Agentic Sandbox v2026.5.5

Agentic Sandbox v2026.5.5

Released: 2026-05-20 Tag: `v2026.5.5` Previous: `v2026.5.4` (2026-05-20) Compare: `v2026.5.4...v2026.5.5`

What this release is

The end-to-end validation patch for v2026.5.4's two operator-facing fixes (#312, #313). v2026.5.4 shipped both with dry-run + cross-reference validation; this release ran them on a real libvirt host and found what the dry-run couldn't catch.

Six commits, three operator-visible bug fixes, one CI gate restoration. After this release the base-image build pipeline works without manual intervention, the browser-qa loadout boots a fully functional VM in one shot, and e2e is back on the release-blocking path.

What changed since v2026.5.4

  • Loadout-based VM provisioning works again. A silent regression from #259's mode-600 hotfix had been blocking every loadout-based provision at "Generating health endpoint token…" since it landed. Found by running #313's live-VM validation; fixed by adding `sudo` to `get_health_token_hash`'s grep.
  • `browser-qa` loadout is now actually functional. First live-VM run surfaced three bugs that the issue body's proposed YAML had inherited — a non-existent Ubuntu 24.04 package, a udev rule that didn't apply retroactively, and no Xorg startup mechanism despite "Xorg :99 runs" being a stated acceptance criterion. All three fixed; re-provision passes 7/7 checks.
  • `build-base-image.sh` is now self-completing. The `--cdrom` → `--location` switch from v2026.5.4 fixed the virt-install API rejection but exposed a second latent bug: autoinstall has no poweroff trigger, so the installer reboots into the installed system and sits idle at a login prompt forever. Added `shutdown -h now` to late-commands. Builds now run unattended end-to-end.
  • E2E hard-gate restored for tag pushes. The `if: false` workaround from commit `13faf95` is reverted. After v2026.5.5+ ships cleanly with e2e green, the next change drops the `if:` entirely so e2e gates every push.

Validation evidence

This is the first release where #312 + #313 are operator-proven, not just code-proven.

#312 — base-image build, end-to-end on titan:

$ sudo images/qemu/build-base-image.sh 24.04 --output /tmp/test-24.04.qcow2
... (autoinstall ran ~9 min; virt-customize + virt-sparsify clean)
[verify] Recorded test-24.04.qcow2 → 2410afc6b8eeb5793539b4c4cdbc24e02210d1397ee1d45f8186df55b67b1c39
✓ Built: /tmp/test-24.04.qcow2  (3.0G sparse, 40G virtual)

#313 — browser-qa VM, 7/7 acceptance checks:

[1] Xorg :99 running?          ✓ PASS (pid via xorg99.service)
[2] /dev/uinput group + mode?  ✓ PASS (crw-rw---- root:input)
[3] carbonyl runtime version?  ✓ PASS (Carbonyl 0.2.0-alpha.3)
[4] python3-uinput importable? ✓ PASS
[5] agent in input group?      ✓ PASS
[6] xserver-xorg-input-evdev?  ✓ PASS
[7] xorg99.service active?     ✓ PASS

New helper

  • `scripts/validate-browser-qa.sh <vm-name>` — SSH into a provisioned browser-qa VM and check all 7 acceptance criteria. Exit 0 on pass, 1 on fail, 2 on SSH-unreachable. Suitable for CI gating later.

Upgrade matrix

If you are…Do this
Running v2026.5.4 with loadout-based provisioning brokenUpgrade — the secrets fix (`58c50c6`) unblocks every loadout-based `provision-vm.sh` invocation.
Using the `browser-qa` loadoutUpgrade — the three layer fixes (`629b598`) are the difference between "VM boots but Xorg isn't running and packages didn't install" and "7/7 acceptance checks pass."
Building base imagesUpgrade — the poweroff fix means `build-base-image.sh` finishes unattended instead of hanging waiting for shutdown after install.
Running CIUpgrade — tag pushes once again gate on e2e. v2026.5.5's own tag is the first to exercise the restored gate.
Operating other parts of the systemUpgrade is safe. No behavior change for v1/v2 clients, no API change, no migration.

How to verify the upgrade

git fetch --tags origin
git checkout v2026.5.5
make build

# Verify versions
./management/target/release/agentic-mgmt --version    # 2026.5.5
./cli/target/release/sandboxctl --version             # 2026.5.5
./agent-rs/target/release/agent-client --version      # 2026.5.5

# Verify the loopback default from v2026.5.4 is still in place
unset LISTEN_ADDR
./management/target/release/agentic-mgmt --help 2>&1 | head -3

# Verify the new browser-qa validation helper exists and is executable
test -x scripts/validate-browser-qa.sh && echo "OK"

# Optional: provision a browser-qa VM and run validation end-to-end
./images/qemu/provision-vm.sh agent-browser \
    --loadout profiles/browser-qa.yaml \
    --ssh-key ~/.ssh/automation_ed25519.pub \
    --wait-ready
./scripts/validate-browser-qa.sh agent-browser    # should exit 0
./scripts/destroy-vm.sh --force agent-browser

Issues closed

  • #312 — `build-base-image.sh` virt-install API incompatibility. Full chain: v2026.5.4's `f105c9f` (the `--cdrom` → `--location` switch) plus this release's `b5b1e18` (the autoinstall poweroff that completes the build) plus `9720215` (e2e CI hard-gate restored).
  • #313 — `browser-qa` loadout for trusted-input browser automation. Full chain: v2026.5.4's `df3ba86` (layer + profile + docs) plus this release's `58c50c6` (secrets regression unblock), `629b598` (three layer bugs from live-VM validation), `3b063af` (validate script xorg99 check), `b6ba53a` (docs pointer).

Carbonyl-agent cross-repo follow-up

`roctinam/carbonyl-agent#120`'s "VM-fallback documented + working" acceptance criterion can now be checked off in that thread — the loadout is proven on this host.

Known limitations / deferred

Carried forward from v2026.5.4, unchanged:

  • #256 WS bearer-auth-on-upgrade stays open — needs paired dashboard JS rework. Loopback bind from v2026.5.4 cuts the documented cross-VM threat in the meantime.
  • #257 full TLS wiring stays open. Multi-day work for multi-host deployments; not load-bearing for the single-host default.
  • #114 + children (Alpine + Proxmox provisioning) deferred to 2026-08-17 check date.

Full change log

See [`CHANGELOG.md` `[2026.5.5]`](../../CHANGELOG.md#202655-2026-05-20) for the detailed Added / Fixed / Changed / Documentation / Operator-notes / Issues-closed breakdown.

Tagging procedure

When you greenlight the cut:

git tag -a v2026.5.5 -m "$(cat <<'EOF'
v2026.5.5 — end-to-end validation patch

Six commits since v2026.5.4 — all from running the v2026.5.4 fixes
end-to-end on a real libvirt host and finding what dry-run validation
couldn't catch.

- get_health_token_hash sudo fix (unblocks all loadout provisions
  silently broken since #259's mode-600 hotfix)
- browser-qa layer: three bugs from live-VM validation
  (xserver-xorg-video-modesetting non-existent in 24.04,
  retroactive udev trigger missing, no Xorg startup mechanism)
- validate-browser-qa.sh smoke-test helper
- build-base-image.sh autoinstall poweroff (completes #312;
  builds now self-complete instead of hanging post-install)
- e2e CI hard-gate restored for tag pushes (reverts the
  if: false workaround from #312 cooldown)

Closes #312, #313.

Full notes: docs/releases/v2026.5.5.md and CHANGELOG.md [2026.5.5]
EOF
)"

git push origin v2026.5.5
git push github v2026.5.5