agent-platform release v4.71.0

Added

• The Substrate bootstrap mints a fifth pool, egress-mitm-ca-pool (ECDSA P-256) in ate-system (giantswarm/giantswarm#37705). The Substrate line from 1.1.0 (kagent-dev/substrate v0.2.0-beta4) terminates and re-originates every TLS connection an actor opens and injects the agents’ credentials into the request at the egress gateway; the egress Deployment mounts this pool and does not start without it. The actors trust its roots through the egress-mitm.ate.dev trust bundle kagent projects. A pool that exists is kept, like the other four.
• substrate.credentialProvider.namespacePolicies, the namespaces the Substrate credential provider may read Secrets from, one entry per namespace that hosts AgentTemplates and one for ate-golden (default: the kagent namespace for both). The egress gateway of the Substrate line from 1.1.0 injects an agent’s credentials from Secrets next to its AgentTemplate; without the grant every model call of the namespace fails. The golden actor of every template boots in Substrate’s atespace ate-golden and fetches the template’s private git skills with the template’s credential, so ate-golden is allowed the same namespaces; without it the golden boot of a template with a private skill fails with git’s 403.
• A Kyverno PolicyException for the Substrate credential provider (substrate-credential-provider, check-seccomp-strict) (giantswarm/giantswarm#37705). The k8s-credential-provider Deployment of Substrate 1.1.0 runs non-root with every capability dropped but declares no seccompProfile; without the exception the restricted policy denies it on the fleet. make verify-kyverno holds the rule list to the rendered pod spec.
• kagent.harness.compaction, the context compaction of every agent the platform Harness admits (tokenThreshold: 24000, eventRetentionSize: 4, the values the Generic agent chart rendered per AgentTemplate). kagent-dev/kagent#2790 put compaction on Harness.spec.kagent.compaction; the kagent line from 1.1.0 renders the block from this value and the AgentTemplate has no such field any more.

Changed

• components.kagent*.versionRange and components.substrate*.versionRange are >=1.1.0 <1.2.0, agent-manager.agentChart.semver is >=1.5.0 <2.0.0 (was >=1.0.0 <1.5.0); the example BOM pins 1.1.0 (giantswarm/giantswarm#37705). The kagent line’s 1.1.0 is upstream main@1069fd2 (2026-09-24) on the Substrate line’s 1.1.0, kagent-dev/substrate v0.2.0-beta5 plus the carried patches, the contract the values of this release are written for (the egress MITM pool, the registry split, the credential provider’s policies, the Harness compaction); the 1.0 lines stay on their release-1.0 branches for the installations that do not move yet. Generic agent chart 1.5.0 renders no spec.context.compaction, which this kagent refuses, so the agent chart floor moves with the lines. Proven on agentlab on the lines’ dev builds: platform-test, a2a-test, skills-test public and private, agents-test.
• substrate.image.registry is the registry host only, gsoci.azurecr.io, and the new substrate.image.repository the path under it, giantswarm/substrate (the Substrate chart’s registry/repository split, kagent-dev/substrate df5265f9, in the line from 1.1.0; the chart refuses a registry that carries a path). The derived worker image follows both, <registry>/<repository>/ateom-gvisor:<floor>. A mirror moves the registry alone.