Docs: choosing where a new workspace is created (--path, start page Location field, workspaces.dir)

6m ago

#3446

Docs: serve-flags.md admin/allowed-user resolution is stale (pinned names, oauth:manage for lookups, plain usernames only)

56m ago

#3445

Manual: working-with-data copy button copies a truncated data query

1h ago

#3444

Dashboard: a live run page polls a full workflow.run.search every 2.5 s, and time-range presets refetch the run summary every minute

hjust now

#3439

Extension push: a range dependency is sent to OSV as the range, not a version

3h ago

#3438

Docs: manual quotes model wording that swamp-club#3437 changes to behavior

4h ago

#3432

Activity scoring aliases only behavior run, not other swamp behavior subcommands

11h ago

#3425

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

16h ago

#3422

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

16h ago

#3417

Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)

17h ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

18h ago

#3405

serve keeps a worker whose enroll finished after the worker timed out, then refuses the real worker as "already connected" and dispatches into the dead session

18h ago

#3404

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

18h ago

#3402

literal() output in a step's inputs logs repeated Refusing to evaluate expression warnings

19h ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

19h ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

9h ago

#3395

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

17h ago

#3392

Registry scorecard: dependency licenses follow the CLI's SPDX rules

20h ago

#3391

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

s17h ago

#3390

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

20h ago

#3385

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

21h ago

#3381

Registry UI and manual say Behaviors, keeping the stored models content type

21h ago

#3378

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

21h ago

#3377

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

22h ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

21h ago

#3361

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

1d ago

#3354

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

1d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

1d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

1d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

20h ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

1d ago

#3342

Rescore scores the newest version, but the scorecard reads the stable one

1d ago

#3313

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

1d ago

#3311

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

1d ago

#3305

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

1d ago

#3298

swamp-uat: the SIGTERM drain test does not check that the run succeeded

1d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

2d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

2d ago

#3280

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

2d ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

2d ago

#3231

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

3d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

3d ago

#3214

Show wait keys and pending signals to remote clients and the dashboard

5d ago

#3208

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

5d ago

#3204

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

5d ago

#3198

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

5d ago

#3193

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

5d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

6d ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

6d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

7d ago

#3103

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

7d ago

#3073

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

8d ago

← Back to list

01Issue

FeatureOpenSwamp ClubPublic

AssigneesNone

Relationships

#3353 Registry scorecard: audit the dependency version that ships, and JSR dependencies

Opened by skunk-ape · 10/13/2026

Part D (#3353, release 2, swamp-club) of the extension dependency trust plan (#3350–#3354). Plan: Extension dependency trust plan (https://claude.ai/code/artifact/c333312a-ca26-4056-a7f2-cabd7f30457c).

Change

The registry scorer reads deprecation, license and maintainers from the audited version, not latest.
It audits JSR dependencies: exists, not yanked.
The registry can't run deno info, so it uses the archive's lockfile when present, and otherwise the declared specifier as today. Say which in the scorecard finding.

Depends on

#3351.

Acceptance

Unit tests mirroring #3352's cases, where they apply.
Club UAT: scorecard findings for a deprecated pin and a missing JSR version.

02Bog Flow

Open

10/13/2026, 2:31:22 PM

No activity in this phase yet.

03Sludge Pulse

system commented 10/13/2026, 2:31:22 PM

Classified automatically when this issue was filed.

Source: Swamp Club

If you feel this classification is incorrect, add a ripple to tell us so.

Docs: choosing where a new workspace is created (--path, start page Location field, workspaces.dir)

Docs: serve-flags.md admin/allowed-user resolution is stale (pinned names, oauth:manage for lookups, plain usernames only)

Manual: working-with-data copy button copies a truncated data query

Dashboard: a live run page polls a full workflow.run.search every 2.5 s, and time-range presets refetch the run summary every minute

Extension push: a range dependency is sent to OSV as the range, not a version

Docs: manual quotes model wording that swamp-club#3437 changes to behavior

Activity scoring aliases only behavior run, not other swamp behavior subcommands

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

serve keeps a worker whose enroll finished after the worker timed out, then refuses the real worker as "already connected" and dispatches into the dead session

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

literal() output in a step's inputs logs repeated Refusing to evaluate expression warnings

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

Registry scorecard: dependency licenses follow the CLI's SPDX rules

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

bundle freshness ignores local modules outside the kind directory

extension pull: shared sources at the archive root are not installed

extension pull: safety analysis scans the bundle the extension runs

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

Registry UI and manual say Behaviors, keeping the stored models content type

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

Registry scorecard: audit the dependency version that ships, and JSR dependencies

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

extensions_search index is never created if the first attempt fails, until the process restarts

Rescore scores the newest version, but the scorecard reads the stable one

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

swamp-uat: the SIGTERM drain test does not check that the run succeeded

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

Show wait keys and pending signals to remote clients and the dashboard

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

Relationships

#3353 Registry scorecard: audit the dependency version that ships, and JSR dependencies

Change

Depends on

Acceptance

Open