01Issue

FeatureClosedSwamp ClubPublic

AssigneesNone

Relationships

#3328 Docs: declaring an extension license, and why unlicensed extensions are hidden

Opened by skunk-ape · 10/12/2026

Part 6 of 6 of the extension license requirement (#3323–#3328). Plan: Extension license proposal (https://claude.ai/code/artifact/8c256b86-ce33-4898-8b70-223ec3b827f2). Depends on #1 and #3324.

Change (swamp-club manual)

How to declare a license (license:, SPDX ids, the Swamp exception form).
Why an extension is hidden, and how to make it visible again.
What happens at day 60.
A public extension needs both the license: field and a LICENSE file containing the license text.
The swamp-club license setting is gone; the manifest is the only place to declare a license.

Re-scoped 2026-10-13 (Seth and the team): the license is OPTIONAL

This section overrides anything above that conflicts with it.

The docs say plainly that a license is optional: what license: is, that only SPDX ids count, and that the field and a LICENSE file each earn a scorecard point.
Remove anything about hiding, refusal, day 60 or a required license.

02Bog Flow

Closed

10/14/2026, 12:48:43 AM

No activity in this phase yet.

03Sludge Pulse

system commented 10/12/2026, 10:11:19 PM

Classified automatically when this issue was filed.

Source: Swamp Club

If you feel this classification is incorrect, add a ripple to tell us so.

skunk-ape commented 10/13/2026, 1:20:01 PM

Decision (Seth, 2026-10-13): the AdditionRef-Swamp-Extension-Exception addition is not needed. The Swamp Extension and Definition Exception is a permission from Swamp's copyright holders that lets anyone write their own extensions and license them as they choose. It is not a license an extension declares: third-party extensions declare their own license (MIT, Apache-2.0, ...), and first-party @swamp extensions declare plain AGPL-3.0-only (#3325).

For #3328: the docs do not need to describe a Swamp exception form for license:. They can say the exception is what lets authors choose their own license, and that the license: field names that license.

skunk-ape commented 10/13/2026, 1:35:00 PM

Correction to the note above: first-party @swamp extensions declare AGPL-3.0-or-later, not AGPL-3.0-only (Seth, 2026-10-13). The decision that AdditionRef-Swamp-Extension-Exception is not needed is unchanged.

stack72 commented 10/14/2026, 12:48:43 AM

Already covered by 2bd1ebdc: how-to/extensions/declare-a-license says a license is optional, only SPDX ids count, and the field and LICENSE file each earn a point. Nothing about hiding, refusal or day 60 remains in the manual.

Flaky: worker_enroll_phase_telemetry_test asserts the order of a lookup's definition_scan spans

@swamp/cloudflare/analytics README documents CRUD methods the GraphQL analytics model does not have

swamp extension source add rejects a relative direct-content path that works as an absolute path

swamp hangs silently when an extension source directory contains the swamp repo itself

Inbox: automatic points message when a quest season or double-points event starts

Inbox: automatic issue_update message when a Lab issue ships

Inbox sending: segments, a per-user limit of 3 messages per 24 hours, and terminal preview

Datastore v3: data writes the datastore filter keeps local are never fsynced

Docs: doctor datastores reference — unreadable data version check and repair (swamp-club#3955)

extension quality: a collective-attested private repository scores provisional, and --json omits ifProvisionalEarned

doctor datastores --repair --json prints two JSON documents instead of one

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

access can-i: evaluate a local grants file without --server

Show each method's kind in type describe --json

Team mode: serve sends the compacted base, so a serve-mode checkout can catch up past compaction

Support search and filters as URL query parameters on /extensions

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

Five Mongo queues can hand the same row to two replicas

Docs: run-workflows-on-a-schedule tells readers to curl /health for queue state, which no longer lists schedules

Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

Rescore every extension's current version under rubric v5

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

A long-lived serve client for extensions, and a stable rate_limited error code

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

Support creating 1Password vaults for new clients

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

Generated state schemas require every child of nested objects, so normal resources warn on create/get

Add LinkedIn as a login provider

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

Showcase editor: caption counter is not announced to screen readers

Profile showcase read: approved list sorts on review.reviewedAt in memory

Showcase countByStatus: $match live statuses before the $group

Showcase admin queues: index-serve the updatedAt sort on approved/rejected

Annotate and retain past workflow runs and data after the fact

Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

Extension registry page: a supported way to include media (images) in the README

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

vary/forEach object values with no key/name/id produce data names Windows refuses

issue-lifecycle start drops issue comments: context.comments is always empty

swamp core: a non-string sensitive value reads back as a JSON string

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

extension install and extension pull leave different bundles for the same extension version

Registry drops contentMetadata.extensions (method grafts) at confirm-push

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

Workflow run cancellation on concurrency-key conflict

Read non-string sensitive resource fields back with their type

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

extensions_search index is never created if the first attempt fails, until the process restarts