Agentic Sandbox v2026.6.18

Agentic Sandbox v2026.6.18

Released: 2026-06-18 Tag: `v2026.6.18` Previous: `v2026.6.17` Compare: `v2026.6.17...v2026.6.18`

What This Release Is

Superseded by `v2026.6.19`. The `v2026.6.18` tag was pushed but failed the

tag CI workspace test because `agentic-host-runtime-daemon` was missing the

new bootstrap enrollment config field.

v2026.6.18 superseded `v2026.6.17`. The `v2026.6.17` tag was pushed but failed the tag lint gate on `cargo fmt` formatting only. `v2026.6.19` is the canonical release for this host runtime bootstrap behavior.

Highlights

  • Host runtime provisioning issues one-time bootstrap enrollment material when a

bootstrap token store is configured.

  • The local host supervisor starts agents with `AGENT_TRANSPORT=auto` and

bootstrap mTLS environment, allowing the agent to enroll, reconnect over mTLS, and register with management.

  • Admin operation results report non-secret bootstrap evidence only:

`bootstrap_token_issued`, `bootstrap_spiffe_id`, and token expiry.

  • The plaintext bootstrap token is redacted from operation excerpts and is

scrubbed from the host `agent.env` after successful enrollment.

Operator Notes

  • Use `v2026.6.19`; do not use `v2026.6.17` or `v2026.6.18`.
  • Use `AGENTIC_HOST_BOOTSTRAP_ENROLLMENT_URL` when the host agent must consume

bootstrap enrollment from a non-default HTTP API origin.

  • Host isolation is still the host user's ambient execution context. This

release fixes secure registration for that runtime; it does not add a new OS-level sandbox.

Verification

Release-prep checks:

cargo fmt --manifest-path management/Cargo.toml --check
cargo test --manifest-path management/Cargo.toml host_runtime --lib
cargo build --manifest-path management/Cargo.toml --bin agentic-mgmt

Live host proof:

  • Started `agentic-mgmt` with a gRPC mTLS listener, bootstrap token store, and

local host runtime supervisor.

  • Provisioned a `runtime: "host"` instance and observed the host agent register

over mTLS with a SPIFFE identity.

  • Started a managed `tmux` session through the registered agent.
  • Launched Codex inside that session and asked it to use AIWG discovery; the

running agent returned `AIWG_COCKPIT_LIVE_OK` and selected `issue-audit`.

Known limitation: Claude launched inside the same host session but reported that it was not logged in. Provider auth-state injection for Claude remains separate from the host runtime secure-registration fix.