[EItanya]

Upgrade Substrate from v0.7.0-alpha2 to v1.0.0-rc1. Rc1 requires mTLS for actor ingress, so A2A and sandbox guest calls now use the existing Substrate CA bundle and rotating controller certificate. The installer selects the HTTPS router endpoint and allows the rendered controller ServiceAccount's SPIFFE identity.

Update the vendored schema, generated bindings, and snapshot consumers for SnapshotStorage.state / SnapshotStorageState. Installer, worker, and CI versions continue to come from the Go module pin. Rc1 also honors the image user, so the shared Go runtime image now provisions /config for UID 65532. Codex, Claude, and sandbox images start in /data so their entrypoints create the workspace as the runtime user after the durable volume is mounted. CI captures worker logs before smoke startup.

make proto-breaking is expected to fail on the upstream snapshot field/enum rename and removal of MintActorCertificate. The compatibility gate stays unchanged; merging this upgrade requires an override. Existing installations also need to reset Substrate's node-local image cache as described in the updated Helm upgrade notes.

Actor ingress with rc1

flowchart LR
    installer["Kagent installer"] -->|"Controller SPIFFE allowlist"| router["Substrate router"]
    a2a["A2A gateway"] -->|"gRPC over mTLS"| router
    guest["Sandbox guest client"] -->|"gRPC over mTLS"| router
    router -->|"Route by ate-target-actor"| actor["Actor runtime"]

Loading

Validation:

• Full local gVisor E2E suite passed (634s), including idle expiration and cross-namespace credential delivery across kagent, Codex, Claude, and BYO.
• Both gVisor and microVM CI E2E jobs passed on 73577cda8.
• Full Go race suite and Go lint passed, including mTLS certificate rotation and rejection tests.
• All 340 Helm tests and chart lint passed.
• UI typecheck and lint passed. All 697 UI tests passed on rerun after three initial timing failures; unchanged main also passed all 697.
• CLI build and installation dry run passed against the published rc1 charts. Rendered controller and router settings agree on mTLS identity and trust.
• Protobuf lint and generation passed; the vendored schema matches rc1 exactly.
• Reproduced the Go image startup permission failure, then verified the fixed production image reaches /readyz as UID 65532 and writes config files with mode 0600. Focused config tests and E2E workflow syntax checks passed.
• Reproduced Codex and Claude workspace ownership failures with fresh /data mounts. All three native/sandbox images now pass readiness and create writable workspaces owned by UID 65532; native workspace mode is 0700.