Agentic Sandbox v2026.7.19

Agentic Sandbox v2026.7.19

Released: 2026-07-31 Tag: `v2026.7.19` Previous published: `v2026.7.18`

What changed

Public provider-image publication now preserves the complete OCI index instead of pulling one runner-native platform and pushing only that manifest. The release job copies each registry object with Buildx imagetools, compares every source and destination child-manifest digest, and fails unless all five provider images expose both `linux/amd64` and `linux/arm64`.

Management and agent-client images remain intentionally `linux/amd64` only. Their registry objects, including any attached provenance descriptors, are preserved without inventing an unsupported arm64 runtime manifest. The release job records structured JSONL evidence for every public destination.

GitHub release synchronization also restores the authoritative signed annotated Gitea tag object after checkout. An identical immutable GitHub tag is now an idempotent success; a different tag object fails closed instead of being rewritten. This prevents a checkout-created lightweight tag ref from interrupting release asset publication when the correct signed tag is already present.

Provider images also restore ownership of `/home/agent` to runtime UID/GID `10001:10001` after build-time provider probes. Managed enrollment can therefore create `/home/agent/.local/state/agentic-sandbox/grpc-mtls` without running the provider container as root.

The VM release gate now reconciles an indeterminate systemd restart response instead of assuming that a reset control connection proves failure. Acceptance still requires the guest agent to become active under a different, non-empty systemd invocation identity, so a restart that did not occur remains a hard failure.

The config-driven publication gate also runs the complete GHCR pull and smoke matrix. Public provider indexes and runtime behavior are therefore verified as part of release completion rather than left to an optional follow-up.

Upgrade

Upgrade public provider-image references from `v2026.7.18` to `v2026.7.19`. The affected public packages are:

  • `agentic-sandbox-agent`
  • `agentic-sandbox-claude`
  • `agentic-sandbox-codex`
  • `agentic-sandbox-opencode`
  • `agentic-sandbox-automation-control`

No data migration is required. Consumers of the `v2026.7.18` provider images should upgrade even when they do not require a second architecture, because that release can leave provider runtime state root-owned. Native binaries, management, and agent-client may upgrade normally.

Verify each provider index exposes both target platforms:

for image in agent claude codex opencode automation-control; do
  docker buildx imagetools inspect \
    "ghcr.io/jmagly/agentic-sandbox-${image}:v2026.7.19"
done

Verify the runtime UID can create its enrollment state directory:

docker run --rm --user 10001:10001 --entrypoint sh \
  ghcr.io/jmagly/agentic-sandbox-codex:v2026.7.19 \
  -c 'mkdir -p "$HOME/.local/state/agentic-sandbox/grpc-mtls" &&
      test -w "$HOME/.local/state/agentic-sandbox/grpc-mtls"'

Verify release artifacts against the published checksum manifests and follow the standard release verification guide.

Known security limits

  • Operator-supplied Docker networks remain Tier 0.
  • Transport acceptance criterion AC-1 remains blocked because containers use

management-issued mTLS material rather than a Unix-domain-socket-only path.

  • Workload and agent processes still share `uid 10001`; credential separation

remains tracked by #617.

  • The Apple developer package is explicitly unsigned and evaluation-only. No

Developer ID, notarization, stapling, or Gatekeeper-trust claim is made.

Rollback

The previous release is `v2026.7.18`. Its public provider-image tags are single-platform, so consumers that require Apple Silicon container images should not roll those five public image references back. Native binaries, packages, internal images, management, and agent-client can otherwise roll back normally.

Full notes: `CHANGELOG.md` `[2026.7.19]`.