Docs: choosing where a new workspace is created (--path, start page Location field, workspaces.dir)

10m ago

#3446

Docs: serve-flags.md admin/allowed-user resolution is stale (pinned names, oauth:manage for lookups, plain usernames only)

1h ago

#3445

Activity scoring aliases only behavior run, not other swamp behavior subcommands

12h ago

#3425

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

16h ago

#3422

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

16h ago

#3417

Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)

17h ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

18h ago

#3405

serve keeps a worker whose enroll finished after the worker timed out, then refuses the real worker as "already connected" and dispatches into the dead session

19h ago

#3404

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

19h ago

#3402

literal() output in a step's inputs logs repeated Refusing to evaluate expression warnings

19h ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

19h ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

9h ago

#3395

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

17h ago

#3392

Registry scorecard: dependency licenses follow the CLI's SPDX rules

20h ago

#3391

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

s17h ago

#3390

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

20h ago

#3385

bundle freshness ignores local modules outside the kind directory

21h ago

#3384

extension pull: shared sources at the archive root are not installed

21h ago

#3383

extension pull: safety analysis scans the bundle the extension runs

21h ago

#3382

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

21h ago

#3381

Registry UI and manual say Behaviors, keeping the stored models content type

21h ago

#3378

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

21h ago

#3377

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

22h ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

21h ago

#3361

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

1d ago

#3354

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

1d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

1d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

1d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

20h ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

1d ago

#3342

Rescore scores the newest version, but the scorecard reads the stable one

1d ago

#3313

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

1d ago

#3311

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

1d ago

#3305

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

1d ago

#3298

swamp-uat: the SIGTERM drain test does not check that the run succeeded

1d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

2d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

2d ago

#3280

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

2d ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

2d ago

#3231

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

3d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

3d ago

#3214

Show wait keys and pending signals to remote clients and the dashboard

5d ago

#3208

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

5d ago

#3204

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

5d ago

#3198

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

5d ago

#3193

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

5d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

6d ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

6d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

7d ago

#3103

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

7d ago

#3073

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

8d ago

#3065

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

8d ago

#3060

Decide a stricter naming rule for workflow step and job names

7d ago

#3041

digitalocean codegen leaves an orphaned security_secret.ts model file after its endpoint left the spec

8d ago

#3010

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Team9d ago

← Back to list

01Issue

BugOpenSwamp ClubPublic

AssigneesNone

Relationships

#3342 Rescore scores the newest version, but the scorecard reads the stable one

Opened by skunk-ape · 10/13/2026

POST /api/v1/extensions//score (the Rescore button) enqueues getLatestNonYankedVersion(), the newest version on any channel. The scorecard, the extension page and the listing's license flag all read resolveScorecardVersion(): latest stable, falling back to rc and then beta.

When an extension's newest version is an rc or beta ahead of its stable, Rescore analyses the prerelease. The scorecard keeps reading the stable version, which may never have been scored, and keeps reporting not_scored. With unlicensed extensions now hidden from browsing (an unknown license counts as hidden), such an extension can't be brought back by pressing Rescore.

Reproduced locally on the seeded @swampadmin/container-runtime (stable 2026.02.15.0, newer 2026.03.15.0): Rescore wrote extension_version_meta for 2026.03.15.0, and the score API still returns available:false, reason:not_scored.

Fix: have handlePostScore score resolveScorecardVersion(ext), or both versions when they differ.

Found while working on Lab 3323; none of the 31 currently unscored public extensions on prod is affected.

02Bog Flow

Open

10/13/2026, 2:29:11 AM

No activity in this phase yet.

03Sludge Pulse

system commented 10/13/2026, 2:29:11 AM

Classified automatically when this issue was filed.

Source: Swamp Club

If you feel this classification is incorrect, add a ripple to tell us so.

Docs: choosing where a new workspace is created (--path, start page Location field, workspaces.dir)

Docs: serve-flags.md admin/allowed-user resolution is stale (pinned names, oauth:manage for lookups, plain usernames only)

Manual: working-with-data copy button copies a truncated data query

Extension push: a range dependency is sent to OSV as the range, not a version

Docs: manual quotes model wording that swamp-club#3437 changes to behavior

Activity scoring aliases only behavior run, not other swamp behavior subcommands

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

serve keeps a worker whose enroll finished after the worker timed out, then refuses the real worker as "already connected" and dispatches into the dead session

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

literal() output in a step's inputs logs repeated Refusing to evaluate expression warnings

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

Registry scorecard: dependency licenses follow the CLI's SPDX rules

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

bundle freshness ignores local modules outside the kind directory

extension pull: shared sources at the archive root are not installed

extension pull: safety analysis scans the bundle the extension runs

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

Registry UI and manual say Behaviors, keeping the stored models content type

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

Registry scorecard: audit the dependency version that ships, and JSR dependencies

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

extensions_search index is never created if the first attempt fails, until the process restarts

Rescore scores the newest version, but the scorecard reads the stable one

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

swamp-uat: the SIGTERM drain test does not check that the run succeeded

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

Show wait keys and pending signals to remote clients and the dashboard

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

Decide a stricter naming rule for workflow step and job names

digitalocean codegen leaves an orphaned security_secret.ts model file after its endpoint left the spec

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Relationships

#3342 Rescore scores the newest version, but the scorecard reads the stable one

Open