Agentic Sandbox v2026.6.29

Agentic Sandbox v2026.6.29

Released: 2026-06-22 Tag: `v2026.6.29` Previous: `v2026.6.28` Compare: `v2026.6.28...v2026.6.29`

What This Release Is

v2026.6.29 is a release-readiness and runtime bootstrap hardening release. It keeps the local-first security posture explicit, makes Docker and QEMU provisioning failures actionable for Cockpit/admin-v2 consumers, records VM provenance hashes, and publishes the current security-claims documentation set.

Highlights

  • Docker-agent dev mode fails early unless non-loopback plaintext management

exposure is explicitly acknowledged with `AGENTIC_ALLOW_PLAINTEXT_TCP=1`.

  • Admin v2 Docker inventory exposes `agent_registered`, `agent_ready`,

`container_finished_at`, `bootstrap_pending`, and `not_ready` so clients do not infer session readiness from runtime inventory alone.

  • QEMU admin-v2 provisioning resolves `provision-vm.sh` from the stable checkout

root or `AIWG_PROVISION_VM_SCRIPT`, and spawn errors include every attempted path.

  • VM provisioning records base image, cloud-init seed ISO, and loadout manifest

provenance hashes in VM metadata.

  • Dashboard static assets now carry a CSP without inline script allowance, and

representative DOM sinks have sentinel regression coverage.

  • Security claim docs now include release verification, security status,

standards alignment, ASVS/Top 10 profile, and attack-informed test catalog.

Upgrade Matrix

AudienceImpact
Docker dev operatorsUse `LISTEN_ADDR=0.0.0.0:8120 AGENTIC_ALLOW_PLAINTEXT_TCP=1 ./dev.sh start` only when local containers must reach HTTP bootstrap through `host.docker.internal:8122`. Keep loopback or a trusted tunnel for other deployments.
Cockpit and admin-v2 consumersWait for `agent_ready: true` before creating sessions. `bootstrap_pending` and `not_ready` are explicit not-ready states, even when runtime metadata exists.
VM provisioning operators`AIWG_PROVISION_VM_SCRIPT` can override the QEMU provision script path; default dev launches resolve the checked-out `images/qemu/provision-vm.sh` independent of process cwd.
Security reviewersTreat dashboard CSP/DOM-sink hardening as current evidence for the local dashboard boundary, not as a claim of complete remote multi-user admin hardening.

Verification

Release-flow local gates for this prep pass:

bash -n management/dev.sh
cargo test provision_vm_script --lib
cargo test provision_vm_spawn_error --lib
cargo test docker --lib
cargo test ready_heartbeat_marks_preregistered_context_ready_without_replacing_it --lib
cargo fmt --check
git diff --check

Doc-sync evidence:

  • `.aiwg/reports/doc-sync-audit-2026-06-22-release.md`
  • `.aiwg/reports/open-issue-audit-2026-06-22.md`

Operator Notes

  • Do not expose plaintext management TCP beyond local Docker development unless

it is behind an authenticated side channel. Secure long-lived agent control remains mTLS, UDS, or vsock.

  • Docker inventory now distinguishes "container exists" from "agent is ready."

Session creation should use readiness fields, not only AgentCard URLs.

  • VM provenance metadata improves auditability but does not by itself claim a

SLSA level, in-toto provenance, or fully reproducible image supply chain.