Lab #2437: control-plane vault init failures are swallowed; `access token reveal` says "Vault '

Summary

When the control-plane vault can't initialise (for example, because of bad datastore credentials), the real error is logged at WARN and discarded. swamp access token reveal then fails with "Vault '_token-secrets' not found. No vaults are configured", plus advice to swamp vault create <type> _token-secrets. That hides the actual problem and points to the wrong fix.

Environment

swamp built from main @ 1da85ec8 (20260923.175528.0-sha.1da85ec8), unmodified
@swamp/s3-datastore@2026.09.23.1 (MinIO), managedConfig: true
Also seen with CLI 20260917.193606.0 / 20260923.001003.0 against @swamp/gcs-datastore@2026.09.23.1, where the cause was expired GCP application-default credentials

Steps to reproduce

A repo on a remote datastore with managed config.
swamp access token mint probe-token --principal user:probe --duration 1d. The secret is stored in the remote _token-secrets.
Control: swamp access token reveal probe-token --yes → the token is revealed.
AWS_SECRET_ACCESS_KEY=wrong swamp access token reveal probe-token --yes → see below.
Repeat step 4 with --log-level debug.

Expected

The command fails with the initialisation error, e.g. S3 headBucket failed HTTP 403 (check AWS credentials …).

Actual

Failed to read secret for token 'probe-token' from vault '_token-secrets': Vault '_token-secrets' not found. No vaults are configured.
Note: Vaults are NOT configured in .swamp.yaml. Create a vault using:
  swamp vault create <type> _token-secrets

Only visible at debug level:

[WRN] vaults·control-plane-init: Failed to initialize control-plane vault: "S3 headBucket failed HTTP 403 (check AWS credentials — …)". Token secrets will be stored in the user vault.

Full transcripts and logs are available on request.

Root cause (on `main`)

src/domain/vaults/control_plane_vault_init.ts: initializeControlPlaneVault wraps provider.initialize() in try/catch, logs a WARN and returns null, so _token-secrets is never registered via VaultService.registerGlobalProvider.
src/cli/commands/access_token_reveal.ts (≈L90–96) ignores the null, builds VaultService.fromRepository, and the lookup fails as "not found".

Suggested fix

When the control plane is remote (hasRemote), propagate the initialisation error, or have commands that need _token-secrets fail with it instead of "not found". Don't suggest vault create for the reserved _token-secrets name.

#2324 (open): the control-plane encryption key is stored beside the ciphertext. #1859 (shipped): reveal docs.

Reproduction configuration

Test environment


swamp	built from `main` @ `1da85ec847ef6a8a0ce0297563b2a9fab1f4b2b8`, unmodified (`20260923.175528.0-sha.1da85ec8`)
Datastore	`@swamp/s3-datastore@2026.09.23.1` on local MinIO (`http://127.0.0.1:19000`, bucket `swamp-repro`)
Vault	none configured; control-plane `_token-secrets` only
Instances	each serve instance starts with an empty `HOME` and a repo containing only `.swamp.yaml`

.swamp.yaml:

swampVersion: 20260923.175528.0
initializedAt: "2026-09-23T18:37:26.223Z"
repoId: 80c3b52b-367c-49d9-9dbb-8b922c911e0b
tools:
  - claude
gitignoreManaged: true
datastore:
  type: "@swamp/s3-datastore"
  config:
    bucket: swamp-repro
    prefix: 08-control-plane-init-error-swallowed-20260923183720
    endpoint: "http://127.0.0.1:19000"
    forcePathStyle: true
    region: us-east-1
  hydrationStrategy: lazy
  managedConfig: true

Follow-ups from the swamp-eval migration (swamp-club#4403)

model output logs shows the latest log version instead of the output's own artifact version

Manual: Sensitive Method Arguments claims a literal value is refused, but a method run accepts it

workflow run: show artifact attributes for runs through serve, and let a run leave out the "Data produced" box

Docs: what serve instances must not share, flat AWS Secrets Manager names, and where OAuth values are stored

Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

@swamp/cve http2shell, php-rce-2026-10 and tailworm: scan fails with 'Duplicate data instance name' (log and status share a name)

swamp skill: add a workspace guide and routing-table entry

stagecraft tracker: relate tickets across trackers (another repo's tracker)

serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request

serve OAuth client reuse: remaining review findings from swamp-club#4264

Agents.md: consider not using H1 'Project' inside managed block

serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire

serve: define what swamp serve does when its OAuth client is deleted at swamp-club

Docs: schedule catch-up and missed-fire tracking for scheduled workflows

Work-item commands run from the wrong repo report the work item as not started

Docs: step concurrency caps only that step's forEach iterations, not its whole dependency level

Package everything on ops.swamp-club.com; stop direct server edits

workflow run: let a run skip the "Data produced" box, or make it show what each artifact holds

Shorten swamp serve's token session re-check so revocation takes effect sooner

@swamp/cve/emudhra: Ubuntu's pip vendored certifi reported as exposed although pip uses the OS store

cfgmgmt firewall (ufw): an input for rule position (insert before/after)

@swamp/video: informal demos — join multiple takes into one video, and a full-length background music bed

agent-sessions: lockfile test helper silently depends on the captured @swamp/git key

agent-sessions: low-severity edge cases from the Codex importer reviews (#4158)

Team mode manual pages: swamp-serve and remote-execution for leader/follower, member checkouts, offline work, run control and known limits

Agent session record: four questions from the Codex importer (#4158)

@swamp/video: upload workflow to publish a take to YouTube (video, description, chapters, captions, thumbnail)

@swamp/video/brand: customizable outro card (next steps, headline, per-video CTA)

data prune through serve deletes data of an auto-definition whose declared type is invalid

serve: give the definition index a change signal (file watcher with a sync barrier) so a write to a definitions directory costs O(1), not a stat of every file in it

Warn when a grant with a methods list is a deny: it also refuses requests that name no method

serve reload reports 0 types reloaded when it replaced edited repo-local behaviors

@swamp/video/brand: cap each Chromium stderr line kept for errors

serve resolves realpath for thousands of files under .swamp/outputs/swamp/worker/set_status

Retention or GC for auto-definitions whose runs and data are gone

S3 and GCS: after a real commit by another writer, a serve stays off the pull fast path until it restarts

Licence header check only compares the first line of a file

CI: an accepted attestation approves the PR, and anything else fails the attestation job

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history

Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild

Add expiring service-account token requests and authorization checks to RBAC

Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

verify-build upgrade gate silently skips models whose version is a constant

@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling

agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)

agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)

Swamp Club collective GUI: show the swamp serve instances currently connected to a collective

A malformed --ca-cert file is reported as an unreadable OS certificate store

TLS hint blames a missing root CA and macOS for every invalid peer certificate failure

workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS

S3/GCS repairUnpushedFiles: the pull it asks for after a lost last-synced index does not stop it re-uploading copies a peer deleted

swamp-uat private-registry tests leave npm/<port> dirs in the shared Deno cache

A resume runs settled work after the teardown gated on it has already run, and nothing tears that work down

serve (token mode): --admins accepts idp-group entries that can never match

build-swamp-extension example: code-review isn't given the quality evidence, so the reviewer reports quality as missing

deployment: getLogs method (deployment-aware pod log tailing)

model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)

Skill/docs: document registry listing limits, static-extraction rules, and splitting large APIs by domain

Check registry listing limits in extension quality/push and suggest splitting into per-domain extensions

Over-limit contentMetadata publishes a blank extension page; archive fallback extracts nothing

swamp inbox: with a filter active, sitting on the last row pages through the whole inbox in the background

@swamp/video/hyprland: recording hotkeys, retake marker and phone-mirror window rules

@swamp/video/obs: optional OBS recording with per-person hardware config for @swamp/video

serve daemon enable: add Windows support (service or startup task)

swamp skill docs: publishing.md contradicts itself on dynamic imports, overstates where git dependencies are listed, and never says consumers keep the publisher's bundle

extension push: the dynamic import() refusal tells authors to run swamp extension fmt, and the archive-project-file fix names the kind directory push never filters

extension push: file:, link:, workspace: and git package.json dependencies are left out of the unaudited list when the project also has a deno.json

push (Apple Containers) makes an index whose platform manifest is unpullable on Forgejo

Streak projector: incremental runs instead of a full scan every minute

Registry: detect code from outside npm and JSR in a v2 archive itself, not only from the author's dependency-audit.json

Scorecard: code past the analyzer's read caps, or unreadable, is skipped silently instead of counting as not audited

Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

access can-i: evaluate a local grants file without --server

Support search and filters as URL query parameters on /extensions

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

Five Mongo queues can hand the same row to two replicas

Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in