Docs: choosing where a new workspace is created (--path, start page Location field, workspaces.dir)

8m ago

#3446

Docs: serve-flags.md admin/allowed-user resolution is stale (pinned names, oauth:manage for lookups, plain usernames only)

59m ago

#3445

Activity scoring aliases only behavior run, not other swamp behavior subcommands

12h ago

#3425

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

16h ago

#3422

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

16h ago

#3417

Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)

17h ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

18h ago

#3405

serve keeps a worker whose enroll finished after the worker timed out, then refuses the real worker as "already connected" and dispatches into the dead session

18h ago

#3404

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

19h ago

#3402

literal() output in a step's inputs logs repeated Refusing to evaluate expression warnings

19h ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

19h ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

9h ago

#3395

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

17h ago

#3392

Registry scorecard: dependency licenses follow the CLI's SPDX rules

20h ago

#3391

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

s17h ago

#3390

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

20h ago

#3385

bundle freshness ignores local modules outside the kind directory

21h ago

#3384

extension pull: shared sources at the archive root are not installed

21h ago

#3383

extension pull: safety analysis scans the bundle the extension runs

21h ago

#3382

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

21h ago

#3381

Registry UI and manual say Behaviors, keeping the stored models content type

21h ago

#3378

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

21h ago

#3377

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

22h ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

21h ago

#3361

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

1d ago

#3354

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

1d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

1d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

1d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

20h ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

1d ago

#3342

Rescore scores the newest version, but the scorecard reads the stable one

1d ago

#3313

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

1d ago

#3311

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

1d ago

#3305

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

1d ago

#3298

swamp-uat: the SIGTERM drain test does not check that the run succeeded

1d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

2d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

2d ago

#3280

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

2d ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

2d ago

#3231

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

3d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

3d ago

#3214

Show wait keys and pending signals to remote clients and the dashboard

5d ago

#3208

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

5d ago

#3204

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

5d ago

#3198

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

5d ago

#3193

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

5d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

6d ago

← Back to list

01Issue

FeatureOpenSwamp CLIPublic

Assigneesskunk-ape

Relationships

#3391 extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

Opened by skunk-ape · 10/13/2026

Split out of #3350 (Seth, 2026-10-13) so the rest of the dependency trust plan doesn't wait on the license work. Plan: Extension dependency trust plan (https://claude.ai/code/artifact/c333312a-ca26-4056-a7f2-cabd7f30457c).

Problem

The push gate reads dependency licenses with parseSpdxLicense/licenseAllowed (src/domain/extensions/extension_dependency_trust_checker.ts). Both split the expression and require every term to be allowed, so MIT OR GPL-3.0 fails even though MIT is allowed. A WITH exception is split wrongly too.

Change

Use the SPDX expression parser from #3324 (src/domain/licensing/spdx_expression.ts), with the existing 9-entry allowlist as the policy.
OR passes if any branch is allowed, AND needs every term, and WITH judges the base license.
A missing license is a warning.
Add a shared test-vector file of expressions and verdicts, which the registry side (the companion swamp-club issue) also reads.

Depends on

#3324 merged (the parser).

Acceptance

Unit tests over the vectors.
UAT: an OR license verdict at push. The test skips itself until the binary has the capability.

02Bog Flow

Open

10/13/2026, 7:51:22 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

skunk-ape assigned skunk-ape10/13/2026, 10:23:41 PM

skunk-ape commented 10/13/2026, 10:50:31 PM

Parked (Seth, 2026-10-13).

Why: the dependency license check only warns, and those warnings never block a push (they print outside the warnings gate). The plan never makes the license check an error. The current split also errs only toward warning: compound SPDX expressions with an allowed branch (MIT OR GPL-3.0, Apache-2.0 WITH LLVM-exception) warn wrongly, but nothing passes that should warn. npm does not enforce SPDX either: missing, free-text and SEE LICENSE IN values warn before and after this change. So the fix only removes false warnings for compound expressions, which a small sample suggests are a minority of dependencies.

Decisions already made, for whoever picks this up:

Uppercase AND/OR/WITH before parsing, so lowercase operators stay accepted as they are today.
Match license ids against the allowlist ignoring case.
Read an array license value (legacy licenses: [{type}]) as an OR of its types. Keep reading the {type} object as today.
Warnings: a disallowed license keeps license "X" not in allowlist. A missing license gets its own message (no license declared). A value that does not parse gets a "not an SPDX expression" message. UNLICENSED stays under "not in allowlist".
Move the 9-entry allowlist into a JSON file in src/domain/licensing/, alongside the shared test vectors, so swamp-club copies one allowlist the way it copies the SPDX lists.

Open, unanswered: how the UAT controls a dependency's license offline. A proposal was to read NPM_CONFIG_REGISTRY in the trust check (swamp-uat#665). Undecided.

Docs: choosing where a new workspace is created (--path, start page Location field, workspaces.dir)

Docs: serve-flags.md admin/allowed-user resolution is stale (pinned names, oauth:manage for lookups, plain usernames only)

Manual: working-with-data copy button copies a truncated data query

Extension push: a range dependency is sent to OSV as the range, not a version

Docs: manual quotes model wording that swamp-club#3437 changes to behavior

Activity scoring aliases only behavior run, not other swamp behavior subcommands

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

serve keeps a worker whose enroll finished after the worker timed out, then refuses the real worker as "already connected" and dispatches into the dead session

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

literal() output in a step's inputs logs repeated Refusing to evaluate expression warnings

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

Registry scorecard: dependency licenses follow the CLI's SPDX rules

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

bundle freshness ignores local modules outside the kind directory

extension pull: shared sources at the archive root are not installed

extension pull: safety analysis scans the bundle the extension runs

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

Registry UI and manual say Behaviors, keeping the stored models content type

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

Registry scorecard: audit the dependency version that ships, and JSR dependencies

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

extensions_search index is never created if the first attempt fails, until the process restarts

Rescore scores the newest version, but the scorecard reads the stable one

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

swamp-uat: the SIGTERM drain test does not check that the run succeeded

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

Show wait keys and pending signals to remote clients and the dashboard

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

Relationships

#3391 extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

Problem

Change

Depends on

Acceptance

Open