Lab #4727: Document trusted telemetry endpoint and authentication semantics

Documentation surface

The canonical user documentation is the Swamp Club manual in the swamp-club site. This change belongs there, not in the CLI repository README.

Problem

The manual documents telemetryEndpoint resolution and separately documents that signed-in telemetry sends the active API key for attribution. It does not state their combined trust contract: authenticated telemetry sends that key to the resolved telemetry endpoint.

This is intentional for operator-controlled and in-prem telemetry collectors, but the trusted deployment boundary needs to be explicit.

Requested documentation

Update these existing manual pages:

content/manual/reference/repository-configuration.md, under telemetryEndpoint: identify it as trusted deployment configuration for an operator-controlled collector.
content/manual/reference/usage-telemetry-events.md, under Endpoint: state that the resolved endpoint is also the destination for the authentication header when telemetry is attributed.
content/manual/explanation/usage-telemetry.md, under Attribution: connect API-key attribution to the resolved endpoint and link to the endpoint reference.

Acceptance criteria

Document endpoint precedence: SWAMP_TELEMETRY_ENDPOINT, repository marker, localhost auto-detection, then the hosted default.
State that custom telemetry endpoints must be controlled by the trusted deployment operator.
State that signed-in telemetry forwards the active API key using the x-api-key request header to the resolved endpoint for attribution.
Provide guidance for organization-managed and in-prem telemetry collectors.
Clarify that repository telemetry configuration is trusted deployment configuration, not a security boundary intended for arbitrary public repository content.

Non-goal

This issue does not add origin restrictions. Any future credential-to-origin binding must support managed in-prem deployments without breaking authenticated telemetry.

Document trusted telemetry endpoint and authentication semantics

Docs: vault manual says legacy vault type names are automatically mapped, but vault create and migrate refuse them

Docs: reaching swamp start and swamp dashboard from another machine (--host)

Team mode: a member's or serve's copy is never slow to become usable (recovery, serve boot, catch-up after idle or compaction, login reset) — cost proportional to change, never to datastore size

ABAC support in @swamp/aws-sm

Docs: automatic continuation of interrupted runs in swamp serve (autoContinue)

serve: let methods act on swamp-club as the user who started the run (on-behalf-of token exchange)

@swamp/video: generate intro and bed music sized to the take (ElevenLabs first; Suno once its API is open)

@swamp/video/obs: add the brand stage to an existing OBS scene, with the webcam ring and mask optional

Docs: show the guard result on guarded skipped lines in make-workflows-idempotent

swamp behavior type rename: move a behavior type's data, outputs and catalog rows to a new type name

swamp issue: choose the target collective and control issue visibility -- at filing time and afterward -- from the CLI (with a settable default)

Render <details>/<summary> in serve's report view

stagecraft DESIGN.md: say the stored-as-received check catches only a redacted secret, and --literal-inputs is what stops evaluation

Lazy loading: delete compile.ts --no-bundle once a Deno version bump has shipped bundled

stagecraft: dispatch prompts read injected products by latest record, not the version the run indexed

Respect dependency versions pinned with extension pull dep@version

Find a working-directory Swamp repo even with `SWAMP_SERVE_URL` in the environment

Scheduled flaky-test detection is failing

datastore setup extension over serve: resolve --config expressions with per-caller authorization

serve: add a fitness test so no serve route is added under the /hooks/ webhook route-file prefix

Audit OAuth client deletion

Collective-registered OAuth clients can't complete authorization_code: redirect URIs are stored as a JSON array string

software-factory: a work item whose slug extends another's reads the other's records

Extension versions: print one spelling in log output (drop the v prefix in list, outdated, update, search)

Ambient tags: set tags once per repo/worktree (env or .swamp), add them to every run and everything downstream, filter run history by tag

Allow editing recent feed submissions

No way to add or switch to password login on an account created with SSO

Native interactive report views in the dashboard, with scoped workflow refresh

Expose a manual_approval gate's decision identity (decidedBy) to workflow expressions

data query rejects CEL list macros: exists(c, ...) fails with Unknown field "c"

A workflow run keeps every step's resource contents in memory, so a large forEach fan-out can exhaust the heap

Image factory: golden GCE and Docker base images built on ops

swamp data get and data versions report Behavior not found for data whose behavior definition was deleted

Workflow-scoped data get reports the behavior id as modelName once the behavior definition is deleted

Slackwater: let customers build integrations that drive workflows securely and auditably

Container run inspection and isolation metadata for audited recovery tests

swamp serve: apply config changes without failed requests (full reload, vault-backed webhook secrets, harmless restarts)

stagecraft tracker: tidy up external relations (duplicate entries, id case, second lookup)

SWAMP_SERVER_TOKEN does not authenticate with --server, while --token and SWAMP_SERVER_TOKEN_FILE do

Terminal title should be conversation summary

@swamp/issue-lifecycle: collapse the verification_passed, post_attestation, link_pr sequence

@swamp/issue-lifecycle: one-call verification

audit: register legitimate non-swamp commands as approved bypasses

Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

swamp skill: add a workspace guide and routing-table entry

serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request

serve OAuth client reuse: remaining review findings from swamp-club#4264

serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire

Relationships

#4727 Document trusted telemetry endpoint and authentication semantics

Documentation surface

Problem

Requested documentation

Acceptance criteria

Non-goal

Open