Agentic Sandbox v2026.6.17

Agentic Sandbox v2026.6.17

Released: 2026-06-18 Tag: `v2026.6.17` Previous: `v2026.6.16` Compare: `v2026.6.16...v2026.6.17`

What This Release Is

Superseded by `v2026.6.18`. The `v2026.6.17` tag was pushed but failed the

tag lint gate on `cargo fmt` formatting only.

v2026.6.17 is a direct-delivery CalVer release-flow cut for the host runtime bootstrap path. It makes host-backed agents register over the same secure transport identity model used by fleet mTLS enrollment, which unblocks real agentic-framework session proof for the host target.

Highlights

  • Host runtime provisioning now issues one-time bootstrap enrollment material

when a bootstrap token store is configured.

  • The local host supervisor starts agents with `AGENT_TRANSPORT=auto` and

bootstrap mTLS environment, allowing the agent to enroll, reconnect over mTLS, and register with management.

  • Admin operation results report non-secret bootstrap evidence only:

`bootstrap_token_issued`, `bootstrap_spiffe_id`, and token expiry.

  • The plaintext bootstrap token is redacted from operation excerpts and is

scrubbed from the host `agent.env` after successful enrollment.

Operator Notes

  • Use `AGENTIC_HOST_BOOTSTRAP_ENROLLMENT_URL` when the host agent must consume

bootstrap enrollment from a non-default HTTP API origin.

  • Host isolation is still the host user's ambient execution context. This

release fixes secure registration for that runtime; it does not add a new OS-level sandbox.

Verification

Release-prep checks:

cargo test --manifest-path management/Cargo.toml host_runtime --lib
cargo build --manifest-path management/Cargo.toml --bin agentic-mgmt

Live host proof:

  • Started `agentic-mgmt` with a gRPC mTLS listener, bootstrap token store, and

local host runtime supervisor.

  • Provisioned a `runtime: "host"` instance and observed the host agent register

over mTLS with a SPIFFE identity.

  • Started a managed `tmux` session through the registered agent.
  • Launched Codex inside that session and asked it to use AIWG discovery; the

running agent returned `AIWG_COCKPIT_LIVE_OK` and selected `issue-audit`.

Known limitation: Claude launched inside the same host session but reported that it was not logged in. Provider auth-state injection for Claude remains separate from the host runtime secure-registration fix.