Agentic Sandbox v2026.6.34

Agentic Sandbox v2026.6.34

Released: 2026-06-28 Tag: `v2026.6.34` Previous: `v2026.6.33` Compare: `v2026.6.33...v2026.6.34`

What this release is

v2026.6.34 is a hardening cut on the QEMU/vsock transport line established in v2026.6.31–.33. It keeps the v2026.6.33 runtime surface and closes a set of vsock and VM-lifecycle edge cases that surfaced after the previous tag, plus a base-image build robustness fix for hosts with a restricted `/boot`.

The operator-facing result is more reliable VM provisioning and teardown over vsock — correct CID-registry locking, dependable destroy cleanup, dev startup that honors file-backed CID maps — and an agent-baked base image that builds on hosts where supermin cannot read a root-only kernel.

Highlights

  • Reliable vsock CID lifecycle (#588, #589): the per-VM CID registry lock is

created with correct ownership, and `management/dev.sh` honors a file-backed vsock CID map (`AGENTIC_GRPC_VSOCK_CID_MAP_FILE`) at startup so the dev executor and the runtime transport resolver agree on CID assignments.

  • Dependable VM teardown (#590): the destroy cleanup trap stays in scope, so

teardown reliably releases the DHCP reservation, vsock CID, and ephemeral key allocations instead of leaking them on early exit.

  • vsock-only guest enrollment: provisioned guests enroll over vsock without

needing a loopback-reachable network path back to management — the path that blocked enrollment before the v2026.6.31 vsock transport landed.

  • TLS server-name override (host-runtime): the host runtime accepts an

explicit TLS server-name override for its mTLS connections.

  • Base-image bake survives a root-only `/boot` (#592):

`images/qemu/build-base-image.sh` now escalates the bake through `LIBGUESTFS_BACKEND=direct` and then `sudo -E` when supermin cannot build its appliance from a `0600` `/boot/vmlinuz`. The default backend still runs first, so CI runners and readable-`/boot` hosts are unaffected.

Operator notes

  • vsock remains the default VM transport for QEMU guests. If a dev executor is

started without `AGENTIC_GRPC_VSOCK_PORT` and `AGENTIC_GRPC_VSOCK_CID_MAP_FILE`, VM guests cannot enroll; persist both in `management/.run/dev.env`.

  • On a dev host where `/boot/vmlinuz-*` is root-only, the base-image builder now

escalates to `sudo` automatically. To avoid the escalation entirely, run the builder as root or `sudo chmod 0644 /boot/vmlinuz-$(uname -r)`.

  • Existing v2026.6.33 runtime and base-image guidance still applies.

Quality

  • Local release-flow checks passed: `bash -n` on the release scripts,

`lint-ci-pins`, `lint-npm-pins`, `cargo fmt --check` across all three crates, and `cargo test` for `management` (730), `agent-rs` (3), and `cli` (54) — all green.

  • The unreleased commits landed green on `main`: Gitea Actions runs across

`ci.yaml`, `conformance`, `schema-lint`, and `supply-chain-lint`, including Docker publish, security scan, and the release-blocking E2E suite.