Agentic Sandbox v2026.6.28

Agentic Sandbox v2026.6.28

Released: 2026-06-22 Tag: `v2026.6.28` Previous: `v2026.6.27` Compare: `v2026.6.27...v2026.6.28`

What This Release Is

v2026.6.28 is the gateway SSH and terminal transport consolidation release. It ships the post-`v2026.6.27` terminal-session commits on the release line and adds a hardened gateway-mediated SSH path with explicit route authorization, authenticated lease ownership, short-lived OpenSSH certificate issuance, runtime trust provisioning, and bounded connector prelude parsing.

The release also records the SSH gateway documentation sync performed after the security hardening work and stabilizes the SSH handshake failure test fixture that gated branch CI.

Highlights

  • Gateway-mediated SSH now covers lease metadata, certificate signing, runtime

CA trust provisioning, connector routing, and CLI UX.

  • SSH connector routing fails closed unless `AGENTIC_GATEWAY_SSH_ALLOWLIST`

explicitly grants an actor-to-instance route.

  • SSH lease issue/revoke paths derive the actor from authenticated operator

identity and no longer trust caller-supplied actor fields.

  • Revocation responses expose the implemented OpenSSH certificate behavior as

`metadata_only_until_certificate_expiry`.

  • SSH connector prelude reads are bounded before newline parsing.
  • Terminal-session commits after `v2026.6.27` are included on the release tag,

including formal `pty-ws` registry/bus projection and wildcard fanout restrictions.

Upgrade Matrix

AudienceImpact
Operators enabling gateway SSHConfigure `AGENTIC_GATEWAY_SSH_ALLOWLIST` before enabling the SSH connector listener. Missing or malformed routes deny attachments.
API clients issuing SSH leasesLease issue/revoke calls require authenticated operator identity; the gateway binds the actor to that identity.
Security reviewersRevoked leases update gateway metadata immediately, but already issued OpenSSH user certificates remain valid until the short certificate TTL expires.
Terminal client authors`pty-ws` session state now converges on the formal registry and canonical session bus on the release tag.

Verification

User-facing artifact verification is documented in `docs/releases/verification.md`, including checksums, package assets, container digests, optional signatures, SBOMs, and current SLSA-not-claimed status.

make test-unit
make lint
git diff --check

Remote gates:

  • Gitea Actions run `1619` passed on `8350096`, including lint, tests, build,

Docker build/publish, E2E tests, and security scan.

  • Gitea Actions conformance run `1620` passed on `8350096`.

Operator Notes

  • Prefer gateway-mediated SSH for standards-compatible shell, `scp`, `sftp`,

`rsync`, and existing SSH tooling when gateway policy and audit are required.

  • Treat direct runtime SSH as a bypass or break-glass path. It does not inherit

gateway route authorization, lease metadata, or gateway audit guarantees.

  • Keep SSH certificate TTLs short. Revocation prevents new gateway-mediated

lease use, but OpenSSH certificates already handed to a client expire on their validity window.