Update kagent 1.x reference docs at v1.0.0-alpha16 (version conrefs changed)

.github/workflows/playwright-screenshots.yaml

@@ -211,27 +211,28 @@ jobs:
           sudo install -m 0755 /tmp/kind /usr/local/bin/kind
           kind --version
 
-      - name: Install kubectl-ate
+      - name: Install the kagent CLI
         working-directory: website/docs-site
         run: |
-          # The same version the install guide tells a reader to download, read from the
-          # same conref, so the tooling matches the charts the provisioner installs.
-          version="$(python3 - assets/kagent-docs/versions/agent-substrate.md <<'PY'
+          # `kagent install` installs the charts of its own release, so the CLI version IS
+          # the chart version. Read it from the same conref the install guide renders; the
+          # provisioner refuses to run if the two disagree.
+          version="$(python3 - assets/kagent-docs/versions/kagent.md <<'PY'
           import re, sys
           txt = open(sys.argv[1]).read()
           m = re.search(r'include-if="[^"]*\b1\.x\b[^"]*"[^>]*>}}([^<{]+)', txt)
           print((m.group(1) if m else txt).strip())
           PY
           )"
-          curl -fsSL -o kubectl-ate \
-            "https://github.com/kagent-dev/substrate/releases/download/v${version}/kubectl-ate-linux-amd64"
-          chmod +x kubectl-ate && sudo mv kubectl-ate /usr/local/bin/
+          curl -fsSL https://raw.githubusercontent.com/kagent-dev/kagent/refs/heads/main/scripts/get-kagent \
+            | bash -s -- --version "v${version}"
+          kagent version
 
       - name: Stand up the cluster at the docs-pinned versions
         working-directory: website/${{ env.PW_DIR }}
         env:
-          # The provisioner only tests that this is non-empty before writing it into a
-          # ModelProviderConfig, and these captures (dashboard, agents list, substrate
+          # `kagent install` only tests that this is non-empty before writing it into the
+          # provider Secret, and these captures (dashboard, agents list, substrate
           # page on a fresh install) invoke no model. So a placeholder is correct here,
           # not a workaround -- and it keeps a missing or rotated secret from failing a
           # run that never needed one. (kagent's `make check-api-key` tests the same

docs-site/assets/kagent-docs/snippets/grpcurl-prerequisites.md

@@ -1,4 +1,4 @@
-1. [Install kagent]({{< link path="setup/installation" >}}), and confirm that your installation sets `controller.grpc.reflection=true`. Reflection lets grpcurl discover the controller's methods without a local copy of kagent's protocol buffer definitions.
+1. [Install kagent]({{< link path="setup/installation" >}}), and confirm that your installation sets `config.server.grpcReflection=true`. Reflection lets grpcurl discover the controller's methods without a local copy of kagent's protocol buffer definitions.
 
 2. [Create your first agent]({{< link path="get-started/your-first-agent" >}}), then save the Agent's namespace and name to an environment variable, in the `<namespace>/<name>` form that the A2A `tenant` field takes. To list your Agents, run `kagent agent list`.
    ```bash

docs-site/assets/kagent-docs/versions/agent-substrate.md

@@ -1 +1 @@
-{{< version include-if="0.x" >}}0.0.9{{< /version >}}{{< version include-if="1.x" >}}0.5.0-alpha2{{< /version >}}
+{{< version include-if="0.x" >}}0.0.9{{< /version >}}{{< version include-if="1.x" >}}0.6.0-alpha3{{< /version >}}

docs-site/assets/kagent-docs/versions/kagent.md

@@ -1 +1 @@
-{{< version include-if="0.x" >}}0.10.3{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha14{{< /version >}}
+{{< version include-if="0.x" >}}0.10.3{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha16{{< /version >}}

docs-site/assets/kagent-docs/versions/runtime-image-claude.md

@@ -1 +1 @@
-ghcr.io/kagent-dev/kagent/claude-harness@sha256:b33b9e3ab90bcba19f0ec719a249b35321cf7508f90cfe7fe1af550f09c9310c
+ghcr.io/kagent-dev/kagent/claude-harness@sha256:6b947b7f13938d49f0e9f8af39621a95e861d5576aad1d934141a438eebabb32

docs-site/assets/kagent-docs/versions/runtime-image-codex.md

@@ -1 +1 @@
-ghcr.io/kagent-dev/kagent/codex-harness@sha256:69f02eff6f78a5f78724f6e5ec856119856ea4d479e0f06455115e45ad2de6fc
+ghcr.io/kagent-dev/kagent/codex-harness@sha256:852fd192f5e2f2e76f17d018de0a1c1eeaeecac72c69b132fbdfb98516ae85cd

docs-site/assets/kagent-docs/versions/runtime-image.md

@@ -1 +1 @@
-ghcr.io/kagent-dev/kagent/golang-adk@sha256:eb1b0c7f635f31d464cff7cf212275f2642057a629ed20b39661e9f644f71f21
+ghcr.io/kagent-dev/kagent/golang-adk@sha256:2240ef5d46b71b4850d072d40f34a5f778e9342cc97df34a635b594540ec62af

docs-site/assets/kagent-docs/versions/sandbox-guest-image.md

@@ -1 +1 @@
-ghcr.io/kagent-dev/kagent/sandbox-guest@sha256:1821780ef01958f63cb9a1a1d9a175f7e386e7c72859dd29ab86d8644a47d2d4
+ghcr.io/kagent-dev/kagent/sandbox-guest@sha256:d3c444e3f5472598ff520255b72cfcb9ecdf22815fd87747315aeaf0520801c3

docs-site/content/kagent/1.x/about/architecture/agent-substrate.md

@@ -28,7 +28,7 @@ An operator never creates a Worker directly. Agent Substrate manages them and ke
 A WorkerPool exposes a Kubernetes scale subresource, so a HorizontalPodAutoscaler can size a pool from a metric instead of a fixed replica count. Agent Substrate publishes how many Workers in each pool have no free Actor slot. An autoscaler that watches this number adds Workers before the pool fills, instead of after placements fail.
 
 <!-- REVIEW (runtime reviewer): queue-depth scaling is still unconfirmed and is deliberately not described here. Confirm whether it is supported before adding it. -->
-<!-- REVIEW (runtime reviewer): the external metric that drives the autoscaler is named per deployment, so this paragraph describes the signal rather than naming the series. Confirm the supported name before documenting a worked HPA example. -->
+<!-- REVIEW (runtime reviewer): ate-api-server publishes this signal as ate_workerpool_workers{state="at_capacity"}. Only the Kind-only demos/autoscaled-workerpool demo wires it into an HPA, through prometheus-adapter, and the chart ships no HPA. Confirm that this series is the supported autoscaling signal before documenting a worked HPA example. -->
 
 ### Worker capacity
 
@@ -40,9 +40,9 @@ Agent Substrate checks two things before it places an Actor on a Worker:
 * Whether the Worker has a free Actor slot. This check always runs.
 * Whether the Worker has enough spare CPU and memory. This check runs only when the ActorTemplate states how much CPU and memory one Actor needs.
 
-An ActorTemplate that the kagent controller compiles does not state per-Actor CPU or memory, so the free Actor slot check is the only one that decides where a Session's Actor lands. [Worker resource limits]({{< link path="operations/tune-agent-substrate#set-resource-requests-on-workers" >}}) still matter, because a Worker with no limits reports its whole node as its own capacity.
+Every ActorTemplate that the kagent controller compiles states a CPU and memory limit for one Actor, so both checks run for a Session's Actor. The `config.runtimeDefaults.cpu` and `config.runtimeDefaults.memory` Helm values set this limit for every agent, and default to `1` CPU and `1Gi` of memory.
 
-<!-- REVIEW (runtime reviewer): on a default installation neither side declares resources, so a Worker keeps accepting Actors up to its build capacity no matter how loaded its node is, and node pressure surfaces as eviction rather than as a placement failure. Confirm that this is intended for GA before this section describes it as the expected operating mode. -->
+The CPU and memory check compares that limit against the capacity that the Worker reports. A WorkerPool sets no resource limits on its Workers by default, and a Worker with no limits reports its whole node as its own capacity. The check then ignores every other pod on the node, so node pressure surfaces as eviction rather than as a placement failure. To make the check reflect the Worker, [set resource limits on Workers]({{< link path="operations/tune-agent-substrate#set-resource-requests-on-workers" >}}).
 
 Agent Substrate first narrows the pool to the Workers that can take the Actor. It then picks two of those Workers at random and places the Actor on the less loaded of the two. A Worker's load is the higher of two shares: the share of its Actor slots that are filled, and the share of its CPU and memory that is committed. Sampling two Workers keeps the decision cheap, and it avoids the pile-up that follows when every placement aims at the Worker that looks emptiest.
 

docs-site/content/kagent/1.x/about/core-concepts.md

@@ -55,9 +55,7 @@ An operator applies the three custom resources directly. The kagent controller w
 
 ## Harness
 
-<!-- REVIEW (docs): the reviewer asked for an established industry definition of "agent harness" with a source. The definition below is drawn from what the linked harnesses do rather than from a published definition. Replace it with an approved citation, or confirm that the examples are sufficient sourcing. -->
-
-An agent harness is the application layer that executes an agent and adds capabilities around its model. It typically assembles context, invokes the model, executes tool calls, loads skills, feeds results back into the agent loop, and manages session state. A harness can also provide memory, subagents, permissions, approvals, sandboxing, and event streaming.
+An agent harness is the software around a model that turns the model into an agent. LangChain defines a harness as "every piece of code, configuration, and execution logic that isn't the model itself," in [The Anatomy of an Agent Harness](https://www.langchain.com/blog/the-anatomy-of-an-agent-harness). A harness typically assembles context, invokes the model, executes tool calls, loads skills, feeds results back into the agent loop, and manages session state. A harness can also provide memory, subagents, permissions, approvals, sandboxing, and event streaming.
 
 Examples include [Claude Code](https://code.claude.com/docs/en/how-claude-code-works), [Codex CLI](https://learn.chatgpt.com/docs/codex/cli), [Gemini CLI](https://geminicli.com/docs/), [OpenClaw](https://docs.openclaw.ai/concepts/agent-runtimes), and custom in-house applications. Each of those runs on a local machine with your own shell and files.
 
@@ -162,8 +160,6 @@ This identity also keeps API keys out of the agent. An agent sends a placeholder
 
 Each Actor runs in its own sandbox, with its own filesystem and its own durable volume for application data. Two Sessions on the same Agent share no files and cannot see any of each other's state, even when they run on the same Worker. The sandbox also isolates the workload's system calls from the node's kernel, which matters because an agent runs commands that a model chose. For what each sandbox class separates, see [Sandboxing]({{< link path="about/substrate-runtime/sandboxing" >}}).
 
-<!-- REVIEW (docs): the reviewer asked for this page to be reorganized around compute, identity, and sandboxing, and to cover MCP servers, CLIs, file systems, skills, prompts, plugins, and the lifecycle operations. This section adds the three axes and links to the runtime pages that own each mechanism, rather than restating them here. Confirm whether the reviewer wants the kagent resource model reordered under these three headings instead. -->
-
 ## Subagent tools
 
 An agent tool binding can point at another AgentTemplate instead of an MCP server, so a broad-scope agent can hand part of a task to a specialist. For example, a release agent delegates a database question to another agent, gets the answer, and carries on. The specialist keeps its own prompt and its own tools, and the conversation stays with the agent that the caller addressed.