Finding / agent-flywheel

2026-10-13-agent-flywheel-post-stable-source-changes-consent-order-recovery-fleet-execution-and-credential-visibilit

Post-stable source changes consent order, recovery, fleet execution and credential visibility. Stable can change base packages before an interactive Proceed confirmation; e2d7f935 moves ensure_base_deps after that confirmation, with --yes unaffected. This is a narrow ordering fix, not a guarantee that no earlier bootstrap or explicit upgrade mutates the host. The recovery patch addresses the maintainer-reported Ubuntu 25.10 failures and removes Meta Skill ARM64 refusal (section 24). Multi-host fleet code adds dispatch, Git-bundle collection, candidate testing and guarded integration/publication over explicit SSH hosts. Later untagged work adds agent-readiness, credential-source status, OAuth lifecycle and vault references. The concrete permission, packet-redaction and website dependency mechanisms are recorded separately in sections 16 through 18.

Channel: mixed. Half: both. Date: 2026-10-04..2026-10-13.

Operator consequence: None is a stable ACFS upgrade; source containment in the binary mirror does not qualify a preview installer. Keep sensitive use on a reviewed stable tree and watch the next real tag for interactive consent order and exact fleet authority gates. Recovery, live fleet throughput and hosted readiness were not reproduced. Read the full bounded compare because the Unreleased changelog is empty.

Receipt

Finding metadata

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-agent-flywheel-post-stable-source-changes-consent-order-recovery-fleet-execution-and-credential-visibilit

Source links

Primary links, including exact changelog lines when available.