Agentic Sandbox v2026.7.8

Agentic Sandbox v2026.7.8

Released: 2026-07-12 Tag: `v2026.7.8` Previous: `v2026.7.7` Compare: `v2026.7.7...v2026.7.8`

What this release is

v2026.7.8 is a release-publication fix that supersedes v2026.7.7. The runtime is identical to v2026.7.7 — same #633/#634 VM control-channel reliability fixes, same binaries. The only reason for the bump is to re-run the release pipeline with a CI fix so the published release is complete.

v2026.7.7's pipeline published binaries but was missing GPG signatures, the SBOM, and public GHCR container images. After the OpenBao secret migration (#635), the `multi-registry-push` job — which only re-tags and pushes prebuilt images and so never checked out the repository — failed to find `ci/openbao-fetch.sh`, and the signing job is gated behind it. v2026.7.8 adds the missing checkout and completes the OpenBao-backed release, mirror, and signing lanes.

Highlights

  • Complete, signed release artifacts: signed tarballs (`.asc`), SBOM, and

public GHCR container images are all published — the pieces v2026.7.7 was missing.

  • CI secrets fully sourced from OpenBao (#635): internal-registry

credentials, GHCR token, GitHub mirror token, docsite deploy key, mutsu SSH key, and the GPG release-signing key are all fetched from the vault at job time via a least-privilege AppRole. Fetched values are masked; private keys land only in mode-600 temp files. The signing identity is unchanged (fingerprint `FE9272F0BC5781E1DE77FAAA719AB63879E84CE8`).

  • CI runtime fixes (#633/#634), unchanged from v2026.7.7 — see that release's

notes for the VM control-channel keepalive, state-preserving reconnect, and default vsock transport.

Upgrade by audience

AudienceAction
Anyone on / considering v2026.7.7Use v2026.7.8 instead — identical runtime, but with signatures and public container images.
VM-runtime operatorsSame as v2026.7.7: redeploy VM agent binaries and restart the management server for the default-on vsock listener.
Release verifiersSignatures use the same key (`FE9272F0BC5781E1DE77FAAA719AB63879E84CE8`); verify as usual.

Verification

# Container image runs (public GHCR)
docker pull ghcr.io/jmagly/agentic-sandbox-mgmt:v2026.7.8
docker run --rm --entrypoint /bin/sh ghcr.io/jmagly/agentic-sandbox-mgmt:v2026.7.8 \
  -lc 'command -v agentic-mgmt >/dev/null && test -x "$(command -v agentic-mgmt)"'

# Tarball signature (expected key fingerprint FE9272F0BC5781E1DE77FAAA719AB63879E84CE8)
gpg --verify agentic-sandbox-v2026.7.8-x86_64-linux-gnu.tar.gz.asc \
             agentic-sandbox-v2026.7.8-x86_64-linux-gnu.tar.gz

Full notes: `CHANGELOG.md` `[2026.7.8]`.