Agentic Sandbox v2026.6.36

Released: 2026-06-29 Tag: `v2026.6.36` Previous: `v2026.6.35` Compare: `v2026.6.35...v2026.6.36`

---

What this release is

v2026.6.36 is the publication recovery release for the Observe/Drive reliability cut. The runtime payload remains the v2026.6.35 live terminal and credential proxy content, while the release automation now retries transient public registry mirror failures before failing the tag workflow.

Use v2026.6.36 for new installs and upgrades. v2026.6.35 published valid Linux packages and release assets, but its public GHCR mirror stopped partway through the image matrix after a registry-side `unknown blob` error.

Highlights

• Observe/Drive reliability payload retained: bridge output, stale

controller cleanup, vsock teardown hardening, and the HTTP credential proxy backend are unchanged from v2026.6.35.

• Public image mirror retry: the tag workflow retries public registry

`docker pull` and `docker push` operations with exponential backoff, covering transient GHCR/Quay blob upload failures.

• Clean publication target: Linux packages, installer assets, internal

images, public GHCR images, and release notes are expected to publish from the same v2026.6.36 tag workflow.

Upgrade matrix

Audience	Action
Live terminal operators	Upgrade directly to v2026.6.36 to receive the Observe/Drive fixes from v2026.6.35 with a clean publication audit.
Linux package users already on v2026.6.35	No emergency rollback is required; move to v2026.6.36 during the next normal update window.
Container users	Use the v2026.6.36 GHCR tags once publication verification completes.
Release consumers	Treat v2026.6.36 as superseding v2026.6.35 for complete package, installer, and public image availability.

Install / upgrade

curl -fsSL https://github.com/jmagly/agentic-sandbox/releases/download/v2026.6.36/agentic-sandbox-install.sh \
  | bash -s -- --version v2026.6.36

Direct package installs:

sudo apt-get install ./agentic-sandbox_2026.6.36-1_amd64.deb
sudo dnf install ./agentic-sandbox-2026.6.36-1.x86_64.rpm

Verification

Release verification should include the package verifier:

scripts/verify-release-assets.sh v2026.6.36 --skip-ghcr

Public container verification should confirm all GHCR images exist without an active `ghcr.io` Docker login:

for image in \
  agentic-sandbox-mgmt \
  agentic-sandbox-agent-client \
  agentic-sandbox-agent \
  agentic-sandbox-claude \
  agentic-sandbox-codex \
  agentic-sandbox-opencode \
  agentic-sandbox-automation-control; do
  docker pull ghcr.io/jmagly/${image}:v2026.6.36
done

Quality

• v2026.6.35 branch and tag CI proved the Observe/Drive runtime payload,

including E2E resource-limit coverage and release package creation.

• v2026.6.36 adds retry hardening to the public mirror step so transient

registry blob upload failures do not leave the public image matrix partial.