rename ateom -> ateworker by BenTheElder · Pull Request #2254 · agent-substrate/substrate

Benjamin Elder (BenTheElder) · 2026-10-06T18:07:02Z

The PR title becomes the release note. Write it for users: what changed for them, not how the code changed.

Breaking change

fixes #2065

renames ateom ahead of GA. this is breaking, atelet and the worker images need to be updated together.

images / binaries: ateom-gvisor, ateom-microvm -> ateworker-gvisor, ateworker-microvm
worker pod container: ateom -> worker
RPCs: ateom.Ateom -> ateworker.Worker, atelet.AteomSupport -> atelet.WorkerSupport, atelet.AteomHerder -> atelet.Atelet, MintAteomActorCertificate -> MintWorkerActorCertificate
SPIFFE path: ateom-for-actor -> worker-for-actor
ate.snapshot.phase values: ateom_restore, ateom_checkpoint -> worker_restore, worker_checkpoint
node paths: /var/lib/ate/ateoms//ateom.sock -> workers//worker.sock, ateom-support.sock -> worker-support.sock
cgroups: the worker's leaf ateom -> worker, the micro-VM guest's /ateomchv -> /actor
authz relation: can_mint_ateom_actor_credential -> can_mint_worker_actor_credential

per review, "worker" where any worker implementation fits and "ateworker" for ours.

the internal go packages (internal/ateom*) keep their names for now, that's a follow-up.

one commit per rename to make review easier.

tested with kind e2e (gVisor + micro-VM) on an earlier rebase, plus CI.

This PR was AI assisted. I have reviewed the changes.

It's a good idea to open an issue first for discussion.

Tests pass
Appropriate changes to documentation are included in the PR

wiz-alphabet · 2026-10-06T18:08:41Z

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	2
SAST Findings	4
Software Management Findings	-

Total	2 4

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

Tim Hockin (thockin)

TL;DR: the places where we just refer to the abstract idea of "a worker" should just say "worker". E.g. if someone could replace our baked-in ateworker with their own worker and the sentence would still make sense, "worker". "ateworker" should refer to specifically our main implementation(s).

But also, most of this is internal - comments etc. Focus on public facing stuff -- proto names and methods and the SPIFFE stuff.

Tim Hockin (thockin) · 2026-10-06T22:03:20Z

  // on behalf of a particular actor.
  //
-  // SPIFFE URI: spiffe://${trustdomain}/ateom-for-actor/${atespace}/${actor}
-  rpc MintAteomActorCertificate(MintAteomActorCertificateRequest) returns (MintAteomActorCertificateResponse);
+  // SPIFFE URI: spiffe://${trustdomain}/ateworker-for-actor/${atespace}/${actor}


This is a very consequential one - should SPIFFE say "ateworker" or "worker"? I think "worker".

Tim Hockin (thockin) · 2026-10-06T22:10:51Z

 	return &url.URL{
 		Scheme: "spiffe",
 		Host:   ActorSPIFFETrustDomain,
 		// TODO(identity): Prefix with "atunnel" to prevent
 		// confusion between atunnel and an actor pretending to be
 		// an atunnel.
-		Path: path.Join("ateom-for-actor", r.Atespace, r.Name),
+		Path: path.Join("ateworker-for-actor", r.Atespace, r.Name),


Taahir Ahmed (@ahmedtd) this is a decision that will stick for a long time?

Benjamin Elder (BenTheElder) · 2026-10-07T01:11:14Z

TL;DR: the places where we just refer to the abstract idea of "a worker" should just say "worker". E.g. if someone could replace our baked-in ateworker with their own worker and the sentence would still make sense, "worker". "ateworker" should refer to specifically our main implementation(s).

Agree.

But also, most of this is internal - comments etc. Focus on public facing stuff -- proto names and methods and the SPIFFE stuff.

Yeah that makes sense, we can punt internal cleanups to later.

Benjamin Elder (BenTheElder) · 2026-10-07T01:33:22Z

I do think we should rename the internal packages to match and that's going to cause churn but we can do that separately from nailing down the user-visible renames.

Lior Lieberman (LiorLieberman) · 2026-10-13T19:05:40Z

 				// TODO(identity): Must be configurable per-install, so that each install can set it to a unique value.
 				Host: "substrate-actor.local",
-				Path: path.Join("ateom-for-actor", dbActor.GetMetadata().GetAtespace(), dbActor.GetMetadata().GetName()),
+				Path: path.Join("worker-for-actor", dbActor.GetMetadata().GetAtespace(), dbActor.GetMetadata().GetName()),


is worker a process?

I think its weird to call it "worker-for-actor". As the side that validates it, I want to make sure I know that this is a specific process on the worker..

As the side that validates it, I want to make sure I know that this is a specific process on the worker..

There isn't one ... only the actors sandbox. The worker process overseeing those is multi-tenant.

ate-worker [per worker pod] -> gvisor [per actor]

if ate-worker is a specific pod, (and it is. cause I undersatnd you are only doing a rename) call it ate-worker-for-actor

See #2254 (review), I think it's sort of an open architecture debate if you can bring your own worker implementation and get this cert or if we'd only allow it with our own implementation?

We can of course rename things again, but #2254 (comment) was Tim's take to call this worker and not ateworker.

If we had a worker which implemented all the right APIs but wasn't literally the ateworker binary we ship -- would we still issue a cert?

ateom was named when it hosted one actor, workers now host many

the package name is part of every method name on the wire

AteomHerder, which ateapi calls to drive actors on a node, becomes Atelet

…ctor*

it runs whatever image the WorkerPool names

the worker's own leaf is now worker, the micro-VM guest's container parent is now /actor

- /var/lib/ate/ateoms/<uid> -> workers/<uid>, ateom.sock -> worker.sock - ateom-support.sock -> worker-support.sock - run-ateom and ateom-dir -> ate-base, ateom-capacity -> worker-capacity

(not the internal go package names, yet ...)

Benjamin Elder (BenTheElder) · 2026-10-15T04:32:15Z

#2700 handles the internal package cleanup, fixing all remaining ateom

Follow-up to agent-substrate#2254, renames the remaining internal/ateom* go packages. After this change there is no `ateom` left in the repo. 🫡 - Worker only packages move under `internal/ateworker`: register (the registration code, leaving `internal/ateworker` itself for the shared worker code), cgroup, pid1 (was ateominit), actornet (was ateomnet), phaselog, suspend, tunnel - Two packages go flat instead: `internal/workerstats`, which atelet also imports, and `internal/netns`, a generic named netns helper that atunnel's tests also use - The downward API file names atecontroller needs move to `internal/workercapacity`, so it doesn't import the worker registration code - `depguard` (`golangci-lint`) now fails any import of `internal/ateworker` outside `cmd/ateworker-*` and `internal/ateworker` - Drops an unused stopwatch package - Renames cmd/atelet's ateom* files The move commits are only `git mv`, imports and package names are fixed in a separate commit after each round of moves, to make it clear which changes are just file moves and which changes are import rewrites etc. We squash merge, so the intermediate commits don't need to build. This PR was AI assisted. I have reviewed the changes.

Benjamin Elder (BenTheElder) added area/gvisor area/microVM area/api-machinery breaking-change PRs with breaking changes labels Oct 6, 2026

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch 3 times, most recently from cbdecb7 to 8964f28 Compare October 6, 2026 20:53

Benjamin Elder (BenTheElder) commented Oct 6, 2026

View reviewed changes

Comment thread benchmarking/deploy_locust.sh Outdated

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch from 8964f28 to a6d3602 Compare October 6, 2026 21:05

Tim Hockin (thockin) reviewed Oct 6, 2026

View reviewed changes

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch 6 times, most recently from 4702dca to 235c262 Compare October 13, 2026 18:02

Lior Lieberman (LiorLieberman) reviewed Oct 13, 2026

View reviewed changes

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch 2 times, most recently from 15fd4ff to 657a007 Compare October 13, 2026 23:58

Benjamin Elder (BenTheElder) assigned Julian Gutierrez Oschmann (juli4n) and Tim Hockin (thockin) Oct 14, 2026

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch 6 times, most recently from 848ac0e to a0c5e5d Compare October 14, 2026 03:15

Benjamin Elder (BenTheElder) added 15 commits October 14, 2026 19:47

rename ateom binaries and images to ateworker

6551644

ateom was named when it hosted one actor, workers now host many

rename ateom proto package to ateworker

949254d

the package name is part of every method name on the wire

rename worker services to Worker, WorkerSupport and Atelet

62ba273

AteomHerder, which ateapi calls to drive actors on a node, becomes Atelet

rename MintAteomActorCertificate and MintAteomActorJwt to MintWorkerA…

2af66df

…ctor*

rename ateom-for-actor SPIFFE path to worker-for-actor

a8d0eaf

say worker instead of ateom in proto docs

70d9df2

rename the worker pod's ateom container to worker

0083c8f

it runs whatever image the WorkerPool names

rename ateom snapshot phases to worker_restore and worker_checkpoint

2cfea72

say worker or ateworker in user facing errors, docs and manifests

dcf5935

rename ateworker-microvm phase timing keys to ateworker.actor.*

c5adc69

say worker or ateworker in logs and flag help

713998f

rename ateom cgroups

e6c598e

the worker's own leaf is now worker, the micro-VM guest's container parent is now /actor

rename ateom node paths and volumes

61cd01c

- /var/lib/ate/ateoms/<uid> -> workers/<uid>, ateom.sock -> worker.sock - ateom-support.sock -> worker-support.sock - run-ateom and ateom-dir -> ate-base, ateom-capacity -> worker-capacity

rename ateom in scripts, config and docs

be14c4e

rename ateom in go identifiers, strings and comments

4422ca5

(not the internal go package names, yet ...)

Benjamin Elder (BenTheElder) dismissed Tim Hockin (thockin)’s stale review via 4422ca5 October 15, 2026 02:52

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch from 59550af to 4422ca5 Compare October 15, 2026 02:52

Haven Xia (HavenXia) approved these changes Oct 15, 2026

View reviewed changes

Haven Xia (HavenXia) disabled auto-merge October 15, 2026 02:57

Haven Xia (HavenXia) enabled auto-merge October 15, 2026 02:57

Haven Xia (HavenXia) added this pull request to the merge queue Oct 15, 2026

Merged via the queue into agent-substrate:main with commit 63a17a9 Oct 15, 2026
15 of 18 checks passed

Benjamin Elder (BenTheElder) mentioned this pull request Oct 15, 2026

ateworker internal packages cleanup #2700

Merged

Benjamin Elder (BenTheElder) deleted the rename-ateom branch October 15, 2026 04:32

Haven Xia (HavenXia) mentioned this pull request Oct 15, 2026

CI: Add the upgrade E2E test for each release #2712

Open

2 tasks

Haowei Cai (Roy) (roycaihw) mentioned this pull request Oct 16, 2026

benchmarking: add memory working set to server telemetry #2386

Merged

2 tasks done

Benjamin Elder (BenTheElder) mentioned this pull request Oct 16, 2026

fix atelet dashboard queries ai-on-gke/substrate-gke#60

Merged

Conversation

Benjamin Elder (BenTheElder) commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Breaking change

Uh oh!

wiz-alphabet Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

Uh oh!

Tim Hockin (thockin) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Tim Hockin (thockin) Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Tim Hockin (thockin) Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Benjamin Elder (BenTheElder) commented Oct 7, 2026

Uh oh!

Benjamin Elder (BenTheElder) commented Oct 7, 2026

Uh oh!

Lior Lieberman (LiorLieberman) Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Benjamin Elder (BenTheElder) Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Benjamin Elder (BenTheElder) Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Lior Lieberman (LiorLieberman) Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Benjamin Elder (BenTheElder) Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Benjamin Elder (BenTheElder) Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Tim Hockin (thockin) Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Benjamin Elder (BenTheElder) commented Oct 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Benjamin Elder (BenTheElder) commented Oct 6, 2026 •

edited

Loading

wiz-alphabet Bot commented Oct 6, 2026 •

edited

Loading

Benjamin Elder (BenTheElder) Oct 13, 2026 •

edited

Loading

Tim Hockin (thockin) Oct 15, 2026 •

edited

Loading