[yzabelle-go]

FD-5441 phase 2. A deployment can now keep some entities, and everything about them, in stores of their own. A [namespaces.<name>] table names a document store and an object store, and a [namespace_resolver] says which ids are in which namespace. Ids derived from one (<id>__…) follow it.

What goes to a namespace's stores:

• its entities;
• everything a run of one of its tasks records and writes: run records, conversations, trajectories, snapshots, recordings, and any entity or object the run creates.

Objects go under a <name>/ key prefix, so namespaces can share a bucket.

Reads that no id places, such as lists or lookups by instance id, see only the shared store and the running task's namespace, unless a service opens more with reading_namespaces(...). That lets a service show a namespace to its members only.

Writes ask the resolver for a fresh answer and are refused if it can't give one. A run in a namespace never writes a new version of a shared entity, never updates a shared run record, and never writes objects outside its namespace's store.

This does nothing until a [namespaces] table is configured. Task steps need no edits: get_object_store() was already run-scoped for @local runs and now is for configured namespaces too. TableNamespaceResolver, which lists ids in config, is the in-tree resolver, used by the tests.

Validation:

• New tst/unit/store/configured_namespace_test.py (141 tests): routing, fail-closed writes, guards, objects, an artifact round trip, and the document-store conformance suite in three modes.
• The full unit suite passes locally, except 3 tests that need Linux tools or click in a subprocess's Python, and 1 that hangs on this machine's git credential helper. All 4 behaved the same before this change.
• Not run: the integration tiers, and a real Mongo or S3 backend.

Part of a three-PR set for restricted storage:

• this PR (the SDK);
• https://github.com/scaleapi/Terracode-Infra/pull/11811 (the bucket and key);
• https://github.com/scaleapi/scaleapi/pull/175204 (a resolver that reads the hub's restriction rows, and the worker side).

Merge order: this first, then a release. The other two don't need this one to merge, but they do nothing until it is released and pinned.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are fixed, and no new actionable issues were found.

Summary

Adds configured namespaces with separate document and object stores, chosen by a resolver.

• Configured entities and task records go to their namespace’s document store.
• Namespace objects use their own store and stay within their namespace’s key prefix.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Request[Store request] --> Kind{Read or write?}
  Kind -->|Read| IDs{IDs name namespaces?}
  IDs -->|Yes| Named[Search named stores]
  IDs -->|No| Visible[Search shared, running, and opened stores]
  Kind -->|Write| Resolve[Ask resolver for placement]
  Resolve --> Guard{Allowed for this run?}
  Guard -->|No| Reject[Reject before writing]
  Guard -->|Yes| Destination[Write to selected store]

Loading

_{Reviews (2) · Last reviewed commit: "fix(store): refuse a run's upload for an..." · Reviewed by Greptile}