Fix agentgateway release pin

[danehans]

Summary

Pin agentgateway and agentgateway-crds to the published agentgateway v1.3.1 release and refresh the generated BOM docs.

Motivation / Context

v2.2.1 is not an agentgateway release, so inference recipes were pointing at an invalid upstream chart version.

Fixes: #1467
Related: #1646

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• API server (cmd/aicrd, pkg/server)
• Recipe engine / data (pkg/recipe)
• Bundlers (pkg/bundler, pkg/component/*)
• Collectors / snapshotter (pkg/collector, pkg/snapshotter)
• Validator (pkg/validator)
• Core libraries (pkg/errors, pkg/k8s)
• Docs/examples (docs/, examples/)
• Other: ____________

Implementation Notes

The agentgateway CRD health check now also asserts the chart-installed agentgateway.dev CRDs are established.

Testing

make bom-docs
make qualify

Also deployed a focused agentgateway bundle to a fresh Kind cluster and verified the controller, inference gateway, Gateway status, service source ranges, and live Chainsaw health checks.

Risk Assessment

• Low — Isolated chart pin correction, validated with template checks and live Kind deployment
• Medium — Touches multiple components or has broader impact
• High — Breaking change, affects critical paths, or complex rollout

Rollout notes: N/A

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S) — GPG signing info

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Welcome to AICR, @danehans! Thanks for your first pull request.

Before review, please ensure:

• All commits are signed off per the DCO
• CI checks pass (tests, lint, security scan)
• The PR description explains the why behind your changes

A maintainer will review this soon.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 05563a47-b84a-4911-a982-bf790881f83b

📥 Commits

Reviewing files that changed from the base of the PR and between 7b879fb and 21dc900.

📒 Files selected for processing (2)

• docs/user/container-images.md
• recipes/registry.yaml

---

📝 Walkthrough

Walkthrough

The PR updates agentgateway and agentgateway-crds references from v2.2.1 to v1.3.1 across recipes, documentation, and a conformance assertion. It also clarifies the CRD health-check scope and adds validation that three agentgateway.dev CRDs reach Established=True.

Estimated code review effort: 2 (Simple) | ~15 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: fixing the agentgateway release pin.
Description check	✅ Passed	The description matches the PR's pin correction, docs refresh, and health-check update.
Linked Issues check	✅ Passed	The changes correct the agentgateway and agentgateway-crds pins in the targeted recipe files as requested by #1467.
Out of Scope Changes check	✅ Passed	No clearly unrelated changes are present; the docs and test updates support the pin fix and reported implementation notes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-fix-agentgateway-release-pin.docs.buildwithfern.com/aicr

[github-actions]

Recipe evidence check

Registry change: scoped to recipes that reference a changed component
entry in recipes/registry.yaml (not every leaf).

Protected recipes

Recipes with committed evidence (recipes/evidence/<slug>/<source>/<digest>.yaml) that this PR affects: 1

Recipe	Source	Pointer	Verify	Digest match
h100-aks-ubuntu-inference-dynamo	5bf9e82f0e90a11528ac85f4bcb866c8	sha256-f8d2a0188274d179f37dfe39a257aeaa3fbb97273162586853e0986bfa5d3c05	✅ passed	⚠️ stale (8e88ca57dea5… vs current ee0b1a319318…)

Other affected recipes without evidence yet: 26

These recipes are affected by this PR but carry no committed evidence pointer, so there is
nothing to verify. This is expected — evidence is hardware-gated and added over time.

• b200-gke-cos-inference-dynamo
• b200-gke-cos-inference
• gb200-eks-inference
• gb200-eks-ubuntu-inference-dynamo
• gb200-eks-ubuntu-inference
• gb200-oke-inference
• gb200-oke-ubuntu-inference-dynamo
• gb200-oke-ubuntu-inference
• h100-aks-inference
• h100-aks-ubuntu-inference
• h100-eks-inference
• h100-eks-ubuntu-inference-dynamo
• h100-eks-ubuntu-inference-nim
• h100-eks-ubuntu-inference
• h100-gke-cos-inference-dynamo
• h100-gke-cos-inference
• h100-kind-inference-dynamo
• h100-kind-inference
• h200-eks-inference
• l40s-oke-inference
• rtx-pro-6000-eks-inference
• rtx-pro-6000-eks-ubuntu-inference-dynamo
• rtx-pro-6000-eks-ubuntu-inference-nim
• rtx-pro-6000-eks-ubuntu-inference
• rtx-pro-6000-lke-inference
• rtx-pro-6000-lke-ubuntu-inference

How to refresh evidence

Run on a cluster matching the recipe's criteria:

aicr snapshot -o snapshot.yaml
aicr validate \
  -r recipes/overlays/<slug>.yaml \
  -s snapshot.yaml \
  --emit-attestation ./out \
  --push ghcr.io/<your-fork>/aicr-evidence
# Copy to the per-source path printed in the emit 'copyTo' hint:
#   recipes/evidence/<slug>/<source>/<bundle-digest>.yaml

This gate is warning-only and never blocks merge. See ADR-007 for the trust model.

[yuanchen8911]

thanks for the PR, left a few comments. PTAL.

[yuanchen8911]

cc @danehans

Approving. The re-pin is correct and complete (registry, mixin, BOM, chainsaw assert), and the agentgateway.dev CRD Established asserts close the gap noted in #1221. The CRD-schema mismatch is non-blocking per the thread; follow-up issue to come.

Before merge: please rebase onto current main (the branch is ~90 commits behind and the merge gate will require it), re-run make bom-docs since the BOM has drifted on main, and mark the PR ready for review.

[yuanchen8911]

Follow-up issue filed: #1646 — chore(recipes): vendor GAIE v1.5.0 CRDs for agentgateway (appProtocol support)

[lockwobr]

@yuanchen8911 this is still in draft, do you know why?