Lab - Swamp Club

serve: idle peer data.query remains stale when a remote datastore honors selective pulls

serve data.get cannot resolve models stored in managed configuration

serve model.edit does not publish managed configuration changes to the shared datastore

swamp serve daemon (user service) doesn't handle systemd 'lingering' — claims it 'starts automatically' but only runs while logged in

deprecated extensions are more prominent than I expected :)

Trigger schedule overrides require a swamp serve restart to take effect

Serve Audit Log - Phase 6: Full documentation

aws-sm vault: support profile config key to select named AWS credential profiles

docs: data.latest second argument matches name OR spec, not just spec

Per-extension white listing

agent-runner: allow using the Claude CLI's stored login instead of requiring an API key

Add put_events method to event-bus type

Block temporary email services on signup

docs(cli): document run GC retention configuration

Document configured method arguments in model get JSON

Document env.* namespace for model-instance globalArguments (host-portable config)

Retire or rebuild /admin/nurture once the epic lands — it is a gate, and gates are single-use

harness-marketing-funnel posts {batch:[...]} to /ingest, which is not a batch — every run silently measures zero

feat(cli): swamp inbox — read swamp-club notifications without leaving the terminal

feat(cli): tell operatives they have swamp-club notifications waiting

feat(api): a cheap unread-notification count for API-key clients

feat(nurture): deliver to the swamp-club inbox on the same dedupe decision as email

Epic: Product nurture — lifecycle identification, dedupe-safe delivery, and operator control (email, inbox, CLI)

AI-Friendly CLI Manual Dump

Add interactive serve setup skill with best-practice guidance

Add intent and scope discovery to extension creation skill

Docs: add Windows install instructions to install-swamp how-to guide

Durable, detached workflow execution (DBOS evaluated as the engine)

Software factory ignores earlier approvals with multiple cycle overrides

Correlate workflow gates with recorded run IDs

Add safe per-work-item workspace preparation

feat(ui/tokens): metadata field or tags for collective API tokens

UAT: workflow resume --from with forEach expression template names

SCIM 2.0 provisioning endpoint for swamp-club (Users + Groups, deprovision)

SSO user profile fields are frozen at first login — overrideUserInfo is never set on any provider

add links to the docs for all account progress teasers

A subscription stuck in incomplete has no path forward: it grants nothing, and the billing page offers no way to finish paying

Identifier lookups are exact-match and case-sensitive across username, email and slug

Invite failures emit no telemetry, so a rejected invitation leaves no trace anywhere

Collective invitations expire after 48h and the auto-claim is gated on that window, so a late signup is never bound

Invite typeahead searches username prefix only, so an operative cannot be found by name or email

Send the release headline from the release pipeline so New Release announcements say what shipped

software-factory: rename gates[].pass to gates[].satisfied - collides with a transition named 'pass'

cycle-override grants are deduplicated, so 'one grant = one entry' fails from the second grant on

Add SWAMP_CLI_OUTPUT env var to control default output mode (plaintext/tui/json)

knowledge-base retrieve persists query output into the state resource, with lifetime infinite and the query text in the instance name

"TRIAL ENDED" modal shown to team plan user when toggling extension visibility

Redaction regex boundary bug: label_base64 secrets with an unrecognized label pass through unredacted (e.g. swamp_ API keys)

User token page (/u/<user>) shows only "swamp_..." for every API key, making leaked-key identification impossible

Support credentials in datastore config (vault-resolvable)

workflow-succeeded selects the globally-latest run, so siblings block each other under parallel use

Feature: user-configurable redaction rules (.swamp/redaction.yaml)

Lab lifecycle POST rejects any payload string that starts with a dollar sign, not just operator keys

Finish the swamp_* attribute set on Attio users, and settle the two unprefixed ones (#809 follow-up)

aria-expanded is a raw boolean in 12 places — collapsed state is unannounced to screen readers

swamp CLI: surface the audience and resolvedInVersion fields swamp-club now serves

ApiKeyManager's collapsed trigger points aria-controls at an element it never renders

A boolean aria-expanded renders as no aria-expanded: two disclosure widgets report no state to a screen reader

Tell the inviter when a collective invite mis-lands, instead of leaving it pending forever

CLI has never sent insert_id: retried telemetry batches are double-counted into cli_daily, inflating XP in an append-only ledger

Docs: manual never mentions telemetry, and the serve/scheduling pages imply automated runs are visible when they are not

Explore: reconcile quality rubric's dormant provenance factor

Explore: pull-time signature verification for extensions

Explore: transparency-log integration (Rekor) for extension signatures

Explore: publish-time artifact signing for extensions (cosign keyless)

Docs: document catalog completeness check and --repair in doctor reference

swamp command doesn't check cwd

Reusable long-lived invite link: one URL to bring people into the swamp

Use whoami entitlement to explain private-extension push refusals

Add --server support to model cancel (server-side run cancellation)

Harden queue claim semantics: atomic claims + status-guarded markDelivered/markFailed across app queues

CLI: swamp invite <email> to drive the platform-invite API

End-to-end UAT for fine-grained collective token scopes (#960)

uat: add namespace isolation and shard resilience test coverage

Extension/type search at method granularity — find capabilities, not just packages

Docker-related model types/workflows would benefit from first-class dry-run/plan support

Issue filing inherits most-recently-created collective's scope and privacy, with no way to choose

fix(software-factory): DeclaredSchemaSchema.enum rejects boolean literals

CLI telemetry: fold third-level verbs into subcommand + canonicalize aliases

Driving agent can wedge a workflow-stage run irrecoverably (workflow-succeeded vs dispatch limit); skill should prevent it

Data-driven webhook signature verifiers (avoid a code change + release per provider)

Drag Windows into the Swamp

@swamp/aws/ec2: auto-generated models lack list, tag, and factory-compatible update methods

@swamp/digitalocean/space-key stores secret in plaintext - should mark as sensitive