Agentic Sandbox v2026.9.0

Agentic Sandbox v2026.9.0

Status: Release-prepared 2026-09-15; not yet tagged. Awaiting the macOS developer-package ceremony, which is still bound to `v2026.8.9`.

Tag: `v2026.9.0`

Previous tag: `v2026.8.9`

Compare: `v2026.8.9...v2026.9.0`

This release supersedes v2026.8.9, the previous published release on both Gitea and GitHub. The v2026.8.10 changes in the changelog were prepared but never published as a tag; they ship here. Asset URLs below become valid only after publication.

Highlights

  • Run tasks through a provider-neutral executor registry and use the new

pinned agentic/dsh platform image.

  • Build and qualify QEMU guests on the Ubuntu 26.04 LTS baseline.
  • Exercise Chromium and Manifest V3 extension behavior inside disposable

guests while retaining bounded diagnostic evidence.

  • Keep VM-backed E2E on the qualified Titan runner and isolate conformance

package discovery from unrelated host files.

  • Deliver A2A input to the existing bound runtime command, including prompts

emitted without a trailing newline.

  • Exercise desktop grant and SSH isolation foundations, and reproduce

persistent browser-state handoff through the XFCE comparison fixtures.

  • Land authenticated desktop admission, durable controller ownership with a

fenced worker supervisor, guest account reconciliation over scoped OpenBao credentials, and a reproducible Keycloak browser-binding mapper qualified against a live issuer. Desktop access stays feature-gated.

Upgrade

After publication, upgrade `agentic-mgmt`, `agent-client`, and `agentic-cli` together:

curl -fsSLO https://github.com/jmagly/agentic-sandbox/releases/download/v2026.9.0/agentic-sandbox-install.sh
bash agentic-sandbox-install.sh --version v2026.9.0

Operators using QEMU should rebuild or replace older guest images before running the Ubuntu 26.04 browser qualification path. No management data migration is required.

Verification

Verify downloaded assets and public images using the release verification guide. The release gate covers Rust formatting and unit tests, CI pinning, browser-runtime contracts, conformance package isolation, and publication checks for release artifacts and images.

Operational status

Desktop access remains under development. The grant store and SSH signer are not yet connected to a complete production admission and lifecycle path. The desktop panel, verified user/workspace provider integration, credential custody, private browser worker and acknowledged agent/human control handoff remain release-independent delivery work. The authorized user login flow is not ready for production use.

The XFCE comparison evidence proves synthetic browser-state preservation in disposable fixtures. It does not qualify production accounts, revocation, capacity or the Cockpit user flow.

Celld remains experimental, disabled by default, and production `NO-GO`.

Rollback

Rollback management, agent, and CLI binaries together to v2026.8.9. Operators who replaced QEMU guest images should retain the prior baseline if guest-level rollback is required.

Full notes: CHANGELOG entry 2026.9.0.