Extension Maintenance

2026.08.28.2

Fixed: The sweep no longer corrupts model upgrade chains. Previously plan-bump emitted a toVersion: "<old>" → "<new>" find/replace that relabelled the last existing upgrade entry in place, destroying the prior version's migration step and attaching its description to the wrong version. It passed the shallow chain check only because the last toVersion still equalled the model version. apply-bump now APPENDS a new no-op upgrade entry (identity upgradeAttributes) to every model upgrades: array instead, leaving prior entries intact.

Fixed: The sweep now updates exact-literal test version assertions. Tests of the form assertEquals(model.version, "<old>") were left pointing at the old version, breaking deno test after a bump (as happened to the 5 *-datastore-bootstrap extensions in the license sweep). plan-bump now emits a test-assertion change for each distinct asserted literal. Pattern-based assertions (assertMatch(model.version, /regex/)) carry no literal and are untouched.

Added: checkUpgradeChain now detects the relabel anti-pattern. When given the version a bump came from, it errors if that previous shipped version's chain entry is missing — catching an in-place relabel even though the last toVersion matches the model version.

Added: BumpPlanEntry.upgradeInserts (structured append instructions) and a test-assertion change category.

Upgrade note: Behavior of the maintenance sweep only. This tool must never be used for a schema-changing bump — the appended migration is identity and would silently fail to migrate stored data. Dependency and license bumps (its only purpose) never change data shape.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.24.2

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.24.1

Added Troubleshooting section documenting strict audit/plan/apply ordering, registry-unavailability false negatives, per-extension apply resilience, registry_timeout arg, and quality-gate fmt side effect.

2026.08.21.2

Changed: quality-gate failures now include the actual command output. Previously a failing deno task check/lint/fmt/test or swamp extension fmt --check only recorded a bare "check failed" / "lint failed" style message with no indication of what broke; the errors array now embeds a truncated snippet of the command's stderr (or stdout when stderr is empty) so you can diagnose a failure from the quality report alone. apply-bump's deno cache regeneration failure message now includes the deno cache stderr output instead of a generic "may be out of sync" note.

2026.08.21.1

Changed: Added .describe() documentation to previously undocumented schema fields: the extensions array in AuditSummarySchema, the changes[].category enum and entries array in the bump-plan schemas, and the error/result fields in ApplyResultSchema and QualityResultSchema. No behavioral change.

2026.08.15.1

Fixed: Restore comment line in maintainer.ts truncated by apply-bump's over-broad version regex (matched @opentelemetry/api@1.9.1 inside a code comment and stripped trailing text).

2026.08.06.1

Fixed: plan-bump no longer assumes that source file version strings match manifest.yaml. It now reads the actual version: fields from .ts source files via a new readSourceVersions helper and emits find/replace patterns for each distinct version found. This fixes silent no-ops during apply-bump when a prior partial bump left source and manifest versions out of sync (as happened with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).

Fixed: checkUpgradeChain now cross-validates that each source file's model version matches the manifest version. Previously it only checked internal consistency (last toVersion == version: within the same file), so a file whose version drifted from the manifest passed silently. Both apply-bump and quality-gate now pass the expected manifest version to catch this class of mismatch.

2026.08.01.1

Fixed: apply-bump now self-verifies the upgrade chain it just wrote before counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds the matching toVersion alongside a version bump) only helps when apply-bump runs through the full extension-maintenance-sweep workflow, whose verify step calls quality-gate. Two sweeps since then were run as ad-hoc audit → plan-bump → apply-bump invocations that skipped verify entirely, so a broken chain shipped undetected both times — 19 extensions after the 2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31. apply-bump now runs the same checkUpgradeChain check quality-gate uses immediately after writing each extension's files, so a broken chain is caught and reported in current-apply even when verify never runs.

2026.07.31.1

Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0

2026.07.27.4

Fixed: apply-bump lockfile regeneration now uses deno cache on all source files instead of deno install. The previous approach only resolved specifiers declared in the deno.json import map, leaving direct specifiers (like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then fail on lock-check because the lockfile still referenced the old version.

2026.07.27.3

Fixed: apply-bump now prepends the new release notes entry to RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the entire changelog history, replacing it with only the current bump's entry.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.08.21.1

Changed: Added .describe() documentation to previously undocumented schema fields: the extensions array in AuditSummarySchema, the changes[].category enum and entries array in the bump-plan schemas, and the error/result fields in ApplyResultSchema and QualityResultSchema. No behavioral change.

2026.08.15.1

Fixed: Restore comment line in maintainer.ts truncated by apply-bump's over-broad version regex (matched @opentelemetry/api@1.9.1 inside a code comment and stripped trailing text).

2026.08.06.1

Fixed: plan-bump no longer assumes that source file version strings match manifest.yaml. It now reads the actual version: fields from .ts source files via a new readSourceVersions helper and emits find/replace patterns for each distinct version found. This fixes silent no-ops during apply-bump when a prior partial bump left source and manifest versions out of sync (as happened with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).

Fixed: checkUpgradeChain now cross-validates that each source file's model version matches the manifest version. Previously it only checked internal consistency (last toVersion == version: within the same file), so a file whose version drifted from the manifest passed silently. Both apply-bump and quality-gate now pass the expected manifest version to catch this class of mismatch.

2026.08.01.1

Fixed: apply-bump now self-verifies the upgrade chain it just wrote before counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds the matching toVersion alongside a version bump) only helps when apply-bump runs through the full extension-maintenance-sweep workflow, whose verify step calls quality-gate. Two sweeps since then were run as ad-hoc audit → plan-bump → apply-bump invocations that skipped verify entirely, so a broken chain shipped undetected both times — 19 extensions after the 2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31. apply-bump now runs the same checkUpgradeChain check quality-gate uses immediately after writing each extension's files, so a broken chain is caught and reported in current-apply even when verify never runs.

2026.07.31.1

Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0

2026.07.27.4

Fixed: apply-bump lockfile regeneration now uses deno cache on all source files instead of deno install. The previous approach only resolved specifiers declared in the deno.json import map, leaving direct specifiers (like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then fail on lock-check because the lockfile still referenced the old version.

2026.07.27.3

Fixed: apply-bump now prepends the new release notes entry to RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the entire changelog history, replacing it with only the current bump's entry.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.08.15.1

Changed: Bump @opentelemetry/api 1.9.1`) that bypass → 1.9.1

2026.08.06.1

Fixed: plan-bump no longer assumes that source file version strings match manifest.yaml. It now reads the actual version: fields from .ts source files via a new readSourceVersions helper and emits find/replace patterns for each distinct version found. This fixes silent no-ops during apply-bump when a prior partial bump left source and manifest versions out of sync (as happened with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).

Fixed: checkUpgradeChain now cross-validates that each source file's model version matches the manifest version. Previously it only checked internal consistency (last toVersion == version: within the same file), so a file whose version drifted from the manifest passed silently. Both apply-bump and quality-gate now pass the expected manifest version to catch this class of mismatch.

2026.08.01.1

Fixed: apply-bump now self-verifies the upgrade chain it just wrote before counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds the matching toVersion alongside a version bump) only helps when apply-bump runs through the full extension-maintenance-sweep workflow, whose verify step calls quality-gate. Two sweeps since then were run as ad-hoc audit → plan-bump → apply-bump invocations that skipped verify entirely, so a broken chain shipped undetected both times — 19 extensions after the 2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31. apply-bump now runs the same checkUpgradeChain check quality-gate uses immediately after writing each extension's files, so a broken chain is caught and reported in current-apply even when verify never runs.

2026.07.31.1

Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0

2026.07.27.4

Fixed: apply-bump lockfile regeneration now uses deno cache on all source files instead of deno install. The previous approach only resolved specifiers declared in the deno.json import map, leaving direct specifiers (like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then fail on lock-check because the lockfile still referenced the old version.

2026.07.27.3

Fixed: apply-bump now prepends the new release notes entry to RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the entire changelog history, replacing it with only the current bump's entry.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.08.06.1

Fixed: plan-bump no longer assumes that source file version strings match manifest.yaml. It now reads the actual version: fields from .ts source files via a new readSourceVersions helper and emits find/replace patterns for each distinct version found. This fixes silent no-ops during apply-bump when a prior partial bump left source and manifest versions out of sync (as happened with agentcore-bootstrap/provisioner.ts in the 2026.08.05 sweep).

Fixed: checkUpgradeChain now cross-validates that each source file's model version matches the manifest version. Previously it only checked internal consistency (last toVersion == version: within the same file), so a file whose version drifted from the manifest passed silently. Both apply-bump and quality-gate now pass the expected manifest version to catch this class of mismatch.

2026.08.01.1

Fixed: apply-bump now self-verifies the upgrade chain it just wrote before counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds the matching toVersion alongside a version bump) only helps when apply-bump runs through the full extension-maintenance-sweep workflow, whose verify step calls quality-gate. Two sweeps since then were run as ad-hoc audit → plan-bump → apply-bump invocations that skipped verify entirely, so a broken chain shipped undetected both times — 19 extensions after the 2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31. apply-bump now runs the same checkUpgradeChain check quality-gate uses immediately after writing each extension's files, so a broken chain is caught and reported in current-apply even when verify never runs.

2026.07.31.1

Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0

2026.07.27.4

Fixed: apply-bump lockfile regeneration now uses deno cache on all source files instead of deno install. The previous approach only resolved specifiers declared in the deno.json import map, leaving direct specifiers (like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then fail on lock-check because the lockfile still referenced the old version.

2026.07.27.3

Fixed: apply-bump now prepends the new release notes entry to RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the entire changelog history, replacing it with only the current bump's entry.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.08.01.1

Fixed: apply-bump now self-verifies the upgrade chain it just wrote before counting an extension as bumped. The plan-bump fix from 2026.07.29 (it adds the matching toVersion alongside a version bump) only helps when apply-bump runs through the full extension-maintenance-sweep workflow, whose verify step calls quality-gate. Two sweeps since then were run as ad-hoc audit → plan-bump → apply-bump invocations that skipped verify entirely, so a broken chain shipped undetected both times — 19 extensions after the 2026.07.27.1 sweep, then 21 more after the AWS SDK bump on 2026.07.31. apply-bump now runs the same checkUpgradeChain check quality-gate uses immediately after writing each extension's files, so a broken chain is caught and reported in current-apply even when verify never runs.

2026.07.31.1

Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0

2026.07.27.4

Fixed: apply-bump lockfile regeneration now uses deno cache on all source files instead of deno install. The previous approach only resolved specifiers declared in the deno.json import map, leaving direct specifiers (like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then fail on lock-check because the lockfile still referenced the old version.

2026.07.27.3

Fixed: apply-bump now prepends the new release notes entry to RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the entire changelog history, replacing it with only the current bump's entry.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.07.31.1

Changed: Bump @aws-sdk/credential-providers 3.1096.0 → 3.1100.0

2026.07.27.4

Fixed: apply-bump lockfile regeneration now uses deno cache on all source files instead of deno install. The previous approach only resolved specifiers declared in the deno.json import map, leaving direct specifiers (like npm:@opentelemetry/api@1.9.1) unresolved in the lockfile. CI would then fail on lock-check because the lockfile still referenced the old version.

2026.07.27.3

Fixed: apply-bump now prepends the new release notes entry to RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the entire changelog history, replacing it with only the current bump's entry.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.07.27.3

Fixed: apply-bump now prepends the new release notes entry to RELEASE_NOTES.md instead of overwriting it. Previous versions discarded the entire changelog history, replacing it with only the current bump's entry.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.07.27.2

Fixed: apply-bump now includes *_test.ts files when expanding glob patterns for find-and-replace. Previously the glob expansion excluded test files, so a dependency bump in production source would leave the same import at the old version in tests — causing duplicate-singleton bugs (e.g. OpenTelemetry's global registry keyed per module instance).

The audit method's extractNpmImports still excludes test files when determining which deps are stale (test-only deps don't drive bumps), but once a bump plan exists, apply-bump replaces all occurrences of the stale version string regardless of whether the file is a test.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.07.26.3

Fixed: Every method failed immediately on 2026.07.26.2. Three independent mismatches against the model execution context, each of which aborted the run before it produced data:

1. context.log does not exist. The runtime supplies logger, a LogTape logger with info/warn methods — not a log(level, message) function. Every method called context.log(...) and died with context.log is not a function. All 14 call sites now use context.logger.info(...) / context.logger.warn(...), matching the convention already used across the other @webframp extensions.

2. latest is a reserved data name. All four resource writes used it, so even after logging was fixed the audit failed with Data name 'latest' is reserved for internal use. Resources are now written as current-audit, current-plan, current-apply, and current-quality.

3. readResource was called with the wrong arity. The runtime signatures differ: writeResource(specName, name, data) takes both a spec and a data name, while readResource(instanceName, version?) takes only the data name. Passing (specName, name) meant the spec name was used as the instance name and the data name landed in the version slot, so the lookup missed and plan-bump reported No audit data found immediately after a successful audit. apply-bump failed the same way reading the plan.

4. A dry-run apply was indistinguishable from a real one. filesModified and the extension count incremented on every planned change regardless of dry_run, and ApplyResultSchema had no field recording which mode produced the record. A dry run across 35 stale extensions reported extensionsBumped: 35, filesModified: 179 — the exact shape a real apply writes — so nothing reading current-apply could tell whether the files existed on disk. Both counters are now gated on the write actually happening, and the same dry run reports extensionsBumped: 0, filesModified: 0. extensionsBumped also no longer counts entries that threw mid-write; a deno.lock regeneration failure still counts as bumped, because the files were written and only the lock is stale.

Added: dryRun and filesMatched on ApplyResultSchema. filesMatched counts files where the target string was present, so a dry run still reports scope (filesMatched: 179) while being honest that nothing was written.

Changed: Resource data names. Anything referencing this model's output must be updated:

Retrieval becomes swamp data get ext-maint current-audit. CEL references become data.latest("ext-maint", "current-audit"). Distinct names also make the four resources addressable — under the old scheme all four shared one data name and could not be told apart by a workflow expression.

Added: A @webframp/extension-maintenance-sweep workflow shipping with the extension. It chains the full maintenance loop as one command:

swamp workflow run @webframp/extension-maintenance-sweep

Five sequential steps — audit, plan, approve, apply, verify — with a manual_approval gate between the plan and any file write. Inspect the plan while the run is suspended, then approve and resume:

swamp data get ext-maint current-plan --json
swamp workflow approve @webframp/extension-maintenance-sweep approve
swamp workflow resume @webframp/extension-maintenance-sweep

Every step targets one model instance and therefore runs strictly sequentially — parallelising them would contend on the per-model lock. The workflow expects an instance named ext-maint.

Changed: ApplyResultSchema gains required dryRun and filesMatched fields, and extensionsBumped / filesModified now count only work that actually happened. Consumers parsing current-apply with a strict schema must add both new fields.

Upgrade note: Requires an @webframp/extension-maintenance/maintainer instance named ext-maint for the bundled workflow to resolve. Existing latest data from prior runs is not migrated; the first audit after upgrading writes current-audit and any older latest data can be deleted.

Known limitation: audit is documented as pure observation but is not. getQualityScore() invokes swamp extension quality with cwd set to each extension directory, and each of those invocations writes to that directory's .swamp.yaml repo marker and can create a missing deno.lock. Running the audit against a repo of N extensions therefore touches N repo markers. Not addressed in this release.

2026.07.26.2

Added: Three new observations in the audit method:

1. Lockfile-sync validation. For each extension with both a deno.json and a deno.lock, the audit now checks whether the lock resolves every pin in deno.json. If not, the extension is flagged as lockDrifted: true, with the specific stale entries listed. This catches the exact state that caused the lockfile-consistency cleanup in #278: a deno.json pin changes, nobody runs deno install, and the lock silently drifts.

2. Direct-specifier detection. Finds .ts source files that import a versioned jsr: or npm: specifier directly instead of using the deno.json import map alias. These bypass any pin change made to deno.json, which is how datastore/azure-blob and datastore/dynamodb kept re-introducing the old swamp-testing version in their locks even after the pin was updated.

3. Audit summary categories now include lockDrifted (extensions with deno.lock out of sync) and directSpecifiers (extensions with imports bypassing the import map).

Changed: plan-bump now reports a skipped array alongside entries. Each entry names the extension, its directory, and the reason it was excluded. Before this, "stale but test-only, correctly skipped" was indistinguishable from "nothing stale" in the plan output.

Changed: apply-bump now runs deno install in each affected extension directory after writing pin changes. Without this, apply-bump creates the exact lockfile-drift state that the new audit check is designed to catch.

Upgrade note: The audit resource schema has new required fields (lockfileSync, directSpecifiers, lockDrifted per extension, and lockDrifted/directSpecifiers in the categories object). The plan resource schema now requires a skipped array. CEL queries against older audit or plan data will need to account for missing fields.

2026.07.25.2

Fixed: Scoped extension names (@webframp/...) in manifest dependency pins are now parsed correctly. Previous regex silently failed on the leading @, causing all manifest deps to be reported as up-to-date.

Fixed: nextCalVer() increments the sequence number when an extension was already bumped today, preventing no-op replacements or version field corruption on same-day re-runs.

Fixed: registry_timeout global argument is now applied to all fetch calls via AbortSignal.timeout(). Previously validated but never used.

Fixed: Test-only stale entries (swamp-testing bump) no longer emit plan entries or overwrite existing RELEASE_NOTES.md with empty content.

Fixed: Manifest version replacement uses the full version: "X.Y.Z.N" field string instead of the bare version, preventing accidental substitution in manifest description blocks.

Changed: Unversioned npm imports (e.g. npm:zod without a pinned version) are now logged as warnings during audit instead of being silently skipped.

Changed: apply-bump dry-run mode now reads files and counts matches, producing accurate filesModified counts that match what a real run would do.