v0.0.1-alpha.30

Overcast v0.0.1-alpha.30

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.30
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.30
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.30
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.30

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	154b132c03433abeb20320a1799e735dbbc8318353f1a3fda98e7f42f6d017f0
overcast-darwin-arm64	c1983e6457d329a71a9b39bb98644a6e7c85ba035f81afff24969310cf9d42e6
overcast-linux-amd64	bd206ec3935acd9240a65d447308bfcad5de301d06ca3c78c98674305de7e1a4
overcast-linux-arm64	43fb09dadd7b210910dd0804a8001559a62b47321b5451b573403e0f0f52ff90
overcast-windows-amd64.exe	b6f1491325d36dd9c65383aa395183ad70e744e0a34fea2194993b1c7d6d934c
overcastd-darwin-amd64	236adea7334df619dff3e5fd0aad0752ec4462d07c0814429759c3068171d6ac
overcastd-darwin-arm64	62afda0b2df35247429236246975887ede1b8dfe47301066fc6814234bc43451
overcastd-linux-amd64	b5bac75bd10f4de82e6e911c0f3c97706db5168000fb59be2dad37385a7140c4
overcastd-linux-arm64	5c5e510621878ecee921825aca3c27caaf1cc4036b109c40d07f92adfd12ba5b
overcastd-windows-amd64.exe	0ea5d784df00328103fd2a5e896f3daa085de65a786ffb2e264593eab726392a

Release Notes

Added

• [waf/web/docs] add Web ACL metadata CRUD views, global search, and system-map nodes while accurately surfacing missing rule enforcement and 501 boundaries

Changed

• [web/ecs] service and task screens prioritize recent container failures, stopped tasks, and logs over follow-on scheduler noise

Fixed

• [cloudformation/rds/ecs] CloudFormation waits for asynchronous resources to become usable before completing them and preserves their physical IDs through stabilisation failures so rollback can delete what it created. AWS::RDS::DBInstance and AWS::RDS::DBCluster now remain in progress until the database reports available, or fail with RDS's recorded reason and roll the stack back; cdk deploy no longer returns green while the engine is still initialising. Failed RDS databases and ECS services are now removed during rollback instead of being leaked under names that collide with the next deployment.

• [cloudformation/s3] AWS::S3::Bucket now applies lifecycle, versioning, notification, encryption, tag, CORS, and website properties through S3, including in-place updates, removals, and rollback restoration. S3 lifecycle configuration now validates and round-trips NoncurrentVersionExpiration while true version-history execution remains tracked separately.

• [cloudformation/lambda] Lambda resources now preserve supported function and event-source properties, reject unsupported fields before mutation, roll back partial updates, and store validated resource policies safely

• [sns/cloudformation] CloudFormation SNS topics and subscriptions now forward configured SNS attributes, including subscription filtering and raw SQS delivery (#522)

• [ecs/web] cluster summaries and topology reflect current resources, while stopped tasks remain inspectable with AWS-compatible status, reason, and one-hour retention metadata

• [ecs] stopped tasks retain a bounded container log tail for post-mortem diagnostics

• [rds] database containers stopped, crashed, or removed through Docker are now recovered with bounded backoff immediately, after Docker reconnects, or during Overcast startup; repeated crash loops settle to failed, only StopDBInstance establishes a durable stopped state, and MySQL 8 initialization now preserves AWS-valid special-character passwords while using caching_sha2_password

• [web/ecs] service diagnostics now keep the actual failed task and container logs visible instead of letting a later clean exit replace the cause; ECS screens add precise event times, two-way task navigation, and distinct working map destinations

Release: https://github.com/Neaox/overcast/releases/tag/v0.0.1-alpha.30

v0.0.1-alpha.29

Overcast v0.0.1-alpha.29

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.29
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.29
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.29
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.29

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	e30067d382ad85882b047ad3f3f5ffdba9aa62fe153ccf5b511ffde58bb9f5bb
overcast-darwin-arm64	e63537f321caf3c40332153f67ea03045c0ef5c2f91811922818bf46a594117b
overcast-linux-amd64	dc1bc0fbc8c310afe96cec43306bc5653b5fdcc59da3e4bca8bed4c444f9ee9e
overcast-linux-arm64	092e0f96a26240e88f99fd721fe4173be9f229b0830f91701b727dda86eeb89b
overcast-windows-amd64.exe	0c7aeda9f89551bd080e79468025e5d11ada06b60b2a96aa1d195797f12292c0
overcastd-darwin-amd64	17e5941eb1b097117588c682e9315df49eb72dbd15a55b4b75fdcab7abf497ef
overcastd-darwin-arm64	1e606a262852328af745d561662138a1003837910b82a63e5a60db1e0efe3937
overcastd-linux-amd64	e2c4700f644e7ee4e27871445d7bec67e0eb5bd31c688230031d4f7ccd252dda
overcastd-linux-arm64	c9d3403c5fdbf1fe6b9d2057903f68156b1b05868188074782a6d42c4999d664
overcastd-windows-amd64.exe	5648600b256c6b265a3d50e16c735eb401add63d4ba5cae3de63c135a7a7d86d

Release Notes

Added

• BREAKING [stepfunctions] a real Amazon States Language interpreter — StartExecution now runs the state machine instead of reporting SUCCEEDED immediately. All eight state types, Retry/Catch, the full Choice operator set and the input/output pipeline are interpreted; Task states invoke Lambda, SQS, SNS, DynamoDB and nested state machines through Overcast's own router. DescribeExecution, GetExecutionHistory, ListExecutions, StopExecution, DescribeStateMachineForExecution and StartSyncExecution report what really ran, and the console gains an executions list and a state-history view. Anything Overcast cannot interpret — .waitForTaskToken, activity tasks, aws-sdk: integrations, distributed Map, JSONata — fails the execution loudly with States.Runtime rather than passing through silently. CreateStateMachine now rejects definitions that are not valid ASL with InvalidDefinition, as AWS does. StartExecution returns while the execution is RUNNING and StopExecution really interrupts it, both matching AWS; StartSyncExecution is the synchronous path
  migration: an execution that used to report SUCCEEDED unconditionally can now legitimately end FAILED or TIMED_OUT — assert on the real outcome. State machines created with a definition that is not valid ASL are rejected at create time. OVERCAST_STEPFUNCTIONS_EXECUTION_TIMEOUT (default 15m) is a runaway guard on each execution; it is not on the request path, so ordinary Wait states are unaffected

• BREAKING [cloudwatch] PutMetricAlarm refuses alarm shapes it cannot evaluate — metric math, anomaly detection, extended statistics — with a 501 instead of creating an alarm that never fires
  migration: replace a metric-math, anomaly-detection or percentile alarm with a single-metric alarm using Average, Sum, SampleCount, Minimum or Maximum

• [apigateway] usage-plan throttle and quota limits are measured on every request that presents an API key — GetUsage returns AWS's daily [used, remaining] log per key, and reaching a limit publishes an apigateway:Throttled event. OVERCAST_ENFORCE_APIGATEWAY_THROTTLE (default off) turns that measurement into rejection, answering an over-limit request with API Gateway's 429: TooManyRequestsException for the rate limit, LimitExceededException for the quota. The console's Usage Plans page shows each plan's rate, burst and quota, today's usage per API key, and a live feed of limits being reached

• [autoscaling] Auto Scaling groups converge for real — a single background reconciler launches and terminates EC2 instances until the owned instance set matches DesiredCapacity, runs the Pending/InService/Terminating lifecycle, replaces unhealthy instances, and records a DescribeScalingActivities entry for every launch and termination. PutScalingPolicy executes SimpleScaling and StepScaling policies, through ExecutePolicy or from a CloudWatch alarm naming the policy ARN in its actions, honouring cooldowns and MinAdjustmentMagnitude; PutLifecycleHook really pauses a launch or termination in Pending:Wait/Terminating:Wait, publishes the EventBridge lifecycle-action event, and waits for CompleteLifecycleAction or the heartbeat timeout. New: DescribeScalingActivities, ExecutePolicy, CompleteLifecycleAction, RecordLifecycleActionHeartbeat, SetInstanceHealth and SetInstanceProtection

• [cloudwatch] alarm state transitions publish the CloudWatch Alarm State Change event to EventBridge and notify SNS alarm actions; new DescribeAlarmHistory, EnableAlarmActions and DisableAlarmActions, plus StateReasonData, Dimensions, DatapointsToAlarm and the action lists on DescribeAlarms. The console's CloudWatch page gains a live alarms view showing state, reason, what is being evaluated, and recent transitions

• [ecs/secretsmanager/ssm] a container definition's secrets are resolved and injected as environment variables at task start, from Secrets Manager (including the :json-key: suffix that ecs.Secret.fromSecretsManager(secret, "password") produces) or SSM Parameter Store. They were parsed into nothing, so a task promised its credentials started without them and the application failed to reach its database with no explanation. A secret that cannot be resolved is named in a warning and left out rather than injected empty, which would be indistinguishable from a secret whose value is the empty string

• [ecs/logs] task containers using the awslogs log driver have their output shipped to CloudWatch Logs, into the group from awslogs-group and a stream named <prefix>/<container>/<task-id> as on ECS — under either launch type and however the task was started. A crash-looping task previously explained itself nowhere, its container being gone before docker logs could reach it

• [ecs] deployments report rolloutState, rolloutStateReason and failedTasks, and a service records the AWS-shaped events for a placement failure, for being unable to consistently start tasks, and for a tripped deployment circuit breaker. In the console a service row expands to show its rollout state, failed task count and event log, and task detail shows stopCode and per-container failure reasons; the Run Task and Create Service dialogs now take subnets, security groups and assignPublicIp, so a Fargate task can be started from the UI at all — it previously always failed with "Network Configuration must be provided when networkMode is 'awsvpc'"

• [ecs/elbv2] a service registers its tasks with the target groups in its loadBalancers, at the task's ENI address and container port, and deregisters them when they stop or the service scales in

• [efs] mount targets can serve a real NFSv4 export — OVERCAST_EFS_NFS=true in live mode starts one unprivileged NFS-Ganesha container per mount target, with access points as pseudo-paths

• [elbv2/ecs] a load balancer forwards to its targets, so ApplicationLoadBalancedFargateService hands out a URL that serves the application. A listener now stores the DefaultActions carrying its target group — previously parsed by the CloudFormation handler and dropped — and a request arriving on the load balancer's DNS name is proxied round robin to a registered target, preserving the Host so an app behind it builds its own links correctly. A load balancer with nothing healthy behind it answers 503, as ALB does

• [eventbridge] rule targets now fan out to Lambda, SNS, Step Functions, Kinesis and Firehose, not just SQS and scheduled ECS tasks; an EventBridge event bus is also a valid target, delivered through PutEvents with a hop budget so bus-to-bus forwarding cannot recurse. InputPath and InputTransformer are applied to a target's payload before delivery, and a failed delivery honours the target's RetryPolicy and dead-letter queue. The console's bus view lists each rule's targets with its resolved type and the last delivery outcome — delivered, retried, dead-lettered or dropped

• [iam] SimulateCustomPolicy, evaluating policy documents passed in the request without touching any stored entity. Opt-in request-time enforcement (OVERCAST_ENFORCE_IAM, unchanged and still off by default) now shares the simulator's evaluator, so a simulation describes what enforcement would decide, and it is documented in the IAM service reference. The console's IAM page gains a policy simulator — pick a principal or paste a policy, see the decision and the statements behind it — with the enforcement flag's state shown beside it, so an AccessDenied can be told apart from an application bug

• [pipes/web] a pipe detail view showing the resolved source, enrichment and target types, recent executions, and whether a pipe is actually wired or only stored

• [release] breaking changes wait while a minor or patch release PR is open. That PR's section of CHANGELOG.md is written and reviewed while it sits there, and every push to main is folded into it, so a break merged in the window ships under a version number that promised there was none. The release bot comments on the held pull request with the entries holding it and t...

v0.0.1-alpha.28

Overcast v0.0.1-alpha.28

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.28
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.28
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.28
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.28

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	d8925bba8eafb54ecffd4fa8466cf5066e38e99728386996fe91b024ed26f5fd
overcast-darwin-arm64	2bc691314e779c7a0c58b1bfd8980a172dbfb45dd48cd3773bbe81354ffaa761
overcast-linux-amd64	d97aed759b89fdcf3c2d1ee3439c324e1c6cab738bd5b9af69be66eb9d9be1c9
overcast-linux-arm64	6aa30a5abda0be9908871517f6be26c30c72a5ac04545f19f429cf6a94cdddc7
overcast-windows-amd64.exe	17ffc17b7c910a5a2ce851881fae57c4b5fd16fa508afd81c10b6e8e4118ebb4
overcastd-darwin-amd64	a08780aee173ee4c327e86f768115c661f86ffab09104521d237bb4f57018658
overcastd-darwin-arm64	ad1174ba17a6a35e89c2238b07c0f20f661b5a45da4528dce904ec0430320e76
overcastd-linux-amd64	ea535937329ff166bb1cc5fe39829ac6186000b049d509cc004045d0d853ddb9
overcastd-linux-arm64	e7c22fac2bff97ba89648cedc7d79fa9da1b33a9460411ff94a37eb6bcc36c3f
overcastd-windows-amd64.exe	38a8285550d6ca6377687d5afb26b645d25057781c5aec37b42ceeb1752c54c5

Release Notes

Added

• [cloudformation] AWS::EFS::FileSystem, AWS::EFS::MountTarget, and AWS::EFS::AccessPoint provision end-to-end, including FileSystemPolicy, LifecyclePolicies, BackupPolicy, FileSystemProtection, tag sync on update, and AWS-matching replacement semantics

• [docker] the internal Docker client gained volume operations (CreateVolume, RemoveVolume, ListVolumes) with the standard managed labels

• [ecs] task definitions now model volumes (including efsVolumeConfiguration) and container mountPoints, with AWS's undefined-volume validation; when EFS live mode is active, task containers mount the file system's backing Docker volume at each mount point (honoring readOnly), sharing real file data with Lambda functions that mount the same file system

• [ecs] RegisterTaskDefinition now rejects efsVolumeConfiguration combining an accessPointId with a rootDirectory other than /, matching AWS

• [efs] opt-in live mode (OVERCAST_EFS_MODE=live): each file system is backed by a named Docker volume (overcast-efs-<FileSystemId>), created on CreateFileSystem, removed on DeleteFileSystem, and reconciled on startup (missing volumes recreated, orphans removed); the control plane degrades gracefully when Docker is unavailable

• [efs] live-mode mounts now honor root directories: Lambda FileSystemConfigs mounts are scoped to the access point's RootDirectory, and ECS efsVolumeConfiguration mounts to the access point's root or the declared rootDirectory, via Docker volume subpath mounts (Docker Engine 26+). Access points with CreationInfo have the directory created in the volume with the declared ownership and permissions before the first mount; without CreationInfo a missing directory fails the mount, matching AWS

• [efs] new service: EFS control-plane emulation under the real /2015-02-01/ REST-JSON API — file systems (create/describe/update/delete, protection), mount targets (incl. security groups), access points, file-system policies, lifecycle configuration, backup policy, tagging (current + legacy APIs), and account preferences, with creating → available → deleting lifecycle states

• [lambda] FileSystemConfigs is now modeled on CreateFunction, UpdateFunctionConfiguration, and GetFunctionConfiguration (one config max, EFS access-point ARN, /mnt/<name> mount path — matching AWS validation); when EFS live mode is active, the function's containers mount the backing Docker volume at LocalMountPath, so invocations share real file data with each other and with other services mounting the same file system

• [lambda] REPORT log lines now carry Init Duration on the cold-start invocation of on-demand execution environments (measured from container start to the runtime's first GET /next), in AWS's field order and format; warm invokes and provisioned-concurrency environments omit it, as on AWS

• [lambda] opt-in proactive initialization (LAMBDA_PROACTIVE_INIT): once a function's configuration settles after a deploy, one execution environment is pre-created in the background so the next request lands warm — mirroring AWS's documented proactive initialization, including AWS_LAMBDA_INITIALIZATION_TYPE=on-demand and no Init Duration on the first REPORT line

• [release] changelog entries carry a compatibility marker, so a release bump can be derived rather than chosen. - Removed defaults to breaking and everything else to compatible, prose naming an input or output contract ("now requires", "now rejects") forces an explicit answer either way, and a breaking entry must carry a migration: note. Calibrated against the entries in flight: 2 of 32 are asked

• [release] a Release Prep workflow (workflow_dispatch) prepares a release end to end: derives the version, assembles and inserts the changelog section, repoints both compare links, writes VERSION, deletes the consumed fragments, opens the PR, and comments a summary listing breaking changes with their migration notes. It never merges — VERSION is CODEOWNER-owned and publishing still waits on the release environment. Re-running against an open release PR reports the fragments that have landed since rather than rewriting the section, so curation is never discarded

• [release] changelog.py release applies the mechanical release-prep edit and changelog.py next-version derives the next version. While in alpha that is the prerelease counter incrementing; deriving a stable bump from the entries stays unimplemented until 1.0 rather than guessing the policy

• [route53] Route 53 is now emulated at inert level (25 operations, up from 10). New: ListHostedZonesByName, GetHostedZoneCount, UpdateHostedZoneComment, tags (ChangeTagsForResource, ListTagsForResource, ListTagsForResources), and health check CRUD (CreateHealthCheck, GetHealthCheck, ListHealthChecks, GetHealthCheckCount, UpdateHealthCheck, DeleteHealthCheck). Hosted zones now get default apex NS/SOA records and a delegation set, CreateHostedZone enforces caller-reference uniqueness (HostedZoneAlreadyExists) and returns the Location header, DeleteHostedZone enforces HostedZoneNotEmpty, ChangeResourceRecordSets validates batches atomically with AWS error codes (InvalidChangeBatch for duplicate creates, missing/mismatched deletes, out-of-zone names, apex CNAMEs) and stores routing metadata (SetIdentifier, Weight, Region, Failover, GeoLocation, MultiValueAnswer), list operations paginate in DNS order, names are canonicalised to lowercase, and errors use Route 53's ErrorResponse envelope. CloudFormation gains AWS::Route53::HealthCheck plus hosted-zone tag/VPC pass-through and comment-only in-place updates.

• [release] a release PR now keeps itself mergeable: every push to main merges into the release branch and appends any new changelog entries to the version section already there, deleting their fragment files, so the changelog gate goes green without anyone editing anything. Folding is additive — no bullet already in the section is read, reordered or rewritten — so curation done by hand survives, and rewording the appended bullets is optional polish rather than a chore every merge forces

• [release] the release-prep workflow now runs on every push to main: when a release PR is open it merges main into the release branch, pushes, and comments with the entries still to curate. Refreshing the branch is what re-runs the PR checks, so a release PR can no longer sit green while going stale

Changed

• [apigateway] proxied requests no longer re-scan and re-decode the API's entire resource/route set on every request — routing state is cached per API and invalidated on any resource or route write

• [lambda] the invoke path no longer SHA-256s the whole deployment package on every invocation (and every configuration read) — the hash is computed once when code is written and stored on the function record, cutting per-invoke CPU for large packages

• [lambda] deployment packages are stored separately from function records, so invoke-path reads no longer base64-decode the whole zip on every invocation (and S3 code-sync events no longer decode every function's package); existing records migrate automatically on their next write

• [lambda] cold starts reuse cached artifacts instead of rebuilding them every time: code and layer tars are kept in a byte-bounded in-memory cache (LAMBDA_TAR_CACHE_MB, default 256, 0 disables), the bootstrap and TLS trust-root tars are built once, and the per-acquire image-presence check is skipped once an image is verified

• [lambda] removing a runtime image mid-session (docker rmi) no longer breaks that runtime until restart — a container create that finds the image missing re-pulls it and retries

• [lambda] cold-start artifacts (code and layer tars) are pre-built in the background once a deploy settles, so even the first cold start of a new code version skips the package fetch and conversion; the artifact cache is reported on the /_lambda/instances debug endpoint

• [lambda] proactive initialization now counts API Gateway integrations and AppSync Lambda da...

v0.0.1-alpha.27

Overcast v0.0.1-alpha.27

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.27
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.27
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.27
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.27

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	146c385f2362ebb984830f961866f92e5f957fb93e568674438494561c3dea6c
overcast-darwin-arm64	636313589259988186984dd732184c83d47a803bbff8a1879310e306b1aa53aa
overcast-linux-amd64	bbdca26919c9eb438acc94ac69f2c40cd5bd7c6c76d18969d997ce3ac68998e7
overcast-linux-arm64	135e10bdc40d98faac7db5caf88927adea0f3128c0595957410abe37eefb6f32
overcast-windows-amd64.exe	636ef72268c7cd4c5e6a9629ba8e1fdc431f31f43de8a3f538ef380a6d3658c0
overcastd-darwin-amd64	d6173742dfeb1fd9a91c20c00cfee50c665cab0f73e17e523951b3894c254156
overcastd-darwin-arm64	08d4d127406a82b422c966a4b7b7c3c3ad1d2e35a4314ef410f90421c946706f
overcastd-linux-amd64	35f96ad62cefffe0e52d02558fdfe954701081f30709068d78bc7129525fc644
overcastd-linux-arm64	527f630f75066a6c8601face8cb33650ad6520b09db12c8a55a1c8a1e5540e8f
overcastd-windows-amd64.exe	a3fa454c1031dd27540895b3db724446e9b2267c25e8103b107c3ccb5d780bc5

Release Notes

Changed

• Release process (changelog) — unreleased changes are now recorded as one fragment file per PR under .changelog/ instead of direct edits to CHANGELOG.md's [Unreleased] section, which every concurrent PR used to merge-conflict over. CI lints the fragments and keeps [Unreleased] empty (scripts/changelog.py check); release prep assembles the fragments into the versioned section (scripts/changelog.py assemble), and the release gate fails if any fragment is left unconsumed.

• CI (release safety) — publishing now requires the maintainer's one-click approval: the release workflow's four publish jobs run in a release environment with a required reviewer, so builds and tests stay unattended while nothing ships without a human seeing the exact SHA. Alongside the repository ruleset changes (required status checks, no bypass actors), routine merges no longer use --admin — the rules that were previously convention are now enforced, including on automation.

Fixed

• CloudFormation (stack updates) — stack updates no longer destroy live resources behind pinned names, and resources whose services reject duplicate creates can now actually be updated. Two related engine/handler defects: first, a replacement whose create is an upsert keyed by a pinned name handed back the original physical ID, and both the post-success cleanup and the rollback path then deleted that ID — destroying the one live resource behind a stack that reported UPDATE_COMPLETE (confirmed with CloudWatch alarms); the engine now reports a same-ID replacement as an in-place update, which also makes the create-overwrite of every upsert-style service (Athena, Glue, Firehose, OpenSearch, MSK, ECS, WAFv2) the correct in-place behaviour. Second, pinned-name resources on services that 409 duplicate creates could not be updated at all, because replacement re-created the same name; their handlers now replace only on the properties real CloudFormation replaces on and apply the rest through the service's own update API (CloudWatch PutMetricAlarm, Route53 UPSERT, EKS UpdateClusterConfig/UpdateClusterVersion/UpdateNodegroupConfig/UpdateAccessEntry/UpdatePodIdentityAssociation, Transfer UpdateUser, Pipes PATCH), while backup vaults, scheduler schedule groups, and the RDS/ElastiCache subnet groups — which have no modify operation — keep the live resource via a name-guarded identity update instead of a guaranteed 409. AWS::ECR::Repository, the original symptom, now updates RepositoryPolicyText and lifecycle rules in place instead of replacing on any property change, so re-running cdk bootstrap after a CDK upgrade succeeds instead of dying with RepositoryAlreadyExistsException, and GetAtt's RepositoryUri is re-read from ECR so it reflects the registry this environment actually serves. Scheduler schedule groups with tags also create correctly now — CloudFormation-shaped tag lists were passed to the emulated API's map form, failing every tagged create. Replacement-on-any-change is deliberately kept where it is real CloudFormation behaviour (Shield, ACM, LaunchConfiguration, IAM AccessKey, EKS FargateProfile).

Release: https://github.com/Neaox/overcast/releases/tag/v0.0.1-alpha.27

v0.0.1-alpha.26

Overcast v0.0.1-alpha.26

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.26
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.26
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.26
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.26

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	6ac8c65defc1d343242f685f47909e47695b80b31c9796c9b0db623acdf0a4b8
overcast-darwin-arm64	db81a245b0e3c19ea3d166369eec25351d814c6287fd200456c4dfcf74e5a51b
overcast-linux-amd64	a77c1142aeeee065fdc3e24ad553f490c61e2cb6ee7792b864a16eb1ddec8af3
overcast-linux-arm64	0c7c7ddb128fba194c27f9df1332fea2978a8f241bbe41c7f9ddf7db7d832905
overcast-windows-amd64.exe	bb7626ad41a9884e751267e3893ebd9ca41227d404fad3233a40c4513aef9326
overcastd-darwin-amd64	519c45f17baf1a51002dcb14b9f4d5ad26e4a9d9663868a2f84f514fe9e62b2f
overcastd-darwin-arm64	9897333aa399166c1c50839bce9840f6d4b4a244ea7bbfc0d95282c82a1713b3
overcastd-linux-amd64	93b89bf81d1a0c41bfd3fff198acdae7522d85c3a57c03a85a2cee9768109ccf
overcastd-linux-arm64	a90e7ad1baa6da0460910463c9ddf931937192d24d2df6c6986e70406c753bf8
overcastd-windows-amd64.exe	4c10dec6cbc0ee6d47ef255183504eadb8d34f9164900319c3819e09eee5f50e

Release Notes

Added

• CI (release candidates) — every build of a release PR now publishes the exact images CI built to GHCR as ghcr.io/neaox/overcast[-slim]:<version>-rc.<n> (linux/amd64, <n> auto-increments per build, earlier RCs stay pullable), uploads all ten cross-built native binaries as workflow artifacts, and maintains a single release-notes-shaped bot comment on the PR with pull commands, image digests, and the artifact table. Until now the PR workflow built images and binaries only as checks and discarded them, so pre-release smoke testing always ran against local rebuilds rather than the candidate bits themselves. Release-candidate detection is one shared predicate rather than a branch-name convention: a same-repo PR whose VERSION carries no v<VERSION> tag yet (scripts/release-candidate-check.sh) — which also covers follow-up PRs after a failed release workflow, a case a release/* branch test is blind to; the release workflow's changelog validation now uses the same predicate and so gains the same coverage. Fork PRs and ordinary PRs are unaffected. The ten-asset binary matrix, previously duplicated between the CI and release workflows and drifting one edit at a time, is now stated once in a shared workflow_call (build-binaries.yml) used by both — so the binaries checked on the release PR are built by the same definition that publishes them.

• HTTPS / HTTP/2 (OVERCAST_TLS=auto, overcast https) — Overcast can now serve both the API and the web UI over browser-trusted HTTPS with certificates minted from a local overcast CA, unlocking HTTP/2 in browsers. This fixes the web console starving under load: browsers cap HTTP/1.1 at six connections per origin (localhost included) and never negotiate cleartext HTTP/2, so the console's SSE feed, Lambda invoke progress streams, S3 transfers and polling could exhaust the sockets and make navigation hang; over TLS the browser multiplexes everything on one connection via ALPN. New overcast https enable|disable|status does the whole setup in one command (create the CA under <data dir>/ca, install it into the system trust store — user-scope certificate store on Windows, login keychain on macOS, system CA bundle on Linux — and mint a leaf covering localhost, 127.0.0.1, ::1, localhost.overcast.sh, *.localhost.overcast.sh, *.s3.localhost.overcast.sh, the other wildcard DNS domains, OVERCAST_HOSTNAME, and OVERCAST_SPLIT_HORIZON_HOSTS); overcast trust install|uninstall|status, previously a stub on every platform, now actually manages the CA in the trust store. OVERCAST_TLS=auto makes overcast serve mint/reuse that leaf at startup (re-minted automatically when the name set changes or expiry nears; leaves live 825 days, the CA 10 years, and re-minting never invalidates the trust-store install). Explicit OVERCAST_TLS_CERT/OVERCAST_TLS_KEY now applies to the web UI listener too, not just the API; the SPA bootstrap, minted client-facing URLs, and init-hook environment (AWS_ENDPOINT_URL, plus a new AWS_CA_BUNDLE) all say https when TLS is on; the Docker HEALTHCHECK probes https as a fallback; plain-HTTP defaults are unchanged, including h2c for SDK clients. serve --bridge is skipped with a warning while TLS is on (the port-80 proxy speaks plain HTTP). See the new docs/https.md. Docker setup is now two commands with no shared volume: the daemon serves its CA certificate (public half only) at GET /_overcast/ca.pem (404 until a CA exists; mirrored on the web UI as /api/ca.pem), and overcast https enable --endpoint http://localhost:4566 fetches it, validates it actually is a CA certificate, caches it under <data dir>/ca-remote/<host_port>/ (kept separate from the local CA so status/disable --endpoint find exactly what was installed), and installs it into the system trust store — http:// spellings auto-negotiate to a TLS-only daemon, non-loopback endpoints are refused without an explicit --trust-remote acknowledgement, and the same --endpoint works on overcast trust install|status|uninstall. A containerized daemon logs the exact --endpoint command at startup. Both Docker images serve TLS + HTTP/2 (the slim image on its API listener; both health checks handle https), and on Linux installed anchors are now fingerprint-named so a local CA and fetched daemon CAs coexist (anchors installed by earlier builds under the old fixed name are still recognised and cleaned up).

• Lambda (concurrency) — a function now scales out to one execution environment per concurrent invocation instead of sharing a single warm container, and provisioned concurrency actually allocates environments. PutProvisionedConcurrencyConfig pre-initializes the requested number in the background (IN_PROGRESS → READY), holds them open against the idle sweep, replenishes them when one is lost, rebuilds them against the new configuration after a code/config update, restores them across a restart, and marks their containers AWS_LAMBDA_INITIALIZATION_TYPE=provisioned-concurrency; Allocated/Available are reported from the environments that actually exist. It behaves as a floor rather than a ceiling, so invocations beyond the reservation spill over into on-demand capacity with a cold start rather than throttling, matching AWS. Previously the config was stored, echoed back as READY, and nothing was ever pre-warmed. DeleteProvisionedConcurrencyConfig and ListProvisionedConcurrencyConfigs are now implemented, and all four operations moved to the /2019-09-30/ path AWS actually serves them on — the AWS SDKs' calls previously missed the handlers entirely and fell through to the S3 catch-all. Reason: FAILED with a StatusReason is now reported when Docker is unavailable, instead of claiming capacity that cannot exist.

• Lambda (concurrency limits) — ReservedConcurrentExecutions is now enforced: exceeding it returns AWS's 429 TooManyRequestsException (Type/message/Reason/retryAfterSeconds body, X-Amzn-Errortype and Retry-After headers) with Reason: ReservedFunctionConcurrentInvocationLimitExceeded, so throttle-handling code and the "reserve 0 to disable a function" idiom now work as they do on AWS; it was previously stored and returned but never applied. The three reserved-concurrency operations also moved to the API versions AWS actually serves them on — PutFunctionConcurrency and DeleteFunctionConcurrency on /2017-10-31/, GetFunctionConcurrency on /2019-09-30/ — having been registered on Lambda's /2015-03-31/ base, where no AWS SDK or CLI call could reach them: they fell through to the S3 catch-all and came back as 404 NoSuchBucket naming the API version as the bucket, so reserved concurrency could not be set at all through a real client. GetFunctionCodeSigningConfig had the same defect and moved to /2020-06-30/. A disabled Lambda now also reports "service disabled" on every API version it serves rather than letting the non-base ones fall through to S3. New LAMBDA_MAX_INSTANCES, LAMBDA_MAX_INSTANCES_PER_FUNCTION and LAMBDA_MAX_WARM_INSTANCES (default 10) bound how many containers Overcast will run on your machine; when unset, the first two — along with LAMBDA_DOCKER_MAX_CONCURRENT_STARTS — are sized to the machine Docker actually runs containers on (its GET /info NCPU/MemTotal, which is the Docker Desktop VM or remote daemon, not necessarily where the Overcast process runs): concurrent starts clamp(NCPU/2, 2, 8) because each start bursts ~2 CPUs during INIT, instances clamp(MemTotal×0.65 / 256 MiB, 4, 32), per-function clamp(maxInstances/2, 2, maxInstances), logged once at startup, with the previous fixed defaults (4/25/10) applying when /info cannot be read. New LAMBDA_MAX_MEMORY_MB additionally budgets memory in bytes rather than containers: a new container is admitted only while Σ MemorySize of live containers stays inside the budget (default 65% of the Docker host's MemTotal; unlimited when /info cannot be read) — a real bound, since every container is hard-capped at its MemorySize with swap disabled — using the same reclaim ...

v0.0.1-alpha.25

Overcast v0.0.1-alpha.25

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.25
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.25
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.25
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.25

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	9f45e9636ed07b0633cc66de7a0685f3182c3c0c43416e898dfc47d9d5627c49
overcast-darwin-arm64	2e154c58d747aba0d41bfeec72b7ab0b2f90f31f8677a6cf56c97cd8727e32b1
overcast-linux-amd64	f7a7d14df0a04c6b7f61b04d18c0c502bf1d20d4a2253aa8ea8c87f4d6504a24
overcast-linux-arm64	4acb7bd60d99a98a0b0f51c38c71b278831f3d442b21d6e17f3053ba27c3b0ca
overcast-windows-amd64.exe	1aa1eb4787aa3801026a9909c636a2242cd1839065e91c68aae0d00704734d9f
overcastd-darwin-amd64	4d3bec857f4fdd6c3082ec8d081608c6122f249481e8ba707231de42e7b61e14
overcastd-darwin-arm64	478f15bd2b13619a6d32c928864c1aac47a9d94e0fd85ee5e89719e3faba4819
overcastd-linux-amd64	6ca8ff5316f5056eed301ef2b96e12aace09196c2ea34a3d0899510226946c76
overcastd-linux-arm64	d7e62bf96ee01e362edcaad0226dc5022c8468f2381aed4cbed708b530cb35e9
overcastd-windows-amd64.exe	412ae446094197071eaa70f8c4e6cd8e35eb7ced0f45020bc5a7e89696dcb2ce

Release Notes

Added

• Networking — real AWS Host-routed (subdomain) addressing now works alongside path-style URLs, via a shared host-route dispatch table (internal/middleware/hostroute.go): API Gateway invoke ({apiId}.execute-api.{region}.<base>, both REST v1 stage-prefixed and HTTP v2 $default/named-stage forms), a brand-new Lambda function URLs feature (CreateFunctionUrlConfig/Get/Update/Delete/ListFunctionUrlConfigs plus Host-routed invocation mapping the request to the payload-v2.0 event shape; AuthType is stored but not enforced, matching Overcast's non-security-boundary stance), and AppSync GraphQL ({apiId}.appsync-api.{region}.<base>/graphql, also covering the colocated /realtime endpoint). See docs/networking.md for the wildcard-DNS (*.localhost.overcast.sh) setup story and its offline caveats.

• Diagnostics — GET /_debug/metrics and the Metrics & Health page's new "Storage Activity" card report cumulative storage-layer reads/writes since process start for every backend (memory, persistent, WAL, hybrid); a hybrid-mode store additionally breaks reads down by which tier actually served them (memory vs. a fall-through to SQLite) and shows how many accepted writes have been flushed to disk so far.

• Events — resource lifecycle events (SQS queues, S3 buckets, DynamoDB tables, SNS topics/subscriptions, Lambda functions, and most other resource-create/delete/update events) now carry the resource's ARN on the event envelope (resourceArn in the SSE stream and MCP event feed); the web UI's Event Stream page auto-links any ARN it finds — the new field, or one embedded anywhere in a payload/error string — to that resource's page for every service that has one.

• CloudFormation — RollbackStack is now supported, so cdk rollback can recover a stack that a failed deploy left stuck: a stack in UPDATE_FAILED or UPDATE_ROLLBACK_FAILED rolls forward through UPDATE_ROLLBACK_IN_PROGRESS to UPDATE_ROLLBACK_COMPLETE, and a CREATE_FAILED stack unwinds through ROLLBACK_IN_PROGRESS to ROLLBACK_COMPLETE, emitting the usual stack events along the way; previously the operation returned 501 and a failed cdk bootstrap/cdk deploy left the stack permanently un-deployable, since the CDK CLI refuses to retry until the stack is rolled back. Any state without a stable state to return to (CREATE_COMPLETE, UPDATE_COMPLETE, in-progress states) is rejected with the AWS-accurate 400 ValidationError. Note that Overcast keeps no snapshot of each resource's pre-update properties, so a rollback restores the stack's status and retires resources left in a failed state rather than reverting individual resource configuration.

• S3 — virtual-hosted-style addressing now recognises localhost.overcast.sh and localhost.localstack.cloud as base hostnames with no configuration (both are wildcard-DNS domains resolving to 127.0.0.1), so an SDK or CDK pointed at either resolves buckets correctly out of the box; OVERCAST_HOSTNAME still works and now adds to those defaults rather than replacing them, and bases are matched longest-first so a configured parent domain cannot shadow a longer default. When a request still looks virtual-hosted against an unrecognised base, the server now logs a warning (once per distinct host) naming the received Host, the configured OVERCAST_HOSTNAME, and the fix — previously the bucket was silently not extracted, the request stayed path-style, and the object key was then parsed as the bucket name, producing a confusing "bucket name is not valid" error naming the key rather than the real problem.

• Web UI — the console is restyled to the Overcast brand design system: brand colour tokens and JetBrains Mono throughout, working in both light and dark themes (including a theme-aware favicon.svg that follows prefers-color-scheme), a 228px sidebar and 52px topbar, breadcrumbs that omit the current page since its heading already names it, a search box that is present on every page and ranks results from the service you are currently viewing first, and a dashboard that groups services by how completely they are emulated (fully/partially/not emulated) with a grid-or-list view toggle that persists between visits. Every service list page now shares one layout — a card-wrapped table with mono column headers, a per-row type icon, consistent row actions, and the same Docs/Raw state/Refresh/Create header ordering — so pages no longer each invent their own. The command palette follows suit: service icons are monochrome, pin stars are always visible rather than appearing on hover, and services the emulator has disabled are greyed out and non-navigating instead of looking available. Typography now follows the brand rule throughout (JetBrains Mono for headings, labels, badges, table bodies and identifiers; the system sans for prose), and the dashboard no longer files a running service under "not emulated" merely because its emulation tier is incomplete. Lists now load into static skeleton rows rather than a centred spinner; dialogs gained a header/body/footer anatomy and the ⏎ to create · esc to cancel contract they previously only advertised; toasts gained a pending variant, so a slow upload or deploy reports progress instead of nothing; and an emulator that is configured but unreachable now shows a connecting screen with a retry, where it previously rendered nothing at all.

Fixed

• S3 — virtual-hosted-style addressing (bucket name in the Host header, e.g. bucket.s3.localhost:4566) now also recognises the legacy dash-region dialect bucket.s3-<region>.<base> (e.g. bucket.s3-us-west-2.amazonaws.com); it previously mis-extracted the bucket name as bucket.s3-<region> instead of bucket, breaking every request. Added integration-level pinning coverage (previously unit-test-only) confirming the existing .s3./plain-.localhost/OVERCAST_HOSTNAME forms already route correctly end-to-end through the real router, including dotted bucket names, nonexistent-bucket/key error fidelity (NoSuchBucket/NoSuchKey), and sub-resource calls (?location).

• Wire protocols — JSON-protocol services using the shared request decoder now reject an unparseable request body with 400 SerializationException, matching real AWS (DynamoDB-style coral services and Smithy's malformed-request protocol tests), instead of the non-AWS InvalidArgument code; five services (Kinesis, Backup, CloudTrail, Transfer, ECS) already returned the correct code via local variants and are unchanged.

• AppSync, API Gateway — request header names reach resolvers and integration events with AWS's casing rather than Go's. Go canonicalises incoming header names, so a client's x-api-key arrived as X-Api-Key, and that casing was copied verbatim into the VTL and JS resolver contexts, the direct Lambda resolver event, and the Lambda authorizer's requestHeaders. AppSync documents ctx.request.headers in lowercase and VTL map access is an exact lookup, so a resolver written from the AWS docs as $ctx.request.headers.get("x-api-key") silently returned null — authentication itself was never affected, which is why this presented as "the header works but my resolver cannot see it". Two API Gateway divergences found alongside it: REST (payload 1.0) headers and queryStringParameters returned the first duplicate value where AWS returns the last, with all values in multiValueHeaders; and the HTTP API payload-1.0 branch emitted lowercase comma-joined headers beside Go-canonical multiValueHeaders in the same event.

• Web UI — hover, focus and busy states now match the design and, in several places, exist at all: a dozen surfaces used hover classes that were never declared and so did nothing, a focus-visible:: typo meant that ring never compiled, buttons never showed a pointer cursor, and busy buttons were marked disabled so they dimmed and read as unavailable while working. Two keyboard defects went with them — inactive tabs were unreachable (no arrow-key handling behind tabIndex={-1}) and clickable table rows could not be focused. The event stream is legible in ligh...

v0.0.1-alpha.24

Overcast v0.0.1-alpha.24

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.24
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.24
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.24
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.24

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	71024f3cf22af9a426ca3189750b19df60a24bf1994d5f5815616dac6bc4548e
overcast-darwin-arm64	1906e02852340e9ceea26e28282060571020a2ac17317ce0a59ab59ec797e28c
overcast-linux-amd64	9d13b08ba2a71d13682e324cbff13e4b6f5504e8ca7ab04e4f37c07e13083827
overcast-linux-arm64	03bab96596a124b395aa8aa08cbfc7a49c3834c46d4d36f4ecc11e93460db62b
overcast-windows-amd64.exe	17ca428de4649d0e442d9621b38ad4164f21860af9a33252a9aac92ad900f62c
overcastd-darwin-amd64	92c3446268718b8a1509add04c14e247a13263cc04ce7cdd692d1e306cf35d8b
overcastd-darwin-arm64	81bf2b23341f240b33257f9095d92032fefc800d4b16612d1465f62491223912
overcastd-linux-amd64	bc92e022b8126cb4468680093e617d0effa9387a1d7811ea7313bcad991708e9
overcastd-linux-arm64	8f645a0bec4b437eac446afa07bc27e270e7c0121ae147b86e5bfd2ca5ca93f0
overcastd-windows-amd64.exe	c7e882f72f54eee4ab5f0d9112701a2b8584ab498720ebd77454de44badfc9ee

Release Notes

Added

• Storage (behavior change) — OVERCAST_STATE now defaults to auto instead of a baked-in memory (Docker image) or hardcoded default (native binary). Unset or set to auto, Overcast resolves the mode at startup from evidence of persistence intent: a mounted volume or bind mount at the data directory, an explicitly configured OVERCAST_DATA_DIR, or an existing database file — any of these selects hybrid; none selects memory. Concretely: docker run -v myvolume:/data ghcr.io/neaox/overcast now persists automatically (it previously ran silently in-memory — mounting a volume had no effect unless you also set OVERCAST_STATE), and fresh unconfigured runs — CI containers especially — get fast in-memory mode with zero configuration. Existing databases are always honored, so no previously-persisted data is ever silently stranded in memory mode. The startup log states the auto decision and which signal drove it, /_health reports both the configured and resolved modes, and the Metrics & Health page shows an actionable notice when auto lands on memory. Set OVERCAST_STATE explicitly to override in either direction — see docs/storage.md.
• Events — the web UI Event Stream now replays recent history on connect (a rolling server-side buffer of the last 10,000 events) instead of starting blank, so events from before the page was opened — the ones someone debugging actually wants — are visible; request-telemetry events are evicted from the buffer first when it fills and stay hidden by default in the UI. Also fixed on the Events page: the "Pings" toggle previously had no visible effect (a second, hidden source filter dropped what the toggle revealed), and the source filter now shows events from newly-added sources by default instead of silently hiding any source it didn't already know about.
• Logging — a new trace level now sits below debug (OVERCAST_LOG_LEVEL=trace), and log levels were reclassified repo-wide so each tier is readable: health-check and /_debug/* polling request lines (Docker HEALTHCHECK and the web UI poll these continuously) moved from info to trace along with periodic flush/sweep/vacuum cycle logs, per-invoke Lambda pool internals moved to debug, storage degradation to memory-only is now an error, and SQLite migration failures now reach structured logs instead of only stderr. Also fixed: OVERCAST_LOG_LEVEL previously never actually gated verbosity (it only switched the encoder) — warn/error settings now work, and debug output is quiet enough to attach to bug reports.
• Web UI / Debug endpoints — the metrics page is now Metrics & Health: a health strip (storage mode, health/degraded badge, live SQLite journal mode, last flush, uptime) and a recommendations section driven by a new advisories array in GET /_debug/metrics — the server now computes storage advisories (journal mode not WAL, store degraded to memory-only, store unhealthy, slow data-directory filesystem with a named-volume suggestion, sustained read pressure, memory-mode notice) and reports the live PRAGMA journal_mode readback per store, so silently-misapplied storage configuration is visible at a glance instead of discoverable only by symptom.
• Docs — the published documentation (web UI docs browser, docs search, embedded builds) now contains only user-facing pages; contributor documentation (development setup, step debugging, wire-protocol architecture, storage internals, performance baselines, the compatibility-review harness) moved to docs/dev/, which is excluded from publishing the same way docs/plans/ already was — slightly shrinking the embedded docs in binaries and images. The web UI docs browser no longer renders a page's internal frontmatter block or duplicates the page title, supports section deep links (heading anchors scroll correctly on navigation — storage advisories link directly to the relevant tuning section), and notes where contributor docs live; the performance guide gained copy-paste docker run/docker compose examples for the recommended named-volume setup including a host layer-cache mount; and the README's badges were repaired, with a new disclaimer section covering AWS non-affiliation and the project's as-is, best-effort status. Two new user-facing guides landed in the split: a performance-tuning page (storage-mode selection including OVERCAST_STATE=memory for CI, per-service overrides, named-volume-vs-bind-mount guidance with the new startup probe warning, the hybrid flush tuning knobs, and client-perceived-latency expectation-setting) and a storage-modes page (per-backend durability comparison and what survives a restart).
• Debug endpoints — GET /_debug/metrics now reports storage diagnostics (recent flush history, seed duration, pending-log size, and opt-in per-namespace row counts via ?includeRowCounts=true) instead of a "not yet implemented" stub; GET /_debug/state/{namespace} is now paginated, returning {values, nextKey} pages (?after= exclusive cursor, ?limit= capped at 5000, default 500) instead of a single flat key→value map — a response-shape change for anything scripting against it (?key= single-value fetches are unchanged); the web Raw State Debugger now pages incrementally (fetching further pages only as the user scrolls near the end of what's loaded) instead of eagerly merging every page, virtualizes both the flat key table and the key tree (which also gained per-node collapse/expand) so large namespaces render a bounded number of DOM rows, lazily fetches a deep-linked key's value via the single-key endpoint when it hasn't loaded yet, and restricts search to key-only matching over loaded rows.
• Storage — SQLite-backed storage now applies versioned schema migrations automatically on startup instead of ad-hoc CREATE TABLE IF NOT EXISTS calls, writing a one-time backup file before the first pending migration runs against an existing database, and periodically checkpoints its WAL and reclaims free pages in the background instead of only growing the database file over time; new OVERCAST_HYBRID_SYNC/OVERCAST_HYBRID_SYNC_INTERVAL (pending-log fsync policy — the hybrid pending log is now fsynced on a 100ms interval by default, where it was previously never fsynced and an OS crash could lose the whole unflushed window), OVERCAST_HYBRID_DIRTY_ENTRY_THRESHOLD/OVERCAST_HYBRID_DIRTY_BYTE_THRESHOLD (size-triggered early flush, so write bursts flush ahead of the timer instead of accumulating unboundedly), and OVERCAST_HYBRID_MAINTENANCE_INTERVAL (WAL checkpoint/vacuum cadence) config options.

Fixed

• Events — events published without a timestamp (31 call sites across 14 services) rendered as 00:00:00.000 in the Events page history; the event bus now stamps its clock on publish whenever a timestamp is missing. Separately, the wal storage backend no longer issues an fsync on shutdown (or on idle sync intervals) when nothing has been written since the last sync — on hosts with degraded fsync (Docker Desktop under pressure) that pointless fsync could stall shutdown for minutes.
• Wire protocols — AWS Query-protocol requests (IAM, EC2, RDS, CloudFormation, STS, SNS, SES, Auto Scaling, ElastiCache, ELBv2, Route 53) now resolve their operation name during protocol identification like every other protocol, making the typed operation registries the primary dispatch path for Query traffic — previously that entire path was unreachable and a second, legacy copy of every operation served all requests. Divergences surfaced by the switchover were fixed: CloudFormation's typed stack operations used the server's default region instead of the request's region, IAM SimulatePrincipalPolicy skipped its required PolicySourceArn validation, and SNS Subscribe skipped cross-region endpoint validation. EC2 (all operations), CloudFormation DeleteStack/ExecuteChangeSet/DeleteChangeSet, and SNS Publish/PublishBatch stay on the legacy path for now — each with a documented reason. New OVERCAST_PROTOCOL_STRICT option: by default a request claiming a wire protocol its service doesn't declare is ...

v0.0.1-alpha.23

Overcast v0.0.1-alpha.23

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.23
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.23
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.23
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.23

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	9fef815d5357e93686eb3b187b7a9236a445aa78ce2ce9b8ac76ac70775bfc17
overcast-darwin-arm64	d1ea630319a299da29989951a9463cbc2b6ca4ca9a69398bb0033afd75246bea
overcast-linux-amd64	092526976be2a696d690ca9748dd24e2a97929a385c0cf2190fbda8f94ff1464
overcast-linux-arm64	04ff3e4d0a6a8c05178be29b853ee515a726db6cf6d521a1bfd31e1be0a40d06
overcast-windows-amd64.exe	efe78c41a0e9c06c7edde8233c72a8cbcbf975fbf5502752ce31158cdd13bc42
overcastd-darwin-amd64	8b32a76f0e7639f18d3aa6a3aa221e76c4b2c4a8eba2d13b5caaf94fc8083cc7
overcastd-darwin-arm64	0d835746a6bd24b8bdb12deeac6712f9ffed3b05f6d0271e29bf191ff330c5a3
overcastd-linux-amd64	fe6b6fef303228666ffc27f5b79588c0894babc61138fa33793742fa1f73f43e
overcastd-linux-arm64	7154c65ee6e29416550db3bd2821913ae14534ab9b935f41c3b2de7cbf4c9c29
overcastd-windows-amd64.exe	1e4eb656ed3f01e9b306f19d8b6f7f1b7ec841a2d048c725ad4a2a9eaccd143c

Release Notes

Fixed

• Web UI — Raw State Debugger namespace views now truncate large stored value strings for responsive browsing and provide an Open action for the selected full raw value with JSON/text content-type detection.
• Debug endpoints — POST /_debug/reset/{service} now succeeds for enabled services even when they have no stored resources yet instead of reporting them as unknown.
• AppSync — CreateGraphqlApi, GetGraphqlApi, and ListGraphqlApis now return local executable GraphQL URLs for the connected Overcast endpoint, Lambda data sources strip ARN aliases/versions before invocation, direct Lambda resolver events include AWS/Powertools-compatible context fields while mapped Lambda requests pass their evaluated JSON payloads through, resolver identities now better match AWS shapes for Cognito/OIDC/IAM including IAM user-store lookup, configured Lambda authorizers now invoke Lambda with GraphQL request context and propagate/cache resolverContext/deniedFields, mapped Lambda request objects validate operation/invocation type with async Event null results, and direct plus VTL/APPSYNC_JS-mapped Lambda nested-list batching now supports maxBatchSize.
• CloudFormation/Lambda — AWS::Lambda::Alias resources now create and delete real Lambda aliases instead of being treated as unsupported/stubbed resources.
• DynamoDB/Lambda — DynamoDB stream event source mappings now process records through a bounded per-mapping worker, honor BatchSize and MaximumBatchingWindowInSeconds, apply filters per record before Lambda invocation, and expose filter decision evidence in the system map through a compact filter node with a searchable ordered receipt-history drawer.
• DynamoDB — BatchWriteItem and TransactWriteItems writes now emit stream records, and composite-key PutItem condition checks such as attribute_not_exists(PK) AND attribute_not_exists(SK) reject existing items consistently.
• S3 — bucket encryption APIs now support CDK asset bucket checks by returning default SSE-S3 encryption and round-tripping AES256/KMS encryption configuration.
• State — hybrid SQLite-backed reads now retry canceled, busy, locked, and interrupted SQLite operations with bounded backoff, serialize SQLite flushes to avoid concurrent transaction contention, seed hot control-plane namespaces into memory while keeping bulk data-plane namespaces lazy, expose persistent backend health and pending-write counts, persist accepted writes to a pending log before async flush, and force CloudFormation terminal stack state through synchronous persistence.
• Lambda — startup no longer pre-pulls every managed runtime image by default; set LAMBDA_SEED_RUNTIME_IMAGES=true to opt back into broad startup seeding while per-function prewarming and lazy first-use pulls remain enabled.
• Web UI — bundled console builds now include the Tailwind typography plugin as a production build dependency, fixing Docker release builds that install only runtime dependencies.

Release: https://github.com/Neaox/overcast/releases/tag/v0.0.1-alpha.23

v0.0.1-alpha.22

Overcast v0.0.1-alpha.22

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.22
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.22
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.22
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.22

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	28fabb9dcc05ff75b04be920dda7130395f637be09a10021b0bf365f70a4345e
overcast-darwin-arm64	1ebc56944c0d07dc2efe5f823d0d125aa3b79439b4ab947d6fa32aab93bfb3de
overcast-linux-amd64	bee766ae49e7184d78f4a5f771b580c6507de41cab08807685b2289b5f4b132a
overcast-linux-arm64	380517c6df179c45060f1a31e5eebdaaa1760de1c2cb2827fff9ebf346ad7915
overcast-windows-amd64.exe	56a29105b973c1565c93bf9b3e15fbe92ac85bb7992fe9bef6cc210e2eafc41c
overcastd-darwin-amd64	6306dd316a8d23e6cdea783e58acfed47ae5156cf185d3161a2930e6551de2bd
overcastd-darwin-arm64	326eb6696c1d8eaa4c2e857c85c69501e35b75ca4c47b34e11f81761ecec7201
overcastd-linux-amd64	e162893c19aea4f35e23fa3e18ab4e26f1cf633fe06da358b5d45b5083f417ee
overcastd-linux-arm64	fb8db0f5d84ba34d893ae34a4c467187c0d132eb3061e289d9c35a7ee400c73e
overcastd-windows-amd64.exe	ad996b434838ec69873ac0795fe5e627f8125412780a3c057d28e88ae10d03b9

Release Notes

Added

• Agent tooling — repo-local OpenCode skill registration now discovers the Overcast agent skills without manual setup.

Fixed

• AppSync/CloudFormation — CreateApiKey now accepts CDK-style Expires values 365 days from creation without rolling back AWS::AppSync::ApiKey resources.
• Web UI — the sidebar now defaults to collapsed on narrow viewports, keeps separate narrow/wide collapse preferences across refreshes, and shows immediate tooltips for collapsed icon navigation.

Release: https://github.com/Neaox/overcast/releases/tag/v0.0.1-alpha.22

v0.0.1-alpha.21

Overcast v0.0.1-alpha.21

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.21
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.21
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.21
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.21

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	76e1e778fcce45d701d0be1bf050584a90365f6d412ec0cd9a85ae0d2f1e386e
overcast-darwin-arm64	9efe58c755719def39a2e9458826a4885f113e7f5df5cb933963abba2be12b08
overcast-linux-amd64	7098cb15c029ef945ccc3a8752fa6a6242ef5a87db10c4c154d31301345aef6a
overcast-linux-arm64	e8bf99ca250a67eb213f53d2649b849b65b63f7089e5818c55340082e5c6eeab
overcast-windows-amd64.exe	dc2374d87191eefc73ccaa1f353e4689519fac7ea70e193eea6c18306cbd2a71
overcastd-darwin-amd64	38b487febca6fe8809b78aabe39b68349e414a391eab1d3811b58589995a0e8c
overcastd-darwin-arm64	80edce618181403901abdff11fe5f23697ab2e1b77e5557f248c06500a819e85
overcastd-linux-amd64	317993098337270b42d88436dc01d11747fcaa2a4e641c177258fde6c4e86212
overcastd-linux-arm64	26ea44ae7a4c90afe96dfc8ff21800fa9682bd77858014523e4c6f8a11b73e0e
overcastd-windows-amd64.exe	91575b6f2fd7a9a9d1d20af3c5e24da250a1a79690a1e763d7b49d772a42db1a

Release Notes

Fixed

• AppSync/CloudFormation — StartSchemaCreation now accepts AppSync built-in scalar types in GraphQL SDL, fixing CDK AWS::AppSync::GraphQLSchema rollbacks on types such as AWSDateTime, while rejecting unsupported custom scalars and custom object types using the reserved AWS prefix.

Release: https://github.com/Neaox/overcast/releases/tag/v0.0.1-alpha.21