Atespace: per-tenant scoping for the actor lifecycle

cmd/ateapi/internal/controlapi/create_actor.go

@@ -41,14 +41,24 @@ func (s *Service) CreateActor(ctx context.Context, req *ateapipb.CreateActorRequ
 		return nil, fmt.Errorf("while getting ActorTemplate: %w", err)
 	}
 
-	id := req.GetActorId()
+	// The atespace must already exist.
+	exists, err := s.persistence.AtespaceExists(ctx, req.GetRef().GetAtespace())
+	if err != nil {
+		return nil, fmt.Errorf("while checking atespace: %w", err)
+	}
+	if !exists {
+		return nil, status.Errorf(codes.FailedPrecondition, "Atespace %s not found", req.GetRef().GetAtespace())
+	}
+
+	id := req.GetRef().GetName()
 	actor := &ateapipb.Actor{
 		ActorId:                id,
 		Version:                1,
 		Status:                 ateapipb.Actor_STATUS_SUSPENDED,
 		ActorTemplateNamespace: req.GetActorTemplateNamespace(),
 		ActorTemplateName:      req.GetActorTemplateName(),
 		WorkerSelector:         req.GetWorkerSelector(),
+		Atespace:               req.GetRef().GetAtespace(),
 	}
 	err = s.persistence.CreateActor(ctx, actor)
 	if err != nil {
@@ -58,7 +68,7 @@ func (s *Service) CreateActor(ctx context.Context, req *ateapipb.CreateActorRequ
 		return nil, fmt.Errorf("while recording actor: %w", err)
 	}
 
-	storedActor, err := s.persistence.GetActor(ctx, id)
+	storedActor, err := s.persistence.GetActor(ctx, req.GetRef().GetAtespace(), id)
 	if err != nil {
 		return nil, fmt.Errorf("while fetching recorded actor from DB: %w", err)
 	}
@@ -75,10 +85,16 @@ func validateCreateActorRequest(req *ateapipb.CreateActorRequest) error {
 	if req.GetActorTemplateName() == "" {
 		return status.Error(codes.InvalidArgument, "actor_template_name is required")
 	}
-	if req.GetActorId() == "" {
+	if req.GetRef().GetName() == "" {
 		return status.Error(codes.InvalidArgument, "actor_id is required")
 	}
-	if err := resources.ValidateActorID(req.GetActorId()); err != nil {
+	if err := resources.ValidateActorID(req.GetRef().GetName()); err != nil {
+		return status.Error(codes.InvalidArgument, err.Error())
+	}
+	if req.GetRef().GetAtespace() == "" {
+		return status.Error(codes.InvalidArgument, "atespace is required")
+	}
+	if err := resources.ValidateAtespace(req.GetRef().GetAtespace()); err != nil {
 		return status.Error(codes.InvalidArgument, err.Error())
 	}
 	if err := validateSelector(req.GetWorkerSelector()); err != nil {

cmd/ateapi/internal/controlapi/create_atespace.go

@@ -0,0 +1,53 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controlapi
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/agent-substrate/substrate/cmd/ateapi/internal/store"
+	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func (s *Service) CreateAtespace(ctx context.Context, req *ateapipb.CreateAtespaceRequest) (*ateapipb.CreateAtespaceResponse, error) {
+	if err := validateCreateAtespaceRequest(req); err != nil {
+		return nil, err
+	}
+
+	atespace := &ateapipb.Atespace{Name: req.GetName()}
+	if err := s.persistence.CreateAtespace(ctx, atespace); err != nil {
+		if errors.Is(err, store.ErrAlreadyExists) {
+			return nil, status.Errorf(codes.AlreadyExists, "Atespace %s already exists", req.GetName())
+		}
+		return nil, fmt.Errorf("while recording atespace: %w", err)
+	}
+
+	return &ateapipb.CreateAtespaceResponse{Atespace: atespace}, nil
+}
+
+func validateCreateAtespaceRequest(req *ateapipb.CreateAtespaceRequest) error {
+	if req.GetName() == "" {
+		return status.Error(codes.InvalidArgument, "name is required")
+	}
+	if err := resources.ValidateAtespace(req.GetName()); err != nil {
+		return status.Error(codes.InvalidArgument, err.Error())
+	}
+	return nil
+}

cmd/ateapi/internal/controlapi/delete_actor.go

@@ -31,16 +31,16 @@ func (s *Service) DeleteActor(ctx context.Context, req *ateapipb.DeleteActorRequ
 		return nil, err
 	}
 
-	if err := s.persistence.DeleteActor(ctx, req.GetActorId()); err != nil {
+	if err := s.persistence.DeleteActor(ctx, req.GetRef().GetAtespace(), req.GetRef().GetName()); err != nil {
 		if errors.Is(err, store.ErrNotFound) {
-			return nil, status.Errorf(codes.NotFound, "Actor %s not found", req.GetActorId())
+			return nil, status.Errorf(codes.NotFound, "Actor %s not found", req.GetRef().GetName())
 		}
 		if errors.Is(err, store.ErrFailedPrecondition) {
-			actor, getErr := s.persistence.GetActor(ctx, req.GetActorId())
+			actor, getErr := s.persistence.GetActor(ctx, req.GetRef().GetAtespace(), req.GetRef().GetName())
 			if getErr == nil {
-				return nil, status.Errorf(codes.FailedPrecondition, "Actor %s is not suspended (status: %v)", req.GetActorId(), actor.GetStatus())
+				return nil, status.Errorf(codes.FailedPrecondition, "Actor %s is not suspended (status: %v)", req.GetRef().GetName(), actor.GetStatus())
 			}
-			return nil, status.Errorf(codes.FailedPrecondition, "Actor %s is not suspended", req.GetActorId())
+			return nil, status.Errorf(codes.FailedPrecondition, "Actor %s is not suspended", req.GetRef().GetName())
 		}
 		if errors.Is(err, store.ErrPersistenceRetry) {
 			return nil, status.Error(codes.Aborted, "concurrent update conflict, please retry")
@@ -52,11 +52,14 @@ func (s *Service) DeleteActor(ctx context.Context, req *ateapipb.DeleteActorRequ
 }
 
 func validateDeleteActorRequest(req *ateapipb.DeleteActorRequest) error {
-	if req.GetActorId() == "" {
+	if req.GetRef().GetName() == "" {
 		return status.Error(codes.InvalidArgument, "actor_id is required")
 	}
-	if err := resources.ValidateActorID(req.GetActorId()); err != nil {
+	if err := resources.ValidateActorID(req.GetRef().GetName()); err != nil {
 		return status.Error(codes.InvalidArgument, err.Error())
 	}
+	if req.GetRef().GetAtespace() == "" {
+		return status.Error(codes.InvalidArgument, "atespace is required")
+	}
 	return nil
 }

cmd/ateapi/internal/controlapi/delete_atespace.go

@@ -0,0 +1,55 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controlapi
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/agent-substrate/substrate/cmd/ateapi/internal/store"
+	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func (s *Service) DeleteAtespace(ctx context.Context, req *ateapipb.DeleteAtespaceRequest) (*ateapipb.DeleteAtespaceResponse, error) {
+	if err := validateDeleteAtespaceRequest(req); err != nil {
+		return nil, err
+	}
+
+	if err := s.persistence.DeleteAtespace(ctx, req.GetName()); err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return nil, status.Errorf(codes.NotFound, "Atespace %s not found", req.GetName())
+		}
+		if errors.Is(err, store.ErrFailedPrecondition) {
+			return nil, status.Errorf(codes.FailedPrecondition, "Atespace %s is not empty", req.GetName())
+		}
+		return nil, fmt.Errorf("while deleting atespace from DB: %w", err)
+	}
+
+	return &ateapipb.DeleteAtespaceResponse{}, nil
+}
+
+func validateDeleteAtespaceRequest(req *ateapipb.DeleteAtespaceRequest) error {
+	if req.GetName() == "" {
+		return status.Error(codes.InvalidArgument, "name is required")
+	}
+	if err := resources.ValidateAtespace(req.GetName()); err != nil {
+		return status.Error(codes.InvalidArgument, err.Error())
+	}
+	return nil
+}