Skip to main content
← Back to list
01Issue
BugShippedSwamp CLIPublic
Assigneesstack72

Relationships

#1897 Core: namespace-scoped datastores write root-level lock key and pass undefined namespace to sync

Opened by stack72 · 8/28/2026· Shipped 8/28/2026

Two related bugs in swamp core cause AccessDenied failures in namespaced datastore deployments where IAM credentials are scoped to the namespace prefix.

1. datastoreGlobalLockOptions writes lock key at bucket root

datastoreGlobalLockOptions derives the global lock key as .locks/{namespace}.lock — a root-level key outside the namespace prefix. The DEFAULT_LOCK_KEY fallback (.datastore.lock) is also root-level. Model locks are correctly namespaced (modelLockKey -> {namespace}/data/{type}/{id}/.lock), so the global lock is an oversight.

Fix: pass namespace in LockOptions instead of baking it into the key path. The S3 and GCS datastore extensions already support LockOptions.namespace as of swamp-club#1889 — when set, the lock prefixes its key under {namespace}/. Core just needs to pass it:

return { lockKey: ".datastore.lock", namespace };

2. Core passes undefined namespace to sync operations

In a namespaced swamp serve deployment, a sync call path passes undefined as namespace after the namespace was already bound. The extension's bindNamespace detects the mismatch and throws:

Namespace mismatch: bound to "agent-harness-dev" but called with undefined

This causes post-run push to fail. The extension behavior is correct (detect and throw). The bug is in whichever core code path constructs sync options without propagating the configured namespace.

Context

Both bugs were discovered during triage of swamp-club#1889. The extension-side fixes (control-plane key migration, controlPlaneStore binding, LockOptions.namespace support, error-message key inclusion) are shipping in that PR. These two core fixes are the remaining work to fully resolve the AccessDenied symptom.

Supersedes swamp-club#1894 and swamp-club#1895.

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 1 MOREASSIGNED+ 5 MOREREVIEW+ 9 MOREPR_MERGED+ 2 MORESESSION_SUMMARIZED

Shipped

8/28/2026, 9:55:13 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack728/28/2026, 8:36:15 PM

Sign in to post a ripple.