agent-substrate/substrate

Features

• Persistent Agent Hosting - Running AI agents from any framework as persistent actors that keep their memory and filesystem state across idle periods, so long-lived sessions survive hibernation and resume quickly.
• Stateful Agent Runtimes - Runs AI agents as persistent actors on Kubernetes, preserving their memory and filesystem state across suspends and resumes.
• Snapshot-Based Suspend and Resume - Snapshots idle workloads to durable storage to free their workers, then restores them onto any available worker so work continues from saved state.
• MicroVM Agent Sandboxes - Runs each untrusted agent in its own gVisor or microVM sandbox with separate compute, network and storage, keeping secrets out of the sandbox.
• Framework-Agnostic Agent Hosts - Runs agents and tool servers from standard container images without code changes, so any framework works inside isolated, stateful sandboxes.
• Agent State Snapshots - Captures an agent's memory and filesystem state in snapshots and restores it intact after hibernation so sessions and tool state survive resume.
• Snapshot Capture and Restoration Managers - Captures an actor's memory and disk state into a snapshot on suspend and restores it onto any worker on resume.
• Stateful Agent Hosting - Hosts long-running AI agents built with any framework as persistent actors that keep memory and filesystem state across idle periods.
• Oversubscribed Agent Sharing - Registers many more agents than workers against a shared pool, running only as many at once as capacity allows while others wait.
• Snapshot-Based Agent Multiplexing - Snapshots idle agents out of memory and restores them onto any free worker when a request arrives, running many stateful agents on few machines.
• On-Demand Resume Routing - Directs inbound requests through a router that resumes the target agent on demand and can hold requests until a worker frees up instead of failing.
• Header-Based Actor Routing - Routes HTTP, WebSocket and gRPC requests to a specific actor through a router using a target header, with a local proxy for development.
• Snapshot-Based State Persistence - Snapshots a sandbox's memory and filesystem on suspend and restores them on resume, so files written earlier remain available in later sessions.
• Credential Injection - Adds API keys and tokens to approved outbound requests at an egress gateway, so a compromised agent never holds secrets it could exfiltrate.
• Secure Sandboxing - Runs each untrusted agent or tool in a dedicated gVisor or microVM sandbox so tenants share nodes without sharing a security boundary.
• Traffic Filtering - Routes actor outbound traffic through an egress proxy that checks identity, enforces destination allowlists, filters DNS, and injects credentials.
• Untrusted Workload Sandboxes - Runs each untrusted actor in its own strong compute sandbox with separate network namespace and storage, so actor code cannot reach the host or other actors.
• Workload Identity Authentication - Gives every actor a short-lived certificate and on-demand tokens while keeping sandboxes free of ambient credentials.
• Actor State Persistence - Captures actor volumes, root filesystem, and memory at selectable fidelity levels and stores them durably in object storage for later restore.
• Idle Actor Hibernation - Snapshots idle actors to object storage to free their workers, then restores them onto a ready worker when a request arrives.
• Actor Lifecycle Management - Creates, updates, suspends, resumes, and reverts actors through API calls, including rolling a crashed actor back to its last snapshot.
• Eviction-Safe State Preservation - Signals actors when their worker pod is removed and allows a synchronous suspend within a grace window so state survives drains and upgrades.
• Golden Snapshot Seeding - Boots a template once, snapshots it as a tagged baseline, and starts new actors from that warm state to skip cold-start initialization.
• Golden Snapshot Starts - Captures a shared starting checkpoint at template creation so new workers restore from that saved state instead of booting from scratch.
• Actor Worker Routing - Maps a large set of mostly idle workloads onto a smaller pool of pre-started workers, assigning them in real time to raise density.
• Shared Worker Pools - Lets multiple templates running different binaries draw from one shared worker pool so compute capacity is reused rather than duplicated per template.
• Warm Worker Pools - Defines a pool of standby worker pods ready to receive actor state so workloads start without waiting for fresh compute.
• Agent Workload Templates - Declares the code, environment, resource limits, and state policies for a type of agent in one immutable blueprint that new actors are created from.
• Authenticated Edge Routers - Terminates inbound invocations at an edge router that authenticates callers and verifies policy before cold-starting or resuming an actor.
• Parked Request Holding - Parks inbound requests at the router on an oversubscribed pool until a worker becomes available, instead of rejecting them with an error.
• Default Deny Egress Policies - Redirects an actor's outbound TCP through a tunnel to an egress gateway that allows or refuses each connection per the actor's egress policy.
• Default-Deny Postures - Launches sandboxes and workers with default-deny networking, cutting off control plane paths and denying ingress to control plane pods except required flows.
• Egress Traffic Firewalls - Tunnels outbound actor traffic through an egress proxy that enforces destination policy and substitutes credentials so no ambient secrets live in the sandbox.
• MicroVM Sandboxes - Offers microVM and container-based sandbox classes behind one lifecycle, so isolation strength and restore behavior can be chosen per worker pool.
• Signing Key Rotation - Rotates actor signing keys by publishing a new key, waiting for relying parties to fetch it, activating it, then removing the old one.
• Egress-Triggered Placeholder Swaps - Replaces a placeholder request header with a secret resolved by the gateway at send time, so the actor never holds the real secret.
• Agent Identities - Gives each active agent a short-lived certificate and on-demand tokens so it is individually identifiable and can federate externally.
• Namespace Partitions - Groups actors and snapshot storage paths into isolated partitions and authorizes API callers per partition using relationship-based access control.
• Default-Deny Agent Networking - Applies default-deny networking with no lateral or control-plane access, routing inbound traffic through a router and filtering outbound requests through a replaceable policy-enforcing egress gateway.
• Token Signature Verifiers - Validates actor tokens by checking issuer, signature against the published key set, audience, time claims, and subject so relying parties can trust callers.
• Workload Identity Federation - Giving every actor a short-lived certificate and signed tokens so external services, cloud providers, and CI systems can verify which workload is calling and grant it access without stored secrets.
• Shared Worker Pools Across Namespaces - Allows templates in different atespaces to use the same worker pool, keeping logical separation between teams while sharing infrastructure.
• Snapshot Fidelity Levels - Lets suspend capture memory, root filesystem, or only durable volumes, determining which state survives resume and which resets.
• Agent Management Planes - Registers many agents as actors under a control plane so each can be resumed, suspended, and tracked individually.
• End-to-End Message Tracing - Samples and propagates distributed traces across gateway, router and workers so a request's full lifecycle appears in a tracing backend.
• Agent Protocols and Standards - Kubernetes-native execution runtime for high-density, stateful AI-agent sandboxes.

Star history