@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

workflow resume fails to register all extension model types (local and pulled) — "Unknown model type"

model method run: cannot pass arrays, numbers, or booleans via --input

extension push --dry-run --json reports local helper imports as bogus model entries

Extension source: direct-content export scan only reads first 64 KiB, silently drops exports beyond it

Homepage install command: wrong domain and missing https:// protocol

Homepage install command: wrong domain and missing https:// protocol

first-class refresh hook for short-lived vault values (gcloud / aws-sso / kubectl-oidc token UX)

swamp issue ripple logged "Posted ripple on issue #514" but the ripple is not visible on the Lab

vault guide promotes inline secret values (KEY=VALUE) as a primary "swamp vault put" example

swamp-getting-started SKILL.md still references removed swamp-model / swamp-workflow / swamp-vault / swamp-extension / swamp-repo skills

extension rm blocked by stale /workspace bundle_types rows from prior container sessions with host repo bind-mounted

extension search returns null repository fields that extension info populates

Quality rubric: scope "No slow types" for model extensions (consumed via model+CEL, not type imports)

data get/list --workflow and workflow history get/logs cannot resolve extension-delivered workflows (Workflow not found)

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

UAT: sensitive resource output without vault produces clear pre-flight error

Docs: add doctor vaults subcommand and pre-flight vault validation

gcs-datastore: registerNamespace does not detect conflicts with existing registrations

Validate vault availability when model has sensitive output fields

Managed skills ship with dangling reference-doc links

swamp-club: update skill references and CLAUDE.md after superskill consolidation

swamp-uat: init_test.ts asserts old skill directory names after superskill consolidation

Codegen: auto-merge resources across GCP API versions instead of manual ADDITIONAL_VERSION_RESOURCE_FILTER

fix: giga-swamp UAT failures — 9 bugs found during comprehensive testing

fix: datastore setup extension with namespace config doesn't scope sync or register manifest

fix: namespace set on default repo writes incomplete filesystem config (missing path)

@swamp/1password put double-escapes JSON values

feat: giga-swamp comprehensive UAT coverage

@swamp/kubernetes 2026.06.04.1 missing upgrade path from 2026.05.27.2

@swamp/kubernetes ignores certificate-authority-data from kubeconfig for self-signed CAs

Inconsistent failures in swamp doctor extensions (database is locked, bundle build failed)

docs: giga-swamp user documentation — reference, how-to, and conceptual guide

@swamp/gcp/iam missing serviceAccounts model type

@swamp/ssh@2026.06.04.1 fails to load: bare zod import + missing 2026.06.04.1 upgrade entry

feat: giga-swamp phase 7 — Data migration commands

feat: S3/GCS extension namespace manifest support (registerNamespace/listNamespaces)

Relocate Docker image from systeminit org to swamp-club

Move JSR packages from @systeminit to @swamp-club scope

Should be able to see all the issues I created by a filter "submitted by me"

Ability to change the email address associated with my Swamp Club Account

feat: giga-swamp phase 5 — CLI output + namespace management commands

CI review jobs use two-dot diff that includes files the PR never touched

paths.base: manifest is not honored for workflows: — bundled workflows only resolve from repo root, blocking self-contained subdir layouts (sibling to #459)

Lab profanity filter rejects legitimate CLI flag tokens via substring match

Sign and notarize the swamp macOS binary

Add platform type to issue-lifecycle extension model Zod schema

fix: datastoreSetupExtension() ignores namespace config on initial migration push/pull

Remote execution: orchestrator/worker fan-out (replaces execution drivers)

swamp datastore sync --push creates global .datastore-index.json ignoring namespace config

feat: S3/GCS extension namespace-scoped sync support

Copy explicitGlobalArgs before mutation in resolveOrCreateDefinition

vault.get() expressions in extension model globalArguments are not resolved at runtime

swamp-issue skill should scrub secrets and org-specific data before submission

workflow validate: trim stale 'skipped' label from model_not_found warning

Add pi coding agent support

hashicorp-vault should read token from env

swamp-extension adversarial review skill needs mandatory mechanical verification checklist

feat: giga-swamp phase 6 — Namespace-scoped sync

swamp workflow validate emits misleading "Extension failed to load" warning when type resolves locally

Add issue search/list command to discover existing issues

Support vault-resolved private key content in transport auth (not just file paths)

Workflow engine resolves extension methods against base type, ignoring extension-registered methods

Per-model LockTimeoutError at 60s causes cascading failures under concurrent access

Persistent, queryable workflow runs (status / cancel from any shell)

swamp repo upgrade: ERR_SQLITE_ERROR 'attempt to write a readonly database' during extension catalog schema migration

workflow validate: fail on references to unknown model instances (typo'd modelIdOrName)

feat: giga-swamp phase 4 — CEL cross-namespace queries

Docs: document the extension push adversarial-review gate

vault://local_encryption token does not round-trip correctly for GCP OAuth2 access tokens

swamp issue: add ability to edit issue title and body after submission

@swamp/gcp/iam: add WIF pool, provider, service account, and binding support

Support vault-sourced identity keys

copy method reports success when scp exits non-zero (e.g. 255)

Docs: TLS behind inspecting proxies / private CAs (system trust store, DENO_CERT, SSL_CERT_FILE)

Extension quality/adversarial-review: add a 'published-surface hygiene' check for real infra identifiers

Feed-post scoring is a direct domain write, not a consumer of feed_post_approved telemetry

workflow validate silently PASSES steps whose model type is a pulled extension (step-inputs skipped = false pass)

extension quality fails to resolve bare specifiers — contradicts fmt no-import-prefix rule

Allow global arguments in direct type execution (workflow fan-out)

Bundled Deno does not honor the OS/system CA trust store

Gator-approved feed post did not trigger Discord activity or profile points

username_metrics projection backfill does not trigger re-scoring (stale UserScore for dormant users)

Enforce adversarial review gate before extension push

support git forge / web namespaces for collectives

Report type filtering in report search

extension search: empty results from CLI despite known extensions

workflow approve/resume cannot find suspended runs

vault annotate --url fails with query params on @swamp/aws-sm

datastore compact VACUUM fails with ERR_SQLITE_ERROR

workflow approve/resume cannot find suspended run when using S3 datastore

reindexByUsername re-strands pre-association history and wipes sign_in_dates

Telemetry never retroactively credits a device's pre-association history

Docs: document swamp doctor secrets in manual reference doctor.md

Docs: document 'swamp workflow resume --input' in manual reference

Cloudflare codegen: manifest version bumps on every regeneration (README not deno-fmt-clean)

Support dynamic host discovery from external sources

feat: giga-swamp phase 3 — Path resolver + per-namespace locking

@swamp/ssh exec: string host selector only matches 'all', ignores host names and tags

Add integration test for sensitive-arg guard on lazily-loaded extension types (follow-up to #480)

Remediate existing definitions holding cleartext sensitive global arguments (follow-up to #480)

Docs: document refusal of literal sensitive global arguments (follow-up to #480)

Docs: update extension-trust reference for swamp-only default + lockfile version pinning (swamp-club#465)

feat: giga-swamp phase 2 — Catalog schema v4 + repository interface

Support for Custom CA's

Cloudflare: support vault expressions for API credentials instead of env-var-only auth

GCP: support vault expressions for credentials instead of env-var-only auth

AWS: support vault expressions for credentials instead of env-var/SDK-chain-only auth

DigitalOcean: support vault expressions for the API token instead of DO_API_TOKEN env var

swamp model get does not redact `sensitive: true` fields (logs/reports/storage do)

Support vault expressions for API token instead of env var

UAT tests for manual_approval workflow commands

Document manual_approval workflow step type and suspend/approve/resume flow

Stale extension bundles break after swamp upgrade

Support --input flags on workflow resume for elevated permissions and runtime overrides

Add HTTP approval endpoints to swamp serve for manual_approval steps

feat: giga-swamp phase 1 — Namespace value object + config

swamp serve scheduled workflows do not load repo extension registries

ci: aws-check and gcp-check jobs take ~30min — rethink whether full model type-checking is needed per PR

swamp CLI: send user/device identity on extension-registry HTTP calls

Orphaned .swamp/ without .swamp.yaml marker is reported as plain 'Not a swamp repository' — partial/corrupt repo not detected

paths.base: manifest is not honored for skills: — bundled skills only resolve from repo root, blocking multi-extension repos

swamp data gc does not remove physical version directories from disk

@swamp/aws/iam/role-policy: PolicyDocument schema says string but CloudControl expects JSONObject

Docs: update autoupdating how-to for Linux privileged schedulers

How-to: Define custom AI agent tools

Workflow-scope report execution fails with `rawType.trim is not a function`

version-drift check reads first `version:` literal, not export const model.version

Support privileged autoupdate schedulers for root-owned binaries on Linux

Docs: document LaunchDaemon autoupdate for root-owned macOS binaries

Support deepAgents CLI/SDK as a target agent

macOS autoupdate LaunchAgent cannot update root-owned swamp binaries

Telemetry admin reindex endpoint is gated on a defunct @systeminit.com email domain — permanently 403

CLI telemetry forwards non-personally-resolvable identity for collective auth; distinct_id is per-machine, not per-repo

Telemetry ingest only resolves personal API keys — collective-token events are unattributed, identity_map under-claims

extension update/pull deadlocks when the repo's datastore is the extension being updated

Docs: update datastore reference for lazy hydration, SyncContext, and SyncCapabilities

Default hydrationStrategy to lazy after soak period

Make GCP CRUD methods factory-aware so list-discovered resources can be managed in-place

Datastore: lazy hydration with metadata-only setup and transparent content download

Slim down extension search output now that extension info exists

exec fails on macOS: ControlPath exceeds 104-byte Unix socket limit

CSS effects on swamp.club (any page) cause high CPU

Datastore extensions: only write dirty partition files on push

Datastore extension benchmark suite for S3 and GCS

GCS datastore: dirty sidecar, partitioned index, content hashing, and scoped sync

Direct execution @type prefix fails for repo-local extension model types

Support GitHub username in swamp.club profile to fix PR attribution

dataRepository.getContent() fails in workflow-scope reports with 'type.toDirectoryPath is not a function'

--json output is polluted by non-JSON content, breaking machine parsing

Core repositories missing markDirty hook — scoped push only works on crash recovery

Add extension info command for registry metadata

Add extension transfer between collectives

Display extension deprecation state on swamp-club pages

Add extension deprecation support to CLI

swamp serve: extension bundle failure at startup is silently pinned, breaking scheduled workflows with permanent 'Unknown model type'

vault put and read-secret use asymmetric path parsing; slash-put creates unreadable items

Provide a Nix package for swamp (devbox / nixpkgs support)

Upgrade TUI graphics — better AI-generated ANSI or a Moebius hand-authored pipeline

Add assertVaultAnnotationExportConformance to @systeminit/swamp-testing

Add VaultAnnotationProvider conformance helpers to @systeminit/swamp-testing

Vault annotations: --note/--notes flag inconsistency and UX improvements

Docs: document VaultAnnotationProvider interface and extension opt-in pattern

Add VaultAnnotationProvider support to @swamp/1password

Add VaultAnnotationProvider support to @swamp/azure-kv

Add VaultAnnotationProvider support to @swamp/aws-sm

Harness detection invents env vars for kiro/opencode/codex

Annotating vault items should be a first-class swamp operation

workflow direct-execution inputs.* persist as globalArguments on auto-definitions and freeze on first run

workflow-scope report's dataRepository.getContent returns null for data written in the same workflow run

swamp-report skill references nonexistent `swamp model report` command

@swamp/digitalocean — add domain-records model for /v2/domains/{domain_name}/records

Docs: update extension scoring documentation for dependency-trust rubric factor

Warn when a ${{ }} secret expression is single-quoted in a command/shell run: script

Workflow validation should resolve modelType for direct-execution steps

dbcluster state schema is missing DBClusterMembers (writer/reader, instance class)

Add a list/discover method to dbcluster for enumerating clusters in a region

Add dependency-trust rubric factor to server-side scorer (RUBRIC_VERSION 3)

cloudidentity API calls fail with 'requires a quota project' — bundle doesn't send x-goog-user-project header

Improve idempotency match field heuristic for auto-generated name resources (tagKeys, tagValues)

@swamp/gcp/cloudresourcemanager/folders: create method has 5 blocking bugs (missing parent in body, LRO detection, post-LRO state, idempotency, projectId requirement)

Add IAM policy management (setIamPolicy/getIamPolicy) on cloudresourcemanager resources; add custom-role CRUD to @swamp/gcp/iam

@swamp/ssh exec method fails with 'ctx.createCelEnvironment is not a function'

Extension decision order should prefer @swamp/community extensions over local types

Make wheelshop-style dependency trust-gating a core swamp feature

swamp repo <unknown-subcommand> silently inits a nested repo (e.g. `swamp repo update`)

Extension METHODS table truncates Method column; short names like apply/check wrap mid-word on /extensions/@swamp/ssh

swamp extension rm leaves empty <kind>-bundles/<hash>/ dirs behind

Pre-flight checks cannot access method arguments (check context omits methodArgs/unresolvedMethodArgs)

swamp audit record --from-hook creates a stray .swamp datastore in the process cwd instead of resolving the repo root

extension push publishes model files ending in _test.ts that no consumer can load

Docs: document --extensions-dir / SWAMP_EXTENSIONS_DIR for worktree workflows

No user feedback when model method run is waiting for lock acquisition

issue-lifecycle: thank external contributors when issues are resolved

Add swamp extension prune to clean up stale catalog entries

identity_map row not updated when user renames

`swamp extension rm` leaves empty scaffold dirs behind

Many CLI commands acquire global .datastore.lock unnecessarily, causing 60s LockTimeoutError under any concurrent writer

swamp CLI commands fail silently or hang when invoked from git worktrees via SWAMP_REPO_DIR

Datastore: lazy hydration for fast cold-start on first clone

S3 datastore: dirty sidecar, partitioned index, content hashing, and scoped sync

Datastore sync: add SyncContext and SyncCapabilities framework contracts

Terminal rendering breaks at large font sizes

Expose cel-js Environment to extensions for custom CEL evaluation

Add list/search as a factory method that produces many data artifacts (Drive files.list, gmail messages.list, etc.)

files.get returns only minimal fields (id, name, kind, mimeType) because no 'fields' query parameter is sent

ADC path uses wrong gcloud token store: 'gcloud auth print-access-token' instead of 'gcloud auth application-default print-access-token'

Docs: update doctor reference and autoupdate how-to for new doctor install subcommand

createModelTestContext: storedResources not used by readResource; readResource always returns null

swamp-vault skill documents 'swamp vault read' but correct subcommand is 'read-secret'

Add a manual_approval (pause) task type to workflow steps

Autoupdate silently fails when swamp is installed system-wide via the official install.sh

Missing 'parent' field in GlobalArgsSchema for several @swamp/gcp/* models causes get to fail

bucket-policy GlobalArgsSchema requires Bucket and PolicyDocument, blocking workflow-YAML direct execution of get

Report execute throws are advisory: workflow marked succeeded, exit 0, AND report output is discarded

dataRepository.getContent rejects string type in production but docs and testing helper demonstrate strings

bucket-policy StateSchema.PolicyDocument declared z.string() but CloudControl returns it as a parsed object

Unified login input that detects email vs username by presence of '@'

Introduce `swampd`: long-running local daemon for shared cache, secrets, and extensions

workflow validate: false "Missing required inputs" when method args are set in the model definition

CEL and vault expressions not evaluated inside nested globalArguments fields

@swamp/digitalocean: 30 of 33 model types fail with version mismatch error

Add first-class Kilo Code tool support

Partitioned index for S3/GCS datastores (Phase 3)

Per-path dirty tracking in S3/GCS datastore extensions (Phase 2)

Docs: update doctor extensions JSON reference to include warnings[] field

Doctor kind-completed events should carry correct per-registry status

Surface type-extraction failures in doctor JSON output

Scoped sync and capability-gated concurrency for datastores (Phase 1)

Direct type execution fails for locally-defined extension types with pulled duplicates

Scaffold new extensions to publish-ready quality (12/12) by default

Add table width controls to swamp report get

Add a markdown output mode to `swamp report get`

Add a markdown output mode to swamp report get

swamp.club: 'Mark all read' link doesn't clear unread count on /inbox

Official @swamp/ssh extension supporting multiple SSH transport styles

W7 — unify extension failure surfaces; collapse registries.failures[] into sourceDetails[]

Surface Tombstoned transitions in doctor extensions output

Distinguish validation-throw from bundle-throw in reconcile catch; surface ValidationFailed in sourceDetails

extension unyank needs -y/--yes flag for non-interactive use

Step key parsing in execution_service uses naive split(":") and silently truncates colon-containing step names

Workflow-scope report artifacts unreachable via `swamp data get --workflow`

Add --stdin support to method run and workflow run for Unix pipe composition

Docs: add run namespace to CEL expressions reference

Fix invalidate-then-reconcile sequencing in doctor extensions; failure-mode RowStates unreachable in sourceDetails

doctor extensions invalidateAll does not trigger fingerprint recheck for existing Indexed rows

Extension failure recording has dual write paths (legacy buildIndex vs W3 reconcile)

Expose workflow run ID in CEL so resource keys can be run-scoped

Add `swamp doctor workflows` subcommand to surface workflow YAML parse errors during preflight

Add 'swamp issue comment' command for updating existing issues

Close #327 — fixed in 20260511.160514.0-sha.9d03b09a

Nested workflow task fails with 'Bad resource ID' when workflowIdOrName uses @collective/ prefix

Detect stale skill directories and prompt for repo upgrade

Improve skill trigger routing for cross-model edge cases

Add type search for driver, datastore, and report kinds

Surface ReconcileFromDisk dryRun transitions in swamp doctor extensions

Docs: update doctor extensions reference for W6 aggregate-state rendering + repair flags

swamp issue: check if reporter is on an outdated binary before opening

Implement W6: swamp doctor extensions aggregate-state rendering + repair surface (extension catalog rearchitecture)

extension pull fails referencing removed source after extension source rm

Investigate whether allExtensionMethodsAttached guard can be removed via registration-path consolidation

Trace context is lost: CLI ignores inbound TRACEPARENT and raw driver doesn't propagate active context into in-process methods

swamp model create --global-arg KEY=VALUE doesn't coerce strings to z.number() schemas

swamp model create --global-arg KEY=VALUE doesn't coerce strings to z.number() schemas

swamp issue get should rate-limit unauthenticated users instead of blocking

swamp issue get should not require authentication

telemetry: emit child entries for follow-up action method invocations

Publish release-candidate / unstable extension versions

extension source rm leaves stale @local/. rows in catalog, blocking later pulls of registry types

extension push drops binaries: field from re-emitted archive manifest.yaml

macOS launchd autoupdate (club.swamp.autoupdate) silently fails — binary stays stale

Clicking @hivemq/honeycomb extension card on /extensions shows 'Something went wrong'

Docs: Update model-definitions.md and workflows.md for direct type execution

Docs: document binaries manifest field in extension-manifest.md

Add an official @swamp/ssh extension for general-purpose SSH (brownfield-friendly)

Accept and display binaries field from extension push metadata

Direct type execution: collapse model create + method run into one command

Per-method telemetry events for workflow runs

Workflow run liveness: orphaned 'running' records when originating CLI process dies mid-run

Provide a CLI-shape primer for AI agents to reduce rediscovery overhead

quality rubric: don't penalize extensions whose upstream constrains them to a single platform

Extension update rejects multiple .ts files extending the same target type within one local extension (regression)

swamp extension push deadlocks when invoked from inside a swamp workflow step

Collective-scoped auth keys + OIDC federation for CI publishing

forEach self.* in modelIdOrName not resolved in runtime execution path

Award leaderboard points for referrals and collective invites

Add agent harness detection and AiTool to telemetry

Workflow-level runtime expressions (env., vault.) not resolved in driverConfig — docker driver receives literal ${{ ... }} strings

Implement W5: Per-fingerprint import URLs + subprocess test harness (extension catalog rearchitecture)

swamp config set crashes with YAML serialization error

datastore compact: VACUUM fails in compiled binary (SQLITE_LIMIT_ATTACHED=0)

Repo-level version gating: minSwampVersion high-water mark for team consistency

Docs: document self.* expressions in modelIdOrName during forEach

Docs: How-to guide for background autoupdating

Manifest version bumps silently ignored for existing local extension aggregates

materialiseExtensions misclassifies pulled rows when manifest name collides with a pulled extension

Local extension edits don't reliably trigger rebundle

Missing unique indexes on user.email and user.username allow duplicate users

Resolve self.* expressions in modelIdOrName during forEach expansion

discord-bot double-sends sign_up notifications

Discord bot sends duplicate signup notifications

Add 'swamp workflow list' as alias for 'swamp workflow search'

Add 'swamp auth status' as alias for 'swamp auth whoami'

Extension bundle cache does not invalidate on source edits

extension pull fails on @local/.@0.0.0 phantom-claim collision when local repo has its own extension

Lab search by numeric issue ID returns no results

W3 sourceToRow writes empty source_mtime — should carry filesystem mtime through Source entity

Warm-start rebundleAndUpdateCatalog should respect terminal RowStates set by reconcile

Implement W4: KindAdapter + unified loader (extension catalog rearchitecture)

Docs: add vault read-secret command to reference manual

Extension layer garbage collection: prune catalog rows + evict orphaned bundles

Docs: document workflow concurrency limits in reference manual

Locally-sourced extension: source_mtime updates without regenerating stale bundle

Extension push: allow shipping executable host helpers (bin/mudroom blocker)

Vault expressions silently deliver __SWAMP_VSEC__ sentinels under the docker driver

First-class shell-shim support for extensions, with registry-level visibility

Local extension model bundles don't rebuild when source changes (no rebuild CLI; manual cache delete breaks the runner)

Configurable concurrency limits for workflow fan-out (forEach, parallel jobs/steps)

feat(security): redact sensitive method arg values from audit log

docs: document swamp datastore compact and GC WAL behaviour

UAT: swamp datastore compact reclaims WAL and catalog space

Plan v4 step 9 literal test untestable under current catalog PK semantics

Cross-process concurrency stress for W2 lifecycle services

UAT additions for W2 lifecycle services (Install/Remove/Upgrade)

Implement W3: ReconcileFromDisk + freshness-as-aggregate-query (extension catalog rearchitecture)

doctor extensions repair: clean catalog-only orphans

Extensions should be able to ship Claude Code skills

Pre-existing TOCTOU windows in YAML repo walkers (findAll directory level + findById)

`swamp datastore setup` migration is not resumable / leaves the repo in a partial state on failure

Built-in models must honor AbortSignal so --timeout works in practice

Reader-lock or lock-free read path for data list/get/search/query

data search: surface jobTag alongside workflowTag and stepTag (follow-up to #237)

global-arg silently strips unknown keys; should reject via strict Zod schema

redmine extension: adopt state machine patterns from @magistr for agent-driven workflows

performance degrades significantly with large SQLite catalog

summarise: timeout/hang on repos with many workflow runs

extension quality/fmt fail on pulled extensions (path mismatch)

vault: add read-secret CLI command for agent-driven secret retrieval

data query: stepName and jobName fields always empty in CEL results

Extension ecosystem: shared utility library, version sync tooling, and HTTP resilience patterns

Agentic CLI improvements: --json stdout isolation, array inputs, and --repo-dir consistency

data delete fails with "Directory not empty (os error 39)" when concurrent writes are active

Extract LockfileRepository (W2 prequel for swamp-club#231)

Extend DatastoreSyncService.markDirty() with optional relPath argument

Implement W2: Lifecycle services own the catalog write (extension catalog rearchitecture)

data·delete logger double-quotes the data name in log output

DDD: refactor data services to depend on domain-side ports instead of infrastructure types

Detect AWS CredentialsProviderError in @swamp/aws-sm-vault and prepend SSO-expiration hint

Opt-in background autoupdate for the swamp binary (configurable cadence + risk tolerance)

Detect AWS CredentialsProviderError in summarizeSyncError and prepend SSO-expiration hint

S3 datastore hydrate has no fallback for buckets without .datastore-index.json

S3 datastore stale-lock retry loop never evicts orphan locks left by swamp processes that panic at shutdown

Implement W1b: Repository and RowState (extension catalog rearchitecture)

Redundant push after pullChanged: localMtime clobbered by pullIndex(forceRemote)

Docs: update datastore-configuration manual after #220 setup-hydration fix lands

workflow run search returns empty after S3 datastore setup, despite run YAMLs in datastore

CLI crashes with exit 134 (Rust panic in tls_wrap.rs) after successful command output

S3 datastore global lock enters infinite stale-lock loop after interrupted workflow

swamp-extension-model skill: include description field in upgrades quickref

swamp-extension-model skill: include field in upgrades quickref

Adversarial UAT test: missing cached bundle with intact catalog should self-recover

Port importBundleByPath ENOENT fallback to datastore/driver/vault/report loaders

`swamp datastore setup` (filesystem→S3 migration) panics in deno Node TLS layer mid-migration

swamp model type describe fails with 'No such file' instead of rebundling when bundle is missing

Implement W1: Repository and RowState (extension catalog rearchitecture)

feat: swamp extension verify — opaque extension-lifecycle verification primitive

Schema-invalid extensions loop in rebundle path: catalog row never updates after first failed validation

swamp model type search is slow (~8s) and re-bundles all extensions on every call

Per-extension layout migration drops Claude skill from @magistr/good-planning

swamp extension outdated crashes on empty repo (Stream ended...)

Docs: extension install/pull/update sync-to-manifest behaviour

Add process-level install lock around installExtension

Docs: extension commands reference

swamp extension install/pull does not prune source files dropped between versions, causing catalog to re-index orphans

Catalog retains stale source-file entries when extension version drops a file; no native prune/repair

Document and surface a native cache-refresh path so agents stop doing cache surgery

swamp should warn when installed extensions are outdated

Catalog retains stale source-file entries when extension version drops a file; no native prune/repair

Document and surface a native cache-refresh path so agents stop doing cache surgery

swamp should warn when installed extensions are outdated

Skill/prompt guidance: prefer the bundled deno when no system deno is on PATH

Vault backend backed by GitHub Actions Secrets (read via gh token)

Re-enable Windows tests as deno compile for Windows lands

swamp-club extension card no longer exposes @ns/slug as contiguous text

Docs: multi-tool repo support

swamp vault: vendor-specific annotations (e.g. 1Password notesPlain, tags, custom fields)

swamp model method run: --foreach to fan out across instances

swamp workflow validate: actionable error messages and template scaffolds

swamp CLI cold-start latency (~5–7 s per invocation) compounds in workflows that shell out

Workflow tasks should support ephemeral model instances (modelType + globalArgs) so workflows are zero-prereq

CEL expression evaluator throws 'Unhandled node type: string'

cli: agents need to add ripples (comments) to issues via the CLI

quality: models and additionalFiles paths resolve relative to different directories

quality: has-readme/has-license miss additionalFiles in subdirectories

Add swamp data delete command to remove a data artifact by model and name

add `swamp doctor extensions` subcommand for on-demand extension load diagnostics

AI agent skipped adversarial review step before smoke testing extension code

Better Auth rejects requests on hostnames not in hardcoded trustedOrigins (signup/signin broken on non-canonical hosts)

Local extension models in extensions/models are not discovered in fresh repo tutorial flow

ticket 1138 not clear - can we still use github?

Drag Windows into the Swamp

Add `swamp extension test` command to run built-in extension tests with coverage

swamp repo init --tool kiro does not create .kiro/settings/cli.json

Support multi-agent repo initialization (multiple --tool targets)

CLI dumps 300-line Cliffy Command object on unknown flags / subcommands

Docs: repository-configuration.md missing defaultDriver / defaultDriverConfig

Server-side parse query params on /lab/all so refresh preserves multi-filter URLs

fast-path sidecar TOCTOU: post-op HEAD can record generation from a concurrent writer's push, masking their data on next sync

Scorer should honour files/deno.json imports so bare specifiers resolve

@swamp/gcs-datastore: same minutes-slow zero-diff sync cliff as lab/164; mirror fingerprint fast path

cleanup for repoDriver

swamp datastore sync is minutes-slow at 4k-file scale even with zero-diff; outer 300s timeout fires

swamp-extension-publish skill: add quality rubric check before push

New @swamp extension: extension quality rubric checker for CI

swamp-extension-quality and swamp-extension-publish skills don't guide zod import map resolution for scorer

swamp repo upgrade deletes extension model source files

Add repo-level `defaultDriver` to `.swamp.yaml`

User report extensions registered lazily are silently skipped during method execution

swamp extension install: datastore push hangs ~8.5m then crashes with Deno TLS panic (tls_wrap.rs:1918 unwrap on None)

Add a preflight diagnostic for AI-tool audit integrations (so upstream CLI changes stop breaking us silently)

audit record --from-hook silently drops input from kiro-cli postToolUse hooks

codegen pipelines don't detect _lib/*.ts changes so manifest CalVer never bumps

Link to namespace extensions listing from profile pages

Trailing slash on /extensions/@<namespace>/ returns 404

No way to browse all extensions belonging to a collective by URL

DatastoreProvider.resolveCachePath declared optional but silently required at runtime

Accept-invite link returns HTML instead of JSON, breaking collective join

additionalFiles flatten to basenames on push and lack a runtime access API, creating a source-vs-pulled layout mismatch

Extension search returns inflated results for quoted phrase queries

Docs: document jsr:/https: imports and non-local pinning convention in user-facing manual

First-class jsr: specifier support in extension bundler

Cross-extension code sharing via manifest exports field

Extension models: document/resolve implicit-any in execute parameters when imported by test files

extension yank: allow unyank and version-specific yanks

extension source add does not discover brand new types — only overrides already-pulled types

Add light mode to swamp.club and swamp open UI

Add 'swamp open' command to open the swamp.club web UI

Add light mode to swamp.club website

Datastore sync surfaces opaque errors from extensions verbatim — no status code or body preview

@swamp/s3-datastore: first-attempt 403 masked as "UnknownError" from AWS SDK deserializer

Extension auto-resolve reports "already_installed" for truncated pulled-extension trees

Email delivery for mention notifications

Auto-update WARN is silent in --json mode (logger suppresses non-fatal)

open.ts web UI uses force:true pullExtension, same data-loss family as #126

Port bundle_freshness (content-fingerprint cache invalidation) to reports / drivers / datastores / vaults loaders

Mentions and notifications system for issues

Datastore auto-update in resolve_datastore.ts uses force:true, risking silent overwrite of local edits

Per-repo user-extension bundle cache doesn't invalidate on source changes

Adding methods to in-body `methods:{}` on `export const model` doesn't re-register

User extensions silently dropped when base type not yet registered at scan time

Footer floats when page content is shorter than viewport

workflow validate can silently overwrite local edits to pulled extensions via force-pull in auto-resolver

Extension pull should namespace files by extension to prevent filename collisions

Update CLAUDE.md co-author instructions to use swamp-club issue author lookup

Add swamp issue get CLI command to fetch issue details

swamp-club API: include issue author in GET /api/v1/lab/issues/{number} response

Install command curl-pipe-sh overflows the component on swamp.club homepage

'Assigned to me' overlaps 'Privacy policy' on short viewports

Collapsible left rail and repositionable right rail in Lab

Usernames aren't linked to their profile pages

Filter lab issues by author (opened by user)

Add skills extension type for bundling agent/human guidance documents

Remove traffic lights in column 2 of /lab

Multi-select combo filtering on /lab

data gc skips version-count GC when no lifetime-expired data exists

Content filter should identify the flagged word or phrase

Bog flow: text rendering and layout issues

Flow modal: text rendering issues

Normalize text sizing across issue list and detail views

Description 'Show more' button appears even when text fits

Inline editing: click-to-edit fields instead of pencil icons

Persist lab filter selection in localStorage

Update how-to guide with swamp-extension-publish skill

Fix incorrect favicon in Google search results

Missing section on user profile page for wendy

Extension skills missing repository initialization and publishing prerequisites

Vault CEL expressions replaced with VaultSecretBag sentinels after model type upgrade

Audit: modelRegistry.get() without ensureTypeLoaded() in YAML repository save() paths

Cross-model expression validator fails on lazy-loaded types — modelRegistry.get() bypasses ensureTypeLoaded

forEach.in with data.latest() throws misleading 'got: object' error for unresolved Promise

issue-lifecycle models should support --assignee for swamp.club issues

Driver capability registry: declare richer execution capabilities at driver design time

Consolidate MethodReportContext construction — manual and workflow report paths build contexts divergently

Workflow-level workspace for docker driver: stateful multi-step workflows

"OG Swamper" badge inconsistent

Workflow-scope user extension reports don't execute: getAll() excludes lazy-loaded reports

Improve skill trigger routing accuracy across models

Add GitHub Copilot IDE support

Phase 1: /feed — judge-gated content stream

Add reactions and Giphy integration to comments

Architecture violation: search route imports directly from lib/infrastructure

Introduce domain events to formalize the telemetry-to-consumer pipeline

Refactor: move telemetry track() calls from route handlers to application services

Reindex path feeds error events to consumer, bypassing filtering

Custom swamp-themed avatar generator with daily rerolls

Profile content links with scoring for community contributions

Score extension pull events for extension authors

Score daily sign-in events with streak multiplier

Score sign_up events in the telemetry pipeline

Score extension publish events in the telemetry pipeline

Add 'award' telemetry event type for arbitrary score grants

Bug: authenticated pulls always shows 0 on profile page

Decouple identity_map from main app: username renames via event, not shared DB

Optimise MongoDB Search Queries

Transactional emails on login with google/similar

Add rate limiting to send-verification-email endpoint

Add authentication or rate limiting to check-verified endpoint

swamp data query for morning-message in hello-world tutorial returns nothing.

Document vault migrate command in reference docs

Locks on long running actions

issue-lifecycle skill: improve resumption and close-out guidance

deprovision: firewall deletion fails with resource_in_use immediately after server delete

swamp workflow validate should check step inputs against method's required arguments

data.latest() returns null when new data written while _catalog.db is already marked populated

Bundle cache fallback silently skipped when source and bundle have equal mtimes

Add vault migrate command to move secrets between vaults

Consolidate method execution paths — workflow steps and manual runs build MethodContext divergently

CatalogStore constructor runs createSchema before migrateIfNeeded; v1→v2 upgrade fails on existing repos

discord-bot poller double-processes events with >1 replica

datastore sync: clean up zombie _catalog.db* entries from remote index and S3 bucket

datastore sync --push runs pushChanged() twice per invocation (coordinator dedup)

datastore sync --push fails on _catalog.db-wal: catalog SQLite DB lives inside the S3 sync cache

.swamp/datastore-bundles/ leaks into deno lint and deno fmt scans

deno run audit task missing --allow-env flag

Error when submitting a new issue manually

Green text on issue details is a lot

evals/promptfoo: bump hono and @hono/node-server to clear 6 dependabot alerts

issue-lifecycle: COMMENTED PR review can overwrite a prior decisive state in fetchPrReviews

Add agent-constraints/ for issue-lifecycle skill

@swamp/aws/ec2: auto-generated models lack list, tag, and factory-compatible update methods

@swamp/digitalocean/space-key stores secret in plaintext - should mark as sensitive

Add Azure provider pipeline to codegen

feat: Namespace.so execution driver for remote workload execution

Add macOS Keychain vault type

Add uniform bucket-level IAM support to @swamp/gcp/storage

Expand DataRecord with first-class provenance fields; remove all hidden scoping from data access

feat: Private extensions

Workflow execution repeats #1091: cross-model CEL expression validation fails for unresolved types

context.readModelData returns different results depending on invocation context (manual vs workflow)

Handle sensitive fields gracefully when no vault is configured

Vault reads for model global arguments are cached at workflow start, making in-workflow token refresh ineffective

feat: approval gates for workflow steps and jobs

Install script: curl fails TLS verification for swamp.club (certificate chain)

Extension Patches: contribution workflow for community extensions

Feature: swamp issue for extensions — bug reports, security disclosures, and author notifications

Support 'swamp <app> run' as containerized entrypoint for easy onboarding

Persistent runner / server mode to eliminate per-invocation CLI startup overhead

feat: add support for Nix via a flake

← Back to list

01Issue

FeatureShippedSwamp Club

Assigneesstack72

Relationships

#568 Docs: add doctor vaults subcommand and pre-flight vault validation

Opened by stack72 · 6/5/2026· Shipped 6/5/2026

What changed

swamp-club/swamp#562 added vault-availability validation for models with sensitive resource outputs:

swamp doctor vaults — new doctor subcommand that scans model definitions for sensitive resource outputs and warns if no vault is configured. Supports --json output and exits non-zero for CI gating.
Pre-flight vault check — before method execution, if a model has sensitive resource output fields and no vault is configured, the method fails immediately with an actionable error message instead of running and failing at persist time.

Docs to update

content/manual/reference/doctor.md

Add doctor vaults subcommand documentation
Example usage: swamp doctor vaults, swamp doctor vaults --json
Describe what it checks (sensitive fields in resource output schemas vs vault availability)

content/manual/reference/vaults.md

Mention the pre-flight validation behavior: models with sensitive outputs now require a vault to be configured before the method can run
Note the error message and how to resolve it (swamp vault create )

02Bog Flow

Shipped

6/5/2026, 11:36:01 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack726/5/2026, 11:19:23 PM

Sign in to post a ripple.