docs(fork): ledger facts as of 2026-10-19

FORK.md

@@ -6,7 +6,7 @@ Agent Platform's kagent (API v2) runs every agent as a Substrate actor; this for
 Substrate is pinned, built, scanned and published. It answers one question from one place: **which Substrate
 are we running, and why does it differ from upstream?**
 
-Tracking: both upstream repositories have issues disabled, so each carried patch is a ledger file in `fork/` that
+Tracking: each carried patch is a ledger file in `fork/` that
 names its pull request here and its upstream pull request or issue; the line's own work is tracked in this repository's
 public issues. The kagent line is built the same way ([giantswarm/kagent-upstream](https://github.com/giantswarm/kagent-upstream)).
 Giant Swarm's internal planning stays out of this public file: where a row once cited an internal issue, it states the
@@ -78,8 +78,8 @@ a workload that exits at start-up is re-booted forever and its cause never repor
 the egress MITM CA cannot be rotated without failing actor TLS, and the image-layer owners, without which
 an actor run as its image's `USER` cannot write what its image gave it, and the migration of the golden snapshot status a release before golden tags recorded, without which
 every template created on 1.0.x refuses its actors as not resumable after the upgrade, and the egress-policy contract check, without which a `kubectl-ate` of another line stores a policy with another meaning, and the template delete that takes the row first, without which a refused delete leaves a template whose golden is gone, and the fencing token on Pause, Suspend and Resume, without which a lease holder frozen past its lease pauses an actor its successor left running, and the lease-free durable-pause commit with the holder-naming lease, without which a client's pause or suspend right after a resume is Aborted by background work on a loaded database, and the denial's own gRPC code for a denied gRPC call, without which a gRPC caller of a held actor reads Unavailable and cannot tell it from an unavailable control plane, and the re-take of a golden written in an older snapshot layout, without which every new conversation on every agent fails after a release that changes the layout until the goldens are reset by hand; all twenty-four are written for upstream and leave at the first release that carries them. Two more are the line's own and stay: the read of a 1.8 actor's local-snapshot node and assigned node, without which a paused 1.8 actor cannot resume on v0.5.0-alpha2 and a running one crashes on its first pause, and the chart's own shape on the v0.5.0-alpha2 base, without which an upgrade loses the bundled database and the certificate controller. The image-identity patches are upstream's open
-agent-substrate/substrate#1918 and #1906 with the merged #1910. The Postgres Secret patch is upstream's own pull
-request, a draft since 2026-09-29. Everything else is what upstream has already merged; the `x/net` v0.61.0 requirement changes versions only and leaves when upstream requires it (see its row). Giant Swarm specific wiring
+agent-substrate/substrate#1918 with the merged #1906 (2026-10-16) and #1910. The Postgres Secret patch is upstream's own pull
+request, merged 2026-10-08 and in the v0.5.0-alpha2 pin, beside which the line keeps its own value key. Everything else is what upstream has already merged; the `x/net` v0.61.0 requirement changes versions only and leaves when upstream requires it (see its row). Giant Swarm specific wiring
 lives elsewhere: the CA/JWT pool bootstrap (`kubectl-ate admin make-ca-pool`/`make-jwt-pool`
 and the `ate-api-authentication` ConfigMap) is created by [agentlab](https://github.com/giantswarm/agentlab)
 and by meta chart 4.0; the `WorkerPool` the platform's Harnesses run on comes with the kagent chart
@@ -155,7 +155,7 @@ The fork commits above are the replayed SHAs.
 ## Upstream items prepared without a carried patch
 
 Items the platform needs from Substrate whose fix is not yet written. The text below is the upstream-facing
-proposal (upstream has issues disabled, so it becomes a kagent-dev/substrate pull request when the patch
+proposal (it becomes an agent-substrate/substrate issue, a kagent-dev/substrate pull request when the patch
 exists, or a kagent-dev/kagent issue); a human decides whether and when it goes upstream.
 
 ### Place an actor's restore only on a worker whose CPU covers the snapshot's feature set

fork/actor-containers-keep-rlimit-nofile-1024.md

@@ -1,7 +1,7 @@
 # Actor containers keep RLIMIT_NOFILE at 1024
 
 - **Status:** carried
-- **Upstream:** [agent-substrate/substrate#2530](https://github.com/agent-substrate/substrate/issues/2530) (open): restore each checkpoint under its own limit; this commit is dropped once a release carries that
+- **Upstream:** [agent-substrate/substrate#2530](https://github.com/agent-substrate/substrate/issues/2530) (closed 2026-10-13 by BenTheElder: "There's no compatibility guarantee right now … NOT supporting backwards compat right now"); upstream writes no restore under the checkpoint's own limit, so this commit stays on the line
 - **Our commit:** [#353](https://github.com/giantswarm/substrate/pull/353) (`fix(ocispec): keep RLIMIT_NOFILE at 1024 so earlier checkpoints restore`)
 
 ## Change

fork/actors-run-as-their-images-user-workdir.md

@@ -1,7 +1,7 @@
 # Actors run as their image's `USER` in its `WORKDIR`
 
 - **Status:** carried
-- **Upstream:** not ours: [agent-substrate/substrate#1918](https://github.com/agent-substrate/substrate/pull/1918) (author dims, open, five commits, rebased on 2026-10-01) and [#1906](https://github.com/agent-substrate/substrate/pull/1906) (open), which #1918 asks to merge first; #1910 is merged. All fall away at the re-pin onto the first release that carries #1918. **The upgrade onto this line breaks every gVisor snapshot**: `runsc restore` checks each container's `Process.User` and `Process.Cwd` against the checkpoint and the pause image sets `USER 65535`, so delete every gVisor actor before the roll and recreate every gVisor template after it (`docs/upgrade.md`, step 4); micro-VM snapshots resume as they were. The harness images must declare their identity (`USER 0:0`, `WORKDIR /`, kagent-upstream#125) before the roll, or the harness itself starts as 65532
+- **Upstream:** not ours: [agent-substrate/substrate#1918](https://github.com/agent-substrate/substrate/pull/1918) (author dims, open on 2026-10-19) and [#1906](https://github.com/agent-substrate/substrate/pull/1906) (merged 2026-10-16, `97de17b1`, in kagent-dev/substrate v0.6.0-alpha3, not in the v0.5.0-alpha2 pin), which #1918 asked to merge first; #1910 is merged. All fall away at the re-pin onto the first release that carries #1918. **The upgrade onto this line breaks every gVisor snapshot**: `runsc restore` checks each container's `Process.User` and `Process.Cwd` against the checkpoint and the pause image sets `USER 65535`, so delete every gVisor actor before the roll and recreate every gVisor template after it (`docs/upgrade.md`, step 4); micro-VM snapshots resume as they were. The harness images must declare their identity (`USER 0:0`, `WORKDIR /`, kagent-upstream#125) before the roll, or the harness itself starts as 65532
 - **Our commit:** `git cherry-pick -x` of the whole stack, in upstream's order: `f55a4de4` (upstream's `8f7eb07d`, rootfs root), with the fork-only test of a restored bundle `f4a98eb1`; `1f43f481` (`895ec3ce`, #1906); `12670632`, `3da2115b`, `136337e7`, `ab5c083e` (`1e0466df`, `fa8578de`, `5925173f`, `d41a2fc2`, #1918). `afb62e18` (agent-substrate/substrate#1910, the manifest's `CAP_DAC_OVERRIDE`) is in the pin. Adapted to the line: `ocispec.Options` keeps its `ActorUID`/`ContainerName` shape and gains only `User` and `Cwd`, paths stay in `ateompath`, and the fork's `TestPrepareOCIDirectory_RegistryRejectionIsTerminal` passes the bundle path; also [#103](https://github.com/giantswarm/substrate/pull/103) (`feat(atelet): carry the image USER and WORKDIR stack of agent-substrate/substrate#1918`), [#101](https://github.com/giantswarm/substrate/pull/101) (`fix(imagecache): carry the rootfs root fix of agent-substrate/substrate#1918`)
 
 ## Change

fork/ate-idp-server-serves-actor-jwt-issuer.md

@@ -1,7 +1,7 @@
 # ate-idp-server serves the actor-JWT issuer
 
 - **Status:** carried
-- **Upstream:** the server is upstream's `08779062` ([agent-substrate/substrate#2099](https://github.com/agent-substrate/substrate/pull/2099), merged on `main` after v0.5.0-alpha2) and leaves at the first re-pin that contains it; the chart's Deployment and `idp` Service: to file — prepared in the fork: branch `upstream/helm-ate-idp-server`
+- **Upstream:** the server is upstream's `08779062` ([agent-substrate/substrate#2099](https://github.com/agent-substrate/substrate/pull/2099), merged 2026-10-16, in kagent-dev/substrate v0.6.0-alpha3, not in v0.5.0-alpha4) and leaves at the first re-pin that contains it; the chart's Deployment and `idp` Service: kagent-dev/substrate `main` renders `charts/substrate/templates/ate-idp-server.yaml` since `8cdb6963` (2026-10-18, in v0.6.0-alpha3), so the branch prepared in the fork, `upstream/helm-ate-idp-server`, is superseded and the chart half leaves at the same re-pin
 - **Our commit:** [#472](https://github.com/giantswarm/substrate/pull/472): `git cherry-pick -x` of `08779062` (the module path adapted, only its ate-idp-server entry of `docs/metrics/substrate.yaml`), the chart's `ate-idp-server` and the line's image of it
 
 ## Change

fork/atelet-daemonset-takes-nodeselector-tolerations-affinity.md

@@ -1,7 +1,7 @@
 # The atelet DaemonSet takes `nodeSelector`, `tolerations` and `affinity`
 
 - **Status:** carried
-- **Upstream:** to file: the upstream-shaped patch is branch [`upstream/atelet-scheduling`](https://github.com/giantswarm/substrate/tree/upstream/atelet-scheduling) here (`b34c1690`, on the mirror `main`); [kagent-dev/substrate#16](https://github.com/kagent-dev/substrate/pull/16) touches the same knob (`atelet.nodeSelector`, no tolerations or affinity) inside a fork-wide 92-file pull request that has conflicted since July — align with the maintainers there; re-checked beside agent-substrate/substrate#1874 (tolerations for workload types, merged 2026-09-25, in v0.3.0-alpha1) and alpha1's fixed `ate.dev/sandboxClass` toleration (`80f37cf6`) at the re-pin; a team member opens the kagent-dev/substrate pull request with DCO sign-off once the team has reviewed it
+- **Upstream:** to file: the upstream-shaped patch is branch [`upstream/atelet-scheduling`](https://github.com/giantswarm/substrate/tree/upstream/atelet-scheduling) here (`b34c1690`, on the mirror `main`); [kagent-dev/substrate#16](https://github.com/kagent-dev/substrate/pull/16) touched the same knob (`atelet.nodeSelector`, no tolerations or affinity) inside a fork-wide 92-file pull request, closed unmerged on 2026-10-06; re-checked beside agent-substrate/substrate#1874 (tolerations for workload types, merged 2026-09-25, in v0.3.0-alpha1) and alpha1's fixed `ate.dev/sandboxClass` toleration (`80f37cf6`) at the re-pin; a team member opens the kagent-dev/substrate pull request with DCO sign-off once the team has reviewed it
 - **Our commit:** `931f9ed4`, [#8](https://github.com/giantswarm/substrate/pull/8)
 
 ## Change

fork/egress-gateway-mints-and-injects-actor-jwts.md

@@ -1,7 +1,7 @@
 # The egress gateway mints and injects actor JWTs
 
 - **Status:** carried
-- **Upstream:** merged on agent-substrate/substrate `main`: [agent-substrate/substrate#2135](https://github.com/agent-substrate/substrate/pull/2135) (`66f8a888`), [#2141](https://github.com/agent-substrate/substrate/pull/2141) (`d966c8e8`), [#2421](https://github.com/agent-substrate/substrate/pull/2421) (`55b6e00e`); in no release tag yet. Leaves at the first re-pin onto a tag that contains all three.
+- **Upstream:** merged on agent-substrate/substrate `main`: [agent-substrate/substrate#2135](https://github.com/agent-substrate/substrate/pull/2135) (`66f8a888`), [#2141](https://github.com/agent-substrate/substrate/pull/2141) (`d966c8e8`), [#2421](https://github.com/agent-substrate/substrate/pull/2421) (`55b6e00e`); all three in agent-substrate/substrate v0.5.0 (2026-10-14) and kagent-dev/substrate v0.5.0-alpha4 (2026-10-14), not in the v0.5.0-alpha2 pin. Leaves at the first re-pin onto a tag that contains them.
 - **Our commit:** [#421](https://github.com/giantswarm/substrate/pull/421): the `git cherry-pick -x` of the three upstream commits, with the agentgateway line's `2.4.0-rc.2` as the agentgateway dataplane; [#429](https://github.com/giantswarm/substrate/pull/429) moves the dataplane to the stable `2.4.0`
 
 ## Change

fork/egress-gateway-takes-further-credential-providers.md

@@ -1,7 +1,7 @@
 # The egress gateway takes further credential providers
 
 - **Status:** carried
-- **Upstream:** to file for kagent-dev/substrate (chart only)
+- **Upstream:** [kagent-dev/substrate#90](https://github.com/kagent-dev/substrate/pull/90) (open, 2026-10-18, the chart); [agent-substrate/substrate#2829](https://github.com/agent-substrate/substrate/issues/2829) (open, 2026-10-18) and [#2830](https://github.com/agent-substrate/substrate/pull/2830) (draft, 2026-10-18) for ate-setup
 - **Our commit:** [#248](https://github.com/giantswarm/substrate/pull/248) (carries [#104](https://github.com/giantswarm/substrate/pull/104) onto the v0.4.0-alpha1 line)
 
 ## Change

fork/egress-gateway-tells-actor-why-credential-was.md

@@ -1,7 +1,7 @@
 # The egress gateway tells the actor why a credential was refused
 
 - **Status:** carried
-- **Upstream:** to file, with the agentgateway half: the 502 for unexpected answers needs upstream's agreement
+- **Upstream:** [agent-substrate/substrate#2555](https://github.com/agent-substrate/substrate/issues/2555) (open, 2026-10-13) asks upstream for the classes; ericcurtin took the Substrate side on 2026-10-15 (`credentials.go`, tests, doc table, the `FetchSecret` contract; the config-error row waits until 500 vs 502 is settled); the agentgateway half is agentgateway/agentgateway#3875 (draft)
 - **Our commit:** `feat/credential-provider-errors`; merged as [#112](https://github.com/giantswarm/substrate/pull/112) (`feat(atenet): tell the actor why a credential was refused`)
 
 ## Change

fork/go-components-honor-otel-traces-exporter-none.md

@@ -1,7 +1,7 @@
 # The Go components honor `OTEL_TRACES_EXPORTER=none`
 
 - **Status:** carried
-- **Upstream:** [agent-substrate/substrate#2189](https://github.com/agent-substrate/substrate/pull/2189) (draft, with the #1878 follow-up and the ateom row below; the upstream version also warns on an unsupported value), carried until it merges. At the 2026-10-08 re-pin onto v0.4.0-alpha1: rewritten on upstream's `metricsPushEnabled` shape as `tracesPushEnabled(ctx)` (`otlp`, the default, or `none`; an unrecognized value keeps the export and warns), so the line and agent-substrate/substrate#2189 now agree. At the 2026-10-12 re-pin onto v0.5.0-alpha2: the `serverboot` half is upstream's (agent-substrate/substrate#2193), and the line keeps only the chart's values and README rows.
+- **Upstream:** [agent-substrate/substrate#2189](https://github.com/agent-substrate/substrate/pull/2189) (open, not a draft, reviewed by JeffLuoo on 2026-10-13; with the #1878 follow-up and the ateom row below; the upstream version also warns on an unsupported value), carried until it merges; the components' own `OTEL_TRACES_EXPORTER=none` handling is upstream's [#2190](https://github.com/agent-substrate/substrate/pull/2190) (merged 2026-10-08, `2f9b30df`, in kagent-dev/substrate v0.5.0-alpha4, not in the v0.5.0-alpha2 pin). At the 2026-10-08 re-pin onto v0.4.0-alpha1: rewritten on upstream's `metricsPushEnabled` shape as `tracesPushEnabled(ctx)` (`otlp`, the default, or `none`; an unrecognized value keeps the export and warns), so the line and agent-substrate/substrate#2189 now agree. At the 2026-10-12 re-pin onto v0.5.0-alpha2: the `serverboot` half is upstream's (agent-substrate/substrate#2193), and the line keeps only the chart's values and README rows.
 - **Our commit:** `48560a41` ([#107](https://github.com/giantswarm/substrate/pull/107))
 
 ## Change

fork/let-actors-egress-through-while-resumes.md

@@ -1,7 +1,7 @@
 # Let an actor's egress through while it resumes
 
 - **Status:** carried
-- **Upstream:** to file: the upstream-shaped patch is branch [`upstream/atenet-egress-during-resume`](https://github.com/giantswarm/substrate/tree/upstream/atenet-egress-during-resume) here (`3a95d7cf`, on the mirror `main`); agent-substrate/substrate#1543 (open issue, 2026-09-08) reports the same problem, egress activated only after readyz, so the evidence and the patch go there; a team member opens the kagent-dev/substrate pull request with DCO sign-off once the team has reviewed it. **Complete with the egress dataplane this pull request pins:** the chart's `images.agentgateway` is the check in the request path (the egress config carries the `substrateEgress` policy and no `ext_proc`, so atenet's handler is not consulted); kagent-dev's `c0f5597c7cb8` (a pre-merge build of agentgateway#3237) authorized every CONNECT against ate-api itself — UID, then `RUNNING` — and refused the golden boot (`atunnel failed to open egress tunnel … 403 Forbidden: actor is not running`, agentlab 2026-09-11); upstream agentgateway v1.5.0 has no such check at all (its `substrateEgress` derives the actor from the SPIFFE id and checks nothing else — `agentlab skills-test` green on both halves with it swapped into `atenet-egress`, 2026-09-11, the run that proved the Substrate half). The line runs the agentgateway line's release (`v1.5.1-gs.2` on the v0.0.26 pin, `v1.5.1-gs.4` since the v0.0.29 pin), which keeps #3237's UID and state check and admits `RESUMING` (giantswarm/agentgateway-upstream#4; upstream-facing branch [`upstream/substrate-egress-resuming`](https://github.com/giantswarm/agentgateway-upstream/tree/upstream/substrate-egress-resuming)). Acceptance test of the combined fix: `agentlab skills-test` on the first build of this merge, recorded on agentlab#137. At the 2026-10-08 re-pin onto v0.4.0-alpha1: upstream moved the tunnel wiring of both ateoms into `internal/ateomtunnel` (agent-substrate/substrate#1959) with one `Tunnel.Activate` arming ingress and egress together; the patch splits it into `Tunnel.ActivateEgress`, called before the first container starts, and `Tunnel.ActivateIngress`, called after readyz.
+- **Upstream:** [agent-substrate/substrate#2117](https://github.com/agent-substrate/substrate/pull/2117) (open since 2026-10-02, from branch [`upstream/atenet-egress-during-resume`](https://github.com/giantswarm/substrate/tree/upstream/atenet-egress-during-resume), `3a95d7cf` on the mirror `main`; EItanya on 2026-10-06: it does nothing without #2159 allowing policies on goldens; on 2026-10-09: the maintainers are doing their best to get it done for GA); agent-substrate/substrate#1543 (open issue, 2026-09-08) reports the same problem, egress activated only after readyz. **Complete with the egress dataplane this pull request pins:** the chart's `images.agentgateway` is the check in the request path (the egress config carries the `substrateEgress` policy and no `ext_proc`, so atenet's handler is not consulted); kagent-dev's `c0f5597c7cb8` (a pre-merge build of agentgateway#3237) authorized every CONNECT against ate-api itself — UID, then `RUNNING` — and refused the golden boot (`atunnel failed to open egress tunnel … 403 Forbidden: actor is not running`, agentlab 2026-09-11); upstream agentgateway v1.5.0 has no such check at all (its `substrateEgress` derives the actor from the SPIFFE id and checks nothing else — `agentlab skills-test` green on both halves with it swapped into `atenet-egress`, 2026-09-11, the run that proved the Substrate half). The line runs the agentgateway line's release (`v1.5.1-gs.2` on the v0.0.26 pin, `v1.5.1-gs.4` since the v0.0.29 pin), which keeps #3237's UID and state check and admits `RESUMING` (giantswarm/agentgateway-upstream#4; upstream-facing branch [`upstream/substrate-egress-resuming`](https://github.com/giantswarm/agentgateway-upstream/tree/upstream/substrate-egress-resuming)). Acceptance test of the combined fix: `agentlab skills-test` on the first build of this merge, recorded on agentlab#137. At the 2026-10-08 re-pin onto v0.4.0-alpha1: upstream moved the tunnel wiring of both ateoms into `internal/ateomtunnel` (agent-substrate/substrate#1959) with one `Tunnel.Activate` arming ingress and egress together; the patch splits it into `Tunnel.ActivateEgress`, called before the first container starts, and `Tunnel.ActivateIngress`, called after readyz.
 - **Our commit:** `6be3d50c` ([#4](https://github.com/giantswarm/substrate/pull/4); first published as `0.0.27-dev.giantswarm.2026-09-10.22-37-39.h1817627`)
 
 ## Change