[danielle-mustillo]

Why

Agents with skills from git or S3 never become Ready. They fail with GoldenActorCrashed.

The golden actor is the first copy of an Agent, and each session starts from its snapshot. The golden actor downloads git and S3 skills when it starts. It has no egress policy, so Substrate blocks the download. The Agent's egressPolicyRefs apply only to sessions.

We found this while testing the example Agents in #3417.

What changed

• The ActorTemplate sets golden_egress_policy. The policy allows only the git and S3 hosts of the Agent's skills, including skills of its shared agents.
• kagent install turns on Substrate's GoldenEgressPolicy preview gate, which Substrate needs to accept the policy.
• If the gate is off, the Agent reports ActorTemplateRejected and names the gate. The controller keeps retrying, so the Agent becomes Ready after you turn on the gate. Other validation errors still stop retrying.

Agents without git or S3 skills don't change.

Example

An AgentTemplate with a git skill:

apiVersion: api.kagent.dev/v1alpha3
kind: AgentTemplate
metadata:
  name: <name>
spec:
  # ...
  skills:
    - name: review
      source:
        git:
          url: https://github.com/<org>/<repo>.git
          commit: <40-character commit SHA>

kagent now adds this to the compiled ActorTemplate:

golden_egress_policy:
  rules:
    - https:
        hostnames: [github.com]
        ports: {numbers: [443]}

The Agent's Ready condition:

Substrate	Before	After
GoldenEgressPolicy gate on	False, GoldenActorCrashed	True
GoldenEgressPolicy gate off	False, GoldenActorCrashed	False, ActorTemplateRejected, names the gate

Known limits

• If you install Substrate yourself, add GoldenEgressPolicy to its Helm preview list.
• S3 on a non-default port fails with 403 SignatureDoesNotMatch, because Substrate's egress gateway drops the port from the Host header.

Testing

On Kind with kagent install, Agents with GitHub skills and an S3 skill become Ready, and load_skill returns the skill. On main they fail with GoldenActorCrashed. With the gate off, the Agent shows the gate message, then becomes Ready once the gate is on.