Lab #3516: swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk

scripts/eval_skill_triggers_promptfoo.ts (line 378) runs npm install --package-lock=false for promptfoo. That produced 1.7 GB of node_modules plus a 578 MB npm cache when measured, about 3.0 GB peak for the eval job with setup-node and setup-deno.

About 900 MB of it is native SDKs that promptfoo 0.122.0 lists as optional dependencies, such as the Claude agent SDK and the OpenAI Codex SDK. The eval only uses the anthropic:messages, openai: and google: providers (evals/promptfoo/generate_config.ts, lines 45 to 70).

Proposed:

install with --omit=optional;
point the npm cache at a temp directory and delete it after the install.

Risk to check first: the google: provider may rely on an optional package (possibly google-auth-library). Run the eval once with each provider before relying on the change, and add back only what is needed as an explicit dependency.

Context: disk-limited CI runners evicted jobs at 1 GiB (swamp-club #3174). This job runs on GitHub-hosted runners today, so this is about headroom and speed, not a current failure.

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

Remote readResource does not apply the legacy schema fallback for untagged sensitive records

Remote resolveSecret allowlist is always empty for workflow steps that use vault.get

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk

swamp install.sh: holds three copies of the binary at once (~913 MB peak); delete the archive and move instead of copy

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

Docs: manifest reference still describes the removed indexer symlinks directory for workflow resolution

Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case

Workflow run cancellation on concurrency-key conflict

Read non-string sensitive resource fields back with their type

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

Registry scorecard: dependency licenses follow the CLI's SPDX rules

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

extension pull: safety analysis scans the bundle the extension runs

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

Registry scorecard: audit the dependency version that ships, and JSR dependencies

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

extensions_search index is never created if the first attempt fails, until the process restarts

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

swamp-uat: the SIGTERM drain test does not check that the run succeeded

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

swamp-extensions CI: Review Integrity audit stalls silently on a large trust-root change until Forgejo kills the job

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

Decide a stricter naming rule for workflow step and job names

digitalocean codegen leaves an orphaned security_secret.ts model file after its endpoint left the spec

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt

Relationships

#3516 swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk

Open