Provenance Record

Well-structured News article (1009 words, within the 400-1200 News range) that attributes the donation, the GA claim, the performance figures and the kernel-patch statement to Google by name, reports the CNCF GitHub records and the v1.0.0 release as primary records, and leaves the Google 'last month' wording versus the GitHub dates and the Google/LWN kernel-patch accounts side by side without reconciling them. A 'What we don't know' section lists real gaps. Title is 144 characters (under the 150 limit; noted per instruction).

All 9 snapshots decompressed and re-hashed (sha256 of uncompressed content matches manifest.json for source-0..8); no suspicious_patterns on any source. Independent-source recount (per outlet, not the writer's count): Google Cloud blog = the subject's own first-party post; The New Stack (Paul Sawers, Nov 6 2026) = independent trade outlet; LWN (Jonathan Corbet, July 29 2022) = independent, but a report on a different, earlier event (one KVM hypercall patch series), used only as context; OpenAI security report (Nov 4 2026) = independent of Google but a gVisor user named by Google, so not independent of the subject's ecosystem; CNCF sandbox issues #521/#523/#518 = the receiving foundation's own automation records plus applicant comments (primary records, not independent reporting); agent-substrate v1.0.0 release and PR #3237 = the project's own first-party records. Result: 2 independent outlets (The New Stack, LWN) plus 1 independent-of-Google ecosystem party (OpenAI); the rest are primary/first-party. No Analysis threshold applies (category News). Anthropic disclosure: not required - Anthropic is named once in the body, inside Google's list of outside gVisor users ('Anthropic and OpenAI use it to contain code execution'); not the subject, not in headline/summary/lead, no credit line in a passage of its own. SOURCE 0 (cloud.google.com blog, source-0.html.gz, sha256 83c09a40...): confirmed - dated November 5, 2026, author Drew Bradstock (VP Product Management, Orchestration & Kubernetes); 'Today, we are announcing the donation of Agent Substrate, gVisor, and OpenRL, three open source projects that started at Google, to the CNCF following their acceptance last month into the CNCF Sandbox'; 'Agent Substrate has reached its 1.0 milestone and is now generally available as Agent Substrate on GKE'; 'Each project is now working through CNCF Sandbox onboarding with community maintainers and independent build infrastructure, and gVisor is on a path toward Incubation'; quotes 'a lightweight application kernel written in Go', 'Cloud Hypervisor microVMs or gVisor', 'a clean, self-hosted Python post-training loop directly to your Kubernetes cluster', 'millions of sandboxes every day underneath GKE Sandbox and Cloud Run', 'have committed to join gVisor's maintainers' all verbatim; 'under 500 milliseconds', 'millions of sandboxes at 10x container density', 'more than 500 suspend and resume activations per second' present and no hardware/workload stated; Actors/Workers/Gateways description matches; 'Anthropic and OpenAI use it', 'Modal and Snowflake', 'Ant Group and Tencent' match; 'OpenAI, Tencent, and NVIDIA continuing their contributions' matches; 'Upstream Linux maintainers declined to merge them while the project was owned by a single vendor' (article omits Google's 'all' before 'carry host kernel patches', harmless); KubeCon NA Salt Lake City November 9 to 12 with sessions and Google Cloud booth matches. The headline 'Agent Substrate 1.0 Reaches GA on GKE' is Google's stated claim (post subtitle: 'Agent Substrate has reached 1.0, and is GA on GKE') and the summary/lead attribute it to Google; the GitHub v1.0.0 release is the open-source 1.0 tag (published 2026-11-05T23:55:26Z, created 23:03:57Z, by GitHub API), which the article lists separately and does not equate with the GKE product. SOURCE 1 (thenewstack.io, source-1.html.gz, Wayback capture web.archive.org/web/20261107053752/..., archive_fallback true although the live URL returned 200, sha256 e4ae25d4...): I also fetched the live URL with a browser User-Agent (HTTP 200, 1235519 bytes, sha256 2c9d82d3cc1f64ba0e66a5d01211dd5e64802585fb6b7b4fff8d01c73eab9ae3) and confirmed the same passages in both: byline Paul Sawers, Nov 6th 2026; 'in the hope they become industry standards, just as Kubernetes did for containers'; 'The CNCF accepted gVisor's application in late September, with Google publicly announcing its plans a few days later. The project's onboarding process began last week'; 'In its original October announcement' Perot and Chen 'outlined plans to move the project's development and testing infrastructure outside Google, give external maintainers permission to merge code, and introduce a governance model that prevents any single company from exercising unilateral control' (article's paraphrase accurate); 'In a security report published just on Wednesday, OpenAI cited sandboxes such as gVisor and Firecracker as important for limiting the damage from exploited Linux kernel vulnerabilities' (Wednesday = Nov 4 2026; Google's Thursday = Nov 5); 'While such interactions don't focus on Google's ownership as a reason for the objections' - the article's 'The New Stack notes that such interactions do not focus on Google's ownership as a reason' is accurate. The New Stack itself links the LWN report to the single-vendor claim (it says 'it's clear that moving to CNCF governance should go some distance toward addressing concerns about single-vendor control'); the article does not adopt that inference and states that LWN's text gives no vendor-ownership reason, which is accurate. The New Stack also says OpenAI 'uses it to isolate code execution' and that Anthropic runs Claude-generated code in gVisor containers; the article attributes the use claims to Google's post, which also states them. SOURCE 2 (lwn.net/Articles/902585/, source-2.html.gz, sha256 53b72371...): confirmed - 'Direct host system calls from KVM' by Jonathan Corbet, July 29, 2022; Andrei Vagin's patch series adds a new hypercall KVM_HC_HOST_SYSCALL so the guest kernel can run a system call directly on the host; Thomas Gleixner: 'this exposes a magic kernel syscall interface to random driver writers. Seriously no' (article quote is a verbatim clip); 'KVM maintainer Paolo Bonzini said that his largest objection is the lack of address translation between the guest and the host'. LWN gives no vendor-ownership reason and does not say the series is among the patches Google means; LWN also records that Gleixner called it 'a clever idea' and that Vagin said it only improves performance - the article's 'objections on technical grounds' is a fair summary and it neither says LWN supports nor refutes Google's statement. SOURCES 3, 4, 5 (cncf/sandbox #521 gVisor, #523 Agent Substrate, #518 OpenRL; snapshots source-3/4/5): the HTML snapshots for #521 and #523 collapse the later comments behind 'Load more', so I read the raw records through the GitHub REST API (gh api repos/cncf/sandbox/issues/N and /comments, UTC timestamps). Confirmed: #521 created 2026-09-07T22:15:14Z; 'Vote closed - The vote passed' bot comments at 2026-09-28T08:16:00Z (#521), 08:16:04Z (#523), 08:16:06Z (#518), each showing 8 in favour, 0 against, 0 abstain, 3 not voted of 11 binding (72.73%); onboarding-issue bot comments at 2026-10-20T23:42:05Z (Agent Substrate, onboarding issue #542) and 2026-10-20T23:42:20Z (OpenRL, #543), and 2026-10-28T20:45:39Z (gVisor, #546); the 2026-10-15T17:19:22Z comment on #523 says 'currently the projects enforces Google CLA'. The article's 'late September acceptance' versus Google's 'last month' point is therefore reported accurately: the TOC votes closed Sept 28 and the onboarding issues opened Oct 20/Oct 28 (the article reports both without reconciling). SOURCE 6 (agent-substrate v1.0.0 release, source-6): title 'v1.0.0 - Fully armed and operational'; published_at 2026-11-05T23:55:26Z, not a draft or pre-release; Breaking Changes section contains 13 entries including the --cordon-control-plane rename to --cordon-system-infra-components (PR 3210) and removal of the unused public MintActorCertificate API (PR 3427) - the article's 'among other entries' is correct; the notes list 'docs: require DCO sign-off instead of the Google CLA' (PR 3237). SOURCE 7 (PR #3237): merged, API merged_at 2026-10-27T03:36:07Z (the snapshot page shows Oct 27, 2026; created 2026-10-26T20:53:16Z, so the date basis matters and the article states UTC for GitHub timestamps). The PR description reads 'Part of cncf/sandbox#542' (the Agent Substrate onboarding issue) and 'I have enabled DCO enforcement, and will shortly drop the Google CLA enforcement'. This contradicts the article's absence sentence 'No cited source links the two' only in part (the PR links the DCO change to the CNCF onboarding issue, not to the Oct 15 comment) - filed as a clarification. SOURCE 8 (openai.com/index/a-thousand-fewer-paths-to-root/, source-8, sha256 ac2c39cd...): the pipeline captured the page directly (HTTP 200, no archive fallback), so the writer's Archive.org route was not needed; text read in full: dated November 4, 2026; 'Defense in depth, using sandboxes and isolation approaches like Firecracker and gVisor are important for limiting the blast radius of exploited vulnerabilities' - the article's verbatim quote of 'are important for limiting the blast radius of exploited vulnerabilities' is exact. The report does NOT state that OpenAI uses gVisor in production (its only other gVisor mention: 'We have proactively tested our infrastructure, disclosing and patching many vulnerabilities in Kata, Moby/Docker, gVisor, and other projects'); the article does not claim it does - it attributes OpenAI's use to Google's post (which says it) and cites the report only for the defence-in-depth statement. Quantifier and absence tests run (jq + grep on title/summary/body): 'each project' (Google: 'Each project is now working...' verbatim), 'a bot comment on each of the three Sandbox issues' (verified item by item above), 'none against' (0 against in each), 'No cited source links the two' (partly contradicted by PR #3237, see correction), 'None of the cited sources says why the post words it that way' (holds), 'None of the cited sources says whether that series is among the patches' (holds), 'Google's post and The New Stack do not identify the kernel patches... or when' (holds), 'The cited sources do not say when the planned changes... will be complete' (incomplete: the CNCF bot comments on all three issues tell the project to 'Complete onboarding within one month of acceptance', see correction). Dates: all calendar dates, UTC basis stated for GitHub timestamps, sequence in chronological order, no relative dates outside quotations ('last month' is quoted and discussed). Derived figures: no figure computed by the Herald other than the vote count, which is copied from the bot's table (8/0). Vendor figures are labelled as Google's. Internal link /article/2026-10/12-gke-sandbox-... exists and the article does compare GKE Sandbox microVM with gVisor. Allowlist: cloud.google.com, thenewstack.io, lwn.net, github.com and openai.com are all in config/source_allowlist.txt; no additions needed. gvisor.dev is not cited.

Headline, summary and lead are each supported by cited sources, with Google's claims attributed to Google. No fabricated specifics, no misattributed quotes, no orphan URLs (all 9 sources in the body, plus one internal Herald link). Two subordinate absence sentences are incomplete and are corrected by clarification: (1) 'No cited source links the two' omits that PR #3237 says 'Part of cncf/sandbox#542' (Agent Substrate's CNCF onboarding issue) and 'I have enabled DCO enforcement, and will shortly drop the Google CLA enforcement'; (2) 'The cited sources do not say when the planned changes ... will be complete' omits that the CNCF bot comments on the three issues set a target of completing onboarding within one month of acceptance.

Accurate, carefully attributed News article on a significant open-source governance move; approved with two clarifications to subordinate absence sentences. Featured candidacy: 2 - three AI-agent infrastructure projects moving to neutral CNCF governance, with Agent Substrate 1.0, is significant for the broad cloud-native and AI-agent developer audience but not industry-changing