// #Kubernetes #AI Agents #Platform Engineering // 4 min read

Agent Substrate day wrap-up: the 19 posts and the field guide

Part of: Agent Runtimes

Agent Substrate day wrap-up: the 19 topic posts from today plus the field guide hub. Isolation, identity, production, scheduling, and what kubectl cannot show.

Agent Substrate day wrap-up is the map of the 19 topic posts under the field guide, in the order I would actually send someone the links. If you want one URL, take the Agent Substrate field guide . This page is the day’s reading order, not a transcript of the room.

I spent today writing the pieces I wanted when I stood this runtime up on a laptop: what the actors are, why kubectl get pods is the wrong view, and the isolation, identity, and scheduling the runtime still does not decide for you. Eighteen agents on two workers, over a thousand real sessions, reserved capacity about 4.5x lower than always-on pods. Those numbers are mine. Scheduler policy, GPU topology, and enterprise bars are how I would operate, not measurements of a production fleet.

The in-person room was Agent Substrate Day in Salt Lake City, next to KubeCon. These posts are not a transcript of that room. They are my answers, grouped morning, midday, and afternoon so you can skim the map and open only the decision you are making.

A measured claim in this set is reservation versus always-on pods, plus the workers-list view. A design take is anything about resume queues, GPU topology, or an enterprise bar. I kept those distinct on purpose so a laptop cluster does not get quoted as a production SLO.

  1. Hub: Agent Substrate field guide .
  2. Cluster already up: kubectl is lying to you .
  3. Shared pool: Scheduling agent sandboxes .
  4. Choosing a runtime: Agent sandbox vs Agent Substrate .
  5. Platform bar: Agent Substrate enterprise .

What should you read first this morning?

  1. What is Agent Substrate . Snapshot-backed actors, a small worker pool, agent count is not pod count.
  2. Agent sandbox vs Agent Substrate . Pod, per-agent sandbox, or multiplexed actors. How I choose.
  3. Running Agent Substrate in production . Bucket, control plane, secrets, sandbox class, idle policy, reset path.
  4. kubectl is lying to you . Watch the workers list. I posted a teaser yesterday.

What isolation and identity questions landed at midday?

  1. Kubernetes network policy for agents . Policy on worker pods cannot tell two actors apart.
  2. Proof of agent identity . The agent is not you, and it is not the worker’s ServiceAccount.
  3. Why Agent Substrate fails . Five bets I made against it. I was wrong about one.
  4. Suspend and resume agents . The lifecycle, and what I refuse to put in a snapshot.
  5. Agent Substrate dataplane . ateapi, atenet, atelet, ateom. What I restart, on purpose.
  6. Sandboxed networking for agents . MVP isolation, not a mesh checkbox.

What scale, GPU, and scheduling posts landed in the afternoon?

  1. Agent platform at scale . Lock identity, pools, and A2A policy while those decisions are still cheap.
  2. Agent action verification . Do not ask a large model if the last step worked.
  3. Suspend-safe networking . Park mid-call and you cut TCP. I do not.
  4. GPUs for agents on Kubernetes . GPU memory does not checkpoint. Keep inference outside the actor.
  5. Scheduling sandboxes for RL . Multiplexing pays while the sandbox waits on the model. Benchmark wall time.
  6. Scheduling agent sandboxes . The runtime packs. It does not pick a winner when the pool is full.
  7. Kubernetes sandbox platform . The primitives work without an LLM. Most of the clever ideas are still bad ideas.
  8. Agent Substrate environment . Files and processes. Not a WorkerPool CRD in the agent loop.
  9. Agent Substrate enterprise . Identity, isolation, scheduling, audit, reset. Density is not a platform.

If you only read three, which ones?

Related angles that are not in the 19: pod per agent , how many agents per Kubernetes pod , running agents in production on Kubernetes , zero trust architecture for AI agents , agent identity vs service account , why OAuth is not enough for agents , agent checkpoint to object storage , who runs next when the agent pool is full , binary verification for agents .

Code from the laptop cluster: themsquared/kagent-substrate-demo , themsquared/substrate-scope .

Frequently asked questions

Where should I start after this Agent Substrate day wrap-up?

The field guide hub. If you already have a cluster, read kubectl is lying to you next. If you are choosing a runtime, read agent sandbox vs Agent Substrate. If two teams will share a pool, read scheduling agent sandboxes.

What did I actually run, versus what is a design take?

The laptop numbers are mine: 18 agents on two workers, over a thousand sessions, about 4.5x lower reserved capacity than always-on pods. Scheduler policy, GPU topology, and enterprise bars are how I would operate, not measurements of a production fleet.

Are these recaps of other people's talks?

No. Each post is my own take on a topic that came up today. The hub is a field guide, not a session list. The in-person room was Agent Substrate Day in Salt Lake City, next to KubeCon.

What is in the 19, and what sits next to them?

The 19 are the topic posts under the hub. Sibling angles such as pod per agent, who runs next when the pool is full, and binary verification are linked from the hub and from the related list on this page.

What three links would I send someone first?

The field guide for the index, kubectl is lying to you if they have a cluster, and scheduling agent sandboxes if two teams will share a pool.

Disagree or have a war story? Reply on X