Agentic Sandbox v2026.6.31

Agentic Sandbox v2026.6.31

Released: 2026-06-24 Tag: `v2026.6.31` Previous: `v2026.6.30` Compare: `v2026.6.30...v2026.6.31`

What this release is

v2026.6.31 lands the same-host VM vsock transport for the QEMU tier. Per ADR-023/ADR-026, a host-created VM is a local build with host-mediated identity: the agent dials the management control plane over `AF_VSOCK` using a hypervisor-assigned CID — no bootstrap token, no HTTP enrollment endpoint. This resolves #561, where qemu VMs provisioned to `running` but their in-guest agent never enrolled (stuck `bootstrap-pending`, transport `Unknown`) because the fleet enrollment path was loopback-unreachable from the guest. The loopback posture (#256/#257) stays fully intact — nothing is exposed to any network.

Highlights

  • Per-VM vsock provisioning (#571, #569, #570): provisioning allocates a

stable per-VM CID, injects a `<vsock>` device into the libvirt domain XML, records `vsock_cid` in `vm-info.json`, and emits `AGENT_GRPC_VSOCK_CID/PORT`

  • `AGENT_TRANSPORT=auto` into `agent.env`; cloud-init recognizes the vsock

tuple as a valid secure transport.

  • Host-side CID identity lifecycle (#574, #577, #583): the management

transport-identity resolver registers `CID → instance_id` on provision and unregisters on destroy, validates the startup `AGENTIC_GRPC_VSOCK_CID_MAP` (rejecting zero/duplicate CIDs and duplicate instance ids), and reloads a canonical `AGENTIC_GRPC_VSOCK_CID_MAP_FILE` on `SIGHUP` with an atomic swap.

  • Lifecycle resolution fix (#563): v2 admin lifecycle ops

(start/stop/destroy/restart/get) now resolve the libvirt domain by mapping the instance_id to candidate domain names instead of looking it up by the raw instance_id, which never matched qemu domains; idempotent destroy is re-gated on a correct lookup.

  • Deterministic teardown (#575, #579, #581): destroy/reap remove the

`.vsock-cid-registry` row and reconcile it against `vm-info.json`; CID allocation is `flock`-serialized so parallel provisioning cannot duplicate or lose a CID.

  • Base image hardening (#578, #573): the base image bakes the

`vmw_vsock_virtio_transport` module + `socat`/`iproute2`, and the `agent-client` install path is standardized on the canonical `/opt/agentic-sandbox/bin/agent-client` across image, live-deploy, and readiness checks.

  • Gateway-mediated SSH docs (ADR-029, #530/#531/#532): documentation is

synced with the landed SSH certificate lease API (`/api/v2/gateway/ssh/leases`) and connector, including a new deployment section and the `AGENTIC_GATEWAY_SSH_*` env reference.

Operator notes

  • To enable the host vsock listener, set `AGENTIC_GRPC_VSOCK_PORT` together with

`AGENTIC_GRPC_VSOCK_CID_MAP` (management refuses to start the listener without a map). Provision/destroy through the v2 admin API update the map in-process; `SIGHUP` reloads `AGENTIC_GRPC_VSOCK_CID_MAP_FILE` for out-of-band edits.

  • The QEMU base image must be rebuilt (`images/qemu/build-base-image.sh`) to

pick up the baked vsock module + current `agent-client`.

  • No action required for the container tier, which continues to enroll over

gRPC mTLS.

Quality

  • `cargo test --lib` green across management (729), agent-rs, and cli; the

real-libvirt unit tests are now serialized to remove parallel flakiness.

  • Script suites green: cloud-init secure transport, vsock CID lifecycle, and

agent-client path parity (wired into `make test-scripts`).