When the target swamp serve runs --auth-mode token, the client's custom trust anchor is never applied: --ca-cert <pem> and SWAMP_CA_CERT are both ignored and the connection fails at the TLS handshake with

TLS certificate rejected: the server's certificate issuer is not trusted.
If using a self-signed certificate, pass it with --ca-cert /path/to/cert.pem
or set SWAMP_CA_CERT=/path/to/cert.pem

— the advice the error gives is the thing that does not work. The identical client command with the identical cert succeeds when the serve runs --auth-mode none, so the anchor is plumbed on that path and lost on the token path.

Deno's own DENO_CERT env var does reach the token path: with it set, the handshake completes and the request proceeds to WebSocket auth (the server logs WebSocket auth rejected … for a bogus token; a valid token round-trips normally). That suggests the token-auth connection is made through the default Deno fetch/WebSocket TLS stack rather than the client that receives the --ca-cert TLS options.

This bites exactly where TLS is mandatory: serve refuses off-loopback binds without TLS and without token/oauth auth, so a private direct listener (the #1748 case — the ALPN fix itself works, thanks) can only be trusted via the undocumented DENO_CERT workaround. A CA-signed leaf (proper CA:TRUE root, leaf with IP SAN + serverAuth EKU, chain served) fails identically in token mode, so it is not a self-signed-anchor quirk — the anchor simply is not installed.

Steps to reproduce

The pair below differs only in the server's --auth-mode; loopback keeps every other variable out.

swamp repo init repo --tool none
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
  -days 2 -subj "/CN=localhost" \
  -addext "subjectAltName=IP:127.0.0.1" \
  -addext "basicConstraints=critical,CA:FALSE" \
  -keyout t.key -out t.crt

# 1) auth-mode none — --ca-cert honored
swamp serve --repo-dir repo --host 127.0.0.1 --port 9443 \
  --cert-file t.crt --key-file t.key &
swamp version --server wss://127.0.0.1:9443 --ca-cert t.crt
# -> succeeds

# 2) auth-mode token — same cert, same client command
kill %1
swamp serve --repo-dir repo --host 127.0.0.1 --port 9443 \
  --cert-file t.crt --key-file t.key \
  --auth-mode token --admins user:x &
swamp version --server wss://127.0.0.1:9443 --ca-cert t.crt
# -> TLS certificate rejected: the server's certificate issuer is not trusted
SWAMP_CA_CERT=$PWD/t.crt swamp version --server wss://127.0.0.1:9443
# -> same rejection

# 3) DENO_CERT reaches the token path
DENO_CERT=$PWD/t.crt swamp version --server wss://127.0.0.1:9443
# -> TLS completes; fails at auth as expected for a tokenless call:
#    "Authentication failed — run: swamp auth server-login ..."

Environment

swamp 20260822.221619.0-sha.b65edcb8 (client and server the same build)
Debian 13, linux amd64
Also reproduced with an off-loopback bind (where token mode is mandatory) and with a CA-signed chain instead of a self-signed anchor

02Bog Flow

Open

8/23/2026, 1:15:22 AM

No activity in this phase yet.

03Sludge Pulse

--ca-cert / SWAMP_CA_CERT are ignored when serve runs --auth-mode token — only DENO_CERT reaches the connection's TLS config (found validating #1748)

Only documented non-interactive auth puts the password in argv; the safe SWAMP_API_KEY path is undocumented

Retyping a model instance strands catalog rows no command can reclaim — prune matches on model_id, delete resolves the current type (follow-up to #1009)

Docs: update cancel endpoint response statuses in REST API reference and workflows page

docs: update vault audit trail reference for write operation support

docs: document --dashboard flag for swamp serve

ExtensionWorkflowRepository scans manifest.yaml as a workflow, emitting 'Unknown key manifestVersion' warning

Relative path for custom agent skills setup doesn't provision skills

swamp serve daemon enable: add --dashboard flag

CLI writes runtime state (lastStalenessWarning) into tracked .swamp.yaml, dirtying a committed config file

extension install serializes files[] in readdir order, producing machine-dependent reorder diffs in upstream_extensions.json

Workflow YAML rewritten in place: block-scalar description truncated, file left unparseable, and validate still reports PASSED

workflow validate does not resolve modelType on factory-pattern steps — a non-existent extension validates clean

vault.get() arguments are verbatim, so a per-target secret cannot be expressed in workflow YAML

Cancellation/--timeout skips remaining steps including `completed`/`always` branches; --timeout waits for the in-flight subprocess

Remote "write-bearing" classification is inferred from data-plane writes, not declared; external side effects can be re-executed on worker disconnect (docs say the opposite)

Audit timeline is not populated by swamp CLI commands unless the AI-tool hook fires (manual says recording is automatic)

manual_approval suspends the run while parallel sibling jobs are mid-flight; in-flight steps are torn down and left `running`

`workflow resume --from` does nothing for forEach steps whose template name contains `${{ }}`

Step-level dependsOn on a forEach step never evaluates true (except `always`)

rum/site-info: lookup GETs a non-existent endpoint, always 405

vault read-secret appends a newline to piped output

wss:// direct to serve's own TLS listener still fails on 20260817 — client ALPN lands on h2, WS-over-h2 unimplemented (follow-up to #1363)

serve: vault audit repository not wired up — audit trail always empty

Support Jira webhooks with X-Hub-Signature HMAC-SHA256 verification

Add typed read-only remote ref lookup to @swamp/git

pullChanged skips same-size updated files — size-only change detection ignores the index sha256

A run's terminal status reaches the shared datastore only when a later run happens to push it

workflow cancel --all on the serve host shuts down the serve process

Readability of tables in documentation

repo init/upgrade --tool kiro references .kiro/skills/ but installs skills to ~/.kiro/skills/

vault: audit trail should record put, delete, and annotate operations

data.findBySpec() returns only the first in-run record, not all of them, so an .all() assert silently checks one element

repo upgrade --tool kiro reports wrong changedFiles paths

Suppress boot-time "pulled extension(s) have missing source files" WRN when invoked command is `swamp extension install`

s3-datastore: a stale machine's sync pushes its old 'latest' pointer over the newer remote one, and the rollback is permanent

`search` → `list` aliases are hand-rolled Command clones, not aliases: 10 of 11 have drifted from their parent's option set

Make official Docker image OCI-compliant

Method-name collision between a base model type and an extending extension silently drops the whole extension file — no error, doctor reports pass

data prune still misclassifies live records as orphans on 20260820 (after #1396) — serve-minted token/grant records, and report data of every live workflow

vault put prompts for the secret before validating the vault name exists

workflow validate: false 'Missing required inputs' for CEL-templated globalArgs (${{ inputs.* }})

Add SWAMP_CLI_OUTPUT env var to control default output mode (plaintext/tui/json)

@swamp/git fetch: support local path as remote

Dispatched steps over 15 minutes cannot write results: dispatch credentials expire and never refresh

Concurrent pushes to one namespace fail with HTTP 409 ConditionalRequestConflict — the conditional PUT is never retried

serve: triggerSource not persisted to workflow run summary

dataOutputOverrides not applied during remote execution — ephemeral resources GC'd before override takes effect

extension rm also deletes the lockfile entry, and install on an empty lockfile is a silent success — rm/install is not a round trip

--max-run-duration only applies to detached runs, not attached runs

Cancel endpoint reports status: cancelled for runs it did not actually cancel

@swamp/git: no way to amend a commit, but push can --force

Installation with new account creation times out

pre-flight checks run on orchestrator, not on worker — breaks remote execution with filesystem-dependent checks

docs: document --remote-only flag for swamp serve

Swamp serve daemon doesn't run with --hot-reload

serve: include workflowName in HealthSnapshotSchedule

knowledge-base retrieve persists query output into the state resource, with lifetime infinite and the query text in the instance name

Skip 50MB monolithic index rewrite on v2 shard-first path

Share single AwsS3Client instance across lock, sync, and verifier

Double shard assembly per command lifecycle (pull + push both read all shards)

pullChanged never records commitSeq for shard-first (v2) index

localHasAllRemoteEntries() permanently blocks sidecar update on partial caches

serve: workflow.history.get cannot find CLI-created runs or look up by run ID

"TRIAL ENDED" modal shown to team plan user when toggling extension visibility

Concurrent suspended workflow runs can't be disambiguated from 'approvals'; fresh runs should supersede matching-input suspended runs

I _think_ I might like a guard in the trigger yaml

swamp cmds don't realise the user is sshed into the system

serve dashboard: add cluster.instances and serve.config endpoints

CEL expressions have timestamp/duration but no current-time value, so no guard can express "older than N"

Support direct type execution (@type) with --server

access token mint writes to user vault, not serve's _token-secrets control plane in HA mode

Generic OTLP endpoint appends signal path after query or fragment

Issue lifecycle start drops top-level issue comments

serve dashboard: add instanceId, triggerSource, and step progress to WorkflowRunSummary

Document worker affinity (affinity: true) for workflows and jobs

Datastore MongoDB driver leaks connections — 5960 accumulated over 8 days

workflow approvals displays the latest run's prompt for every suspended run

@swamp/git: add a read-only working-tree diff for pre-commit review

docs: document --oauth-client-name flag for swamp serve