Agentic Sandbox v2026.6.12

Agentic Sandbox v2026.6.12

Released: 2026-06-16 Tag: `v2026.6.12` Previous: `v2026.6.11`

What This Release Is

v2026.6.12 is the direct-delivery CalVer release-flow cut for the local-first secure agent transport work. It carries the workstation local CA backend lifecycle, the remote CA backend boundary for distributed fleets, and the release-lane fixes needed to publish the full artifact matrix.

Highlights

  • Local workstation deployments default to the embedded local CA for agent

mTLS while keeping the remote CA backend boundary fail-closed.

  • Agent and server leaf certificate renewal is covered by deterministic tests.
  • The agent PTY controlling-terminal ioctl is typed per target so Darwin and

Linux release builds both compile cleanly.

  • The mutsu Apple Silicon smoke path now tolerates slower post-reboot SSH

readiness with longer setup/cleanup windows and additional connection attempts.

Operator Notes

  • Treat `v2026.6.7` through `v2026.6.11` as superseded release-attempt tags.

They were useful for proving individual lanes, but `v2026.6.12` is the intended release-flow cut.

  • Tag CI remains the publication source of truth for release assets, package

artifacts, container tags, SBOM/signing, and release mirroring.

Verification

Release-prep checks:

scripts/lint-ci-pins.sh
git diff --check
cargo test --manifest-path management/Cargo.toml --lib
cargo test --manifest-path agent-rs/Cargo.toml --lib

Post-publication verification:

scripts/verify-release-assets.sh v2026.6.12 --skip-ghcr