Fixes agent-substrate#1709 Follow-up to agent-substrate#1997, which did the same for atelet's AteworkerHerder RPCs. This brings declarative validation (DV) to the other end of that call: the `Ateworker` service both sandbox runtimes (`ateworker-gvisor`, `ateworker-microvm`) implement. Generated validation lives in a new `internal/ateworkervalidation` package, since both binaries are `package main` and must share one set of rules. Every Ateworker handler calls its validator first thing, before taking any lock, and turns failures into `InvalidArgument` through `resources.ToAPIError`. Rules are the ones atelet already enforces on the same values one hop earlier, shared through `internal/resources` so the two ends cannot drift: short names and UUIDs for identity, `ValidateMountPath` for every mount path, `ValidateHostPort` for the egress gateway, `ValidateHTTPGetPath` for the wakeup probe, `ValidateActorDirs` for the seven actor directories. Bounds mirror the producer's: `containers ≤ 10`, each mount list ≤ 32, `cpu_milli ≤ 999999`, `runtime_asset_paths ≤ 16` entries like atelet's `ArchAssets.files`. Two places ateworker's shape differs from atelet's, and the rules follow the shape: - A container's mounts arrive in four typed lists rather than atelet's one. Each list's key keeps its own paths unique, so a hook on `Container` gathers all four and holds their paths unique and non-nesting across them, reporting each finding on the mount it belongs to. - `WorkloadSpec.containers` is optional on the message, because the fallback spec atelet's Terminate sends for a template-less actor carries no containers. Run and Restore require at least one through a hook on their `spec` field, so neither runtime boots a sandbox around nothing. #### Hand-written checks this replaces - `validateActorDirs` in both binaries, now the `ActorDirs` hook. - The `actor_uid` presence checks in both stats handlers. - The empty-container guards in ateworker-microvm's boot and restore paths, now the `spec` hooks above. - ateworker-microvm's cap of 25 containers, which no accepted spec could reach once `containers` is bounded at 10. `ateworkervalidation.MaxContainers` names the bound. - The `actor UID is required` guard in each binary's `hostActor`, unreachable once every request that hosts an actor requires the UID. #### Removed fields `CheckpointWorkloadRequest.snapshot_uri` and `RestoreWorkloadRequest.snapshot_uri` date from when ateworker moved snapshots to object storage itself. atelet does that now, through the object-store plugin; nothing sets the fields and neither runtime reads them. They are removed rather than validated. #### What is deliberately *not* validated here - **Snapshot fidelity support.** DV only bounds `fidelity` to the enum. Which levels a runtime can capture (gVisor cannot do ROOTFS without MEMORY) stays the per-runtime check in each binary, as designed in agent-substrate#2448: atelet forwards every level and ateworker refuses what it cannot serve. - **`runsc_path` / `runtime_asset_paths` contents.** They must be files under the node's static-files root; that depends on host state and stays a hand check in the binary. DV bounds their length only. - **`container_spec`.** atelet derives it from template fields it already validated, merging the image's ENTRYPOINT, CMD and ENV in, so the template's bounds do not apply. It is marked opaque with that reason. #### Testing - `internal/ateworkervalidation`: one table per request type, plus tables for `WorkloadSpec`, `Container` (which covers the mount rules, including the cross-list cases) and `ActorDirs`. The probe is covered from the Run table. - Each binary's edge test asserts every RPC with a request body rejects an empty one. Existing handler tests that sent minimal requests now build valid ones, so they test the check they are aimed at. - `go vet` for `GOOS=linux` on both binaries at every commit (their tests are Linux-only and run in CI). - `hack/update/codegen.sh` is clean at every commit. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR

Commits

Commits on Oct 16, 2026

Commits on Oct 17, 2026

Commits on Oct 18, 2026