Extension scoring audits v2 archives exact-only and charges unaudited code, in the package and the CLI alike

s11m ago

#3869

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

s1h ago

#4015

extension quality: a collective-attested private repository scores provisional, and --json omits ifProvisionalEarned

2h ago

#3970

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

s2h ago

#4010

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

3h ago

#3983

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

s3h ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

s4h ago

#3998

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

4h ago

#3639

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

s4h ago

#3383

extension pull: safety analysis scans the bundle the extension runs

s15h ago

#3979

Extension scoring queue: two replicas can claim the same pending event

s16h ago

#3995

Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore

s1h ago

#3994

Five Mongo queues can hand the same row to two replicas

9h ago

#3863

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

s17h ago

#3977

Score extensions with @swamp-club/extension-scoring (rubric v5) instead of the registry's own copy

s19h ago

#3991

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

19h ago

#3969

Extension dependencies: one resolver for push, quality and fmt (no behaviour change)

s19h ago

#3989

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

s2h ago

#3980

Rescore every extension's current version under rubric v5

21h ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

21h ago

#3781

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

s22h ago

#3974

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

2h ago

#3973

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

s12m ago

#3972

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

s1m ago

#3971

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

s23m ago

#3828

stagecraft studio: show a factory's open tickets that have no work item yet on the Board

s1d ago

#3964

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

1d ago

#3963

A long-lived serve client for extensions, and a stable rate_limited error code

1d ago

#3725

Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)

s1d ago

#3793

extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

s1d ago

#3772

cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

s2d ago

#3775

@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

s2d ago

#3776

@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling

3d ago

#3870

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

3d ago

#3826

method run masks a sensitive array from --input element by element, exposing its shape (regression from #3752)

s3d ago

#3783

Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments

s3d ago

#3778

Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)

s3d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

3d ago

#3662

extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)

s4d ago

#3796

main fails type check: query_view_test.ts passes a namespace string where expressionQueryView now takes a NamespaceReader (semantic conflict between #3790 and #3785)

s4d ago

#3795

forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names

4d ago

#3782

extension push finds no local modules when a folder above the repo is named node_modules

4d ago

#3630

extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)

s4d ago

#3764

Local verification docs still tell agents to put ANTHROPIC_API_KEY in verify.env for reviews

s5d ago

#3770

@swamp/cve/php-rce-2026-10 follow-ups: dry-run heading, command spelling, Debian 12 fix, podman image scan

s5d ago

#3612

extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes

s5d ago

#3717

extension fmt --check writes deno.lock in deno.json mode, which push and quality then bundle against with --frozen

s5d ago

#3720

@swamp/cve/dirtyfrag: scan logs are never saved (file writer handle dropped, data name collides with the status resource)

5d ago

#3715

audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited

s5d ago

#3719

@swamp/cve/dirtyfrag README shows --input targetHost/sshUser/sshKey/dockerContainer, which the CLI rejects

5d ago

#3716

@swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run

s5d ago

#3718

extension quality names the wrong cause: a bundle failure prints no reason, the not-audited row always blames an outage, and symbols-docs blames JSDoc when deno doc failed

s5d ago

#3728

Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)

3d ago

#3631

Docs: extension dependency trust pages — import-map auditing, bare-import rewrite and scoring, and the clarified warning/error plan

6d ago

#3682

Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)

s6d ago

#3705

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

6d ago

#3702

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

6d ago

#3354

Dependency trust scoring (CLI): yanked and loose specifiers cost one of the two dependency-trust points (no new push errors)

s6d ago

#3669

extension quality crashes with deno doc --json failed when a package.json-mode archive ships a bare import

s6d ago

#3689

Docs: extension publishing reference quotes stale bare-specifiers and quality messages

6d ago

#3677

extension push: the yanked-dependency warning names a version to move to, and dependency warnings appear in the Unresolved warnings summary

s6d ago

#3688

Scorecard: copy the updated jsr-yanked wording from dependency_audit_vectors.json

6d ago

#3687

Docs: extension publishing reference should describe the yanked-version suggestion and dependency findings in Unresolved warnings

6d ago

#3601

eval-skill-triggers ignores evals/promptfoo/package-lock.json, so promptfoo's transitive deps are not locked

s6d ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

6d ago

#3640

v3 outbox killed-writer test times out waiting for the kill point under CPU load

6d ago

#3673

On Windows, v3 outbox tests time out on a writer lock held by a dead fake pid

s6d ago

#3637

extension push: rewrite bare imports in the shipped source to their import-map specifiers

s7d ago

#3672

Flaky: probeStartServer 'a closed port is dead' gets unknown under the parallel test run

7d ago

#3638

workflow run --detach integration test fails under load: the run finishes before the test attaches

s7d ago

#3676

extension push: a deno.json scopes entry can make push ship and audit a different version than the extension resolves

7d ago

#3667

Skill trigger evals run through claude -p so verify-skills works on a subscription login

s7d ago

#3655

On Windows, extension pull and rm report paths with mixed separators

s7d ago

#3659

Windows CI: data_writer vary-suffix test writes a data name with a double quote, which #3568 refuses on Windows

s7d ago

#3664

Docs: bare imports mapped by deno.json are rewritten on push and scored

7d ago

#3663

vary/forEach object values with no key/name/id produce data names Windows refuses

7d ago

#3654

Since #3569: Datastore UAT's extension install row and 17 Windows extension unit tests fail on every release

s7d ago

#3611

extension push: dependencies named only through a deno.json import map are never audited

s7d ago

#3613

extension push rewrites the author's deno.lock when bundling

s7d ago

#3648

codegen/vercel: union (oneOf) read responses produce id-only ResourceSchemas

s7d ago

#3610

Docs: manual pages for push auditing the dependency version that ships (deprecated pin, loose specifier, JSR checks)

s7d ago

#3647

swamp core: a non-string sensitive value reads back as a JSON string

7d ago

#3634

extension install and extension pull leave different bundles for the same extension version

7d ago

#3632

extension push writes node_modules/.deno/ into the author's package.json project when bundling

5d ago

#3629

registry scorecard reports dependency trust passed for versions with bare imports it cannot audit

7d ago

#2564

swamp-club: unknown collective API token returns 422 instead of the documented 404

s7d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

s7d ago

#3621

swamp update on Windows leaves no complete swamp.exe during a cross-volume copy, and keeps the zip until it finishes

s7d ago

#3618

install.ps1 keeps the release zip until exit and deletes the old swamp.exe before copying the new one

s7d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

s8d ago

#3616

Dev server (Vite) sends HTML pages with content-encoding: gzip over a body that isn't gzip

8d ago

#3515

swamp install.sh: holds three copies of the binary at once (~913 MB peak); delete the archive and move instead of copy

s8d ago

#3516

swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk

s8d ago

#3603

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

s8d ago

#3600

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

8d ago

#3415

Docs: dependency trust reports unaudited dependencies (follows #3350)

s8d ago

#3463

auth whoami: log mode labels collectives Free and shows trial expired for a superseded trial

s8d ago

#3174

swamp-extensions CI: Review Integrity audit stalls silently on a large trust-root change until Forgejo kills the job

s8d ago

#3536

extension quality and push report source paths through the repo's resolved symlink: quality's entry.file climbs to / and back

z10d ago

#3313

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

z10d ago

#3311

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

s11d ago

#3500

A bare deno check fails with ~2,000 errors in packages/dashboard; make the dashboard type-check under Deno

s11d ago

#3514

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

7d ago

#2583

verify-reviews: adversarial review path guard is a hand-kept list, so new extensions silently skip it

s11d ago

#3503

whoami reports a superseded trial as expired, and a Personal License does not end the trial for private extensions

s11d ago

#3497

Flaky: v3 restore test 'serve's retake after another checkout wrote restores into its open store' fails under full-suite load

11d ago

#3498

Manual: extension quality --json status field should say a check that would block a push

s12d ago

#3464

extension quality --json reports status "failed" when a rubric factor is missing, though the exit code is 0

s12d ago

#3495

Docs: manifest reference still describes the removed indexer symlinks directory for workflow resolution

7d ago

#3385

bundle freshness ignores local modules outside the kind directory

z12d ago

#3486

Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case

7d ago

#3342

Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)

7d ago

#3351

Registry scorecard: dependency lookups that failed are not audited

s12d ago

#3422

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

12d ago

#3425

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

s12d ago

#3350

extension push: report dependencies whose lookup failed as not audited

s13d ago

#3438

Docs: manual quotes model wording that swamp-club#3437 changes to behavior

13d ago

#3326

Registry: validate, record and score the declared license (optional; remove the swamp-club license setting)

s13d ago

#3132

serve check-config: decide how to report restricted-model-types entries that cannot match

s13d ago

#3324

extension manifest: optional SPDX license: field, scored in quality and the rubric (field and LICENSE file, one point each)

s13d ago

#3376

extension push: archive source copy drops local modules imported from outside the model's directory

s13d ago

#3397

Registry: undo hiding of unlicensed extensions; remove the no-license banner and badge (license is optional; keep the licensed=true opt-in filter)

s13d ago

#3284

Remote worker keeps running stale code for an edited repo-local extension model

s13d ago

#2528

Workflow evaluation rejects another templating system's ${{ }} text, so the #2491 pass-through never reaches workflow steps

z13d ago

#3394

Flaky: AccessDataPoller 'a grant created by a real method run through A stays staged on A and reaches B'

13d ago

#3370

Registry scorer: a deno doc failure discards the whole scorecard, including the LICENSE and README facts (12 public extensions unscored)

s13d ago

#3392

Registry scorecard: dependency licenses follow the CLI's SPDX rules

7d ago

#3391

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

s7d ago

#3325

swamp-extensions: declare license: in every @swamp manifest and in codegen output

s13d ago

#3323

Registry: hide extensions with no license from browsing (show-unlicensed toggle for 60 days; search API default unchanged)

s14d ago

#3348

Flaky: start_server_test 'two agent opens at once open only one window' opens 3 windows under parallel load

s14d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

19h ago

#3274

stagecraft: let users build their own tracker as a separate extension (open tracker kinds, published adapter contract and conformance suite)

s14d ago

#3343

datastore_v3_read_model_test: two swamp-club#3337 tests fail on Linux (Expected function to reject)

s14d ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

14d ago

#3341

Registry search: a channel filter and a signed-in member's visibility overwrite each other's $or

14d ago

#3303

extensions rail facet counts ignore the query, channel and selected facets

s14d ago

#3318

A forEach's iterations run in name order, not list order (operate-10 before operate-2)

s14d ago

#3328

Docs: declaring an extension license, and why unlicensed extensions are hidden

13d ago

#3327

Extension licenses, day 60: remove the show-unlicensed toggle and settle what counts as licensed

13d ago

#3312

Docs: extension pull before/after summary, published vs followed channel, and publishedChannel in the lockfile and list

13d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

15d ago

#3196

swamp model validate checks globalArguments without applying the model's upgrades chain

s15d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

15d ago

#3291

stagecraft: example tracker extension and the writing-a-tracker guide (#3274 step 3)

15d ago

#3290

stagecraft: open the set of trackers to any bound adapter (#3274 step 2)

15d ago

#3289

stagecraft: publish and claim as workflows over a tracker method contract (#3274 step 1)

15d ago

#3030

digitalocean codegen: app-platform and database spec secret fields are not marked sensitive

z15d ago

#3114

swamp-extensions: replace bare import specifiers with npm:/jsr: specifiers in first-party extensions

s15d ago

#3190

stagecraft: let a method or workflow stage's target use {{name}} placeholders from run data

s15d ago

#3201

check_upgrades.ts skips models in nested extensions/models/ directories (e.g. stagecraft's engine/ and tracker/)

16d ago

#3230

verification: check_upgrades skips models in subdirectories, so stagecraft version bumps go unchecked

s16d ago

#3228

swamp issue edit: a dotted code path in the body is redacted as a hostname

s16d ago

#2280

issue-lifecycle: swamp-club lifecycle post failures are logged but the method still reports success

s16d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

16d ago

#2478

Namespace names are not reserved against cache/datastore layout directories (e.g. data)

z17d ago

#3139

serve check-config writes the extension catalog into the repo, though its help says nothing is written

z17d ago

#3149

extension fmt output prints JavaScript string concatenation and quoted values

z17d ago

#3170

dynamic-code safety error reports Babel line numbers, which disagree with the analyzer's newline-split lines

z18d ago

#3138

extension push offers to promote a yanked version, and extension promote does not check for a yank

z18d ago

#3067

Search and list output follows directory iteration order in the definition, workflow, vault and output repositories

z18d ago

#3200

stagecraft: integration test 'studio watch: an unchanged follow sends nothing; an edit sends a definition event' fails on main (macOS)

18d ago

#3194

stagecraft: upgrade stored factory definitions on read, so a format change does not break work in progress

s18d ago

#2257

-q does not suppress the update, auth-nudge and autoupdate banners

s18d ago

#3182

access grant create: a refused condition still leaves an empty grant-… definition and a failed run behind

s18d ago

#3163

codegen/aws: 9 services still pin @aws-sdk/client-cloudcontrol@3.1090.0

s18d ago

#2477

Clear error when hydrateFile reports success but the file is missing

z18d ago

#3062

Workflow load errors print the raw Zod issue dump instead of a readable message

z19d ago

#3176

Docs: extension info reference should show the Accepted warnings block and contentMetadata.acceptances (swamp-club#3158)

18d ago

#3158

extension info: show the accepted warnings the registry returns for the latest version (swamp-club#3095)

s19d ago

#2269

Periodic worker GC sweep prunes outside the sync gate

z19d ago

#3172

Docs: restricted-model-types covers edit, delete, data delete/rename and workflow step changes

18d ago

#2965

extension safety analyzer's Deno.Command( warning is a plain substring match

s19d ago

#3095

registry: store and show declared acceptances sent in contentMetadata.acceptances at confirm (swamp-club#3021)

s19d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

19d ago

#3120

Flaky property test: analyzeExpression hyphenated dot access fails when modelName generates a CEL keyword ("in")

19d ago

#3107

extension push/quality: structured acceptances for agents, a clearer title than For next time, and an optional reason

s19d ago

#3116

Docs: extension publishing reference is stale on bare specifiers, quality output and fmt config (swamp-club#3022)

s19d ago

#3104

extension push: the undecided private-entitlement verdict still says the registry may start a trial at publish

s19d ago

#3150

Docs: private-entitlement verdict for a free collective with no trial is now failed, not undecided

18d ago

#3013

auto-resolve: the Installing line prints the extension's entire multi-line description

z19d ago

#3069

extension push: version-drift check reports 'no previously published version found' when the registry call failed

s19d ago

#3100

extension push: resolved file names and content hash are relative to the repo dir, so a push from outside the extension root shows ../ paths and a hash that differs from publish.yml

s19d ago

#3040

extension promote accepts a yanked version and reports it promoted

s19d ago

#3112

extension push: 'Requested visibility' line prints to stdout without the logger prefix, twice per run

19d ago

#3118

extension push: a required global argument renders with a stray "" ("text": "string""")

19d ago

#3017

extension push output: double-quoted adjacent interpolations, repo-relative paths, and --json emits three JSON documents

s19d ago

#3142

Docs: extension push content hash no longer depends on the swamp repo location (Match CI's content hash section)

19d ago

#3119

extension quality and push crash with IsADirectory when additionalFiles lists a directory

s20d ago

#3088

extension push --dry-run: authentication verdict prints 'Signed in as .' when the credential is an API key with no username

s20d ago

#3137

Manual: additionalFiles and binaries entries must be files, not directories

19d ago

#3135

Docs: extension push dry-run authentication verdict names the credential (follow-up to Lab 3088)

19d ago

#3134

Docs: serve restricted-model-types matches any @ spelling; restriction warnings in serve and check-config

18d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

20d ago

#3022

extension quality, fmt --check and push disagree: bare-specifier severity, cache hit skips gates, gate failure hides the rubric, fmt ignores project config

s20d ago

#3071

Docs: extension push dry-run reference and how-to need the registry checks, API-call list and content hash from Lab #3016

s20d ago

#3113

Docs: channel-aware extension push prompts and promote with a manifest (follow-up to #2939)

20d ago

#3020

extension push: testing-completeness warns once per generated model (262 warnings in 25 extensions) with no way to mark a package generated

20d ago

#3021

extension push: declare accepted lint warnings where the finding is (inline swamp-review-ignore comments, a sidecar review file beside the manifest), reported in quality, push and the registry

s20d ago

#3105

Docs: manual describes the old extension push path resolution (manifest argument, --extensions-dir scope, global skill fallback) after swamp-club#3018

20d ago

#3031

extension push: --extensions-dir is ignored for bundled workflows

20d ago

#3018

extension push: sub-directory extensions cannot be found from outside their directory (manifest path, directory argument, --extensions-dir for workflows and skills)

s20d ago

#3103

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

20d ago

#3098

Docs: declared acceptances for extension push warnings (quality.yaml sidecar, swamp-quality-ignore comments, For next time report)

20d ago

#3097

Docs: describe the private-entitlement registry check and the refusal wording in the extension publishing reference

20d ago

#3016

extension push --dry-run skips auth, collective and version-exists checks, and prints 'No API calls were made' while calling the registry

s21d ago

#2481

serve HA: a server token minted on one replica is rejected by the other replicas until they restart (auto-definitions/ is only pulled at boot)

z21d ago

#3066

data_query_stale_limit_test fails on Linux: a limited page returns names in b, a order

s21d ago

#3065

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

4d ago

#3064

verify-reviews: whole-extension rubric review for changed hand-written extensions, carried in the attestation and read by publish (design: Lab #3023)

21d ago

#3063

Docs: step and job name rules in the workflows reference

20d ago

#3023

Design: verify the extension push adversarial review through the attestation (whole-extension rubric review as a local verification step, carried in the attestation, read by publish and the push gate)

s21d ago

#3060

Decide a stricter naming rule for workflow step and job names

20d ago

#2978

stagecraft: read records with data query --single once it ships

s21d ago

#3047

extension push: restore --yes waiving warnings (revert the 20261005.154947.0 flag split), keep the accepted-warnings record, --accept-warnings stays as an optional alias

s21d ago

#2482

server tokens: concurrent mints of the same name can pair one mint's record with the other's secret, so a credential authenticates as the wrong principal

z21d ago

#3019

extension push: credentials-sensitive-field has no word boundaries and flags secretName, TokenReference, credential_id (fourth fix to the rule)

s21d ago

#3042

swamp-extensions publish.yml: pass --accept-warnings alongside --yes now that --yes no longer waives warnings

s21d ago

#3015

extension push: --accept-warnings separate from --yes, and --json exits non-zero instead of skipping the warnings prompt

s22d ago

#3026

Docs: extension push --accept-warnings is separate from --yes (manual pages)

21d ago

#3003

vault migrate: report missing required --config fields clearly, before installing the target type

s22d ago

#3014

Docs: vault create and vault migrate name missing required --config fields and prompt for them

21d ago

#2820

stagecraft: publish @swamp/stagecraft: manifest, Lab exclusion, real-tree checks, packaged install, merge

s24d ago

#2956

stagecraft studio work-item page: follow-ups from the #2944 reviews

s24d ago

#2891

gatorwalk-factory studio: Simulate follow-ups from #2808's reviews (stuck Run tab on an unrunnable walk, settling states)

s24d ago

#2991

stagecraft studio work-item page: follow-ups from the #2956 reviews

21d ago

#2974

stagecraft: stop relying on the CLI's swamp data get

s24d ago

#2952

extension push: Credentials & Secrets review flags token-count fields (inputTokens, outputTokens, totalTokens) as secrets

s24d ago

#2951

stagecraft studio: serve refuses to start without queryData, and printed start commands can coerce a title

s24d ago

#2969

stagecraft studio: a Ticket tab on the work-item page (description, comments, relations), and the nav shows where you are

s24d ago

#2949

extension push: eval()/new Function() safety check is a substring match and blocks obj.eval( method calls in bundled libraries

s24d ago

#2966

stagecraft: short work-item ids: a tracker prefix plus a counter (blog-12), the ticket's id for external trackers (abc-12), and -2 for later work on the same ticket

s25d ago

#2963

stagecraft studio: long work-item keys overflow Board cards, and the built-in tracker ref repeats the key

s25d ago

#2944

stagecraft studio: a work-item view showing where one item is in its factory and how it got there

s25d ago

#2850

audit_deps does not scan gatorwalk-factory's lockfile

25d ago

#2947

stagecraft: prepare for publication: manifest, swamp's extension checks (fmt, quality, push --dry-run), repo verification, packaged install

s25d ago

#2950

stagecraft skill: getting started asks every question at once; it should ask one at a time

s25d ago

#2943

stagecraft studio: a Board view of every work item by stage

s25d ago

#2945

stagecraft: the Linear adapter assigns the issue when work starts

s25d ago

#2819

stagecraft: a user-facing README for first release (what it is, getting started, studio, trackers)

s25d ago

#2931

gatorwalk-factory skill: an interactive getting-started walkthrough for a first factory, modelled on swamp-getting-started

s25d ago

#2932

gatorwalk-factory: rename to stagecraft (@swamp/stagecraft) for first release

s25d ago

#2703

gatorwalk-factory: project a work item parked by its dispatch cap (GW-17 follow-up)

s25d ago

#2911

gatorwalk-factory: remove the static design page (design_page and its Mermaid renderer); the studio is the only visualization

s25d ago

#2712

gatorwalk-factory: claim can wedge a ticket on a reservation whose factory no longer loads (GW-18 follow-ups)

s25d ago

#2841

gatorwalk-factory studio: file-watch and page edge cases left from #2806's reviews

s25d ago

#2913

gatorwalk-factory studio: a replaced directory that gets the same inode number is still not watched again

21d ago

#2772

gatorwalk-factory: lifecycle entries carry issue-lifecycle's versions, counts and attempts

s25d ago

#2799

gatorwalk-factory: mark a duplicate and move its work to the primary

s25d ago

#2912

gatorwalk-factory skill: an eval suite (claude plugin eval) that keeps authoring and driving behaviour from regressing

s25d ago

#2889

gatorwalk-factory studio: a factory whose model file is briefly invalid YAML drops off the list, and the page jumps to another factory

s25d ago

#2714

gatorwalk-factory: publish can undo a manual status move after a lost cursor write (GW-17 follow-up)

s25d ago

#2710

gatorwalk-factory: publish explains a stuck status step, and every refused lifecycle copy (GW-17 follow-up)

s25d ago

#2908

Run from a git worktree: definitions from the worktree, state from the shared repo

18d ago

#2839

gatorwalk-factory skill: authoring's Show it step uses the studio once it lands

s25d ago

#2875

gatorwalk-factory: small driving fixes from the #2711 dogfood

s26d ago

#2874

gatorwalk-factory: metrics count an open manual exit as a wait on a person

s26d ago

#2872

gatorwalk-factory: the swamp-club adapter links the pull request on the Lab issue, as issue-lifecycle's link_pr does

s26d ago

#2886

gatorwalk-factory: main's embedded studio build is stale after #2792 and #2807 crossed

26d ago

#2808

gatorwalk-factory studio: Simulate mode

s26d ago

#2842

gatorwalk-factory: scrub the swamp-club Lab from everything a public user sees, so it never reads as an option

s26d ago

#2816

gatorwalk-factory: a factory definition's name field duplicates the factory's model name

s26d ago

#2873

gatorwalk-factory: swamp-club-swamp-extensions stages read stale inputs (notify summary, review context, plan.submit)

s26d ago

#2840

gatorwalk-factory: validate warns on a way back with no description and on a product with no schema

s26d ago

#2813

model method run draws an empty report box when a report returns no markdown

s26d ago

#2884

gatorwalk-factory: the factory definition lives in the factory model, with its schema, not in a separate file

s26d ago

#2801

gatorwalk-factory: publish assigns the issue when work starts

s26d ago

#2885

gatorwalk-factory: main's embedded studio bundle is stale after #2792, so studio_assets_test fails

26d ago

#2780

gatorwalk-factory: `--log` prints every method's output twice, and writes don't print the status that follows

s26d ago

#2807

gatorwalk-factory studio: Design mode

s26d ago

#2792

gatorwalk-factory: warn when a product only CEL reads is not produced on every path to the reading stage

s26d ago

#2796

gatorwalk-factory: parent, blocked-by, related and duplicate relations in every tracker

s26d ago

#2878

swamp-extensions build-attestation rejects every run: evaluated workflows carry sensitiveFormat (port of swamp-club #2815)

s26d ago

#2711

gatorwalk-factory: skill command check knows each tracker adapter's own methods

s26d ago

#2795

gatorwalk-factory: a lifecycle chooses its tracker, and status shows projection lag

s26d ago

#2680

gatorwalk-factory: check that CEL product references name declared products

s26d ago

#2852

gatorwalk-factory: plan prompt can add the same feedback to feedbackIncorporated twice after revise then rework

s26d ago

#2782

gatorwalk-factory skill: stop on repeated automatic rework, and lay out every exit neutrally at human stops

s26d ago

#2770

gatorwalk-factory: keep a person's plan feedback and hand it to the next plan

s26d ago

#2847

gatorwalk-factory: a tracker-side check that a factory definition fits its bound tracker

21d ago

#2818

gatorwalk-factory skill: authoring: the agent interviews, starts from an example, validates, and shows the factory

s26d ago

#2806

gatorwalk-factory: studio model type and its local serve method

s26d ago

#2778

gatorwalk-factory: record_usage cannot take the token count Claude Code reports, so no dispatch gets usage

s26d ago

#2781

gatorwalk-factory: review prompts define severity and scale to the change, so a small change doesn't loop on logistics findings

s26d ago

#2794

gatorwalk-factory: a built-in tracker core that the Lab and Linear adapters build on

s26d ago

#2776

gatorwalk-factory: dispatch fidelity: subagents get the rendered prompt and product contract, and their results are recorded as returned

s26d ago

#2805

gatorwalk-factory: saved scenarios next to a lifecycle, run by validate

s26d ago

#2832

gatorwalk-factory: built-in tracker create must not overwrite a ticket on an id collision

s25d ago

#2798

gatorwalk-factory: retarget a work item to another issue, journaled

s26d ago

#2769

gatorwalk-factory: a downgraded regression still sets the Lab regression flag

sBlocked26d ago

#2803

gatorwalk-factory: the lifecycle holder reads its lifecycle from lifecycles/<name>.yaml

s26d ago

#2785

gatorwalk-factory: decide whether 'lifecycle' should be called 'factory' before go-live

s26d ago

#2793

gatorwalk-factory: separate engine and tracker code behind a seam module the tests enforce

s27d ago

#2696

check_upgrades path test fails an extension that has no manifest instead of skipping it as unpublished

s27d ago

#2804

gatorwalk-factory: description fields on gates and work; move lifecycle comments into fields

s27d ago

#2821

software-factory: decide its future at gatorwalk-factory go-live: PR #318, support window, deprecation

s21d ago

#2767

gatorwalk-factory: remove stage templates and apply; ship examples/ lifecycles instead

s27d ago

#2811

gatorwalk-factory: replace the Mermaid design page with a static studio export

25d ago

← Back to list

01Issue

FeatureShippedExtensionsPublic

Assigneesskunk-ape

Relationships

⊘ blocked by #2793

#2711 gatorwalk-factory: skill command check knows each tracker adapter's own methods

Opened by skunk-ape · 9/29/2026· Shipped 10/1/2026

Follow-up to #2685. integration/skill_commands.ts checks a skill command on a instance against the Linear model's methods only. That holds while every adapter shares the same methods (fetch_issue, comment, set_status, publish), but a skill command for a method only one adapter has, such as the swamp-club adapter's assign or post_attestation, would be refused. Let the placeholder name the adapter (for example and ), or check against the union of adapter methods with the placeholder naming which one.

02Bog Flow

Shipped

10/1/2026, 1:33:55 AM

Click a lifecycle step above to view its details.

03Sludge Pulse

skunk-ape assigned skunk-ape10/1/2026, 12:53:44 AM

skunk-ape linked blocked by #27939/30/2026, 3:58:44 PM

skunk-ape marked as blocked9/30/2026, 3:58:44 PM

skunk-ape unblocked automatically9/30/2026, 5:26:51 PM