Sync upstream sandbox, snapshot, and HTTPS egress updates

.agents/skills/sync-upstream-main/SKILL.md

@@ -37,8 +37,8 @@ does not authorize merging it.
 
 ## Validate and investigate failures
 
-Run `make verify` (which includes the race-enabled unit tests),
-`make verify-helm-template`, and `make verify-crd-chart`. Use Go's default cache.
+Run `go test -race ./...`, `hack/verify-all.sh`,
+`hack/render-manifests.sh --check`, and `hack/verify/crd-chart.sh`. Use Go's default cache.
 Record failures and distinguish regressions from missing prerequisites and
 existing failures using evidence from the base revision when needed.
 

.github/workflows/helm-e2e.yaml

@@ -63,7 +63,7 @@ jobs:
         # the chart composes {registry}/{repository}/{component}, so the local
         # registry serves each image where the default repository expects it --
         # the same path-preserving rule a production mirror follows.
-        for component in ateapi atecontroller atelet podcertcontroller atenet credential-provider/kubernetes-secrets; do
+        for component in ateapi atecontroller atelet podcertcontroller atenet snapshot-plugin credential-provider/kubernetes-secrets; do
           KO_DOCKER_REPO="localhost:5001/kagent-dev/substrate/${component##*/}" \
             ./hack/run-tool.sh ko build --bare --tags helm-e2e \
               --platform linux/amd64 "./cmd/${component}"
@@ -115,6 +115,8 @@ jobs:
       run: hack/install-ate-kind.sh --deploy-demo-counter
     - name: Deploy egress demo
       run: hack/install-ate-kind.sh --deploy-demo-egress
+    - name: Trust local E2E TLS origins
+      run: hack/setup-e2e-egress-tls-kind.sh
     - name: Run E2E tests (gVisor)
       # The egress credential suite replaces the shared provider policy.
       # Run it separately after the Helm suite has checked the chart's grants.
@@ -139,8 +141,7 @@ jobs:
     - name: Require every lane to have run tests
       if: always()
       run: |
-        make build-junittool
-        bin/junittool verify -manifest "${ARTIFACTS}/expected-junit.txt"
+        go -C tools/junittool run . verify -manifest "${ARTIFACTS}/expected-junit.txt"
     - name: Upload test results
       if: always()
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

.github/workflows/helm-verify.yaml

@@ -32,4 +32,4 @@ jobs:
       - name: Lint the chart
         run: helm lint charts/substrate charts/substrate-crds charts/substrate-podcert
       - name: Verify committed manifests match the chart output
-        run: make verify-helm-template
+        run: hack/render-manifests.sh --check

.github/workflows/pr-workflow.yaml

@@ -97,7 +97,7 @@ jobs:
       run: |
         sudo apt-get update -qq
         sudo apt-get install -y -qq --no-install-recommends clang libclang-dev
-        make test-dynamic-modules
+        hack/test-dynamic-modules.sh
     # Root-gated tests (overlay mounts, whiteout mknod, trusted.* xattrs, ...)
     # skip for the unprivileged runner user above; rerun the packages that
     # contain them (any test importing internal/roottest) under sudo.
@@ -109,9 +109,7 @@ jobs:
     # file that was never written fails too.
     - name: Require tests to have run
       if: always()
-      run: |
-        make build-junittool
-        bin/junittool verify -manifest "${ARTIFACTS}/expected-junit.txt"
+      run: go -C tools/junittool run . verify -manifest "${ARTIFACTS}/expected-junit.txt"
     - name: Upload test results
       if: always()
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -234,6 +232,8 @@ jobs:
       run: |
         hack/install-ate-kind.sh --deploy-demo-egress
         hack/install-ate-kind.sh --deploy-demo-egress-microvm
+    - name: Trust local TLS origins in egress gateway
+      run: hack/setup-e2e-egress-tls-kind.sh
     # scale the idle sandbox class's demo pools to zero so each lane has the node
     - name: Focus the node on gVisor
       run: hack/e2e-focus-sandbox-class.sh gvisor
@@ -258,9 +258,7 @@ jobs:
     # run-e2e.sh refuses to run in CI without E2E_JUNIT_FILE.
     - name: Require every lane to have run tests
       if: always()
-      run: |
-        make build-junittool
-        bin/junittool verify -manifest "${ARTIFACTS}/expected-junit.txt"
+      run: go -C tools/junittool run . verify -manifest "${ARTIFACTS}/expected-junit.txt"
     - name: Save Go build cache
       # Main only, so PRs restore the latest main build rather than each
       # storing its own copy.

.github/workflows/release.yaml

@@ -88,7 +88,7 @@ jobs:
         run: |
           set -o errexit -o nounset -o pipefail
 
-          for component in ateapi atecontroller atelet ateom-gvisor ateom-microvm podcertcontroller atenet credential-provider/kubernetes-secrets; do
+          for component in ateapi atecontroller atelet ateom-gvisor ateom-microvm podcertcontroller atenet snapshot-plugin credential-provider/kubernetes-secrets; do
             KO_DOCKER_REPO="${IMAGE_REPOSITORY}/${component##*/}" \
             ./hack/run-tool.sh ko build \
               --tags "${IMAGE_TAGS}" \

.gitignore

@@ -60,8 +60,8 @@ Thumbs.db
 /.worktrees/
 
 # Stray outputs from `go build` without -o. Root-module tools land at the repo
-# root; tools with their own go.mod land beside their source. Use
-# `make build-<tool>`, which writes to /bin/ above.
+# root; tools with their own go.mod land beside their source. Build with
+# `-o bin/<tool>`, which is ignored above.
 /validate-image-cache
 /setup-gcp
 /tools/apitool/apitool

.golangci-kal.yaml

@@ -96,7 +96,9 @@ linters:
       - path: 'pkg/api/v1alpha1/sandboxconfig_types\.go'
         text: '^requiredfields: .*\bAssetFile\.(SHA256|URL)\b'
       - path: 'pkg/api/v1alpha1/sandboxconfig_types\.go'
-        text: '^(nomaps|optionalfields|requiredfields): .*\bSandboxConfigSpec\.(Assets|PauseImage|SandboxClass)\b'
+        text: '^(optionalfields|requiredfields): .*\bSandboxConfigSpec\.SandboxClass\b'
+      - path: 'pkg/api/v1alpha1/sandboxconfig_types\.go'
+        text: '^(nomaps|optionalfields): .*\bSandboxVersionConfig\.(Assets|PauseImage)\b'
       - path: 'pkg/api/v1alpha1/sandboxconfig_types\.go'
         text: '^(nonpointerstructs|requiredfields): .*\bSandboxConfig\.Spec\b'
       - path: 'pkg/api/v1alpha1/csidriverconfig_types\.go'
@@ -112,7 +114,7 @@ linters:
       - path: 'pkg/api/v1alpha1/workerpool_types\.go'
         text: '^optionalfields: .*\bWorkerPoolPodTemplate\.PriorityClassName\b'
       - path: 'pkg/api/v1alpha1/workerpool_types\.go'
-        text: '^(optionalfields|requiredfields): .*\bWorkerPoolSpec\.(Replicas|SandboxClass|WorkerImage)\b'
+        text: '^(optionalfields|requiredfields): .*\bWorkerPoolSpec\.(Replicas|WorkerImage)\b'
       - path: 'pkg/api/v1alpha1/workerpool_types\.go'
         text: '^optionalfields: .*\bWorkerPoolStatus\.(ReadyReplicas|Replicas|Selector)\b'
       - path: 'pkg/api/v1alpha1/workerpool_types\.go'

AGENTS.md

@@ -40,22 +40,21 @@ See `docs/dev/code-layout.md` for the full rationale and per-directory details.
 
 ## Build and Test Commands
 
-Agent Substrate uses a `Makefile` for its build and test tasks.
+The dev entry points are the scripts under `hack/` and the `cmd/ate-setup` installer.
 
-### Building
-- **Binaries**: `make build` (builds images and `kubectl-ate`) or `make build-atectl`
-- **Images**: `make build-images` (uses ko to build container images)
-- **Demos**: `make build-demos`
-- **Release images**: `make build-release-images KO_DOCKER_REPO=REPO VERSION=TAG` (every image a pre-built install needs, all tagged `TAG`, including the docker-built `envoy-dataplane`; `make build-envoy-dataplane` builds only that one)
+### Building and Installing
+- **Install from source**: `go run ./cmd/ate-setup deploy ate-system` (or the `hack/install-ate.sh` shim) builds every image with ko as part of the install; see `cmd/ate-setup/README.md`
+- **Binaries**: `go build -o bin/kubectl-ate ./cmd/kubectl-ate`, `go build -o bin/ate-setup ./cmd/ate-setup`
+- **Release images**: `VERSION=TAG go run ./cmd/ate-setup publish release-images --ko-docker-repo REPO` (every image a pre-built install needs, all tagged `TAG`, including the docker-built `envoy-dataplane`)
 
 ### Testing and Verification
-- **Run Unit Tests**: `make test`
-- **Run E2E Tests**: `make e2e` (Requires GCP cluster setup and built images)
-- **Run Linters and Verifiers**: `make verify` (Includes `go vet` and checks for formatting, boilerplate headers, licenses, and go modules)
+- **Run Unit Tests**: `go test -race ./...`
+- **Run E2E Tests**: `hack/run-e2e.sh` (Requires a cluster with Agent Substrate installed; `hack/run-e2e-kind.sh` for kind)
+- **Run Linters and Verifiers**: `hack/verify-all.sh` (formatting, golangci-lint, boilerplate headers, licenses, go modules, generated code, and the metrics registry)
 
 ## Code Style Guidelines
 
-- **Go Formatting**: Code must be formatted with `gofmt`. Run `make fmt` to automatically format all files before submitting changes.
+- **Go Formatting**: Code must be formatted with `gofmt`. Run `hack/update/gofmt.sh` to automatically format all files before submitting changes.
 - **Copyright Headers**: All files must contain appropriate copyright and license headers. See templates in `hack/boilerplate/`.
 - **Modularity**: Submit small, focused Pull Requests that touch a limited part of the codebase for easier reviews and rebasing.
 - **Go Modules**: Ensure `go.mod` is clean. Run `go mod tidy` if adding or removing dependencies.
@@ -79,7 +78,7 @@ Do not add `reserved` statements to protos, deprecated aliases, fallbacks for ol
 
 `docs/metrics/registry/` is an [OpenTelemetry Weaver](https://github.com/open-telemetry/weaver) registry. `metrics.yaml` defines every metric instrument the ate system components emit, plus every attribute any signal uses and the permitted values of each. `events.yaml` defines the log events emitted over OTLP. Read them to find an instrument, an event, or their attributes.
 
-If you add or rename an instrument or an event, or add an attribute, follow `docs/dev/best-practices/metrics.md`, update the registry, and run `hack/verify/metrics.sh`. `make verify` runs the same check. Weaver reads the whole directory, so a new file in it is checked straight away.
+If you add or rename an instrument or an event, or add an attribute, follow `docs/dev/best-practices/metrics.md`, update the registry, and run `hack/verify/metrics.sh`. `hack/verify-all.sh` runs the same check. Weaver reads the whole directory, so a new file in it is checked straight away.
 
 Some attributes are defined in the registry but barred from metric labels: actor identity is the main one. The `note` on each says so, and `cardinality_rules` in `docs/metrics/substrate.yaml` is where the bar lives.
 
@@ -91,7 +90,7 @@ See the [metric registry](docs/observability.md#the-metric-registry) section of
 
 1. Write tests for all new code. We will not merge code that lacks tests.
 2. Ensure changes do not break existing tests.
-3. Run `make verify` locally before requesting a code review to catch common issues like missed copyright headers or formatting drift.
+3. Run `go test -race ./...` and `hack/verify-all.sh` locally before requesting a code review to catch common issues like missed copyright headers or formatting drift.
 4. For end-to-end tests involving the actual infrastructure, ensure you have a running cluster (setup via `hack/ate-dev-env.sh.example` and `go run ./tools/setup-gcp bootstrap`).
 5. A test that skips when a precondition is missing — Docker, a cluster, an artifact directory — must **fail** on it in CI, because a skip and a pass are the same exit code. Resolve strictness through a named predicate rather than an inline `os.Getenv("CI")`; `cmd/ateapi/internal/store/dockerenv.Required()` is the reference implementation. Prove the strict branch red before merging: a guard only ever observed passing is not known to guard anything. See `docs/dev/best-practices/ci-fail-closed.md`.
 

COLLABORATING.md

@@ -35,17 +35,6 @@ When writing, please strive for clarity and conciseness.  Not everyone in the
 community will have the same proficiency in English, so please be mindful of
 that when writing.
 
-## Always use Pull Requests
-
-Do not push directly to the main branch.  Always use pull requests to propose
-changes to the codebase.  This allows for code review and discussion before
-changes are merged, which helps maintain the quality of the codebase and
-fosters collaboration.
-
-### Merging PRs
-
-PRs should be merged by the reviewer of a PR, not the author.
-
 ### Using AI
 
 For the time being, the Substrate project uses the same AI contribution policy
@@ -76,8 +65,16 @@ project](https://www.kubernetes.dev/docs/guide/pull-requests/#ai-guidance):
 ## Code reviews
 
 We want to move quickly, but we need to balance that with quality and
-maintainability.  Code reviews are an important part of that process.  All PRs
-should be reviewed BEFORE they are merged.
+maintainability.  Code reviews are an important part of that process.
+
+Agent Substrate requires at least one approving GitHub review from a maintainer
+in order for the PR to be eligible for the merge queue.  It is allowable to use
+the "merge when ready" functionality to mark the PR as eligible for the merge
+queue as soon as all preconditions are met.
+
+Note that most changes to a PR will require a new approving review.  Use the
+"re-request review" button to automatically place the PR back into your
+reviewer's GitHub inbox.
 
 ### Code reviews across companies
 

CONTRIBUTING.md

@@ -31,7 +31,9 @@ The [Quickstart (Development)](README.md#quickstart-development) in the README
 covers bringing up a local cluster with the default (gVisor) runtime. To run
 the microVM runtime locally — which needs `/dev/kvm`, or Lima nested
 virtualization on Apple Silicon — see
-[docs/dev/microvm-local.md](docs/dev/microvm-local.md).
+[docs/dev/microvm-local.md](docs/dev/microvm-local.md). To measure where a
+suspend or resume spends its time on such a cluster, follow
+[docs/dev/suspend-resume-phase-breakdown.md](docs/dev/suspend-resume-phase-breakdown.md).
 
 ## Contribution process