Agentic Sandbox v2026.5.13

Agentic Sandbox v2026.5.13

Released: 2026-05-24 Tag: `v2026.5.13` Previous: `v2026.5.12` (2026-05-23) Compare: `v2026.5.12...v2026.5.13`

What this release is

v2026.5.13 is the VM substrate release-gate repair for the automation-control/TUI line.

It supersedes v2026.5.12. The v2026.5.12 tag created release artifacts, but tag E2E still failed after the SSH wait heartbeat exposed that titan's VM substrate was not merely slow. The runner had recorded a manifest for a 193 KiB placeholder qcow2, and even after rebuilding the image, provisioned VMs still booted with BIOS-style XML while the project image builder produces UEFI images.

Highlights

  • Base-image fast-fail guard: base-image verification now rejects implausibly small qcow2 files before recording or trusting a manifest.
  • Manifest metadata hardening: qcow2 manifest entries now record and verify image size metadata in addition to sha256.
  • Timeout propagation through reprovisioning: `AGENTIC_VM_SSH_WAIT_SECONDS` and `SSH_WAIT_SECONDS` survive the second `sudo` boundary in `reprovision-vm.sh`.
  • UEFI VM boot default: provisioned libvirt VMs now boot with OVMF/UEFI by default, matching images produced by `build-base-image.sh --boot uefi`; BIOS remains available through `AGENTIC_VM_FIRMWARE=bios`.
  • Titan base image restored: the runner's Ubuntu 24.04.3 agent image was rebuilt and re-manifested after backing up the bad placeholder image.

Verification

Branch verification before release prep:

  • Run 610: CI passed on `5b8ec7d`.
  • Run 611: Conformance passed on `5b8ec7d`.
  • Run 609: Supply-chain pin lint passed on `f94c226`.

Manual titan VM E2E after host repair and the UEFI provisioner patch:

TEST_VM=agentic-e2e-uefi-20260523 E2E_CLEANUP_VM=1 E2E_VM_SETUP=1 E2E_VM_READY_TIMEOUT=900 AGENTIC_VM_SSH_WAIT_SECONDS=900 make test-e2e

Result: `25 passed, 4 skipped in 96.63s`. The VM reached SSH in about 13 seconds, agent deployment/readiness succeeded, and the manual VM was destroyed after the run.

Local verification for the release-prep and script changes:

bash -n images/qemu/backends/libvirt.sh
bash -n images/qemu/provision-vm.sh
bash -n scripts/reprovision-vm.sh
bash -n scripts/run-e2e-tests.sh
bash -n images/qemu/lib/verify.sh
git diff --check

Tag CI remains the release source of truth for release-blocking E2E.

Issues closed

  • #362.
  • #356 remains the release E2E VM readiness tracker until tag CI confirms the substrate gate is green.
  • #363 tracks titan runner isolation so release-blocking E2E does not contend with unrelated heavy host builds.

Full change log

See [`CHANGELOG.md` `[2026.5.13]`](../../CHANGELOG.md#2026513-2026-05-24) for the categorized breakdown.