Lab #3350: extension push: report dependencies whose lookup failed as not audited

Part A (#3350, release 1, swamp) of the extension dependency trust plan (#3350–#3354). Plan: Extension dependency trust plan (https://claude.ai/code/artifact/c333312a-ca26-4056-a7f2-cabd7f30457c).

Problem

The push gate's dependency audit (src/domain/extensions/extension_dependency_trust_checker.ts) has a problem.

A failed lookup reads as a clean audit. An OSV error returns no vulnerabilities, and an unreachable npm marks the dependency passed with a "could not fetch" warning.

Change

"Not audited" is its own result. When OSV or npm can't be reached, the dependency is reported as not audited, with the reason, in the push and quality summary and in --json. It is never passed. --yes waives it like any warning, and it is always listed in the accepted-warnings record (Seth, 2026-10-13). The CLI rubric's dependency-trust point needs every dependency audited. This follows the pattern #3069 used for a failed version-drift lookup.

Dependency license rules moved to #3391 (Seth, 2026-10-13), which waits for #3324's parser. This issue no longer depends on #3324.

Depends on

Nothing. Can start now.

Acceptance

Unit tests: OSV down, npm down, both down.
No UAT item (Seth, 2026-10-13): a lookup failure cannot be forced from outside without endpoint overrides, and this change adds none.

Extension scoring audits v2 archives exact-only and charges unaudited code, in the package and the CLI alike

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

extension quality: a collective-attested private repository scores provisional, and --json omits ifProvisionalEarned

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

extension pull: safety analysis scans the bundle the extension runs

Extension scoring queue: two replicas can claim the same pending event

Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore

Five Mongo queues can hand the same row to two replicas

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

Score extensions with @swamp-club/extension-scoring (rubric v5) instead of the registry's own copy

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

Extension dependencies: one resolver for push, quality and fmt (no behaviour change)

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

Rescore every extension's current version under rubric v5

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

stagecraft studio: show a factory's open tickets that have no work item yet on the Board

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

A long-lived serve client for extensions, and a stable rate_limited error code

Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)

extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

method run masks a sensitive array from --input element by element, exposing its shape (regression from #3752)

Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments

Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)

main fails type check: query_view_test.ts passes a namespace string where expressionQueryView now takes a NamespaceReader (semantic conflict between #3790 and #3785)

forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names

extension push finds no local modules when a folder above the repo is named node_modules

extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)

Local verification docs still tell agents to put ANTHROPIC_API_KEY in verify.env for reviews

@swamp/cve/php-rce-2026-10 follow-ups: dry-run heading, command spelling, Debian 12 fix, podman image scan

extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes

extension fmt --check writes deno.lock in deno.json mode, which push and quality then bundle against with --frozen

@swamp/cve/dirtyfrag: scan logs are never saved (file writer handle dropped, data name collides with the status resource)

audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited

@swamp/cve/dirtyfrag README shows --input targetHost/sshUser/sshKey/dockerContainer, which the CLI rejects

@swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run

extension quality names the wrong cause: a bundle failure prints no reason, the not-audited row always blames an outage, and symbols-docs blames JSDoc when deno doc failed

Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)

Docs: extension dependency trust pages — import-map auditing, bare-import rewrite and scoring, and the clarified warning/error plan

Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Dependency trust scoring (CLI): yanked and loose specifiers cost one of the two dependency-trust points (no new push errors)

extension quality crashes with deno doc --json failed when a package.json-mode archive ships a bare import

Docs: extension publishing reference quotes stale bare-specifiers and quality messages

extension push: the yanked-dependency warning names a version to move to, and dependency warnings appear in the Unresolved warnings summary

Scorecard: copy the updated jsr-yanked wording from dependency_audit_vectors.json

Docs: extension publishing reference should describe the yanked-version suggestion and dependency findings in Unresolved warnings

eval-skill-triggers ignores evals/promptfoo/package-lock.json, so promptfoo's transitive deps are not locked

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

v3 outbox killed-writer test times out waiting for the kill point under CPU load

On Windows, v3 outbox tests time out on a writer lock held by a dead fake pid

extension push: rewrite bare imports in the shipped source to their import-map specifiers

Flaky: probeStartServer 'a closed port is dead' gets unknown under the parallel test run

workflow run --detach integration test fails under load: the run finishes before the test attaches

extension push: a deno.json scopes entry can make push ship and audit a different version than the extension resolves

Skill trigger evals run through claude -p so verify-skills works on a subscription login

On Windows, extension pull and rm report paths with mixed separators

Windows CI: data_writer vary-suffix test writes a data name with a double quote, which #3568 refuses on Windows

Docs: bare imports mapped by deno.json are rewritten on push and scored

vary/forEach object values with no key/name/id produce data names Windows refuses

Since #3569: Datastore UAT's extension install row and 17 Windows extension unit tests fail on every release

extension push: dependencies named only through a deno.json import map are never audited

extension push rewrites the author's deno.lock when bundling

codegen/vercel: union (oneOf) read responses produce id-only ResourceSchemas