Agentic Sandbox v2026.7.17

Released: 2026-07-30 Tag: `v2026.7.17` Previous published: `v2026.7.16`

What changed

This corrective patch makes the production container identity (`uid 10001`) able to execute the provider toolchain. Node, npm, AIWG, Codex, Claude, OpenCode, Rust, and Aider now live beneath `/opt/agent-tools`, removing the root-home traversal that made the immutable `v2026.7.16` provider images fail with `node: Permission denied`.

Admin v2 Docker provisioning also accepts an explicit operator-selected network. Omitting the field retains the managed internal-network default. Selecting `bridge`, `host`, or another existing egress-capable network is an explicit Tier 0 compatibility decision for workloads that require upstream provider access.

Upgrade

Upgrade provider images and the management service from `v2026.7.16` to `v2026.7.17`. No data migration is required. Recreate affected provider containers so they receive the corrected filesystem layout.

Verify release artifacts against the published checksum manifests and follow the standard release verification guide.

Known security limits

• Operator-supplied Docker networks remain Tier 0.
• Transport acceptance criterion AC-1 remains blocked because containers use

management-issued mTLS material rather than a Unix-domain-socket-only path.

• Same-host-UID credential access remains tracked by #617 and is not resolved

by this patch.

• The Apple developer package is explicitly unsigned and evaluation-only. No

Developer ID, notarization, stapling, or Gatekeeper-trust claim is made.

Rollback

The previous release is `v2026.7.16`. Rolling back reintroduces the non-root provider toolchain failure; use rollback only to recover unrelated regressions.

Full notes: `CHANGELOG.md` `[2026.7.17]`.