Agentic Sandbox v2026.5.7

Released: 2026-05-22 Tag: `v2026.5.7` Previous: `v2026.5.6` (2026-05-20) Compare: `v2026.5.6...v2026.5.7`

Superseded by v2026.5.8. v2026.5.7 release artifacts were created, but tag CI run 565 failed the release-blocking E2E job because agentshare was not initialized on titan. Use v2026.5.8 or newer as the clean automation-control/TUI release.

What this release is

The automation-control and TUI orchestration substrate release.

v2026.5.6 made VM-backed agents routable through A2A. v2026.5.7 builds the next layer: bounded PTY replay, durable transcript and event history, role-aware orchestrator attach metadata, a first-class `sandboxctl tui` command group, and an `automation-control` loadout that can launch provider TUIs under supervised control.

This release is meant for supervised human-in-the-loop agent operation. It proves that an orchestrator can create a named PTY session, observe it by default without write authority, explicitly opt into Controller writes, surface provider authorization URI/code flows, and cleanly record/replay enough state to drive the next loop.

Highlights

`sandboxctl tui` command group: snapshot, observe, send, and search commands for external orchestration.
Automation-control loadout: Docker image and VM profile for provider-TUI automation experiments, plus a credential-free provider inventory helper.
Direct provider TUI launch: interactive session create now honors the requested command and runs it inside the named tmux session.
Observer-first control model: session metadata advertises observer/controller URLs and Controller input stays explicitly gated.
Bounded hot replay plus durable history: PTY sessions keep the previous three screens hot and spill older transcript frames to searchable JSONL storage.
Event observability: mission/task events now expose hot-window Prometheus metrics and can spill evicted history to a durable archive.
A2A runtime correctness: task artifacts are available over HTTP, VM readiness rejects stale agents, and VM-backed instances carry correct runtime metadata.

What changed since v2026.5.6

PTY and TUI orchestration

`sandboxctl tui snapshot|observe|send|search` gives orchestrators a stable CLI surface for TUI interaction (#345).
Session create responses now include `pty_ws_url`, `pty_ws_subprotocol`, observer/controller orchestrator URLs, `default_role: observer`, and controller policy guidance (#340).
AgentCards advertise the actual `pty-ws/v1` attach endpoint and replay bounds (#338).
Formal PTY replay is bounded to a three-screen hot window (#332).
Evicted PTY transcript frames spill to per-session JSONL files under `pty-transcripts/`, with explicit search for older history (#337).
`observe --idle-ok` lets loop-start probes treat a successful idle Observer attach as success (#349).
Interactive session create now launches the requested command in tmux instead of discarding it (#350/#352).

Automation-control loadout

Added the `automation-control` Docker image, VM/QEMU loadout profile, image catalog entry, docs, and CI smoke coverage (#347).
Added `agentic-provider-inventory` so agents can inspect installed provider CLIs without credentials or authenticated provider flows.
Live validation reached the OpenAI Codex device authorization URI/code flow through sandbox PTY, accepted operator-completed sign-in, and reached the main Codex TUI.

Runtime and A2A fixes

A2A task artifacts are retrievable over HTTP (#327).
QEMU provisioning waits for the current VM agent instead of accepting stale registrations (#328).
VM-registered agents carry correct VM runtime classification in executor metadata (#330).
`adapter-command/v1` supports the provider-free assess path used by M011 self-guidance smokes (#326).
Session id handling is consistent across HTTP and PTY flows (#323).
Orchestrator write paths enforce Controller authority (#325).

Events and metrics

The bounded `/api/v1/events` hot window exports Prometheus metrics (#334).
Evicted mission/task events spill to `events.jsonl` and can be included on explicit query (#336).

Upgrade matrix

If you are...	Do this
Building an orchestrator that reads or drives TUIs	Upgrade. This release provides the first coherent CLI/API surface for Observer-first PTY operation.
Testing provider TUIs such as Codex	Upgrade and prefer the automation-control loadout. Start with a low-churn launch profile such as `cd /tmp && TERM=xterm NO_COLOR=1 codex --no-alt-screen`.
Using A2A task artifacts	Upgrade. Completed artifacts are now available through HTTP.
Running long-lived PTY sessions	Upgrade. Hot replay is bounded and older transcript output spills to durable searchable storage.
Only using one-shot VM/container lifecycle APIs	Upgrade is safe; no breaking API migration is required.

Verification

Main was green before release prep:

Gitea Actions run 561: success on `bee1f53`.
Gitea Actions run 562: success on `bee1f53`.

Local release-prep checks should include:

cargo fmt --check
cargo test --workspace

After tag CI publishes artifacts, verify versions:

git fetch --tags origin
git checkout v2026.5.7
make build

./management/target/release/agentic-mgmt --version    # 2026.5.7
./cli/target/release/sandboxctl --version             # 2026.5.7
./agent-rs/target/release/agent-client --version      # 2026.5.7

Minimal TUI smoke:

# Start management with a routable bind for Docker callback.
LISTEN_ADDR=0.0.0.0:8120 ./management/target/release/agentic-mgmt

# Create an automation-control container, then launch a low-churn Codex TUI.
sandboxctl --server http://127.0.0.1:8122 container create \
  --image agentic/automation-control:v2026.5.7 agentic-codex

cat > /tmp/codex-session.json <<'JSON'
{"command":"sh -lc 'cd /tmp && TERM=xterm NO_COLOR=1 codex --no-alt-screen'","session_name":"codex-low-churn"}
JSON

curl -sS -X POST -H 'content-type: application/json' \
  --data-binary @/tmp/codex-session.json \
  http://127.0.0.1:8122/api/v1/agents/agentic-codex/sessions

Known follow-ups

#351: clarify/search hot snapshot text vs durable transcript spill.
#353: browser UI reconnects and snapshot corruption under high-redraw provider TUIs. Raw tmux capture is currently more reliable than snapshot reconstruction during rapid redraws.
Provider authentication remains human-mediated. The substrate can surface device URI/code flows, but credentials and codes must not be stored in repo artifacts.

Issues closed

#314, #319, #320, #321, #322, #324, #331, #333, #339, #346, #348, #350.

Full change log

See [`CHANGELOG.md` `[2026.5.7]`](../../CHANGELOG.md#202657-2026-05-22) for the categorized breakdown.

Tagging procedure

git tag -a v2026.5.7 -m "$(cat <<'EOF'
v2026.5.7 — automation-control and TUI orchestration substrate

Ships the supervised provider-TUI substrate: sandboxctl tui driver commands,
automation-control loadout, direct interactive command launch, Observer-first
PTY metadata, bounded hot replay with durable transcript spill, durable event
archive, A2A artifact retrieval, VM readiness/runtime fixes, and idle Observer
probes.

Full notes: docs/releases/v2026.5.7.md and CHANGELOG.md [2026.5.7]
EOF
)"

git push origin main
git push origin v2026.5.7