Agentic Sandbox v2026.5.17
Agentic Sandbox v2026.5.17
Released: 2026-05-24 Tag: `v2026.5.17` Previous: `v2026.5.15` (2026-05-24) Supersedes: `v2026.5.16` blocked tag attempt Compare: `v2026.5.15...v2026.5.17`
What this release is
v2026.5.17 is the clean publication candidate for the v2026.5.16 operator documentation synchronization work.
The v2026.5.16 tag was signed and pushed to both configured remotes, but tag CI failed before repository checkout when the `teroknor` Docker runner received HTTP 500 while pulling `docker.gitea.com/runner-images:ubuntu-latest` for the pre-release validation job. Because tag workflows are evaluated from the tagged commit, rerunning that tag would keep using the old release workflow. v2026.5.17 carries the same documentation-sync payload plus the release workflow hardening needed for a clean tag pipeline.
Highlights
- Release-critical tag jobs now run on titan: pre-release validation, aarch64/mutsu binary bridge, Gitea release attachment, and GitHub release mirroring no longer depend on the teroknor Docker runner image pull.
- v2026.5.16 remains auditable: the blocked tag was not moved or rewritten; v2026.5.17 supersedes it cleanly.
- Documentation sync from v2026.5.16 is preserved: README, quickstart, how-to, loadout, container-runtime, QEMU, operations, deployment, and troubleshooting docs remain aligned with the current task API, image catalog, loadout registry, and runtime notes.
- Release gates remain strict: artifact attachment, crates.io publication, GitHub release mirroring, and public registry mirroring still depend on release-blocking tag CI and E2E.
Upgrade matrix
| Audience | Impact |
|---|---|
| Operators following README / Getting Started | Use the corrected task manifest examples introduced in the documentation sync. |
| Release operators | Treat v2026.5.16 as a blocked tag attempt; use v2026.5.17 as the clean release candidate. |
| Runtime users already on v2026.5.15 | No runtime behavior change beyond versioned artifacts and corrected docs. |
| CI maintainers | Release-critical jobs no longer depend on teroknor's Docker base-image pull path. |
Verification
Local release-prep checks:
git diff --check
yq e '.' .gitea/workflows/ci.yaml
make lint
bash -n images/qemu/loadouts/resolve-manifest.sh images/qemu/loadouts/generate-from-manifest.sh images/qemu/provision-vm.sh scripts/bump-version.sh
cargo pkgid --manifest-path management/Cargo.toml
cargo pkgid --manifest-path agent-rs/Cargo.toml
cargo pkgid --manifest-path cli/Cargo.toml
bash scripts/test-bump-version.shThe superseding tag should be cut only after branch CI is green on the v2026.5.17 release-prep commit. Tag CI remains the release source of truth for publication.
Issues closed
- #369 - release-critical tag jobs depend on teroknor docker runner image pull.
- #370 - prepare v2026.5.17 to supersede blocked v2026.5.16 tag.
Related issues
- #367 remains open for runner label/substrate drift tracking.
Full change log
See [`CHANGELOG.md` `[2026.5.17]`](../../CHANGELOG.md#2026517-2026-05-24) for the categorized breakdown.