Tonight's session involved auditing and fixing a homelab's Docker Compose stacks (via @swamp/ssh's exec/script methods, shelling out to raw docker/docker compose commands — there wasn't a purpose-built compose model type in play). Before applying compose changes to already-running, production-ish containers, I wanted to see the actual plan (create/recreate/ no-op) against live state, not just validate YAML syntax.

docker compose config --quiet only validates the file — it doesn't tell you what would actually happen. docker compose up --dry-run does: it showed, for example, that removing unrelated stale service blocks from one compose file would cause an unrelated, unchanged service to be marked for recreation next time (a config-hash side effect), and that a previously plain docker run-started container would need to be created fresh (name conflict) rather than adopted. Neither of those was visible from config validation alone, and I only found --dry-run because the human using swamp already knew about the flag and suggested it — swamp itself didn't surface or encourage it anywhere in the exec/script workflow.

Proposed solution

For docker-related model types (e.g. @adam/cfgmgmt's docker_container/ docker_image, which already follow a check/apply pattern) and generally for any workflow that shells out to tools with native plan/dry-run support (docker compose, terraform, etc. — via @swamp/ssh exec/script or a future docker-compose-specific extension), it'd help to have a first-class, discoverable way to preview the actual change plan before applying:

For typed model types with a check/apply split: consider whether check already surfaces this, or whether a distinct plan-style method/flag makes sense for compose-shaped resources specifically (since compose's own dry-run reasons about the whole project file, not a single resource).
For the generic @swamp/ssh exec/script path: maybe just a doc/skill callout (e.g. in the swamp skill's guidance) suggesting dry-run flags for common tools (docker compose, terraform plan, etc.) before mutating calls, so agents/users reach for it by default rather than by luck.

Alternatives considered

Just rely on users/agents knowing about each tool's own --dry-run flag (status quo) — works, but it's easy to miss, as this session shows.
A dedicated @swamp/* docker-compose model type with its own plan/apply methods, mirroring @swamp/ssh's fleet pattern — bigger lift, but would make this a native, typed capability rather than raw shell exec.

Context

Not a specific bug — a workflow/DX idea from real usage. Filing per a homelab user's request to raise it for the swamp team to evaluate.

02Bog Flow

Open

7/22/2026, 12:21:28 PM

No activity in this phase yet.

03Sludge Pulse

Website extension search ignores API relevance — exact name match "good-planning" ranks #10 (API ranks it #1)

Extension/type search at method granularity — find capabilities, not just packages

data query and data get return the same payload under different keys

forEach leaves self.* unresolved in target

It is possible for a member to be a member of a collective twice

swamp-club: score-reads tierTotals GET overflows URL with inline param_ownerIds (Invalid URL, mislabeled clickhouse-network-error) for large collectives

apps sync/lookup fail with 'partial() cannot be used on object schemas containing refinements'

Docker-related model types/workflows would benefit from first-class dry-run/plan support

open method fails for password-auth hosts: SSHPASS env set but ssh call never wrapped in sshpass

Hide enterprise (SSO) operatives from announcements and leaderboard by default

Worker queries need a safe connected-worker filter for fleet fan-out

Published extension scores dependency-trust as "missing" (0/2) while client `extension quality` earns it (2/2); no verdict exposed

Add a :micdrop: emoji / reaction shortcode (swamp-native art included)

Docs: update autoGc documentation to reflect write-time version pruning

namespace unset --migrate silently deletes artifact history via catalog-rebuild GC (~484k files lost)

serve: workflow.approvals and workflow.run.search still full-scan the workflow-run store after the #1284 data.query pushdown

Bugs filed by a team-subscription user are not tagged "team" in the Lab

Bundled extension model cannot deserialize AWS SDK S3 XML that works in direct Deno

gcp/sheets spreadsheets-values: batch_get crashes with "Request with GET/HEAD method cannot have body"

Token creation API and UI scope selector for collective tokens (phase 4 of #960)

Make Cloudflare CRUD methods factory-aware so list-discovered resources can be managed in-place

[sc] quest-grant Mongo ops (recentHeartbeat/signalCounts/countIssueShipped) regressed to ~5s timeouts — missing index

Add @swamp/kubernetes/statefulset model type

Sync guard skips bound namespace directory during push — 0 files pushed after namespace migrate

Flaky #1052 preparePush test: mtime-granularity race on Linux tmpfs

command/shell renders JSON-object stdout lines as the literal string 'undefined'

Issue redactor treats the MongoDB authSource parameter as a secret, corrupting reproduction steps

Docs: document repo root resolution from subdirectories

Expose the swamp.club feed as an RSS feed

Email invitation is not linked to account created from invite URL

Add serve, datastore, vault, and worker wildcard scopes to token registry (phase 4 prep, #960)

datastore setup extension drops 'namespace' from --config, making extensions that require it impossible to configure

Docs: update manual to document --yes/-y as the standard confirmation-skip flag

Docs: update data.query and CEL expressions references for SQL pushdown

Docs: document collective token CLI usage in API key authentication pages

Add a --release-notes option to `swamp update` (or even make it the default)

Docs: manual should state workflow unknown keys are rejected and placement is step-only (follow-up to #1240)

Make GCP CRUD methods factory-aware so list-discovered resources can be managed in-place

serve: read ops (data.query, workflow.approvals, workflow run.search) linearly scan the whole datastore — ~350–600ms floor regardless of match count

Running "swamp workflow run ..." in a subdir of the swamp repo fails

Guide agents to inspect reports after failed model and workflow runs

serve: main JS thread holds ~40–70% of a core while idle (no clients, no runs, --no-schedule)

Search box collapses to near-zero width on mobile on the Extensions page

Extensions page: Search bar missing on mobile

spreadsheets-values: every method fails with 'Missing required path parameter: spreadsheetId' — implementation reads a global argument the schema does not declare

namespace migrate/set workflow broken for extension datastores: migrate skipped by sync guard, set not idempotent, migrate-index empties shards

ExtensionInfo.latestVersion typed 'string' but registry returns null; harden pull/resolve for prerelease-only extensions

workflow.run: relay a custom model method's output as method_output (command steps already do)

promptChoice infinite-loops on non-interactive stdin

gcp _lib: unconditional x-goog-user-project header causes USER_PROJECT_DENIED (403) for service accounts without the serviceUsageConsumer role

extension push: issue-verdict review is indistinguishable from missing/stale

swamp extension version crashes with 'Invalid CalVer version: "null"' when only a prerelease (beta/rc) version is published

Pushing an extension after creating a public git repo that is the same as other previously pushed extensions doesn't update the "Verified public repository"

`datastore setup filesystem` never transfers content when leaving a sync-based (remote) datastore — copies only the catalog and hardcodes `filesPulled: 0`

Scaleway models: create methods should not require the resource ID they generate (ipId/gatewayId/serverId/...)

gcp/calendar events.list reads wrong array field ('defaultReminders' not 'items') → always returns 0 events

provisioner.provision fails with 'Cannot read properties of undefined (reading trim)' at method_execution_service.ts:852

method_execution_service.ts:852 crashes on undefined.trim() when writeResource receives undefined instance name

CLI support for collective API tokens (phase 3 of #960)

@swamp/gcp/calendar: service-account & ADC auth mint cloud-platform-scoped tokens → 403 on Calendar API

Scope enforcement and whoami introspection for collective tokens (phase 2 of #960)

fix(software-factory): DeclaredSchemaSchema.enum rejects boolean literals

Surface cloud-provider labels (scaleway, digitalocean, oracle/oci) as first-class search/filter facets on the Extensions page

Profile link in genesis subdirectory does not navigate back to main profile

Profile stats: per-user daily rollup table + MV in ClickHouse

Reconcile collective-token CLI activity to members (attribute → bonus → stamp → even-split)

Telemetry stats consumer: unsanitized subcommand in Mongo update path drops user metrics silently

Telemetry stats consumer: insert_id dedup commits before the write it guards — any upsert failure is silently swallowed on retry

Job-level labels: block is silently ignored, not rejected

Issue submission redactor silently corrupts report bodies

CLI telemetry: fold third-level verbs into subcommand + canonicalize aliases

Docs: update extension info reference to document extensions (type grafts) in content metadata

Docs: swamp skill repo-structure reference still documents repo-local .swamp/telemetry/ as live

Add safe adoption and lifecycle methods for existing Hetzner resources

Docs: update manual telemetry reference for user-global spool and telemetry.yaml opt-out

export const extension can graft methods onto foreign-collective types, undisclosed in extension info / contentMetadata

Add lookup support to the Cloudflare DNS records model

Expand token scope registry to full taxonomy (phase 1 addendum, #960)

Docs: document user-global telemetry (telemetry.yaml opt-out, spool location, telemetry stats behavior)

score_daily rollup strands stale grains when a day-less grant re-stamps onto a later day

Grant revoke is never applied to the running server — under `--grant-reload auto` and `manual` alike, a revoked grant stays in force until an explicit `access reload`