Upgrade TUI graphics — better AI-generated ANSI or a Moebius hand-authored pipeline

The extension scoring documentation in content/manual/reference/extensions.md and content/manual/how-to/extensions.md describes the quality rubric but does not include the new dependency-trust factor added in RUBRIC_VERSION 3.

Proposed Solution

Update the manual documentation to cover:

Reference page (content/manual/reference/extensions.md):
- Add dependency-trust to the rubric factor table (worth 2 points)
- Document what the factor checks: OSV.dev advisories, npm registry trust signals (weekly downloads, license allowlist, publish recency, maintainer count, deprecation status)
- Document blocker vs warning classification (HIGH/CRITICAL/deprecated → blocker, MEDIUM/low-trust → warning)
- Note that jsr dependencies are auto-trusted (registry-enforced SPDX license, provenance, no install scripts)
- Update total max points from 12 to 14
How-to page (content/manual/how-to/extensions.md):
- Add guidance on how to pass the dependency-trust factor
- Explain that swamp extension quality now shows per-dependency audit results with trust signals (license, downloads/week, publish age)
- Note that blockers prevent swamp extension push
Any rubric-specific pages that list the scoring factors

References

CLI implementation: systeminit/swamp#1422
Server-side scorer: swamp-club#402
Trust gate defaults from @bixu/wheelshop: min 1,000 weekly downloads, max 24 months since last publish
License allowlist: MIT, Apache-2.0, BSD-2/3-Clause, ISC, 0BSD, MPL-2.0, Unlicense, CC0-1.0

02Bog Flow

Shipped

5/22/2026, 2:11:11 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack725/21/2026, 10:51:54 PM

Upgrade TUI graphics — better AI-generated ANSI or a Moebius hand-authored pipeline

Add assertVaultAnnotationExportConformance to @systeminit/swamp-testing

Add VaultAnnotationProvider conformance helpers to @systeminit/swamp-testing

Vault annotations: --note/--notes flag inconsistency and UX improvements

Docs: document VaultAnnotationProvider interface and extension opt-in pattern

Add VaultAnnotationProvider support to @swamp/1password

Add VaultAnnotationProvider support to @swamp/azure-kv

Add VaultAnnotationProvider support to @swamp/aws-sm

Harness detection invents env vars for kiro/opencode/codex

Annotating vault items should be a first-class swamp operation

workflow direct-execution inputs.* persist as globalArguments on auto-definitions and freeze on first run

workflow-scope report's dataRepository.getContent returns null for data written in the same workflow run

swamp-report skill references nonexistent `swamp model report` command

@swamp/digitalocean — add domain-records model for /v2/domains/{domain_name}/records

Docs: update extension scoring documentation for dependency-trust rubric factor

Warn when a ${{ }} secret expression is single-quoted in a command/shell run: script

Workflow validation should resolve modelType for direct-execution steps

dbcluster state schema is missing DBClusterMembers (writer/reader, instance class)

Add a list/discover method to dbcluster for enumerating clusters in a region

Add dependency-trust rubric factor to server-side scorer (RUBRIC_VERSION 3)

cloudidentity API calls fail with 'requires a quota project' — bundle doesn't send x-goog-user-project header

Improve idempotency match field heuristic for auto-generated name resources (tagKeys, tagValues)

@swamp/gcp/cloudresourcemanager/folders: create method has 5 blocking bugs (missing parent in body, LRO detection, post-LRO state, idempotency, projectId requirement)

Add IAM policy management (setIamPolicy/getIamPolicy) on cloudresourcemanager resources; add custom-role CRUD to @swamp/gcp/iam

@swamp/ssh exec method fails with 'ctx.createCelEnvironment is not a function'

Extension decision order should prefer @swamp/community extensions over local types

Make wheelshop-style dependency trust-gating a core swamp feature

swamp repo <unknown-subcommand> silently inits a nested repo (e.g. `swamp repo update`)

Extension METHODS table truncates Method column; short names like apply/check wrap mid-word on /extensions/@swamp/ssh

swamp extension rm leaves empty <kind>-bundles/<hash>/ dirs behind

Pre-flight checks cannot access method arguments (check context omits methodArgs/unresolvedMethodArgs)

swamp audit record --from-hook creates a stray .swamp datastore in the process cwd instead of resolving the repo root

extension push publishes model files ending in _test.ts that no consumer can load

Docs: document --extensions-dir / SWAMP_EXTENSIONS_DIR for worktree workflows

No user feedback when model method run is waiting for lock acquisition

issue-lifecycle: thank external contributors when issues are resolved

Add swamp extension prune to clean up stale catalog entries

identity_map row not updated when user renames

`swamp extension rm` leaves empty scaffold dirs behind

Many CLI commands acquire global .datastore.lock unnecessarily, causing 60s LockTimeoutError under any concurrent writer

swamp CLI commands fail silently or hang when invoked from git worktrees via SWAMP_REPO_DIR

Datastore: lazy hydration for fast cold-start on first clone

S3 datastore: dirty sidecar, partitioned index, content hashing, and scoped sync

Datastore sync: add SyncContext and SyncCapabilities framework contracts

Terminal rendering breaks at large font sizes

Expose cel-js Environment to extensions for custom CEL evaluation

Add list/search as a factory method that produces many data artifacts (Drive files.list, gmail messages.list, etc.)

files.get returns only minimal fields (id, name, kind, mimeType) because no 'fields' query parameter is sent

ADC path uses wrong gcloud token store: 'gcloud auth print-access-token' instead of 'gcloud auth application-default print-access-token'

Docs: update doctor reference and autoupdate how-to for new doctor install subcommand

createModelTestContext: storedResources not used by readResource; readResource always returns null

swamp-vault skill documents 'swamp vault read' but correct subcommand is 'read-secret'

Add a manual_approval (pause) task type to workflow steps

Autoupdate silently fails when swamp is installed system-wide via the official install.sh

Missing 'parent' field in GlobalArgsSchema for several @swamp/gcp/* models causes get to fail

bucket-policy GlobalArgsSchema requires Bucket and PolicyDocument, blocking workflow-YAML direct execution of get

Report execute throws are advisory: workflow marked succeeded, exit 0, AND report output is discarded

dataRepository.getContent rejects string type in production but docs and testing helper demonstrate strings

bucket-policy StateSchema.PolicyDocument declared z.string() but CloudControl returns it as a parsed object

Unified login input that detects email vs username by presence of '@'

Introduce `swampd`: long-running local daemon for shared cache, secrets, and extensions

workflow validate: false "Missing required inputs" when method args are set in the model definition

CEL and vault expressions not evaluated inside nested globalArguments fields

@swamp/digitalocean: 30 of 33 model types fail with version mismatch error

Add first-class Kilo Code tool support

Partitioned index for S3/GCS datastores (Phase 3)

Per-path dirty tracking in S3/GCS datastore extensions (Phase 2)

Docs: update doctor extensions JSON reference to include warnings[] field

Doctor kind-completed events should carry correct per-registry status

Surface type-extraction failures in doctor JSON output

Scoped sync and capability-gated concurrency for datastores (Phase 1)

Direct type execution fails for locally-defined extension types with pulled duplicates

Scaffold new extensions to publish-ready quality (12/12) by default

Add table width controls to swamp report get

Add a markdown output mode to `swamp report get`

Add a markdown output mode to swamp report get

swamp.club: 'Mark all read' link doesn't clear unread count on /inbox

Official @swamp/ssh extension supporting multiple SSH transport styles

W7 — unify extension failure surfaces; collapse registries.failures[] into sourceDetails[]

Surface Tombstoned transitions in doctor extensions output

Workflow-level runtime expressions (env., vault.) not resolved in driverConfig — docker driver receives literal ${{ ... }} strings