Agentic Sandbox v2026.6.1

Agentic Sandbox v2026.6.1

Released: 2026-06-14 Tag: `v2026.6.1` Previous: `v2026.6.0` (2026-06-11) Compare: `v2026.6.0...v2026.6.1`

What this release is

v2026.6.1 is the full-autonomy substrate release. It completes the post-2026.6.0 secure-transport hardening slices that remove legacy shared secret and TOFU defaults, and it adds the executor-substrate surface AIWG needs to normalize Cockpit orchestration on agentic-sandbox's v2 executor contract.

The runtime spectrum is now explicit: host, Docker, and VM are operator-selectable per instance. Host is the least-isolated tier and should be presented as full host access in operator UX.

Highlights

  • Local user-host execution target (#460): host runtime metadata,

isolation-tier reporting, local supervisor boundaries, admin v2 host lifecycle routing, and daemon-mode supervision for agents that run directly on the user's host with no Docker or VM wrapper.

  • First-party host runtime daemon (#460): `agentic-host-runtime-daemon`

exposes a fail-closed Unix-socket supervisor protocol and ships with an example user-level systemd unit for durable host agents. The daemon is not installed or started by default.

  • Direct and managed session-host control (#461): `pty-ws/v1` now

advertises session host capabilities and supports native/direct plus managed `tmux`, `screen`, and `zellij` backend selection through the v2 executor contract.

  • Host PTY conformance proof (#460): multiple host-runtime agents on one

host can attach over `pty-ws/v1`, keep output isolated, forward controller stdin through `PtyBridge`, and reattach through replay keyframes.

  • Secure transport default path (#409/#410/#412): UDS, vsock, mTLS,

peer identity, embedded local CA, bootstrap token, and CSR enrollment plumbing are wired into secure provisioning.

  • Legacy secret and TOFU removal (#412): secure loadouts omit legacy agent

shared secrets, disable TOFU by default, and document legacy secrets as compatibility-only.

Upgrade matrix

AudienceImpact
AIWG / Cockpit integratorsHost, Docker, and VM can be selected per instance through the v2 executor contract. Host mode now covers lifecycle, attach, stdin/stdout, and reattach semantics needed for base AIWG operation.
Operators running host agentsUse `AGENTIC_HOST_RUNTIME_MODE=daemon` plus the documented user-level systemd unit when host agents need durable supervision. Review the socket path and mode before enabling.
Security operatorsSecure VM provisioning no longer emits legacy shared secrets by default. External CA / OpenBao integration remains gated for a later release.
CLI / session users`pty-ws/v1` session hosts now report backend capabilities and support native, tmux, screen, and zellij selection where the bridge advertises them.
Release operatorsBranch and tag CI remain the source of truth. VM-backed E2E and conformance were green on the delivery commits and will run again in tag context.

Package install and upgrade

For releases that publish native Linux packages, use the checksum-verifying installer:

curl -fsSL https://github.com/jmagly/agentic-sandbox/releases/download/v2026.6.1/agentic-sandbox-install.sh \
  | bash -s -- --version v2026.6.1

Direct package installs are also supported:

sudo apt-get install ./agentic-sandbox_2026.6.1-1_amd64.deb
sudo dnf install ./agentic-sandbox-2026.6.1-1.x86_64.rpm

Public container packages

For releases that publish public container packages, pull the GHCR version tags:

docker pull ghcr.io/<owner>/agentic-sandbox-mgmt:v2026.6.1
docker pull ghcr.io/<owner>/agentic-sandbox-agent-client:v2026.6.1
docker pull ghcr.io/<owner>/agentic-sandbox-agent:v2026.6.1
docker pull ghcr.io/<owner>/agentic-sandbox-claude:v2026.6.1
docker pull ghcr.io/<owner>/agentic-sandbox-codex:v2026.6.1
docker pull ghcr.io/<owner>/agentic-sandbox-opencode:v2026.6.1
docker pull ghcr.io/<owner>/agentic-sandbox-automation-control:v2026.6.1

Verification

Local release-prep checks:

git diff --check
make lint
cargo pkgid --manifest-path management/Cargo.toml   # ...#2026.6.1
cargo pkgid --manifest-path agent-rs/Cargo.toml     # ...#2026.6.1
cargo pkgid --manifest-path cli/Cargo.toml          # ...#2026.6.1
python3 scripts/check-doc-links.py --docs-root docs

Runtime spot-checks after upgrade:

# Confirm binary versions:
agentic-mgmt --version
sandboxctl --version
agent-client --version

# Host runtime daemon help:
agentic-host-runtime-daemon --help

The tag should be cut only after branch CI is green on the release-prep commit. Tag CI remains the release source of truth for publication (artifacts, registry images, crates.io, SBOM/signing, GitHub release sync, and docs deployment where secrets are configured).

Issues closed

  • #409 - local-first gRPC UDS/vsock/mTLS transport groundwork and identity

plumbing.

  • #410 - embedded local CA and bootstrap enrollment provisioning path.
  • #412 - legacy shared-secret / TOFU removal for secure transports.
  • #460 - local user-host execution target with daemon supervision and host

PTY conformance proof.

  • #461 - direct and managed session control via native, tmux, screen, and

zellij backends.

  • #411 remains gated on operator OpenBao genesis for external CA issuance and

short-lived certificate renewal.

  • #438 remains related VM-provider work; it is distinct from this release's

bare-host target.