01Issue

FeatureClosedExtensionsPublic

AssigneesNone

Relationships

#2220 Org Policy: typed batch effective-policy snapshots for baseline reports

Opened by swamp_lord · 9/16/2026

The generated get_effective_policy method returns an unpersisted result. Please add a typed fan-out method over explicit resource/constraint checks that records versioned effective PolicySpec rules with conditional/boolean/list semantics intact, and fails on access errors rather than inventing an unset/default policy. This enables reports to compare baselines against exact current-run data. Local policies extension adds audit_effective_policies.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

Extension: @swamp/gcp/orgpolicy@2026.08.12.2
swamp: 20260916.215025.0-sha.93897fc2
OS: darwin (aarch64)
Deno: 2.9.6
Shell: /bin/zsh

02Bog Flow

Closed

9/17/2026, 11:26:40 PM

No activity in this phase yet.

03Sludge Pulse

swamp_lord commented 9/16/2026, 10:39:58 PM

Related management capability: convergent local PolicySpec create/update with typed boolean/list/reset/conditional rules, mandatory current spec.etag on PATCH, updateMask=spec to preserve dry-run/other fields, and both local and effective read-back. Record prior local specification for audit/rollback planning; permission errors must not trigger creation. Local policies extension adds ensure_local_policy.

stack72 commented 9/17/2026, 11:26:37 PM

Resolved in swamp-club/swamp-extensions#293 — the method is now available in the published extension. Upgrade to version 2026.09.17.1 (or .2 for bigquery) to pick it up.

Package everything on ops.swamp-club.com; stop direct server edits

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

Shared dispatch bookkeeping queue delays completed worker results by up to 58 seconds

Serve globally scans definitions twice per new direct-type step, delaying worker dispatch by minutes

Serve: execute independent webhook-triggered workflows concurrently

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

serve/fleet: close OpenTelemetry attribution gaps across dispatch, data plane and worker lifecycle

serve: multi-minute write_resource latency during concurrent worker readiness

Installers intermittently fail resolving stable release: add bounded retries and actionable diagnostics

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

README.md needs updating with current language and content

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

Flaky test: lock hand-off timeout test times out in its own setup under load

Dashboard: a hidden tab keeps polling and re-rendering (health stream, live run page)

Registry client: retry transient upstream failures with bounded backoff and visible attempt progress

Pause and resume a scheduled workflow without editing or deleting its definition

Remote worker step marked failed ('aborted due to timeout') when the result report times out, though the method succeeded and its data was saved

Retention: one timeframe, enforced automatically, after which nothing older remains anywhere in the datastore

Workflow run cancellation on concurrency-key conflict

serve keeps a worker whose enroll finished after the worker timed out, then refuses the real worker as "already connected" and dispatches into the dead session

workflow run search / history search parse every run record on every call, so their cost grows with all history ever kept

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

Fleet visibility: live worker host map grouped by label, with slot-level lease state

Docs: dashboard reference needs the Workers view (/dashboard/workers)

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

swamp access check run locally ignores the named resource's stored type and tags

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

extension push: workflows listed with a shared directory prefix collapse into one workflows.yaml; all but the last are silently dropped

CLI tells signed-in callers to sign in when the registry rate-limits them

Add a subprocessors page at /subprocessors

Make Compute Routes list usable without create-only global arguments

Cloud Asset: complete metadata-only project search snapshot for lifecycle planning

Dashboard: deep links to a model's data item, data version and report

swamp report get --version N returns "Report not found" for any version older than the latest

serve: `serve reload` drops `export const extension` methods from a pulled package, while other extensions on the same type survive

serve: one unresolvable username in `auth.admins` stops the server from starting

control-plane vault init failures are swallowed; `access token reveal` says "Vault '_token-secrets' not found"

serve: boot token-secret migration deletes the source vault item

serve: boot hydration ignores `hydrationStrategy: lazy` and downloads every payload

Security Center: complete location-scoped finding snapshots for current-run reporting

IAM service accounts: verified deterministic-account lifecycle method with safe 404/409 handling

Secret Manager: complete metadata-only secret/version hygiene snapshot across projects

extension push: allow explicit private visibility in the manifest and at publish time, including public collectives

Swamp Club deno serve stays alive after SIGTERM because background loops are not stopped

Verification reviews infer pass from Claude usage-limit errors

Swamp Club fresh-database startup aborts migrations on missing deviceCode and concurrent replica markers

Logging sinks: convergent audit sink setup with typed writer identity and destination verification

Org Policy: typed batch effective-policy snapshots for baseline reports

Recommender: complete multi-scope recommendation snapshot for cost reports

Billing Budgets: convergent ensure-by-ID-or-unique-name method with etag and notification verification

Publishing manual contradicts registry omission defaults and supported visibility values

Service Usage: persist a complete paginated enabled-services snapshot for drift reports

Resource Manager: recursive caller-visible organisation hierarchy inventory with full pagination

Registry API: opt-in private visibility at publish time with fully backward-compatible defaults (prerequisite for CLI #2198)

BigQuery jobs: add a typed query method that polls, paginates and persists query results

Generic OTLP endpoint appends signal path after query or fragment

Cloud Build create supplies project instead of required projectId path parameter

Make official Docker image OCI-compliant

Issue lifecycle start drops top-level issue comments

Global Secret Manager methods build an invalid regional parent

No way to store code-review results — verdicts, findings, and cost are not persisted for any repo

Smoke test: gated lab issue lifecycle workflow

swamp-club: score-reads tierTotals GET overflows URL with inline param_ownerIds (Invalid URL, mislabeled clickhouse-network-error) for large collectives

[sc] quest-grant Mongo ops (recentHeartbeat/signalCounts/countIssueShipped) regressed to ~5s timeouts — missing index

Telemetry stats consumer: unsanitized subcommand in Mongo update path drops user metrics silently

Embeddable operative profile cards (iframe + oEmbed)

Harden the CLI update path so a future artifact-host migration can't strand clients again

swamp update silently reports 'up to date' forever if the stable pointer loses its redirect-location metadata

Slow Mongo: subscription.findByCollectiveId N+1 fan-out inflates p95 (lab issue list)

Scorecard: beta/rc-only extensions show "not scored" despite successful scoring (GET /score resolves only latestVersion)

Make serve WebSocket idle/keepalive timeout configurable (untunable default aborts runs when serve's loop briefly blocks)

Expose run/job/step identifiers as SWAMP_* env vars + CEL values, and template placement selectors (extends #331's run.id)

Relationships

#2220 Org Policy: typed batch effective-policy snapshots for baseline reports

Environment

Closed