Agentic Sandbox v2026.7.7

Agentic Sandbox v2026.7.7

Released: 2026-07-12 Tag: `v2026.7.7` Previous: `v2026.7.6` Compare: `v2026.7.6...v2026.7.7`

What this release is

v2026.7.7 is a VM-runtime reliability release with a supply-chain change to how releases are signed.

Two UAT-found VM control-channel defects are fixed: idle connections that silently dropped after ~30 minutes, and pre-existing sessions that were killed whenever the transport reconnected. Same-host VMs now use vsock for the control channel by default, deleting the libvirt NAT hop that those failures crossed.

Separately, release signing moves into OpenBao: the GPG release key is fetched from the vault at CI time via a least-privilege AppRole instead of living as a stored CI secret. The signing identity is unchanged for anyone verifying releases.

Highlights

  • VM control channel no longer drops when idle (#633): the agent gRPC

client now sets HTTP/2 keepalive (10s interval / 20s timeout, ping-while-idle) and OS-level TCP keepalive on every transport. A flow torn down by a stateful middlebox now surfaces as a fast transport error and trips the existing reconnect/backoff, instead of leaving a zombie connection until the next write.

  • Reconnect is state-preserving; sessions survive it (#634): the agent no

longer SIGTERMs tracked workloads on stream loss. `running_commands` and their child processes persist across a reconnect, the output channel survives (output produced while disconnected buffers and flushes), and server-side reconcile is the sole kill authority. Previously only detached-tmux sessions traversed a reconnect; now non-tmux sessions do too.

  • vsock control transport by default for same-host VMs (#633): when the

host exposes `/dev/vhost-vsock`, the management server serves the vsock gRPC listener and provisioning selects it, so guest↔host control traffic bypasses the libvirt NAT/ufw boundary entirely. Opt out with `AGENTIC_GRPC_VSOCK_PORT=0`; hosts without vsock keep the mTLS-TCP path. Loadout-provisioned VMs also get a static IP now (no in-guest DHCP), removing the ~30-minute lease-renewal event from otherwise-idle guests.

  • Release signing sourced from OpenBao: the `sign-and-sbom` job logs into

OpenBao with a least-privilege AppRole (its role-id/secret-id are the only stored CI secret), reads the release GPG key ephemerally, asserts the pinned fingerprint, signs the tarballs, and scrubs the keyring — nothing sensitive persists on the runner. Replaces the `GPG_PRIVATE_KEY`/`GPG_PASSPHRASE` CI secrets. cosign image signing is unchanged.

Upgrade by audience

AudienceAction
VM-runtime operatorsRedeploy VM agent binaries (`./scripts/deploy-agent.sh <vm>`), and restart the management server to pick up the default-on vsock listener. New provisions get vsock + static IP; existing VMs keep their current config until reprovisioned.
Release verifiersNo change. Signatures are produced by the same key (fingerprint `FE9272F0BC5781E1DE77FAAA719AB63879E84CE8`); verify as before.
Container/host-runtime usersNo action — these fixes are VM-runtime-specific.

Verification

# Container image runs
docker pull ghcr.io/jmagly/agentic-sandbox-mgmt:v2026.7.7
docker run --rm --entrypoint /bin/sh ghcr.io/jmagly/agentic-sandbox-mgmt:v2026.7.7 \
  -lc 'command -v agentic-mgmt >/dev/null && test -x "$(command -v agentic-mgmt)"'

# Tarball signature (expected key fingerprint FE9272F0BC5781E1DE77FAAA719AB63879E84CE8)
gpg --verify agentic-sandbox-2026.7.7-x86_64-linux-gnu.tar.gz.asc \
             agentic-sandbox-2026.7.7-x86_64-linux-gnu.tar.gz

Full notes: `CHANGELOG.md` `[2026.7.7]`.