Agentic Sandbox v2026.6.19

Agentic Sandbox v2026.6.19

Released: 2026-06-19 Tag: `v2026.6.19` Previous: `v2026.6.18` Compare: `v2026.6.18...v2026.6.19`

What This Release Is

v2026.6.19 supersedes `v2026.6.18`. The `v2026.6.18` tag contains the host runtime bootstrap enrollment fix, but its tag CI failed because `agentic-host-runtime-daemon` was not updated for the new supervisor config field. This release carries the host bootstrap behavior plus the daemon compile fix.

Highlights

  • Host runtime provisioning issues one-time bootstrap enrollment material when a

bootstrap token store is configured.

  • Embedded and daemon host supervisors now both pass

`AGENTIC_HOST_BOOTSTRAP_ENROLLMENT_URL` through to host-backed agents.

  • The local host supervisor starts agents with `AGENT_TRANSPORT=auto` and

bootstrap mTLS environment, allowing the agent to enroll, reconnect over mTLS, and register with management.

  • Admin operation results report non-secret bootstrap evidence only:

`bootstrap_token_issued`, `bootstrap_spiffe_id`, and token expiry.

  • The plaintext bootstrap token is redacted from operation excerpts and is

scrubbed from the host `agent.env` after successful enrollment.

Operator Notes

  • Use `v2026.6.19`; do not use `v2026.6.17` or `v2026.6.18`.
  • Use `AGENTIC_HOST_BOOTSTRAP_ENROLLMENT_URL` or

`agentic-host-runtime-daemon --bootstrap-enrollment-url` when the host agent must consume bootstrap enrollment from a non-default HTTP API origin.

  • Host isolation is still the host user's ambient execution context. This

release fixes secure registration for that runtime; it does not add a new OS-level sandbox.

Verification

Release-prep checks:

cargo fmt --manifest-path management/Cargo.toml --check
cargo test --manifest-path management/Cargo.toml host_runtime --lib
cargo build --manifest-path management/Cargo.toml --bin agentic-mgmt
cargo test --workspace
make test-unit

Live host proof:

  • Started `agentic-mgmt` with a gRPC mTLS listener, bootstrap token store, and

local host runtime supervisor.

  • Provisioned a `runtime: "host"` instance and observed the host agent register

over mTLS with a SPIFFE identity.

  • Started a managed `tmux` session through the registered agent.
  • Launched Codex inside that session and asked it to use AIWG discovery; the

running agent returned `AIWG_COCKPIT_LIVE_OK` and selected `issue-audit`.

Known limitation: Claude launched inside the same host session but reported that it was not logged in. Provider auth-state injection for Claude remains separate from the host runtime secure-registration fix.