audit: register legitimate non-swamp commands as approved bypasses
workflow run: show artifact attributes for runs through serve, and let a run leave out the "Data produced" box
Docs: what serve instances must not share, flat AWS Secrets Manager names, and where OAuth values are stored
Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime
aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region
@swamp/cve http2shell, php-rce-2026-10 and tailworm: scan fails with 'Duplicate data instance name' (log and status share a name)
swamp skill: add a workspace guide and routing-table entry
stagecraft tracker: relate tickets across trackers (another repo's tracker)
serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request
serve OAuth client reuse: remaining review findings from swamp-club#4264
Agents.md: consider not using H1 'Project' inside managed block
serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire
serve: define what swamp serve does when its OAuth client is deleted at swamp-club
Docs: schedule catch-up and missed-fire tracking for scheduled workflows
Work-item commands run from the wrong repo report the work item as not started
Docs: step concurrency caps only that step's forEach iterations, not its whole dependency level
Package everything on ops.swamp-club.com; stop direct server edits
workflow run: let a run skip the "Data produced" box, or make it show what each artifact holds
Shorten swamp serve's token session re-check so revocation takes effect sooner
@swamp/cve/emudhra: Ubuntu's pip vendored certifi reported as exposed although pip uses the OS store
cfgmgmt firewall (ufw): an input for rule position (insert before/after)
@swamp/video: informal demos — join multiple takes into one video, and a full-length background music bed
agent-sessions: lockfile test helper silently depends on the captured @swamp/git key
agent-sessions: low-severity edge cases from the Codex importer reviews (#4158)
Team mode manual pages: swamp-serve and remote-execution for leader/follower, member checkouts, offline work, run control and known limits
Agent session record: four questions from the Codex importer (#4158)
@swamp/video: upload workflow to publish a take to YouTube (video, description, chapters, captions, thumbnail)
@swamp/video/brand: customizable outro card (next steps, headline, per-video CTA)
data prune through serve deletes data of an auto-definition whose declared type is invalid
serve: give the definition index a change signal (file watcher with a sync barrier) so a write to a definitions directory costs O(1), not a stat of every file in it
Warn when a grant with a methods list is a deny: it also refuses requests that name no method
serve reload reports 0 types reloaded when it replaced edited repo-local behaviors
@swamp/video/brand: cap each Chromium stderr line kept for errors
serve resolves realpath for thousands of files under .swamp/outputs/swamp/worker/set_status
Retention or GC for auto-definitions whose runs and data are gone
S3 and GCS: after a real commit by another writer, a serve stays off the pull fast path until it restarts
Licence header check only compares the first line of a file
CI: an accepted attestation approves the PR, and anything else fails the attestation job
artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)
Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history
Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild
Add expiring service-account token requests and authorization checks to RBAC
Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in
verify-build upgrade gate silently skips models whose version is a constant
@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling
agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)
agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)
Swamp Club collective GUI: show the swamp serve instances currently connected to a collective
A malformed --ca-cert file is reported as an unreadable OS certificate store
TLS hint blames a missing root CA and macOS for every invalid peer certificate failure
workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS
S3/GCS repairUnpushedFiles: the pull it asks for after a lost last-synced index does not stop it re-uploading copies a peer deleted
swamp-uat private-registry tests leave npm/<port> dirs in the shared Deno cache
A resume runs settled work after the teardown gated on it has already run, and nothing tears that work down
serve (token mode): --admins accepts idp-group entries that can never match
build-swamp-extension example: code-review isn't given the quality evidence, so the reviewer reports quality as missing
deployment: getLogs method (deployment-aware pod log tailing)
model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)
Skill/docs: document registry listing limits, static-extraction rules, and splitting large APIs by domain
Check registry listing limits in extension quality/push and suggest splitting into per-domain extensions
Over-limit contentMetadata publishes a blank extension page; archive fallback extracts nothing
@swamp/video/hyprland: recording hotkeys, retake marker and phone-mirror window rules
@swamp/video/obs: optional OBS recording with per-person hardware config for @swamp/video
serve daemon enable: add Windows support (service or startup task)
swamp skill docs: publishing.md contradicts itself on dynamic imports, overstates where git dependencies are listed, and never says consumers keep the publisher's bundle
extension push: the dynamic import() refusal tells authors to run swamp extension fmt, and the archive-project-file fix names the kind directory push never filters
extension push: file:, link:, workspace: and git package.json dependencies are left out of the unaudited list when the project also has a deno.json
push (Apple Containers) makes an index whose platform manifest is unpullable on Forgejo
Streak projector: incremental runs instead of a full scan every minute
Registry: detect code from outside npm and JSR in a v2 archive itself, not only from the author's dependency-audit.json
Scorecard: code past the analyzer's read caps, or unreadable, is skipped silently instead of counting as not audited
Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo
access can-i: evaluate a local grants file without --server
Support search and filters as URL query parameters on /extensions
bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load
Five Mongo queues can hand the same row to two replicas
Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in
Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike
serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail
serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail
Rescore every extension's current version under rubric v5
stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)
A long-lived serve client for extensions, and a stable rate_limited error code
Support creating 1Password vaults for new clients
Generated state schemas require every child of nested objects, so normal resources warn on create/get
Add LinkedIn as a login provider
Showcase reward backfill can double-pay 5,000,000 points when replicas start together
Profile showcase read: approved list sorts on review.reviewedAt in memory
Showcase countByStatus: $match live statuses before the $group
Showcase admin queues: index-serve the updatedAt sort on approved/rejected
Annotate and retain past workflow runs and data after the fact
Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding
serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed
stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors
auth token create --json fields key and signinToken are undocumented; no token-mode service setup page
trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so
telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed
Docs: publish typed-secrets Phase 4.6 expression and delivery semantics
Extension registry page: a supported way to include media (images) in the README
Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)
Serve: delegate namespace-scoped extension pulls and reload without granting administrator access
Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches
vary/forEach object values with no key/name/id produce data names Windows refuses
issue-lifecycle start drops issue comments: context.comments is always empty
swamp core: a non-string sensitive value reads back as a JSON string
Generated vault keys carry raw data-name and vary characters that strict vault providers reject
Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)
local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)
Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition
Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support
workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)
issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream
swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)
Workflow run cancellation on concurrency-key conflict
Read non-string sensitive resource fields back with their type
Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds
Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them
A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through
serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other
S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version
extensions_search index is never created if the first attempt fails, until the process restarts
S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files
swamp-uat: the SIGTERM drain test does not check that the run succeeded
stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)
stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)
s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json
stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load
Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability
s3-datastore: model-scoped pullChanged lists and walks the whole namespace
extension safety analyzer does not warn on node:child_process or cluster subprocess spawning
Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)
seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them
serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once
extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)
Decide a stricter naming rule for workflow step and job names
s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards
Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt
Let agent-runner drive more agent CLIs (Kilo Code and others)
Feedback: Swamp as an approval-gated control plane for a small fleet
Tracking: test baseline required before the datastore refactor (commit-log design)
serve: define and supply the collective and owner grant condition variables
No first-class workflow primitive for spawning a permission-scoped agent session
Decorative animations outside the Lab still repaint on the main thread
s3/gcs datastore: pullChanged overwrites dirty, unpushed cache files
Codegen/AWS: create-only required fields block list/get/delete in generated AWS models
End a collective's trial when it begins a paid subscription
s3-datastore: SWAMP_S3_REQUEST_TIMEOUT_MS does not appear to apply to ListObjectsV2 during pull
s3-datastore: S3Lock.acquire overshoots maxWaitMs by up to a full backoff interval
s3-datastore: a model-scoped pull still lists, walks and indexes the whole namespace
Run the web dashboard locally from the CLI without swamp serve
extensions: cold-path catalog rebuild skips sources whose type is not a string literal, dropping them for one process lifetime
serve: rotate the external token-secrets key
Link each swamp-club panel to its manual page with a header DOCS link
managedConfig: extension lockfile writes lose updates, and auto-resolved installs never reach the shared lockfile
Generated @swamp/aws StateSchemas mark conditional and create-only properties as required, producing schema warnings on every read
workflows: a nested workflow step should inherit the caller's placement when the child declares none
Supported vault-write API for extension model methods (per-instance vault target)
serve: after lazy hydration, scoped poller pulls never take the fast path, and the login mint waits behind them on the sync gate
datastore extensions: full pushes re-hash every pulled file on every run because index mtimes never match pulled copies
Extension catalog caches a datastore bundle with an empty type, so the repo fails with Unknown datastore type when addressed by its realpath
Let a method inside serve start a workflow run: context.runWorkflow
s3/gcs datastore: no safe recovery when _meta.json v2 lists a shard missing from the bucket
worker secret allowlist rejects caller-chosen vault references resolved at run time (method args carrying {vaultName, secretKey})
serve: default placement for steps that declare none (so one workflow runs both locally and via workers)
s3-datastore: per-datastore AWS profile, so a serve audit store can use different credentials from the main datastore
s3/gcs-datastore: clean up data left behind by deletes that silently no-opped before the swamp-club#2249 fix
Expose Swamp as a REST/OpenAPI endpoint (for GPT Actions and other REST clients)
Promote CodeBuddy and WorkBuddy from custom-tool configs to first-class Swamp clients
s3-datastore: documented offline behaviour is unreachable — lock acquire fails closed before pull, while a mid-run outage exits 0 with the data stranded
Route log-mode output to stderr by default, with commands opting stdout back in
Billing telemetry: surface scheduled cancellations (cancelAtPeriodEnd) and emit subscription_canceled reliably
A pending platform invite that loses to the recruit lane is never consumed and leaks a pending slot
Recruit links have no web surface — a CLI-less operative cannot get their link
Workload identity (Kubernetes ServiceAccount / OIDC) for worker enrollment
Feed grant projection stamps a site route that does not exist
UAT coverage for workflow history outputs and expanded JSON schema
Serve Audit Log - Phase 6: Full documentation
Per-extension white listing
Retire or rebuild /admin/nurture once the epic lands — it is a gate, and gates are single-use
harness-marketing-funnel posts {batch:[...]} to /ingest, which is not a batch — every run silently measures zero
Epic: Product nurture — lifecycle identification, dedupe-safe delivery, and operator control (email, inbox, CLI)
Add interactive serve setup skill with best-practice guidance
Add intent and scope discovery to extension creation skill
feat(ui/tokens): metadata field or tags for collective API tokens
UAT: workflow resume --from with forEach expression template names
SCIM 2.0 provisioning endpoint for swamp-club (Users + Groups, deprovision)
SSO user profile fields are frozen at first login — overrideUserInfo is never set on any provider
add links to the docs for all account progress teasers
A subscription stuck in incomplete has no path forward: it grants nothing, and the billing page offers no way to finish paying
Identifier lookups are exact-match and case-sensitive across username, email and slug
Invite failures emit no telemetry, so a rejected invitation leaves no trace anywhere
Collective invitations expire after 48h and the auto-claim is gated on that window, so a late signup is never bound
Invite typeahead searches username prefix only, so an operative cannot be found by name or email
Send the release headline from the release pipeline so New Release announcements say what shipped
Support credentials in datastore config (vault-resolvable)
Feature: user-configurable redaction rules (.swamp/redaction.yaml)
Lab lifecycle POST rejects any payload string that starts with a dollar sign, not just operator keys
Finish the swamp_* attribute set on Attio users, and settle the two unprefixed ones (#809 follow-up)
aria-expanded is a raw boolean in 12 places — collapsed state is unannounced to screen readers
swamp CLI: surface the audience and resolvedInVersion fields swamp-club now serves
ApiKeyManager's collapsed trigger points aria-controls at an element it never renders
A boolean aria-expanded renders as no aria-expanded: two disclosure widgets report no state to a screen reader
Tell the inviter when a collective invite mis-lands, instead of leaving it pending forever
CLI has never sent insert_id: retried telemetry batches are double-counted into cli_daily, inflating XP in an append-only ledger
Docs: manual never mentions telemetry, and the serve/scheduling pages imply automated runs are visible when they are not
Explore: reconcile quality rubric's dormant provenance factor
Explore: pull-time signature verification for extensions
Explore: transparency-log integration (Rekor) for extension signatures
Explore: publish-time artifact signing for extensions (cosign keyless)
Docs: document catalog completeness check and --repair in doctor reference
Add --server support to model cancel (server-side run cancellation)
End-to-end UAT for fine-grained collective token scopes (#960)
uat: add namespace isolation and shard resilience test coverage
Extension/type search at method granularity — find capabilities, not just packages
Docker-related model types/workflows would benefit from first-class dry-run/plan support
Issue filing inherits most-recently-created collective's scope and privacy, with no way to choose
CLI telemetry: fold third-level verbs into subcommand + canonicalize aliases
Driving agent can wedge a workflow-stage run irrecoverably (workflow-succeeded vs dispatch limit); skill should prevent it
Data-driven webhook signature verifiers (avoid a code change + release per provider)
Add first-class Kilo Code tool support
@swamp/aws/ec2: auto-generated models lack list, tag, and factory-compatible update methods
@swamp/digitalocean/space-key stores secret in plaintext - should mark as sensitive
Relationships
#1025 Scorecard: beta/rc-only extensions show "not scored" despite successful scoring (GET /score resolves only latestVersion)
Opened by swamp_lord · 7/7/2026· Shipped 7/7/2026
Summary
Extensions whose only published release is on a pre-release channel (beta / rc) display "not scored" on swamp-club.com even though the scorecard pipeline scored the version successfully. The score is computed and persisted, but the public GET /score read short-circuits before it looks the score up.
Root cause
The scorecard read resolves the target version from the stable channel only:
routes/api/v1/extensions/[...path].ts (handleGetScore, ~line 264):
const targetVersion = version ?? ext.latestVersion; // latestVersion is null for a beta-only extension
if (!targetVersion) {
return Response.json({ status: "not_scored" }); // ← returns here, never reads the meta
}For a beta-only extension, ext.latestVersion (stable) is null while ext.latestBeta holds the version, so targetVersion is null and the handler returns bare {"status":"not_scored"} without ever calling extensionVersionMetaRepo.findByExtensionIdAndVersion(...) — even though a scored meta row exists.
This is asymmetric with the rescore path. POST /score (handleScoreExtension, ~line 569) resolves the version via extensionRepo.getLatestNonYankedVersion(existing.id), which does find the beta version. So the owner's "rescore" button enqueues + scores the beta version successfully and writes the meta — but the GET read still refuses to surface it. The result is a frustrating loop: rescore succeeds → refresh → still "not scored".
Reproduction
- Publish an extension with its only release on the beta channel (so the extension record has
latestBetaset andlatestVersion = null). - Wait for background scoring to complete (
watcher.extension-scoring.tick→app.extension-scoring.process.batch; log line"Extension version scored"withrubricVersion: 3). - Load the extension page / call
GET /api/v1/extensions/<name>/score. - Expected: the computed scorecard (
{"available":true, "percentage":…}). - Actual:
{"status":"not_scored"}.
Observed in production (2026-07-07)
Extension @magistr/stripe-mpp@2026.07.03.1:
- Scored successfully 3× today (21:39, 21:40, 21:47) — each logged
Extension version scored,rubricVersion: 3,dependencyTrustPassed: false(2 blockers inmppx),percentageDocumentedSymbols: 1, etc. So the meta row exists. - Extension record:
latestVersion: null,latestBeta: "2026.07.03.1",latestRc: null,score: null. GET /api/v1/extensions/@magistr/stripe-mpp/score→{"status":"not_scored"}(the bare line-266 shape, i.e.targetVersionwas falsy — not the{available:false, reason:…}shape used when a version is known but meta is missing).- Contrast
@webframp/twitch(stable release):latestVersion: "2026.07.03.1"→GET /score→{"available":true, "percentage":100, …}.
Suggested fix
Make GET /score resolve the target version the same way the rescore path does — fall back to getLatestNonYankedVersion() (or consider latestBeta / latestRc) instead of relying solely on ext.latestVersion. Any beta-only or rc-only extension is currently mis-shown as "not scored." Separately, consider whether the UI should distinguish "beta — no stable release yet" from a genuine "not scored" state.
Impact
All extensions whose only release is on a pre-release channel are silently unscored on the site despite scoring succeeding. Worth auditing how many extensions are currently beta/rc-only.
Shipped
Click a lifecycle step above to view its details.
Sign in to post a ripple.