Agentic Sandbox v2026.7.20

Agentic Sandbox v2026.7.20

Released: 2026-08-01 Tag: `v2026.7.20` Previous published: `v2026.7.19`

What changed

VM provisioning launched through an installed `agentic-mgmt` now deploys the exact `agent-client` installed beside it. The management service resolves that sibling binary and passes it to the QEMU provisioning scripts through `AGENT_CLIENT_SOURCE_BIN`. Development checkouts retain their existing Cargo target fallback, and operators can still provide an explicit absolute source path.

Started VM operations also include `--wait-ready`. A successful operation now means that provisioning installed the selected agent binary, verified the guest-side hash, activated the service, and observed agent readiness. It no longer means only that a VM booted with whatever agent happened to be baked into its base image.

This closes the package-path regression reproduced during protected Cockpit acceptance of `v2026.7.19`, where an extracted release package had no `agent-rs/target/release/agent-client` tree and the VM retained a stale baked agent.

Upgrade

Upgrade `agentic-mgmt` and `agent-client` together. Standard Linux packages and the release installer place both binaries in the same directory, which is the layout used for the exact handoff.

VMs provisioned from an extracted `v2026.7.19` package may contain the older agent from their base image. Reprovision those VMs with `v2026.7.20`, or deploy the matching `v2026.7.20` agent before treating executor-restart continuity as verified.

An operator-provided source remains available for controlled development or recovery:

AGENT_CLIENT_SOURCE_BIN=/absolute/path/to/agent-client \
  images/qemu/provision-vm.sh example-vm --start --wait-ready

The explicit path must name a regular agent binary; provisioning fails if it cannot be installed or does not become ready.

Verify release artifacts against the published checksum manifests and follow the standard release verification guide.

Known security limits

  • Operator-supplied Docker networks remain Tier 0.
  • Transport acceptance criterion AC-1 remains blocked because containers use

management-issued mTLS material rather than a Unix-domain-socket-only path.

  • Workload and agent processes still share `uid 10001`; credential separation

remains tracked by #617.

  • The Apple developer package is explicitly unsigned and evaluation-only. No

Developer ID, notarization, stapling, or Gatekeeper-trust claim is made.

Rollback

The previous release is `v2026.7.19`. Rolling back management or provisioning to that release restores the package-path risk described above: a newly provisioned VM can retain the stale agent baked into its base image when the Cargo target tree is absent. Prefer rolling back an already-provisioned VM as a complete management-and-agent pair rather than provisioning a fresh VM from the older package.

Full notes: CHANGELOG entry 2026.7.20.