Agentic Sandbox v2026.7.12

Agentic Sandbox v2026.7.12

Released: 2026-07-13 Tag: `v2026.7.12` Previous: `v2026.7.11` Compare: `v2026.7.11...v2026.7.12`

What this release is

An agent-reliability fix (#637) plus a build-performance retune. This is the first release compiled on the faster thin-LTO / parallel-codegen profile, and it runs the full pipeline on the pure-vault + variables setup proven in v2026.7.11.

Highlights

  • Agent output survives reconnect recovery (#637). A preserved session no

longer silently loses all future output after the rare 5s-timeout recovery path — the agent now waits for the output forwarder to hand its receiver back instead of swapping the channel out from under running sessions. The fallback that recreates the channel is now a loud, last-resort deadlock guard.

  • First regression tests for the reconnect / keepalive / session-dedup

behaviour (the #633/#634 range), running in CI.

  • Faster CI builds — thin-LTO + parallel codegen instead of fat-LTO /

single-unit codegen; negligible runtime impact for a service and agent.

  • One less secret in the tracker — `CF_ZONE_ID` moved to a repository

variable; only the two `VAULT_*` bootstrap secrets remain.

Upgrading

The #637 fix ships in the agent binary, which runs inside each VM. It reaches a VM only when that VM's binary is redeployed (`./scripts/deploy-agent.sh <vm>`) or the VM is reprovisioned — a VM from a pre-v2026.7.7 image keeps the old kill-on-reconnect agent until then. See `docs/DEPLOYMENT.md`.

Verification

# import the release public key (unchanged since v2026.7.10)
curl -fLO "https://raw.githubusercontent.com/jmagly/agentic-sandbox/main/docs/releases/keys/agentic-sandbox-release-key.asc"
gpg --import agentic-sandbox-release-key.asc   # expect 9292EFCB…E09C33

docker pull ghcr.io/jmagly/agentic-sandbox-mgmt:v2026.7.12
gpg --verify agentic-sandbox-v2026.7.12-x86_64-linux-gnu.tar.gz.asc \
             agentic-sandbox-v2026.7.12-x86_64-linux-gnu.tar.gz

Full notes: `CHANGELOG.md` `[2026.7.12]`.