Agentic Sandbox v2026.6.32

Agentic Sandbox v2026.6.32

Released: 2026-06-25 Tag: `v2026.6.32` Previous: `v2026.6.31` Compare: `v2026.6.31...v2026.6.32`

What this release is

v2026.6.32 completes the QEMU/vsock transport release flow. It keeps the v2026.6.31 runtime surface, then fixes the release-blocking base-image bake and runner acceptance path that prevented the #561 live E2E gate from going green.

The core product result is unchanged: qemu VMs now use same-host gRPC over `AF_VSOCK` for agent enrollment, preserving the loopback-only management posture while avoiding guest-to-host loopback reachability problems. This release is the tag to use because it includes the successful CI/E2E proof and the base-image operational fixes needed to reproduce it.

Highlights

  • Live E2E accepted (#561): full manual CI run `1776` completed

successfully on `18f9336f8a96bee971ee40972e79f79a133cf447`. The E2E job passed with `6 passed; 0 failed` and reaped its test VM cleanly.

  • Vsock listener cold start fixed (#584): `management/dev.sh` now accepts

either inline `AGENTIC_GRPC_VSOCK_CID_MAP` or file-backed `AGENTIC_GRPC_VSOCK_CID_MAP_FILE`, and exports the file path into the spawned management process.

  • Base-image bake made deterministic (#561): the image builder now keeps

the guest from running the post-install `agent-client` build during the bake, waits for the unattended guest path to settle, and verifies the baked `agent-client`, vsock module, and manifest provenance before accepting the image.

  • CI fails fast on stale runner images (#561): the E2E bootstrap step now

detects image/manifest drift immediately, which turned the remaining failure into an operator-visible runner-state problem instead of a late runtime failure.

Operator notes

  • If E2E reports a stale QEMU base-image manifest, verify the runner-local

`/mnt/ops/base-images/ubuntu-server-24.04-agent.qcow2` and `/mnt/ops/base-images/manifest.json` pair. The known-good image used for this release has sha256 `a8d2b97b14eb45215f1f333ec2f4ed7dae751c217b07e3c59aae9fac374008c1` and size `5631442944`.

  • For dev-mode vsock listener startup, either set `AGENTIC_GRPC_VSOCK_CID_MAP`

directly or set `AGENTIC_GRPC_VSOCK_CID_MAP_FILE` to the generated CID map file before starting `management/dev.sh`.

  • Existing v2026.6.31 runtime guidance still applies: rebuild the QEMU base

image when rolling out the vsock transport line, and no container-tier action is required.

Quality

  • Gitea Actions run `1776` completed successfully.
  • E2E job `57383` passed all six runtime tests.
  • Issue #561 was updated with the live E2E proof and closed.