chore(release): prepare 0.0.1-alpha.31

[overcast-release]

This is the release PR for 0.0.1-alpha.31. I opened it from the changelog fragments
that were on main, and I will keep it up to date as more land.

What I did

• Set VERSION to 0.0.1-alpha.31
• Added the ## [0.0.1-alpha.31] section to CHANGELOG.md
• Repointed the compare links at the new tag
• Deleted the fragment files those entries came from

What happens next

• On every push to main — I merge it into this branch, append any new
  entries to ## [0.0.1-alpha.31], and comment to say what I added. You do not need to
  do anything to keep this PR mergeable.
• When you merge this — the release workflow builds and tests, then waits for
  your approval in the release environment before anything is published.

Optional, whenever it suits

The entries are one bullet each, straight from the fragments. The house style
merges same-area entries into single bullets and tightens the prose — see
.changelog/README.md. Reword freely: I only
ever append, and never edit what is already in the section.

Worth doing before you merge: smoke test the release-candidate image rather than
a local rebuild. Its pull command and digest are in the release-candidate comment
below.

---

I cannot merge this myself. VERSION is owned in .github/CODEOWNERS so it needs
your review, and every publish job waits on the release environment.

[overcast-release]

What's in 0.0.1-alpha.31

46 entries — 37 added, 1 changed, 8 fixed.

Breaking changes (2)

• [kms/cloudformation] key-policy mutations apply AWS schema and caller lockout-safety validation
  • migration: ensure custom policies retain kms:PutKeyPolicy for the caller, or explicitly set BypassPolicyLockoutSafetyCheck
• [secretsmanager/cloudformation] generated-secret templates validate before mutation, while KMS key metadata and CloudFormation tags round-trip through the service APIs
  • migration: use PasswordLength 1..4096 (or omit it for 32), and keep GenerateStringKey absent from the template object

Added

• [appconfig] TagResource, UntagResource, and ListTagsForResource for applications, environments, and configuration profiles

• [athena] TagResource, UntagResource, and ListTagsForResource for workgroups

• [bff] normalizeEndpoint now rewrites all loopback endpoints to internal API port, fixing BFF proxying in Docker with remapped ports and no socket

• [bff] deriveAPIBaseURL returns endpoint known/unknown alongside URL; handles native custom API port via default-UI-port fallback

• [cognito] TagResource, UntagResource, and ListTagsForResource for user pools

• [combobox] add allowFreeText prop for editable-after-selection behaviour (seeds query from current value, commits on blur)

• [dynamodb] TagResource, ListTagsOfResource, and UntagResource operations; CreateTable accepts Tags

• [ecs] TagResource, UntagResource, and ListTagsForResource with tag validation

• [eks] TagResource, UntagResource, and ListTagsForResource with tag validation

• [elasticache] AddTagsToResource, ListTagsForResource, and RemoveTagsForResource with tag validation

• [elbv2] AddTags, RemoveTags, and DescribeTags for load balancers and target groups

• [eventbridge] TagResource, UntagResource, and ListTagsForResource for event buses

• [firehose] TagDeliveryStream, UntagDeliveryStream, and ListTagsForDeliveryStream

• [glue] TagResource, UntagResource, and ListTagsForResource for databases and tables

• [iam] TagRole, UntagRole, ListRoleTags, TagUser, UntagUser, and ListUserTags use shared tag accessors

• [kms] TagResource, UntagResource, and ListResourceTags use shared tag accessors

• [lambda] TagResource, UntagResource, and ListTags operations CloudFormation tag updates now apply

• [msk] TagResource, UntagResource, and ListTagsForResource

• [pipes] TagResource, UntagResource, and ListTagsForResource

• [rds] AddTagsToResource, ListTagsForResource, and RemoveTagsForResource

• [router] new /_debug/trace/* endpoints for full request tracing — request/response bodies, per-handler structured log capture across 22 services, internal service-hop recording, and AWS errors. Active when OVERCAST_DEBUG=true; traces are looked up by the request ID already returned in every response (x-amzn-requestid / x-amz-request-id). Includes BFF proxy routes, web UI at /debug/traces with sequence diagram/waterfall/flow map views, live in-flight trace polling, infinite scroll list with auto-refresh, and OVERCAST_DEBUG_TRACE_BUFFER env var for ring-buffer sizing.

• [router] GET /_health now includes a docker block with per-service Docker connection status Responses from Docker-backed describe endpoints carry x-overcast-backing, x-overcast-backing-reason, and x-overcast-container-health headers

• [scheduler] TagResource, UntagResource, and ListTagsForResource

• [secretsmanager] TagResource uses shared tag accessors

• [serviceutil] shared Taggable interface, generic ApplyTags/RemoveTags/ListTags helpers, and TagStore + NSStore for separate-namespace tag storage

• [shield] TagResource, UntagResource, and ListTagsForResource for protections

• [sns] TagResource, UntagResource, and ListTagsForResource operations

• [sqs] TagQueue, UntagQueue, and ListQueueTags use shared tag accessors

• [ssm] AddTagsToResource, RemoveTagsFromResource, and ListTagsForResource for parameters

• [stepfunctions] TagResource, UntagResource, and ListTagsForResource for state machines

• [ui] add copy URL buttons for S3 buckets, objects, and prefixes (S3 URI and path-style formats, actions-menu UX)

• [ui] add copy endpoint button to header alongside connection status indicator

• [ui] overhaul connection dialog with debounced endpoint validation (spinner/tick/cross + tooltip), combobox suggestions, and dynamic label placeholder

• [ui] auto-detect API port when known (Docker socket, native, or 1:1 mapping); show connection dialog when unknown with Docker socket guidance

• [ui] extract endpoint status indicator (dot + baseUrl + copy) into standalone HeaderEndpoint component

• [ui] connection settings (Plug icon) always visible — opens modal when connected, resets dialog when unconfigured

• [waf] TagResource, UntagResource, and ListTagsForResource for WebACLs

Changed

• [web] Docker connectivity is now visible on the /metrics health page and via info banners on Docker-backed resource pages

Fixed

• [cloudformation/dynamodb] Local secondary indexes are applied on table creation, while unsupported LSI updates now fail without mutating the table

• [cloudformation/dynamodb] DynamoDB table TTL configuration is validated, applied, and reconciled during stack create and update

• [cloudformation/cloudwatch-logs] Log group retention, resource tags, and propagated stack tags are applied when a stack creates or updates the group

• [ecs/rds/elasticache/msk] resources no longer report RUNNING/available/ACTIVE when Docker is unavailable

• BREAKING [kms/cloudformation] key-policy mutations apply AWS schema and caller lockout-safety validation
  migration: ensure custom policies retain kms:PutKeyPolicy for the caller, or explicitly set BypassPolicyLockoutSafetyCheck

• [kms/cloudformation] KMS keys created by CloudFormation now honor Enabled: false on first deployment and restore the enabled default when the property is removed.

• BREAKING [secretsmanager/cloudformation] generated-secret templates validate before mutation, while KMS key metadata and CloudFormation tags round-trip through the service APIs
  migration: use PasswordLength 1..4096 (or omit it for 32), and keep GenerateStringKey absent from the template object

• [waf/stepfunctions/shield/glue] fix tag validation gaps: WAF no longer publishes spurious creation events on tag writes; Step Functions typed path validates tags; Shield and ELBv2 validate tag limits; Glue uses shared helpers; RDS fixes unbounded loop; removed dead TaggedResource and shieldTagsToList

[Neaox]

Release candidate testing — 0.0.1-alpha.31-rc.1257

CI

✅ All required checks passed. Compat suites: 2976 pass / 0 fail / 100% pass rate (all suites green, no regressions).

Smoke — console image

• ✅ API /_health returns v0.0.1-alpha.31, 50 services, Docker block present
• ✅ SQS CreateQueue + TagQueue + ListQueueTags
• ✅ SNS CreateTopic + TagResource + ListTagsForResource
• ✅ /_debug/traces list endpoint (pagination, cursor)
• ✅ /_debug/trace/ detail (headers, body, log entries, timing)

Smoke — slim image

• ✅ API /_health returns 200, version correct
• ✅ Web UI port returns minimal page (no SPA, as expected)

Web UI — console image (Chrome DevTools MCP)

• ✅ Dashboard renders with 31 services, v0.0.1-alpha.31
• ✅ Connection dialog: overhauled UI with combobox, debounced validation, Docker socket guidance
• ✅ Header: endpoint indicator with copy button, connection settings always visible
• ✅ S3 bucket list: Copy URL button (s3:// URI and HTTP path-style) via actions menu
• ✅ S3 bucket detail: Copy URL button (dropdown with S3 URI + HTTP)
• ✅ Metrics & Health: Docker block visible with per-service status (DISCONNECTED — no socket)

Targeted — changelog walkthrough

• ✅ Resource tags: SQS/SNS tested, shared serviceutil/tags.go helpers verified
• ✅ Request tracing: /_debug/trace/* endpoints return full trace payload
• ✅ Docker status: /_health docker block, x-overcast-backing headers, docker metrics page
• ✅ Web UI overhaul: connection dialog, endpoint indicator, S3 copy URL, Docker health
• ✅ Breaking changes verified via CI (KMS policy validation, Secrets Manager template validation)

Gaps (not tested — no Docker socket available on this host)

• Lambda/ECS/RDS/ElastiCache/MSK/EFS container-backed operations (tested as metadata-only stubs)

Cleanup

No leftover containers or volumes.

[overcast-release]

Updated for main

I merged eaeb6619 into this branch. It brought no new changelog entries, so
CHANGELOG.md is unchanged.

[overcast-release]

Updated for main

I merged 6cb39fab into this branch and added the entries below to
## [0.0.1-alpha.31] in CHANGELOG.md, deleting the fragment files they came from.

Nothing needed from you — this PR is still mergeable. Reword the new bullets
whenever it suits; I only ever append.

No breaking changes.

Fixed

• [web] path-style S3 copy URLs percent-encode object keys, so keys with #, ?, spaces, or unicode paste as working links

• [web] bundled builds follow the server-injected API endpoint on boot instead of a stale stored one; only endpoints entered in the connection dialog persist as overrides

• [web] reopening connection settings seeds the form from the active endpoint, so Connect keeps a custom endpoint instead of reverting it to the default

[github-actions]

Release candidate 0.0.1-alpha.31-rc.1265

Current for head dd84f70e — workflow run.
Freshly built: this push changed something the image is built from.
Every push to this branch mints a new RC tag; earlier RCs stay pullable.

Images (linux/amd64, linux/arm64)

docker pull ghcr.io/neaox/overcast:0.0.1-alpha.31-rc.1265

_{digest sha256:1e859b48a57ab6e34a00e95d6d9b859c4353460022485594ade52859782eb80a}

docker pull ghcr.io/neaox/overcast-slim:0.0.1-alpha.31-rc.1265

_{digest sha256:b0548d9163a22463f945a14bc970a3bd4f8164fabb7233ffb71ac77b804529f0}

Binaries

Asset	Size
overcast-darwin-amd64	18.5 MB
overcast-darwin-arm64	17.6 MB
overcast-linux-amd64	18.0 MB
overcast-linux-arm64	16.7 MB
overcast-windows-amd64.exe	18.4 MB
overcastd-darwin-amd64	15.0 MB
overcastd-darwin-arm64	14.2 MB
overcastd-linux-amd64	14.6 MB
overcastd-linux-arm64	13.4 MB
overcastd-windows-amd64.exe	14.9 MB

_{Binary artifacts expire after 14 days. RC image tags are transient pre-release builds.}

[github-actions]

Compatibility Tests

✅ No regressions against the baseline

Suite	Pass	Fail	Unimpl.	Skip	N/A	Total
cdk	35	0	0	0	0	35
cli	509	0	0	0	1	510
dotnet-sdk	216	0	0	329	0	545
go-sdk	510	0	0	0	0	510
java-sdk	510	0	0	35	0	545
node-js-sdk	510	0	0	0	0	510
python-sdk	510	0	0	0	0	510
rust-sdk	176	0	0	369	0	545
Total	2976	0	0	733	1	3710

Pass rate (excluding skips and N/A): 100.0%

Full report

[overcast-release]

Updated for main

I merged 94484204 into this branch and added the entries below to
## [0.0.1-alpha.31] in CHANGELOG.md, deleting the fragment files they came from.

Nothing needed from you — this PR is still mergeable. Reword the new bullets
whenever it suits; I only ever append.

Breaking changes (1)

• [logs] PutRetentionPolicy validates retentionInDays against AWS's fixed value set and returns InvalidParameterException otherwise, matching real CloudWatch Logs
  • migration: use one of the AWS-documented retention values (1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288 or 3653 days)

Added

• [kms] UpdateKeyDescription

Fixed

• [cloudformation/kms] AWS::KMS::Key updates dispatch PutKeyPolicy only when KeyPolicy actually changed, so an unchanged caller-locking policy created with BypassPolicyLockoutSafetyCheck survives unrelated stack updates; a KeyPolicy given as a JSON string is forwarded verbatim instead of double-encoded; Description changes are applied through UpdateKeyDescription instead of being ignored

• BREAKING [logs] PutRetentionPolicy validates retentionInDays against AWS's fixed value set and returns InvalidParameterException otherwise, matching real CloudWatch Logs
  migration: use one of the AWS-documented retention values (1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288 or 3653 days)

• [router] debug tracing no longer pins an oversized request body's full backing array in memory when truncating it into the trace ring buffer, and internal CloudFormation dispatch hop bodies are capped at 1 MiB and flagged truncated

• [router] traces of responses written without an explicit status code record 200 instead of appearing in-flight forever in the debug UI

• [sns] TagResource and UntagResource responses include the empty result element botocore requires, so the AWS CLI no longer fails client-side after a successful tagging call