Agentic Sandbox v2026.5.8

Agentic Sandbox v2026.5.8

Released: 2026-05-22 Tag: `v2026.5.8` Previous: `v2026.5.7` (2026-05-22) Compare: `v2026.5.7...v2026.5.8`

Superseded by v2026.5.9. v2026.5.8 release artifacts were created, but tag CI run 578 failed the release-blocking E2E job while waiting for first-boot VM SSH readiness. Use v2026.5.10 or newer as the clean automation-control/TUI release.

What this release is

v2026.5.8 is the clean automation-control/TUI orchestration patch release.

It supersedes v2026.5.7, whose release artifacts were created but whose tag workflow failed the release-blocking E2E job before VM tests could run because the titan runner had no initialized agentshare tree.

This release fixes that tag-gate prerequisite and adds the low-churn Codex automation launcher that should be used by browser-observed and orchestrator-driven Codex TUI sessions.

Highlights

  • Release-gate repair: tag E2E initializes agentshare when missing instead

of failing before VM provisioning.

  • Codex automation launcher: `agentic-codex-automation` wraps Codex with

`TERM=xterm`, `NO_COLOR=1`, and `--no-alt-screen`.

  • Docker and VM parity: the launcher is installed in the

`agentic/automation-control` image and in the automation-control VM/QEMU loadout.

  • Signed delivery: the operator-authored feature and corrective merge are

signed with code key `62297562B1C7053088F405DB0117DAAA677A5BF2`.

What changed since v2026.5.7

CI and release gate

  • The E2E workflow now checks `/srv/agentshare/global` and

`/srv/agentshare/global-ro` before `make test-e2e`.

  • If agentshare is missing, CI runs

`sudo AGENTSHARE_ROOT=/srv/agentshare images/qemu/setup-agentshare.sh`.

  • Already-initialized runners skip the step.

Automation-control Codex launch

  • Added `images/common/automation-control/codex-automation.sh`.
  • Docker automation-control builds copy it to

`/usr/local/bin/agentic-codex-automation`.

  • VM automation-control loadouts write the same helper into

`/usr/local/bin/agentic-codex-automation`.

  • Container smoke coverage verifies the wrapper by running

`agentic-codex-automation --version`.

Upgrade matrix

If you are...Do this
Using v2026.5.7Upgrade. v2026.5.7 tag CI failed release-blocking E2E.
Launching Codex TUIs through automation-controlUse `agentic-codex-automation` instead of raw `codex` for the default observed path.
Running tag-gated E2E on titanUpgrade. The workflow now initializes agentshare when missing.
Only using lifecycle APIsUpgrade is safe; no API migration is required.

Verification

Main was green before release prep:

  • Gitea Actions run 573: success on signed tip `698d43a`.
  • Gitea Actions run 574: success on signed tip `698d43a`.
  • PR runs 567, 568, and 569 passed for the Codex automation launcher.

Local checks performed before release prep:

codex --help
bash -n images/common/automation-control/codex-automation.sh tests/container/smoke.sh
images/common/automation-control/codex-automation.sh --version
cd images/qemu/loadouts && ./resolve-manifest.sh profiles/automation-control.yaml
docker build -f images/container/Dockerfile.automation-control \
  -t agentic/automation-control:codex-automation-test .
docker run --rm --entrypoint /bin/bash agentic/automation-control:codex-automation-test \
  -lc 'set -o pipefail; codex --version | head -1; agentic-codex-automation --version | head -1; agentic-provider-inventory | grep -F "schema\	agentic.provider_inventory.v1"'
git diff --check

After tag CI publishes artifacts, verify versions:

git fetch --tags origin
git checkout v2026.5.8
make build

./management/target/release/agentic-mgmt --version    # 2026.5.8
./cli/target/release/sandboxctl --version             # 2026.5.8
./agent-rs/target/release/agent-client --version      # 2026.5.8

Minimal Codex launch:

agentic-codex-automation

Set `AGENTIC_CODEX_WORKDIR=/path/to/workspace` when the session should start outside the current directory.

Known follow-ups

  • #351: clarify/search hot snapshot text vs durable transcript spill.
  • #353: browser UI reconnects and snapshot corruption under high-redraw

provider TUIs, plus Codex-specific Controller Enter semantics.

Issues closed

  • #355.

Full change log

See [`CHANGELOG.md` `[2026.5.8]`](../../CHANGELOG.md#202658-2026-05-22) for the categorized breakdown.

Tagging procedure

git tag -a v2026.5.8 -m "$(cat <<'EOF'
v2026.5.8 — release gate and Codex automation patch

Supersedes v2026.5.7 by fixing tag E2E agentshare bootstrap and ships
agentic-codex-automation for low-churn Codex TUI launches in automation-control
Docker and VM loadouts.

Full notes: docs/releases/v2026.5.8.md and CHANGELOG.md [2026.5.8]
EOF
)"

git push origin main
git push origin v2026.5.8