Extension scoring audits v2 archives exact-only and charges unaudited code, in the package and the CLI alike
extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir
extension quality: a collective-attested private repository scores provisional, and --json omits ifProvisionalEarned
Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json
judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve
Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)
swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models
bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load
bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load
extension pull: safety analysis scans the bundle the extension runs
Extension scoring queue: two replicas can claim the same pending event
Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore
Five Mongo queues can hand the same row to two replicas
Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)
Score extensions with @swamp-club/extension-scoring (rubric v5) instead of the registry's own copy
Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike
Extension dependencies: one resolver for push, quality and fmt (no behaviour change)
Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)
Rescore every extension's current version under rubric v5
extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored
Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it
Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design
Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock
Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)
Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once
stagecraft studio: show a factory's open tickets that have no work item yet on the Board
stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)
A long-lived serve client for extensions, and a stable rate_limited error code
Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)
extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited
cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)
@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs
@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling
package.json mode: no loose-specifier warning for a range push ships as the exact installed version
method run masks a sensitive array from --input element by element, exposing its shape (regression from #3752)
Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments
Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)
stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors
extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)
main fails type check: query_view_test.ts passes a namespace string where expressionQueryView now takes a NamespaceReader (semantic conflict between #3790 and #3785)
forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names
extension push finds no local modules when a folder above the repo is named node_modules
extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)
Local verification docs still tell agents to put ANTHROPIC_API_KEY in verify.env for reviews
@swamp/cve/php-rce-2026-10 follow-ups: dry-run heading, command spelling, Debian 12 fix, podman image scan
extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes
extension fmt --check writes deno.lock in deno.json mode, which push and quality then bundle against with --frozen
@swamp/cve/dirtyfrag: scan logs are never saved (file writer handle dropped, data name collides with the status resource)
audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited
@swamp/cve/dirtyfrag README shows --input targetHost/sshUser/sshKey/dockerContainer, which the CLI rejects
@swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run
extension quality names the wrong cause: a bundle failure prints no reason, the not-audited row always blames an outage, and symbols-docs blames JSDoc when deno doc failed
Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)
Docs: extension dependency trust pages — import-map auditing, bare-import rewrite and scoring, and the clarified warning/error plan
Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)
Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)
workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT
Dependency trust scoring (CLI): yanked and loose specifiers cost one of the two dependency-trust points (no new push errors)
extension quality crashes with deno doc --json failed when a package.json-mode archive ships a bare import
Docs: extension publishing reference quotes stale bare-specifiers and quality messages
extension push: the yanked-dependency warning names a version to move to, and dependency warnings appear in the Unresolved warnings summary
Scorecard: copy the updated jsr-yanked wording from dependency_audit_vectors.json
Docs: extension publishing reference should describe the yanked-version suggestion and dependency findings in Unresolved warnings
eval-skill-triggers ignores evals/promptfoo/package-lock.json, so promptfoo's transitive deps are not locked
codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import
v3 outbox killed-writer test times out waiting for the kill point under CPU load
On Windows, v3 outbox tests time out on a writer lock held by a dead fake pid
extension push: rewrite bare imports in the shipped source to their import-map specifiers
Flaky: probeStartServer 'a closed port is dead' gets unknown under the parallel test run
workflow run --detach integration test fails under load: the run finishes before the test attaches
extension push: a deno.json scopes entry can make push ship and audit a different version than the extension resolves
Skill trigger evals run through claude -p so verify-skills works on a subscription login
On Windows, extension pull and rm report paths with mixed separators
Windows CI: data_writer vary-suffix test writes a data name with a double quote, which #3568 refuses on Windows
Docs: bare imports mapped by deno.json are rewritten on push and scored
vary/forEach object values with no key/name/id produce data names Windows refuses
Since #3569: Datastore UAT's extension install row and 17 Windows extension unit tests fail on every release
extension push: dependencies named only through a deno.json import map are never audited
extension push rewrites the author's deno.lock when bundling
codegen/vercel: union (oneOf) read responses produce id-only ResourceSchemas
Docs: manual pages for push auditing the dependency version that ships (deprecated pin, loose specifier, JSR checks)
swamp core: a non-string sensitive value reads back as a JSON string
extension install and extension pull leave different bundles for the same extension version
extension push writes node_modules/.deno/ into the author's package.json project when bundling
registry scorecard reports dependency trust passed for versions with bare imports it cannot audit
swamp-club: unknown collective API token returns 422 instead of the documented 404
Registry scorecard: audit the dependency version that ships, and JSR dependencies
swamp update on Windows leaves no complete swamp.exe during a cross-volume copy, and keeps the zip until it finishes
install.ps1 keeps the release zip until exit and deletes the old swamp.exe before copying the new one
extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)
Dev server (Vite) sends HTML pages with content-encoding: gzip over a body that isn't gzip
swamp install.sh: holds three copies of the binary at once (~913 MB peak); delete the archive and move instead of copy
swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk
Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)
local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)
Docs: dependency trust reports unaudited dependencies (follows #3350)
auth whoami: log mode labels collectives Free and shows trial expired for a superseded trial
swamp-extensions CI: Review Integrity audit stalls silently on a large trust-root change until Forgejo kills the job
extension quality and push report source paths through the repo's resolved symlink: quality's entry.file climbs to / and back
extension pull: answering y to a dependency's overwrite prompt silently skips that dependency
extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial
A bare deno check fails with ~2,000 errors in packages/dashboard; make the dashboard type-check under Deno
swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)
verify-reviews: adversarial review path guard is a hand-kept list, so new extensions silently skip it
whoami reports a superseded trial as expired, and a Personal License does not end the trial for private extensions
Flaky: v3 restore test 'serve's retake after another checkout wrote restores into its open store' fails under full-suite load
Manual: extension quality --json status field should say a check that would block a push
extension quality --json reports status "failed" when a rubric factor is missing, though the exit code is 0
Docs: manifest reference still describes the removed indexer symlinks directory for workflow resolution
bundle freshness ignores local modules outside the kind directory
Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case
Rescore scores the newest version, but the scorecard reads the stable one
Extension push: a range dependency is sent to OSV as the range, not a version
extension pull: shared sources at the archive root are not installed
Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)
Registry scorecard: dependency lookups that failed are not audited
CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently
CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials
extension push: report dependencies whose lookup failed as not audited
Docs: manual quotes model wording that swamp-club#3437 changes to behavior
Registry: validate, record and score the declared license (optional; remove the swamp-club license setting)
serve check-config: decide how to report restricted-model-types entries that cannot match
extension manifest: optional SPDX license: field, scored in quality and the rubric (field and LICENSE file, one point each)
extension push: archive source copy drops local modules imported from outside the model's directory
Registry: undo hiding of unlicensed extensions; remove the no-license banner and badge (license is optional; keep the licensed=true opt-in filter)
Remote worker keeps running stale code for an edited repo-local extension model
Workflow evaluation rejects another templating system's ${{ }} text, so the #2491 pass-through never reaches workflow steps
Flaky: AccessDataPoller 'a grant created by a real method run through A stays staged on A and reaches B'
Registry scorer: a deno doc failure discards the whole scorecard, including the LICENSE and README facts (12 public extensions unscored)
Registry scorecard: dependency licenses follow the CLI's SPDX rules
extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)
swamp-extensions: declare license: in every @swamp manifest and in codegen output
Registry: hide extensions with no license from browsing (show-unlicensed toggle for 60 days; search API default unchanged)
Flaky: start_server_test 'two agent opens at once open only one window' opens 3 windows under parallel load
swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file
stagecraft: let users build their own tracker as a separate extension (open tracker kinds, published adapter contract and conformance suite)
datastore_v3_read_model_test: two swamp-club#3337 tests fail on Linux (Expected function to reject)
extensions_search index is never created if the first attempt fails, until the process restarts
Registry search: a channel filter and a signed-in member's visibility overwrite each other's $or
extensions rail facet counts ignore the query, channel and selected facets
A forEach's iterations run in name order, not list order (operate-10 before operate-2)
Docs: declaring an extension license, and why unlicensed extensions are hidden
Extension licenses, day 60: remove the show-unlicensed toggle and settle what counts as licensed
Docs: extension pull before/after summary, published vs followed channel, and publishedChannel in the lockfile and list
stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)
swamp model validate checks globalArguments without applying the model's upgrades chain
stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)
stagecraft: example tracker extension and the writing-a-tracker guide (#3274 step 3)
stagecraft: open the set of trackers to any bound adapter (#3274 step 2)
stagecraft: publish and claim as workflows over a tracker method contract (#3274 step 1)
digitalocean codegen: app-platform and database spec secret fields are not marked sensitive
swamp-extensions: replace bare import specifiers with npm:/jsr: specifiers in first-party extensions
stagecraft: let a method or workflow stage's target use {{name}} placeholders from run data
check_upgrades.ts skips models in nested extensions/models/ directories (e.g. stagecraft's engine/ and tracker/)
verification: check_upgrades skips models in subdirectories, so stagecraft version bumps go unchecked
swamp issue edit: a dotted code path in the body is redacted as a hostname
issue-lifecycle: swamp-club lifecycle post failures are logged but the method still reports success
stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load
Namespace names are not reserved against cache/datastore layout directories (e.g. data)
serve check-config writes the extension catalog into the repo, though its help says nothing is written
extension fmt output prints JavaScript string concatenation and quoted values
dynamic-code safety error reports Babel line numbers, which disagree with the analyzer's newline-split lines
extension push offers to promote a yanked version, and extension promote does not check for a yank
Search and list output follows directory iteration order in the definition, workflow, vault and output repositories
stagecraft: integration test 'studio watch: an unchanged follow sends nothing; an edit sends a definition event' fails on main (macOS)
stagecraft: upgrade stored factory definitions on read, so a format change does not break work in progress
-q does not suppress the update, auth-nudge and autoupdate banners
access grant create: a refused condition still leaves an empty grant-… definition and a failed run behind
codegen/aws: 9 services still pin @aws-sdk/client-cloudcontrol@3.1090.0
Clear error when hydrateFile reports success but the file is missing
Workflow load errors print the raw Zod issue dump instead of a readable message
Docs: extension info reference should show the Accepted warnings block and contentMetadata.acceptances (swamp-club#3158)
extension info: show the accepted warnings the registry returns for the latest version (swamp-club#3095)
Periodic worker GC sweep prunes outside the sync gate
Docs: restricted-model-types covers edit, delete, data delete/rename and workflow step changes
extension safety analyzer's Deno.Command( warning is a plain substring match
registry: store and show declared acceptances sent in contentMetadata.acceptances at confirm (swamp-club#3021)
extension safety analyzer does not warn on node:child_process or cluster subprocess spawning
Flaky property test: analyzeExpression hyphenated dot access fails when modelName generates a CEL keyword ("in")
extension push/quality: structured acceptances for agents, a clearer title than For next time, and an optional reason
Docs: extension publishing reference is stale on bare specifiers, quality output and fmt config (swamp-club#3022)
extension push: the undecided private-entitlement verdict still says the registry may start a trial at publish
Docs: private-entitlement verdict for a free collective with no trial is now failed, not undecided
auto-resolve: the Installing line prints the extension's entire multi-line description
extension push: version-drift check reports 'no previously published version found' when the registry call failed
extension push: resolved file names and content hash are relative to the repo dir, so a push from outside the extension root shows ../ paths and a hash that differs from publish.yml
extension promote accepts a yanked version and reports it promoted
extension push: 'Requested visibility' line prints to stdout without the logger prefix, twice per run
extension push: a required global argument renders with a stray "" ("text": "string""")
extension push output: double-quoted adjacent interpolations, repo-relative paths, and --json emits three JSON documents
Docs: extension push content hash no longer depends on the swamp repo location (Match CI's content hash section)
extension quality and push crash with IsADirectory when additionalFiles lists a directory
extension push --dry-run: authentication verdict prints 'Signed in as .' when the credential is an API key with no username
Manual: additionalFiles and binaries entries must be files, not directories
Docs: extension push dry-run authentication verdict names the credential (follow-up to Lab 3088)
Docs: serve restricted-model-types matches any @ spelling; restriction warnings in serve and check-config
Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)
extension quality, fmt --check and push disagree: bare-specifier severity, cache hit skips gates, gate failure hides the rubric, fmt ignores project config
Docs: extension push dry-run reference and how-to need the registry checks, API-call list and content hash from Lab #3016
Docs: channel-aware extension push prompts and promote with a manifest (follow-up to #2939)
extension push: testing-completeness warns once per generated model (262 warnings in 25 extensions) with no way to mark a package generated
extension push: declare accepted lint warnings where the finding is (inline swamp-review-ignore comments, a sidecar review file beside the manifest), reported in quality, push and the registry
Docs: manual describes the old extension push path resolution (manifest argument, --extensions-dir scope, global skill fallback) after swamp-club#3018
extension push: --extensions-dir is ignored for bundled workflows
extension push: sub-directory extensions cannot be found from outside their directory (manifest path, directory argument, --extensions-dir for workflows and skills)
seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them
Docs: declared acceptances for extension push warnings (quality.yaml sidecar, swamp-quality-ignore comments, For next time report)
Docs: describe the private-entitlement registry check and the refusal wording in the extension publishing reference
extension push --dry-run skips auth, collective and version-exists checks, and prints 'No API calls were made' while calling the registry
serve HA: a server token minted on one replica is rejected by the other replicas until they restart (auto-definitions/ is only pulled at boot)
data_query_stale_limit_test fails on Linux: a limited page returns names in b, a order
extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)
verify-reviews: whole-extension rubric review for changed hand-written extensions, carried in the attestation and read by publish (design: Lab #3023)
Docs: step and job name rules in the workflows reference
Design: verify the extension push adversarial review through the attestation (whole-extension rubric review as a local verification step, carried in the attestation, read by publish and the push gate)
Decide a stricter naming rule for workflow step and job names
stagecraft: read records with data query --single once it ships
extension push: restore --yes waiving warnings (revert the 20261005.154947.0 flag split), keep the accepted-warnings record, --accept-warnings stays as an optional alias
server tokens: concurrent mints of the same name can pair one mint's record with the other's secret, so a credential authenticates as the wrong principal
extension push: credentials-sensitive-field has no word boundaries and flags secretName, TokenReference, credential_id (fourth fix to the rule)
swamp-extensions publish.yml: pass --accept-warnings alongside --yes now that --yes no longer waives warnings
extension push: --accept-warnings separate from --yes, and --json exits non-zero instead of skipping the warnings prompt
Docs: extension push --accept-warnings is separate from --yes (manual pages)
vault migrate: report missing required --config fields clearly, before installing the target type
Docs: vault create and vault migrate name missing required --config fields and prompt for them
stagecraft: publish @swamp/stagecraft: manifest, Lab exclusion, real-tree checks, packaged install, merge
stagecraft studio work-item page: follow-ups from the #2944 reviews
gatorwalk-factory studio: Simulate follow-ups from #2808's reviews (stuck Run tab on an unrunnable walk, settling states)
stagecraft studio work-item page: follow-ups from the #2956 reviews
stagecraft: stop relying on the CLI's swamp data get
extension push: Credentials & Secrets review flags token-count fields (inputTokens, outputTokens, totalTokens) as secrets
stagecraft studio: serve refuses to start without queryData, and printed start commands can coerce a title
stagecraft studio: a Ticket tab on the work-item page (description, comments, relations), and the nav shows where you are
extension push: eval()/new Function() safety check is a substring match and blocks obj.eval( method calls in bundled libraries
stagecraft: short work-item ids: a tracker prefix plus a counter (blog-12), the ticket's id for external trackers (abc-12), and -2 for later work on the same ticket
stagecraft studio: long work-item keys overflow Board cards, and the built-in tracker ref repeats the key
stagecraft studio: a work-item view showing where one item is in its factory and how it got there
audit_deps does not scan gatorwalk-factory's lockfile
stagecraft: prepare for publication: manifest, swamp's extension checks (fmt, quality, push --dry-run), repo verification, packaged install
stagecraft skill: getting started asks every question at once; it should ask one at a time
stagecraft studio: a Board view of every work item by stage
stagecraft: the Linear adapter assigns the issue when work starts
stagecraft: a user-facing README for first release (what it is, getting started, studio, trackers)
gatorwalk-factory skill: an interactive getting-started walkthrough for a first factory, modelled on swamp-getting-started
gatorwalk-factory: rename to stagecraft (@swamp/stagecraft) for first release
gatorwalk-factory: project a work item parked by its dispatch cap (GW-17 follow-up)
gatorwalk-factory: remove the static design page (design_page and its Mermaid renderer); the studio is the only visualization
gatorwalk-factory: claim can wedge a ticket on a reservation whose factory no longer loads (GW-18 follow-ups)
gatorwalk-factory studio: file-watch and page edge cases left from #2806's reviews
gatorwalk-factory studio: a replaced directory that gets the same inode number is still not watched again
gatorwalk-factory: lifecycle entries carry issue-lifecycle's versions, counts and attempts
gatorwalk-factory: mark a duplicate and move its work to the primary
gatorwalk-factory skill: an eval suite (claude plugin eval) that keeps authoring and driving behaviour from regressing
gatorwalk-factory studio: a factory whose model file is briefly invalid YAML drops off the list, and the page jumps to another factory
gatorwalk-factory: publish can undo a manual status move after a lost cursor write (GW-17 follow-up)
gatorwalk-factory: publish explains a stuck status step, and every refused lifecycle copy (GW-17 follow-up)
Run from a git worktree: definitions from the worktree, state from the shared repo
gatorwalk-factory skill: authoring's Show it step uses the studio once it lands
gatorwalk-factory: small driving fixes from the #2711 dogfood
gatorwalk-factory: metrics count an open manual exit as a wait on a person
gatorwalk-factory: the swamp-club adapter links the pull request on the Lab issue, as issue-lifecycle's link_pr does
gatorwalk-factory: main's embedded studio build is stale after #2792 and #2807 crossed
gatorwalk-factory studio: Simulate mode
gatorwalk-factory: scrub the swamp-club Lab from everything a public user sees, so it never reads as an option
gatorwalk-factory: a factory definition's name field duplicates the factory's model name
gatorwalk-factory: swamp-club-swamp-extensions stages read stale inputs (notify summary, review context, plan.submit)
gatorwalk-factory: validate warns on a way back with no description and on a product with no schema
model method run draws an empty report box when a report returns no markdown
gatorwalk-factory: the factory definition lives in the factory model, with its schema, not in a separate file
gatorwalk-factory: publish assigns the issue when work starts
gatorwalk-factory: main's embedded studio bundle is stale after #2792, so studio_assets_test fails
gatorwalk-factory: `--log` prints every method's output twice, and writes don't print the status that follows
gatorwalk-factory studio: Design mode
gatorwalk-factory: warn when a product only CEL reads is not produced on every path to the reading stage
gatorwalk-factory: parent, blocked-by, related and duplicate relations in every tracker
swamp-extensions build-attestation rejects every run: evaluated workflows carry sensitiveFormat (port of swamp-club #2815)
gatorwalk-factory: skill command check knows each tracker adapter's own methods
gatorwalk-factory: a lifecycle chooses its tracker, and status shows projection lag
gatorwalk-factory: check that CEL product references name declared products
gatorwalk-factory: plan prompt can add the same feedback to feedbackIncorporated twice after revise then rework
gatorwalk-factory skill: stop on repeated automatic rework, and lay out every exit neutrally at human stops
gatorwalk-factory: keep a person's plan feedback and hand it to the next plan
gatorwalk-factory: a tracker-side check that a factory definition fits its bound tracker
gatorwalk-factory skill: authoring: the agent interviews, starts from an example, validates, and shows the factory
gatorwalk-factory: studio model type and its local serve method
gatorwalk-factory: record_usage cannot take the token count Claude Code reports, so no dispatch gets usage
gatorwalk-factory: review prompts define severity and scale to the change, so a small change doesn't loop on logistics findings
gatorwalk-factory: a built-in tracker core that the Lab and Linear adapters build on
gatorwalk-factory: dispatch fidelity: subagents get the rendered prompt and product contract, and their results are recorded as returned
gatorwalk-factory: saved scenarios next to a lifecycle, run by validate
gatorwalk-factory: built-in tracker create must not overwrite a ticket on an id collision
gatorwalk-factory: retarget a work item to another issue, journaled
gatorwalk-factory: a downgraded regression still sets the Lab regression flag
gatorwalk-factory: the lifecycle holder reads its lifecycle from lifecycles/<name>.yaml
gatorwalk-factory: decide whether 'lifecycle' should be called 'factory' before go-live
gatorwalk-factory: separate engine and tracker code behind a seam module the tests enforce
check_upgrades path test fails an extension that has no manifest instead of skipping it as unpublished
gatorwalk-factory: description fields on gates and work; move lifecycle comments into fields
software-factory: decide its future at gatorwalk-factory go-live: PR #318, support window, deprecation
gatorwalk-factory: remove stage templates and apply; ship examples/ lifecycles instead
gatorwalk-factory: replace the Mermaid design page with a static studio export
gatorwalk-factory studio: Operate mode for live work items
gatorwalk-factory studio: example payloads from JSON Schema for Simulate walks
gatorwalk-factory: swamp-extensions stages load the issue-lifecycle skill, which starts a second driver
gatorwalk-factory: a breakdown stage files child issues and their dependencies
gatorwalk-factory: claim warns about open blockers and records an override
gatorwalk-factory: the dispatch packet does not say which products the stage records or their schemas
gatorwalk-factory: subagent findings are retyped into record_artifact instead of recorded as returned
gatorwalk-factory: restart at triage keeping what was recorded (gap 7)
gatorwalk-factory: prepare to ship (fast_forward) for work already done
gatorwalk-factory: a workflow stage cannot say where its workflow lives (gap 3)
gatorwalk-factory: the Lab issue stays current only if the driver remembers assign and publish
gatorwalk-factory: add issue-lifecycle's complete shortcut to swamp-extensions.yaml as per-stage exits (gap 6)
gatorwalk-factory: work-item keys are a title slug plus a short random suffix
gatorwalk-factory: drive a swamp-extensions Lab issue end to end through the swamp-club adapter (gap 1)
gatorwalk-factory: graph validation fails at default cycle limits; prune dominated count states
gatorwalk-factory: starter plugins (GW-13)
Decorative animations outside the Lab still repaint on the main thread
gatorwalk-factory: local design page for a lifecycle (GW-10)
gatorwalk-factory: rename plugin/eject to template/apply (GW-20)
gatorwalk-factory: document loops and their controls
gatorwalk-factory swamp-club adapter: assign robustness (stale assignees, dropped entries, default username)
gatorwalk-factory: a parsed lifecycle cannot be parsed again (payload schemas keep a validator mark)
gatorwalk-factory: projection publisher (GW-17)
gatorwalk-factory: start a work item from a ticket (GW-18)
gatorwalk-factory: requireField matches only equal values
gatorwalk-factory: conditional human approval
gatorwalk-factory: run verification in parallel inside a stage, and document the pattern
gatorwalk-factory: summary report and per-item metrics (GW-19)
gatorwalk-factory: validate passes a lifecycle whose graph exploration was truncated
gatorwalk-factory: swamp-club Lab adapter
gatorwalk-factory: ambiguous-exit exclusivity compares requireField keys literally, not as field paths
gatorwalk-factory: Linear adapter lets a response-body timeout escape as a raw error
gatorwalk-factory: plugin contract and composition (GW-12)
gatorwalk-factory: integration harness robustness (key parsing, version-check failure, HOME writes)
gatorwalk-factory: integration harness should strip every SWAMP_ variable except an allowlist
gatorwalk-factory: integration harness runs swamp --version without --no-telemetry, contradicting DESIGN.md
gatorwalk-factory: tracker adapter contract and Linear adapter (GW-16)
gatorwalk-factory: the swamp-extensions process as a gatorwalk lifecycle
gatorwalk-factory: a shortcut from several stages to one
gatorwalk-factory: parallel stages
gatorwalk-factory: the driving skill (GW-8)
gatorwalk-factory: graph validation and exhaustive check (GW-9)
gatorwalk-factory: start's externalRefs cannot be passed with --input
gatorwalk-factory: test harness on the real swamp engine (GW-7)
gatorwalk-factory: lifecycle holder and work-item model type (GW-6)
End a collective's trial when it begins a paid subscription
gatorwalk-factory: gates and limits (GW-5)
verify-reviews: code review fails on format, not substance; submit verdicts through a tool that enforces them
A collective that cancels inside its 30-day trial window regains trial access to private extensions
CI review-integrity: record its verdict through @swamp/review-record instead of the text marker
gatorwalk-factory: runtime core (GW-4)
gatorwalk-factory: the build-a-swamp-extension lifecycle as data (GW-3)
issue-lifecycle skill: prepare-to-ship documents a fast_forward method that does not exist
gatorwalk-factory: extension skeleton and lifecycle schema (GW-1, GW-2)
auth token revoke exits 1 with a TypeError after swamp-club revokes the token
Docs: auth token revoke deletes the token, but the manual says it stays in the token list
Docs: worker token create --server defaults to the _token-secrets vault, not the sole configured vault
Docs: explain how swamp treats other services' template syntax in the CEL expressions reference
Failed pulled-extension sources are attributed to @local/model, producing a nonsensical 'extension pull @local/model --force' hint
Link each swamp-club panel to its manual page with a header DOCS link
CLI: show API key fingerprints in auth whoami and auth token list/create
swamp-extensions verify-build: codegen guards read stdout from the shell log file resource and now fail every run
swamp-extensions verify-build: codegen idempotency step runs generate:* without fetching the gitignored schemas
issue-lifecycle: contributor check compares swamp-club handles against GitHub logins, so every author reads as external
verify-reviews gives no usable error when the local Claude Code predates the pinned review model
Definitions with no typeVersion get the entire upgrade chain applied, which can corrupt current-shaped arguments
Lab tab title goes stale on client-side navigation between issues
swamp --version emits ANSI escapes when piped, and --no-color does not suppress them
Docs: manual does not document issue submission redaction or --no-redact
Eliminate test flakiness: detect flaky tests with deno --repeats, track and fix them
Remove dead verification/container/ and fix the stale AGENTS.md verification instruction
Notify invited users of a collective invite (inbox + email)
deno task test fails on main: shared-env home writes, TTY assumptions, and two flaky tests
issue-lifecycle: two ordering deadlocks — ad-hoc fast_forward is unreachable, and verify before conformance review parks the lifecycle
DeferredExpression durable bindings lose a binding named __proto__ (flaky property test)
issue-lifecycle: lifecycle entries whose payload contains a quote-dollar sequence are rejected 422/400 and the failure is swallowed
verification: adversarial review guard omits extensions/, so bundled extension changes skip review
lab lifecycle API: dollar-key guard scans the serialised payload and rejects ordinary prose
verification harness: code review reviews the wrong diff, and a missing VERDICT is recorded as a pass
ci: configIntegrity check_hash treats a missing attestation key as a warning, so omission passes the merge gate
Interactive prompts write to stdout, corrupting commands whose stdout carries a value
main is red: handleWorkerPrune is not wrapped in the serve sync gate
main is red: handleWorkerPrune pushes outside the sync gate, failing serve_deps_rules_test
Merge gate validates attestations from stale branches, so main can go red with no PR ever failing
Docs: cli-output.md does not state the stdout-is-value / stderr-is-interaction contract
swamp invite link -v puts log output on stdout, breaking the pasteable-link contract
Route log-mode output to stderr by default, with commands opting stdout back in
Docs: invite-commands manual page documents an alias and a positional the CLI does not have
Lab status never returns to shipped on merge — transitions are manual and drift silently
swamp model method run deletes tracked .claude/skills files as an extension-install side effect
license-headers task is a silent no-op inside .claude worktrees (absolute-path skip patterns)
Relationships
#2427 Lab tab title goes stale on client-side navigation between issues
Opened by skunk-ape · 9/23/2026· Shipped 9/23/2026
The browser tab title never changes while navigating inside the Lab. Open the
issue list, click an issue, click another: the <title> keeps whatever the
server set when the document was first served. Reloading shows the correct
title for the issue in the URL.
Steps to reproduce
- Load
/lab— tab reads "Lab - Swamp Club". - Click any issue. URL becomes
/lab/{n}, the detail pane renders, tab title is unchanged. - Click a second issue. Same.
- Reload. Tab now reads
Lab #{n}: {title}— correct.
Cause
/lab and /lab/{n} are the same island, islands/lab/LabShell.tsx, which is
a hand-rolled client router. Clicking an issue never reaches the server, and the
only writer of the tab title is server-side:
routes/_app.tsx:58renders<title>{title}</title>fromctx.state.title, once per document response.routes/lab/[slug].tsx:185setsLab #{number}: {title}for a detail URL.routes/lab/[slug].tsx:302/routes/lab/index.tsx:54set the list titles.
document.title appears nowhere in the repo, and there is no <Head> usage —
Fresh 2 has no client-side head management. So after hydration nothing can
change the title.
The island intercepts the navigation instead:
islands/lab/LabShell.tsx:510handleIssueClickcallse.preventDefault()on the issue anchor for any plain left-click (anchors at:880board,:1555list).islands/lab/LabShell.tsx:493navigateTosets the selection, callshistory.pushState, and callsloadDetail. It never touches the title.islands/lab/LabShell.tsx:406loadDetailfetches/api/v1/lab/issues/{n}as JSON. JSON has no head.
A reload fixes it because that is a real document request to
routes/lab/[slug].tsx, whose handler sets ctx.state.title for the URL the
island's pushState already corrected. The server has always been right; it is
just never consulted on the fast path.
Also affected, same cause
Every pushState in the island: closing the detail (navigateTo(null),
:602/:2070) leaves an issue title on a list view; toggleFilter (:479),
clearFilters (:487) and setViewMode (:852) change the filter URL without
the matching Lab — {filter} title; the popstate handler (:552) restores
selection on back/forward but sets no title. Because loadDetail re-runs off
the SSE stream when the open issue changes (:689), a rename also leaves the
old title up.
Suggested fix
One effect in LabShell, keyed on the selected number and activeDetail —
written in an effect, not render scope, since the island SSRs before it
hydrates. activeDetail.value.issue already carries number and title
(LabShellDetail, :58), so no extra fetch is needed.
The one real cost: the list-side vocabulary (filterTitle and its
STATUS_LABEL / TYPE_LABEL maps) is route-local at
routes/lab/[slug].tsx:95-111, and an island cannot import from routes/. It
needs extracting into the shared kernel (lib/*.ts) with the route re-pointed
at it, or the client and server titles drift the next time a status label
changes. ctx.state.description / ogImage can stay server-only — crawlers get
a real document response.
Scope elsewhere in the app
islands/ExtensionRegistry.tsx:471, islands/FeedFilterBar.tsx:81 and
islands/LeaderboardBrowser.tsx:76 do the same pushState-without-title, so
the gap is app-wide. Their host routes set static titles
(routes/extensions/index.tsx:50, routes/feed/index.tsx:51), so there is
nothing per-URL to go stale and no visible defect there today. Lab is the only
place where a server title varies per URL behind a client router.
Environment
swamp-club web app, main at ec005fc0. Reproduced by reading the code; the
mechanism is confirmed against the files and lines above.
Shipped
Click a lifecycle step above to view its details.