Agentic Sandbox v2026.6.15

Agentic Sandbox v2026.6.15

Released: 2026-06-17 Tag: `v2026.6.15` Previous: `v2026.6.14`

What This Release Is

v2026.6.15 is the direct-delivery CalVer release-flow cut for the local-first secure agent transport work. It includes the local CA backend lifecycle, remote CA backend boundary, deterministic CA renewal test, target-typed PTY ioctl fix, mutsu Darwin smoke restructuring, GitHub release mirroring, and a workspace-local SBOM tool install path for locked-down runners.

Highlights

  • Darwin binaries execute on mutsu in the native build session and the final

Darwin tarball is verified locally for arm64 Mach-O payloads.

  • SBOM generation installs `syft` into the workflow workspace instead of

`/usr/local/bin`, avoiding host permission failures.

  • The GitHub release mirror secret has been refreshed with a `repo` scoped

token for the required public release sync.

Operator Notes

  • Treat `v2026.6.7` through `v2026.6.14` as superseded release-attempt tags.

`v2026.6.15` is the intended release-flow cut.

  • Tag CI remains the publication source of truth for release assets, package

artifacts, container tags, SBOM/signing, and release mirroring.

Verification

Release-prep checks:

scripts/lint-ci-pins.sh
git diff --check
cargo pkgid --manifest-path management/Cargo.toml
cargo pkgid --manifest-path agent-rs/Cargo.toml
cargo pkgid --manifest-path cli/Cargo.toml
python3 scripts/check-doc-links.py --docs-root docs

Post-publication verification:

scripts/verify-release-assets.sh v2026.6.15 --skip-ghcr