Rachael-Graham · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/docs-site/assets/kagent-docs/versions/kagent.md b/docs-site/assets/kagent-docs/versions/kagent.md
@@ -1 +1 @@
-{{< version include-if="0.x" >}}0.10.2{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha12{{< /version >}}
+{{< version include-if="0.x" >}}0.10.3{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha12{{< /version >}}
diff --git a/docs-site/content/kagent/0.x/introduction/installation.md b/docs-site/content/kagent/0.x/introduction/installation.md
@@ -468,6 +468,28 @@ When unset, the `registry` and `pullPolicy` fields of `agentImage` and `goAgentI
 
 > **Note**: If you set only `agentImage` without also setting `controller.goAgentImage`, Go declarative agents still try to pull the Go ADK image from its default location, `ghcr.io`. The controller logs a startup warning when the two image registries differ.
 
+#### Digest-pinned image tags
+
+Agents that declare skills, agents that set `declarative.executeCodeBlocks: true`, and BYO agents that run in a sandbox pull the full runtime image instead of the slim one. The controller derives the full image by appending `-full` to the tag name, because the slim and full images have separate manifests and cannot share a digest.
+
+When `agentImage.tag` or `goAgentImage.tag` embeds a digest, such as `0.10.3@sha256:...`, you must also set the matching `fullDigest` value. Without it, the controller fails reconciliation for every agent that needs the full image rather than falling back to a mutable tag.
+
+```yaml
+controller:
+  agentImage:
+    registry: my-registry.example.com
+    repository: kagent/app
+    tag: 0.10.3@sha256:<slim Python image digest>
+    fullDigest: sha256:<full Python image digest>
+  goAgentImage:
+    registry: my-registry.example.com
+    repository: kagent/golang-adk
+    tag: 0.10.3@sha256:<slim Go image digest>
+    fullDigest: sha256:<full Go image digest>
+```
+
+When the tag is a bare tag, you can omit `fullDigest`, and the controller uses the published `<tag>-full` image.
+
 ## Uninstallation
 
 Refer to the [Uninstall]({{< link path="operations/uninstall" >}}) guide.

diff --git a/docs-site/content/kagent/0.x/resources/helm.md b/docs-site/content/kagent/0.x/resources/helm.md
@@ -13,20 +13,20 @@ A Helm chart for kagent, built with Google ADK
 | Repository | Name | Version |
 |------------|------|---------|
 | `${SUBSTRATE_REPO}` | substrate | `${SUBSTRATE_VERSION}` |
-| file://../agents/argo-rollouts | argo-rollouts-agent | 0.10.2 |
-| file://../agents/cilium-debug | cilium-debug-agent | 0.10.2 |
-| file://../agents/cilium-manager | cilium-manager-agent | 0.10.2 |
-| file://../agents/cilium-policy | cilium-policy-agent | 0.10.2 |
-| file://../agents/helm | helm-agent | 0.10.2 |
-| file://../agents/istio | istio-agent | 0.10.2 |
-| file://../agents/k8s | k8s-agent | 0.10.2 |
-| file://../agents/kgateway | kgateway-agent | 0.10.2 |
-| file://../agents/observability | observability-agent | 0.10.2 |
-| file://../agents/promql | promql-agent | 0.10.2 |
-| file://../tools/grafana-mcp | grafana-mcp | 0.10.2 |
+| file://../agents/argo-rollouts | argo-rollouts-agent | 0.10.3 |
+| file://../agents/cilium-debug | cilium-debug-agent | 0.10.3 |
+| file://../agents/cilium-manager | cilium-manager-agent | 0.10.3 |
+| file://../agents/cilium-policy | cilium-policy-agent | 0.10.3 |
+| file://../agents/helm | helm-agent | 0.10.3 |
+| file://../agents/istio | istio-agent | 0.10.3 |
+| file://../agents/k8s | k8s-agent | 0.10.3 |
+| file://../agents/kgateway | kgateway-agent | 0.10.3 |
+| file://../agents/observability | observability-agent | 0.10.3 |
+| file://../agents/promql | promql-agent | 0.10.3 |
+| file://../tools/grafana-mcp | grafana-mcp | 0.10.3 |
 | https://oauth2-proxy.github.io/manifests | oauth2-proxy | ~10.7.0 |
 | oci://ghcr.io/kagent-dev/kmcp/helm | kmcp | `${KMCP_VERSION}` |
-| oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.2.1 |
+| oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.3.0 |
 
 ## Values
 
@@ -73,6 +73,7 @@ A Helm chart for kagent, built with Google ADK
 | controller.agentDeployment.nodeSelector | object | {} (no default nodeSelector) | Default nodeSelector applied to all agent deployments. Useful when admission policies require a nodeSelector on every Deployment, since wizard-created Agents carry none. A per-agent nodeSelector in the Agent CRD takes precedence over these defaults. |
 | controller.agentDeployment.podLabels | object | {} (no extra labels) | Default labels applied to all agent pod templates. Per-agent labels in the Agent CRD take precedence over these defaults. |
 | controller.agentDeployment.serviceAccountName | string | "" (auto-create per-agent ServiceAccount) | Default ServiceAccount name for agent pods. When set, agent pods that don't specify an explicit serviceAccountName will use this ServiceAccount instead of creating a per-agent one. Useful for Workload Identity (GCP, AWS IRSA, Azure Workload Identity). Precedence: agent-level serviceAccountName > this default > auto-created SA. |
+| controller.agentImage.fullDigest | string | "" (bare tag: tag-full; tag@digest without this: reconcile error; sandbox: link-time digest) | Explicit manifest digest (sha256:...) of the full (skills/SRT) Python agent image. Forwarded as APP_FULL_IMAGE_DIGEST. When agentImage.tag is a bare tag, declarative skills agents use the tag-full image and this may be omitted. When agentImage.tag embeds a digest (tag@sha256:...), this value is required or reconciliation fails. The controller's link-time digest is not used for declarative skills agents. Sandbox agents use this when set, otherwise the link-time digest. |
 | controller.agentImage.pullPolicy | string | `""` |  |
 | controller.agentImage.pullSecret | string | `""` | Image pull secret name set on agent pods created by the controller |
 | controller.agentImage.registry | string | `""` |  |
@@ -83,7 +84,8 @@ A Helm chart for kagent, built with Google ADK
 | controller.auth.userIdClaim | string | `""` |  |
 | controller.env | list | `[]` |  |
 | controller.envFrom | list | `[]` |  |
-| controller.goAgentImage | object | `{"pullPolicy":"","registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for the Go (ADK) runtime agent. |
+| controller.goAgentImage | object | `{"fullDigest":"","pullPolicy":"","registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for the Go (ADK) runtime agent. |
+| controller.goAgentImage.fullDigest | string | "" (bare tag: tag-full; tag@digest without this: reconcile error; sandbox: link-time digest) | Explicit manifest digest (sha256:...) of the full (skills/SRT) Go agent image. Forwarded as GOLANG_ADK_FULL_IMAGE_DIGEST. Same rules as agentImage.fullDigest: required when goAgentImage.tag embeds a digest, optional on a bare tag. |
 | controller.image.pullPolicy | string | `""` |  |
 | controller.image.registry | string | `""` |  |
 | controller.image.repository | string | `"kagent-dev/kagent/controller"` |  |

diff --git a/docs-site/content/kagent/0.x/resources/tools-ecosystem.md b/docs-site/content/kagent/0.x/resources/tools-ecosystem.md
@@ -36,6 +36,7 @@ The following tools provide comprehensive cluster management.
 | `k8s_generate_resource` | Generate YAML for Istio, Gateway API, or Argo resources. |
 | `k8s_rollout` | Manage rollouts (restart, status, history). |
 | `k8s_scale` | Scale a resource (deployment, statefulset, etc.). |
+| `k8s_wait` | Wait for a condition on resources, and block until the condition is met or the timeout elapses. |
 
 ### Helm
 

diff --git a/docs-site/content/kagent/1.x/reference/tools-ecosystem.md b/docs-site/content/kagent/1.x/reference/tools-ecosystem.md
@@ -13,7 +13,7 @@ Both servers arrive as subcharts of the kagent chart, and each one creates its o
 
 | RemoteMCPServer | Helm value | Serves |
 | --------------- | ---------- | ------ |
-| [`kagent-tool-server`](#kagent-tool-server) | `kagent-tools.enabled` | 124 tools for Kubernetes, Helm, Istio, Cilium, Argo Rollouts, Prometheus, and Kubescape. |
+| [`kagent-tool-server`](#kagent-tool-server) | `kagent-tools.enabled` | 126 tools for Kubernetes, Helm, Istio, Cilium, Argo Rollouts, Prometheus, and Kubescape. |
 | [`kagent-grafana-mcp`](#kagent-grafana-mcp) | `grafana-mcp.enabled` | Grafana's own MCP server, for dashboards, data sources, alerts, Loki logs, and incidents. |
 
 The kagent release pins the `kagent-tool-server` version, which is currently {{< reuse "kagent-docs/versions/kagent-tools.md" >}}. For the full set of pinned component versions, see [Version support]({{< link path="reference/versions#what-a-kagent-release-includes" >}}).
@@ -73,6 +73,7 @@ Agents use the Kubernetes provider the most, and it covers both inspection and m
 | `k8s_get_available_api_resources` | Get available Kubernetes API resources. |
 | `k8s_get_cluster_configuration` | Get cluster configuration details. |
 | `k8s_generate_resource` | Generate a Kubernetes resource YAML from a description. |
+| `k8s_wait` | Wait for a condition on Kubernetes resources (kubectl wait). Blocks until the condition is met or the timeout elapses. |
 | `k8s_apply_manifest` * | Apply a YAML manifest to the Kubernetes cluster. |
 | `k8s_create_resource` * | Create a Kubernetes resource from YAML content. |
 | `k8s_create_resource_from_url` * | Create a Kubernetes resource from a URL that points to a YAML manifest. |
@@ -232,16 +233,17 @@ Kubescape's tools read scan results that the Kubescape operator has already prod
 
 ### Utilities
 
-Two tools sit outside any product. `shell` runs an arbitrary command in the server's container with the server's ServiceAccount, so treat it as the widest permission that this server grants.
+Three tools sit outside any product. `shell` runs an arbitrary command in the server's container with the server's ServiceAccount, so treat it as the widest permission that this server grants.
 
 | Tool | Description |
 | ---- | ----------- |
 | `datetime_get_current_time` | Return the current date and time in ISO 8601 format. |
+| `mcp_inspect` | Echo input and return all HTTP headers received with the MCP request for debugging. |
 | `shell` * | Execute shell commands. |
 
 ## Narrow what kagent-tool-server serves
 
-Serving all 124 tools costs an agent context on every turn, and it grants the server broad authority over your cluster. Two independent settings narrow it, and each one acts at a different layer.
+Serving all 126 tools costs an agent context on every turn, and it grants the server broad authority over your cluster. Two independent settings narrow it, and each one acts at a different layer.
 
 ```yaml
 kagent-tools:
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		{{< version include-if="0.x" >}}0.10.2{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha12{{< /version >}}
		{{< version include-if="0.x" >}}0.10.3{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha12{{< /version >}}