Agentic Sandbox v2026.5.14

Agentic Sandbox v2026.5.14

Released: 2026-05-24 Tag: `v2026.5.14` Previous: `v2026.5.13` (2026-05-24) Compare: `v2026.5.13...v2026.5.14`

What this release is

v2026.5.14 is the release-gate enforcement patch for the automation-control/TUI substrate line.

It supersedes v2026.5.13. The v2026.5.13 tag workflow failed release-blocking E2E, but stale workflow dependencies still allowed publication jobs to run. This release keeps the v2026.5.13 VM substrate repairs and makes the release pipeline enforce the rule we need: no release attachment, crates publication, GitHub mirror, or public registry mirror unless tag E2E passes.

Highlights

  • Publication now waits for tag E2E: release publication jobs depend on the release-blocking E2E job, closing the gap that let v2026.5.13 publish after failed substrate validation.
  • Manual E2E works on PEP 668 hosts: `scripts/run-e2e-tests.sh` creates a local `.venv` when needed, so one-off titan validation no longer depends on caller-managed Python setup.
  • Current substrate proof is green: a fresh titan temp clone at `4a413a4` passed the VM E2E suite with `25 passed, 4 skipped`.
  • Runner-lane risk is explicit: titan host-runner contention remains tracked separately in #363; v2026.5.14 is the release gate enforcement layer, not a runner isolation release.

Verification

Branch verification before release prep:

  • Run 622: CI passed on `4a413a4`.
  • Run 623: Conformance passed on `4a413a4`.
  • Run 624: Supply-chain pin lint passed on `4a413a4`.

Manual titan VM E2E from a fresh temp clone at the release code line:

E2E_CLEANUP_VM=1 AGENTIC_VM_SSH_WAIT_SECONDS=900 E2E_VM_READY_TIMEOUT=900 ./scripts/run-e2e-tests.sh

Result: `25 passed, 4 skipped in 96.02s`. The script-created venv was used, the base image manifest sha was `0fc2b1a3b443c143a03454a324a5c2223e6e39ae7dfed9642bf1775d34c39c93`, the VM reached SSH in about 9 seconds, agent deployment/readiness succeeded, and cleanup destroyed the VM plus its ephemeral SSH key and agent secrets.

Local verification for the release-prep and script changes:

bash -n scripts/run-e2e-tests.sh
git diff --check

Tag CI remains the release source of truth for release-blocking E2E. After v2026.5.14 is tagged, the expected proof is a green tag CI run where release publication jobs start only after E2E succeeds.

Issues closed

  • #364.
  • #365.
  • #356 remains the release E2E VM readiness tracker until tag CI confirms the substrate gate is green.
  • #363 tracks titan runner isolation so release-blocking E2E does not contend with unrelated heavy host builds.
  • #341 tracks branch-push release-only jobs briefly scheduling before resolving to skipped.

Full change log

See [`CHANGELOG.md` `[2026.5.14]`](../../CHANGELOG.md#2026514-2026-05-24) for the categorized breakdown.