rename ateom -> ateworker by BenTheElder · Pull Request #2254 · agent-substrate/substrate

Benjamin Elder (BenTheElder) · 2026-10-06T18:07:02Z

The PR title becomes the release note. Write it for users: what changed for them, not how the code changed.

Breaking change

Renames the binaries and RPCs ahead of GA. Breaking change.

Fixes #2065

It's a good idea to open an issue first for discussion.

Tests pass
Appropriate changes to documentation are included in the PR

wiz-alphabet · 2026-10-06T18:08:41Z

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1
SAST Findings	4
Software Management Findings	-

Total	1 4

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

Benjamin Elder (BenTheElder) · 2026-10-06T21:00:19Z

  echo "                          for each WorkerPool pod (default: unset, the pod is unsized)."
  echo "  --wait-timeout SECONDS  Forwarded to workloads/deploy.sh. The timeout in seconds for"
-  echo "                          waiting for the ateom workers to be ready (default: 300)"
+  echo "                          waiting for the ateworker workers to be ready (default: 300)"


So this was a direct find and replace (automated at that) but it reads weird. instead

Suggested change

echo " waiting for the ateworker workers to be ready (default: 300)"

echo " waiting for the workers to be ready (default: 300)"

Tim Hockin (thockin)

TL;DR: the places where we just refer to the abstract idea of "a worker" should just say "worker". E.g. if someone could replace our baked-in ateworker with their own worker and the sentence would still make sense, "worker". "ateworker" should refer to specifically our main implementation(s).

But also, most of this is internal - comments etc. Focus on public facing stuff -- proto names and methods and the SPIFFE stuff.

Tim Hockin (thockin) · 2026-10-06T20:42:01Z

@@ -188,7 +188,7 @@ func retryable(err error) bool {
 func requestOnce(ctx context.Context, conn grpc.ClientConnInterface, actor Actor) error {
 	callCtx, cancel := context.WithTimeout(ctx, requestTimeout)
 	defer cancel()
-	_, err := ateletpb.NewAteomSupportClient(conn).RequestActorSuspend(callCtx, &ateletpb.RequestActorSuspendRequest{
+	_, err := ateletpb.NewWorkerSupportClient(conn).RequestActorSuspend(callCtx, &ateletpb.RequestActorSuspendRequest{


In some places "Ateom" -> "Worker" and in others "AteWorker". e.g. certificateSource.MintAteWorkerCertificate(ctx) I can't discern a clear rule.

Tim Hockin (thockin) · 2026-10-06T20:49:12Z

 // otelOverrideDeployments are the control plane Deployments that read
 // ate-otel-config. ate-controller additionally copies the values onto the
-// ateom worker pods it creates, so one patch reaches the whole system.
+// ateworker worker pods it creates, so one patch reaches the whole system.


super nit: "ateworker worker" -> "worker" ?

Tim Hockin (thockin) · 2026-10-06T20:51:37Z

 	crashMessageWorkerIneligible         = "assigned worker no longer satisfies the actor's placement constraints"
 	crashMessageWorkerPodGone            = "worker pod went away while hosting the actor"
-	crashMessageAteomRestarted           = "ateom restarted while hosting the actor"
+	crashMessageAteWorkerRestarted       = "ateworker restarted while hosting the actor"


Above says "worker pod" this says "ateworker" - I don't love embedding the word "pod" here but "worker" seems correct in both

Tim Hockin (thockin) · 2026-10-06T20:52:57Z


 	req := &ateletpb.TerminateRequest{
-		TargetAteomUid:        assignment.GetWorkerPodUid(),
+		TargetAteWorkerUid:    assignment.GetWorkerPodUid(),


Here's a place where "Worker" is clearly more correct - it's the UID of the Worker resource.

Tim Hockin (thockin) · 2026-10-06T20:53:43Z

 	// into the snapshot manifest.
 	req := &ateletpb.CheckpointRequest{
-		TargetAteomUid:        assignment.GetWorkerPodUid(),
+		TargetAteWorkerUid:    assignment.GetWorkerPodUid(),


Another place where "Worker" is clearly more correct - it's the UID of the Worker resource.

Tim Hockin (thockin) · 2026-10-06T22:01:17Z

  // run and one more for each restart. 0 means it has not been reported.
  //
-  // A restarted ateom has lost the sandboxes of the Actors it was hosting, so
+  // A restarted ateworker has lost the sandboxes of the Actors it was hosting, so


Tim Hockin (thockin) · 2026-10-06T22:01:44Z

@@ -2152,7 +2152,7 @@ message WorkerStatus {

  // observed_epoch is the latest epoch whose earlier Actors the control plane
  // has crashed and released. While it is below epoch, Actors placed before
-  // the ateom's last restart may still be reported as running.
+  // the ateworker's last restart may still be reported as running.


Tim Hockin (thockin) · 2026-10-06T22:02:00Z

@@ -2225,19 +2225,19 @@ message ActorAssignment {
 // only to an atelet, and only for the Workers on its own node.
 service WorkerService {
  // SetWorkerCapacity records what a Worker can hold. Capacity is the Worker's
-  // to report rather than the control plane's to infer: it is what the ateom
+  // to report rather than the control plane's to infer: it is what the ateworker


Tim Hockin (thockin) · 2026-10-06T22:03:20Z

  // on behalf of a particular actor.
  //
-  // SPIFFE URI: spiffe://${trustdomain}/ateom-for-actor/${atespace}/${actor}
-  rpc MintAteomActorCertificate(MintAteomActorCertificateRequest) returns (MintAteomActorCertificateResponse);
+  // SPIFFE URI: spiffe://${trustdomain}/ateworker-for-actor/${atespace}/${actor}


This is a very consequential one - should SPIFFE say "ateworker" or "worker"? I think "worker".

Tim Hockin (thockin) · 2026-10-06T22:10:51Z

 	return &url.URL{
 		Scheme: "spiffe",
 		Host:   ActorSPIFFETrustDomain,
 		// TODO(identity): Prefix with "atunnel" to prevent
 		// confusion between atunnel and an actor pretending to be
 		// an atunnel.
-		Path: path.Join("ateom-for-actor", r.Atespace, r.Name),
+		Path: path.Join("ateworker-for-actor", r.Atespace, r.Name),


Taahir Ahmed (@ahmedtd) this is a decision that will stick for a long time?

Benjamin Elder (BenTheElder) · 2026-10-07T01:11:14Z

TL;DR: the places where we just refer to the abstract idea of "a worker" should just say "worker". E.g. if someone could replace our baked-in ateworker with their own worker and the sentence would still make sense, "worker". "ateworker" should refer to specifically our main implementation(s).

Agree.

But also, most of this is internal - comments etc. Focus on public facing stuff -- proto names and methods and the SPIFFE stuff.

Yeah that makes sense, we can punt internal cleanups to later.

Benjamin Elder (BenTheElder) · 2026-10-07T01:33:22Z

I do think we should rename the internal packages to match and that's going to cause churn but we can do that separately from nailing down the user-visible renames.

ateom was named when it hosted a single actor; a worker now hosts many. cmd/ateom-gvisor and cmd/ateom-microvm become ateworker-gvisor and ateworker-microvm, and so do their images.

The package name is part of every method name on the wire.

Ateom becomes ateworker.Worker and AteomSupport becomes atelet.WorkerSupport: the proto package already names the component. AteomHerder, which ateapi calls to drive actors on a node, becomes atelet.Atelet.

The field carries the worker pod's UID, matching worker_pod_uid in the public API.

Match the worker services.

The certificate asserts a worker acting for an actor, whatever the worker implementation.

ateworker is our implementation; these APIs describe any worker.

The container runs whatever image the WorkerPool names, so it is the worker container, not necessarily an ateworker.

The phases time the worker's restore and checkpoint calls, whatever the worker implementation.

Client-visible errors, the crash message, CRD and user docs, manifests and the metric registry say worker for the generic concept and ateworker for our implementation.

The keys are documented and joined by benchmarking tooling, so they follow the binary's name.

Operators read these, so they follow the same rule as the docs.

The worker's own leaf under its container cgroup becomes worker. The micro-VM guest's per-actor container parent becomes /actor, a name other runtimes can share.

Per-worker directories move to /var/lib/ate/workers/<pod-uid> with a worker.sock, and the support socket becomes worker-support.sock. The /var/lib/ate hostPath volume is ate-base everywhere, and the capacity volume is worker-capacity.

Covers the authz relation, e2e fixtures, benchmark names and queries, and the remaining docs. Internal Go package names are left for later.

Code outside the ateworker binaries says worker; the binaries say ateworker for themselves. Go package names are left for later.

Benjamin Elder (BenTheElder) added area/gvisor area/microVM area/api-machinery breaking-change PRs with breaking changes labels Oct 6, 2026

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch 3 times, most recently from cbdecb7 to 8964f28 Compare October 6, 2026 20:53

Benjamin Elder (BenTheElder) commented Oct 6, 2026

View reviewed changes

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch from 8964f28 to a6d3602 Compare October 6, 2026 21:05

Tim Hockin (thockin) reviewed Oct 6, 2026

View reviewed changes

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch 4 times, most recently from 722c093 to d11206d Compare October 7, 2026 03:00

Benjamin Elder (BenTheElder) added 13 commits October 7, 2026 16:22

rename the ateom binaries and images to ateworker

844b946

ateom was named when it hosted a single actor; a worker now hosts many. cmd/ateom-gvisor and cmd/ateom-microvm become ateworker-gvisor and ateworker-microvm, and so do their images.

rename the ateom proto package to ateworker

b6ed791

The package name is part of every method name on the wire.

rename the worker services to Worker, WorkerSupport and Atelet

568d6de

Ateom becomes ateworker.Worker and AteomSupport becomes atelet.WorkerSupport: the proto package already names the component. AteomHerder, which ateapi calls to drive actors on a node, becomes atelet.Atelet.

rename target_ateom_uid to target_worker_pod_uid

eb8f330

The field carries the worker pod's UID, matching worker_pod_uid in the public API.

rename MintAteomActorCertificate to MintWorkerActorCertificate

0bb20f7

Match the worker services.

rename the ateom-for-actor SPIFFE path to worker-for-actor

0daa095

The certificate asserts a worker acting for an actor, whatever the worker implementation.

say worker for the generic concept in protos

0073def

ateworker is our implementation; these APIs describe any worker.

rename the worker pod's ateom container to worker

6cbfdc4

The container runs whatever image the WorkerPool names, so it is the worker container, not necessarily an ateworker.

rename the ateom snapshot phases to worker_restore and worker_checkpoint

82da702

The phases time the worker's restore and checkpoint calls, whatever the worker implementation.

say worker or ateworker in user-facing text

19edc5a

Client-visible errors, the crash message, CRD and user docs, manifests and the metric registry say worker for the generic concept and ateworker for our implementation.

rename ateworker-microvm's phase timing keys to ateworker.actor.*

9e01cb8

The keys are documented and joined by benchmarking tooling, so they follow the binary's name.

say worker or ateworker in log messages and help text

0037099

Operators read these, so they follow the same rule as the docs.

rename the ateom cgroups

9bab9bb

The worker's own leaf under its container cgroup becomes worker. The micro-VM guest's per-actor container parent becomes /actor, a name other runtimes can share.

Benjamin Elder (BenTheElder) added 3 commits October 7, 2026 16:26

rename the ateom node paths and volumes

a8f059f

Per-worker directories move to /var/lib/ate/workers/<pod-uid> with a worker.sock, and the support socket becomes worker-support.sock. The /var/lib/ate hostPath volume is ate-base everywhere, and the capacity volume is worker-capacity.

rename ateom in scripts, config and docs

fd46f74

Covers the authz relation, e2e fixtures, benchmark names and queries, and the remaining docs. Internal Go package names are left for later.

rename ateom in Go identifiers, strings and comments

4702dca

Code outside the ateworker binaries says worker; the binaries say ateworker for themselves. Go package names are left for later.

Benjamin Elder (BenTheElder) force-pushed the rename-ateom branch from d11206d to 4702dca Compare October 7, 2026 23:30

	echo " waiting for the ateworker workers to be ready (default: 300)"
	echo " waiting for the workers to be ready (default: 300)"

Conversation

Benjamin Elder (BenTheElder) commented Oct 6, 2026

Breaking change

Uh oh!

wiz-alphabet Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Tim Hockin (thockin) left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Benjamin Elder (BenTheElder) commented Oct 7, 2026

Uh oh!

Benjamin Elder (BenTheElder) commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

wiz-alphabet Bot commented Oct 6, 2026 •

edited

Loading