One-shot bootstrap for @swamp/s3-datastore. Ships a single provisioner model that creates an S3 bucket and a least-privilege IAM managed policy, plus a workflow that runs the provisioner and then switches the current swamp repository over to the S3 datastore. ## Prerequisites - AWS credentials in the default credential chain (env / profile / role) with permissions to create the bucket, create the managed policy, and exercise the runtime actions documented in @swamp/s3-datastore. - The caller that will run swamp after setup must already hold, or will attach, the managed policy produced by this workflow. ## What it does 1. `provision` creates a private S3 bucket (versioning on, SSE-S3, public access blocked) and a scoped IAM managed policy granting the four runtime IAM actions (`ListBucket`, `GetObject`, `PutObject`, `DeleteObject`) limited to that bucket. 2. A final `command/shell` step runs `swamp datastore setup extension @swamp/s3-datastore --config ...` to flip the repo's datastore to S3. ## Running ```bash swamp extension pull @swamp/s3-datastore-bootstrap swamp model create @swamp/s3-datastore-bootstrap/provisioner \ swamp-s3-datastore-provisioner # Edit the instance so globalArguments are wired to workflow inputs: # bucket_name: ${{ inputs.bucket_name }} # region: ${{ inputs.region }} # prefix: ${{ inputs.prefix }} # policy_name: ${{ inputs.policy_name }} swamp model edit swamp-s3-datastore-provisioner # The command/shell instance used by the final workflow step swamp model create command/shell swamp-s3-datastore-setup swamp workflow run bootstrap-s3-datastore \ --input bucket_name=my-swamp-state \ --input region=us-east-1 swamp datastore status ``` See the bundled README for optional inputs (`prefix`, `policy_name`), the exact IAM policy produced, and idempotency notes.

linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64

datastorebootstrapawss3

modelsworkflows

2026.04.22.3

Grade A

@swamp/gcs-datastore-bootstrap

One-shot bootstrap for @swamp/gcs-datastore. Ships a single provisioner model that creates a GCS bucket and a project-scoped custom IAM role, plus a workflow that runs the provisioner and then switches the current swamp repository over to the GCS datastore. ## Prerequisites - GCP Application Default Credentials in the environment (env var, `gcloud auth application-default login`, or attached service account) bound to a principal with `roles/storage.admin` and `roles/iam.roleAdmin` (or equivalent) on the target project. - The target project has the Cloud Storage API and the IAM API enabled. - The caller that will run swamp after setup must already hold, or will have bound to it, the custom role produced by this workflow. ## What it does 1. `provision` creates a private GCS bucket with hardened defaults (uniform bucket-level access on, public access prevention `enforced`, versioning on) and a project-scoped custom IAM role granting the five runtime permissions (`storage.buckets.get`, `storage.objects.get`, `storage.objects.create`, `storage.objects.delete`, `storage.objects.list`) the datastore uses. 2. A final `command/shell` step runs `swamp datastore setup extension @swamp/gcs-datastore --config ...` to flip the repo's datastore to GCS. ## Running ```bash swamp extension pull @swamp/gcs-datastore-bootstrap swamp model create @swamp/gcs-datastore-bootstrap/provisioner \ swamp-gcs-datastore-provisioner # Edit the instance so globalArguments are wired to workflow inputs: # bucket_name: ${{ inputs.bucket_name }} # project_id: ${{ inputs.project_id }} # location: ${{ inputs.location }} # prefix: ${{ inputs.prefix }} # role_id: ${{ inputs.role_id }} swamp model edit swamp-gcs-datastore-provisioner # The command/shell instance used by the final workflow step swamp model create command/shell swamp-gcs-datastore-setup swamp workflow run @swamp/bootstrap-gcs-datastore \ --input bucket_name=my-swamp-state \ --input project_id=my-gcp-project \ --input location=US swamp datastore status ``` See the bundled README for optional inputs (`prefix`, `role_id`), the exact permission set granted by the role, and idempotency notes.

linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64

datastorebootstrapgcpgcs

modelsworkflows

2026.04.22.3

Grade A

@swamp/aws-sm

Read and write secrets stored in AWS Secrets Manager. ## Authentication Uses the default AWS credential chain — no credentials in config. Provide credentials via one of: - Environment variables: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` - AWS profile: `~/.aws/credentials` - IAM role attached to the instance or task ## Required IAM Permissions - `secretsmanager:GetSecretValue` - `secretsmanager:PutSecretValue` - `secretsmanager:CreateSecret` - `secretsmanager:ListSecrets` ## Usage ```bash swamp vault create @swamp/aws-sm my-aws-sm \ --config '{"region": "us-east-1"}' --json swamp vault get my-aws-sm my/secret/name --json swamp vault put my-aws-sm my/secret/name "s3cr3t" --json swamp vault list-keys my-aws-sm --json ``` ## Secret Key Format Secret keys map directly to AWS Secrets Manager secret names, including path-style names such as `myapp/production/db-password`.

linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64

vaultawssecrets-managersecrets

vaults

2026.04.22.2

Grade A

@swamp/azure-kv

Read and write secrets stored in Azure Key Vault. ## Authentication Uses `DefaultAzureCredential` — no credentials in config. Provide credentials via one of: - Environment variables: `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_SECRET` - Azure CLI: `az login` - Managed Identity attached to the VM or container ## Usage ```bash swamp vault create @swamp/azure-kv my-azure-kv \ --config '{"vault_url": "https://my-vault.vault.azure.net"}' --json swamp vault get my-azure-kv my-secret --json swamp vault put my-azure-kv my-secret "s3cr3t" --json swamp vault list-keys my-azure-kv --json ``` ## Secret Key Format Secret keys map to Azure Key Vault secret names. Slashes and underscores are converted to hyphens (Azure only allows alphanumeric characters and hyphens). Use `secret_prefix` to namespace secrets when sharing a vault across multiple swamp instances.

linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64

vaultazurekey-vaultsecrets

vaults

2026.04.22.2

Grade A

@swamp/1password

Read and write secrets stored in 1Password using the `op` CLI. ## Prerequisites - [1Password CLI](https://developer.1password.com/docs/cli/get-started/) installed and in `PATH` - Authenticated via one of: - **Service account**: `export OP_SERVICE_ACCOUNT_TOKEN=<token>` - **Desktop app**: enable CLI integration in 1Password settings - **Connect Server**: `export OP_CONNECT_HOST=<url>` and `export OP_CONNECT_TOKEN=<token>` ## Usage ```bash swamp vault create @swamp/1password my-1password \ --config '{"op_vault": "Private"}' --json swamp vault get my-1password my-api-key --json swamp vault put my-1password my-api-key "s3cr3t" --json swamp vault list-keys my-1password --json ``` ## Secret Key Format - `item-name` — reads the `password` field of the named item - `item-name/field` — reads a specific field - `op://vault/item/field` — full 1Password URI (passthrough)

linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64

vault1passwordsecrets

vaults

2026.04.22.2

Grade A

@swamp/issue-lifecycle

Interactive triage and implementation planning for swamp-club lab issues. Drives the triage/plan/iterate/approve/implement loop as a local conversation with Claude, while posting structured lifecycle entries and status transitions back to the swamp-club issue on every step. The model operates directly on swamp-club lab issue numbers — the issue must already exist in swamp-club before you start. There is no GitHub integration. ## State Machine ``` created ──[start]──> triaging triaging ──[triage]──> classified classified ──[plan]──> plan_generated plan_generated ──[iterate]──> plan_generated (feedback loop) plan_generated ──[approve]──> approved approved ──[implement]──> implementing implementing ──[link_pr]──> pr_open pr_open ──[link_pr]──> pr_open (idempotent re-link) pr_open ──[complete]──> done implementing ──[complete]──> done (legacy, no PR linked) ``` Pre-flight checks enforce valid transitions: you cannot approve without a plan, cannot implement without approval, and cannot approve while critical or high adversarial findings remain unresolved. `complete` accepts both `implementing` and `pr_open` as source phases so legacy records (created before `link_pr` existed) can still reach `done`. ## Methods - `start` — fetch issue context from swamp-club (fails if the issue does not exist) - `triage` — classify as bug/feature/security and PATCH the swamp-club issue type - `plan` — generate an implementation plan - `review` — display the current plan (read-only) - `iterate` — revise the plan with feedback (versioned) - `adversarial_review` — record adversarial review findings - `resolve_findings` — mark adversarial findings as resolved - `approve` — lock the plan and transition to in_progress - `implement` — signal implementation has started - `link_pr` — link an opaque pull request URL to the lifecycle record (idempotent; transitions to `pr_open`). Git-host agnostic — the model persists whatever URL the agent supplies without fetching anything. - `complete` — mark the lifecycle done ## Data All resources are versioned and immutable: `state`, `context`, `classification`, `plan`, `feedback`, `adversarialReview`, `pullRequest`. ## Prerequisites - swamp initialized in the repository (`swamp init`) - `SWAMP_API_KEY` env var (or `swamp auth login`) for swamp-club access - The target lab issue must already exist in swamp-club

linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64

issue-lifecyclesdlc

modelsskills

2026.04.22.2

@swamp/aws/elasticloadbalancing

AWS ELASTICLOADBALANCING infrastructure models

linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64

awselasticloadbalancingcloudinfrastructure

models

2026.04.03.3