#1427
workflow assert: a step whose CEL expression fails to evaluate is omitted from --junit output, so the XML reports a clean pass
#1420
No way to select which vault receives a sensitive-marked field's value
#1414
worker daemon enable: relative/missing --cache-dir fails launchd EX_CONFIG while daemon status reports running
#1419
swamp doctor extensions: nondeterministic BundleBuildFailed for local extensions on an unchanged tree
#1392
Issue redactor corrupts reports: dotted code identifiers masked as hostnames, loopback and RFC 5737 documentation IPs masked, angle-bracket placeholders half-eaten
#1396
data prune resolves auto-definitions at the local path, not the datastore path — deletes live models' data (verified: destroyed a working server token and an active grant)
#1398
workflow/job-lifetime data is never reclaimed — expiry check requires an ownerDefinition.workflowId that step execution never sets
#1399
runModel breadth limit (MAX_INVOCATION_BREADTH=100) is never enforced — tracking object is never written back to the caller context; verified 150/150 calls succeeded
#1391
serve daemon enable is ungated — it reports success, then the account gate fires inside the detached daemon, which crash-loops invisibly
#1390
Purely local operations require a swamp-club account: local-token serve is gated while deprecated --auth-mode none is not, third-party OIDC is gated, and 'Local_Encryption' is paywalled by capitalization
#1389
A collective token stored in auth.json (rather than SWAMP_API_KEY) is permanently scope-less — resolution only runs for the env var, and scopes are never persisted for collective tokens
#1388
An empty stored apiKey counts as authenticated — saveIdentityCache writes apiKey:'' on a virgin machine, permanently satisfying the mandatory-account gate with no credential
#1387
Account/scope gates fire before argument, type and repo validation — 'swamp vault create env my-vault' (the command's own example, an invalid type) returns a paywall instead of 'Unknown vault type'
#1386
auth token create advertises a 'collective:write' scope that does not exist, and following its advice hits 'collective tokens cannot create other collective tokens'
#1385
requireScope does exact string matching — fine-grained scopes fail gates that demand the literal wildcard, and minted scopes are never validated or normalized
#1384
Collective-token scope cache never expires, is never refreshed by whoami, and cannot be cleared via the CLI — scope changes and revocations never take effect
#1382
Collective-token scope cache is keyed on a 12-char token prefix — only 2 chars distinguish org tokens, so a rotated token silently inherits another token's scopes
#1381
Misleading 'Your collective token lacks the X scope' when scope resolution failed — startup whoami errors are silently swallowed
#1380
Community points / reputation: award points for upvoting extensions, feature requests, comments, and feed posts
#1302
datastore setup extension drops 'namespace' from --config, making extensions that require it impossible to configure
#1363
Remote --server wss:// fails through an HTTP/2 TLS reverse proxy (WS client ALPN is h2-only)
#1352
Website extension search ignores API relevance — exact name match "good-planning" ranks #10 (API ranks it #1)
#1326
Published extension scores dependency-trust as "missing" (0/2) while client `extension quality` earns it (2/2); no verdict exposed
#1304
namespace unset --migrate silently deletes artifact history via catalog-rebuild GC (~484k files lost)
#1327
Bugs filed by a team-subscription user are not tagged "team" in the Lab
#1301
command/shell renders JSON-object stdout lines as the literal string 'undefined'
#1303
Issue redactor treats the MongoDB authSource parameter as a secret, corrupting reproduction steps
#1186
Collective invite is never claimed when the invitee registers via Google with the invited address — stays pending forever, invisible to the invitee
#1187
/orgs shows no pending collective invitations to the invitee — no list, banner, or accept affordance anywhere in the product
#1196
Cannot subscribe: personal collective has 0 operatives (owner missing from own roster) — payment returns Forbidden, while whoami and extension push both grant the collective
#1189
quest: 'Case Closed' (issue_shipped) does not fire when an issue you filed ships — #1181 shipped, challenge still 0/1 (bug_hunter fired for the same issue)
#1181
Unreachable path in .swamp-sources.yaml is fatal to every command, including 'swamp version'
#1163
OTel setup manual example (OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317) cannot work — exporter is OTLP/HTTP-only, needs port 4318
#1164
Configure the OTLP trace exporter (endpoint/service/headers) in .swamp.yaml, not only via OTEL_ env vars
#1139
Lab: URLs inside list items aren't clickable (linkified) in rendered issue bodies/summaries
#1138
Feed: detect and gracefully handle dead (404) post links (link rot)
#1137
/feed: per-post unread indicators and mark-as-read to track reading progress
#1094
swamp serve leaks esbuild bundler subprocesses as zombies (reparented to PID 1, never reaped)
#1024
`swamp extension search --channel beta|rc|stable` ignores the filter — all channels + the no-flag default return an identical result set
#1023
Beta-channel extensions are never scored — perpetual 'Scoring is taking longer than expected'
#974
swamp serve scheduled execution runs steps in an isolated data scope: readResource sees empty state, writeResource never reaches the model-scope chain — stateful scheduled workflows duplicate instead of deduplicating
#914
swamp serve: model resource vault-backed sensitive fields resolve empty during served/workflow execution (readResource)
#890
swamp serve --auth-mode token: redeem reads token-main as null → every valid token rejected 'Authentication failed' (real error hidden at debug)
#889
swamp serve: hardcoded WebSocket host allowlist makes it unusable behind a reverse proxy (no --trusted-hosts/--allowed-origins)
#742
swamp issue bug times out posting to the Lab while swamp-club.com returns HTTP 200
#741
telemetry stats fatally fails to load an installed datastore extension (auto-resolve path); all other commands load it fine
#732
Trajectory chart: current-day x-axis label is clipped at the right edge
#731
Telemetry not synced to swamp-club: local queue accumulating ~3 days despite valid auth
#708
Eager render stack (Ink/yoga-layout + marked-terminal) adds ~540ms to every command's startup
#671
Telemetry flush blocks command exit, adding ~1.2s p50 to every invocation
#615
model type describe --json: bloated output (40% duplicated specs, no compact mode) and lost method-to-output mapping drive agents to read extension source
#639
Yanked extension version still shown as active on swamp-club.com and in 'extension search'
#623
Docs: extension-publish skill guide doesn't cover release channels
#626
Feature: make extension yank channel-scoped (--channel) so it doesn't nuke every channel
#624
Feature: demote / withdraw an extension version from the stable channel
#601
extension push: credentials-sensitive-field false positive when .meta({ sensitive: true }) is on a continuation line
#586
@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put
#540
paths.base: manifest is not honored for workflows: — bundled workflows only resolve from repo root, blocking self-contained subdir layouts (sibling to #459)
#459
paths.base: manifest is not honored for skills: — bundled skills only resolve from repo root, blocking multi-extension repos
#460
Orphaned .swamp/ without .swamp.yaml marker is reported as plain 'Not a swamp repository' — partial/corrupt repo not detected
#348
Scaffold new extensions to publish-ready quality (12/12) by default
#406
Warn when a ${{ }} secret expression is single-quoted in a command/shell run: script
#208
swamp model type search is slow (~8s) and re-bundles all extensions on every call
#207
Per-extension layout migration drops Claude skill from @magistr/good-planning
#43