@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

A swamp issue ripple <n> invocation that logged a successful Posted ripple on issue #514 is not visible on the Lab ~5 days later. A separate (probably related) oddity: swamp issue get <n> --json returns commentCount: 0 even on Labs where ripples are visible in the UI.

Evidence

A local agent-session transcript captured the exact ripple invocation and its successful tool result on 2026-06-01.

CLI input:

swamp issue ripple 514 --body "Root cause identified: the issue is not truncation or encoding. The model was using vault:// URI syntax in globalArguments, which is resolved at definition-load time and cached. The working pattern from another extension repo uses CEL expressions (\${{ vault.get(vault-name, key) }}) which are evaluated at method-execution time, ensuring a fresh token on every call.

The vault:// syntax may still have a separate round-trip issue, but the practical fix is to use CEL vault expressions for short-lived credentials like OAuth tokens."

CLI output (recorded as the tool result):

HH:MM:SS.863 INF issue·ripple Posted ripple on issue #514
HH:MM:SS.864 INF issue·ripple View at: "https://swamp-club.com/lab/514"

Current state:

https://swamp-club.com/lab/514 UI shows no ripple from the affected author.
swamp issue get 514 --json returns commentCount: 0.

Secondary observation

swamp issue get <n> --json returns commentCount: 0 even on Labs where ripples are visible in the UI. So either:

(a) commentCount in the get-Lab JSON is always 0 (unimplemented), masking the real comment state, OR
(b) ripples are sometimes persisted to a place the get-Lab API doesn't see, depending on auth/source/environment at post time.

Either way, callers using swamp issue get --json cannot reliably tell whether a Lab has ripples.

Suggested fix

Investigate whether the #514 ripple ever reached durable storage. The Posted ripple log appears to be emitted before/without a persistence handshake — the success log should only fire after persistence is confirmed.
Make swamp issue get --json reflect the actual ripple/comment count, or remove the misleading commentCount field if it isn't going to be populated.
If the #514 ripple did reach durable storage and was lost server-side, surface a retention/migration story so callers can tell whether their ripple is gone vs. just out-of-view.

Why this matters

Both humans and agents rely on swamp issue ripple to record progress, root-cause findings, and cross-link Labs. If a ripple silently disappears after a successful post log, the canonical record of an investigation is lost — and there's no signal that it happened.

02Bog Flow

Shipped

6/6/2026, 11:51:19 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack726/6/2026, 10:52:07 PM

stack72 commented 6/6/2026, 11:51:26 PM

Thanks @bixu for reporting this! The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

workflow resume fails to register all extension model types (local and pulled) — "Unknown model type"

model method run: cannot pass arrays, numbers, or booleans via --input

extension push --dry-run --json reports local helper imports as bogus model entries

Extension source: direct-content export scan only reads first 64 KiB, silently drops exports beyond it

Homepage install command: wrong domain and missing https:// protocol

Homepage install command: wrong domain and missing https:// protocol

first-class refresh hook for short-lived vault values (gcloud / aws-sso / kubectl-oidc token UX)

swamp issue ripple logged "Posted ripple on issue #514" but the ripple is not visible on the Lab

vault guide promotes inline secret values (KEY=VALUE) as a primary "swamp vault put" example

swamp-getting-started SKILL.md still references removed swamp-model / swamp-workflow / swamp-vault / swamp-extension / swamp-repo skills

extension rm blocked by stale /workspace bundle_types rows from prior container sessions with host repo bind-mounted

extension search returns null repository fields that extension info populates

Quality rubric: scope "No slow types" for model extensions (consumed via model+CEL, not type imports)

data get/list --workflow and workflow history get/logs cannot resolve extension-delivered workflows (Workflow not found)

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

UAT: sensitive resource output without vault produces clear pre-flight error

Docs: add doctor vaults subcommand and pre-flight vault validation

gcs-datastore: registerNamespace does not detect conflicts with existing registrations

Validate vault availability when model has sensitive output fields

Managed skills ship with dangling reference-doc links

swamp-club: update skill references and CLAUDE.md after superskill consolidation

swamp-uat: init_test.ts asserts old skill directory names after superskill consolidation

Codegen: auto-merge resources across GCP API versions instead of manual ADDITIONAL_VERSION_RESOURCE_FILTER

fix: giga-swamp UAT failures — 9 bugs found during comprehensive testing

fix: datastore setup extension with namespace config doesn't scope sync or register manifest

fix: namespace set on default repo writes incomplete filesystem config (missing path)

@swamp/1password put double-escapes JSON values

feat: giga-swamp comprehensive UAT coverage

@swamp/kubernetes 2026.06.04.1 missing upgrade path from 2026.05.27.2

@swamp/kubernetes ignores certificate-authority-data from kubeconfig for self-signed CAs

Inconsistent failures in swamp doctor extensions (database is locked, bundle build failed)

docs: giga-swamp user documentation — reference, how-to, and conceptual guide

@swamp/gcp/iam missing serviceAccounts model type

@swamp/ssh@2026.06.04.1 fails to load: bare zod import + missing 2026.06.04.1 upgrade entry

feat: giga-swamp phase 7 — Data migration commands

feat: S3/GCS extension namespace manifest support (registerNamespace/listNamespaces)

Relocate Docker image from systeminit org to swamp-club

Move JSR packages from @systeminit to @swamp-club scope

Should be able to see all the issues I created by a filter "submitted by me"

Ability to change the email address associated with my Swamp Club Account

feat: giga-swamp phase 5 — CLI output + namespace management commands

CI review jobs use two-dot diff that includes files the PR never touched

paths.base: manifest is not honored for workflows: — bundled workflows only resolve from repo root, blocking self-contained subdir layouts (sibling to #459)

Lab profanity filter rejects legitimate CLI flag tokens via substring match

Sign and notarize the swamp macOS binary

Add platform type to issue-lifecycle extension model Zod schema

fix: datastoreSetupExtension() ignores namespace config on initial migration push/pull

Remote execution: orchestrator/worker fan-out (replaces execution drivers)

swamp datastore sync --push creates global .datastore-index.json ignoring namespace config

feat: S3/GCS extension namespace-scoped sync support

Copy explicitGlobalArgs before mutation in resolveOrCreateDefinition

vault.get() expressions in extension model globalArguments are not resolved at runtime

swamp-issue skill should scrub secrets and org-specific data before submission

workflow validate: trim stale 'skipped' label from model_not_found warning

Add pi coding agent support

hashicorp-vault should read token from env

swamp-extension adversarial review skill needs mandatory mechanical verification checklist

feat: giga-swamp phase 6 — Namespace-scoped sync

swamp workflow validate emits misleading "Extension failed to load" warning when type resolves locally

Add issue search/list command to discover existing issues

Support vault-resolved private key content in transport auth (not just file paths)

Workflow engine resolves extension methods against base type, ignoring extension-registered methods

Per-model LockTimeoutError at 60s causes cascading failures under concurrent access

Persistent, queryable workflow runs (status / cancel from any shell)

swamp repo upgrade: ERR_SQLITE_ERROR 'attempt to write a readonly database' during extension catalog schema migration

workflow validate: fail on references to unknown model instances (typo'd modelIdOrName)

feat: giga-swamp phase 4 — CEL cross-namespace queries

Docs: document the extension push adversarial-review gate

vault://local_encryption token does not round-trip correctly for GCP OAuth2 access tokens

swamp issue: add ability to edit issue title and body after submission

@swamp/gcp/iam: add WIF pool, provider, service account, and binding support

Support vault-sourced identity keys

copy method reports success when scp exits non-zero (e.g. 255)

Docs: TLS behind inspecting proxies / private CAs (system trust store, DENO_CERT, SSL_CERT_FILE)

Extension quality/adversarial-review: add a 'published-surface hygiene' check for real infra identifiers

Feed-post scoring is a direct domain write, not a consumer of feed_post_approved telemetry

workflow validate silently PASSES steps whose model type is a pulled extension (step-inputs skipped = false pass)

extension quality fails to resolve bare specifiers — contradicts fmt no-import-prefix rule

Allow global arguments in direct type execution (workflow fan-out)