Rename Session to Actor - #602
Merged
Bowei Du (bowei) merged 3 commits intoJul 30, 2026
Merged
Conversation
stubs were last regenerated on 2026-07-17 and had fallen behind ateapi.proto.
Sessions are no longer a concept in Substrate; Actor is the glossary term. This completes the "s/Session/Actor" TODO that sat at the top of ateapi.proto, and removes the TODO. API surface: service SessionIdentity -> ActorIdentity MintJWTRequest.session_id -> actor_id MintJWTResponse.session_jwt -> actor_jwt MintCertRequest.session_id -> actor_id MintCertResponse.session_certificates -> actor_certificates Go packages: cmd/ateapi/internal/sessionidentity -> actoridentity cmd/ateapi/internal/sessionidjwt -> actoridjwt Flags and cluster resources: --session-id-jwt-pool -> --actor-id-jwt-pool --session-id-ca-pool -> --actor-id-ca-pool Secrets, volumes and mount paths renamed to match, in both manifests/ate-install/ate-api-server.yaml and hack/install-ate.sh (--create-session-id-ca-pool-secret -> --create-actor-id-ca-pool-secret). Two credential identity values change with the rename: JWT issuer https://broker.agentic-substrate-session-id-broker.svc -> https://broker.agentic-substrate-actor-id-broker.svc SPIFFE ID spiffe://substrate-session.local/app/../session/.. -> spiffe://substrate-actor.local/app/../actor/.. Tokens and certificates issued before this change will not validate against the new issuer or trust domain. BREAKING: the gRPC wire path moves from /ateapi.SessionIdentity/* to /ateapi.ActorIdentity/*, and the Secrets must be recreated under their new names before the new ate-api-server rolls out.
Lior Lieberman (LiorLieberman)
requested review from
Taahir Ahmed (ahmedtd),
Julian Gutierrez Oschmann (juli4n) and
Zoe Zhao (zoez7)
July 29, 2026 23:05
Zoe Zhao (zoez7)
previously approved these changes
Jul 29, 2026
Co-authored-by: Lior Lieberman <liorlib7+riskified@gmail.com>
Bowei Du (bowei)
approved these changes
Jul 30, 2026
Collaborator
|
Looks like the e2e is failing in an unrelated test: Kind of concerning we are starting to get e2e meltdowns. |
Collaborator
|
Bowei Du (@bowei) please file a tracking issue when you spot test flakes. I just filed #619 for another one. |
Collaborator
|
Also: please make sure to link to the failing test runs. It's a bit annoying to find them otherwise, we don't have testgrid here. The log snippet above isn't much to go on. |
Collaborator
Bowei Du (bowei)
merged commit Jul 30, 2026
f3fe063
into
agent-substrate:main
13 of 15 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sessions aren't a concept in Substrate anymore - Actor is the glossary term. This does the s/Session/Actor (almost /g)
The rename goes all the way through. the proto service and its request/response fields, the sessionidentity / sessionidjwt packages, the --session-id-* flags, and the matching Secret names, volumes and mount paths in manifests/ate-install and hack/install-ate.sh. Also updating docs got the same treatment.
Two things to know before rolling this out:
The gRPC path moves from /ateapi.SessionIdentity/* to /ateapi.ActorIdentity/*, so clients and servers need to go together.
The JWT issuer and SPIFFE trust domain both change
(...session-id-broker.svc → ...actor-id-broker.svc, substrate-session.local → substrate-actor.local). Note: I know these are not great but will change them in a subsequent PR to keep this PR rename purely
Credentials issued before this won't validate after this change. The Secrets also have to be recreated under their new names before the new ate-api-server rolls out.
The first commit on the branch is unrelated housekeeping: the Python stubs were last regenerated on 2026-07-17 and had drifted from the proto, so they're brought up to date separately to keep the rename diff readable.
Fixes: #575