Lab #3821: Docs: define the sensitive-output fallback vault order and document the doctor vaults fallback warning

What changed

swamp-club#3805 (swamp PR #3322) documented in the swamp repo which vault the sensitive-output fallback picks, and added a doctor vaults warning for it. The manual does not describe either yet.

When a sensitive output names no vault (no field, data output override or spec vaultName) and no default vault is in effect, swamp stores it in the first user vault, ordered by vault type, then by vault id. That is the order of swamp vault list. It is not creation order, and it is not lowest id across all vaults: an @-scoped extension vault type such as @swamp/1password sorts before local_encryption. That order replaced filesystem listing order in swamp-club#3067, so repos with several vaults and no defaultVault could see their secrets move to a different vault after an upgrade.

Pages to update

content/manual/reference/vaults.md, "Vault Resolution Order". Step 4 says "First available vault from the vault service (backwards-compatible fallback)". Replace it with the defined order (vault type, then id, as swamp vault list shows), and recommend setting defaultVault in any repo with more than one vault. "Each level takes precedence…" can stay.
content/manual/reference/repository-configuration.md, the defaultVault section. "When not set, Swamp falls back to the first available vault" should say which vault that is (as above) and point to swamp doctor vaults. It could also note that swamp repo upgrade never adds defaultVault, so repos created before repo init started setting it rely on the fallback.
content/manual/reference/doctor.md, "doctor vaults". Document the new advisory warning and its optional JSON field fallbackWarning:
- When it appears: two or more user vaults, no default vault in effect (defaultVault unset, or naming a vault that is not registered), and at least one definition whose sensitive outputs rely on the fallback. Workflow-step dataOutputOverrides are not considered.
- Fields: fallbackVault (the vault those outputs are stored in), userVaults (all user vaults in fallback order), definitions (each with definitionId, definitionName, type), and unregisteredDefaultVault (only when defaultVault names a vault that is not registered).
- The warning does not change overallStatus or the exit code. In log mode the pass line ends with , 1 warning and a yellow block follows it.

Source of truth

design/primitives/data.md and design/enablers/doctor-vaults.md ("Fallback vault warning") in the swamp repo
src/domain/models/sensitive_output_vault.ts (resolveSensitiveOutputVault, reliesOnVaultFallback)
src/libswamp/models/doctor_vaults.ts (VaultFallbackWarning)

swamp update downloads before failing in a sticky directory with another user's binary, and blames an immutable flag

Docs: define the sensitive-output fallback vault order and document the doctor vaults fallback warning

scanFleet: support a different SSH user per host (user@host entries)

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

@swamp/cve/dirtyfrag: scan flags suspicious XFRM SAs on every unprivileged Linux scan (greps 'error' in /proc/net/xfrm_stat counter names)

Homepage club plate link has no visible keyboard focus

forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names

extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

Docs: dashboard Approvals view shows run context, reason and per-viewer decide state

Scheduled flaky-test detection is failing

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling

@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

Docs: extra-headers how-to systemd snippet puts a path in SWAMP_SERVE_EXTRA_HEADERS

CVE pages: horizontally scrolling code blocks are not keyboard-reachable

typed-secrets 4.6: turn the typed path on for every entry point, remove the internal option, and delete the regular-expression rewrite, the value search and the plaintext resolution of tagged fields

typed-secrets 4.5: the inline resolutions refuse or mask: placement, task selectors, child references and deferred targets refuse secrets, assert messages mask them, and the deprecated resolvers go

Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)

Docs: extension manual pages describe push and quality resolving only the deno.json import map

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

vary/forEach object values with no key/name/id produce data names Windows refuses

issue-lifecycle start drops issue comments: context.comments is always empty

swamp core: a non-string sensitive value reads back as a JSON string

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

extension install and extension pull leave different bundles for the same extension version

Registry drops contentMetadata.extensions (method grafts) at confirm-push

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

Workflow run cancellation on concurrency-key conflict

Read non-string sensitive resource fields back with their type

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

extension pull: safety analysis scans the bundle the extension runs

Relationships

#3821 Docs: define the sensitive-output fallback vault order and document the doctor vaults fallback warning

What changed

Pages to update

Source of truth

Open