Agentic Sandbox v2026.8.5

Released: 2026-08-23<br> Tag: `v2026.8.5` Previous tag: `v2026.8.4` Compare: `v2026.8.4...v2026.8.5`

What changed

This patch adds the protected implementation needed to run automated Celld UAT 003-015 on Titan: exact-owned three-node and S3-compatible fixtures, fixed live drivers, trusted evaluators, private callback mTLS, provider and network fault campaigns, Worker conformance, complete cleanup, and pre/post host baselines. Unavailable live prerequisites remain `NOT_RUN`; deterministic support does not promote a live hard gate.

The provider-neutral offline migration controller covers only the Celld object store. It stops and inventories all writers, denies source writes, compares stable listings and independent content/metadata hashes, qualifies the destination, records cutover, proves a destination write, and rehearses the same quiesced process in reverse. Existing local filesystems, volume mounts, VM disks, agentshare, workspaces, bind mounts, and management state are unchanged.

The complete Titan lane now has a schema-backed exact-head readiness gate for all 13 automated scenarios, 44 assertion owners, 30 live formulas, and eight fixed drivers. Credential/provenance, observability, and recovery controllers persist their mutation and cleanup intent and derive evidence from raw adapter observations. They still fail closed as `NOT_RUN` until their separately reviewed live adapters and upstream capabilities are available.

The release also records Celld v0.3.0 as a separate `reviewed_unqualified` candidate with exact OCI and SLSA provenance checks. It does not replace the approved v0.2.1 default. The rollout controller contract now enforces explicit compatibility, exact-run authorization, persisted intent, one-node and reserve budgets, kill/rebuild measurement, and emergency rollback; the live lane still refuses to run without an approved pair and reviewed Titan adapter.

Separately, libvirt checkpoint save and managed-save operations now have TERM/KILL deadlines, remove partial artifacts after timeout, and force bounded cleanup when the disposable self-test domain remains active. The post-E2E checkpoint/restore probe has a hard outer timeout and retains diagnostics on failure.

An apply-gated recovery workflow is available for older or already-wedged runs. It matches only the fixed `chkpt-selftest-base`/`chkpt-selftest` domains, the self-test checkpoint path, and `/var/tmp/chkpt-selftest`. After successful cleanup it can schedule a restart of the deployed Titan Actions runner. The workflow does not touch user VMs or general checkpoint storage.

Highlights

• Protected, exact-owned Titan automation for Celld UAT 003-015, with trusted

evaluators and cleanup precedence.

• Exact-head readiness validation for the complete lane, including all eight

drivers and every scenario/assertion/formula ownership contract.

• Three-node Celld and two-gateway S3-compatible fixtures with immutable pins,

private control surfaces, and resource-baseline evidence.

• Celld-object-store-only offline forward/reverse migration; local storage and

mounted-volume behavior is unchanged.

• A provenance-verified v0.3.0 candidate lane and fail-closed rollout controller

contract, without candidate promotion or simulated live qualification.

• Bounded libvirt checkpoint recovery that cannot reap general VM or storage

state.

• Eight-job Cargo ceilings for repository container builds on the 16-core build

runner.

Upgrade

Upgrade `agentic-mgmt`, `agent-client`, and `agentic-cli` together. Linux package users can use the published installer:

curl -fsSLO https://github.com/jmagly/agentic-sandbox/releases/download/v2026.8.5/agentic-sandbox-install.sh
bash agentic-sandbox-install.sh --version v2026.8.5

Verify downloaded artifacts and public images using the release verification guide.

Audience	Required action
Existing Sandbox deployment	Upgrade management, agent, and CLI together; no persisted-state migration is performed.
Local filesystem or mounted-volume user	No storage change. These remain first-class defaults.
Celld user with integration disabled	No configuration change; Celld remains off by default.
Celld qualification operator	Recreate only disposable exact-run fixtures, then run automated UAT 003-015 on Titan. Keep soak and human UAT separate.
Celld v0.3.0 evaluator	Use only the `reviewed-candidate` fixture lane. Do not add it to the approved inventory from provenance or fresh-fixture evidence alone.

Verification

After installing all three binaries, verify their shared version and the credential-free qualification contracts:

agentic-mgmt --version
agent-client --version
sandboxctl --version
node scripts/celld-rollout-candidate.mjs check \
  --input deploy/celld/qualification/celld-rollout-candidates.json
make test-celld-uat-structure

Expected binary version: `2026.8.5`. The candidate checker reports one `reviewed_unqualified` candidate. The structured suite validates test and evidence behavior; it does not substitute for retained Titan observations.

Qualification boundary

Celld remains experimental, off by default, and production `NO-GO`. Exact-head live object-store, multi-node fleet, provider-fault, network-isolation, rollout, observability, recovery, soak, and human UAT evidence remains open. The credential/provenance live campaign is separately gated by #766 and is not included. Local filesystem storage and mounted volumes remain first-class options.

Rollback

Rollback management, agent, and CLI binaries together to v2026.8.4. The checkpoint and qualification-harness changes do not migrate persisted VM, local-volume, or management state. An offline Celld object-store migration is a separate explicit operator action and is never performed during package upgrade.

Full notes: CHANGELOG entry 2026.8.5.