Agentic Sandbox v2026.5.3

Agentic Sandbox v2026.5.3

Released: 2026-05-19 (prep — tag to follow once you greenlight) Tag: `v2026.5.3` Previous: `v2026.5.2` (2026-05-19) Compare: `v2026.5.2...v2026.5.3`

What this release is

The first artifact-bearing release. v2026.5.1 and v2026.5.2 shipped with source-only notices because the release pipeline created a release page in three seconds with nothing attached. After this release, a tag push runs a full multi-architecture build, produces `agentic-sandbox-vX.Y.Z-<arch>-<libc>.tar.gz` for four targets with SHA256SUMS, tags container images with `:vX.Y.Z` on the internal registry, and (when operator secrets are provisioned) publishes crates, mirrors containers to ghcr/Quay, signs binaries with GPG, signs containers with cosign, attaches CycloneDX SBOMs, and mirrors the release to GitHub. The bar set in `docs/architecture/release-pipeline-audit.md` § 8 is met.

The one runtime-visible change is a TLS-backend swap to rustls. No client behavior change.

Highlights

  • Real release artifacts. Four binary tarballs per release (x86_64-linux-gnu, x86_64-linux-musl, aarch64-apple-darwin, aarch64-unknown-linux-gnu) with per-file `.sha256` sidecars plus an aggregated `SHA256SUMS`. Container images tagged `:vX.Y.Z` for the first time.
  • aarch64 from a Mac Mini, the proven way. A self-hosted Linux runner SSHes to `mutsu` (Apple M4) per release, clones into `/Volumes/build/agentic-sandbox/builds/run-<id>-<target>/`, runs `cargo build` / `cargo zigbuild`, scp's binaries back. Matches `fortemi/publish-sidecar.yml` — sidesteps the native `runs-on: mutsu` gRPC task-fetch issue that's been silently cancelling sidecar releases since April.
  • rustls everywhere. `reqwest` and `tokio-tungstenite` no longer depend on `native-tls` / system OpenSSL. Pure-Rust TLS. josekit (used by the executor for AgentCard JWS signing) is the lone openssl holdout; it vendors openssl from C source as part of the build to keep cross-compile clean.
  • CI runner re-routing. Zero `runs-on: self-hosted` remains in any workflow file. Every job targets `titan` (heavy: build, docker, e2e, cosign) or `teroknor` (light: validation, network, SSH out) by explicit label. The workstation runner is excluded from CI by design.
  • `scripts/bump-version.sh` — single command for the version-bump dance. CalVer validation, dirty-tree refusal, idempotency check, updates 3 Cargo.toml + 3 Cargo.lock + CHANGELOG section + footer compare-link.
  • Three operator-facing architecture docs added: release-pipeline audit, aarch64 build-runner plan, release runbook.

What landed under the hood

  • Release pipeline (Phases 1–4 of the audit): new jobs `prerelease-gate`, `release-binaries`, `release-binaries-mutsu`, `release-attach`, `cargo-publish`, `multi-registry-push`, `sign-and-sbom`, `github-release-sync`. `gitea-release.yaml` and `executor-build.yml` deleted; their work folded into `ci.yaml`. `docsite-deploy.yml` re-enabled on `v*` tags with secret guards.
  • Per-release container tags: `docker` job now emits `:latest`, `:<sha>`, AND `:v<version>` on tag pushes for all 6 images.
  • **`tags: ['v*']` added to `ci.yaml` triggers** — the full pipeline runs against the tag commit, not just the prior branch commit.
  • Ubuntu 24.04.3 pinned in `iso-pins.json` — sha256 verified against GPG-signed `SHA256SUMS` from releases.ubuntu.com. `pin-iso.sh` fingerprint-regex bug fixed (gpg uses double-spaces between fingerprint halves; old regex required single).

Upgrade matrix

If you are…Do this
Running v2026.5.2 with v1 or v2 clientsOptional rebuild from `v2026.5.3`. No client-visible behavior change.
Operating the runtimePick up the new container image: `docker pull registry.example.invalid/agentic-sandbox/mgmt:v2026.5.3` (first release with a `:v<version>` tag).
Pinning to a release in codeReference `:v2026.5.3` for any container, or download the binary tarball from the release page. SHA256SUMS lets you verify in one step.
Building from source`make build` continues to work. First cold build adds ~30s for the vendored OpenSSL compile pass (josekit dep).
Maintaining or contributing`scripts/bump-version.sh <new-version>` automates the version-bump dance for the next release. `docs/releases/runbook.md` is the end-to-end procedure.

How to verify the upgrade

git fetch --tags origin
git checkout v2026.5.3
make build

# Verify versions
./management/target/release/agentic-mgmt --version    # 2026.5.3
./cli/target/release/sandboxctl --version             # 2026.5.3
./agent-rs/target/release/agent-client --version      # 2026.5.3

# Verify the rustls swap (cargo tree no longer pulls native-tls/openssl via reqwest or tokio-tungstenite)
cd cli && cargo tree | grep -E "native-tls|openssl" || echo "rustls-only ✓"

Required operator secrets for full release activation

Wired but skip-with-warning until provisioned. See `docs/releases/runbook.md` § Required secrets for the full table.

  • `MUTSU_SSH_KEY` — aarch64 builds via mutsu SSH (this is the one that unlocks aarch64 in the release)
  • `CARGO_REGISTRY_TOKEN` — crates.io publish
  • `GHCR_TOKEN`, `QUAY_USERNAME`/`QUAY_PASSWORD` — multi-registry container push
  • `COSIGN_KEY`/`COSIGN_PASSWORD`, `GPG_PRIVATE_KEY`/`GPG_PASSPHRASE` — signatures + SBOM
  • `GITHUB_MIRROR_TOKEN` — GitHub Releases sync
  • `GT_ACCESS_TOKEN` + DEPLOY_* — docsite deploy

Each gates independently. A release with `MUTSU_SSH_KEY` set but `CARGO_REGISTRY_TOKEN` absent gets the four binary tarballs but no crates.io publish — clean partial activation.

Known limitations / deferred

  • #312 — `build-base-image.sh` hits a `virt-install --cdrom + --extra-args` API incompatibility. titan can't currently produce the Ubuntu 24.04 base image the e2e harness needs. E2E is skipped on every push (branch AND tag) as a temporary workaround so v2026.5.3 can ship. When #312 lands and the qcow2 is staged at `/mnt/ops/base-images/ubuntu-server-24.04-agent.qcow2`, restore the hard gate (first tag-only, then unconditional).
  • aarch64-linux ships without `agentic-mgmt` — it hard-links to system libvirt and no aarch64-linux libvirt sysroot is available on the mutsu build host. The aarch64-linux tarball includes a `MGMT_EXCLUDED.txt` note pointing at the x86_64-linux-gnu archive for control-plane use. (Fix would require gating the `virt` FFI behind a Cargo feature — separate ADR.)

Full change log

See [`CHANGELOG.md` `[2026.5.3]`](../../CHANGELOG.md#202653-2026-05-19) for the detailed Added / Changed / Fixed / Documentation / Removed / Required-secrets / Operator-notes breakdown.

Tagging procedure

When you greenlight the cut:

git tag -a v2026.5.3 -m "$(cat <<EOF
v2026.5.3 — first artifact-bearing release

Release pipeline transformed from notes-only (3s, no artifacts) to
full multi-arch builds with stamped tarballs, SHA256SUMS, versioned
container tags, and optional cargo publish / multi-registry / sign+SBOM
/ GitHub sync gated on operator secrets. CI runs only on titan/teroknor
(never workstation runners). HTTP+WS stack switched to rustls.

Full notes: docs/releases/v2026.5.3.md and CHANGELOG.md [2026.5.3]
EOF
)"

git push origin main && git push github main
git push origin v2026.5.3 && git push github v2026.5.3