sync: re-pin onto upstream 7471879 blocked — fix(harness): re-read the continuation state from /data on every turn - #60

The automated re-pin stopped: a carried commit does not apply onto upstream 7471879. Nothing was pushed to giantswarm.

Re-pin giantswarm onto upstream/main

23 upstream commits since the previous pin.

Carried commits (90, in order)

• 19922ea fix(controller): accept a RemoteMCPServer labeled kagent.dev/discovery=disabled without listing its tools
• bc3b8dd fix(controller): keep a kagent.dev/discovery=disabled MCPServer out of the catalog
• 3999b3b fix(harness): re-read the continuation state from /data on every turn
• 306634f fix(helm): sanitise the chart version in the app.kubernetes.io/version label
• 1f5c54a ci(fork): publish dev images and charts to ghcr.io/ from the poc branch
• 25aeb08 ci(fork): retry image builds and keep the matrix running on a single failure
• de871e6 fix(docker): apk upgrade in the Go runtime image
• ec42869 ci(fork): test and scan the consumed branch, re-pin weekly by workflow, keep a ledger
• 56f7db3 ci(fork): mirror as the App and cancel the runs upstream's files start
• 7ac255f ci(fork): open the sync's pull requests in this repository, not the parent
• 3ff261f build(fork): the charts' Substrate dependencies come from the Giant Swarm line
• f5b1989 ci(fork): the e2e cluster runs the Substrate the charts depend on
• df32c59 ci(fork): the consumed branch is giantswarm
• 8ec2b25 ci(fork): a tag is a release of the line, vX.Y.Z-gs.N
• 6119408 chore: align files according to platform standards
• 7d53e06 fix(controller): honour AUTH_MODE and wire the trusted-proxy authenticator
• b1199b8 docs(fork): ledger row for the trusted-proxy authenticator wiring
• 024fd6d fix(helm): keep the kagent-crds CRDs on uninstall (helm.sh/resource-policy: keep)
• 730e965 docs(fork): ledger row for the kagent-crds keep policy
• 4bc2c2b docs(fork): record the first release, v0.11.0-gs.1 (0ac5240), in the Releases table
• 49611e3 docs(fork): record the second release, v0.11.0-gs.2 (3bdff38), in the Releases table
• 34a9217 feat(api): a per-source credential for private git skill and plugin sources
• d183fde docs(fork): ledger row for the artifact-source credential
• 1be8818 docs(fork): record the third release, v0.11.0-gs.3 (ed07617), in the Releases table
• f38ccc1 fix(a2agateway): fail a task whose dispatch to the runtime fails instead of leaving it submitted
• bee42b1 docs(fork): ledger rows for the dispatch-failure patch and the fourth release, v0.11.0-gs.4 (ca399a3)
• 0c675bf ci(fork): stamp the golang-adk digest and SUBSTRATE_VERSION into the chart at publish
• c69d085 feat(helm): controller.agentImage.digest and an optional default Harness for the chart's own runtime image
• 0cb97ee feat(helm): a ConfigMap of the chart's runtime image references for the Substrate image cache
• 3e6f377 build(fork): pin Substrate to the line's release 0.0.27-gs.6 (build(fork): pin Substrate to the line's release 0.0.27-gs.6 #18)
• ea03a9d docs(fork): record the fifth release, v0.11.0-gs.5 (955ac54), in the Releases table (docs(fork): record the fifth release, v0.11.0-gs.5 (955ac543), in the Releases table #19)
• af75aaf build(fork): pin Substrate to the line's release 0.0.27-gs.7 (build(fork): pin Substrate to the line's release 0.0.27-gs.7 #20)
• d0b085a docs(fork): record the sixth release, v0.11.0-gs.6 (1724f81), in the Releases table (docs(fork): record the sixth release, v0.11.0-gs.6 (1724f815), in the Releases table #21)
• af8cbe9 fix(helm): label the runtime images ConfigMap for helm-controller to watch
• 3d3ba11 docs(fork): the runtime-images ConfigMap row covers its watch label (giantswarm/giantswarm#37767)
• aefa41e fix(controller): start a crashed golden boot over instead of failing the AgentTemplate for good
• 6a5055f docs(fork): ledger row for the golden-boot retry
• 2d2d9af docs(fork): record the seventh release, v0.11.0-gs.7 (2b1cef3), in the Releases table
• f8068ba docs(fork): record the eighth release, v0.11.0-gs.8 (6be4b09), in the Releases table
• 2717214 fix(helm): drop empty-valued matchLabels from the Harness admission selector
• bbbb348 docs(fork): ledger row for the empty-valued selector labels of the Harness
• 491b428 docs(fork): record the ninth release, v0.11.0-gs.9 (549907d), in the Releases table
• f8c0f73 fix(a2agateway): the turn a unary SendMessage starts outlives the caller's deadline
• 7dcea35 docs(fork): ledger rows for the detached unary dispatch and the tenth release, v0.11.0-gs.10 (5283284)
• 1bff3a7 fix(adk): load a SKILL.md whose frontmatter carries fields outside the agentskills.io set
• ec93e80 docs(fork): ledger row for the lenient skill loader (giantswarm/giantswarm#37772)
• 593b2e0 docs(fork): ledger row for the eleventh release, v0.11.0-gs.11 (aca521b)
• 9d78c12 chore(fork): re-pin Substrate to the line's release 0.0.27-gs.9 — the gVisor worker's terminate collects a crashed golden actor (giantswarm/giantswarm#37773) (chore(fork): re-pin Substrate to 0.0.27-gs.9 — a crashed golden actor of a superseded template is collected (giantswarm#37773) #32)
• 0b076d7 docs(fork): ledger row for the twelfth release, v0.11.0-gs.12 (b5bfa7f) — Substrate re-pinned to 0.0.27-gs.9 (docs(fork): ledger row for the twelfth release, v0.11.0-gs.12 #33)
• a12afc7 docs(fork): ledger row for the keyless OpenAI-compatible baseUrl cherry-pick (fix(adk): allow a keyless OpenAI-compatible baseUrl kagent-dev/kagent#2739, ModelConfig accepts keyless OpenAI configs (baseUrl, no apiKeySecret) that crashloop every consumer agent — OPENAI_API_KEY unset kagent#57)
• 6bf9a7a docs(fork): ledger row for the thirteenth release, v0.11.0-gs.13 (8d91784) — fix(adk): allow a keyless OpenAI-compatible baseUrl kagent-dev/kagent#2739 carried as a cherry-pick (ModelConfig accepts keyless OpenAI configs (baseUrl, no apiKeySecret) that crashloop every consumer agent — OPENAI_API_KEY unset kagent#57) (docs(fork): ledger row for the thirteenth release, v0.11.0-gs.13 (8d917840) #36)
• 7b3d881 build(fork): pin Substrate to the line's re-pin candidate 0.0.30-dev.giantswarm.2026-09-14.19-48-17.h21027aa
• fcc047f docs(fork): ledger — the pin moves to upstream main 800015d with Substrate 0.0.30-gs.1 (chore: upgrade Substrate to v0.0.29 kagent-dev/kagent#2802's ate-target-actor); the fix(adk): allow a keyless OpenAI-compatible baseUrl kagent-dev/kagent#2739 cherry-pick fell away
• 0a89197 build(fork): pin Substrate to the line's release 0.0.30-gs.1
• d63afd2 docs(fork): ledger row for the fourteenth release, v0.11.0-gs.14 (0a89197) — the line on upstream main 800015d with Substrate 0.0.30-gs.1
• 6d3237d feat(models): add prompt caching for the Anthropic provider
• 3e44b3f test(adk): deep-copy caller objects in the prompt cache no-mutation tests
• 138ed1d docs(fork): ledger row for the Anthropic prompt caching cherry-pick (feat(models): add prompt caching for the Anthropic provider (promptCaching, cacheTTL) kagent-dev/kagent#2788)
• fd80b11 docs(fork): ledger row for the fifteenth release, v0.11.0-gs.15 (138ed1d) — feat(models): add prompt caching for the Anthropic provider (promptCaching, cacheTTL) kagent-dev/kagent#2788 carried as a cherry-pick
• e66fb5a chore(deps): bump google.golang.org/adk/v2 to v2.3.0
• 229ae56 feat(adk): honour context compaction in the Go runtime
• cc11cc9 feat(api): add spec.context.compaction to the v1alpha3 AgentTemplate
• 646e7fe test(e2e): cover context compaction with mockllm as the summarizer
• b692efd docs(fork): ledger row for the context compaction cherry-pick (feat(adk): honour context compaction in the Go runtime kagent-dev/kagent#2790)
• 4ede934 docs(fork): ledger row for the sixteenth release, v0.11.0-gs.16 (b692efd) — feat(adk): honour context compaction in the Go runtime kagent-dev/kagent#2790 carried as a cherry-pick
• e821fcd fix(a2agateway): end a turn whose runtime is lost, and delete a paused or crashed Actor as it is
• d990b84 docs(fork): ledger row for the lost-runtime patch (giantswarm/giantswarm#37742 row 45)
• 23afab5 docs(fork): ledger row for the seventeenth release, v0.11.0-gs.17 (d990b84) — the lost-runtime patch
• f001a44 feat(a2agateway): suspend a runtime paused for input once the pause is older than a TTL
• fbab147 docs(fork): ledger row for the pause TTL (giantswarm/giantswarm#37795, #37742 row 45)
• 3c669c7 docs(fork): ledger row for the eighteenth release, v0.11.0-gs.18 (fbab147) — the pause TTL
• 3b665b1 fix(a2agateway): leave a pause whose node has no worker alone, and delete a runtime that cannot be suspended as it is
• 2e18f2b docs(fork): ledger row for the lost-node pause follow-up (giantswarm/giantswarm#37742 row 45)
• a3246ae docs(fork): ledger row for the nineteenth release, v0.11.0-gs.19 (2e18f2b) — the lost-node pause follow-up
• f3eced6 chore(fork): re-pin Substrate to the line's release 0.0.30-gs.4 — the golden boot a workload keeps failing is bounded and its cause carried up (giantswarm/giantswarm#37801) (chore(fork): re-pin Substrate to the line's release 0.0.30-gs.4 — the bounded golden boot #49)
• 9114c95 docs(fork): ledger row for the twentieth release, v0.11.0-gs.20 (f3eced6) — Substrate re-pinned to 0.0.30-gs.4, the bounded golden boot (docs(fork): ledger row for the twentieth release, v0.11.0-gs.20 #50)
• 6213c18 feat(runtime): name the agent and the user on every model call
• 7c0e574 docs(fork): ledger row for the model-call identity headers (giantswarm/giantswarm#37871, #37742 row 48)
• faf4478 docs(fork): ledger row for the twenty-first release, v0.11.0-gs.21 (7c0e574) — the model-call identity headers
• 7ddba59 fix(controller): compare the pair collections' outputs by content
• 8637d5e docs(fork): ledger row for the pair collections' content comparison
• 790342a ci(fork): publish to gsoci from CircleCI
• c371e27 docs(fork): FORK.md — the line publishes to gsoci from CircleCI
• c8e7af5 docs(fork): ledger row for the twenty-second release, v0.11.0-gs.22 (c371e27) — the first release published to gsoci from CircleCI
• 10557a6 chore(fork): re-pin Substrate to the line's release 0.0.30-gs.5 — the charts and the worker image come from gsoci
• 72efa7e fix(helm): trim every trailing non-alphanumeric from the truncated label values
• 40e2ff0 docs(fork): carried-patches row for the truncated label values fix
• 4dc2618 ci(fork): publish through the orb's stock jobs with decoupled versions
• e09e341 chore(fork): re-pin Substrate to the line's release 1.0.0 — the first of its decoupled scheme
• d24ad9f docs(fork): release row 1.0.0

Conflict

Carried commit 3999b3b fix(harness): re-read the continuation state from /data on every turn does not apply onto 7471879.

Conflicting files:

• go/harness/runtime/continuation/store.go
• go/harness/runtime/continuation/store_test.go

Commits replayed before it: 2 (00776be).

Resolve by hand (FORK.md, "Manual re-pin"): rebase the consumed branch onto 7471879, fix the conflict in that commit, run the checks on a sync/** branch, force-push.

Finish by hand (FORK.md, "Manual re-pin"), then close this pull request — do not merge it. Run: https://github.com/giantswarm/kagent-upstream/actions/runs/35563881477