{"record":{"id":"f60efc55ec01aa9b","repo":"sgl-project/sglang","slug":"publish-role-role-r-has-no-role-namespace-sets-e","errorCode":null,"errorMessage":"publish role {role!r} has no ROLE_NAMESPACE_SETS entry; declare its namespace set (None for the full tree).","messagePattern":"publish role (.+?) has no ROLE_NAMESPACE_SETS entry; declare its namespace set \\(None for the full tree\\)\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/runtime_context.py","lineNumber":1341,"sourceCode":"def publish(server_args, *, role: str, hf_config: Any = None) -> RuntimeContext:\n    \"\"\"Install process-wide config for this OS process.\n\n    Records the process ``role`` — one of the ``ROLE_NAMESPACE_SETS`` keys,\n    which is the one place the roles are enumerated — and\n    projects the config bags. Draft workers skip publish (they must not clobber\n    the target). ``role`` is provenance, and — when ``SGLANG_ROLE_NAMESPACES``\n    is ``enforce`` — the key into ``ROLE_NAMESPACE_SETS`` for fail-closed\n    namespace-read enforcement (``record`` audits the reads instead).\n    ``hf_config`` is accepted for forward-compat and currently unused.\n\n    A process holds at most one live config: the bags always describe the\n    engine running now. Re-publish is allowed and is **last-publish-wins**\n    (bags re-projected, provenance reset, role overwritten), which is what\n    lets one process rebuild an engine after shutting the previous one down.\n    \"\"\"\n    if _ROLE_NS_MODE == \"enforce\" and role not in ROLE_NAMESPACE_SETS:\n        # Fail closed at publish time, not at the first stray read.\n        raise ValueError(\n            f\"publish role {role!r} has no ROLE_NAMESPACE_SETS entry; declare \"\n            \"its namespace set (None for the full tree).\"\n        )\n    server_args.resolve_once()\n    discarded = _CONTEXT.overrides_log()\n    _CONTEXT.set_server_args(server_args)\n    if discarded:\n        logger.warning(\n            \"publish(role=%s) re-projected the config bags and dropped %d \"\n            \"override(s) taken since the last publish: %s\",\n            role,\n            len(discarded),\n            \", \".join(\n                f\"{source}({', '.join(sorted(fields))})\" for source, fields in discarded\n            ),\n        )\n    _CONTEXT._publish_role = role\n    if _ROLE_NS_MODE == \"record\":","sourceCodeStart":1323,"sourceCodeEnd":1359,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/runtime_context.py#L1323-L1359","documentation":"When SGLANG_ROLE_NAMESPACES=enforce, publish(server_args, role=...) requires the role to have an entry in ROLE_NAMESPACE_SETS (which may be None for the full tree). Publishing with an undeclared role fails immediately at publish time — fail closed — rather than letting stray reads escape later.","triggerScenarios":"Calling publish(server_args, role=\"my_new_role\") while SGLANG_ROLE_NAMESPACES=enforce and 'my_new_role' has no ROLE_NAMESPACE_SETS entry; adding a new process role (e.g. a new worker type) without declaring its namespace set.","commonSituations":"Introducing a new entry-point role in a fork/extension of sglang; flipping the env from record to enforce and discovering roles that were never declared; tests publishing under an ad-hoc role name.","solutions":["Add an entry for the role in ROLE_NAMESPACE_SETS: an explicit namespace set, or None for the full tree","Re-check the role string for typos against existing entries","Use SGLANG_ROLE_NAMESPACES=record first to discover which namespaces the role touches, then declare the set and switch to enforce"],"exampleFix":"# before\nROLE_NAMESPACE_SETS = {\"scheduler\": {...}}\npublish(args, role=\"detokenizer\")  # enforce mode -> ValueError\n# after\nROLE_NAMESPACE_SETS = {\"scheduler\": {...}, \"detokenizer\": None}\npublish(args, role=\"detokenizer\")","handlingStrategy":"validation","validationCode":"from sglang.srt.runtime_context import ROLE_NAMESPACE_SETS\nif role not in ROLE_NAMESPACE_SETS:\n    raise ValueError(f\"declare {role!r} in ROLE_NAMESPACE_SETS before publish under enforce\")\npublish(server_args, role=role)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Declare every new process role in ROLE_NAMESPACE_SETS when introducing it","Use record mode first to discover the namespaces a new role touches, then declare the set"],"tags":["config","role-based-access","enforcement","sglang"],"backgroundTag":"undeclared-role","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}