Issues

• Reject trailing YAML documents in actor-template create manifests

  agent-substrate/substrate#2156 · Filter by author dajiaohuang opened on Oct 3, 2026

• Close the initial GCS range reader when closing rangedReader

  agent-substrate/substrate#2155 · Filter by author dajiaohuang opened on Oct 3, 2026

• Delete final-round GCS compose inputs after successful uploads

  agent-substrate/substrate#2154 · Filter by author dajiaohuang opened on Oct 3, 2026

• Skip ClusterTrustBundle updates when the desired state already matches

  agent-substrate/substrate#2153 · Filter by author dajiaohuang opened on Oct 3, 2026

• docs/api-guide.md: "an actor occupies its whole worker" contradicts multi-actor workers

  agent-substrate/substrate#2152 · Filter by author whysosuresh opened on Oct 3, 2026

• sdsmint egress gateway: an intercepted TLS connection is sometimes matched to another tunnel's cleartext destination and dropped (filter_chain_not_found)

  agent-substrate/substrate#2151 · Filter by author whysosuresh opened on Oct 3, 2026

• Inject permission for ATE System components on ATE API server bootstrap

  agent-substrate/substrate#2149 · Filter by author SHRUTI6991 opened on Oct 2, 2026 · M3

• Decouple ateom-microvm from shell utilities to enable distroless:static and eliminate 110 CVEs

  area/nodearea/security
  agent-substrate/substrate#2146 · Filter by author destijl opened on Oct 2, 2026
  

• Hardening gVisor sandbox configuration against CPU side-channel risks and binary mismatches

  area/gvisorarea/security
  agent-substrate/substrate#2136 · Filter by author destijl opened on Oct 2, 2026 · M3
  

• [Bug]: actorcrash while modifying workerpool replicas from 4 to 2

  area/api-machineryarea/reliabilitykind/bug
  agent-substrate/substrate#2130 · Filter by author linsun opened on Oct 2, 2026
  

• The scheduler text and ErrNoCapacity still say "free worker"

  area/observabilitykind/cleanup
  agent-substrate/substrate#2128 · Filter by author JeffLuoo opened on Oct 2, 2026 · M3
  

• The router reports a shed request as unavailable after a full fleet

  area/networkarea/observabilitybug-bashkind/bugprio/P2
  agent-substrate/substrate#2127 · Filter by author JeffLuoo opened on Oct 2, 2026 · M3
  

• [Bug]: the version cmd only prints ate plugin version

  area/clikind/bugprio/P2
  agent-substrate/substrate#2126 · Filter by author linsun opened on Oct 2, 2026
  

• Public Documentation with Limitations

  kind/docs
  agent-substrate/substrate#2106 · Filter by author SHRUTI6991 opened on Oct 2, 2026 · M3

• E2E Test, Manual Test, Security Regression Test across all authorization runtime check

  area/securityarea/testskind/feature
  agent-substrate/substrate#2103 · Filter by author SHRUTI6991 opened on Oct 2, 2026 · M3

• ActorTemplate: replace on_pause/on_commit/on_resume with capture_scope and minimum_resume_scope

  area/apiarea/api-machinerykind/featureprio/P0
  Task

  agent-substrate/substrate#2102 · Filter by author zoez7 opened on Oct 2, 2026 · M3
  

• Minimum Postgres security posture For GA

  area/api-machineryarea/securitykind/feature
  agent-substrate/substrate#2097 · Filter by author EItanya opened on Oct 1, 2026 · M3
  2

  

• [Security] Unvalidated CDI Host Mounts & RuntimeAssetPaths in ateom

  area/nodearea/securitykind/bug
  agent-substrate/substrate#2091 · Filter by author destijl opened on Oct 1, 2026 · M3
  3

  

• [Security] Arbitrary Device Node Creation and Unfiltered Overlay Xattrs in Snapshot Tar

  area/nodearea/securitykind/bug
  agent-substrate/substrate#2090 · Filter by author destijl opened on Oct 1, 2026 · M3
  2

  

• [Security] ServiceAccount and Node Identity Spoofing in podcertcontroller

  area/identityarea/securitykind/bug
  agent-substrate/substrate#2089 · Filter by author destijl opened on Oct 1, 2026
  1

• [Security] Rogue Worker Pod Registration via Unverified Pod Label Selector

  area/schedulingarea/securitykind/bug
  agent-substrate/substrate#2088 · Filter by author destijl opened on Oct 1, 2026
  3

• [Security] Unauthenticated Actor Ingress and Cross-Tenant Wakeup via atenet-router

  area/networkarea/securitykind/bug
  agent-substrate/substrate#2087 · Filter by author destijl opened on Oct 1, 2026 · M3
  2

  

• [Security] SSRF via atenet-egress Allows Actors to Reach Cloud Metadata & Internal APIs

  area/networkarea/securitykind/bug
  agent-substrate/substrate#2086 · Filter by author destijl opened on Oct 1, 2026
  2

  

• [Security] Sandbox Asset Cache TOCTOU / Cache Poisoning via Writable BasePath

  area/gvisorarea/securitykind/bug
  agent-substrate/substrate#2085 · Filter by author destijl opened on Oct 1, 2026
  1

• [Security] WorkerPool Privilege Laundering into Root SYS_ADMIN HostPath Pods

  area/securitykind/bug
  agent-substrate/substrate#2084 · Filter by author destijl opened on Oct 1, 2026
  2