feat(substrate): bump agent substrate to 0.0.7

[supreme-gg-gg]

Changes in this version (that affects Kagent):

• ActorTemplate spec became immutable -> delete golden actor and delete / recreate template on spec drift for sandbox agents and agent harness reconciler
• workerPoolRef removed from actor template -> kagent uses worker selector and SandboxClass instead; helm WorkerPool gets the kagent.dev/worker-pool: <name> label automatically
• runsc config decoupled from actor template -> removed relevant flags, they're owned by SandboxConfig now
• New PAUSED state and PauseActor RPC
• last_snapshot proto field replaced by lastest_snapshot_info

Installation note:

You will likely need to wipe stale actor states in Valkey due to the last change above (see below). If you still run into issues with agents not getting ready, delete and reapply them. Existing session data are persisted in Kagent DB, so it will not be lost.

# When getting actors, you will likely run into this error
kubectl ate get actors
# Error: failed to list actors: rpc error: code = Internal desc = internal server error

# Flush all Valkey primaries
kubectl exec -n ate-system valkey-cluster-0 -- valkey-cli FLUSHALL

[Copilot]

Pull request overview

This PR bumps the Agent Substrate dependency to v0.0.7 and updates kagent’s controller, API, Helm chart, and UI to match upstream breaking changes (immutable ActorTemplate.spec, removal of workerPoolRef, new pause states, and snapshot proto changes).

Changes:

• Add immutable-spec handling for Substrate ActorTemplate reconciliation (delete golden actor + recreate template on spec drift) and wire it through the generic reconciler path.
• Switch WorkerPool targeting from workerPoolRef to workerSelector/kagent.dev/worker-pool label; update Helm chart to stamp the label and expose WorkerPool customization.
• Update HTTP API + UI types/views for sandboxClass, workerSelector, workerPoolName, and latestSnapshotInfo; add PAUSING/PAUSED status handling.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
ui/src/types/index.ts	Updates UI-facing substrate types for selector/sandbox class and latest snapshot info.
ui/src/components/substrate/SubstrateStatusView.tsx	Updates the substrate status table columns to show sandbox class and worker selector.
helm/kagent/values.yaml	Removes deprecated runsc flags and adds WorkerPool sandbox class/labels/template options.
helm/kagent/templates/substrate-workerpool.yaml	Stamps the kagent.dev/worker-pool label and surfaces sandboxClass/template into the WorkerPool spec.
helm/kagent/templates/controller-deployment.yaml	Removes deprecated substrate runsc env var wiring from the controller deployment.
go/go.mod	Bumps the substrate replace target to v0.0.7 (and updates an indirect dependency).
go/go.sum	Updates checksums for the substrate bump and indirect dependency update.
go/core/pkg/sandboxbackend/substrate/list.go	Adds labels for the new PAUSING/PAUSED actor statuses.
go/core/pkg/sandboxbackend/substrate/lifecycle_test.go	Adds a unit test asserting ActorTemplate recreation on spec drift.
go/core/pkg/sandboxbackend/substrate/lifecycle_shared.go	Introduces WorkerPool label key constant + helper for generating a worker selector.
go/core/pkg/sandboxbackend/substrate/lifecycle_delete_test.go	Extends the fake ate client to satisfy new substrate client interface surface.
go/core/pkg/sandboxbackend/substrate/lifecycle_actortemplate.go	Implements immutable-spec reconciliation semantics for ActorTemplates; switches to worker selector + sandbox class fields.
go/core/pkg/sandboxbackend/substrate/delete_actor.go	Updates deletion state machine to handle PAUSING/PAUSED.
go/core/pkg/sandboxbackend/substrate/agents_backend.go	Adds backend entry point to reconcile ActorTemplates with immutable-spec semantics.
go/core/pkg/sandboxbackend/substrate/agentharness_actor.go	Treats PAUSING/PAUSED the same as suspended for resume behavior.
go/core/pkg/sandboxbackend/substrate/agent_lifecycle.go	Updates SandboxAgent ActorTemplate generation to use worker selector + sandbox class.
go/core/pkg/sandboxbackend/substrate/agent_actor.go	Treats PAUSING/PAUSED the same as suspended for resume behavior.
go/core/pkg/app/app.go	Removes substrate runsc configuration flags and wiring into lifecycle defaults.
go/core/internal/httpserver/handlers/substrate.go	Updates substrate status API payload for sandbox class/selector and latest snapshot info.
go/core/internal/httpserver/handlers/substrate_test.go	Updates tests for selector/sandbox class fields in the substrate status response.
go/core/internal/controller/reconciler/reconciler.go	Delegates ActorTemplate reconciliation to sandbox backend for immutable-spec drift handling and prevents accidental pruning.
go/api/httpapi/substrate.go	Updates HTTP API types to match the new status payload fields.
examples/substrate-openclaw/README.md	Updates installation docs and example manifests for substrate v0.0.7 and selector-based WorkerPool targeting.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[supreme-gg-gg]

Makes sense, added requeue logic

[supreme-gg-gg]

The scope of this PR should be gvisor only, perhaps in a follow up PR we can add microVM support

[EItanya]

We definitely need to split up these controllers ASAP. The behavior is too different

[EItanya]

We should separate these controllers in a follow-up, this is too specific to combine with the existing behavior IMO