Persisted resource redaction masks the vault key inside a sensitive field ref (data name containing a vault-resolved value), so readResource fails with Secret not found

Teamz7d ago

#3581

Explicit pinned host-key policy, argv exec, atomic copy, and agent-based identityContent

Teams17d ago

#3582

dns_records lookup: distinguish no-match from API/auth/network failure (or add a list method)

Teams17d ago

#3584

kubernetes/secret: idempotent ensure method and a metadata-only get

Teams17d ago

#3580

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Team19d ago

#3579

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

Team19d ago

#3540

Cloudflare extensions reject account-owned API tokens: credential check uses /user/tokens/verify

Teams20d ago

#3046

serve: run scheduled workflows concurrently (per-workflow serialization), and report queue delay

Teams28d ago

#3080

serve --remote-only: step output from workers is never persisted to the run log (history logs always empty)

Teamz29d ago

#2468

serve: workflow trigger get/set ignore --config and read/write <repo>/.swamp/serve.yaml, so they disagree with the scheduler

Team1mo ago

#2472

serve --hot-reload: a changed trigger override schedule is logged as applied but the built-in cron keeps firing

Teams1mo ago

#2518

serve: a suspended run with an expired gate from a previous serve instance cannot be cancelled by any path

Teamz1mo ago

#3005

dashboard: approved autoResume run shows Resume and needs-inputs hint while serve already resumed it (status running)

Teams1mo ago

#3006

vault read-secret: to a pipe or file, drops the last line of a multi-line value when that line is 1024+ chars with no trailing newline (exit 0)

Teams1mo ago

#3010

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Team20d ago

#2504

dashboard: Schedules/Webhooks views are empty for non-admins -- the health stream needs admin on access:* and the 403 is swallowed

Teams1mo ago

#2627

access token mint --server: server demands --vault, no client version has that flag

Team1mo ago

#2519

dashboard System tab shows Port —, TLS disabled, Auth —, Scheduling disabled although serve.config reports them correctly

Teams1mo ago

#2473

serve: remote token mint impossible with multiple vaults -- server demands --vault, CLI has no --vault option

Team1mo ago

#2465

workflows: a nested workflow step should inherit the caller's placement when the child declares none

Team19d ago

#2383

serve: minting a token for an unsupported principal kind (e.g. agent:) succeeds, then every connection 500s in parsePrincipal

Teams1mo ago

#2377

dashboard: an approved run never resumes and the dashboard cannot resume it (workflow.resume is never called)

Teams1mo ago

#2347

serve dashboard: 2.6 MB uncompressed per page (no permessage-deflate, unpaginated workflow/run search); 15 s WS close stall; serve.config rejected

Teams1mo ago

#2337

s3-datastore: since the #2300 conditional-write change, every push to Ceph RGW 19.2.5 fails (_meta.json 'kept changing'); the run still exits 0

Teamz1mo ago

#2298

s3-datastore: a transient S3 read error during a heartbeat silently abandons the lock; a second host then runs the same model concurrently

Teamz1mo ago

#2345

worker secret allowlist rejects caller-chosen vault references resolved at run time (method args carrying {vaultName, secretKey})

Team1mo ago

#2344

serve: default placement for steps that declare none (so one workflow runs both locally and via workers)

Team19d ago

#2339

s3-datastore: per-datastore AWS profile, so a serve audit store can use different credentials from the main datastore

Team1mo ago

#2325

SWAMP_SERVER_TOKEN is ignored with --server unless SWAMP_SERVER_URL is also set to the same host (and SWAMP_SERVER_URL rejects wss://)

Teams1mo ago

#2300

s3-datastore: verify conditional-write support (If-None-Match / If-Match) at setup and in doctor; a backend that ignores them makes locking silently unsafe

Teamz1mo ago

#2299

s3-datastore: documented offline behaviour is unreachable — lock acquire fails closed before pull, while a mid-run outage exits 0 with the data stranded

Team1mo ago

#1786

vault.get() arguments are verbatim, so a per-target secret cannot be expressed in workflow YAML

Teams2mo ago

#1950

model type describe reports arguments: {} for models that define a full args schema

Teams2mo ago

#1949

verification-attestation reports 0 skipped and omits skipped steps, including skipped asserts

Team2mo ago

#1785

Cancellation/--timeout skips remaining steps including `completed`/`always` branches; --timeout waits for the in-flight subprocess

Teams2mo ago

#1784

Remote "write-bearing" classification is inferred from data-plane writes, not declared; external side effects can be re-executed on worker disconnect (docs say the opposite)

Teams2mo ago

#1781

`workflow resume --from` does nothing for forEach steps whose template name contains `${{ }}`

Teams2mo ago

#1780

Step-level dependsOn on a forEach step never evaluates true (except `always`)

Teams2mo ago

#1782

manual_approval suspends the run while parallel sibling jobs are mid-flight; in-flight steps are torn down and left `running`

Teams2mo ago

#1792

CLI writes runtime state (lastStalenessWarning) into tracked .swamp.yaml, dirtying a committed config file

Teams2mo ago

#1788

workflow validate does not resolve modelType on factory-pattern steps — a non-existent extension validates clean

Teams2mo ago

#1789

Only documented non-interactive auth puts the password in argv; the safe SWAMP_API_KEY path is undocumented

Teams2mo ago

#1791

extension install serializes files[] in readdir order, producing machine-dependent reorder diffs in upstream_extensions.json

Teams2mo ago

#1790

Workflow YAML rewritten in place: block-scalar description truncated, file left unparseable, and validate still reports PASSED

Teams2mo ago

#1783

Audit timeline is not populated by swamp CLI commands unless the AI-tool hook fires (manual says recording is automatic)

Team2mo ago

← Back to list

01Issue

BugShippedSwamp CLIPublicTeam

Assigneesstack72

Relationships

#2377 dashboard: an approved run never resumes and the dashboard cannot resume it (workflow.resume is never called)

Opened by randybias · 9/22/2026· Shipped 9/23/2026

Problem

A run approved in the dashboard never continues, and the dashboard gives no way to continue it. Approving is a record edit; resuming is an execution that needs a driver; nothing in serve connects the two.

Traced in 20260922.011324.0:

workflowApprove (src/libswamp/workflows/approve.ts) marks the gate step succeeded in the run record and returns. The serve handler (workflow_handlers.ts:1005) then calls pushChangedToRemote. Nothing else.
The only callers of the approve path are the WebSocket handler and the CLI. No scheduler, reconciler or subscriber reacts to an approval. --reconciliation-interval is peer reconciliation, not suspended runs.
handleWorkflowResume builds run deps, an ephemeral store and step locks and streams the run, so resume is a client-initiated execution. When the run suspended, the executor persisted its checkpoint and returned, and the client that started it exited.
The dashboard bundle calls workflow.approve, workflow.reject and workflow.approvals, and never workflow.resume, although serve exposes it. Checked against the served asset /dashboard/assets/index-B6vcd3ZC.js.

Measured, end to end

Time (UTC)	Event
21:46:45	`workflow.run` by `user:rbias`, suspends at the gate
22:01:17	`workflow.approve` by `user:rbias`, in the dashboard
22:01:23 – 22:05:41	run stays `suspended`; nothing runs
22:05:58	`workflow.resume` from a terminal; the run completes in 17.8 s

An operator who only has the dashboard is stuck at step 3, with no indication that anything is required of them.

Ask

A Resume action in the dashboard, next to Approve on a suspended run. Serve already supports it, including the detached form where serve drives the run itself (activeRunRegistry, kind: "workflow-resume"), so a dashboard resume need not hold a socket.
An opt-in auto-resume for the common case: when every gate on a run is decided and the workflow declares no resume-time inputs, serve continues it. Per workflow (autoResume: true) or per server (--auto-resume). Off by default, since design/primitives/workflows.md documents resume inputs as the reason the two are separate — that pattern must keep working.
Failing either, say so in the dashboard: an approved run that still needs a resume should show the exact command.

Why it matters

Gated workflows are how a human authorises a production change. If clearing the gate requires the approver to then find a terminal, the dashboard is not a complete approval surface, and an approved change can sit unexecuted with nobody aware of it.

02Bog Flow

Shipped

9/23/2026, 11:54:42 AM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack729/22/2026, 11:20:58 PM

stack72 commented 9/23/2026, 11:54:52 AM

Thanks @randybias for reporting this! We shipped: Close the approve-to-resume gap in serve two ways. (1) The dashboard can resume an approved run: a detached workflow.resume call, a Resume action on runs awaiting resume, and the exact CLI command shown as a fallback, with an --input placeholder for workflows that declare inputs. (2) An opt-in auto-resume: a workflow field autoResume, plus a serve flag --auto-resume (default off) that applies only to workflows declaring no inputs; the workflow setting always wins. When every gate on a run is decided through serve, serve launches a detached resume itself, using the canonical run identity and charged to the approver. The detached-resume block in handleWorkflowResume is extracted into a shared launcher, so the manual and automatic paths share one implementation. Also fixes the dashboard approving without a runId and leaving stale approval cards.. The fix has been merged and a release is on its way. We appreciate your contribution to swamp.