github · pelikhan · Jun 25, 2026 · Jun 25, 2026 · github-actions · Jun 25, 2026
diff --git a/.github/workflows/ab-testing-advisor.lock.yml b/.github/workflows/ab-testing-advisor.lock.yml
diff --git a/.github/workflows/ab-testing-advisor.md b/.github/workflows/ab-testing-advisor.md
@@ -75,7 +75,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
diff --git a/.github/workflows/ai-moderator.md b/.github/workflows/ai-moderator.md
@@ -61,7 +61,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # AI Moderator

diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
diff --git a/.github/workflows/archie.md b/.github/workflows/archie.md
@@ -47,7 +47,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Archie - Mermaid Diagram Generator

diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
diff --git a/.github/workflows/auto-triage-issues.md b/.github/workflows/auto-triage-issues.md
@@ -62,7 +62,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Auto-Triage Issues Agent 🏷️

diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml
diff --git a/.github/workflows/blog-auditor.md b/.github/workflows/blog-auditor.md
@@ -61,7 +61,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 # Blog Auditor
 

diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
diff --git a/.github/workflows/changeset.md b/.github/workflows/changeset.md
@@ -54,7 +54,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Changeset Generator

diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
diff --git a/.github/workflows/cli-consistency-checker.md b/.github/workflows/cli-consistency-checker.md
@@ -75,7 +75,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # CLI Consistency Checker

diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
diff --git a/.github/workflows/code-scanning-fixer.md b/.github/workflows/code-scanning-fixer.md
@@ -46,7 +46,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Code Scanning Alert Fixer Agent

diff --git a/.github/workflows/constraint-solving-potd.lock.yml b/.github/workflows/constraint-solving-potd.lock.yml
diff --git a/.github/workflows/constraint-solving-potd.md b/.github/workflows/constraint-solving-potd.md
@@ -35,7 +35,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Constraint Solving — Problem of the Day

diff --git a/.github/workflows/copilot-opt.lock.yml b/.github/workflows/copilot-opt.lock.yml
diff --git a/.github/workflows/copilot-opt.md b/.github/workflows/copilot-opt.md
@@ -53,7 +53,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
diff --git a/.github/workflows/copilot-pr-prompt-analysis.md b/.github/workflows/copilot-pr-prompt-analysis.md
@@ -30,7 +30,7 @@ network:
 sandbox:
   agent:  # Firewall enabled (migrated from network.firewall)
     id: awf
-    sudo: true
+    sudo: false
 imports:
   - uses: shared/daily-audit-base.md
     with:

diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.md b/.github/workflows/daily-agent-of-the-day-blog-writer.md
@@ -25,7 +25,7 @@ network:
 sandbox:
   agent:
     id: awf
-    sudo: true
+    sudo: false
 tools:
   cli-proxy: true
   agentic-workflows:

diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.md b/.github/workflows/daily-astrostylelite-markdown-spellcheck.md
@@ -284,7 +284,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Daily AstroStyleLite Markdown Spellcheck

diff --git a/.github/workflows/daily-byok-ollama-test.lock.yml b/.github/workflows/daily-byok-ollama-test.lock.yml
diff --git a/.github/workflows/daily-byok-ollama-test.md b/.github/workflows/daily-byok-ollama-test.md
@@ -61,7 +61,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Daily BYOK Endpoint Test

diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
diff --git a/.github/workflows/daily-cli-performance.md b/.github/workflows/daily-cli-performance.md
@@ -77,7 +77,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
diff --git a/.github/workflows/daily-compiler-quality.md b/.github/workflows/daily-compiler-quality.md
@@ -96,7 +96,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml
diff --git a/.github/workflows/daily-doc-healer.md b/.github/workflows/daily-doc-healer.md
@@ -78,7 +78,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
diff --git a/.github/workflows/daily-file-diet.md b/.github/workflows/daily-file-diet.md
@@ -47,7 +47,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/daily-geo-optimizer.lock.yml b/.github/workflows/daily-geo-optimizer.lock.yml
diff --git a/.github/workflows/daily-geo-optimizer.md b/.github/workflows/daily-geo-optimizer.md
@@ -112,7 +112,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
diff --git a/.github/workflows/daily-malicious-code-scan.md b/.github/workflows/daily-malicious-code-scan.md
@@ -35,7 +35,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/daily-model-resolution.lock.yml b/.github/workflows/daily-model-resolution.lock.yml
diff --git a/.github/workflows/daily-model-resolution.md b/.github/workflows/daily-model-resolution.md
@@ -39,7 +39,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
diff --git a/.github/workflows/daily-observability-report.md b/.github/workflows/daily-observability-report.md
@@ -34,7 +34,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
diff --git a/.github/workflows/daily-rendering-scripts-verifier.md b/.github/workflows/daily-rendering-scripts-verifier.md
@@ -61,7 +61,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Daily Rendering Scripts Verifier

diff --git a/.github/workflows/daily-safe-outputs-conformance.lock.yml b/.github/workflows/daily-safe-outputs-conformance.lock.yml
diff --git a/.github/workflows/daily-safe-outputs-conformance.md b/.github/workflows/daily-safe-outputs-conformance.md
@@ -35,7 +35,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Daily Safe Outputs Conformance Checker

diff --git a/.github/workflows/daily-security-observability.lock.yml b/.github/workflows/daily-security-observability.lock.yml
diff --git a/.github/workflows/daily-security-observability.md b/.github/workflows/daily-security-observability.md
@@ -141,7 +141,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

diff --git a/.github/workflows/daily-skill-optimizer.lock.yml b/.github/workflows/daily-skill-optimizer.lock.yml
diff --git a/.github/workflows/daily-skill-optimizer.md b/.github/workflows/daily-skill-optimizer.md
@@ -153,7 +153,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Daily Skill Optimizer Improvements

diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
diff --git a/.github/workflows/daily-testify-uber-super-expert.md b/.github/workflows/daily-testify-uber-super-expert.md
@@ -55,7 +55,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
diff --git a/.github/workflows/dead-code-remover.md b/.github/workflows/dead-code-remover.md
@@ -47,7 +47,7 @@ steps:
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Dead Code Removal Agent

diff --git a/.github/workflows/deployment-incident-monitor.lock.yml b/.github/workflows/deployment-incident-monitor.lock.yml
diff --git a/.github/workflows/deployment-incident-monitor.md b/.github/workflows/deployment-incident-monitor.md
@@ -32,7 +32,7 @@ timeout-minutes: 10
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Deployment Incident Monitor

diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
diff --git a/.github/workflows/dev.md b/.github/workflows/dev.md
@@ -36,7 +36,7 @@ tools:
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 <!--

diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
diff --git a/.github/workflows/discussion-task-miner.md b/.github/workflows/discussion-task-miner.md
@@ -62,7 +62,7 @@ tools:
 tracker-id: discussion-task-miner
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Discussion Task Miner - Code Quality Improvement Agent

diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
diff --git a/.github/workflows/example-workflow-analyzer.md b/.github/workflows/example-workflow-analyzer.md
@@ -25,7 +25,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 # Weekly Workflow Analysis
 

diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
diff --git a/.github/workflows/github-mcp-structural-analysis.md b/.github/workflows/github-mcp-structural-analysis.md
@@ -35,7 +35,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 # GitHub MCP Structural Analysis
 

diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
diff --git a/.github/workflows/glossary-maintainer.md b/.github/workflows/glossary-maintainer.md
@@ -88,7 +88,7 @@ steps:
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Glossary Maintainer

diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
diff --git a/.github/workflows/grumpy-reviewer.md b/.github/workflows/grumpy-reviewer.md
@@ -31,7 +31,7 @@ timeout-minutes: 10
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 > ⚠️ **Deprecated**: This agent is superseded by the [PR Code Quality Reviewer](pr-code-quality-reviewer.md), which consolidates code quality and nitpick reviews into a single pass. Use `/review` instead of `/grumpy` for new PRs. This agent is kept for backward compatibility but will be removed in a future release.

diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
diff --git a/.github/workflows/instructions-janitor.md b/.github/workflows/instructions-janitor.md
@@ -46,7 +46,7 @@ tools:
     - default
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 # Instructions Janitor
 

diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
diff --git a/.github/workflows/jsweep.md b/.github/workflows/jsweep.md
@@ -46,7 +46,7 @@ strict: true
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # jsweep - JavaScript Unbloater

diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
diff --git a/.github/workflows/lockfile-stats.md b/.github/workflows/lockfile-stats.md
@@ -25,7 +25,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 # Lockfile Statistics Analysis Agent
 

diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
diff --git a/.github/workflows/mergefest.md b/.github/workflows/mergefest.md
@@ -63,7 +63,7 @@ steps:
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Mergefest - Merge Main into Pull Request Branch

diff --git a/.github/workflows/outcome-collector.lock.yml b/.github/workflows/outcome-collector.lock.yml
diff --git a/.github/workflows/outcome-collector.md b/.github/workflows/outcome-collector.md
@@ -61,7 +61,7 @@ pre-agent-steps:
       fi
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Outcome Collector
-Original file line number
+Diff line change
@@ Expand Up / @@ -36,7 +36,7 @@ tools: @@
     sandbox:
       agent:
-        sudo: true
+        sudo: false
     ---
     <!--
@@ Expand Down @@