A collective invitation sent to an email address is never claimed when the recipient registers via Google OAuth using that same address. The invite stays pending forever on the inviter's side, and the new account has no idea it was ever invited. Nothing errors — it just silently doesn't connect.

Steps to reproduce

Create a collective (in my case quest).
From the collective's page, invite a person by email address — a Gmail address.
The recipient opens the invitation and registers a new swamp-club account via Google / Gmail sign-in, using the same address the invitation was sent to.
Registration succeeds; the account is created and can log in.

Expected

Because the address the account registers with matches the address the invitation was sent to, the pending invitation should be claimed at signup: the invitee joins the collective, and the invitation leaves the pending state.

Actual

Invitee's account page: no mention of the collective that invited them. No membership, no pending-invite prompt, no "you were invited to X — accept?" affordance. From their side the invitation does not exist.
Inviter's collective page: the invitation is still listed as pending, indefinitely.

Neither side sees an error, so there is nothing to act on. The invitee cannot self-serve (they see nothing to accept) and the inviter has no way to force the link.

Notes

The emails match exactly, so this isn't a mismatch case — which suggests the pending-invitation lookup doesn't run on the OAuth/Google registration path, or runs before the account's email is populated from the OAuth profile. An email/password signup path may reconcile correctly; I only exercised the Google one, so I can't say whether this is OAuth-specific or affects all signups.

Worth checking whether the invite is keyed to something other than the email (an invite token consumed only by a specific route), and whether the Google path drops the invite context across the OAuth redirect.

Impact

Beyond collectives being unjoinable via the invite flow, this blocks the recruit_first quest challenge ("invite someone who accepts", 1000 XP) — the invite can never reach accepted state, so the challenge cannot complete.

That challenge is load-bearing for the genesis campaign. Summing every other challenge in the pass, including both lab challenges, reaches 6400 XP against the 7000 needed for the T15 GENESIS capstone — 600 short. The heartbeat drip entries (+5 model method run, +5 workflow run) do not contribute to passXp; on my account passXp equals the sum of completed challenges exactly, across hundreds of drip events. So recruit_first is the only remaining path to the capstone, and while this bug stands, the capstone is unreachable for anyone whose invitee registers with Google.

02Bog Flow

Shipped

7/17/2026, 2:07:43 AM

Click a lifecycle step above to view its details.

03Sludge Pulse

keeb assigned keeb7/17/2026, 12:33:28 AM

magistr commented 7/16/2026, 8:55:25 PM

Filed #1187 for the adjacent, separable half of this: /orgs renders no pending-invitation state for the invitee at all — no list, banner, or accept affordance.

Keeping them apart deliberately. This issue is the reconciliation bug on the Google signup path (invite not claimed despite a matching address). #1187 is the absence of an invitee-facing surface, which survives a fix here: if invitations require explicit acceptance, then even with the invite correctly linked and correctly pending, there is still no page on which to accept it.

Together they close the loop — an invitation currently cannot be completed by any route.

magistr commented 7/16/2026, 9:01:55 PM

Correction to my own Impact section above — it is wrong, and I would rather flag it than have it mislead triage.

I claimed this blocks the recruit_first quest challenge and makes the T15 capstone unreachable. It does not. recruit_first has since completed on my account and awarded its 1000 XP from this very invite, so that paragraph should be disregarded.

The referral credit and the collective membership appear to be separate mechanisms: the signup was credited as a referral, while the collective invite itself is still pending and the membership never formed. So the defect reported at the top stands unchanged — an invite sent to an address, whose recipient registers via Google with that same address, is never claimed — it simply does not have the quest consequence I attributed to it.

Everything else in the report is as observed. Apologies for the noise.

keeb commented 7/17/2026, 2:08:05 AM

Thanks @magistr for reporting this! The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

Bundled extension model cannot deserialize AWS SDK S3 XML that works in direct Deno

gcp/sheets spreadsheets-values: batch_get crashes with "Request with GET/HEAD method cannot have body"

Token creation API and UI scope selector for collective tokens (phase 4 of #960)

Make Cloudflare CRUD methods factory-aware so list-discovered resources can be managed in-place

[sc] quest-grant Mongo ops (recentHeartbeat/signalCounts/countIssueShipped) regressed to ~5s timeouts — missing index

Add @swamp/kubernetes/statefulset model type

serve: workflow.approvals and workflow.run.search still full-scan the workflow-run store after the #1284 data.query pushdown

Sync guard skips bound namespace directory during push — 0 files pushed after namespace migrate

Flaky #1052 preparePush test: mtime-granularity race on Linux tmpfs

command/shell renders JSON-object stdout lines as the literal string 'undefined'

Issue redactor treats the MongoDB authSource parameter as a secret, corrupting reproduction steps

namespace unset --migrate silently deletes artifact history via catalog-rebuild GC (~484k files lost)

Docs: document repo root resolution from subdirectories

Expose the swamp.club feed as an RSS feed

Email invitation is not linked to account created from invite URL

Add serve, datastore, vault, and worker wildcard scopes to token registry (phase 4 prep, #960)

datastore setup extension drops 'namespace' from --config, making extensions that require it impossible to configure

Docs: update manual to document --yes/-y as the standard confirmation-skip flag

Docs: update data.query and CEL expressions references for SQL pushdown

Docs: document collective token CLI usage in API key authentication pages

Add a --release-notes option to `swamp update` (or even make it the default)

Docs: manual should state workflow unknown keys are rejected and placement is step-only (follow-up to #1240)

Make GCP CRUD methods factory-aware so list-discovered resources can be managed in-place

serve: read ops (data.query, workflow.approvals, workflow run.search) linearly scan the whole datastore — ~350–600ms floor regardless of match count

Running "swamp workflow run ..." in a subdir of the swamp repo fails

Guide agents to inspect reports after failed model and workflow runs

serve: main JS thread holds ~40–70% of a core while idle (no clients, no runs, --no-schedule)

Search box collapses to near-zero width on mobile on the Extensions page

Extensions page: Search bar missing on mobile

spreadsheets-values: every method fails with 'Missing required path parameter: spreadsheetId' — implementation reads a global argument the schema does not declare

namespace migrate/set workflow broken for extension datastores: migrate skipped by sync guard, set not idempotent, migrate-index empties shards

ExtensionInfo.latestVersion typed 'string' but registry returns null; harden pull/resolve for prerelease-only extensions

workflow.run: relay a custom model method's output as method_output (command steps already do)

promptChoice infinite-loops on non-interactive stdin

gcp _lib: unconditional x-goog-user-project header causes USER_PROJECT_DENIED (403) for service accounts without the serviceUsageConsumer role

extension push: issue-verdict review is indistinguishable from missing/stale

swamp extension version crashes with 'Invalid CalVer version: "null"' when only a prerelease (beta/rc) version is published

Pushing an extension after creating a public git repo that is the same as other previously pushed extensions doesn't update the "Verified public repository"

`datastore setup filesystem` never transfers content when leaving a sync-based (remote) datastore — copies only the catalog and hardcodes `filesPulled: 0`

Scaleway models: create methods should not require the resource ID they generate (ipId/gatewayId/serverId/...)

gcp/calendar events.list reads wrong array field ('defaultReminders' not 'items') → always returns 0 events

provisioner.provision fails with 'Cannot read properties of undefined (reading trim)' at method_execution_service.ts:852

method_execution_service.ts:852 crashes on undefined.trim() when writeResource receives undefined instance name

CLI support for collective API tokens (phase 3 of #960)

@swamp/gcp/calendar: service-account & ADC auth mint cloud-platform-scoped tokens → 403 on Calendar API

Scope enforcement and whoami introspection for collective tokens (phase 2 of #960)

fix(software-factory): DeclaredSchemaSchema.enum rejects boolean literals

Surface cloud-provider labels (scaleway, digitalocean, oracle/oci) as first-class search/filter facets on the Extensions page

Profile link in genesis subdirectory does not navigate back to main profile

Profile stats: per-user daily rollup table + MV in ClickHouse

Reconcile collective-token CLI activity to members (attribute → bonus → stamp → even-split)

Telemetry stats consumer: unsanitized subcommand in Mongo update path drops user metrics silently

Telemetry stats consumer: insert_id dedup commits before the write it guards — any upsert failure is silently swallowed on retry

Job-level labels: block is silently ignored, not rejected

Issue submission redactor silently corrupts report bodies

CLI telemetry: fold third-level verbs into subcommand + canonicalize aliases

Docs: update extension info reference to document extensions (type grafts) in content metadata

Docs: swamp skill repo-structure reference still documents repo-local .swamp/telemetry/ as live

Add safe adoption and lifecycle methods for existing Hetzner resources

Docs: update manual telemetry reference for user-global spool and telemetry.yaml opt-out

export const extension can graft methods onto foreign-collective types, undisclosed in extension info / contentMetadata

Add lookup support to the Cloudflare DNS records model

Expand token scope registry to full taxonomy (phase 1 addendum, #960)

Docs: document user-global telemetry (telemetry.yaml opt-out, spool location, telemetry stats behavior)

score_daily rollup strands stale grains when a day-less grant re-stamps onto a later day

swamp-club: global rate limiter runs pre-auth and collapses all direct clients into one per-IP bucket — 429s authenticated CLI traffic

Collective API token scopes: domain, persistence, and auth threading (phase 1 of #960)

Telemetry migration from ~/.swamp/telemetry should auto-detect home-as-repo

feed_post_score_events queue grows unboundedly (no TTL, no delete-on-delivery)

Issue-filing skill should require ownership classification before submitting a bug

Interactive finder silently drops the preview pane on narrower terminals, and layout selection is unstable

@-mention autocomplete for users when writing lab ripples

Remove comments from /feed and redesign the page

Interactive finder preview corrupts: overlapping/stale lines when preview content overflows the pane

Score-refresh consumer: harden coalescing against a diverse backlog (bistability)

Remove feed comments — consolidate discussion in Discord

Add a 'my collective extensions' filter to extensions page

Relax the profanity filter

Extension search returns edit-distance noise for short queries ("asdl" → "AWS DEADLINE")

Telemetry recoverOrphaned startup race with multiple replicas (created_at-based)

Grant revoke is never applied to the running server — under `--grant-reload auto` and `manual` alike, a revoked grant stays in force until an explicit `access reload`