[github-actions]

kagent-dev/kagent#3457 — chore: upgrade Substrate to v1.0.0-rc1

Docs versions: 1.x (first shipped in v1.0.0-rc1)

No code-path rule covers 13 touched file(s). The planner could route these only by identifier search, so the candidate pages may miss what they changed, including in the other mode:

• DEVELOPMENT.md
• docs/architecture/configuration-and-compilation.md
• docs/architecture/credential-injection.md
• docs/architecture/persistence-checkpoints-and-forks.md
• docs/architecture/runtime-and-lifecycle.md
• go/core/internal/service/sandbox/guest.go
• ...and 7 more

What changes for users: Direct Helm installations that run Substrate v1.0.0-rc1 must allow the kagent controller's SPIFFE identity on the Agent Substrate router. kagent install sets the HTTPS router endpoint and allowlist automatically; without atenetRouter.ingressAllowedSPIFFEIDs, actor ingress for A2A and Sandbox guest calls is denied.

What the docs now say: The Identity page explains that the controller uses the same CA bundle and rotating client certificate for the HTTPS router as for the Agent Substrate API. The Operational considerations page now shows the kagent and Agent Substrate Helm values for direct installs.

Not verified: No cluster; the configuration is unrun, and internal links are unchecked.

How kagent-3457 was drafted, and what was not verified

• Code PR: chore: upgrade Substrate to v1.0.0-rc1 kagent#3457
• Code issue: none linked
• Product: kagent (upstream) → kagent-dev/website
• Docs version: 1.x, first shipped in v1.0.0-rc1. This product publishes one rolling tree, so the release confirms that the change is out rather than choosing a version.
• Category: new-feature / pr

Plan, and what changed it

• Planned: Document the new Substrate rc1 actor-ingress mTLS requirements on the page that owns production installation and identity behavior.
• Learned: The generated Helm reference already covers config.substrate.routerUrl, and the section index is not a configuration page; this came from the work-list reasons and candidate pages.
• Did: Added conceptual identity prose and direct Helm values for actor ingress.

Why a documentation change is necessary

The pull request upgrades Agent Substrate to v1.0.0-rc1 and changes the kagent controller's default router URL from http://atenet-router.ate-system.svc:80 to https://atenet-router.ate-system.svc:443. The diff also configures the Substrate chart with atenetRouter.ingressAllowedSPIFFEIDs for the rendered controller ServiceAccount identity. The generated Helm reference mentions the field, but no editable prose page explained when direct Helm installers must set the router allowlist. I chose operations/operational-considerations.md because it already owns production Helm changes, and identity.md because it already explains Agent Substrate mTLS. I rejected the egress, sandboxing, suspend/resume, UI, and example pages because their first paragraphs scope them to other workflows.

What changed on disk

docs-site/content/kagent/1.x/about/substrate-runtime/identity.md - Added the controller-to-router mTLS behavior and linked to the Helm values.

docs-site/content/kagent/1.x/operations/operational-considerations.md - Added Agent Substrate actor ingress, with the kagent and Agent Substrate values for direct Helm installs.

How to verify this change

1. On a direct Helm installation, apply the kagent values from Agent Substrate actor ingress. The rendered controller configuration should show config.substrate.routerUrl: https://atenet-router.ate-system.svc:443, and the controller pod should mount its Substrate client certificate.
2. Apply the Agent Substrate values from the same section. The rendered router values should include atenetRouter.ingressAllowedSPIFFEIDs with spiffe://cluster.local/ns/kagent/sa/kagent-controller, adjusted for any custom namespace, ServiceAccount, or trust domain.
3. Create a Session and call the Agent over A2A, then create a Sandbox and run a guest command. Both paths should complete through the router. If the allowlist is empty or names the wrong identity, these actor-ingress calls should fail.

Proposed release note

No proposed-release-note.md written: markers.notes_placeable is false for this product.

Release-note text from the dossier: Upgrade Substrate from v0.7.0-alpha2 to v1.0.0-rc1. Rc1 requires mTLS for actor ingress, so A2A and sandbox guest calls now use the existing Substrate CA bundle and rotating controller certificate. The installer selects the HTTPS router endpoint and allows the rendered controller ServiceAccount's SPIFFE identity.

What was not verified

The configuration was not applied to a cluster, so every command and value in the documentation is unrun. No Hugo build was run, and internal links are unchecked.

How the pages were chosen (triage report)

New configuration: no page mentions it yet

kagent-dev/kagent#3457 — chore: upgrade Substrate to v1.0.0-rc1

• Product: kagent (upstream) → kagent-dev/website
• Docs version: 1.x
• Summary (read from the body): Upgrade Substrate from v0.7.0-alpha2 to v1.0.0-rc1. Rc1 requires mTLS for actor ingress, so A2A and sandbox guest calls now use the existing Substrate CA bundle and rotating controller certificate. The installer selects the HTTPS router endpoint and allows the rendered controller ServiceAccount's SPIFFE identity.
• Not tested: no cluster was available, so every command in this diff is unrun
• No rule covers 13 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
  • DEVELOPMENT.md
  • docs/architecture/configuration-and-compilation.md
  • docs/architecture/credential-injection.md
  • docs/architecture/persistence-checkpoints-and-forks.md
  • docs/architecture/runtime-and-lifecycle.md
  • go/core/internal/service/sandbox/guest.go
  • ...and 7 more

Draft branch: pr-tracker-draft-kagent-3457

---

Important

The test suite has not run on this pull request. It was opened by github-actions[bot], and GitHub does not start workflows for pull requests opened with the repository's own token. This repository's checks are held as action_required until somebody presses Approve and run on the Checks tab. Checks that come from GitHub Apps rather than Actions, such as DCO, run on their own.

Please approve the checks before reviewing the content: an absence of failures here means the tests have not run, not that they passed.

[github-actions]

Docs preview

Link	Points at
Branch preview	The newest push to this branch. Updates in place.
Commit preview	a8b3fb5 only. Frozen.

Both are uploaded Worker versions and serve no production traffic.