feat: add AgentTemplate preparation and immutable revisions

[EItanya]

Summary

• compile v1alpha3 Harness and AgentTemplate attachments into deterministic prepared bundles
• provision immutable Substrate ActorTemplates and track latest successful revisions in PostgreSQL
• preserve credential SecretKeyRefs and materialize runtime config without generated Secrets
• use Substrate v0.0.11 with gRPC port 80 and health-only readiness on port 8081

Testing

• full Go package test sweep, including CRD envtest rerun with cached assets
• golangci-lint run
• sqlc generate and go mod tidy drift checks
• Python Ruff formatting and lint
• 33 affected kagent-adk unit tests

[Copilot]

Pull request overview

Adds an AgentTemplate “preparation” pipeline that compiles Harness+AgentTemplate attachments into deterministic runtime bundles, provisions immutable Substrate ActorTemplate revisions, and persists/maintains revision tracking in Postgres (including cleanup of unreferenced revisions). The PR also updates runtime contracts for Substrate v0.0.11 (gRPC on port 80, readiness-only endpoint on 8081) and aligns both Go/Python ADKs with credential placeholder expansion.

Changes:

• Compile v1alpha3 Harness + AgentTemplate into a backend-neutral prepared bundle and derive an immutable revision hash.
• Provision immutable Substrate ActorTemplate revisions and track desired/latest-successful revisions in Postgres via new migrations + sqlc queries.
• Add credential placeholder expansion when materializing config from env vars, plus readiness endpoint changes (port 8081) across Go and Python runtimes.

Reviewed changes

Copilot reviewed 26 out of 30 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
python/packages/kagent-adk/tests/unittests/test_config_materialize.py	Adds unit coverage for credential placeholder expansion during config materialization.
python/packages/kagent-adk/src/kagent/adk/cli.py	Updates substrate comment to reflect env-injected config (not secret-backed mounts).
python/packages/kagent-adk/src/kagent/adk/_config_materialize.py	Expands __KAGENT_ENV[...]__ placeholders in KAGENT_CONFIG_JSON before writing config files.
python/packages/kagent-adk/src/kagent/adk/_a2a.py	Adds a dedicated readiness listener on port 8081 via app lifespan.
go/go.sum	Updates dependency checksums (notably Substrate v0.0.11).
go/go.mod	Updates Substrate replacement to v0.0.11 and adjusts OTel grpc instrumentation dependency.
go/core/pkg/sandboxbackend/substrate/prepared_template.go	Introduces prepared immutable ActorTemplate creation for a given revision/bundle.
go/core/pkg/sandboxbackend/substrate/prepared_template_test.go	Adds tests ensuring prepared templates preserve SecretKeyRefs and avoid creating config Secrets.
go/core/pkg/sandboxbackend/substrate/openclaw.go	Adapts actor status IP reporting to the new worker assignment fields.
go/core/pkg/sandboxbackend/substrate/lifecycle_shared.go	Adjusts env var sanitization to correctly preserve literal values (including empty).
go/core/pkg/migrations/core/000008_prepared_revisions.up.sql	Adds prepared_revision and agent_template_attachment tables + indexes for revision tracking.
go/core/pkg/migrations/core/000008_prepared_revisions.down.sql	Drops prepared revision tracking tables.
go/core/pkg/app/app.go	Wires in the new AgentTemplateController when the substrate lifecycle is enabled and DB supports it.
go/core/internal/service/system/service.go	Updates Substrate actor fields to match the newer API (worker assignment, latest snapshot).
go/core/internal/preparation/bundle.go	Adds bundle model + stable revision hashing for prepared runtime inputs.
go/core/internal/preparation/bundle_test.go	Adds unit test asserting revision changes with runtime input changes.
go/core/internal/database/queries/prepared_revisions.sql	Adds sqlc queries for upserting attachments/revisions, marking success, retirement, and GC.
go/core/internal/database/prepared_revisions.go	Implements PreparedRevisionStore on Postgres client using generated queries.
go/core/internal/database/gen/querier.go	Extends sqlc Querier interface to include prepared revision operations.
go/core/internal/database/gen/prepared_revisions.sql.go	Adds generated sqlc code for prepared revision queries.
go/core/internal/database/gen/models.go	Adds generated model structs for new tables.
go/core/internal/controller/translator/agent/template.go	Refactors prompt source resolution and expands template context to include AgentTemplate name.
go/core/internal/controller/translator/agent/agenttemplate_compiler.go	Adds compilation of AgentTemplate+Harness into prepared bundles, including credential placeholders and egress destinations.
go/core/internal/controller/translator/agent/agenttemplate_compiler_test.go	Adds test ensuring prepared config/snapshot does not include secret values and includes placeholders/env refs.
go/core/internal/controller/translator/agent/adk_api_translator.go	Extends translator interface to expose CompileAgentTemplate.
go/core/internal/controller/agenttemplate_controller.go	Adds controller to manage preparation lifecycle, status, DB persistence, and revision GC.
go/core/internal/controller/agenttemplate_controller_test.go	Adds controller test validating latest-success semantics until backing template is ready.
go/adk/pkg/config/config_materialize.go	Adds placeholder expansion for KAGENT_CONFIG_JSON when writing config files.
go/adk/pkg/config/config_materialize_test.go	Adds unit test for Go placeholder expansion behavior.
go/adk/pkg/a2a/server/server.go	Adds a dedicated readiness HTTP server on port 8081 and shuts it down gracefully.

Files not reviewed (3)

• go/core/internal/database/gen/models.go: Generated file
• go/core/internal/database/gen/prepared_revisions.sql.go: Generated file
• go/core/internal/database/gen/querier.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.