Agent Flywheel

Where it stands, 2026-10-13

The maintainer’s 2026-10-03 factory run of Agent Flywheel v0.10.0 passed eight critical smoke checks but the installer exited 1 after uv/dcg checksum refusals. Agent Flywheel assembles Claude Code, Codex and Antigravity on Ubuntu, so try it on a VPS you can rebuild. ACFS is the setup and update tooling discussed on this page. The 2026-10-04 checksum repin still called for a factory re-run.

Pin the scripts and checksum ledger separately. Fetch the v0.10.0 installer and set --ref v0.10.0. Its checksum ledger defaults to main; --checksums-ref <sha> fixes the accepted hashes. Record both revisions and check upstream downloads against the ledger. This page does not supply a reviewed checksum-ledger SHA. Review and record that revision before installing; do not enter the placeholder literally. The Quick Install recipe selects main, so skip it when evaluating stable scripts.

Hosted setup remains outside stable. Stable also lacks the repairs described below for overwritten coordination tools, ignored update holds, raw data in shared task packets, and stalled checksum publication.

Swarm launch reached stable in v0.10.0. Review the launch plan before starting paid workers. acfs swarm launch previews one to 32 native Claude/Codex agents; a separate --launch tied to the reviewed launch request’s hash starts them. That batches starts while leaving worker authority to Named Tmux Manager (NTM) configuration. If you install Brenner Bot, inspect NTM and CASS Memory versions before launch: the maintainer reports it replacing newer coordination tools; the protection is outside stable.

Set worker authority before launching. In either mode, the shell aliases pass --dangerously-skip-permissions to Claude and --dangerously-bypass-approvals-and-sandbox to Codex. Inspect the swarm worker commands in the Named Tmux Manager (NTM) launcher configuration at ~/.config/ntm/config.toml: the fresh-host Codex command uses the same bypass at gpt-6-astra/xhigh. ACFS’s Antigravity wrapper sets always-proceed, disables the terminal sandbox and allows non-workspace access.

Override shortcuts in the last-loaded ~/.zshrc.local and edit NTM separately. Audit sudo too: vibe grants passwordless sudo that a later safe-mode run does not revoke.

Verify that the DCG command guard is registered with each agent, not just installed. Failure to install the required Destructive Command Guard (DCG) binary now fails installation. But Claude hook registration remains optional, and ACFS’s Antigravity hook returns allow when DCG is unavailable or times out. Inspect the hook-registration log.

Existing installations: logs, Ubuntu and updater checks

Inspect older update logs before resuming work. The token-redaction fix in v0.10.0 addresses the maintainer-reported printing of credentialed Git origin URLs into update and world-readable /data/tmp logs. If you used credentialed Git rewrites, inspect retained logs and rotate exposed tokens. A tarball runtime can discover a separate checkout for self-update. Absence of ~/.acfs/.git is no exemption.

Keep OS migration out of setup. v0.10.0 preserves supported LTS hosts by default; its opt-in 26.04 upgrade remains unqualified. Check /etc/os-release on v0.9.0 hosts, whose default target was 25.10. Rebuild any on that end-of-life release with an LTS image. The maintainer reports two failed in-place recoveries before a post-stable repair.

Replace the older runtime before repairing Claude’s settings. v0.10.0 stops installing Ultimate Bug Scanner (UBS) hooks during updates, ending the reported nightly rewrite of user-level hooks. Inspect ~/.claude/settings.json for bad paths and git_safety_guard entries. The nightly update job disables ACFS self-update by default, so agent updates alone do not deliver the repair.

Stable source builds can bypass holds. Test each per-tool update freeze, called a hold, and verify the saved binary you would restore. ACFS’s Claude/Codex install inputs float to latest; its normal Claude update path checks holds before running the installer. In stable, aadc/rust_proxy source-build callers use a helper without hold checks. A failed binary backup leaves no rollback candidate; inspect the retained .prev binary before relying on it.

A skipped update leaves the old version installed. The nightly update job can skip updates when resource checks block them. Check logs and actual versions. Drain older updater processes before adopting the target-home lock, which returns 75 when busy, and alert on both 75 and exit 2 for partial failure.

Before sharing packets, adding plugins or trying hosted setup

Sanitized briefs still travel with raw task data. Stable retains raw task data beside its sanitized brief. Credentials in task fields can still reach recipients. Inspect raw source, titles and labels in packet JSON.

Review the exact third-party plugin plan before accepting it. v0.10.0 previews plugin installs and requires --yes plus the exact --accept-plan fingerprint to execute as the target user. The path requires first-party dependencies to be installed already; setpriv --no-new-privs provides no filesystem or network confinement.

Keep hosted setup a separate disposable trial. The cloud-binaries-v1 prerelease mirrors tool archives. It is not an ACFS upgrade. Its initial cloud setup and later untagged hardening are outside stable.

Pin the script and ACFS_REF to one reviewed SHA. It hash-checks new bundles but retains existing callable tools.

Claude mode attempts Agent Mail MCP registration; Codex/generic modes use CLI access without MCP registration. Check per-tool logs and actual versions: tool failures can still end in exit 0.

Read the license before intended hosted use. The rider withholds rights from OpenAI, Anthropic, their affiliates and people acting on their behalf, absent Jeffrey Emanuel’s prior written permission. This page offers no view on enforceability.

What still needs proof

• Require full installation and upgrade records. Retain a run recording script and ledger revisions, repeat-install behavior, exit status, doctor and service checks. A separate tag-to-tag deployment test must show the old updater was replaced.
• Watch checksum publication after the repair. The maintainer reports a completed 175-run publication stall and subsequent healthy monitor runs. The main-only deferral fix lets unrelated repins publish while one tool awaits authorization. A stable tag containing the fix, plus retained timer health, would settle release status and continued publication.
• Require released hold and packet repairs with passing checks. The source-build hold repair is in the prerelease source tree; the packet-redaction repair is untagged. Stable tags containing the repairs, plus held-build and packet-export tests, would settle delivery and behavior.
• Test conflicting writes before trusting assignments. Assignment checks declared scopes, not eventual writes or live reservations. The test must show what happens when workers write the same file and who resolves the collision.
• Require hosted acceptance in each mode. Runs must record script and ACFS_REF, mode, actual tool versions and rejected Git operations, plus completed work alongside executable checks.
• Measure completed work before claiming attention saved. A completed-project comparison must count accepted work, review, maintenance, rework and spend.