pushing updates

IMPLEMENTATION.md

@@ -87,17 +87,32 @@ Ansible needs SSH + sudo on each target before playbooks work.
    ssh westfarn@10.0.0.77
    ssh westfarn@10.0.0.176
    ```
-4. On ai-server-4080 (control node), install Ansible:
+4. **First-time only** — grant passwordless sudo on each new host before the first
+   `provision.sh` run. Ubuntu 26.04 ships `sudo-rs` by default; Ansible's
+   `--ask-become-pass` does not recognize its password prompt, so bootstrap sudo
+   manually over SSH instead:
+   ```bash
+   ssh -t westfarn@10.0.0.176   # repeat for each host IP
+   ```
+   On the host:
+   ```bash
+   echo 'westfarn ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/westfarn
+   sudo chmod 440 /etc/sudoers.d/westfarn
+   exit
+   ```
+   The `common` role writes the same file on later runs; this one-time step is only
+   needed before Ansible can escalate privileges the first time.
+5. On ai-server-4080 (control node), install Ansible:
    ```bash
    sudo apt update && sudo apt install -y ansible
    # or: pip install ansible
    ```
-5. Install Galaxy collections:
+6. Install Galaxy collections:
    ```bash
    cd ~/Documents/repos/server-infra
    ansible-galaxy collection install -r requirements.yml
    ```
-6. Update `inventory/host_vars/ai-server-4080.yml` with this machine's LAN IP (`ansible_host`).
+7. Update `inventory/host_vars/ai-server-4080.yml` with this machine's LAN IP (`ansible_host`).
 
 ## Testing on a Single Server
 
@@ -112,6 +127,9 @@ ansible adama -m ping
 
 ### Provision one host
 
+New hosts need the one-time passwordless sudo bootstrap in
+[Prerequisites](#prerequisites-one-time-bootstrap) before the first run.
+
 ```bash
 # Dry run (no changes)
 ./scripts/provision.sh adama --check