v1.0.2

# 🚀 Announcing Agent Sandbox v1.0.2!

We're excited to announce the release of **Agent Sandbox v1.0.2**! This release brings significant improvements across the sandbox router, SDKs, and reinforcement learning (RL) integrations. Key enhancements include Ed25519-based scoped-token v2 verification for fine-grained authorization, direct in-cluster connectivity options for the Go SDK, improved connection resiliency for the Python SDK, warm pool adoption and OpenHands integration in the RL framework, and controller observability metrics via controller-runtime v0.25.0.

### ⚠️ Breaking Changes / Action Required
* **Sandbox Router Authorizer Interface Update (`authz.Authorizer`) (#1497):** The public `Authorizer` interface signature in Go `sandbox-router` has changed from taking separate `(namespace, name)` string arguments to accepting a single `authz.AuthorizationTarget` struct. Custom `Authorizer` implementations must update their `Authorize` method to inspect the fields of `authz.AuthorizationTarget`.
* **Sandbox Router Namespace Change (#1537):** The Go `sandbox-router` manifests in `sandbox-router/deploy/` have moved from the `default` namespace to `agent-sandbox-system` to enforce privilege separation and align with SDK defaults and NetworkPolicy rules. If you deploy raw manifests, ensure your manifests and scripts point to `agent-sandbox-system`.

---

### Key Highlights

#### Sandbox Router & Security
* **Scoped-Token v2 Target Binding (#1497):** Added Ed25519 scoped-token v2 verification binding tokens to Sandbox UID, port, HTTP method, and exact upstream path. Enables multi-key rotation and exclusive cutoff timestamps (`--authz-scoped-token-v1-accept-until`) for seamless migration from legacy HMAC v1 tokens.
* **Namespace & NetworkPolicy Alignment (#1537, #1539):** Deployed the router to `agent-sandbox-system` and added the `app: sandbox-router` label to router deployment manifests, ensuring compatibility with the controller's secure-by-default `SandboxTemplate` NetworkPolicy.
* **OLM Operator Router Integration (#1425, #1477):** Added the `sandbox-router` deployment, proxy service, and health checks directly to the Operator Lifecycle Manager (OLM) bundle.

#### Go & Python SDKs
* **Direct In-Cluster Connectivity in Go SDK (#1576):** Added `Options.Connectivity` (`ConnectivityInClusterService` and `ConnectivityInClusterPodIP`), enabling workloads inside the cluster to connect directly to sandbox pods via headless service DNS or Pod IP without proxying through the API server or router.
* **Python SDK Connection Resilience on 4xx (#1574):** Fixed an issue where HTTP 4xx responses (such as file not found) caused the connector to tear down the port-forward tunnel and clear the cached Pod IP. Tunnel teardown and routing invalidations are now reserved for transport failures and 5xx errors.
* **Async Client Concurrency & Flake Hardening (#1385, #1553):** Added comprehensive E2E tests for `AsyncSandboxClient` validating concurrent execution and non-blocking event loops, with interval-overlap assertions resilient to sub-second warm-pool creation speeds.

#### Reinforcement Learning (RL) & Fleet Integrations
* **Warm Pool Adoption (#1556):** Added `FleetConfig.adopt_existing=True` and `FleetConfig.pool_name_format` to the RL SDK, allowing training harnesses to discover and adopt pre-provisioned warm pools by container image rather than creating redundant pools.
* **OpenHands Fleet Adapter & Fan-Out (#1503):** Introduced OpenHands integration shims (`make_fleet_workspace`, `make_handle_workspace`), advisory attach-time version skew detection, and scalable multi-agent example workflows (`examples/run_openhands_fleet.py`).
* **RL Quickstart Standardization (#1549):** Updated setup steps to configure and provision workloads consistently in the `agent-sandbox-rl` namespace.

#### Controller Observability, Performance & MCP Server
* **controller-runtime v0.25.0 & REST Client Metrics (#1547):** Upgraded `controller-runtime` to v0.25.0 and enabled client-go REST client metrics (`rest_client_requests_total`, `rest_client_request_duration_seconds`, rate-limiting, and retry counters) by default.
* **MCP Server Probes & Skills (#1339, #1534):** Added `/healthz` (liveness) and `/readyz` (readiness) probe endpoints to the Model Context Protocol (MCP) server container and documented client skills for MCP tools.
* **Golden-Snapshot Warm Pools on GKE (#1522):** Added an end-to-end example demonstrating golden-image warm pools restored directly from GKE Pod Snapshots.
* **High-Throughput Tuning & Diagnostics (#1593, #1552, #1555):** Documented flags for connection sharding, write optimization, and refill rate limiting; tuned stress test networking defaults (`nodeCIDRMaskSize=23`); and added serial port log capture during benchmark cluster validation failures.

---

### Installation

#### Standard Install (Core + Extensions)
Recommended for most users and GitOps engines (Argo CD, Config Sync, kustomize):
```bash
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.2/sandbox-with-extensions.yaml
```

#### Selective Install
Install components separately:
```bash
# Core only:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.2/sandbox.yaml

# Extensions (opt-in):
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.2/extensions.yaml
```

#### Python SDK
```bash
pip install k8s-agent-sandbox==1.0.2
```

--------
### Contributors
We extend our sincere thanks to all contributors to this release:
@aditya-shantanu, @dongjiang1989, @drogovozDP, @esposem, @hyperb1iss, @janetkuo, @justinsb, @leomcl, @nankeen, @tomergee, @vicentefb, @vincent0426, @wjun29, @yuzhiquan

### New Contributors
* @hyperb1iss made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1497
* @leomcl made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1463
* @nankeen made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1576

**Full Changelog**: https://github.com/kubernetes-sigs/agent-sandbox/compare/v1.0.1...v1.0.2