EXTENSIONS

Repository hygiene checks for swamp repos — hardcoded absolute home paths in model/workflow sources, pulled extensions whose source files are missing, generated .swamp artifacts not covered by .gitignore, and workflow wiring drift (scripts missing an exec bit/shebang, declared schedules with no live registration). Writes a combined markdown report plus per-check structured resources.

Generic, portable housekeeping sweep for any checkout. A read-only audit of dirty trees, diverged or deleted branches, forgotten stashes, stale worktrees, flat sibling clones, temp debris, leftover processes, disk pressure, and stuck tracker claims, plus explicitly-gated cleanup methods that dry-run by default. Project-agnostic: projectDir defaults to `.`, with .beads/ and .swamp/ awareness layered on when present.

A deterministic published-surface hygiene gate — a CLASSIFIER, not an LLM eval. It answers "does this artifact contain a forbidden identifier?" with rule-based recognizers (private-range IPv4 full-quad, *.ts.net) plus a fleet-aware DENYLIST (owned hostnames / FQDNs / people, matched case-sensitively on word boundaries) and any custom recognizers an instance adds. The flagship `scan` is a HARD GATE: it walks files/dirs and/or inline text and THROWS on a hit by default, so it can back a publish-workflow step, a git pre-push hook, or a Claude Code PreToolUse hook; pass failOnHit=false for an advisory report. `redact` remaps detected identifiers to the swamp-blessed documentation placeholders (RFC 5737 IPs, RFC 2606 example.com). The denylist is the private part — an instance typically derives it via a CEL view over @stateless/inventory, so it grows with the fleet model and is never hand-maintained; the generic recognizers carry no fleet knowledge, so a community checkout with no denylist still runs them. This is the enforced version of the published-surface-hygiene check swamp-club Lab 508 shipped only as advisory.