@@ -2,7 +2,7 @@ name: Upgrade Test Setup
 
 description: >-
   Shared prelude for the upgrade-tests and rolling-upgrade-tests jobs: resolve
-  the upgrade-from version, skip redundant and pre-Goose legs, and bring up the
+  the upgrade-from version, skip redundant legs and releases older than the CLI-managed database, and bring up the
   build/cluster toolchain. Exposes the resolved version and skip flag so the
   caller can gate its test step. The caller MUST run actions/checkout (with
   fetch-depth: 0 + fetch-tags) before this action — a local action is loaded
@@ -15,7 +15,7 @@ inputs:
 
 outputs:
   skip:
-    description: '"true" when this leg is redundant or predates Goose and the caller should skip its test step.'
+    description: '"true" when this leg is redundant or predates the CLI-managed database and the caller should skip its test step.'
     value: ${{ steps.resolve.outputs.skip }}
   version:
     description: The resolved upgrade-from version (empty when skip is true).
@@ -69,8 +69,9 @@ runs:
           fi
           V="$(./scripts/upgrade-from-version.sh)"
         fi
-        if [[ "$V" == 0.10.* ]]; then
-          echo "previous release v$V predates Goose; skipping upgrade tests."
+        # Keep in sync with CLI_DATABASE_SENTINEL in the Makefile.
+        if ! git cat-file -e "v$V:go/core/cli/internal/commands/bundled_postgres.sql" 2>/dev/null; then
+          echo "previous release v$V predates the database kagent install manages; skipping upgrade tests."
           echo "skip=true" >> "$GITHUB_OUTPUT"
           exit 0
         fi
 
@@ -323,7 +323,6 @@ jobs:
         env:
           OPENAI_API_KEY: fake
           BUILDX_BUILDER_NAME: ${{ env.BUILDX_BUILDER_NAME }}
-          KAGENT_HELM_EXTRA_ARGS: --cleanup-on-fail=false
           DOCKER_BUILD_ARGS: >-
             --cache-from=type=gha,scope=${{ needs.setup.outputs.cache-key }}-e2e
             --cache-from=type=gha,scope=${{ env.CACHE_KEY_PREFIX }}-main-e2e
@@ -371,7 +370,6 @@ jobs:
         env:
           OPENAI_API_KEY: fake
           BUILDX_BUILDER_NAME: ${{ env.BUILDX_BUILDER_NAME }}
-          KAGENT_HELM_EXTRA_ARGS: --cleanup-on-fail=false
           DOCKER_BUILD_ARGS: >-
             --cache-from=type=gha,scope=${{ needs.setup.outputs.cache-key }}-e2e
             --cache-from=type=gha,scope=${{ env.CACHE_KEY_PREFIX }}-main-e2e
 
@@ -14,6 +14,7 @@ VERSION ?= $(shell git describe --tags --always 2>/dev/null | grep v || echo "v0
 
 # Local architecture detection to build for the current platform
 LOCALARCH ?= $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
+LOCALOS ?= $(shell uname -s | tr '[:upper:]' '[:lower:]')
 
 KUBECONFIG_PERM ?= $(shell \
   if [ "$$(uname -s | tr '[:upper:]' '[:lower:]')" = "darwin" ]; then \
@@ -55,6 +56,8 @@ KIND_KUBECONFIG ?= /tmp/kind-config
 # Substrate settings for Kind: workers pull localhost:5001 images through the
 # registry container, and templates reconcile at the minimum interval.
 KIND_SUBSTRATE_HELM_ARGS = --set atelet.extraArgs[0]=--localhost-registry-replacement=kind-registry:5000 --set ateApi.extraArgs[0]=--template-resync-interval=250ms
+# A file only releases whose `kagent install` deploys the database contain.
+CLI_DATABASE_SENTINEL = go/core/cli/internal/commands/bundled_postgres.sql
 KAGENT_POSTGRES_SECRET ?= kagent-postgres
 
 CONTROLLER_IMAGE_NAME ?= controller
@@ -534,16 +537,11 @@ helm-uninstall: ## Uninstall kagent and kagent-crds Helm releases from the kind
 	helm uninstall kagent --namespace kagent --kube-context kind-$(KIND_CLUSTER_NAME) --wait
 	helm uninstall kagent-crds --namespace kagent --kube-context kind-$(KIND_CLUSTER_NAME) --wait
 
-# Upgrade tests install a previous Kagent chart and upgrade it to the current build.
+# Upgrade tests install a previous release with that release's own `kagent install`,
+# exactly as a user would, then upgrade it to the current build with kagent-cli-deploy.
 # The tests use a separate cluster because they change the database and deployment.
-# The tests skip releases that do not use Goose.
-# UPGRADE_FROM_VERSION selects the previous release.
-# The previous install pins the bundled Postgres image to whatever the
-# upgrade-from release's own install target shipped (resolved inside
-# install-previous-release), so the baseline matches how that release actually
-# runs rather than a hardcoded guess; the upgrade then exercises the real
-# app/migration (and any DB image) change between that release and the current
-# build.
+# UPGRADE_FROM_VERSION selects the previous release; it must install its database with
+# `kagent install` (see CLI_DATABASE_SENTINEL); earlier releases are rejected.
 #
 # Prerequisite (provided by CI as a separate step; run it locally first): a kind
 # cluster (make create-kind-cluster).
@@ -552,48 +550,26 @@ helm-uninstall: ## Uninstall kagent and kagent-crds Helm releases from the kind
 # make invocations never run the resolver; CI passes UPGRADE_FROM_VERSION
 # explicitly (per matrix leg), which bypasses the script entirely.
 UPGRADE_FROM_VERSION ?= $(shell ./scripts/upgrade-from-version.sh)
+UPGRADE_FROM_CLI = /tmp/kagent-$(UPGRADE_FROM_VERSION)-$(LOCALOS)-$(LOCALARCH)
 
 .PHONY: install-previous-release
-install-previous-release: ## Install the previous released kagent + kagent-crds charts from the public OCI registry
-	# Abort early (rather than let helm fail confusingly) if the upgrade-from
-	# version could not be resolved.
+install-previous-release: use-kind-cluster ## Install the previous release with its own kagent CLI
+	# Abort early (rather than let the download fail confusingly) if the upgrade-from
+	# version could not be resolved or predates the CLI-managed database.
 	[ -n "$(UPGRADE_FROM_VERSION)" ] || { echo "UPGRADE_FROM_VERSION is empty; set it explicitly or ensure git tags are fetched." >&2; exit 1; }
+	git cat-file -e "v$(UPGRADE_FROM_VERSION):$(CLI_DATABASE_SENTINEL)" 2>/dev/null || { echo "v$(UPGRADE_FROM_VERSION) predates the database kagent install manages; upgrade tests cannot start from it." >&2; exit 1; }
 	@echo "=== Installing previous release: $(UPGRADE_FROM_VERSION) ==="
-	helm upgrade --install kagent-crds $(HELM_REPO)/kagent/helm/kagent-crds \
-		--version $(UPGRADE_FROM_VERSION) \
-		--namespace kagent --create-namespace \
-		--kube-context kind-$(KIND_CLUSTER_NAME) \
-		--timeout 5m --wait
-	# The bundled-Postgres image is selected by the install target's --set flags,
-	# not by the chart defaults (the chart ships a non-vector image). So the
-	# previous install must use the exact pins the upgrade-from release shipped —
-	# otherwise the baseline DB would differ from how that release actually runs,
-	# and the upgrade would conflate a DB swap with the migration change under
-	# test. Read those flags straight from that release's own helm-install-provider
-	# target (via its tagged Makefile) rather than hardcoding values that drift as
-	# the bundled image changes. Resolved here in the recipe so the `git show` runs
-	# only when this target runs, and so the flags can be validated before use
-	# (they must be literal — a future release that parameterizes them with a
-	# make/env variable would be rejected rather than passed to helm verbatim).
-	@set -e; \
-	db_flags="$$(git show v$(UPGRADE_FROM_VERSION):Makefile 2>/dev/null | grep -oE '\-\-set[[:space:]]+database\.postgres\.[^[:space:]\\]+' | tr '\n' ' ')"; \
-	[ -n "$$db_flags" ] || { echo "Could not read bundled-Postgres --set flags from v$(UPGRADE_FROM_VERSION):Makefile; the upgrade-from release's install target may have moved or renamed them." >&2; exit 1; }; \
-	case "$$db_flags" in *'$$'*|*'('*|*'{'*) echo "Bundled-Postgres --set flags from v$(UPGRADE_FROM_VERSION):Makefile contain an unexpanded variable and cannot be passed to helm verbatim: $$db_flags" >&2; exit 1;; esac; \
-	echo "    bundled-Postgres flags (from v$(UPGRADE_FROM_VERSION) install target): $$db_flags"; \
-	helm upgrade --install kagent $(HELM_REPO)/kagent/helm/kagent \
-		--version $(UPGRADE_FROM_VERSION) \
-		--namespace kagent --create-namespace \
-		--kube-context kind-$(KIND_CLUSTER_NAME) \
-		--timeout 5m --wait \
-		--set ui.service.type=LoadBalancer \
-		--set controller.service.type=LoadBalancer \
-		--set providers.default=openAI \
-		--set providers.openAI.apiKey="$${OPENAI_API_KEY:-test}" \
-		$$db_flags $(UPGRADE_PREV_EXTRA_ARGS)
+	curl -fsSL -o $(UPGRADE_FROM_CLI) https://github.com/kagent-dev/kagent/releases/download/v$(UPGRADE_FROM_VERSION)/kagent-$(LOCALOS)-$(LOCALARCH)
+	chmod +x $(UPGRADE_FROM_CLI)
+	KUBECONFIG=$(KIND_KUBECONFIG) \
+	KAGENT_DEFAULT_MODEL_PROVIDER=openAI \
+	OPENAI_API_KEY="$${OPENAI_API_KEY:-test}" \
+	KAGENT_SUBSTRATE_HELM_EXTRA_ARGS="$(KIND_SUBSTRATE_HELM_ARGS)" \
+	KAGENT_HELM_EXTRA_ARGS="--set ui.service.type=LoadBalancer --set controller.service.type=LoadBalancer $(UPGRADE_PREV_EXTRA_ARGS)" \
+	$(UPGRADE_FROM_CLI) install
 
 # run-upgrade-tests installs the previous release and upgrades it to the current build.
-# The test skips releases that do not use Goose.
-# Later Goose releases test previous-release behavior after the target migrations,
+# It tests previous-release behavior after the target migrations,
 # data survival, schema equality, previous/current controller startup, and a
 # complete application and schema rollback to the previous release.
 # KAGENT_E2E_LOCAL_HOST lets the agent reach the local mock LLM.
 
@@ -29,9 +29,6 @@ func TestRollingUpgradeCompatibility(t *testing.T) {
 
 	waitForReadyPods(t, env, postgresSelector, 3*time.Minute)
 	waitForPostgresSchema(t, env, 3*time.Minute)
-	if !hasGooseMigrationTable(t, env) {
-		t.Skip("the baseline release does not use Goose")
-	}
 
 	// Run even when there is no migration delta: a rolling upgrade rolls the new
 	// image regardless of migrations, so the deploy can still break for
@@ -63,27 +60,27 @@ func TestRollingUpgradeCompatibility(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Minute)
 	defer cancel()
 	done := make(chan upgradeResult, 1)
-	cmd := helmUpgradeCommand(ctx, env)
+	cmd := upgradeCommand(ctx, env)
 	go func() {
 		out, err := cmd.CombinedOutput()
 		done <- upgradeResult{out: string(out), err: err}
 	}()
 
 	// Wait until the target schema has landed while at least one previous-release
 	// controller pod is still ready. That is the rolling deploy hazard: old code
-	// can keep serving briefly after a new pod has applied migrations. Surface a
-	// helm upgrade failure immediately instead of letting it look like a
+	// can keep serving briefly after a new pod has applied migrations. Surface an
+	// upgrade failure immediately instead of letting it look like a
 	// schema-observation timeout.
-	var helmErr error
-	var helmOut string
+	var upgradeErr error
+	var upgradeOut string
 	require.Eventually(t, func() bool {
 		select {
 		case r := <-done:
 			if r.err != nil {
-				helmErr, helmOut = r.err, r.out
+				upgradeErr, upgradeOut = r.err, r.out
 				return true
 			}
-			// Helm finished successfully before we caught the window; put the
+			// The upgrade finished successfully before we caught the window; put the
 			// result back so the final read below still sees it, then keep polling.
 			done <- r
 		default:
@@ -94,7 +91,7 @@ func TestRollingUpgradeCompatibility(t *testing.T) {
 		}
 		return state.version == targetCoreVersion && anyPodsReady(t, env, oldPods)
 	}, 6*time.Minute, 500*time.Millisecond, "target schema was not observed while old controller pods were still ready")
-	require.NoError(t, helmErr, "helm upgrade failed before target schema was observed:\n%s", helmOut)
+	require.NoError(t, upgradeErr, "upgrade failed before target schema was observed:\n%s", upgradeOut)
 
 	// These SQL canaries intentionally use the pre-upgrade column shape. They do
 	// not prove every previous-release code path works, but they catch migrations
@@ -114,7 +111,7 @@ func TestRollingUpgradeCompatibility(t *testing.T) {
 	)
 
 	result := <-done
-	require.NoError(t, result.err, "helm upgrade failed:\n%s", result.out)
+	require.NoError(t, result.err, "upgrade failed:\n%s", result.out)
 
 	kubectl(t, env, 3*time.Minute,
 		"rollout", "status", "deployment/kagent-controller",