Agentic Sandbox v2026.5.15

Agentic Sandbox v2026.5.15

Released: 2026-05-24 Tag: `v2026.5.15` Previous: `v2026.5.14` (2026-05-24) Compare: `v2026.5.14...v2026.5.15`

What this release is

v2026.5.15 is the base-image verifier diagnostics patch for the release-gated VM substrate.

It supersedes v2026.5.14. The v2026.5.14 tag workflow correctly blocked publication after release E2E failed, but the failure stopped before VM boot because the job observed `/mnt/ops/base-images/ubuntu-server-24.04-agent.qcow2` as a 628 MiB file. Follow-up runner inspection showed that the job executed on `grissom`, whose runner also advertises the `titan` label and whose local base image is a valid compressed qcow2 with a 40 GiB virtual size and matching manifest sha.

Highlights

  • Release gate still holds: failed tag E2E skips release attachment, crates.io publication, GitHub release mirroring, and public registry mirroring.
  • Base-image failures are diagnosable: verifier failures now print `stat`, `ls`, `qemu-img info`, mount, and manifest context for the selected qcow2 path.
  • Virtual-size-aware sanity check: compressed or sparse qcow2 files with a sane virtual size continue to manifest size and sha256 validation instead of failing solely on raw file length.
  • Tamper checks remain fail-closed: manifest size mismatch and sha mismatch still abort overlay creation.

Verification

Local verifier checks:

bash -n images/qemu/lib/verify.sh images/qemu/tests/test-verify.sh
images/qemu/tests/test-verify.sh

Expected result: the test accepts a small raw file only when fake `qemu-img` reports qcow2 format and a sane virtual size, then fails on manifest size mismatch with diagnostics and fails undersized files without qemu metadata.

Tag CI remains the release source of truth for release-blocking E2E. The expected proof for this release is a green `v2026.5.15` tag run where E2E reaches VM provisioning with the repaired verifier behavior and release publication jobs only start after E2E succeeds.

Issues closed

  • #366.
  • #356 remains the release E2E VM readiness tracker until tag CI confirms a clean substrate run.
  • #363 tracks titan runner isolation so release-blocking E2E does not contend with unrelated heavy host builds.
  • #341 tracks branch-push release-only jobs briefly scheduling before resolving to skipped.

Full change log

See [`CHANGELOG.md` `[2026.5.15]`](../../CHANGELOG.md#2026515-2026-05-24) for the categorized breakdown.