Agentic Sandbox v2026.7.4

Released: 2026-07-08 Tag: `v2026.7.4` Previous: `v2026.7.2` Compare: `v2026.7.2...v2026.7.4`

What this release is

v2026.7.4 supersedes the prepared but unpublished v2026.7.3 cut and adds a reliability and projection payload for VM provisioning, long-lived agent sessions, provider loadouts, AIWG reporting, and Cockpit Chat output consumption. It carries the v2026.7.3 admin-v2 VM lifecycle fixes, bounds `virsh` calls so a wedged libvirtd cannot leave provisioning forever in flight, preserves tmux-backed sessions across `agent-client` restarts, verifies provider CLI installation parity, backfills monthly reports to project inception, and exposes a byte-preserving structured agent-output SSE stream.

Highlights

Provisioning fails fast on wedged libvirt: `virsh` calls made by the QEMU

provisioning path now run through a timeout wrapper controlled by `AGENTIC_VIRSH_TIMEOUT_SECONDS`.

v2026.7.3 lifecycle fixes included: stopped admin-v2 VMs stay visible,

VM destroy releases libvirt/storage/IP/CID allocations, host session lists import agent-reported PTY sessions, host runtime defaults to mTLS when configured, and container bootstrap can bind for Docker host-gateway paths.

Tmux sessions survive agent restarts: agent cleanup no longer kills tmux

servers, systemd units use `KillMode=process`, and existing tmux sessions can be re-adopted into session reporting and reconciliation.

Provider loadout drift is covered: the `verify-providers` loadout

regression proves all non-artifact provider CLIs are installed, not only the first provider subset.

Structured output for Cockpit Chat:

`GET /api/v1/agent-output/stream` emits `agentic.agent_output.v1` SSE events with raw bytes in `data_base64` and readable text projection.

AIWG report history is backfilled: monthly reports now cover 2026-01

through 2026-05 with evidence and carryover notes.

Install / upgrade

curl -fsSL https://github.com/jmagly/agentic-sandbox/releases/download/v2026.7.4/agentic-sandbox-install.sh \
  | bash -s -- --version v2026.7.4

Direct package installs:

sudo apt-get install ./agentic-sandbox_2026.7.4-1_amd64.deb
sudo dnf install ./agentic-sandbox-2026.7.4-1.x86_64.rpm

Upgrade matrix

Audience	Action
VM operators	Upgrade before running long provisioning batches on hosts where libvirtd stalls have been observed. Tune `AGENTIC_VIRSH_TIMEOUT_SECONDS` only when the default 15-second command timeout is too low for the host.
Session/Cockpit users	Upgrade agent clients and service units together so tmux sessions are preserved and re-adopted after restart.
Loadout maintainers	Use the `verify-providers` profile test as the regression guard for provider CLI install changes.
Projection clients	Prefer `/api/v1/agent-output/stream` when consuming command output for chat or dashboard projections that need structured metadata and byte preservation.
AIWG stewards	Use `.aiwg/reports/monthly-index.md` for the backfilled January-May 2026 report history.

Verification

The release fixes were validated locally with:

images/qemu/tests/test-provision-virsh-timeouts.sh
images/qemu/tests/test-runtime-boot-restart.sh
images/qemu/tests/test-vsock-cidr-lifecycle.sh
images/qemu/loadouts/tests/test_generate_from_manifest.sh
cargo test --manifest-path agent-rs/Cargo.toml --bins -- --nocapture
cargo test --manifest-path agent-rs/Cargo.toml test_cleanup -- --nocapture
cargo test --manifest-path management/Cargo.toml agent_output -- --nocapture
cargo fmt --check --manifest-path agent-rs/Cargo.toml
cargo fmt --check --manifest-path management/Cargo.toml
bash -n images/qemu/provision-vm.sh images/qemu/backends/libvirt.sh images/qemu/lib/network.sh images/qemu/tests/test-provision-virsh-timeouts.sh images/qemu/loadouts/tests/test_generate_from_manifest.sh scripts/provision-vm-agent.sh deploy/cloud-init/user-data.template

After publication, verify the release assets:

scripts/verify-release-assets.sh v2026.7.4 --skip-ghcr

Runtime checks:

curl -N 'http://127.0.0.1:8122/api/v1/agent-output/stream?agent_id=<agent>&stream=stdout'
systemctl restart agent-client.service
tmux list-sessions

Confirm existing tmux sessions remain present after the agent service restart and appear in agent session reports. On a libvirt host, simulate a slow or wedged `virsh` path and confirm provisioning exits with a timeout instead of remaining indefinitely in the running state.

Notes

`AGENTIC_VIRSH_TIMEOUT_SECONDS` defaults to 15 seconds and must be a positive

integer.

Set `AGENTIC_ADOPT_TMUX_SESSIONS=0` to disable tmux adoption when a deployment

needs to hide sessions not launched by the current agent process.

The structured output stream is additive; legacy WebSocket output remains

available for existing clients.