swamp workflow validate reports steps as failing "Step inputs" checks when a required global argument is supplied via a CEL expression like ${{ "Swamp Tests " + inputs.suffix }}. The steps are perfectly valid at runtime — they succeed — but validation marks them red, making validate unreliable as a CI/pre-run gate.

Reproduction

Model type @shelson/jira/project-category requires the name global argument. Workflow step (direct-type execution):

inputs:
  type: object
  properties:
    suffix: { type: string }
  required: [suffix]
jobs:
  - name: define-category
    steps:
      - name: create
        task:
          type: model_method
          modelType: "@shelson/jira/project-category"
          modelName: e2e-category
          methodName: create
          globalArgs:
            name: ${{ "Swamp Tests " + inputs.suffix }}
            site: [HOST-1]
            email: [REDACTED-EMAIL]
            token: ${{ vault.get(jira, API_TOKEN) }}

swamp workflow validate returns:

{ "name": "Step inputs for create in job define-category (e2e-category.create)",
  "passed": false,
  "error": "Missing required inputs: name" }

but swamp workflow run wf --input suffix=DD3 succeeds and creates "Swamp Tests DD3".

Impact

A full e2e workflow of 35+ steps generated ~30 false "Missing required inputs" errors, drowning any genuine schema problems in noise. Users learn to ignore validate results, defeating its purpose. This affects any workflow that parameterizes args via ${{ inputs.* }}, ${{ data.latest(...) }}, etc. — i.e. the recommended pattern for dynamic workflow inputs (docs suggest exactly this in reference.md § Using Inputs in Expressions).

Expected behavior

One of:

swamp workflow validate --input suffix=X — accept input overrides and resolve CEL before checking required args; or
Mark expression-templated args as "unverifiable" (skip / warn-only, not a hard failure), since static analysis cannot determine their value without runtime inputs; or
Treat any non-empty ${{ ... }} string as satisfying the presence requirement for required-arg checks (the type-level shape is still validated against the schema).

Environment

swamp CLI: 20260819.011806.0 (sha a9c7ee9a)
Reproduced against @shelson/jira local-source extension, project/category + project types
Related behaviors observed (possibly worth separate issues): eager CEL evaluation inside globalArgs fails at run-start when referencing data.latest() of data produced within the same run ("No such key: attributes"); raw vault.get() strings inside globalArgs CEL merge fail with found no matching overload for dyn.get(dyn, dyn). Workaround in both cases: move the args to lazy inputs.

02Bog Flow

Shipped

8/20/2026, 11:17:34 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack728/20/2026, 10:28:44 PM

stack72 commented 8/20/2026, 11:18:51 PM

Thanks @shelson for the detailed bug report and reproduction steps — the fix for false 'Missing required inputs' on CEL-templated globalArgs is now shipped!

Only documented non-interactive auth puts the password in argv; the safe SWAMP_API_KEY path is undocumented

Retyping a model instance strands catalog rows no command can reclaim — prune matches on model_id, delete resolves the current type (follow-up to #1009)

Docs: update cancel endpoint response statuses in REST API reference and workflows page

docs: update vault audit trail reference for write operation support

docs: document --dashboard flag for swamp serve

ExtensionWorkflowRepository scans manifest.yaml as a workflow, emitting 'Unknown key manifestVersion' warning

Relative path for custom agent skills setup doesn't provision skills

swamp serve daemon enable: add --dashboard flag

CLI writes runtime state (lastStalenessWarning) into tracked .swamp.yaml, dirtying a committed config file

extension install serializes files[] in readdir order, producing machine-dependent reorder diffs in upstream_extensions.json

Workflow YAML rewritten in place: block-scalar description truncated, file left unparseable, and validate still reports PASSED

workflow validate does not resolve modelType on factory-pattern steps — a non-existent extension validates clean

vault.get() arguments are verbatim, so a per-target secret cannot be expressed in workflow YAML

Cancellation/--timeout skips remaining steps including `completed`/`always` branches; --timeout waits for the in-flight subprocess

Remote "write-bearing" classification is inferred from data-plane writes, not declared; external side effects can be re-executed on worker disconnect (docs say the opposite)

Audit timeline is not populated by swamp CLI commands unless the AI-tool hook fires (manual says recording is automatic)

manual_approval suspends the run while parallel sibling jobs are mid-flight; in-flight steps are torn down and left `running`

`workflow resume --from` does nothing for forEach steps whose template name contains `${{ }}`

Step-level dependsOn on a forEach step never evaluates true (except `always`)

rum/site-info: lookup GETs a non-existent endpoint, always 405

vault read-secret appends a newline to piped output

wss:// direct to serve's own TLS listener still fails on 20260817 — client ALPN lands on h2, WS-over-h2 unimplemented (follow-up to #1363)

serve: vault audit repository not wired up — audit trail always empty

Support Jira webhooks with X-Hub-Signature HMAC-SHA256 verification

Add typed read-only remote ref lookup to @swamp/git

pullChanged skips same-size updated files — size-only change detection ignores the index sha256

A run's terminal status reaches the shared datastore only when a later run happens to push it

workflow cancel --all on the serve host shuts down the serve process

Readability of tables in documentation

repo init/upgrade --tool kiro references .kiro/skills/ but installs skills to ~/.kiro/skills/

vault: audit trail should record put, delete, and annotate operations

data.findBySpec() returns only the first in-run record, not all of them, so an .all() assert silently checks one element

repo upgrade --tool kiro reports wrong changedFiles paths

Suppress boot-time "pulled extension(s) have missing source files" WRN when invoked command is `swamp extension install`

s3-datastore: a stale machine's sync pushes its old 'latest' pointer over the newer remote one, and the rollback is permanent

`search` → `list` aliases are hand-rolled Command clones, not aliases: 10 of 11 have drifted from their parent's option set

Make official Docker image OCI-compliant

Method-name collision between a base model type and an extending extension silently drops the whole extension file — no error, doctor reports pass

data prune still misclassifies live records as orphans on 20260820 (after #1396) — serve-minted token/grant records, and report data of every live workflow

vault put prompts for the secret before validating the vault name exists

workflow validate: false 'Missing required inputs' for CEL-templated globalArgs (${{ inputs.* }})

Add SWAMP_CLI_OUTPUT env var to control default output mode (plaintext/tui/json)

@swamp/git fetch: support local path as remote

Dispatched steps over 15 minutes cannot write results: dispatch credentials expire and never refresh

Concurrent pushes to one namespace fail with HTTP 409 ConditionalRequestConflict — the conditional PUT is never retried

serve: triggerSource not persisted to workflow run summary

dataOutputOverrides not applied during remote execution — ephemeral resources GC'd before override takes effect

extension rm also deletes the lockfile entry, and install on an empty lockfile is a silent success — rm/install is not a round trip

--max-run-duration only applies to detached runs, not attached runs

Cancel endpoint reports status: cancelled for runs it did not actually cancel

@swamp/git: no way to amend a commit, but push can --force

Installation with new account creation times out

pre-flight checks run on orchestrator, not on worker — breaks remote execution with filesystem-dependent checks

docs: document --remote-only flag for swamp serve

Swamp serve daemon doesn't run with --hot-reload

serve: include workflowName in HealthSnapshotSchedule

knowledge-base retrieve persists query output into the state resource, with lifetime infinite and the query text in the instance name

Skip 50MB monolithic index rewrite on v2 shard-first path

Share single AwsS3Client instance across lock, sync, and verifier

Double shard assembly per command lifecycle (pull + push both read all shards)

pullChanged never records commitSeq for shard-first (v2) index

localHasAllRemoteEntries() permanently blocks sidecar update on partial caches

serve: workflow.history.get cannot find CLI-created runs or look up by run ID

"TRIAL ENDED" modal shown to team plan user when toggling extension visibility

Concurrent suspended workflow runs can't be disambiguated from 'approvals'; fresh runs should supersede matching-input suspended runs

I _think_ I might like a guard in the trigger yaml

swamp cmds don't realise the user is sshed into the system

serve dashboard: add cluster.instances and serve.config endpoints

CEL expressions have timestamp/duration but no current-time value, so no guard can express "older than N"

Support direct type execution (@type) with --server

access token mint writes to user vault, not serve's _token-secrets control plane in HA mode

Generic OTLP endpoint appends signal path after query or fragment

Issue lifecycle start drops top-level issue comments

serve dashboard: add instanceId, triggerSource, and step progress to WorkflowRunSummary

Document worker affinity (affinity: true) for workflows and jobs

Datastore MongoDB driver leaks connections — 5960 accumulated over 8 days

workflow approvals displays the latest run's prompt for every suspended run

@swamp/git: add a read-only working-tree diff for pre-commit review

docs: document --oauth-client-name flag for swamp serve

Docs: update workflow reference to include trigger in JSON output shapes