#3383
extension pull: safety analysis scans the bundle the extension runs
#3979
Extension scoring queue: two replicas can claim the same pending event
#3995
Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore
#3994
Five Mongo queues can hand the same row to two replicas
#3863
Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)
#3977
Score extensions with @swamp-club/extension-scoring (rubric v5) instead of the registry's own copy
#3991
Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike
#3969
Extension dependencies: one resolver for push, quality and fmt (no behaviour change)
#3989
Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)
#3983
Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)
#3980
Rescore every extension's current version under rubric v5
#3153
extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored
#3781
Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it
#3974
Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design
#3973
Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock
#3972
Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)
#3971
Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once
#3970
Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json
#3828
stagecraft studio: show a factory's open tickets that have no work item yet on the Board
#3964
stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)
#3963
A long-lived serve client for extensions, and a stable rate_limited error code
#3725
Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)
#3793
extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited
#3772
cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)
#3775
@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs
#3776
@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling
#3870
package.json mode: no loose-specifier warning for a range push ships as the exact installed version
#3869
extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir
#3826
method run masks a sensitive array from --input element by element, exposing its shape (regression from #3752)
#3783
Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments
#3778
Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)
#3855
stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors
#3662
extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)
#3796
main fails type check: query_view_test.ts passes a namespace string where expressionQueryView now takes a NamespaceReader (semantic conflict between #3790 and #3785)
#3795
forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names
#3782
extension push finds no local modules when a folder above the repo is named node_modules
#3630
extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)
#3764
Local verification docs still tell agents to put ANTHROPIC_API_KEY in verify.env for reviews
#3770
@swamp/cve/php-rce-2026-10 follow-ups: dry-run heading, command spelling, Debian 12 fix, podman image scan
#3612
extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes
#3717
extension fmt --check writes deno.lock in deno.json mode, which push and quality then bundle against with --frozen
#3720
@swamp/cve/dirtyfrag: scan logs are never saved (file writer handle dropped, data name collides with the status resource)
#3715
audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited
#3719
@swamp/cve/dirtyfrag README shows --input targetHost/sshUser/sshKey/dockerContainer, which the CLI rejects
#3716
@swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run
#3718
extension quality names the wrong cause: a bundle failure prints no reason, the not-audited row always blames an outage, and symbols-docs blames JSDoc when deno doc failed
#3728
Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)
#3631
Docs: extension dependency trust pages — import-map auditing, bare-import rewrite and scoring, and the clarified warning/error plan
#3682
Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)
#3705