Agentic Sandbox v2026.7.0

Released: 2026-07-02 Tag: `v2026.7.0` Previous: `v2026.6.36` Compare: `v2026.6.36...v2026.7.0`

---

What this release is

v2026.7.0 is a runtime hardening and release-readiness cut for the July branch. It keeps the v2026.6.36 package and image release surface, then adds stronger credential-proxy controls, QEMU provisioning restart handling, live-validation evidence, and management startup resilience for low-soft-limit dev launches.

Highlights

• Credential proxy hardening: per-lease/session HTTP proxy rate limits now

return `429` with `Retry-After`, expired or revoked leases are denied before accounting, and proxied upstream responses are redacted before returning to a workload.

• Credential leakage harness: the new security harness exercises metadata,

lease, denied, rate-limited, and proxied-response paths to ensure managed credential APIs do not expose active secret material.

• QEMU first-boot restart handling: provisioning now watches for the

first-boot customization shutdown window and restarts the guest before the runtime wait phase when needed.

• Management launch resilience: management raises its soft

`RLIMIT_NOFILE` to the inherited hard limit at startup, preventing transient dev launches from failing libvirt inventory under a low soft descriptor cap.

• Docs and release surfaces: the project blog is now part of the docs site,

release verification docs are refreshed, and the July open-issue audit records the remaining evidence gaps for #503, #507, #518, and #597.

Upgrade matrix

Audience	Action
Credential proxy operators	Upgrade to pick up rate-limit, redaction, and leakage-harness coverage. Keep network egress controls in place for workloads that can bypass the proxy.
QEMU/libvirt users	Upgrade before reprovisioning guests that may power off during first-boot customization.
Dev or transient management launches	Upgrade to inherit the startup file-descriptor soft-limit correction outside the packaged unit path.
Docs and release consumers	Use this cut as the first July release and the current release-readiness baseline.

Install / upgrade

curl -fsSL https://github.com/jmagly/agentic-sandbox/releases/download/v2026.7.0/agentic-sandbox-install.sh \
  | bash -s -- --version v2026.7.0

Direct package installs:

sudo apt-get install ./agentic-sandbox_2026.7.0-1_amd64.deb
sudo dnf install ./agentic-sandbox-2026.7.0-1.x86_64.rpm

Verification

Local release gates before tagging:

bash -n scripts/bump-version.sh
bash -n scripts/run-e2e-tests.sh
bash -n scripts/verify-release-assets.sh
scripts/lint-ci-pins.sh
scripts/lint-npm-pins.sh
cargo fmt --manifest-path management/Cargo.toml --check
cargo fmt --manifest-path agent-rs/Cargo.toml --check
cargo fmt --manifest-path cli/Cargo.toml --check
cargo test --manifest-path management/Cargo.toml --lib
cargo test --manifest-path agent-rs/Cargo.toml --lib
cargo test --manifest-path cli/Cargo.toml --bins
python3 scripts/check-doc-links.py --docs-root docs

After publication, verify the release assets:

scripts/verify-release-assets.sh v2026.7.0 --skip-ghcr

Public container verification should confirm all GHCR images exist without an active `ghcr.io` Docker login:

for image in \
  agentic-sandbox-mgmt \
  agentic-sandbox-agent-client \
  agentic-sandbox-agent \
  agentic-sandbox-claude \
  agentic-sandbox-codex \
  agentic-sandbox-opencode \
  agentic-sandbox-automation-control; do
  docker pull ghcr.io/jmagly/${image}:v2026.7.0
done

Quality

• The July code-to-docs sync is recorded in

`.aiwg/reports/doc-sync-audit-2026-07-02-release.md`.

• The open-issue audit records the live QEMU/libvirt validation that was run

after the credential-proxy and provisioning hardening landed.

• Remaining market-readiness evidence gaps are intentionally still tracked in

#503, #507, #518, and #597 rather than overstated in release claims.