v0.5.5

# 🚀 Announcing Agent Sandbox v0.5.5!

We're excited to announce the release of Agent Sandbox v0.5.5! This release brings significant enhancements to core stability, performance, new examples, and documentation, along with important updates to development workflows and dependency management.

### ⚠️ Breaking Changes / Action Required
*   **Python SDK Minimum Version (#1324)**: The minimum supported Python version for `k8s-agent-sandbox` and the `deepagents` and `mcp-server` integration packages has been raised from 3.10 to **3.11**. Users on Python 3.10 must upgrade to Python 3.11 or newer before adopting this release, as `pip` will refuse to install newer versions of these packages on Python 3.10. Python 3.10 reaches end of life on 2026-10-31.

### Key Highlights
#### Core Stability & Lifecycle Management
*   **Stale SandboxClaim Assignment Fix** (#1129): Addressed issues where stale SandboxClaim assignments could interfere with reconciliation, ensuring stable ownership and continuous operation.
*   **Optimized Metadata Writes** (#1252): Introduced an opt-in mechanism to coalesce recoverable metadata-only writes via `RequeueAfter` deferral, reducing API server load during bursts and improving overall performance (`--sandbox-write-behind-window` controller flag).
*   **Profiling Endpoint Stability** (#1305): Implemented protection against concurrent `fgprof` profile requests, ensuring the profiling endpoint remains stable and returns a 500 error for subsequent concurrent requests.
*   **Warm Pool Refill Shaping** (#1251): Added `replenish-delay` and `max-refill-rate` flags to the SandboxWarmPool controller, allowing for more controlled and throttled refilling after sandboxes are claimed.

#### Examples & Documentation
*   **`nono` Sandbox Example** (#1333): Introduced a new example demonstrating enhanced security with the `nono` agent security runtime within Agent Sandbox, showcasing filesystem isolation, scoped egress, and tamper-evident audit trails.
*   **AWS IRSA Local Simulation** (#1340): Added an example for simulating AWS IRSA locally with LocalStack, enabling validation of sandbox pod credential-loading paths without a real AWS account.
*   **Kata on AKS Examples** (#1312): Provided new examples for running Agent Sandbox with Kata Containers hardware-virtualized isolation on Azure Kubernetes Service (AKS), including a minimal `kata-aks-sandbox` and an `openclaw-kata-aks-sandbox`.
*   **RL Example Update** (#1311): Refreshes the agent-sandbox-rl example's controller tuning guidance for controller v0.5.4+, recommending higher concurrent workers due to fixes.
*   **Multi-Runtime Benchmark Study** (#1279): Expanded the GKE Memory Swap example into a comprehensive multi-runtime performance study across `gVisor`, `Kata Containers (kata-qemu)`, and `Kata Containers (kata-clh)`.
*   **High-Density Benchmark & Node Tuning Docs** (#1334): Added high-density benchmark results and node tuning instructions for GKE swap configurations.

#### Performance & Benchmarking
*   **Router Resolution Benchmarks** (#1246): Added benchmarks for the router's upstream resolution paths (UID cache, namespace/name cache, DNS fallback), highlighting significant performance differences.
*   **Python Sandbox Density Benchmark** (#1342): Introduced a high-density Python workload benchmark suite and automated runner to evaluate memory density scalability and swap offloading characteristics.
*   **Enhanced Performance Test Validation** (#1358): Improved the KWOK scalability presubmit test by extracting a reusable metrics scraper and adding automated latency threshold validation.
*   **Client to Claim Ready Latency Metric** (#565): Added an end-to-end metric (`agent_sandbox_client_claim_startup_latency_ms`) to measure user-perceived latency from client request initiation to sandbox readiness.

#### Build & CI
*   **Python Router Path Preservation** (#1158): Fixed an issue where the Python sandbox-router would incorrectly decode percent-encoded dot segments in paths.
*   **Automated Deployment Dependency Install** (#1189): Ensured `deploy-to-kube` automatically installs necessary Python dependencies, preventing installation failures.
*   **Expanded CI Coverage**: Integrated Prow presubmit unit tests for several examples (#1273), wired `hermes-agent` and `policy/vap` tests into CI (#1349), and added Prow presubmits for OLM (#1303).
*   **OLM Bundle Update** (#1330): Updated the OLM bundle to version 0.5.4.
*   **Linting Enhancements** (#1320): Added `goheader` and `intrange` linters to enforce code style and updated existing code to comply.
*   **Image Loading for Kind Clusters** (#1356): Fixed an issue where extra image tags were ignored when loading images into Kind clusters via `push-images`.

### Installation

#### Standard Install (Core + Extensions)
Recommended for most users and GitOps engines (Argo CD, Config Sync, kustomize):
```bash
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.5.5/sandbox-with-extensions.yaml
```

#### Selective Install
Install components separately:
```bash
# Core only:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.5.5/sandbox.yaml

# Extensions (opt-in):
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.5.5/extensions.yaml
```

#### Python SDK
```bash
pip install k8s-agent-sandbox==0.5.5
```

--------
### Contributors
We extend our sincere thanks to all contributors to this release:
@Axpz, @LuBingtan, @Oneimu, @XbaoWu, @YahiaBadr, @aditya-shantanu, @aleks-stefanovic, @alexatakvelon, @dependabot, @dongjiang1989, @esposem, @hchenxa, @igooch, @karimad, @lukehinds, @michaelxu2288, @ngopalak-redhat, @oceanxie1, @tom1299, @tomergee, @tomsen02, @vincent0426, @volatilemolotov, @vvoronko

### New Contributors
* @michaelxu2288 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1312
* @oceanxie1 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1279
* @tomsen02 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1300
* @karimad made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1340
* @lukehinds made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1333
* @Axpz made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1338
* @ngopalak-redhat made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1336
* @vincent0426 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1129
* @hchenxa made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1189

**Full Changelog**: https://github.com/kubernetes-sigs/agent-sandbox/compare/v0.5.4...v0.5.5