Evidence record / agent-flywheel
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
Vibe mode writes passwordless sudo; safe mode does not revoke it
The active v0.7.0 installer writes /etc/sudoers.d/90-ubuntu-acfs with
$TARGET_USER ALL=(ALL) NOPASSWD:ALL in vibe mode, chmods it to 440, and validates
the file with visudo. A safe-mode run skips that write. It does not delete the
file left by an earlier vibe-mode run or revoke another passwordless-sudo rule;
the tagged Hetzner cloud-init example itself creates one. Channel: tagged-release
intake baseline. Operator consequence: safe mode is not a sudo-remediation step.
On a fresh host with no other NOPASSWD rule it does not create the ACFS rule, but
an operator changing modes must inspect and remove prior/provider rules separately.
This was an intake baseline, not a July 1-2 product change.
Receipt
Finding metadata
Run: 2026-07-02-weekly-digest-2026-07-01_2026-07-02-frontier-v0
Finding ID: 2026-07-02-agent-flywheel-passwordless-sudo-vibe-default
Profile citations
- Agent Flywheel / claim / passwordless-sudo-vibe-default
- Agent Flywheel / posture / governance
Source links
Primary links, including exact changelog lines when available.
- commit line rangeVibe mode writes passwordless sudo; safe mode does not revoke itDicklesworthstone/agentic_coding_flywheel_setup / install.sh#L4861-L4870commit line rangeVibe mode writes passwordless sudo; safe mode does not revoke itDicklesworthstone/agentic_coding_flywheel_setup / scripts/providers/hetzner-cloud-init.yml#L41-L46
Versioned source: run artifact