Agentic Sandbox v2026.6.22

Agentic Sandbox v2026.6.22

Superseded by `v2026.6.23`. The tag carried the fix and passed local

verification plus Gitea lint/test/build/package/Docker publish jobs, but the

VM E2E resource-stress test failed on a transient SSH readiness gap before

release creation.

Released: 2026-06-19 Tag: `v2026.6.22` Previous: `v2026.6.21` Compare: `v2026.6.21...v2026.6.22`

What This Release Is

v2026.6.22 supersedes v2026.6.21. It carries the normalized runtime bootstrap injection fix for Docker and VM deployments, plus release metadata noting that v2026.6.21 was blocked by a Gitea lint-job infrastructure failure with no retrievable job log and no available rerun endpoint.

Highlights

  • Docker v2 provisioning starts a managed container with canonical instance IDs,

management endpoint env, labels, mounts, and one-time bootstrap enrollment material.

  • Docker v1 provisioning issues bootstrap enrollment material when callers do

not provide mTLS, UDS, vsock, or bootstrap env.

  • The container entrypoint accepts bootstrap enrollment as secure first-start

material so `agent-rs` can enroll into mTLS.

  • VM deploy now fails closed if `agent.env` lacks bootstrap enrollment, mTLS,

UDS, or vsock material, or still contains retired `AGENT_SECRET` material.

  • The fake-Docker regression test is safe under the full parallel management

test suite.

  • Local socket-binding tests now skip only when the environment denies the

socket bind precondition, while still failing on other bind or TLS errors.

Verification

make lint
python3 scripts/check-doc-links.py --docs-root docs
git diff --exit-code
cargo fmt --manifest-path management/Cargo.toml --check
cargo fmt --manifest-path agent-rs/Cargo.toml --check
cargo fmt --manifest-path cli/Cargo.toml --check
bash -n images/container/agent-entrypoint.sh
bash -n scripts/provision-vm-agent.sh
bash -n images/qemu/provision-vm.sh
cargo test --manifest-path management/Cargo.toml --lib
make test-unit
images/qemu/loadouts/tests/test_generate_from_manifest.sh
images/qemu/tests/test-cloud-init-secure-transport.sh