Spun out of #925's approved plan — the shadow-critical slice, kept separate so its parity gate gets undivided attention. Prerequisite: #927 (single-runner gate for the projector; both prod replicas currently run it and can double-grant same-day chunks — that race would poison this issue's parity validation).

Projector: full rescan → touched-set incremental (was #925 stage 5)

Every 60s tick, activity-asof-projector.sql (a) groups the entire all-history cli_daily rollup, (b) does FROM swamp.score_grants FINAL over every post-cutover grant (grant_type not pruned by the ORDER BY), (c) runs window CTEs over every user's full history. Cost grows linearly forever; will eventually blow the tick's 10-min timeout.

Plan:

CH migration: add last_seen SimpleAggregateFunction(max, DateTime) to swamp.cli_daily, populated by cli_daily_mv with max(now()) — ingest time, deliberately NOT max(created_at): the projector supports late-arriving events for old days ("late arrivals mint one more chunk"), and an event-time watermark would put a late arrival before the watermark and skip its chunk forever. Add a projector test for exactly this case. Ships via the clickhouse-migrations Job in giga-swamp (content-hash ConfigMap, Lab #859); infrastructure/clickhouse/init/02-score-grants.sql kept in lockstep.
activity-asof-projector.sql: add a touched CTE (distinct_ids with last_seen >= {WATERMARK}); scope the cli CTE to distinct_id IN touched (full backward history only for touched users — required for correct as-of streak/rolling windows) and the granted CTE the same way. Keep FINAL but scoped — distinct_id is the first ORDER BY column of score_grants, so this prunes by primary key. Do NOT build the SummingMergeTree granted-units table floated in #925: score_grants is a ReplacingMergeTree precisely so re-inserted deterministic grant_ids dedup; an insert-fed SummingMergeTree would double-count re-inserts and corrupt units_before.
activity-projector.ts: {WATERMARK} substitution with the same strict-validation pattern as {CUTOVER}; per-process watermark = previous tick start time; epoch on first tick (full pass, idempotent by design — a restart just does one expensive tick).
Parity gate before merge: as-of harness (mirror :8123 vs run DB :8133) — full-history pass and incremental pass must produce identical ledgers (same grant count, equal sums, matching grant_ids). Post-deploy: watch the prod shadow comparison board for drift.

swamp.events username bloom index (was #925 stage 7)

clickhouse-active-days-repository.ts filters swamp.events by username, but the only bloom filter is on distinct_id → full-table scan per user; backfill-score-grants.ts multiplies that by N operatives per pass.

Plan: ALTER TABLE swamp.events ADD INDEX on username (bloom_filter, same granularity as the distinct_id index) + MATERIALIZE INDEX over history, riding the same clickhouse-migrations batch as the projector change (a skip index is result-neutral, so it cannot muddy the parity gate). Leave the admin shadow board's three FINAL-over-ledger queries as-is (low frequency, admin-only); pre-aggregated owner-totals MV is the escape hatch if the board slows.

Full staging rationale, DDD analysis, and adversarial-review trail live in the #925 lifecycle.

02Bog Flow

Shipped

8/15/2026, 12:53:37 AM

No activity in this phase yet.

03Sludge Pulse

keeb assigned keeb8/14/2026, 10:04:57 PM

keeb linked related to #9257/2/2026, 9:57:19 PM

keeb linked blocked by #9277/2/2026, 9:57:23 PM

keeb marked as blocked7/2/2026, 9:57:23 PM

keeb unblocked automatically7/17/2026, 7:01:57 PM

Only documented non-interactive auth puts the password in argv; the safe SWAMP_API_KEY path is undocumented

Retyping a model instance strands catalog rows no command can reclaim — prune matches on model_id, delete resolves the current type (follow-up to #1009)

Docs: update cancel endpoint response statuses in REST API reference and workflows page

docs: update vault audit trail reference for write operation support

docs: document --dashboard flag for swamp serve

ExtensionWorkflowRepository scans manifest.yaml as a workflow, emitting 'Unknown key manifestVersion' warning

Relative path for custom agent skills setup doesn't provision skills

swamp serve daemon enable: add --dashboard flag

CLI writes runtime state (lastStalenessWarning) into tracked .swamp.yaml, dirtying a committed config file

extension install serializes files[] in readdir order, producing machine-dependent reorder diffs in upstream_extensions.json

Workflow YAML rewritten in place: block-scalar description truncated, file left unparseable, and validate still reports PASSED

workflow validate does not resolve modelType on factory-pattern steps — a non-existent extension validates clean

vault.get() arguments are verbatim, so a per-target secret cannot be expressed in workflow YAML

Cancellation/--timeout skips remaining steps including `completed`/`always` branches; --timeout waits for the in-flight subprocess

Remote "write-bearing" classification is inferred from data-plane writes, not declared; external side effects can be re-executed on worker disconnect (docs say the opposite)

Audit timeline is not populated by swamp CLI commands unless the AI-tool hook fires (manual says recording is automatic)

manual_approval suspends the run while parallel sibling jobs are mid-flight; in-flight steps are torn down and left `running`

`workflow resume --from` does nothing for forEach steps whose template name contains `${{ }}`

Step-level dependsOn on a forEach step never evaluates true (except `always`)

rum/site-info: lookup GETs a non-existent endpoint, always 405

vault read-secret appends a newline to piped output

wss:// direct to serve's own TLS listener still fails on 20260817 — client ALPN lands on h2, WS-over-h2 unimplemented (follow-up to #1363)

serve: vault audit repository not wired up — audit trail always empty

Support Jira webhooks with X-Hub-Signature HMAC-SHA256 verification

Add typed read-only remote ref lookup to @swamp/git

pullChanged skips same-size updated files — size-only change detection ignores the index sha256

A run's terminal status reaches the shared datastore only when a later run happens to push it

workflow cancel --all on the serve host shuts down the serve process

Readability of tables in documentation

repo init/upgrade --tool kiro references .kiro/skills/ but installs skills to ~/.kiro/skills/

vault: audit trail should record put, delete, and annotate operations

data.findBySpec() returns only the first in-run record, not all of them, so an .all() assert silently checks one element

repo upgrade --tool kiro reports wrong changedFiles paths

Suppress boot-time "pulled extension(s) have missing source files" WRN when invoked command is `swamp extension install`

s3-datastore: a stale machine's sync pushes its old 'latest' pointer over the newer remote one, and the rollback is permanent

`search` → `list` aliases are hand-rolled Command clones, not aliases: 10 of 11 have drifted from their parent's option set

Make official Docker image OCI-compliant

Method-name collision between a base model type and an extending extension silently drops the whole extension file — no error, doctor reports pass

data prune still misclassifies live records as orphans on 20260820 (after #1396) — serve-minted token/grant records, and report data of every live workflow

vault put prompts for the secret before validating the vault name exists

workflow validate: false 'Missing required inputs' for CEL-templated globalArgs (${{ inputs.* }})

Add SWAMP_CLI_OUTPUT env var to control default output mode (plaintext/tui/json)

@swamp/git fetch: support local path as remote

Dispatched steps over 15 minutes cannot write results: dispatch credentials expire and never refresh

Concurrent pushes to one namespace fail with HTTP 409 ConditionalRequestConflict — the conditional PUT is never retried

serve: triggerSource not persisted to workflow run summary

dataOutputOverrides not applied during remote execution — ephemeral resources GC'd before override takes effect

extension rm also deletes the lockfile entry, and install on an empty lockfile is a silent success — rm/install is not a round trip

--max-run-duration only applies to detached runs, not attached runs

Cancel endpoint reports status: cancelled for runs it did not actually cancel

@swamp/git: no way to amend a commit, but push can --force

Installation with new account creation times out

pre-flight checks run on orchestrator, not on worker — breaks remote execution with filesystem-dependent checks

docs: document --remote-only flag for swamp serve

Swamp serve daemon doesn't run with --hot-reload

serve: include workflowName in HealthSnapshotSchedule

knowledge-base retrieve persists query output into the state resource, with lifetime infinite and the query text in the instance name

Skip 50MB monolithic index rewrite on v2 shard-first path

Share single AwsS3Client instance across lock, sync, and verifier

Double shard assembly per command lifecycle (pull + push both read all shards)

pullChanged never records commitSeq for shard-first (v2) index

localHasAllRemoteEntries() permanently blocks sidecar update on partial caches

serve: workflow.history.get cannot find CLI-created runs or look up by run ID

"TRIAL ENDED" modal shown to team plan user when toggling extension visibility

Concurrent suspended workflow runs can't be disambiguated from 'approvals'; fresh runs should supersede matching-input suspended runs

I _think_ I might like a guard in the trigger yaml

swamp cmds don't realise the user is sshed into the system

serve dashboard: add cluster.instances and serve.config endpoints

CEL expressions have timestamp/duration but no current-time value, so no guard can express "older than N"

Support direct type execution (@type) with --server

access token mint writes to user vault, not serve's _token-secrets control plane in HA mode

Generic OTLP endpoint appends signal path after query or fragment

Issue lifecycle start drops top-level issue comments

serve dashboard: add instanceId, triggerSource, and step progress to WorkflowRunSummary

Document worker affinity (affinity: true) for workflows and jobs

Datastore MongoDB driver leaks connections — 5960 accumulated over 8 days

workflow approvals displays the latest run's prompt for every suspended run

@swamp/git: add a read-only working-tree diff for pre-commit review

docs: document --oauth-client-name flag for swamp serve

Docs: update workflow reference to include trigger in JSON output shapes