Sync upstream runtime, AgentGateway, and documentation updates

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -47,7 +47,7 @@ body:
       label: Steps to Reproduce
       description: How can the issue be reproduced? Provide commands, scripts, or manifests (e.g., ActorTemplate).
       placeholder: |
-        1. Deploy Substrate with `hack/install-ate-kind.sh ...`
+        1. Deploy Substrate with `go run ./cmd/ate-setup --kind ...`
         2. Apply manifest `kubectl apply -f ...`
         3. Run command `...`
         4. See error

.github/SECURITY.md

@@ -37,8 +37,8 @@ include:
 
 ## What Counts as a Vulnerability
 
-See the [Security Guide](../docs/security.md) and
-[Threat Model](../docs/threat-model.md) for the security architecture, trust
+See the [Security Guide](../docs/security/security.md) and
+[Threat Model](../docs/security/threat-model.md) for the security architecture, trust
 boundaries, and assumptions this section is based on.
 
 In scope: the Agent Substrate control plane (`ateapi`, `atecontroller`,
@@ -81,7 +81,7 @@ from most to least severe:
 - Sample applications under `demos/` and load-testing harnesses under
   `benchmarking/`.
 - Documented scope boundaries and future capabilities listed in
-  [docs/security.md](../docs/security.md) at the time of your report. If you are
+  [docs/security/security.md](../docs/security/security.md) at the time of your report. If you are
   unsure whether a finding is covered by a documented limitation, report it
   privately anyway and let a maintainer make the call.
 

.github/scripts/release/ghcr-login.sh

@@ -14,8 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Logs docker in to ghcr.io as GITHUB_ACTOR with the token in TOKEN. ko and
-# ate-setup's registry checks read the credentials docker login stores.
+# Logs docker in to ghcr.io as GITHUB_ACTOR with the token in TOKEN. ko, buildx,
+# and ate-setup's registry checks read the credentials docker login stores.
 #
 #   GITHUB_ACTOR=<user> TOKEN=<token> .github/scripts/release/ghcr-login.sh
 #

.github/workflows/govulncheck.yaml

@@ -32,7 +32,6 @@ jobs:
         # The root module, then each module kept apart from it.
         work-dir:
           - .
-          - internal/plugins/gcp-secret-manager
     steps:
       - id: govulncheck
         uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0

.github/workflows/helm-e2e.yaml

@@ -74,12 +74,12 @@ jobs:
       run: helm upgrade --install substrate-crds charts/substrate-crds
     - name: Bootstrap mTLS authorities
       run: |
-        hack/install-ate-kind.sh create podcertificate-controller-cas
-        hack/install-ate-kind.sh create jwt-authority-pool
-        hack/install-ate-kind.sh create actor-id-ca-pool
-        hack/install-ate-kind.sh create actor-id-ca-certs
-        hack/install-ate-kind.sh create api-authentication-config
-        hack/install-ate-kind.sh create egress-mitm-ca-pool
+        go run ./cmd/ate-setup --kind create podcertificate-controller-cas
+        go run ./cmd/ate-setup --kind create jwt-authority-pool
+        go run ./cmd/ate-setup --kind create actor-id-ca-pool
+        go run ./cmd/ate-setup --kind create actor-id-ca-certs
+        go run ./cmd/ate-setup --kind create api-authentication-config
+        go run ./cmd/ate-setup --kind create egress-mitm-ca-pool
     - name: Install certificate controller
       run: |
         helm upgrade --install substrate-podcert charts/substrate-podcert \
@@ -100,24 +100,26 @@ jobs:
           --set image.registry=localhost:5001 \
           --set image.tag=helm-e2e \
           --set 'preview[0]=ALL' \
+          --set 'atenetRouter.ingressAllowedSPIFFEIDs[0]=spiffe://cluster.local/ns/ate-e2e-router-client/sa/router-client' \
           --set 'atelet.extraArgs[0]=--localhost-registry-replacement=kind-registry:5000' \
+          --set 'atelet.extraArgs[1]=--snapshot-upload-delay=2s' \
           --set otel.endpoint=http://opentelemetry-collector.otel-system.svc:4317 \
           --wait --timeout=10m
     - name: Enable NFS
       run: |
         sudo modprobe nfs || true
         sudo modprobe nfsd || true
     - name: Install CSI NFS driver
-      run: hack/install-ate-kind.sh setup csi nfs
+      run: go run ./cmd/ate-setup --kind setup csi nfs
     - name: Deploy micro-VM counter demo
       # The deploy creates the substrate ActorTemplate and waits for its golden
       # snapshot internally; the ActorTemplate CRD (and its Ready condition)
       # no longer exists to wait on.
       run: hack/run-microvm-demo-kind.sh --skip-control-plane
     - name: Deploy gVisor counter demo
-      run: hack/install-ate-kind.sh deploy demo counter
+      run: go run ./cmd/ate-setup --kind deploy demo counter
     - name: Deploy egress demo
-      run: hack/install-ate-kind.sh deploy demo egress
+      run: go run ./cmd/ate-setup --kind deploy demo egress
     - name: Trust local E2E TLS origins
       run: hack/setup-e2e-egress-tls-kind.sh
     - name: Run E2E tests (gVisor)

.github/workflows/pr-workflow.yaml

@@ -85,22 +85,6 @@ jobs:
           --jsonfile "${ARTIFACTS}/junittool.json" \
           --format pkgname-and-test-fails --format-hide-empty-pkg \
           -- -race ./...
-    # Kept apart from the root module so it can move to its own repository.
-    - name: gcp-secret-manager credential provider tests
-      working-directory: internal/plugins/gcp-secret-manager
-      run: |
-        go -C ../../../tools/junittool run . register "${ARTIFACTS}/gcp-secret-manager.xml"
-        ../../../hack/run-tool.sh gotestsum --junitfile "${ARTIFACTS}/gcp-secret-manager.xml" \
-          --jsonfile "${ARTIFACTS}/gcp-secret-manager.json" \
-          --format pkgname-and-test-fails --format-hide-empty-pkg \
-          -- -race ./...
-    # The root verifiers stop at the module's go.mod, so it gets its own run:
-    # gofmt, go vet and the tidy check, then golangci-lint with the root config.
-    - name: gcp-secret-manager credential provider verify
-      working-directory: internal/plugins/gcp-secret-manager
-      run: |
-        make verify
-        ../../../hack/run-tool.sh golangci-lint run --config ../../../.golangci.yaml ./...
     - name: Cache cargo
       uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
@@ -173,6 +157,9 @@ jobs:
         preview: ['off', 'on']
     env:
       E2E_ATENET_DATAPLANE: ${{ matrix.dataplane }}
+      # Apply the e2e test component (short atelet snapshot delays) across the
+      # initial install and the control plane redeploy in run-microvm-demo-kind.sh.
+      ATE_INSTALL_E2E_TUNING: "true"
       # The installer requires a credential provider selection, and deploys the
       # bundled Kubernetes Secrets provider with the control plane. Job-wide
       # because every ate-setup invocation reads it, including the control
@@ -262,55 +249,28 @@ jobs:
       # gateway. ATE_PREVIEW above selects the preview features.
       env:
         ATE_ATENET_DATAPLANE: ${{ matrix.dataplane }}
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
-      run: go run ./cmd/ate-setup deploy ate-system --rollout-timeout=300s
+      run: go run ./cmd/ate-setup --kind deploy ate-system --rollout-timeout=300s
     - name: Enable NFS
       # Load NFS kernel modules so in-cluster NFS server and CSI driver can run.
       run: |
         sudo modprobe nfs || true
         sudo modprobe nfsd || true
     - name: Install CSI NFS driver
-      env:
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
-      run: go run ./cmd/ate-setup setup csi nfs
+      run: go run ./cmd/ate-setup --kind setup csi nfs
     - name: Deploy micro-VM counter demo
       # Stages the (cached) assets into the cluster's rustfs and deploys the
       # counter-microvm demo onto the control plane installed above.
       run: hack/run-microvm-demo-kind.sh --skip-control-plane
     - name: Deploy gVisor counter demo
-      env:
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
-      run: go run ./cmd/ate-setup deploy demo counter
+      run: go run ./cmd/ate-setup --kind deploy demo counter
     - name: Deploy egress demos
       # TestActorEgress in the networking suite builds its Actor from the egress
       # ActorTemplate for the class under test, so both fixtures have to exist
       # before their respective lane runs. The demo's actors trust the CA the
       # gateway mints its leaves from.
-      env:
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
       run: |
-        go run ./cmd/ate-setup deploy demo egress
-        go run ./cmd/ate-setup deploy demo egress-microvm
+        go run ./cmd/ate-setup --kind deploy demo egress
+        go run ./cmd/ate-setup --kind deploy demo egress-microvm
     - name: Trust local TLS origins in egress gateway
       run: hack/setup-e2e-egress-tls-kind.sh
     # scale the idle sandbox class's demo pools to zero so each lane has the node

.github/workflows/release.yaml

@@ -80,9 +80,15 @@ jobs:
         # These jobs can write packages or releases, so they restore no cache
         # that another workflow could have written.
         cache: false
-    # Every release image is built with ko, which cross-compiles Go for arm64
-    # without emulation, so the job needs neither QEMU nor buildx. ko and
-    # ate-setup's registry checks read the credentials docker login stores.
+    # ko cross-compiles Go for arm64, and the envoy-dataplane Dockerfile
+    # cross-compiles its Rust module, so the job needs no QEMU. buildx builds
+    # envoy-dataplane for both platforms. ko, buildx, and ate-setup's registry
+    # checks read the credentials docker login stores. BuildKit is pinned by
+    # digest because it builds a published image with the ghcr.io login.
+    - name: Set up buildx
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      with:
+        driver-opts: image=moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea
     - name: Log in to ghcr.io
       env:
         TOKEN: ${{ github.token }}
@@ -129,6 +135,17 @@ jobs:
         # These jobs can write packages or releases, so they restore no cache
         # that another workflow could have written.
         cache: false
+    # The same BuildKit as the images job. Host networking and plain HTTP let
+    # buildx push to the registry service.
+    - name: Set up buildx
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      with:
+        driver-opts: |
+          image=moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea
+          network=host
+        buildkitd-config-inline: |
+          [registry."localhost:5000"]
+            http = true
     - name: Publish images
       run: go run ./cmd/ate-setup publish release-images
   draft:

.github/workflows/site.yaml

@@ -0,0 +1,120 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Builds the website in site/ on every pull request that could change it, and
+# publishes it to GitHub Pages from main.
+name: site
+on:
+  pull_request:
+    paths:
+      - 'site/**'
+      - 'docs/**'
+      - 'demos/*/README.md'
+      - 'tools/site-content/**'
+      - 'tools/site-release-data/**'
+      - 'hack/site.sh'
+      - 'hack/test-site-templates.sh'
+      - '.github/workflows/site.yaml'
+  push:
+    branches: [main]
+    paths:
+      - 'site/**'
+      - 'docs/**'
+      - 'demos/*/README.md'
+      - 'tools/site-content/**'
+      - 'tools/site-release-data/**'
+      - 'hack/site.sh'
+      - 'hack/test-site-templates.sh'
+      - '.github/workflows/site.yaml'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+env:
+  # Keep in sync with module.hugoVersion.min in site/hugo.yaml.
+  HUGO_VERSION: 0.163.3
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      with:
+        # site-release-data needs the latest release tag and its history.
+        fetch-depth: 0
+    - name: Setup Go
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        # The root module, for tools/site-release-data. Hugo fetches Docsy
+        # with the same Go.
+        go-version-file: 'go.mod'
+        cache: false
+    - name: Setup Node
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: 22
+        cache: npm
+        cache-dependency-path: site/package-lock.json
+    - name: Install Hugo
+      run: |
+        base="https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}"
+        tarball="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
+        cd "${RUNNER_TEMP}"
+        curl -sSfLO "${base}/${tarball}"
+        curl -sSfLO "${base}/hugo_${HUGO_VERSION}_checksums.txt"
+        grep " ${tarball}\$" "hugo_${HUGO_VERSION}_checksums.txt" | sha256sum -c -
+        mkdir -p hugo && tar -xzf "${tarball}" -C hugo hugo
+        echo "${RUNNER_TEMP}/hugo" >> "${GITHUB_PATH}"
+    - name: Install PostCSS
+      working-directory: site
+      run: npm ci
+    - name: Generate site content
+      run: hack/site.sh content
+    - name: Generate release data
+      run: hack/site.sh release-data
+    - name: Test templates
+      if: github.event_name == 'pull_request'
+      run: hack/test-site-templates.sh
+    - name: Configure Pages
+      id: pages
+      if: github.event_name != 'pull_request'
+      uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+    - name: Build
+      working-directory: site
+      env:
+        BASE_URL: ${{ steps.pages.outputs.base_url }}
+      run: hugo build --environment production --minify ${BASE_URL:+--baseURL "${BASE_URL}/"}
+    - name: Upload artifact
+      if: github.event_name != 'pull_request'
+      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+      with:
+        path: site/public
+  deploy:
+    if: github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+    - name: Deploy to GitHub Pages
+      id: deployment
+      uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1