745",
+    "max_rounds": 3,
+    "automatic_retry": false
+  },
+  "execution": {
+    "execution_id": "exec_cell_1789434620898180840_10",
+    "call_id": "call_63d20cfd035346f2acab068d51bbce07",
+    "event_id": "exec_cell_1789434620898180840_10:call.finished",
+    "tenant_id": "tenant-demo",
+    "tenant_key": "tenant-demo-key",
+    "connected": false,
+    "duration_ms": 881.5649320022203,
+    "reason_code": "CALL_NOT_ANSWERED",
+    "turns": 0,
+    "media_packets_in": 0,
+    "media_packets_out": 0
+  },
+  "sip": {
+    "codec": "PCMA/8000",
+    "responses": ["100 trying", "183 Session Progress", "486 Busy Here"],
+    "reason": "Q.850 cause=16 NORMAL_CLEARING",
+    "external_media": "UnicastRTP channel created and joined the bridge",
+    "rtp_and_recording": "no answered media session"
+  },
+  "acceptance": {
+    "real_sip_connected": false,
+    "bidirectional_rtp_verified": false,
+    "real_asr_llm_tts_turns": false,
+    "three_round_conversation": false,
+    "human_listening": false,
+    "oss_recording_handoff": false
+  },
+  "note": "This daytime attempt did not reach SIP 200 OK. The provider returned 486 Busy Here after 183 Session Progress; this is consistent with a busy/unavailable destination but does not by itself prove a time-window restriction. No automatic retry was issued. Credentials, provider URLs, SIP addresses, and API keys are omitted."
+}