Agentic Sandbox v2026.8.3
Agentic Sandbox v2026.8.3
Released: 2026-08-03 Tag: `v2026.8.3` Previous published: `v2026.7.20` Compare: `v2026.7.20...v2026.8.3`
Highlights
- Durable, versioned fleet-workload admission, inventory, observation, and
restart reconciliation.
- Loss-aware activity ingestion and correlated timelines across Linux,
network, and macOS collection surfaces.
- Governance, export integrity, reliability campaigns, and rolling operational
evidence for activity data.
- Credential-free UDS control by default for managed Linux containers, with
distinct control and workload identities.
- Broader qualified CI runner scheduling with bounded, atomic maintenance.
What changed
This release adds a durable, substrate-neutral fleet workload boundary. The new `/api/v2/fleet` routes admit typed workloads, preserve idempotency and runtime identity, expose revisioned inventory, and reconcile children after a management restart. The v1 contract distinguishes persistent agents, daemons, scheduled collectors, and one-shot commands without importing an orchestrator-specific task model.
Agent activity observability now spans loss-aware ingestion, Linux process and file metadata, network metadata, native macOS collector scaffolding, integrity and retention governance, correlated timeline queries, and deterministic reliability campaigns. Rolling evidence and bounded validation scheduling make the qualification state explicit without presenting short runs as long-term production evidence.
Managed Docker containers now use a credential-free Unix-domain socket control path by default on Linux. A distinct control identity is bound with `SO_PEERCRED`; dispatched workloads enter `10001:10001` and clear their capability sets. Docker Desktop retains an identity-bound bootstrap path where its filesystem bridge cannot preserve Linux peer credentials.
Upgrade
Upgrade `agentic-mgmt`, `agent-client`, and `agentic-cli` together. Recreate management-owned containers to receive the UDS and split control/workload identity boundary; existing containers are not rewritten in place.
Fleet clients can feature-detect `/api/v2/fleet`. Existing singleton executor clients remain supported and do not need to claim daemon, schedule, typed backpressure, or reconciliation capabilities.
| Audience | Required action |
|---|---|
| Linux package users | Install the matching `2026.8.3` package and restart management and agent services. |
| Container operators | Pull `v2026.8.3` images and recreate managed containers to receive the UDS identity boundary. |
| Fleet API clients | Feature-detect `/api/v2/fleet`; keep existing singleton executor fallback where needed. |
| macOS evaluators | Use only the explicitly unsigned developer package and retain the documented trust limitations. |
Linux package users can use the published installer:
curl -fsSLO https://github.com/jmagly/agentic-sandbox/releases/download/v2026.8.3/agentic-sandbox-install.sh
bash agentic-sandbox-install.sh --version v2026.8.3Verify downloaded artifacts and public images using the release verification guide.
sha256sum -c SHA256SUMS-linux-packages
docker buildx imagetools inspect ghcr.io/jmagly/agentic-sandbox-agent:v2026.8.3Known limits
- `AGENTIC_GRPC_UDS=off`, operator-supplied Docker transports or networks, and
secret-bearing environment remain explicit Tier 0 compatibility choices.
- Native macOS Endpoint Security activation still requires Apple entitlement
approval, full Xcode linkage, signing, notarization, and host consent.
- Deterministic activity campaigns do not satisfy the outstanding seven-day
production runtime and storage-budget qualification gate.
- The Apple developer package is explicitly unsigned and evaluation-only. No
Developer ID, notarization, stapling, or Gatekeeper-trust claim is made.
Rollback
Rollback should keep management, agent, and CLI binaries on one version. Rolling back to `v2026.7.20` removes the fleet workload API and the new activity surfaces. Containers recreated on the UDS default should be reprovisioned under the selected older management version instead of retaining a mixed control path.
Full notes: CHANGELOG entry 2026.8.3.