Lab #4728: swamp start: make Swampify opt-in while it is experimental

Problem

Swampify is experimental, but swamp start now offers it to everyone. #4705 and #4713 put a "Start from your past sessions" card at the top of the workspace screen. It shows whenever Claude Code or Codex history is found on the machine (showPastSessions in packages/dashboard/src/views/start/helpers.ts), and it launches a swampify kick-off task. This shipped in builds from v20261113.125428.0 onwards. We want a few community testers to try it without new users meeting it by default.

Decision

Swampify in swamp start is opt-in. It is off unless the person turns it on. Turning it on is unadvertised: it's not in --help, the start screen or the manual. We tell testers how directly.

Proposed switch: an environment variable, SWAMP_EXPERIMENTAL_SWAMPIFY=1. It covers both swamp start and the server it runs, and it persists in a tester's shell. A flag on swamp start (hidden from help) or a query parameter on the start page are the alternatives. The analysis pass settles which, with Seth.

Proposed change

When the switch is off, swamp start doesn't show the "Start from your past sessions" card. The start server also refuses a swampify launch, so the switch isn't a client-side hide only.
When it's on, everything behaves as it does today.
The dashboard's Swampify page is unchanged. It shows only once a candidate set exists, which means the person has run the swampify skill themselves. Briefs keep their page link.
Update design/surfaces/start.md and design/surfaces/swampify.md to say the start entry point is experimental and opt-in, and how to turn it on.

Done when

With no switch set, swamp start shows no Swampify card on a machine with Claude Code or Codex history, and a direct swampify launch request is refused.
With the switch on, the card and the kick-off work as they do today.
Tests cover both states, at the start server and in the dashboard.
Help text, the start screen and the manual don't mention the switch.

Out of scope

Hiding the dashboard Swampify page or the @swamp/agent-sessions skill. Promoting Swampify out of experimental.

Document trusted telemetry endpoint and authentication semantics

Docs: vault manual says legacy vault type names are automatically mapped, but vault create and migrate refuse them

Docs: reaching swamp start and swamp dashboard from another machine (--host)

Team mode: a member's or serve's copy is never slow to become usable (recovery, serve boot, catch-up after idle or compaction, login reset) — cost proportional to change, never to datastore size

ABAC support in @swamp/aws-sm

Docs: automatic continuation of interrupted runs in swamp serve (autoContinue)

serve: let methods act on swamp-club as the user who started the run (on-behalf-of token exchange)

@swamp/video: generate intro and bed music sized to the take (ElevenLabs first; Suno once its API is open)

@swamp/video/obs: add the brand stage to an existing OBS scene, with the webcam ring and mask optional

Docs: show the guard result on guarded skipped lines in make-workflows-idempotent

swamp behavior type rename: move a behavior type's data, outputs and catalog rows to a new type name

swamp issue: choose the target collective and control issue visibility -- at filing time and afterward -- from the CLI (with a settable default)

Render <details>/<summary> in serve's report view

stagecraft DESIGN.md: say the stored-as-received check catches only a redacted secret, and --literal-inputs is what stops evaluation

Lazy loading: delete compile.ts --no-bundle once a Deno version bump has shipped bundled

stagecraft: dispatch prompts read injected products by latest record, not the version the run indexed

Respect dependency versions pinned with extension pull dep@version

Find a working-directory Swamp repo even with `SWAMP_SERVE_URL` in the environment

Scheduled flaky-test detection is failing

datastore setup extension over serve: resolve --config expressions with per-caller authorization

serve: add a fitness test so no serve route is added under the /hooks/ webhook route-file prefix

Audit OAuth client deletion

Collective-registered OAuth clients can't complete authorization_code: redirect URIs are stored as a JSON array string

software-factory: a work item whose slug extends another's reads the other's records

Extension versions: print one spelling in log output (drop the v prefix in list, outdated, update, search)

Ambient tags: set tags once per repo/worktree (env or .swamp), add them to every run and everything downstream, filter run history by tag

Allow editing recent feed submissions

No way to add or switch to password login on an account created with SSO

Native interactive report views in the dashboard, with scoped workflow refresh

Expose a manual_approval gate's decision identity (decidedBy) to workflow expressions

data query rejects CEL list macros: exists(c, ...) fails with Unknown field "c"

A workflow run keeps every step's resource contents in memory, so a large forEach fan-out can exhaust the heap

Image factory: golden GCE and Docker base images built on ops

swamp data get and data versions report Behavior not found for data whose behavior definition was deleted

Workflow-scoped data get reports the behavior id as modelName once the behavior definition is deleted

Slackwater: let customers build integrations that drive workflows securely and auditably

Container run inspection and isolation metadata for audited recovery tests

swamp serve: apply config changes without failed requests (full reload, vault-backed webhook secrets, harmless restarts)

stagecraft tracker: tidy up external relations (duplicate entries, id case, second lookup)

SWAMP_SERVER_TOKEN does not authenticate with --server, while --token and SWAMP_SERVER_TOKEN_FILE do

Terminal title should be conversation summary

@swamp/issue-lifecycle: collapse the verification_passed, post_attestation, link_pr sequence

@swamp/issue-lifecycle: one-call verification

audit: register legitimate non-swamp commands as approved bypasses

Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

swamp skill: add a workspace guide and routing-table entry

serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request

serve OAuth client reuse: remaining review findings from swamp-club#4264

serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire

Relationships

#4728 swamp start: make Swampify opt-in while it is experimental

Problem

Decision

Proposed change

Done when

Out of scope

Shipped