datastore setup migration relocates and deletes repo-root .swamp/secrets, breaking all local_encryption vault.get

The denormalized Extension.contentTypes field is maintained by Extension.recordNewVersion (lib/domain/extension/extension.ts:439), which overwrites _contentTypes unconditionally on every push regardless of release channel. recordChannelLatest and the yank recalculation paths never recompute it. As a result the field is effectively last-push-wins across all channels, and can advertise a content type that only exists in a prerelease (rc/beta) version or in a since-yanked version — not in the current stable extension.

The registry content-type search filter uses this field directly (MongoExtensionRepository, $in on contentTypes), so filtering the registry by e.g. reports can surface an extension whose stable/displayed version has no reports.

Context

This was found while fixing issue #647 (the extension-page header nav rendered a dead REPORTS anchor from the same denormalized field). That fix made the page nav derive from the displayed version's actual content (deriveSectionNav(latestVersion)), which sidesteps the divergence for the UI. The search-filter field was intentionally left out of scope and still has the underlying staleness.

Steps to reproduce

Publish a stable extension version with no reports.
Publish a later rc/beta version that adds a report (scope: workflow).
extension.contentTypes now includes reports while latestVersion (stable) has none.
Filter the registry by the reports content type — the extension appears, though its stable version has no report.

Possible directions

Recompute contentTypes as the union (or stable-only projection) across the relevant channel state on every push/yank/promotion, rather than blindly overwriting with the latest push.
Or define contentTypes explicitly as a stable-channel projection and recompute it in recordChannelLatest/yank paths.

Environment

swamp-club app (Deno Fresh 2), lib/domain/extension/extension.ts, lib/infrastructure/mongo-extension-repository.ts. Follow-up to #647.

02Bog Flow

Open

6/13/2026, 5:02:47 PM

No activity in this phase yet.

03Sludge Pulse

datastore setup migration relocates and deletes repo-root .swamp/secrets, breaking all local_encryption vault.get

Registry content-type search filter can match versions absent from the displayed extension

Docs: document reports.require failure semantics in the manual (unresolvable required report fails the run)

Reports tab on extension page is non-functional

vault read-secret mixes log output into stdout

Resource-leak test failures on main: extension_rubric_scorer_test and worker_gateway_test

Landing page clips the curl install command instead of rendering the full text

model delete --json output shape doesn't match the documented {deleted, modelId, modelName, artifactsDeleted}

model search --json returns a bare model object instead of {query, results} when exactly one model matches

Extension author gitignore guidance: add .swamp.yaml and CLAUDE.md to recommended excludes

reports.require in workflow YAML does not auto-execute pulled extension reports

Yanked extension version still shown as active on swamp-club.com and in 'extension search'

Add deprecate/yank/unyank actions for own extensions on the web interface

Expose per-run memory/CPU metrics for method & workflow executions

model method run OOMs at 4GB V8 heap on long high-fan-out methods; non-configurable heap + crash leaves run stuck in "running"

Tier-up announcements never fire for direct score contributions (badge awards, feed credits)

CI never runs the discord-bot service test suite

Discord role sync never assigns lower leaderboard tiers (Swamp Baby / Muck Runt / Sludge Whelp)

Docs: document globalArgument input reference validation in workflow validate

Remote execution: UAT coverage for tokens, enrollment, and dispatch

Remote execution: comprehensive reference documentation

doctor extensions: pulled-extension source files reported as orphans that --repair can't evict (nested @swamp/aws/* sibling mis-attribution)

Channel-based publishing for local extension backports

Feature: make extension yank channel-scoped (--channel) so it doesn't nuke every channel

swamp update --setup-auto does not work with bluefin44 (crontab not found, should

Feature: demote / withdraw an extension version from the stable channel

Docs: extension-publish skill guide doesn't cover release channels

workflow validate: resolve model globalArguments expressions against the calling workflow's declared inputs

Add a way to list registered report definitions (report search only lists results)

Inconsistent resource-field accessor: data get returns content, data query and CEL use attributes

Extension API: allow export const extension to add resource specs, or document that it cannot

@swamp/aws/cloudformation: expose StackSet instances, drift, and operations (Cloud Control cannot)

workflow validate: method args with a Zod .default() are treated as required

Profile months overlap in trajectory

model type describe --json: bloated output (40% duplicated specs, no compact mode) and lost method-to-output mapping drive agents to read extension source

UAT: Release channel CLI and adversarial tests

Docs: Add release channel documentation to the manual

Test skill evals with Fable in multi-skill eval tests

Guide users toward filing feature requests when @swamp extensions lack a needed capability

Guide users toward filing feature requests when @swamp extensions are missing features

correcting capitlization of Swamp, Swamp Club, and The Swamp on the swamp-club.com website

API: Add release channel support for extension versions (beta, rc, stable)

Add @swamp/hetzner-cloud/server-types model for availability and project limits

Resident/warm worker mode — `model method run` has ~6s fixed per-invocation overhead that rules out latency-sensitive use

Issue submission returns wrong URL path

Dynamic resource attribute refresh for model instances

`vault put` inside workflow steps still acquires global `.datastore.lock` after #382

extension quality scorer mis-detects quoted phrases in comments as bare imports

extension push: credentials-sensitive-field false positive when .meta({ sensitive: true }) is on a continuation line

Local source-loading should discover a report co-located with its model in a paths.base:manifest extension

extension push: optionally sync the published bundle to the manifest `repository:` (git mirror)

Add 'creek' extension kind for cross-querying external systems alongside swamp data

Docs: vault refresh hooks (--refresh-from, --refresh-ttl, --clear-refresh)

Support CI-friendly adversarial review artifacts for extension push

Deprecate "No slow types" (fast-check) rubric factor on server-side scorer

Registry scorer fails on bare specifiers — mirror CLI fix from #505

Official extension for GitHub repository configuration (environments, variables, secrets)

Feature request: @swamp/tailscale extension

Option to change email in your Swamp Club profile or delete account

Docs: vault reference in manual promotes inline KEY=VALUE as primary example

extension push error for disallowed file types doesn't mention binaries field

swamp help extension omits yank and unyank (machine-readable CLI schema misses real subcommands)

Extension model method execute lacks typed args/context — every author has to use ': any' to unblock tests

@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

workflow resume fails to register all extension model types (local and pulled) — "Unknown model type"

model method run: cannot pass arrays, numbers, or booleans via --input

extension push --dry-run --json reports local helper imports as bogus model entries

Extension source: direct-content export scan only reads first 64 KiB, silently drops exports beyond it

Homepage install command: wrong domain and missing https:// protocol

Homepage install command: wrong domain and missing https:// protocol

first-class refresh hook for short-lived vault values (gcloud / aws-sso / kubectl-oidc token UX)

swamp issue ripple logged "Posted ripple on issue #514" but the ripple is not visible on the Lab

vault guide promotes inline secret values (KEY=VALUE) as a primary "swamp vault put" example

swamp-getting-started SKILL.md still references removed swamp-model / swamp-workflow / swamp-vault / swamp-extension / swamp-repo skills

extension rm blocked by stale /workspace bundle_types rows from prior container sessions with host repo bind-mounted

extension search returns null repository fields that extension info populates

Quality rubric: scope "No slow types" for model extensions (consumed via model+CEL, not type imports)

data get/list --workflow and workflow history get/logs cannot resolve extension-delivered workflows (Workflow not found)

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

UAT: sensitive resource output without vault produces clear pre-flight error