Agentic Sandbox v2026.5.1

Released: 2026-05-19 Tag: `v2026.5.1` Previous: `v2026.5.0` (2026-05-08) Compare: `v2026.5.0...v2026.5.1`

Source-only release. No binaries, container images, or SBOMs are attached. Build from source via `make build` (release commit: `ef61337c4f`). Release-artifact CI is tracked under #295, #297, #299, #300 and will produce the first artifact-bearing release in a follow-up cut.

What this release is

The first CalVer cut that ships the v2 (A2A-aligned) executor surface GA. It also closes out a full security-hardening pass, ships the v2 dashboard rewrite, and lands the AIWG executor bridge for mission dispatch from `aiwg serve`.

If you are running v2026.5.0 today: this is a non-breaking upgrade. v1 routes still respond identically; the only observable change is three new response headers (`Sunset`, `Deprecated`, `Link`) that let v1 clients discover the v2 path without out-of-band knowledge.

If you are new to the project: start at docs/getting-started.md — a 15-minute walkthrough including prerequisite verification, the fast container-runtime path, and the full VM path.

Highlights

A2A executor surface (GA) — three-surface split (admin, A2A per-instance, observability) with AgentCard discovery, JCS+Ed25519 signing, and five extensions: `runtime/v1`, `idempotency/v1`, `hitl-prompt/v1`, `multi-tenant/v1` (beta), `adapter-command/v1`.
v1 stays live, with discovery headers — every v1 response carries `Sunset`, `Deprecated`, and `Link` headers pointing at its v2 successor. Removal targets v3.0, no earlier than 2027-05-09. Override per deployment via `AIWG_V1_SUNSET_DATE`.
AIWG executor bridge — register `agentic-sandbox` as an executor with an `aiwg serve` instance, dispatch missions over WebSocket, get the full `mission.*` event vocabulary back. SQLite-backed task store + idempotency cache, persistent across restarts, resumable missions. See docs/aiwg-executor.md.
v2 dashboard — sidebar v1→v2 migration, signed AgentCard panel per instance, A2A extension activation chips per task, push-notification CRUD UI, HITL prompt envelope rendering, Sunset banner with hit count.
Security hardening pass — SHA-pinned all CI actions, digest-pinned all Dockerfiles, dropped root in deploy images, pinned npm installs, constant-time secret comparison, bearer-token log redaction, tightened cloud-init perms.
Conformance harness wired into CI — new `roctinam/agentic-sandbox-conformance` suite blocks delivery on regression, alongside a VM-backed end-to-end gate.
New Getting Started guide — docs/getting-started.md for the 15-minute onboarding path.

Upgrade notes

If you are…	Do this
Running v2026.5.0 with v1 clients only	Nothing required. v1 routes are unchanged; you'll see new `Sunset`/`Deprecated`/`Link` headers in responses.
Building against v1 today	Plan migration to v2 ahead of the 2027-05-09 sunset. The v2 migration guide maps every v1 path to its v2 equivalent. The `Link` header in every v1 response also gives the successor URL inline.
Running an `aiwg serve` instance	Set `AIWG_SERVE_ENDPOINT` on the management server and the sandbox will register itself as an executor on startup. Existing v1 missions on disk are migrated to SQLite automatically (`agentic-sandbox-mgmt missions migrate` runs at boot).
Provisioning VMs in CI	Pull the latest VM-backed e2e workflow — `run-e2e-tests.sh` now requires the management server to be alive across step boundaries and explicitly resets runtime state.
Operating with custom cloud-init	Re-provision affected VMs to pick up tightened secret perms (`0400`, owner-only) and virtiofs mount flags. Existing VMs continue to run; tightening only applies on re-provision.
Maintaining downstream clients	The five v2 extensions are declared in every AgentCard's `capabilities`; `runtime/v1` and `idempotency/v1` are `required: true` (enforcement deferred to v2.1 and clients can activate). `multi-tenant/v1` shape is declared but enforcement is deferred to v2.2 per ADR-013.

Known limitations / deferred work

Binary release artifacts: this release ships from source only. The following follow-on work is tracked and will land in a subsequent release:
#295 — pre-release validation gate (P0)
#296 — cargo publish for the three Rust crates (P1)
#297 — release binary tarballs + SHA256 sums (P1)
#301 — automated version bumping across all manifests (P1)
#299 — multi-registry container push (ghcr + Quay) (P2)
#300 — signed artifacts + SBOM (P2)
Python expunge follow-ups: the Python SDK (`sdk/python/`) and legacy agent runtime (`agent/`) have been removed. Two intentional Python footholds remain and will be ported to Rust:
#302 — port `tests/e2e/` pytest harness to Rust integration tests
#303 — port `scripts/vm-event-bridge.py` to Rust
Python SDK has been removed. It was alpha (`0.1.0`), unmaintained, and never published. REST API access is unchanged; use the `sandboxctl` CLI or hit `/api/v2/admin/*` directly. The companion `agent/` (deprecated Python agent runtime) has also been removed; `agent-rs/` has been the supported agent client since 2026-01-26.
`multi-tenant/v1` enforcement is deferred to v2.2 (ADR-013); the extension is declared and discoverable but does not yet gate requests.
`runtime/v1` is declared `required: true` but full enforcement is deferred to v2.1.

How to verify the upgrade

# Pull the tag
git fetch --tags origin
git checkout v2026.5.1

# Rebuild and start
make build
cd management && ./dev.sh

# Verify v2 surface is live
curl -sf http://localhost:8122/healthz
curl -s http://localhost:8122/api/v1/agents -i | grep -E '^(Sunset|Deprecated|Link):'

# Provision a container instance and confirm AgentCard signs cleanly
sandboxctl container create agent-01 --image agentic/claude:latest
sandboxctl agentcard verify agent-01

Expected: `agentcard verify` reports a valid Ed25519 signature; `/api/v1/agents` response includes `Sunset` (date), `Deprecated: true`, and a `Link` header with `rel="successor-version"` pointing at `/api/v2/admin/instances`.

Thanks

Issues, contributions, and audit reports are tracked at https://github.com/jmagly/agentic-sandbox/issues.

Full change log

See `CHANGELOG.md` for the detailed Added / Fixed / Security / Documentation breakdown.