#1676 swamp access grant create installs an unrelated extension from the registry

swamp access grant create installs an extension from the registry that the repository never asked for. It is a network fetch plus 30 files written into .swamp/pulled-extensions/, with no prompt and no mention in the command's purpose. I hit it while probing grant conditions, noticed an unexplained @swamp/gcp/migrationcenter in my working tree, and traced it back.

Reproduce

$ swamp extension list
@swamp/software-factory  v2026.06.24.1

$ swamp access grant create --subject user:probe9 --allow run --on model:zzz-nonexistent
  Installed   @swamp/gcp/migrationcenter@2026.08.12.2 (13 models registered)
  Completed   create on grant-f2c1ff23 succeeded in 9ms

$ swamp extension list
@swamp/gcp/migrationcenter  v2026.08.12.2  (pulled 2026-08-16T22:09:29.868Z)
@swamp/software-factory     v2026.06.24.1

It repeats: swamp extension rm @swamp/gcp/migrationcenter --yes, then any swamp access grant create, and the extension is back.

What I ruled out

• Not other commands. With the extension removed, swamp model list, swamp model type search gcp, swamp model method run <m> validate, swamp access grant list, and swamp access token list all leave it absent. swamp model create @swamp/software-factory <name> also leaves it absent, so this is not ordinary model creation.
• Not repo config. .swamp.yaml holds only swampVersion, initializedAt, repoId, tools, gitignoreManaged. swamp extension source list reports none.
• Not a local reference. Nothing in the repository names @swamp/gcp/migrationcenter except upstream_extensions.json, which is the record of the install itself.
• Not another operator. The repo's command audit log shows one session for the day and no swamp extension pull|install|search at any point.

Expected

swamp access grant create writes a grant. It does not reach the registry, and it does not install extensions. If some code path genuinely needs an extension installed, it should say which one and why, and ask first.

Why it matters

The install path runs unprompted from a command with no stated relationship to extensions, which is a supply-chain surface: a local, unrelated operation fetches and registers third-party model code. It also breaks sandboxed and air-gapped use, where an unexpected egress attempt is a failure rather than a convenience. And it dirties the working tree — upstream_extensions.json is tracked, so the install shows up as an unexplained diff.

Possibly related

Once installed, the extension fails to load, and every later swamp access command prints:

Error   @swamp/gcp/migrationcenter already installed at
        .../pulled-extensions/@swamp/gcp/migrationcenter but failed to load
        Local edits may be preventing it from registering

There are no local edits — the tree came straight from the install. Meanwhile .swamp/_extension_catalog.db records all 13 of its bundle_types with state = Indexed and an empty last_error, so the catalog and the loader disagree about the same extension.

Environment

swamp 20260815.023608.0-sha.a648c130, macOS 25.6.0 (darwin arm64).