diff --git a/docs/superpowers/plans/2026-09-17-agent-substrate-research-note.md b/docs/superpowers/plans/2026-09-17-agent-substrate-research-note.md
new file mode 100644
index 0000000..47875a0
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-17-agent-substrate-research-note.md
@@ -0,0 +1,46 @@
+# Agent Substrate Research Note Implementation Plan
+
+> **For agentic workers:** Execute this plan inline with validation checkpoints.
+
+**Goal:** Add and publish a concise architecture-first research note on Agent Substrate and its Cloud Foundry relevance.
+
+**Architecture:** Describe Substrate as an actor lifecycle and sandbox multiplexing layer: a control plane maps suspended actors onto ready workers, snapshots state, resumes actors on demand, and routes traffic. Separate documented demos from aspirational architecture, then map the model to CF process supervision, routing, isolation, and density.
+
+**Tech Stack:** Markdown, YAML frontmatter, Devbox, Git, GitHub CLI.
+
+---
+
+### Task 1: Write the research note
+
+**Files:**
+- Create: `research/agent-substrate.md`
+
+- [ ] Add frontmatter with title `Agent Substrate: Multiplexed Sandboxed Actors`, author `Ruben Koster (@rkoster)`, date `2026-09-17`, tags `[sandboxing, workload-isolation, orchestration, ecosystem-survey]`, `cf_areas: [diego, capi]`, `status: draft`, provisional ratings, and sources for the repository, README, architecture document, command tour, and counter demo.
+- [ ] Explain the actor/worker model, where many mostly-idle actors are mapped onto fewer ready workers.
+- [ ] Describe lifecycle operations: create/destroy, suspend/resume, worker assignment, routing, and full-state snapshots for process memory and filesystem state.
+- [ ] Describe the component split: `ateapi` gRPC control plane, `atelet` node supervisor, `atecontroller` WorkerPool reconciler, `atenet` Envoy routing, and gVisor/microVM execution helpers.
+- [ ] Distinguish the working counter demonstration from the architecture document's aspirational elements and note that the project is not an officially supported Google product.
+- [ ] Assess Cloud Foundry relevance for Diego density, CAPI lifecycle APIs, route-to-resume behavior, sandbox isolation, snapshot storage, and observability.
+- [ ] Add open questions about CF-native suspend/resume, trusted snapshot formats, network identity, tenant isolation, failure recovery, and whether actor multiplexing belongs in Diego or an adjacent substrate.
+
+### Task 2: Validate and inspect
+
+**Files:**
+- Test: `.github/scripts/validate_notes.py`
+
+- [ ] Run `devbox run validate` and expect all research notes and ideas to be valid.
+- [ ] Run `devbox run test` and expect success.
+- [ ] Run `git diff --check` and inspect `git status --short`; leave unrelated environment artifacts unstaged.
+
+### Task 3: Commit and publish
+
+**Files:**
+- Include: `research/agent-substrate.md`
+- Include: `docs/superpowers/specs/2026-09-17-agent-substrate-research-note-design.md`
+- Include: `docs/superpowers/plans/2026-09-17-agent-substrate-research-note.md`
+
+- [ ] Stage only the three intended files, using `git add -f` for ignored planning artifacts.
+- [ ] Commit with `docs: add Agent Substrate research note`.
+- [ ] Push `research/agent-substrate` to origin.
+- [ ] Open a PR titled `docs: add Agent Substrate research note` targeting `main`, with the repository checklist completed.
+- [ ] Verify the PR URL, branch, state, and CI status with `gh pr view`.
diff --git a/docs/superpowers/specs/2026-09-17-agent-substrate-research-note-design.md b/docs/superpowers/specs/2026-09-17-agent-substrate-research-note-design.md
new file mode 100644
index 0000000..1cbac0c
--- /dev/null
+++ b/docs/superpowers/specs/2026-09-17-agent-substrate-research-note-design.md
@@ -0,0 +1,40 @@
+# Agent Substrate Research Note Design
+
+## Goal
+
+Capture a first-pass, sourced research note on Agent Substrate's architecture and potential
+relevance to Cloud Foundry, with later refinement intentionally left open.
+
+## Scope
+
+The note will cover Agent Substrate's actor/worker model, lifecycle control, suspend/resume
+and snapshotting, sandbox backends, network routing, Kubernetes integration, and the boundary
+between implemented demonstrations and aspirational architecture. It will briefly assess
+Cloud Foundry implications for Diego, CAPI, routing, workload isolation, density, and state
+management.
+
+## Structure
+
+Create `research/agent-substrate.md` using the repository template and required sections:
+
+1. Summary
+2. Key findings
+3. CF relevance
+4. Open questions
+
+Use concise provisional ratings and label this as a research snapshot. Do not present Agent
+Substrate as an officially supported Google product or claim that aspirational architecture is
+already implemented.
+
+## Sources and evidence
+
+Use the Agent Substrate repository README, architecture document, command/component tour,
+observability or API documentation when available, and the counter demo. Claims about Cloud
+Foundry will be analysis or open questions, not claims of existing integration.
+
+## Validation
+
+Run the repository's configured Devbox validation and test scripts, inspect whitespace and
+the staged diff, then commit the note and this approved design spec on `research/agent-substrate`.
+Push the branch and open a new PR targeting `main` without staging unrelated environment
+artifacts.
diff --git a/generated/research-map.html b/generated/research-map.html
index 0aacdfd..ee673dd 100644
--- a/generated/research-map.html
+++ b/generated/research-map.html
@@ -23,6 +23,9 @@
Focus use cases
Attested Workload Authority and Mediated Tool AccessExchange platform-attested workload identity for scoped authority while credentials and outbound tool access remain mediated by the platform.Strategic decision: Decide whether CF should become the portable trust and policy layer between agent workloads and the tools they invoke.Gap, experiments, and evidence
Current CF gap
CF issues workload identity certificates but does not exchange them for scoped tool authority, keep third-party credentials out of workloads, mediate off-platform access, or record delegation-aware audit events.
Candidate POC
Exchange a Diego instance identity certificate for a short-lived scoped token, invoke one allowed tool through a credential proxy and egress mediator, deny another, and emit attributable audit events.
Candidate RFC scope
Define workload token exchange, authority and delegation claims, credential brokering, outbound mediation and policy enforcement, audit events, revocation, and integration boundaries for UAA, routing, and service brokers.
CF can stage apps and run ephemeral tasks but cannot cheaply compose a reusable environment with per-session workspace state, select stronger isolation, constrain session networking, or resume the session lifecycle.
Candidate POC
Start two isolated sessions from one content-addressed staged environment, attach separate mutable workspaces, apply per-session egress policy, stop one session, and resume it on fresh compute.
Candidate RFC scope
Define environment and workspace references, session identity and lifecycle, isolation classes, network policy, workspace persistence and cleanup, scheduling, quotas, and compatibility with existing CF staging and task APIs.