docs(ledger): apply the T3 credential-injection decision

fork/ate-idp-server-serves-actor-jwt-issuer.md

@@ -5,17 +5,17 @@ theme: credential-injection
 category: feature
 status: carried
 commits:
-  - Add ate-idp-server to serve the discovery document and key set for actor JWTs
+  - 'Add ate-idp-server to serve the discovery document and key set for actor JWTs'
   - 'feat(chart): serve the actor-JWT issuer with ate-idp-server'
   - 'chore(manifests): render ate-idp-server from the chart'
   - 'ci(fork): build and publish the ate-idp-server image'
   - 'fix(manifests): keep the chart-only ate-idp-server out of ate-install'
 upstream:
   outcome: drops-at-repin
   refs: [agent-substrate/substrate#2099]
-  exit: re-pin onto kd v0.6.0-alpha3 or later; prepared chart branch superseded
+  exit: "re-pin onto kagent-dev/substrate v0.6.0-alpha3 or later (ate-idp-server and its chart template are upstream)"
 depends_on: []
-verified: 2026-10-19
+verified: 2026-10-20
 ---
 # ate-idp-server serves the actor-JWT issuer
 
@@ -32,3 +32,5 @@ Without it nothing published the issuer's key set, so no relying party (an MCP g
 the server is upstream's `08779062` ([agent-substrate/substrate#2099](https://github.com/agent-substrate/substrate/pull/2099), merged 2026-10-16, in kagent-dev/substrate v0.6.0-alpha3, not in v0.5.0-alpha4) and leaves at the first re-pin that contains it; the chart's Deployment and `idp` Service: kagent-dev/substrate `main` renders `charts/substrate/templates/ate-idp-server.yaml` since `8cdb6963` (2026-10-18, in v0.6.0-alpha3), so the branch prepared in the fork, `upstream/helm-ate-idp-server`, is superseded and the chart half leaves at the same re-pin
 
 [#472](https://github.com/giantswarm/substrate/pull/472): `git cherry-pick -x` of `08779062` (the module path adapted, only its ate-idp-server entry of `docs/metrics/substrate.yaml`), the chart's `ate-idp-server` and the line's image of it
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 2 upstream has it; destination agent-substrate/substrate#2099 (`08779062`) and kagent-dev/substrate `8cdb6963`; first step none; branch none; test the chart's `idp_test.yaml` upstream; owner unassigned.

fork/atenet-router-answers-denial-callers-protocol-grpc.md

@@ -9,9 +9,9 @@ commits:
 upstream:
   outcome: to-file
   refs: []
-  exit: upstream PR; not on the line's production ingress path (agentgateway dataplane)
+  exit: "filed low priority from the prepared branch when a slot frees; the commit leaves the giantswarm branch at the next re-pin whatever the PR's state (the Envoy dataplane is not on this line's path)"
 depends_on: []
-verified: 2026-10-19
+verified: 2026-10-20
 ---
 # The atenet router answers a denial in the caller's protocol
 
@@ -28,3 +28,5 @@ a gRPC caller of a held actor (one whose lease another operation holds, answered
 to file: the upstream-shaped patch is branch [`upstream/atenet-grpc-denial-code`](https://github.com/giantswarm/substrate/tree/upstream/atenet-grpc-denial-code) here (`0a91139b`, on the mirror `main`); agent-substrate/substrate `main` (`296e329a`, 2026-10-08) still answers every denial as `text/plain` and no upstream issue or pull request covers it (searched 2026-10-08); a team member opens the agent-substrate/substrate pull request with DCO sign-off once the team has reviewed it
 
 `giantswarm`: [#200](https://github.com/giantswarm/substrate/pull/200)
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 5 upstream PR, low priority, uncarried at the next re-pin; destination agent-substrate/substrate; first step the PR when a slot frees; branch `upstream/atenet-grpc-denial-code` @ `0a91139b8`; test `TestIngressDenialProtocol`; depends on no theme; owner unassigned; draft: internal issue 38652, comment 6301546603.

fork/ca-pools-rotate-with-cross-certified-overlap.md

@@ -8,8 +8,8 @@ commits:
   - 'localca: rotate a CA pool with cross-certified overlap'
 upstream:
   outcome: to-file
-  refs: [agent-substrate/substrate#932, agent-substrate/substrate#971]
-  exit: upstream design issue then PR
+  refs: [agent-substrate/substrate#932, agent-substrate/substrate#971, agent-substrate/substrate#1931]
+  exit: "upstream ships rotation commands for the CA pools (agent-substrate/substrate#1931, the follow-on #971 announced): drop; re-check each re-pin; if #1931 is idle at the re-pin after 2026-11-17, the prepared comment is posted"
 depends_on: []
 verified: 2026-10-20
 ---
@@ -30,3 +30,5 @@ to file: the upstream-shaped patch is branch [`upstream/egress-ca-rotation`](htt
 `c8584af3` ([#68](https://github.com/giantswarm/substrate/pull/68), squash)
 
 2026-10-20: agent-substrate/substrate#971 (merged 2026-08-26, `d90e02ce`, in the pin) added `ActiveForSigning`, which the rotation builds on, not its exit, so the outcome stays to-file.
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 4 upstream issue; destination agent-substrate/substrate#1931 (assigned upstream), the first upstream step `add-ca`, `activate-ca` and `remove-ca` mirroring the JWT-pool commands (`cmd/kubectl-ate/internal/cmd/admin.go:168-245`); first step none until #1931 moves; branch `upstream/egress-ca-rotation` @ `fa028bf67` (six commits, to be squashed and cut to the commands); test `TestEgressMITMCARotation`; depends on no theme; owner unassigned; draft: internal issue 38652, comment 6301547059.

fork/egress-gateway-mints-and-injects-actor-jwts.md

@@ -5,18 +5,18 @@ theme: credential-injection
 category: feature
 status: carried
 commits:
-  - Egress policies can inject actor JWTs
+  - 'Egress policies can inject actor JWTs'
   - 'feat(egress): run the agentgateway line''s stable 2.4.0'
-  - Rename `MintActorJWTRequest.audience` to `audiences`.
+  - 'Rename `MintActorJWTRequest.audience` to `audiences`.'
   - 'feat(egress): inject actor JWTs on the agentgateway dataplane with the agentgateway line''s 2.4.0-rc.1'
   - 'test(chart): admit a release candidate of the agentgateway line as the dataplane image'
   - 'feat(egress): run the agentgateway line''s 2.4.0-rc.2, which mints through MintActorJWT'
-  - Egress gateway can mint and cache actor JWTs
+  - 'Egress gateway can mint and cache actor JWTs'
   - 'feat(ateapi): serve the actor JWT mint as Control.MintActorJwt, upstream''s name'
 upstream:
   outcome: drops-at-repin
   refs: [agent-substrate/substrate#2135, agent-substrate/substrate#2141, agent-substrate/substrate#2421, agent-substrate/substrate#2520]
-  exit: next re-pin
+  exit: "next re-pin (the three commits and the rename are upstream; the agentgateway line calls MintActorJwt since giantswarm/agentgateway-upstream#123)"
 depends_on: [giantswarm/agentgateway-upstream:the-substrate-egress-injects-a-minted-actor-jwt]
 verified: 2026-10-20
 ---
@@ -37,3 +37,5 @@ merged on agent-substrate/substrate `main`: [agent-substrate/substrate#2135](htt
 [#421](https://github.com/giantswarm/substrate/pull/421): the `git cherry-pick -x` of the three upstream commits, with the agentgateway line's `2.4.0-rc.2` as the agentgateway dataplane; [#429](https://github.com/giantswarm/substrate/pull/429) moves the dataplane to the stable `2.4.0`
 
 [#495](https://github.com/giantswarm/substrate/pull/495): the RPC and its messages renamed `MintActorJwt`, `MintActorJwtRequest` and `MintActorJwtResponse`, as agent-substrate/substrate#2520 (`68895abb`, 2026-10-13) named them on `main` (`pkg/proto/ateapipb/ateapi.proto` line 89 there). gRPC method names are case-sensitive: until then the line served `/ateapi.Control/MintActorJWT`, which upstream's callers, agentgateway#3985 among them, are answered `Unimplemented` on. The agentgateway line's egress (giantswarm/agentgateway-upstream:the-substrate-egress-injects-a-minted-actor-jwt) calls `MintActorJWT` up to `2.6.1` and moves in the same release window; the chart's `images.agentgateway` moves to its release in the Substrate release that carries the rename.
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 2 upstream has it; destination agent-substrate/substrate#2135, #2141, #2421 and #2520; first step none; branch none; test `TestActorEgressCredentialInjection`; owner unassigned.

fork/egress-gateway-takes-further-credential-providers.md

@@ -12,9 +12,9 @@ commits:
 upstream:
   outcome: open
   refs: [agent-substrate/substrate#2829, agent-substrate/substrate#2830, kagent-dev/substrate#90]
-  exit: kd#90 and as#2830 merged
+  exit: "kagent-dev/substrate#90 and agent-substrate/substrate#2830 merged: drop; unreviewed on 2026-11-17: the platform chart overlays the egress gateway's credentialProviders entries and the file drops"
 depends_on: []
-verified: 2026-10-19
+verified: 2026-10-20
 ---
 # The egress gateway takes further credential providers
 
@@ -31,3 +31,5 @@ kagent injects the caller of the current turn at egress through its own provider
 [kagent-dev/substrate#90](https://github.com/kagent-dev/substrate/pull/90) (open, 2026-10-18, the chart); [agent-substrate/substrate#2829](https://github.com/agent-substrate/substrate/issues/2829) (open, 2026-10-18) and [#2830](https://github.com/agent-substrate/substrate/pull/2830) (draft, 2026-10-18) for ate-setup
 
 [#248](https://github.com/giantswarm/substrate/pull/248) (carries [#104](https://github.com/giantswarm/substrate/pull/104) onto the v0.4.0-alpha1 line)
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 5 upstream PR in flight, fallback class 3 platform; destination kagent-dev/substrate#90 (the chart) and agent-substrate/substrate#2830 (ate-setup, for #2829); the dataplane already selects a provider by URI authority; first step none, both are filed; branch the `giantswarm` commit of this file; test the chart's additional-providers cases; depends on theme T6; re-check 2026-11-17; owner unassigned; draft: internal issue 38652, comment 6301544198.

fork/egress-gateway-tells-actor-why-credential-was.md

@@ -8,10 +8,10 @@ commits:
   - 'feat(atenet): tell the actor why a credential was refused'
 upstream:
   outcome: open
-  refs: [agent-substrate/substrate#2555, agent-substrate/substrate#2706, agentgateway/agentgateway#3875]
-  exit: as#2706 (the atenet half of as#2555) merges, then agentgateway#3875
-depends_on: [giantswarm/agentgateway-upstream:a-credential-providers-failure-is-answered-by-its-class]
-verified: 2026-10-20
+  refs: [agent-substrate/substrate#2555, agent-substrate/substrate#2706, agentgateway/agentgateway#3875, agentgateway/agentgateway#2162]
+  exit: "agent-substrate/substrate#2706 merged: re-pin; the reason-to-the-actor part drops at the agentgateway re-pin past be8864a88 (agentgateway/agentgateway#2162, merged 2026-10-21); re-check each re-pin"
+depends_on: [giantswarm/agentgateway-upstream:a-credential-providers-failure-is-answered-by-its-class, agentgateway/agentgateway#2162]
+verified: 2026-10-22
 ---
 # The egress gateway tells the actor why a credential was refused
 
@@ -30,3 +30,7 @@ kagent's caller credential provider refuses for reasons the actor can act on (no
 `feat/credential-provider-errors`; merged as [#112](https://github.com/giantswarm/substrate/pull/112) (`feat(atenet): tell the actor why a credential was refused`)
 
 2026-10-20: the Substrate side is [agent-substrate/substrate#2706](https://github.com/agent-substrate/substrate/pull/2706) (ericcurtin, opened 2026-10-15, "Fixes #2555"): provider `Internal`, `Unknown`, `Unimplemented` and an unusable credential answer 502, `ResourceExhausted` 503, `InvalidArgument` stays 403; the outcome stays open on it.
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 5 upstream PR in flight; destination agent-substrate/substrate#2706 (a third-party PR for #2555) then agentgateway/agentgateway#3875; first step reopen agent-substrate/substrate#2555, which was closed while #2706 is open; branch the `giantswarm` commit of this file; test the fork e2e error-class cases; depends on agentgateway/agentgateway#2162 (if it lands no reason reaches the actor); owner unassigned; draft: internal issue 38652, comment 6301545434.
+
+2026-10-22, updated on internal issue 38652: agentgateway/agentgateway#2162 merged on 2026-10-21, so every egress refusal body is generic upstream and no reason reaches the actor; agent-substrate/substrate#2555 was reopened on 2026-10-21 (it had been closed by a ledger pull request's closing keyword, not by a maintainer).

fork/egress-gateway-trusts-extra-cas-actors-upstream.md

@@ -9,9 +9,9 @@ commits:
 upstream:
   outcome: to-file
   refs: []
-  exit: kd chart PR
+  exit: "kagent-dev/substrate chart PR merged: drop; unreviewed on 2026-11-17: the lab mounts its own bundle and the file drops (no production installation needs it, checked 2026-10-20)"
 depends_on: []
-verified: 2026-10-19
+verified: 2026-10-20
 ---
 # The egress gateway trusts extra CAs on the actors' upstream HTTPS
 
@@ -28,3 +28,5 @@ the egress gateway terminates the actors' TLS and dials the upstream itself with
 to file — prepared in the fork: branch [`upstream/atenet-egress-upstream-trust`](https://github.com/giantswarm/substrate/tree/upstream/atenet-egress-upstream-trust) here (`175664c9`, on the mirror `main` @ `bf51a996`; its message is the pull-request text). A team member opens the kagent-dev/substrate pull request with DCO sign-off once the team has reviewed it
 
 [#92](https://github.com/giantswarm/substrate/pull/92)
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 5 upstream PR, capped (136 lines, acceptance uncertain), fallback class 3 (lab only); destination kagent-dev/substrate, an issue then the chart PR; first step the issue, kagent-dev/substrate; branch `upstream/atenet-egress-upstream-trust` @ `175664c9f`; test `atenet_egress_upstream_trust_test.yaml` and the lab's serving test; depends on no theme; re-check 2026-11-17; owner unassigned; draft: internal issue 38652, comment 6301544635 and comment 6301545100.

fork/egress-path-prefix-admits-encoded-slash.md

@@ -5,14 +5,14 @@ theme: credential-injection
 category: bugfix
 status: carried
 commits:
-  - "fix(egress): a path prefix applies to a path with an encoded slash"
-  - "chore(agentgateway): run 2.5.0-rc.2, which admits an encoded slash"
+  - 'fix(egress): a path prefix applies to a path with an encoded slash'
+  - 'chore(agentgateway): run 2.5.0-rc.2, which admits an encoded slash'
 upstream:
-  outcome: to-file
-  refs: []
-  exit: goes with the path_prefix change (agent-substrate/substrate#2541)
+  outcome: fork-only
+  refs: [agent-substrate/substrate#2541]
+  exit: "with egress-scopes-credential-header-to-request-path-prefix: drops in both outcomes (the scheme-keyed entry needs no path parsing)"
 depends_on: [egress-scopes-credential-header-to-request-path-prefix, giantswarm/agentgateway-upstream:substrate-egress-path-prefix-admits-an-encoded-slash]
-verified: 2026-10-19
+verified: 2026-10-20
 ---
 # A path-prefixed credential header applies to a path with an encoded slash
 
@@ -29,3 +29,5 @@ GitLab addresses a project by its URL-encoded path (`/api/v4/projects/<group>%2F
 to file — prepared in the fork: branch `upstream/egress-path-prefix-encoded-slash` on top of `upstream/egress-credential-path-prefix`, so it goes upstream with or after the path-prefix change. Drops at the re-pin onto a commit containing it
 
 [#483](https://github.com/giantswarm/substrate/pull/483), for [#481](https://github.com/giantswarm/substrate/issues/481)
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 6 fork-only, follower of the path_prefix row; destination none of its own; first step none; branch `upstream/egress-path-prefix-encoded-slash` @ `5d054f25b`; test the encoded-slash case; depends on no theme; re-check 2026-11-17; owner unassigned.

fork/egress-scopes-credential-header-to-request-path-prefix.md

@@ -9,11 +9,11 @@ commits:
   - 'feat(ateapi): name the credential path prefix in the egress contract'
   - 'test(egress): prove a path-scoped credential cannot escape its prefix'
 upstream:
-  outcome: open
+  outcome: fork-only
   refs: [agent-substrate/substrate#2515, agent-substrate/substrate#2541]
-  exit: as#2541 decision
+  exit: "agent-substrate/substrate#2541 answered by 2026-11-17: the scheme-keyed entry accepted, the line re-seats on that commit and field 5 goes; unanswered on 2026-11-17: drops at the following re-pin, GitLab API calls as the person unsupported"
 depends_on: [ate-api-reports-egress-policy-contract-kubectl, giantswarm/agentgateway-upstream:substrate-egress-applies-credential-header-by-request-path-prefix]
-verified: 2026-10-19
+verified: 2026-10-20
 ---
 # The egress gateway scopes a credential header to a request path prefix
 
@@ -34,3 +34,5 @@ One host can take different credentials on different paths: a Git server takes `
 proposed in [agent-substrate/substrate#2541](https://github.com/agent-substrate/substrate/issues/2541) (open). Upstream's maintainers call the egress API locked for GA and ask for API changes as issues first. The implementation, [agent-substrate/substrate#2515](https://github.com/agent-substrate/substrate/pull/2515) from the branch `upstream/egress-credential-path-prefix` on upstream `main` @ `c4129c94`, is a draft that waits on the issue.
 
 [#349](https://github.com/giantswarm/substrate/pull/349) (ledger: [#370](https://github.com/giantswarm/substrate/pull/370)): the fork's cherry-pick of the upstream commit, resolved against the line's `applyEffects`; the escape-case tests: [#468](https://github.com/giantswarm/substrate/pull/468)
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 6 fork-only until 2026-11-17; destination agent-substrate/substrate#2541, where the smaller scheme-keyed shape (several entries per header chosen by the prefix the request carries, no new field, no path parsing) was posted on 2026-10-20; acceptance uncertain (the API was called locked on #2515, two proto renames merged after it); no standard fits, neither dataplane has a path input; first step rework #2515 if accepted; branch `upstream/egress-credential-path-prefix` @ `35009eff8`; test `TestActorEgressCredentialInjection`; depends on no theme; owner unassigned; draft: internal issue 38652, comment 6301545833.

fork/route-outcome-denied-for-a-403.md

@@ -9,9 +9,9 @@ commits:
 upstream:
   outcome: open
   refs: [agent-substrate/substrate#2534]
-  exit: as#2534 merged
+  exit: "agent-substrate/substrate#2534 merged (approved, its e2e check failing): re-pin; re-check each re-pin"
 depends_on: []
-verified: 2026-10-19
+verified: 2026-10-20
 ---
 # The router's route outcome names a 403 denied, not resume_error
 
@@ -28,3 +28,5 @@ Without a 403 case every egress policy refusal and every ingress `PermissionDeni
 [agent-substrate/substrate#2534](https://github.com/agent-substrate/substrate/pull/2534), open, from the branch `upstream/egress-denied-outcome` on upstream `main` @ `579cfcb6`
 
 [#354](https://github.com/giantswarm/substrate/pull/354): the fork's cherry-pick of the upstream commit, unchanged
+
+2026-10-20, decided on internal issue 38652, comment 6301541135: class 5 upstream PR in flight; destination agent-substrate/substrate#2534; first step fix the failing e2e check on it; branch `upstream/egress-denied-outcome` @ `f7a635bd1`; test the e2e case of #2534; depends on no theme; owner unassigned; draft: internal issue 38652, comment 6301546241.