Agentic Sandbox v2026.6.20

Agentic Sandbox v2026.6.20

Superseded by `v2026.6.21`. The tag was pushed but its tag CI test job

failed because the fake-Docker regression test was not parallel-safe.

Released: 2026-06-19 Tag: `v2026.6.20` Previous: `v2026.6.19` Compare: `v2026.6.19...v2026.6.20`

What This Release Is

v2026.6.20 extends the host-runtime bootstrap work from v2026.6.19 to the Docker and VM deployment paths. The fix normalizes the runtime bootstrap envelope so each substrate can launch the same Rust agent with canonical instance identity and secure first-start enrollment material.

Highlights

  • Docker v2 provisioning now starts a managed container instead of failing on

the retired `AGENT_SECRET` bootstrap path.

  • Docker v1/v2 provisioning injects canonical `AGENT_INSTANCE_ID`,

`AIWG_INSTANCE_ID`, `MANAGEMENT_SERVER`, `AGENT_TRANSPORT=auto`, and `AGENT_BOOTSTRAP_*` env when bootstrap enrollment is needed.

  • The container entrypoint accepts bootstrap enrollment as a secure first-start

path, allowing `agent-rs` to exchange the token for mTLS material.

  • VM cloud-init/loadout generation carries the optional bootstrap TLS directory

and enrollment URL fields in addition to token, SPIFFE ID, and expiry.

  • VM agent deployment now fails closed if `/etc/agentic-sandbox/agent.env` has

retired `AGENT_SECRET` material or lacks bootstrap enrollment, mTLS, UDS, or vsock transport configuration.

Verification

cargo fmt --manifest-path management/Cargo.toml --check
bash -n images/container/agent-entrypoint.sh
bash -n scripts/provision-vm-agent.sh
bash -n images/qemu/provision-vm.sh
cargo test --manifest-path management/Cargo.toml admin_v2::tests --lib
cargo test --manifest-path management/Cargo.toml containers --lib
cargo test --manifest-path management/Cargo.toml bootstrap_enrollment --lib
images/qemu/loadouts/tests/test_generate_from_manifest.sh
images/qemu/tests/test-cloud-init-secure-transport.sh

The release also includes an entrypoint execution check proving bootstrap enrollment is accepted and a no-secure-transport launch is rejected before the agent starts.