[teemow]

Problem

The platform runs Substrate 1.14. Substrate 1.16.0 is stable: its egress gateway runs agentgateway 2.5.0 (giantswarm/substrate#488), which relays the TCP a tcp egress rule allows, applies a path-prefixed credential to a path with a percent-encoded /, and answers a denied request with a 403 naming the destination. It also carries 1.15's per-actor DNS query count.

Proposed solution

• components.substrate{,-crds}.versionRange: >=1.16.0 <1.17.0 (was >=1.14.0 <1.15.0). The kagent WorkerPool's derived worker image follows to ateom-gvisor:1.16.0; the customer BOM pins 1.16.0.
• tests/verify-worker-image.py: 1.15 and 1.16 stay on upstream v0.5.0-alpha2, so the kagent line published against 1.12.1 speaks their contract.
• No kagent range change. CHANGELOG and UPGRADE entries.

Substrate's docs/upgrade.md (the 1.14→1.15 and 1.15→1.16 steps): no CRD, Postgres schema or snapshot layout change; no migration, no reset; goldens kept. The egress contract is v0.4.0-alpha1+path-prefix+tcp: use the 1.16 kubectl ate.

Proof

• Step check (agentlab substrate-step-test, run by the Substrate promoter): 1.13.1 → 1.16.0-rc.4 (the commit 1.16.0 is cut from), 8/8 under drain. The conversation resumed, the volume stayed intact, and the new conversation ran on a kept golden; persisted layout 2 on both releases, so no migration and no reset.
• Renders: make golden-update (only the substrate ranges and the worker image move), verify-worker-image, verify-target, verify-tenant-credentials, verify-examples, verify-llm-routing green; both charts render at --kube-version 1.35.8 and 1.36.0; the MutatingAdmissionPolicy gate is unchanged.
• Agentlab (agentlab v0.116.0), platform on the new range, this PR's dev build 4.152.1-r749d6f5et20261019202525h289c20a:
  • kagent-step-test --chart <dev build> from the released 4.152.0 (Substrate 1.14.0): a Session took a turn and was suspended, the platform rolled in place to Substrate 1.16.0 (atelet and ateom-gvisor:1.16.0, atenet-egress on agentgateway 2.5.0), then the Session resumed and answered the codeword of its first turn, suspended and resumed again: 7/7 PASS.
  • platform-test on 1.16.0: green.
  • egress-test on 1.16.0 (the egress gateway's new agentgateway): the declared origin reached, an undeclared host answered 403 by the gate, muster reached, raw TCP to github.com:22 refused: 6/6 PASS.
  • The 1.16 kubectl ate (built from v1.16.0) reads the lab's ate-api.

Acceptance criteria

• Agentlab: platform-test green on 1.16.0; a conversation started on the released range survives the roll.
• Released; devctl rollout wait Ready on gazelle, graveler and glean.

Supersedes giantswarm/agent-platform#1129.

[circleci-architect]

Published Helm chart agent-platform

4.152.1-r749d6f5et20261019202525h289c20a

Chart	agent-platform
Version	4.152.1-r749d6f5et20261019202525h289c20a
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.152.1-r749d6f5et20261019202525h289c20a
Digest	sha256:ca9593042f56711154d5c85a906420207e6c1c4dfaf65552990e7fef5fa7a1b6
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.152.1-r749d6f5et20261019202525h289c20a

_{Posted by architect-orb · build 25768 · commit 289c20a · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.152.1-r749d6f5et20261019202525h289c20a

Chart	agent-platform-connectivity
Version	4.152.1-r749d6f5et20261019202525h289c20a
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.152.1-r749d6f5et20261019202525h289c20a
Digest	sha256:fecf09d56ebd73c0830b909c977c361e997c06a6a1cc18d29ecd3f2cf888793f
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.152.1-r749d6f5et20261019202525h289c20a

_{Posted by architect-orb · build 25769 · commit 289c20a · updated in place on every push}