Lab — All Issues

CI auto-merge broken: removed claude-review job was the PR approver

Serve Audit Log - Phase 4: SIEM integrations, bulk export, HMAC

Simplify CI: remove redundant jobs, automerge only on security + attestation gates

managedConfig: cross-process sentinel disagreement between CLI and serve

Expose swamp help to agents proactively in the swamp skill

Windows: vault roundtrip model outputs UTF-16LE instead of UTF-8

Make verification reviews tolerate a passing review without an explicit verdict

Enrich InvocationContext telemetry with datastore type and external vault detection

Windows: CLI outputs forward-slash lowercase paths instead of native backslash paths

Audit: emit auth-category events for OAuth device flow and token operations

Serve Audit Log - Phase 3: Real-time WebSocket streaming

Flaky POSIX shutdown handler SIGINT test exits 130

Test flake: buildOtelResource env var race in parallel test execution

Windows: HOME environment variable not set — no USERPROFILE fallback

Property test flake: CEL embedded interpolation with empty expression key

Adversarial review guard does not cover src/cli/ outside src/cli/commands/

Lab #2037 mitigation does not cover category-specific bundle stores (datastore-bundles, vault-bundles, report-bundles)

Serve Audit Log - Phase 2: WAL, chain hashing, query API, complete coverage

Docs: document the approve grant action and separation-of-duties patterns

Docs: Add method-level grant scoping to authorization reference

Docs: document enriched model search JSON output shape

Serve Audit Log - Phase 1: Event pipeline and durable storage

Add method-level scoping to grants

model_handlers acquires write lock on pure-read method invocations

data.latest cache is stale after nested workflow outputs

LockTimeoutError surfaces as generic 'internal error' at the CLI

Support agent-neutral repository instructions without duplicating Claude configuration

Docs: document --token-file and --server-token-file flags for worker commands

Docs: update pi skill directory path in repository-configuration.md

feat(worker): --server-token-file (and --token-file) to read secrets from a mount without env-var round-trip

Self-update fails on Windows: running binary cannot be replaced due to file locking

Self-update broken on Windows: tar.gz format and zip extraction missing

run tracker: hostname-based PID liveness check fails in containers sharing a hostname

Fix Windows install script (install.ps1) parity with Unix

Add Windows binary to release pipeline

Swamp skill repo reference missing datastore config expression interpolation docs

Docs: document env and vault expression syntax in datastore configuration reference

Docs: add swamp auth token list/revoke to API key authentication guide

formatUserModelError reports 'Missing required methods field' for any method sub-field validation failure

Add support for Google AntiGravity as a supported agent

swamp update leaks raw LogTape output instead of using presentation output

Catalog export blocks event loop and global lock during serve push

Show local vs remote mode indicator in command output

Move skill review and trigger eval into the local verification loop

Docs: remove driver references from extension documentation

Remove extension driver support from CLI and domain layers

docs: write enablers/access-control.md design doc

verification-attestation report runs as default on every workflow

repo init and repo upgrade use LogTape output instead of clean human-readable output

enforceUniqueLatest can incorrectly demote foreign namespace rows

verify-reviews workflow broken: UUID schema validation error on id field

verify-build workflow broken: unknown 'guard' key on job

Suppress boot-time "pulled extension(s) have missing source files" WRN when invoked command is `swamp extension install`

Namespace mismatch regression in datastore sync after PR #2314 lock key restructuring

docs(design): reorganise design/ around the six primitives

Core: namespace-scoped datastores write root-level lock key and pass undefined namespace to sync

Add Amp Code as a built-in tool in repo init

Docs: document managedConfig for multi-instance serve deployments

serve: #2308 method-run push fails with namespace mismatch — grant create does not push until a reload

Docs: fix incorrect write-bearing classification claim in failure-semantics.md

Support direct type execution (@type) with --server

serve HA: grant/group mutations are never pushed to the shared datastore — replication pull (#2305) has nothing to pull

serve: data handler authorization fields missing ns/tags/owner for CEL conditions

serve HA: grants do not replicate across cluster instances — policy is repo-local despite the shared datastore

model get does not render the description field

serve: access check --server evaluates the target subject with the caller's IdP groups/collectives

serve: workflow tags never reach grant CEL conditions — tag-conditioned grants always deny

verify-reviews workflow uses local main as diff base, producing stale diffs in worktrees

Windows test failures in resolveManagedConfigPaths after managedConfig merge

Enforce attestation and review integrity as merge gates

docs(skill): serve guide's Token Management section is bare, leads to picking the wrong mint command

Docs: document that workflow cancel --all skips serve-owned runs

Docs: document `swamp access token reveal` and update token retrieval guidance

Docs: document --filter flag on workflow history search

Docs: document SWAMP_SERVER_URL as routing alias for SWAMP_SERVE_URL

Docs: add --ca-cert / SWAMP_CA_CERT for swamp worker connect to TLS reference

swamp access check/can-i report ALLOW where enforcement DENIES (explain() not deny-first)

Add --filter flag to workflow history search

serve: dashboard behind an ingress fails WS handshake — Origin allowlist is hardcoded

Docs: add jira webhook scheme to manual documentation

data.latest() should error on ambiguous specName matches across multiple data items

swamp serve daemon enable: add --dashboard flag

Datastore lock warnings should use workflow step output format

Docs: update cancel endpoint response statuses in REST API reference and workflows page

docs: update vault audit trail reference for write operation support

docs: document --dashboard flag for swamp serve

serve: vault audit repository not wired up — audit trail always empty

vault: audit trail should record put, delete, and annotate operations

serve: triggerSource not persisted to workflow run summary

dataOutputOverrides not applied during remote execution — ephemeral resources GC'd before override takes effect

--max-run-duration only applies to detached runs, not attached runs

pre-flight checks run on orchestrator, not on worker — breaks remote execution with filesystem-dependent checks

docs: document --remote-only flag for swamp serve

serve: include workflowName in HealthSnapshotSchedule

serve: workflow.history.get cannot find CLI-created runs or look up by run ID

serve dashboard: add cluster.instances and serve.config endpoints

serve dashboard: add instanceId, triggerSource, and step progress to WorkflowRunSummary

docs: document --oauth-client-name flag for swamp serve

Docs: update workflow reference to include trigger in JSON output shapes

Docs: update workflow-placement.md for job/workflow-level placement inheritance

feat(serve): use identifiable OAuth client_name instead of random UUID

Document model.method() support in assert expressions

workflows: support labels/target/platform at job and workflow level

Serve telemetry attribution for collectives

Extension workflows: no way to override trigger configuration

Document @vault= prefix for webhook secrets in serve.yaml

docs: document SWAMP_API_KEY headless OAuth bootstrap for swamp serve

swamp serve: webhook secrets should support @vault= resolution

datastore setup: symlinks not counted in bytesCopied, causing misleading '(0B)' output

vault.get() CEL error embeds raw newline when wrapped by model resolver, producing broken output

Docs: document swamp workflow trigger set/get/remove commands

serve reload should pick up trigger override changes from serve.yaml

CLI: swamp workflow trigger set/get/remove commands

Plus-addressed emails stripped on invite acceptance, breaking collective join and quest reward

Docs: document health monitoring endpoints for swamp serve

Cluster health snapshots with SSE streaming for swamp serve

Docs: document auto-raise of open-file limit in swamp serve reference

serve: stale empty directories in active-runs/ never cleaned up

WebSocket auth rate limiter blocks legitimate users when sharing IP with a failing client

GC expired OAuth server tokens and control plane secrets

Client shows 'Authentication failed' when actually rate-limited

Workers retry forever on permanent auth failures instead of backing off

Support --grants-dir for loading grants from a directory

Server token definitions and encryption keys are not durable across pod restarts

Docs: add swamp access group list-idp to access commands reference

--grant-reload auto does not detect filesystem changes — blind to ConfigMap updates

Add swamp access group list-idp to enumerate IdP groups seen by the server

Grants directory loader skips symlinks — breaks Kubernetes ConfigMap mounts

serve boot OOM: findAllGlobalSince loads all workflow runs as full aggregates during reconciliation

s3-datastore: localHasAllRemoteEntries uses bare rel instead of localRelPath, always returns false in namespaced mode

Show user:<name> instead of user:<id> in grant list output

Exclude swamp internal model types from model list output

Skill docs use invalid two-argument 'vault get' form

Document --restricted-commands flag for swamp serve

vault put: pass tags through to extension provider CreateSecret/setSecret calls

Docs: update manual for 23 new --server commands

Update VaultProvider interface in @systeminit/swamp-testing to support optional tags in put()

Docs: document --grants-file flag for swamp serve

Docs: document --server support for serve reload

Docs: add --tag flag to vault put reference

Docs: update manual for --detach-runs deprecation and HA auto-detection

Document the Codex plugin in swamp docs

Add --server support to CLI commands missing it

Document the swamp Claude Code plugin in the swamp documentation

Load grants from external source on swamp serve startup

swamp vault put should support tags for secret governance

Authenticated users must re-login after swamp serve restart

Add --server support to serve reload

Auto-detect HA mode and deprecate --detach-runs flag

Move per-login token secrets from vault to encrypted control-plane store

Docs: document macOS TLS trust limitation and SSL_CERT_FILE workaround

Validate swamp serve deployment stack on startup

Docs: serve config file (.swamp/serve.yaml) and --config flag

Serve config file — read swamp serve configuration from YAML

Docs: update hot-reload reference to include trust list refresh

Cross-instance client re-attach for multi-instance swamp serve

vercel codegen: inline rawSyncResult in non-unwrap sync path

vercel codegen: unused listAll import blocks extension publish for 4 models

Track active runs in the control-plane store for cross-instance visibility

Docs: document continuous reconciliation and multi-instance serve flags

Docs: update workflow guard skip output to include guardExpression and guardResult

Make it aware hot reload on the deamon does not take into account trust list changes, or do take into account the trust list for the hot reload.

Continuous reconciliation for multi-instance swamp serve

Startup cache hydration for swamp serve instance replacement

Docs: access token commands reference says plaintext is 'shown once'

Document --restricted-model-types flag for swamp serve

s3-datastore extension: pullChanged writes namespace-stripped paths to local cache

access token mint: allow reusing a revoked token name

access token rotate: add --vault flag to override inherited vault

Docs: document rollbackOnFailure with safety guidance for external-dependency models

Add rollbackOnFailure for method-level write atomicity

Document --server support for extension pull/update, datastore setup, and vault migrate

Docs: document guard and resume --from in workflows reference

Add --from flag to workflow resume for DAG re-entry on failed runs

Docs: document guard field for workflow steps

Add guard field to workflow steps for idempotent execution

Docs: document vault selection for sensitive fields (defaultVault, per-resource vaultName)

azure-kv error wrapping loses original error type — ERROR_TYPE always 'Error' in traces

Docs: document workflow-scope ReportContext fields in extension report reference

aws-sm deleteAnnotation removes all non-aws: tags, not just swamp-specific ones

Documentation for workflow assert steps and JUnit output

Teach swamp skill how to write assert workflow steps

Docs: add how-to guide for running swamp serve/worker in daemon mode

Docs: document datastore directory relocation during setup

vault extensions: emit OTel spans for vault operations (AWS SM, Azure KV, 1Password)

Docs: document extension runtime permissions and device I/O workaround in user manual

api-key-scoping explanation doc contradicts shipped fine-grained scopes

Docs: document swamp auth token create command for collective tokens

docs: update swamp skills for setup extension --namespace

Docs: update autoGc documentation to reflect write-time version pruning

CLI command to create scoped collective tokens (phase 8 of #960)

docs: document auth gates for team features (datastores, vaults, serve)

Document doctor datastores --repair for namespace contamination cleanup

docs: update giga-swamp manual pages for setup extension --namespace

Docs: update extension push output examples to include channel and visibility

Token creation API and UI scope selector for collective tokens (phase 4 of #960)

Make Cloudflare CRUD methods factory-aware so list-discovered resources can be managed in-place

Sync guard skips bound namespace directory during push — 0 files pushed after namespace migrate

Docs: document repo root resolution from subdirectories

Add serve, datastore, vault, and worker wildcard scopes to token registry (phase 4 prep, #960)

Docs: update manual to document --yes/-y as the standard confirmation-skip flag

Docs: update data.query and CEL expressions references for SQL pushdown

Docs: document collective token CLI usage in API key authentication pages

Make GCP CRUD methods factory-aware so list-discovered resources can be managed in-place

namespace migrate/set workflow broken for extension datastores: migrate skipped by sync guard, set not idempotent, migrate-index empties shards

method_execution_service.ts:852 crashes on undefined.trim() when writeResource receives undefined instance name

CLI support for collective API tokens (phase 3 of #960)

Scope enforcement and whoami introspection for collective tokens (phase 2 of #960)

Docs: update extension info reference to document extensions (type grafts) in content metadata

Docs: update manual telemetry reference for user-global spool and telemetry.yaml opt-out

Expand token scope registry to full taxonomy (phase 1 addendum, #960)

Collective API token scopes: domain, persistence, and auth threading (phase 1 of #960)

Docs: update auth login examples for username support and piped passwords

Docs: add reference page for swamp run gc

`models.md` says the `latest` marker is a symlink but it's a plain text file now

Docs: add IdP group refresh and deprovisioning details to swamp-serve manual pages

Document IdP group-based access control in serve guide

SSO admin setup guide for swamp-club

Docs: document the OTel logs signal in the swamp-club manual (opentelemetry.md)

SSO + IdP group federation for swamp-club

Docs: add workflow blocking semantics and lock concurrency to manual

Docs: add CEL run.* and webhook.* context variables to manual expressions reference

Hot-reload finds 0 types for large pulled extensions (empty extension_name in catalog rows)

UAT Phase 2: auth and agent commands

How-to guide: How can I collaborate in the Swamp?

Docs: add --timeout to workflow resume reference

UAT Phase 2: source commands and completions extension

UAT Phase 2: doctor install, secrets, and workflows

Docs: update --server support tables for extension and doctor commands

Docs: document WebSocket Bearer header and Sec-WebSocket-Protocol auth transports

serve: extension and doctor extension handlers return not_implemented

Document vault read-access audit trail

UAT Phase 2: telemetry, update --check, version/help

Docs: document instructionsMode for custom AI agent tools

Docs: document --hot-reload flag and swamp serve reload subcommand

UAT Phase 2: run history and run doctor

UAT Phase 1f: alias-parity micro-suite

UAT Phase 1e: report family verb gap-fill

Docs: add OTEL_RESOURCE_ATTRIBUTES to OpenTelemetry reference

UAT Phase 1d: data family verb gap-fill

Improve skills and documentation to guide agents toward correct swamp patterns

UAT Phase 1c: vault family verb gap-fill

vault list-keys no-arg form errors despite help text suggesting it works

UAT Phase 1b: workflow family verb gap-fill

UAT Phase 1a: model family verb gap-fill

UAT Phase 8a: CI guard + adversarial tier-6 catch-all

Document context.runModel() model-to-model invocation

skill: add serve, grants, and access control guidance to the swamp skill

Share skill: guided solo-to-team promotion

docs: declarative grants directory how-to and reference updates

serve-auth: declarative grants directory with validate-and-reconcile on reload

Docs: document per-invocation traceparent/tracestate support

CI: review jobs check stale global state, causing cross-reviewer blocking

Docs: document CEL grant condition cost limits

serve-auth: CEL cost-bounding for grant conditions

docs: OAuth authentication how-to and explanation guides for swamp serve

serve-auth: mode: oauth — device grant client + collective-based admission

swamp-club: enable OAuth provider for swamp serve collective-based admission

Session credential revocation scans entire credential map on every dispatch completion

Docs: update worker-commands.md for --all flag and JSON output change

swamp worker list: hide disconnected workers by default, add --all flag

Worker fleets phase 7: how-to guides and explanation docs

Docs: add --server-token flag to worker connect reference

Add --server-token to worker connect for authenticated orchestrators

Docs: document --trusted-hosts flag for swamp serve

Document SWAMP_SERVE_EXTRA_HEADERS for reverse proxy/tunnel setups

Add --trusted-hosts flag to swamp serve for Docker/Kubernetes worker connections

Docs: update serve-flags.md default queue timeout from 60s to 10m

Worker fleets phase 6: raise default queue timeout to 10 minutes

Worker fleets phase 4b: capacity slots and concurrent dispatch

Docs: add --concurrency flag and SLOTS column to worker-commands reference

Worker fleets phase 4a: dispatch runner extraction — child process per dispatch

Docs: add swamp worker daemon enable/disable/status to worker-commands reference

Worker fleets phase 3 PR2: swamp worker daemon enable

Docs: add drain, lifecycle policies, and exit-code contract to references

Worker fleets phase 3 PR1: drain state machine, lifecycle policies, signal handling

Docs: add worker verify, --verify-on-enroll, and env-var config to references

Worker fleets phase 2 PR2: env-var config, swamp worker verify, --verify-on-enroll

Docs: add --type flag to issue edit reference and how-to

Docs: update manual with whole-field expression syntax for workflow task inputs/globalArgs

Docs: update enrollment token references for fleet tokens (--max-enrollments)

Worker fleets phase 2 PR1: fleet tokens (--max-enrollments, bindings, worker naming)

Worker fleets phase 1 PR3: boot reconciliation and integration test

Worker fleets phase 1 PR2: step_queued events, pending-dispatch model, queue introspection

Docs: add swamp worker queue to worker-commands reference

Docs: update manual for ephemeral data and step-output dependency deferral

Docs: update remote execution references for elastic queueing

Worker fleets phase 1: elastic queueing

catalog backfill should support scoped population for targeted lookups

Docs: document global skill sync behavior for custom tools in manual

Implement ephemeral data as in-memory repository

refactor: decompose connection.ts server handlers into domain-aligned modules

Document the run tracker across all four diataxis verticals

Add swamp datastore sync --migrate-index CLI command to trigger shard-first migration

Add how-to guides for core operations and operational tasks

Shard-first index: eliminate monolithic .datastore-index.json from commitPush critical section

Add core-concept explanation pages to the manual

SQLite run tracker subsystem for in-flight run lifecycle

Add comprehensive CLI command reference documentation to the manual

docs: update swamp-serve manual reference for phase 2 --server commands

serve-auth: --server support for remaining remote-capable commands (phase 2)

serve: catalog backfill is unbounded and unsafe on large repos

Docs: add --ws-idle-timeout to serve flags reference

Docs: update extension info reference with content metadata output

Surface extension type+method detail in CLI to eliminate expensive discovery loops

Docs: document @env= and @file= webhook secret indirection in swamp-serve reference

fix: add .namespace.json to isInternalCacheFile() in datastore extensions

docs: document swamp serve daemon enable/disable/status subcommands

docs: document execution cancellation commands and cancelled status

docs: document autoGc config option for automatic garbage collection

Opt-in automatic garbage collection for datastore data

Skill guides lack progressive reveal boundaries — agents over-read by 4x

Execution cancellation: abort stuck workflow runs and model method runs, bulk cleanup, and daemon-restart reaping

Docs: document .? optional select for null-safe CEL data access

Docs: update vault inspect output in manual reference

pushChanged does not implement absence-on-disk deletion (markDirty contract rule #2)

pushChanged does not implement absence-on-disk deletion (markDirty contract rule #2)

Add `vault delete` support to @swamp/1password extension

Add `vault delete` support to @swamp/azure-kv extension

Add `vault delete` support to @swamp/aws-sm extension

docs: swamp serve user guide

Add deleteResource to MethodContext and document dataRepository.delete in skills

Docs: update Copilot how-to for audit hooks support

serve-auth: add --server support to data, model, workflow, vault, audit, summary, and report commands

serve-auth: swamp access token rotate command

serve-auth: alias 'swamp access policy' as alternative to 'swamp access grant'

serve-auth: swamp access can-i — user self-service permission check

serve-auth: hard refusals for off-loopback without TLS or auth

serve-auth: wire AccessDecisionService into serve chokepoints for authorization enforcement

serve-auth: mode: token — server token authentication on WebSocket connections

serve-auth: mandatory admin materialization from config at startup

serve-auth: auth config schema and mode flag for swamp serve

serve-auth: remote grant management via swamp access --server

serve-auth: swamp access CLI commands

Docs: add server-side TLS reference for swamp serve --cert-file/--key-file

serve-auth: static TLS for swamp serve

serve-auth: client-side server credential storage

serve-auth: server token built-in model

serve-auth: AccessDecisionService with in-memory policy snapshot

serve-auth: access bounded context — Grant, Group, and shared value objects

Docs: document --compact flag for model type describe

Docs: document globalArgument input reference validation in workflow validate

Docs: Add release channel documentation to the manual

API: Add release channel support for extension versions (beta, rc, stable)

Test skill evals with Fable in multi-skill eval tests

Docs: vault refresh hooks (--refresh-from, --refresh-ttl, --clear-refresh)

Deprecate "No slow types" (fast-check) rubric factor on server-side scorer

CI review jobs use two-dot diff that includes files the PR never touched

Docs: vault reference in manual promotes inline KEY=VALUE as primary example

GCP: support vault expressions for credentials instead of env-var-only auth

Extension model method execute lacks typed args/context — every author has to use ': any' to unblock tests

model method run: cannot pass arrays, numbers, or booleans via --input

AWS: support vault expressions for credentials instead of env-var/SDK-chain-only auth

fix: giga-swamp UAT failures — 9 bugs found during comprehensive testing

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

Docs: add doctor vaults subcommand and pre-flight vault validation

gcs-datastore: registerNamespace does not detect conflicts with existing registrations

Codegen: auto-merge resources across GCP API versions instead of manual ADDITIONAL_VERSION_RESOURCE_FILTER

swamp-club: update skill references and CLAUDE.md after superskill consolidation

fix: datastore setup extension with namespace config doesn't scope sync or register manifest

fix: namespace set on default repo writes incomplete filesystem config (missing path)

docs: giga-swamp user documentation — reference, how-to, and conceptual guide

feat: giga-swamp phase 7 — Data migration commands

feat: S3/GCS extension namespace manifest support (registerNamespace/listNamespaces)

feat: giga-swamp phase 5 — CLI output + namespace management commands

feat: S3/GCS extension namespace-scoped sync support

Add platform type to issue-lifecycle extension model Zod schema

fix: datastoreSetupExtension() ignores namespace config on initial migration push/pull

swamp datastore sync --push creates global .datastore-index.json ignoring namespace config

vault.get() expressions in extension model globalArguments are not resolved at runtime

Copy explicitGlobalArgs before mutation in resolveOrCreateDefinition

feat: giga-swamp phase 6 — Namespace-scoped sync

workflow validate: trim stale 'skipped' label from model_not_found warning

workflow validate: fail on references to unknown model instances (typo'd modelIdOrName)

swamp repo upgrade: ERR_SQLITE_ERROR 'attempt to write a readonly database' during extension catalog schema migration

feat: giga-swamp phase 4 — CEL cross-namespace queries

Docs: document the extension push adversarial-review gate

Docs: document swamp doctor secrets in manual reference doctor.md

Docs: document 'swamp workflow resume --input' in manual reference

Remediate existing definitions holding cleartext sensitive global arguments (follow-up to #480)

Support --input flags on workflow resume for elevated permissions and runtime overrides

Cloudflare codegen: manifest version bumps on every regeneration (README not deno-fmt-clean)

feat: giga-swamp phase 3 — Path resolver + per-namespace locking

Cloudflare: support vault expressions for API credentials instead of env-var-only auth

Add integration test for sensitive-arg guard on lazily-loaded extension types (follow-up to #480)

Docs: document refusal of literal sensitive global arguments (follow-up to #480)

DigitalOcean: support vault expressions for the API token instead of DO_API_TOKEN env var

feat: giga-swamp phase 2 — Catalog schema v4 + repository interface

Docs: update extension-trust reference for swamp-only default + lockfile version pinning (swamp-club#465)

swamp model get does not redact `sensitive: true` fields (logs/reports/storage do)

Document manual_approval workflow step type and suspend/approve/resume flow

feat: giga-swamp phase 1 — Namespace value object + config

Improve idempotency match field heuristic for auto-generated name resources (tagKeys, tagValues)

ci: aws-check and gcp-check jobs take ~30min — rethink whether full model type-checking is needed per PR

Add extension deprecation support to CLI

Display extension deprecation state on swamp-club pages

Docs: update autoupdating how-to for Linux privileged schedulers

Support privileged autoupdate schedulers for root-owned binaries on Linux

How-to: Define custom AI agent tools

Docs: document LaunchDaemon autoupdate for root-owned macOS binaries

Datastore: lazy hydration with metadata-only setup and transparent content download

Docs: update datastore reference for lazy hydration, SyncContext, and SyncCapabilities

Add extension info command for registry metadata

Datastore extensions: only write dirty partition files on push

Datastore extension benchmark suite for S3 and GCS

GCS datastore: dirty sidecar, partitioned index, content hashing, and scoped sync

S3 datastore: dirty sidecar, partitioned index, content hashing, and scoped sync

Docs: document VaultAnnotationProvider interface and extension opt-in pattern

Add VaultAnnotationProvider support to @swamp/azure-kv

Vault annotations: --note/--notes flag inconsistency and UX improvements

Add VaultAnnotationProvider conformance helpers to @systeminit/swamp-testing

Add VaultAnnotationProvider support to @swamp/1password

Add VaultAnnotationProvider support to @swamp/aws-sm

Add uniform bucket-level IAM support to @swamp/gcp/storage

Docs: update extension scoring documentation for dependency-trust rubric factor

Add dependency-trust rubric factor to server-side scorer (RUBRIC_VERSION 3)

Datastore sync: add SyncContext and SyncCapabilities framework contracts

issue-lifecycle: thank external contributors when issues are resolved

Docs: document --extensions-dir / SWAMP_EXTENSIONS_DIR for worktree workflows

No user feedback when model method run is waiting for lock acquisition

swamp issue get should rate-limit unauthenticated users instead of blocking

CEL and vault expressions not evaluated inside nested globalArguments fields

Add --stdin support to method run and workflow run for Unix pipe composition

Docs: update doctor reference and autoupdate how-to for new doctor install subcommand

@swamp/digitalocean: 30 of 33 model types fail with version mismatch error

Per-path dirty tracking in S3/GCS datastore extensions (Phase 2)

Scoped sync and capability-gated concurrency for datastores (Phase 1)

Docs: update doctor extensions JSON reference to include warnings[] field

Surface type-extraction failures in doctor JSON output

W7 — unify extension failure surfaces; collapse registries.failures[] into sourceDetails[]

Direct type execution fails for locally-defined extension types with pulled duplicates

Distinguish validation-throw from bundle-throw in reconcile catch; surface ValidationFailed in sourceDetails

Surface Tombstoned transitions in doctor extensions output

swamp issue: check if reporter is on an outdated binary before opening

Detect stale skill directories and prompt for repo upgrade

extension unyank needs -y/--yes flag for non-interactive use

Fix invalidate-then-reconcile sequencing in doctor extensions; failure-mode RowStates unreachable in sourceDetails

Docs: add run namespace to CEL expressions reference

Add type search for driver, datastore, and report kinds

Investigate whether allExtensionMethodsAttached guard can be removed via registration-path consolidation

Docs: update doctor extensions reference for W6 aggregate-state rendering + repair flags

Implement W6: swamp doctor extensions aggregate-state rendering + repair surface (extension catalog rearchitecture)

Implement W5: Per-fingerprint import URLs + subprocess test harness (extension catalog rearchitecture)

swamp issue get should not require authentication

Docs: Update model-definitions.md and workflows.md for direct type execution

Direct type execution: collapse model create + method run into one command

Docs: document binaries manifest field in extension-manifest.md

Accept and display binaries field from extension push metadata

W3 sourceToRow writes empty source_mtime — should carry filesystem mtime through Source entity

Implement W4: KindAdapter + unified loader (extension catalog rearchitecture)

Docs: How-to guide for background autoupdating

datastore compact: VACUUM fails in compiled binary (SQLITE_LIMIT_ATTACHED=0)

swamp config set crashes with YAML serialization error

Manifest version bumps silently ignored for existing local extension aggregates

materialiseExtensions misclassifies pulled rows when manifest name collides with a pulled extension

Docs: document self.* expressions in modelIdOrName during forEach

`swamp datastore setup` migration is not resumable / leaves the repo in a partial state on failure

Detect AWS CredentialsProviderError in @swamp/aws-sm-vault and prepend SSO-expiration hint

Docs: add vault read-secret command to reference manual

Add swamp issue get CLI command to fetch issue details

Implement W3: ReconcileFromDisk + freshness-as-aggregate-query (extension catalog rearchitecture)

Docs: document workflow concurrency limits in reference manual

Cross-process concurrency stress for W2 lifecycle services

Pre-existing TOCTOU windows in YAML repo walkers (findAll directory level + findById)

Implement W2: Lifecycle services own the catalog write (extension catalog rearchitecture)

data search: surface jobTag alongside workflowTag and stepTag (follow-up to #237)

Detect AWS CredentialsProviderError in summarizeSyncError and prepend SSO-expiration hint

Extract LockfileRepository (W2 prequel for swamp-club#231)

DDD: refactor data services to depend on domain-side ports instead of infrastructure types

Implement W1b: Repository and RowState (extension catalog rearchitecture)

data·delete logger double-quotes the data name in log output

Implement W1: Repository and RowState (extension catalog rearchitecture)

Redundant push after pullChanged: localMtime clobbered by pullIndex(forceRemote)

Docs: update datastore-configuration manual after #220 setup-hydration fix lands

Schema-invalid extensions loop in rebundle path: catalog row never updates after first failed validation

swamp extension outdated crashes on empty repo (Stream ended...)

Docs: extension commands reference

Docs: multi-tool repo support

add `swamp doctor extensions` subcommand for on-demand extension load diagnostics

Local extension models in extensions/models are not discovered in fresh repo tutorial flow

fast-path sidecar TOCTOU: post-op HEAD can record generation from a concurrent writer's push, masking their data on next sync

Add a preflight diagnostic for AI-tool audit integrations (so upstream CLI changes stop breaking us silently)

@swamp/gcs-datastore: same minutes-slow zero-diff sync cliff as lab/164; mirror fingerprint fast path

Trailing slash on /extensions/@<namespace>/ returns 404

Link to namespace extensions listing from profile pages

DatastoreProvider.resolveCachePath declared optional but silently required at runtime

Feature: swamp issue for extensions — bug reports, security disclosures, and author notifications

Docs: document jsr:/https: imports and non-local pinning convention in user-facing manual

Datastore sync surfaces opaque errors from extensions verbatim — no status code or body preview

Extension auto-resolve reports "already_installed" for truncated pulled-extension trees

Port bundle_freshness (content-fingerprint cache invalidation) to reports / drivers / datastores / vaults loaders

Mentions and notifications system for issues

open.ts web UI uses force:true pullExtension, same data-loss family as #126

Datastore auto-update in resolve_datastore.ts uses force:true, risking silent overwrite of local edits

workflow validate can silently overwrite local edits to pulled extensions via force-pull in auto-resolver

swamp-club API: include issue author in GET /api/v1/lab/issues/{number} response

Add GitHub Copilot IDE support

Improve skill trigger routing accuracy across models

Update how-to guide with swamp-extension-publish skill

forEach.in with data.latest() throws misleading 'got: object' error for unresolved Promise

Score daily sign-in events with streak multiplier

Reindex path feeds error events to consumer, bypassing filtering

Workflow-scope user extension reports don't execute: getAll() excludes lazy-loaded reports

Architecture violation: search route imports directly from lib/infrastructure

Score extension pull events for extension authors

Document vault migrate command in reference docs

Expand DataRecord with first-class provenance fields; remove all hidden scoping from data access

Add vault migrate command to move secrets between vaults

issue-lifecycle skill: improve resumption and close-out guidance

discord-bot poller double-processes events with >1 replica

datastore sync --push fails on _catalog.db-wal: catalog SQLite DB lives inside the S3 sync cache

.swamp/datastore-bundles/ leaks into deno lint and deno fmt scans

deno run audit task missing --allow-env flag

evals/promptfoo: bump hono and @hono/node-server to clear 6 dependabot alerts