Docs: extension quality now reports repository-verified for private source hosting (swamp-club#3406)
Concurrent run writers leave finished runs stuck as running in the run index: repairIndex returns early once counts agree, so lost updates are never healed (regression from #3105)
Dashboard: an idle, visible tab keeps counting runs that have aged out of a preset time range
Extension push: a range dependency is sent to OSV as the range, not a version
Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)
Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them
A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects
literal() output in a step's inputs logs repeated Refusing to evaluate expression warnings
A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through
serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other
Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root
Registry scorecard: dependency licenses follow the CLI's SPDX rules
extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)
@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes
bundle freshness ignores local modules outside the kind directory
extension pull: shared sources at the archive root are not installed
extension pull: safety analysis scans the bundle the extension runs
Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it
verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps
S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version
codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import
S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version
extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)
Registry scorecard: audit the dependency version that ships, and JSR dependencies
extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)
swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file
extensions_search index is never created if the first attempt fails, until the process restarts
Rescore scores the newest version, but the scorecard reads the stable one
extension pull: answering y to a dependency's overwrite prompt silently skips that dependency
extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial
S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files
swamp-uat: the SIGTERM drain test does not check that the run succeeded
stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)
stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)
s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json
swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models
vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"
stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load
Show wait keys and pending signals to remote clients and the dashboard
Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability
@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read
s3-datastore: model-scoped pullChanged lists and walks the whole namespace
Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit
extension safety analyzer does not warn on node:child_process or cluster subprocess spawning
extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored
Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)
seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them
serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once
extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)
Decide a stricter naming rule for workflow step and job names
digitalocean codegen leaves an orphaned security_secret.ts model file after its endpoint left the spec
s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards
Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt
Let agent-runner drive more agent CLIs (Kilo Code and others)
s3-datastore: every fast-path miss re-downloads every _index shard, so a busy serve pulls the whole index every poll (~230 GB/day S3 egress)
Feedback: Swamp as an approval-gated control plane for a small fleet
S3/GCS datastore: a push that fails after uploading drops its recorded deletes, so the retry brings deleted data back
Tracking: test baseline required before the datastore refactor (commit-log design)
serve: define and supply the collective and owner grant condition variables
No first-class workflow primitive for spawning a permission-scoped agent session
Decorative animations outside the Lab still repaint on the main thread
s3/gcs datastore: pullChanged overwrites dirty, unpushed cache files
Codegen/AWS: create-only required fields block list/get/delete in generated AWS models
End a collective's trial when it begins a paid subscription
A collective that cancels inside its 30-day trial window regains trial access to private extensions
s3-datastore: SWAMP_S3_REQUEST_TIMEOUT_MS does not appear to apply to ListObjectsV2 during pull
s3-datastore: S3Lock.acquire overshoots maxWaitMs by up to a full backoff interval
s3-datastore: a model-scoped pull still lists, walks and indexes the whole namespace
Run the web dashboard locally from the CLI without swamp serve
verify-reviews: adversarial review path guard is a hand-kept list, so new extensions silently skip it
issue-lifecycle skill: prepare-to-ship documents a fast_forward method that does not exist
S3 datastore rejects valid cache paths as traversal on Windows
swamp-club: unknown collective API token returns 422 instead of the documented 404
extensions: cold-path catalog rebuild skips sources whose type is not a string literal, dropping them for one process lifetime
serve: rotate the external token-secrets key
@swamp/aws/certificatemanager/certificate: expose ACM's reported attributes (NotAfter, Type, RenewalEligibility, InUseBy) on read
Link each swamp-club panel to its manual page with a header DOCS link
managedConfig: extension lockfile writes lose updates, and auto-resolved installs never reach the shared lockfile
Generated @swamp/aws StateSchemas mark conditional and create-only properties as required, producing schema warnings on every read
workflows: a nested workflow step should inherit the caller's placement when the child declares none
Supported vault-write API for extension model methods (per-instance vault target)
datastore sync: repositories mark paths dirty before writing, so a concurrent ungated push can drop the write
serve: after lazy hydration, scoped poller pulls never take the fast path, and the login mint waits behind them on the sync gate
datastore extensions: full pushes re-hash every pulled file on every run because index mtimes never match pulled copies
Extension catalog caches a datastore bundle with an empty type, so the repo fails with Unknown datastore type when addressed by its realpath
Let a method inside serve start a workflow run: context.runWorkflow
s3/gcs datastore: no safe recovery when _meta.json v2 lists a shard missing from the bucket
worker secret allowlist rejects caller-chosen vault references resolved at run time (method args carrying {vaultName, secretKey})
serve: default placement for steps that declare none (so one workflow runs both locally and via workers)
s3-datastore: per-datastore AWS profile, so a serve audit store can use different credentials from the main datastore
gcs-datastore: a failed lock read is reported as "unlocked" — #2298 in the GCS backend
s3/gcs-datastore: clean up data left behind by deletes that silently no-opped before the swamp-club#2249 fix
Expose Swamp as a REST/OpenAPI endpoint (for GPT Actions and other REST clients)
Promote CodeBuddy and WorkBuddy from custom-tool configs to first-class Swamp clients
s3-datastore: documented offline behaviour is unreachable — lock acquire fails closed before pull, while a mid-run outage exits 0 with the data stranded
Route log-mode output to stderr by default, with commands opting stdout back in
Billing telemetry: surface scheduled cancellations (cancelAtPeriodEnd) and emit subscription_canceled reliably
Swamp Club fresh-database startup aborts migrations on missing deviceCode and concurrent replica markers
A pending platform invite that loses to the recruit lane is never consumed and leaks a pending slot
Recruit links have no web surface — a CLI-less operative cannot get their link
Workload identity (Kubernetes ServiceAccount / OIDC) for worker enrollment
Feed grant projection stamps a site route that does not exist
UAT coverage for workflow history outputs and expanded JSON schema
Serve Audit Log - Phase 6: Full documentation
Per-extension white listing
Block temporary email services on signup
Retire or rebuild /admin/nurture once the epic lands — it is a gate, and gates are single-use
harness-marketing-funnel posts {batch:[...]} to /ingest, which is not a batch — every run silently measures zero
feat(cli): swamp inbox — read swamp-club notifications without leaving the terminal
feat(cli): tell operatives they have swamp-club notifications waiting
feat(api): a cheap unread-notification count for API-key clients
feat(nurture): deliver to the swamp-club inbox on the same dedupe decision as email
Epic: Product nurture — lifecycle identification, dedupe-safe delivery, and operator control (email, inbox, CLI)
Add interactive serve setup skill with best-practice guidance
Add intent and scope discovery to extension creation skill
feat(ui/tokens): metadata field or tags for collective API tokens
UAT: workflow resume --from with forEach expression template names
SCIM 2.0 provisioning endpoint for swamp-club (Users + Groups, deprovision)
SSO user profile fields are frozen at first login — overrideUserInfo is never set on any provider
add links to the docs for all account progress teasers
A subscription stuck in incomplete has no path forward: it grants nothing, and the billing page offers no way to finish paying
Identifier lookups are exact-match and case-sensitive across username, email and slug
Invite failures emit no telemetry, so a rejected invitation leaves no trace anywhere
Collective invitations expire after 48h and the auto-claim is gated on that window, so a late signup is never bound
Invite typeahead searches username prefix only, so an operative cannot be found by name or email
Send the release headline from the release pipeline so New Release announcements say what shipped
Support credentials in datastore config (vault-resolvable)
Feature: user-configurable redaction rules (.swamp/redaction.yaml)
Lab lifecycle POST rejects any payload string that starts with a dollar sign, not just operator keys
Finish the swamp_* attribute set on Attio users, and settle the two unprefixed ones (#809 follow-up)
aria-expanded is a raw boolean in 12 places — collapsed state is unannounced to screen readers
swamp CLI: surface the audience and resolvedInVersion fields swamp-club now serves
ApiKeyManager's collapsed trigger points aria-controls at an element it never renders
A boolean aria-expanded renders as no aria-expanded: two disclosure widgets report no state to a screen reader
Tell the inviter when a collective invite mis-lands, instead of leaving it pending forever
CLI has never sent insert_id: retried telemetry batches are double-counted into cli_daily, inflating XP in an append-only ledger
Docs: manual never mentions telemetry, and the serve/scheduling pages imply automated runs are visible when they are not
Explore: reconcile quality rubric's dormant provenance factor
Explore: pull-time signature verification for extensions
Explore: transparency-log integration (Rekor) for extension signatures
Explore: publish-time artifact signing for extensions (cosign keyless)
Docs: document catalog completeness check and --repair in doctor reference
Add --server support to model cancel (server-side run cancellation)
End-to-end UAT for fine-grained collective token scopes (#960)
uat: add namespace isolation and shard resilience test coverage
Extension/type search at method granularity — find capabilities, not just packages
Docker-related model types/workflows would benefit from first-class dry-run/plan support
Issue filing inherits most-recently-created collective's scope and privacy, with no way to choose
CLI telemetry: fold third-level verbs into subcommand + canonicalize aliases
Data-driven webhook signature verifiers (avoid a code change + release per provider)
Add first-class Kilo Code tool support
Drag Windows into the Swamp
@swamp/aws/ec2: auto-generated models lack list, tag, and factory-compatible update methods
@swamp/digitalocean/space-key stores secret in plaintext - should mark as sensitive
Relationships
#1631 Failing on claude validate
Opened by brucejo75 · 8/12/2026
This popped out of my agent: claude plugin validate is unavailable because claude is not on PATH;
I am running ---tool copilot
This was the offending line in AGENTS.md:
Install commands are copied verbatim from .agents/install-block.md. .claude-plugin/marketplace.json makes the repo its own single-plugin marketplace — a fallback the install block explains, not the documented route. Run claude plugin validate . --strict after touching either manifest. Why a Claude plugin but not (yet) a Codex one lives in .agents/adr/0002-ship-as-a-claude-code-plugin.md.
Closed
No activity in this phase yet.
brucejo75 commented 8/12/2026, 11:29:29 PM
Repro
git clone https://github.com/mattpocock/skills cd skills cat CLAUDE.md swamp repo init --tool copilot
The contents of CLAUDE.md is at the bottom of AGENTS.md
This kinda makes sense?
Sign in to post a ripple.