v0.0.1-alpha.38

Overcast v0.0.1-alpha.38

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.38
• Moving tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.38
• Moving tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.38
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.38

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	6ae434fdbebf0952bfe75a663162aceb345a800ea811e0793821b8a522a4e3da
overcast-darwin-arm64	b43c953006003ec15211109f4186719d64699fccaf41ad8aa81a61b5d72562e5
overcast-linux-amd64	f58491631a048b7003f9f11c6529eadd767614cabefc470e3b7f6e548e7dda0a
overcast-linux-arm64	804260f363eb0425dd33f9bf6ebec922884d7ea10e72cdc36977c5359aa0bfb5
overcast-windows-amd64.exe	61a5e3bf1c860d3f6b5652678f3aa5bcf7b53690e3681f108fb7f6cbec045c99
overcastd-darwin-amd64	0d9e8406615257026fe6bc547d717e9ca33f08617025d6f0de2e1bd69ecab399
overcastd-darwin-arm64	eea0523cbdc096632698135b07bdcdfb67672f6282629924151e4d81c483a98a
overcastd-linux-amd64	50c7810ca754838629d7a3c20b0718b99b3c686e7901ca248c90b89caf1d0b5b
overcastd-linux-arm64	41dba2450b09c8eacb05bbf2e6c0b5248e380815038277073b0b7b64938546be
overcastd-windows-amd64.exe	984627dd15e66c276fd446d722d79fb870460d7f780877eb6fe7ac711d8992b0

Release Notes

Added

• [apigateway/web] Monitor tab on the REST and HTTP API detail pages, charting requests, 4XX/5XX errors, and latency per API or per stage

• [cloudformation/s3] AWS::S3::Bucket gains BucketNamespace and BucketNamePrefix, both Replacement on update; BucketNamePrefix appends the account/region suffix the way the console does

• [iam] the s3:x-amz-bucket-namespace condition key is populated from the request header, so AWS's published Deny+StringNotEquals account-regional enforcement pattern works

• [lambda] the Telemetry API subscription endpoint (PUT /2022-07-01/telemetry) — the surface modern observability extensions call — with schemaVersion validation, the documented cross-API exclusivity with the Logs API, and JSON-format function log records embedded as objects from schemaVersion 2022-12-13. Deliveries are batched per the subscription's buffering configuration — maxItems, maxBytes and timeoutMs with AWS's defaults and limits — instead of one POST per record, and a subscriber whose batch was lost is told: the next batch opens with a platform.logsDropped event carrying the dropped counts, in AWS's documented shape

• [lambda] platform records now carry AWS's documented depth. platform.start, platform.runtimeDone and platform.report gain the tracing member with the X-Amzn-Trace-Id actually handed to the runtime; platform.runtimeDone metrics — including the responseLatency span, and producedBytes from the length the runtime declared — are measured by the in-container init, from the runtime being handed the event to its answer arriving back, with the host's own measurement as the fallback when the runtime never answered (responseDuration and runtimeOverhead stay documented-out — the first ends only after the answer has streamed through, the second exists only at the runtime's next poll); and platform.runtimeDone and platform.report carry errorType: Runtime.ExitError when the runtime exited, while timeout and handler-error records stay nameless, as AWS's own examples do

• [lambda] extensions' own lifecycle is on the platform stream: platform.extension at registration (replayed to later subscribers) and platform.telemetrySubscription / platform.logsSubscription at subscribe, named for the API the subscription came through

• [lambda/web] execution environments report how they were initialized (on-demand, proactive after a settled deploy, or provisioned) and why they were removed (idle TTL, configuration change, container died, ...) — an origin badge and removal reason on the instances panel and system map, initOrigin/evictedReason on the instance SSE events, and an init_origin field on the cold-start server log line

• [router] 292 operations newly modeled by AWS are recognised, spanning 4 services new to the corpus (account-access, agent-registry, agent-registry-control, pricing-plan-manager). A signed request to one reaches a protocol-correct 501 marked x-emulator-unsupported, in that service's own error envelope, instead of falling through to the S3 fallback and coming back as a bucket or object answer

• [s3] CreateBucket supports account regional namespaces: x-amz-bucket-namespace: account-regional with a <prefix>-<accountId>-<region>-an name creates the bucket in the account's per-region namespace instead of the global one, and re-creating it returns BucketAlreadyOwnedByYou in every region, including us-east-1

• [web] Monitor charts gained labeled X/Y axes with aligned gridlines, an AWS-console-style auto-refresh interval picker (Off/10s/30s/1m/5m), and a bucket-width chip; any card expands into a full-width dialog with drag-to-zoom into a time window, a y-axis scale, and per-series whole-range summaries in the legend; the time window holds still while auto-refresh is off or a chart is being inspected

• [web/s3] tick boxes on the bucket's object listing, with a header box for everything currently listed, and a Download .zip button that fetches the whole selection as one archive — entries named relative to the folder they were ticked in, so a selection made in logs/2026/ unpacks as q1.csv rather than rebuilding the key path around it. The archive is built and sent object by object rather than assembled first, and the console asks for it with a form submission so the browser streams it to disk: a multi-gigabyte selection costs neither the server nor the tab multi-gigabyte memory. An object that disappears between the listing and the download is named in a _download-errors.txt inside the archive, since a download that has already begun has no status code left to spend

• [web/s3] S3 folders and objects are addressable — the object browser keeps its place in the URL, so an object is linkable and reload, Back and Forward all work — and the object inspector gains a Versions tab: one object's own history, with the details and preview of whichever revision you pick

• [web/s3] the create-bucket dialog gains an S3 Bucket Namespace choice — global (default) or account regional, which turns the name field into a prefix and shows a live <prefix>-<accountId>-<region>-an preview before submitting — and the bucket list badges a bucket "Account regional" when its name matches the reserved suffix, inferred from the name, since neither ListBuckets nor the AWS console reports a namespace for an existing bucket

Changed

• [apigateway] request metrics are recorded under every AWS-documented dimension combination — ApiName and ApiName+Stage (REST), ApiId and ApiId+Stage (HTTP) alongside the detailed per-route set — so CloudWatch queries at the API or stage level now return data

• BREAKING [apigateway] HTTP (v2) API error metrics are recorded under AWS's real metric names, 4xx and 5xx
  migration: CloudWatch queries or alarms watching 4XXError/5XXError on an HTTP API must switch to 4xx/5xx; REST API metric names are unchanged

• [metrics] the 5-minute rollup tier is retained for 30 days (previously 7), and the 30-day Monitor view charts 15-minute buckets instead of 1-hour ones

• [router] the pinned AWS API models moved to 2026-08-21: 37 operations changed protocol traits, 5 changed an HTTP or target binding and 37 path bindings changed which services share them. A protocol-trait change moves that operation's error envelope; a binding change moves which request shape reaches the operation at all; a binding shared by several services is answered without the credential-scope check an unshared one gets, because the models no longer name a single owner for it

• BREAKING [s3] CreateBucket now rejects a global-namespace bucket name ending in the reserved -an suffix
  migration: rename a bucket ending in -an, or create it with x-amz-bucket-namespace: account-regional instead

• [web] log rendering converged on the shared virtualized viewer: its table mode gained level badges, click-to-expand rows, and hover-copy, and a new reusable LogPanel owns fetch + filter + auto-refresh for any log group or stream (declarative filter model with relative or fixed time windows); the Lambda Monitor tab now renders its logs through it, with a filter box and time-window picker

Fixed

• [apigateway] REST v1 create-deployment returned createdDate as epoch milliseconds; the AWS CLI and SDKs parse the field as epoch seconds, so the call errored client-side even though the deployment was created. The response now uses the same seconds conversion as get-deployments and the stage responses

• BREAKING [apigateway] Usage plan responses (CreateUsagePlan, GetUsagePlan, GetUsagePlans) no longer return a keyIds member — the API Gateway UsagePlan shape has no such member; the underlying key associations are unaffected and remain fully readable
  migration: stop reading keyIds from usage plan responses; the AWS SDKs never surfaced the member there, so SDK-based clients are unaffected — use GetUsagePlanKeys (the modeled channel) to read a plan's attached API key IDs

• BREAKING [apigateway] RestApi responses (CreateRestApi, GetRestApi, GetRestApis, UpdateRestApi) no longer return an arn member, a...

v0.0.1-alpha.37

Overcast v0.0.1-alpha.37

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.37
• Moving tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.37
• Moving tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.37
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.37

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	6a9bb5e5293b2e0a1c9576a2eea9dbff9d1063e8c42c8ac20066c3d18f6185eb
overcast-darwin-arm64	e1577756fb25fe0ef6a43d4da0ba11fef4a132a91c0823ce6f7400b069927a5c
overcast-linux-amd64	91108ec5f743e46ad11d330cfeb49331ee40b3eb51ceef22f23ada342bfdb584
overcast-linux-arm64	ab4e2e8cac426bbdeb8c4c879de0aa9eaf7e82a9694d39d0a84a2ccec2367447
overcast-windows-amd64.exe	ba2998f0ebaaf21fdb8a41fdd6a25541d3f77bf2fa9979d8d9f2e2f4a1892ea3
overcastd-darwin-amd64	4822ffaf5deacf352e1e72236f4384d680802dffe507eb1b1d5868bbb732a24d
overcastd-darwin-arm64	ae8a07a486ec0a16644ec57269d4f2c47344eba42039cadc88920bf5f41ef103
overcastd-linux-amd64	493429a1968d5a3492d66b4a26eecd7f5acf929a530864381467f5a29fed75ac
overcastd-linux-arm64	62989659ded2dac954244aa4f6db578381f103b14f43f41b09b2af965e146a77
overcastd-windows-amd64.exe	95e546c5a02f26f47779377b53eade1e2bf00263822e1be12c6ec2bc32ad0b43

Release Notes

Added

• [athena] CreateWorkGroup persists Configuration and GetWorkGroup returns it; it was previously discarded

• [backup/cloudwatch-logs] tag operations for the resources that had none. Backup gains TagResource/ListTags/UntagResource (POST /tags/{ResourceArn}, GET /tags/{ResourceArn}, POST /untag/{ResourceArn}), with tags stored inline on the vault or plan record so they die with it, and the CloudFormation provisioner forwards BackupVaultTags/BackupPlanTags and reconciles a tag-only stack update in place. CloudWatch Logs gains the modern TagResource/UntagResource/ListTagsForResource trio for log groups, resolving a resource ARN to the log group name and sharing the existing TagLogGroup/UntagLogGroup/ListTagsLogGroup spelling's validation and storage rather than duplicating it

• [ci] a Lockfile freshness check fails a pull request whose web/pnpm-lock.yaml was generated against a main that has since changed its own copy, and a sweep on every lockfile push to main re-judges the open pull requests so a stale one is blocked before it merges rather than after — the case that kept every PR red for 28 minutes on 2026-08-22. It is not a merge queue: two lockfile PRs auto-merging in the same instant can still race

• [ci] a pruned Smithy shape snapshot under models/aws/shapes/, regenerated and digest-verified alongside the AWS operation manifest

• [cloudformation] ContinueUpdateRollback is now supported, so a stack in UPDATE_ROLLBACK_FAILED is recoverable rather than a stack you have to delete and redeploy. That state is reached when an update fails and the automatic rollback fails too — usually because both were blocked by the same thing outside the stack, a host port already bound or a resource something else is still holding — and it has no last known stable state, so every later UpdateStack, ExecuteChangeSet and change set has nowhere to start from; previously the operation returned 501, and the only way forward was delete-stack and a deploy from scratch. Clearing the blocker and calling it now resumes the rollback: the deletes that failed are retried, what the failed attempt half-created is retired, and the stack reaches UPDATE_ROLLBACK_COMPLETE and is updatable again. A retry that meets the same blocker lands back in UPDATE_ROLLBACK_FAILED and can be tried again. Nested stacks are continued before their parent, so a wedged child is recovered rather than reported rolled back from above. ResourcesToSkip is honoured for a resource that cannot be cleaned up at all, AWS's NestedStackName.ResourceLogicalID form included: the resource is left physically untouched, reported UPDATE_COMPLETE, and the rest of the stack rolls back around it. Any other stack status gets AWS's Stack:<arn> is in <status> state and can not be updated., and every ResourcesToSkip member is validated before the operation is accepted

• [cloudformation] AWS::CloudTrail::Trail, AWS::Transfer::Server, AWS::Transfer::User, AWS::IAM::ManagedPolicy and AWS::IAM::InstanceProfile now merge a stack's own tags onto the resources they create, and reconcile a stack-tag-only change on update, matching every other propagating resource type

• [cloudformation/web] a deployed stack now says which resources are stubs or backed by an inert/stub-tier service, on the same ResourceStatusReason CloudFormation already exposes and in the console's stack view, instead of only a server log line nobody sees

• [cloudwatch] CloudWatch answers Smithy RPC v2 CBOR. The pinned model declares rpcv2Cbor for CloudWatch — the only dispatched service it declares it for — and a newer AWS SDK major negotiates it for a service that declares it, but Overcast claimed the protocol nowhere: its Smithy RPC registration carried no protocol service, so all fifteen dispatched operations answered 501 Not Implemented over POST /service/GraniteServiceVersion20100801/operation/<Op> while the identical call over the JSON or Query protocol worked. All fifteen now answer over CBOR, from the same implementation the other two protocols use — the request and response shapes and every validation rule are shared, so a call returns the same result whichever protocol an SDK picks, and PutMetricAlarm still marks the alarms Overcast will not evaluate. The router's protocol-symmetry gate consequently exercises CloudWatch over CBOR for real, which it could not before: an operation added to the Query and JSON tables without a CBOR binding now fails the build instead of quietly becoming a fourth protocol gap

• [cognito] LambdaConfig triggers (PreSignUp, PostConfirmation, PreTokenGeneration, PostAuthentication, CustomMessage) are now invoked during SignUp, ConfirmSignUp, AdminCreateUser, AdminConfirmSignUp, ResendConfirmationCode, ForgotPassword, ConfirmForgotPassword, InitiateAuth, AdminInitiateAuth and RespondToAuthChallenge on the classic X-Amz-Target API, through the same synchronous Lambda invoker Secrets Manager rotation, API Gateway and AppSync already use. A trigger that errors or is unreachable fails the call with UserLambdaValidationException instead of being silently skipped, except PostConfirmation, which AWS documents as fire-and-forget since the account is already confirmed by the time it runs. CUSTOM_AUTH's DefineAuthChallenge/CreateAuthChallenge/VerifyAuthChallengeResponse remain tracked separately (#88, #94, #101); PreAuthentication, UserMigration and the Smithy RPC v2 duplicate dispatch path's non-token triggers are not yet wired

• [compat] four new registry groups. rds-clusters covers the Aurora DB cluster lifecycle — create, describe, modify, stop, start, delete — and rds-cluster-members covers a cluster with an instance in it: DBClusterMembers, writer election, the settings a member inherits from its cluster, and the membership pruning DeleteDBInstance does. Both run in the Go, Python, Node and Java SDK suites and the CLI suite, over ground nothing outside the emulator's own Go tests had ever looked at, and they are what found the cluster response-envelope and membership fixes below. eventbridge-patterns (TestEventPattern, TestEventPatternNoMatch) and lambda-invoke-error (a handler that throws must come back as HTTP 200 with FunctionError set) are implemented in all seven SDK/CLI suites; eventbridge-patterns is the dotnet-sdk and rust-sdk suites' first EventBridge coverage

• [config] the startup log names the resolved bind address(es), says that OVERCAST_LISTEN is what changes them, and says why the default was chosen — containerised or native

• [config] Overcast warns once at startup when OVERCAST_HOSTNAME's subdomains do not resolve on this host — a resolver limitation (Windows does not resolve *.localhost the way Linux does) that otherwise surfaces far from its cause: virtual-hosted-style S3 addressing breaks silently, and cdk deploy asset publishing fails with a bare getaddrinfo ENOTFOUND on a bucket-shaped hostname. The probe is two DNS lookups run off the startup critical path — the bare hostname, then a synthetic subdomain of it — and only warns, never fails, since path-style S3 addressing is unaffected; the message also flags the case where a custom hostname is resolved only through a hosts file, where the warning is an expected false positive rather than a bug

• [config] LocalStack's environment variables are accepted as compatibility aliases for their Overcast equivalents. LOCALSTACK_HOST maps to OVERCAST_HOSTNAME — LocalStack's documented hostname[:port] format is parsed and a port part must match OVERCAST_PORT — and EDGE_PORT, GATEWAY_LISTEN, DEFAULT_REGION, DATA_DIR, DEBUG, PERSISTENCE, HOSTNAME_EXTERNAL and LAMBDA_RUNTIME_ENVIRONMENT_TIMEOUT map to the matching OVERCAST_*/LAMBDA_* setting, completing the drop-in-replacement audit. SERVICES, LOCALSTACK_API_KEY and LOCALSTACK_AUTH_TOKEN are recognised and logged once at startup as inert rather than silently ignored. Every alias shares one mechanism and one conflict rule: a value that disagrees with an explicit `OVERCAST_...

v0.0.1-alpha.36

Overcast v0.0.1-alpha.36

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.36
• Moving tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.36
• Moving tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.36
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.36

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	f1e331f6b72d556bfff0d13a597ac4d5a3622144ae29edb29ed3a71d5e186e04
overcast-darwin-arm64	960186b1e74347ac3fdf84446224c576dc10ac2c4f96ece987f58d5366c73d33
overcast-linux-amd64	c4568d5ceeba438cf02381dcf5846dcf7fce293f9ba40407bee2d0012d51e15c
overcast-linux-arm64	75ff98f34ebea38e5f9686b01166543057862c48238ad9def000571b0de820f3
overcast-windows-amd64.exe	4e1ee01ea6e3815e08db2fc31f4eeacdf52802c435fcf79f42f45f9a816fcd25
overcastd-darwin-amd64	8c77d83924aa0d29f5e22c677b783c3585b3a8034daeff8081db3640720a802a
overcastd-darwin-arm64	258a71aecbbc9e3d804cd55e559b3b9fea2a45794ffa9ec56b3ce6535c6acdc7
overcastd-linux-amd64	08e3f7564f4388fafc149e446e51bfefe2c5f927271f32224b2c97a5300cc177
overcastd-linux-arm64	daeab55224f40c0d612a832e2df00f77c7f78d1a2994b5c8d9e2a39d6f2ad6ee
overcastd-windows-amd64.exe	ca41a8c095c2feb04879e89343e9d3b514614cf6442e6022d79a6fd0ddb1ba50

Release Notes

Added

• [mcp] a request that asks for a streamed response now gets one: the notifications belonging to that request arrive as they happen, followed by its result. Progress, log messages and cancellation are scoped to a single request — MCP revision 2026-07-28 says such notifications "flow only on the response stream of the request they relate to" — so a long tool call reports its progress on its own response instead of on a separate connection, and a client reading in order sees the work reported before the answer to it. Cancelling a call delivers notifications/cancelled on the cancelled call's stream, which then ends without a result. A request that did not ask for a stream is answered exactly as before, and a request refused before it reaches a handler is still an HTTP error rather than a stream carrying one

• [web/tls] a Settings page in the console, whose first section drives HTTPS setup end to end: it reports the serving mode, certificate and trust-store state, mints the CA and server certificate on a click, and installs the CA into the system trust store behind the OS approval prompt. A containerized daemon still prepares the certificate material, so the CA is downloadable at /api/ca.pem before the restart, and hands back the host-side overcast https enable --endpoint ... one-liner. The one step no UI can take — restarting with OVERCAST_TLS=auto — is shown verbatim in per-shell tabs, and a "Switch to HTTPS" button appears once the TLS listener answers

• [web] a header gear opening that Settings page, in every build including bundled ones; the connection is editable there as well as from the existing header plug, both sharing the first-run dialog's form and its live reachability probe

• [web] an empty CloudFormation, SQS or Lambda list page in the console now says when the resources exist in a different region — "No stacks in us-east-1. There are 3 in ap-southeast-2." — with a button that switches to it. A developer whose AWS_REGION points somewhere the console does not sees a working emulator and an empty list, and nothing on that screen is about regions, so it reads as a lost deploy or a broken emulator. The notice appears only when the selected region is genuinely empty and another genuinely is not: an account with nothing in it anywhere says nothing at all

• [tls] OVERCAST_CA_DIR puts the local CA somewhere other than $OVERCAST_DATA_DIR/ca, so a container can mint certificates from a CA that outlives it. State and a trust anchor have opposite lifetimes — state is disposable, while installing a root certificate is a per-machine, permanent act — and tying them to one directory is what made every docker compose down cost another root-certificate approval. Create the CA once on the host with overcast https enable, mount it read-only (-e OVERCAST_CA_DIR=/ca -v ~/.overcast/data/ca:/ca:ro), and recreation, down -v and image upgrades all keep working with no further prompts; this is the anchor-durable/leaf-ephemeral split mkcert, Caddy and step-ca use. Read-only mounts are supported directly: leaf caching becomes best-effort (a re-mint costs about a millisecond) rather than a startup failure, and because a bind-mounted CA carries the host's ownership and 0600 keys that the unprivileged container user usually cannot read, the entrypoint serves from a private in-container copy when that happens — the mount is never written to. docker-compose.yml now gives the CA its own volume

• [events/web] every event on the stream now carries the request id of the API call that caused it, so a PutObject and the notification, queue write and delivery it set off are all attributable to one call instead of appearing as unrelated activity; the bus derives it from the context a publisher already passes, which covers asynchronous work — an SNS fan-out delivering after its Publish returned is attributed to that Publish — and leaves it off entirely for events no request caused, such as container and timer activity, rather than inventing an id that resolves to nothing; the Events page shows the id in the expanded event and in what the copy button writes, matches it in the filter box so pasting one narrows the console to that call's events, and links each row to the request's trace when OVERCAST_DEBUG is set; a trace's own Events tab correspondingly lists everything its request caused, where it previously showed only the single row summarising the request itself

Changed

• BREAKING [mcp] the log level is stated per request instead of set once for a connection, and a request that names none is sent no notifications/message at all. logging/setLevel set a threshold that every client on the server then shared, which MCP revision 2026-07-28 replaces with a level named in each request's _meta — so one client can ask for debug without making another listen to it. Silence is the default rather than a threshold nobody chose: the revision requires that a server not emit log notifications for a request that did not ask for them. Deciding this before the notification is built also means an emit with no audience costs nothing, which matters because these fire from the emulator's own paths whether or not MCP is in use
  migration: put io.modelcontextprotocol/logLevel in a request's _meta to receive notifications/message for it; requests that omit it are answered without any

• [mcp] a client is told the tool, prompt or resource list changed without having to complete a handshake first. Emission used to be gated on the initialize lifecycle, which MCP revision 2026-07-28 removes: a stateless client never performs one, so a provider registering after startup would have gone unannounced to it. A client that opened a subscriptions/listen stream and named the notification type has already said it is ready to receive, which is what the gate existed to establish

• [web] the Metrics & Health page is reordered — health and runtime facts in one summary band, then a uniform runtime card grid, then advisories and per-subsystem diagnostics; the advisories section collapses to a single line when there is nothing to report, and the Docker table moved to the foot of the page and now shows each service its own socket

• BREAKING [ec2] every EC2 describe now refuses a filter name it does not implement, with AWS's InvalidParameterValue: The filter '<name>' is invalid. It used to answer one of two ways, and which one depended on which helper the handler happened to be written with: the parseFilterValues describes (VPCs, subnets, security groups, route tables, internet gateways, VPC endpoints, peering connections) looked each filter up by name, never saw the rest, and returned everything; the matchFilters ones (NAT gateways, network interfaces) compared every supplied filter against an attribute map and returned nothing. Both are confidently wrong, in opposite directions, in one service, so a caller could not even work around them consistently. This is the root of the tag:Name bug fixed in #1033 — a find-or-create script's describe-vpcs --filters Name=tag:Name,... was ignored, so Vpcs[0] was the seeded default VPC and the script adopted it instead of creating its own private one; implementing that one filter fixed that one filter, while the next unimplemented name failed in exactly the same silent way. Which names each operation implements is now declared in one place per operation, and that declaration is what matches the filter, writes the error and is checked against the capability tables — which the same change makes accurate, several having claimed filters that were never applied. The set is also wider than it was: DescribeAddresses, DescribeImages, DescribeKeyPairs, DescribeRegions, DescribeAvailabilityZones, DescribeInstanceTypes and DescribeTags implement filters they previously accepted and ignored, and DescribeInstances gained instance-id, which its capability note had claimed for some time. CDK's VPC context provider sends only names Overcast implements, on all four describes it calls, so Vpc.fromLookup and cdk deploy are unaffected
  ...

v0.0.1-alpha.35

Overcast v0.0.1-alpha.35

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.35
• Moving tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.35
• Moving tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.35
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.35

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	c9943e14b893a43861a61b4c15077001999961b470045dad039e2c976f32fbfe
overcast-darwin-arm64	7c5c3c6ad44d6273a39b60bec37d615310229a7d9807e283eace4b1304760f38
overcast-linux-amd64	f5854fd7f7e16471cca233a54343553cb35cf12fbba09fc0460a2ee4e6df3668
overcast-linux-arm64	db52c1d0661c01be4dbdc8b3f7d5d9c8006d2878d19972ec4cfb87ddb669c5d1
overcast-windows-amd64.exe	6af8c890f09632bc5aa820447e602f39ac17a7a1c4219dc9199a98fac5c56f5b
overcastd-darwin-amd64	7781e37051935faf61eaaf468ef269b4183001c66310bb63a93c15573bdadc34
overcastd-darwin-arm64	7e1fdc8af34928a4a68aa303dfa37ba72f9f2906a78b34b0c17bdc2a90018387
overcastd-linux-amd64	0329517ee093191a6ab257bc98e215a6e903f7b81efa38bd85f45dd564abd063
overcastd-linux-arm64	c5e67a209b43f3740a9c6e97da2ca8453cefa8c3012b544b63e148d0335a446f
overcastd-windows-amd64.exe	c5806039857913f5e50b2495397e0bbdbcc163972e5042ad69609af94f52b3a0

Release Notes

Added

• [appconfig] UpdateApplication is implemented, at PATCH /applications/{ApplicationId}; an omitted Name or Description leaves the stored value alone

• BREAKING [appconfig] the create operations require the members AWS marks required — Name on an environment, Name and LocationUri on a configuration profile, Content-Type on a hosted version — and creating an environment or a profile under an application that does not exist answers ResourceNotFoundException in place of storing an unreachable record
  migration: pass the required member, and create the application first

• [appconfig] the create operations apply an inline Tags map, CreateHostedConfigurationVersion honours the Latest-Version-Number header with a ConflictException, ListConfigurationProfiles honours type and ListHostedConfigurationVersions honours version_label

• [appconfig] every list operation paginates on max_results and next_token and answers a NextToken; a token that cannot be decoded gets a BadRequestException in place of a silent restart at the first page

• BREAKING [appconfigdata] StartConfigurationSession accepts RequiredMinimumPollIntervalInSeconds, reports it back in Next-Poll-Interval-In-Seconds, and refuses a poll that arrives before it has elapsed, as AWS does; the member used to be ignored
  migration: poll no more often than the interval the session asked for, or drop RequiredMinimumPollIntervalInSeconds from StartConfigurationSession

• [backup] the vault and plan operations honour the members AWS models: ListBackupVaults and ListBackupPlans page on maxResults and nextToken, with ListBackupVaults also filtering on vaultType and shared and an undecodable token getting an InvalidParameterValueException in place of a silent restart at the first page; CreateBackupVault validates the vault name against the pattern AWS documents; DescribeBackupVault honours backupVaultAccountId; and GetBackupPlan answers not-found for a versionId other than the plan's current one, rather than returning the current version under the requested version's name

• [console] a Lambda's Configuration tab says what its VPC configuration actually does here — the container really joins the VPC's network, but Overcast restricts nothing and security groups are never applied, so a test that "proves" the VPC wiring works passes whether or not it is correct. Shown only on functions that have a VPC configured; the empty state carries a one-line version for everyone else

• [dns] a query for a resource endpoint the calling container cannot reach is refused instead of answered with Overcast's own address. Overcast is authoritative for every subdomain of its split-horizon domains, and a container endpoint is one of those — so a missing network alias never produced a clean failure, it produced Overcast's address, and the client connected to the emulator on the engine's port and waited for its own timeout. The refusal is immediate, and the log line names the resource, the caller, and the networks each is on

• [dns] the refusal requires positive identification — some container is advertising that exact alias, on a network the caller is not attached to. A name that merely looks like a resource endpoint is still answered, because those labels are ordinary words in a bucket name: my.rds is addressed virtual-hosted as my.rds.localhost, and refusing it would break the bucket

• [docs] docs/networking.md gains a section on Lambda, ECS and VPCs — a row-by-row comparison of what AWS routes and what Overcast currently allows, why the emulator's own APIs stay reachable from inside a VPC on purpose, and what to do about the two *_NETWORK-era migrations (OVERCAST_NETWORK, and the seeded default VPC turning up in DescribeVpcs)

• [ec2/ecs] assignPublicIp: ENABLED on an awsvpcConfiguration keeps the task reachable from outside its VPC, matching what the field buys on AWS. It was stored and ignored before

• BREAKING [ecr] images pushed to the emulated ECR survive an Overcast restart. The registry container keeps its blobs in a named Docker volume, overcast-ecr-registry-data-<port>, carrying the same overcast.service=ecr labels every other managed resource does; the container itself stays disposable. The gap this closes is cdk deploy: cdk-assets asks DescribeImages for a container asset's content-hash tag and skips both the build and the push when it resolves, so a registry that came back empty made every deploy after a restart rebuild and re-upload assets that had not changed. Only the fixed-port claim (OVERCAST_ECR_REGISTRY_PORT, default 4510) gets a volume — an ephemeral registry's container name is deliberately random and its port is whatever the daemon had spare, so a volume keyed to either would be a fresh orphan on every start, and one well-known name shared between concurrent instances would put two registry processes on one filesystem. Repository metadata still follows the state backend, and re-creating a repository is enough for its images to reappear: the first read reconciles it against the registry
  migration: a restart no longer clears the registry. Discard the images with docker volume rm overcast-ecr-registry-data-4510 while Overcast is down, or set OVERCAST_ECR_REGISTRY_PERSIST=false to keep the old container-lifetime storage

• [ecr] OVERCAST_ECR_REGISTRY_PERSIST (default true) backs the fixed-port registry with that volume. Set it false for storage that dies with the registry container, which is worth doing when the volume itself is the problem — a corrupt one, or a runner that has to start from nothing

• [eks] DescribeAddonVersions filters on addonName, kubernetesVersion, types, publishers and owners and pages with maxResults/nextToken; omitting addonName returns the whole add-on catalog rather than nothing, and each entry now carries its type, publisher and owner

• [eks] ListInsights honours the modeled filter on category, Kubernetes version and status, and pages with maxResults/nextToken; an undecodable nextToken gets an InvalidParameterException in place of a silent restart at the first page

• [lambda] an asynchronous invocation whose function returns an error is now retried, as AWS retries it: two more attempts, waiting one minute after the first and two after the second, matching AWS's default MaximumRetryAttempts and the wait AWS documents for a function error. Previously a single failure was final, so a handler that failed on a cold start and would have succeeded on the retry lost its event — and, with a DeadLetterConfig configured, dead-lettered an event AWS would have run. Each attempt acquires its own execution environment and is tracked as its own invocation, which is what a retry is on AWS rather than a resumption of the last one. A function throttled by its own reserved concurrency is the documented exception and is not retried again: AWS sends those events to the dead-letter queue "without any retries"

• [lambda] DeadLetterConfig on a function is honoured: an asynchronous invocation that fails is delivered to the SQS queue or SNS topic TargetArn names, carrying the original event as the message body and the RequestID, ErrorCode and ErrorMessage message attributes AWS documents. It is stored and echoed by CreateFunction, UpdateFunctionConfiguration, GetFunction and GetFunctionConfiguration, and an explicitly empty TargetArn removes the target as on AWS. Overcast still makes one attempt where AWS makes three, so the event reaches the queue sooner than it would on AWS; nothing in a dead-letter message reports the attempt count, so what a consumer reads is unchanged. PutFunctionEventInvokeConfig on-failure destinations — a different feature, carrying the invocation record rather than the event — remain unimplemented outside event source mappings

• [lambda] PutFunctionEventInvokeConfig and its family — Get, Update, Delete and ListFunctionEventInvokeConfigs — are implemented, so a function's asynchronous invocation settings are configurable per fu...

v0.0.1-alpha.34

Overcast v0.0.1-alpha.34

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.34
• Moving tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.34
• Moving tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.34
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.34

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	e73e204bae6770bd4216c313e4b6a88a7c5ec816c368061d2338d67152d7f6ce
overcast-darwin-arm64	ca7708b8c3da8af9cb27d31c771ab3f37e447140a3a332f2e46dee3631acdbf5
overcast-linux-amd64	980bed4b05ee6b8702a3fc45c01fc5385c15a673155b027fbf57eb985ac8e522
overcast-linux-arm64	8151a8bf01fdcf597932a83768a0e7dfe844ca79b034c5e8da785ccf862b7bc5
overcast-windows-amd64.exe	5e0763ab5851eefbf618a769a79c1d6fe5956e61d2ff3dcd120821b44fcb2ec5
overcastd-darwin-amd64	035d20679361ee8728c6b1a4cbb7173411ac225fe50ea7bb66a601987d488b22
overcastd-darwin-arm64	ea322f434da544c01f52943622d335d912b2acebee1e7accf2315ecf71c2e375
overcastd-linux-amd64	0bfa543587c9a67094d48e606b4642b955246a7d962977a528b5d07b0f8b1664
overcastd-linux-arm64	f6a4e419bfd5d166e7d68a0ff6f3760bb3ca9b608124e111f37773bf7ed2883b
overcastd-windows-amd64.exe	37309ebfff523d85625f92ec8c896c6e728524f2fadfe5edcbe51b28d5b9e479

Release Notes

Added

• [acm] TagResource, UntagResource and ListTagsForResource — the modern aliases of the *Certificate tag operations, addressing the certificate by ResourceArn. RequestCertificate applies inline Tags at creation

• [cloudtrail] Trails are taggable: AddTags, RemoveTags and ListTags, plus an inline TagsList on CreateTrail

• [iam] Managed policies and instance profiles are taggable: TagPolicy/UntagPolicy/ListPolicyTags and TagInstanceProfile/UntagInstanceProfile/ListInstanceProfileTags; and CreateUser, CreateRole, CreatePolicy and CreateInstanceProfile apply inline Tags at creation

• [kinesis] TagResource, UntagResource and ListTagsForResource — the ARN-addressed tag operations the AWS CLI's kinesis tag-resource uses, reading and writing the same tag set as AddTagsToStream — and CreateStream applies inline Tags at creation

• [scheduler] ListSchedules and ListScheduleGroups honour MaxResults, NextToken and NamePrefix, and ListSchedules also filters on State; a NextToken that cannot be decoded gets a ValidationException in place of a silent restart at the first page

• [ses] SESv2 resource tagging: TagResource, UntagResource and ListTagsForResource on /v2/email/tags, for email identities. CreateEmailIdentity applies inline Tags at creation, GetEmailIdentity reports them, and deleting an identity drops them

• [sns] CreateTopic applies inline Tags at creation, as AWS does; a repeat idempotent call leaves an existing topic's tags untouched

• [transfer] Transfer Family servers and users are taggable: TagResource, UntagResource and ListTagsForResource, plus inline Tags on CreateServer and CreateUser. DescribeServer and DescribeUser report them

• [web/s3] the object inspector opens on a named version: it shows that version's metadata and body, its copy-URL carries ?versionId=, and a version that cannot be read is explained rather than left blank — a delete marker as the tombstone it is, an id that no longer exists as a listing that has gone stale

• [web/cloudwatch] a Clear button on the log events viewer empties the buffer on screen without stopping the tail, so a live stream can be read from a known point instead of scrolling past everything that came before. The events are hidden, not lost — "Show N earlier" puts them back, and so does Refresh

• [web/s3] an expiry hint on noncurrent version rows, counted the way the sweeper counts it — from the moment the version's successor was written, and skipping the newest versions a rule's NewerNoncurrentVersions retains

• [web/s3] search and sort controls on the bucket object browser: filter by name or prefix, switch between this-folder and fully recursive listings, and sort by name, size or last modified

• [web/s3] a Versioning panel on the bucket Configuration tab, which is the first way to enable or suspend versioning from the console rather than through the API. The state was already reported there; only the control was missing. Suspending says what it actually does — new writes are stored with version id null, and every version already stored is kept, which is not the same as turning versioning off

• [ec2] each region seeds a default VPC on first use, with a default subnet per availability zone, an attached internet gateway, a main route table carrying the default route, and a default security group — DescribeVpcs --filters Name=isDefault,Values=true and CDK's Vpc.fromLookup(isDefault: true) previously found nothing. Its backing network is the shared data plane, so "no VPC" and "the default VPC" are the same place; DeleteVpc on it removes the record and leaves the network, and an internet-gateway change on it is ignored rather than recreating the network under every running container

• [eks] a live-mode cluster's API server carries DNS aliases on the shared data plane. The endpoint DescribeCluster returns is still the published host port, so this is groundwork rather than a complete path

Changed

• BREAKING [docker] overcast-slim has no SQLite, so a volume mounted at /data no longer gives it persistent storage: auto resolves to memory, and hybrid and persistent refuse to start. This is what the image was always documented to do — it only appeared to persist because the wrong binary was shipped
  migration: use wal, which is durable and needs no SQLite, or switch to the full overcast image

• [ecr] the registry asks for a fixed host port (OVERCAST_ECR_REGISTRY_PORT, default 4510 — LocalStack's registry port) so repositoryUri is stable across restarts, falling back to an ephemeral port when it is taken; the port repositoryUri then advertises is selected by the Docker daemon itself proving it can dial it — a dual-stack ephemeral publish can split IPv4 and IPv6 onto different host ports, and only the daemon knows which family its localhost reaches — and a path nothing answers on is one actionable warning instead of a CannotPullContainerError in a later task launch

• [scheduler] CreateSchedule and CreateScheduleGroup answer 200, the status code their AWS models bind, in place of 201

• BREAKING [scheduler] UpdateSchedule replaces the whole schedule, as AWS does. An optional member the caller leaves out of the request — Description, ScheduleExpressionTimezone, State, StartDate, EndDate, or anything inside Target — ends up unset, where it used to keep its stored value; the schedule keeps its name, group, ARN and CreationDate
  migration: send the whole schedule, not just the parts you are changing — read it with GetSchedule, change what you mean to change, and send the result back

• BREAKING [config] LAMBDA_NETWORK, ECS_NETWORK, RDS_NETWORK, ELASTICACHE_NETWORK, MSK_NETWORK, EKS_NETWORK and EFS_NETWORK are replaced by a single OVERCAST_NETWORK (default overcast). Every container Overcast starts now shares one data plane instead of one network per emulator service, which is what made cross-service reachability a per-service bug; the seven per-service networks are removed at startup once nothing is attached to them
  migration: unset the old variables. If you set one to a custom value, set OVERCAST_NETWORK to it instead; if you joined a compose service to overcast_lambda or another per-service network, join overcast instead.

• [lambda/ecs] containers are created on a control plane that carries the Runtime API and the emulator endpoint, separately from the data plane they reach other resources on — the split a VPC needs in order to restrict one without severing the other

Fixed

• [acm] tagging a certificate that does not exist is a ResourceNotFoundException instead of succeeding and stranding the tags under an ARN nothing owns, and ListTagsForCertificate returns tags in a stable key order instead of a different order per call

• [cloudformation] a create that fails with rollback disabled leaves StackStatusReason set to AWS's summary of which resources failed, rather than to the underlying service error — which stays on the resource and its event, where AWS keeps it

• [cloudformation] stack operations accept the stack ARN wherever AWS does — DescribeStacks, DescribeStackEvents, ListStackResources, DescribeStackResources, GetTemplate, GetTemplateSummary, UpdateStack, DeleteStack, CreateChangeSet, and DeleteChangeSet resolved StackName by name only, so clients that poll by the stack ID (CDK's deploy monitor among them) got ValidationError: Stack [arn:…] does not exist for a stack that was right there. Conversely, a CREATE-type CreateChangeSet naming an unknown stack ARN no longer mints a placeholder stack literally named the ARN — an ARN is a handle to an existing stack, and now answers "does not exist"

• [cloudformation] mutating a deleted stack now behaves as on AWS — UpdateStack on a DELETE_COMPLETE stack reports it does not exist instead of resurrecting it, and a repeat DeleteStack is a no-op success instead of re-running the delete and appending a second wave of delete events

• BREAKING [cloudformat...

v0.0.1-alpha.33

Overcast v0.0.1-alpha.33

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.33
• Moving tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.33
• Moving tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.33
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.33

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	b1cd32963bb8e99b863a0d545235c0fa0b5a834b30af32407bd1f84fb8db5c96
overcast-darwin-arm64	c1ffe7553301245a5c9723a13d5635a680aaf968899c344d1576338d731ab1f9
overcast-linux-amd64	e842631ec5ccb9008035d3364638f08f7f92a86c245361921331f5dc6c6a67f8
overcast-linux-arm64	cdf3c046237fea0a9748599460cfbb9117f19e41e30326e006f406e9b17d6cff
overcast-windows-amd64.exe	a89dc09adfdb2ecdece607a08e5d1a52361364ae9e5227af0f6fda7fc8844b6c
overcastd-darwin-amd64	a72e172dde09a90d61f7253ffbcf6d7126204aa2b9c95c8c706b8a0e041344fa
overcastd-darwin-arm64	c8905ee9bcf8e2857ff635662d0f200199078ed8b8dc5bd7aa6f4c5e826ca64f
overcastd-linux-amd64	d20e564c4002c23b87e548ccb6c88cf38df50a86504db437f9223c6388ba7015
overcastd-linux-arm64	9f459c5886b2f05b844049907d2439f40e447e5c80369bfc6ffe84f62d249627
overcastd-windows-amd64.exe	6fe65289848291b80f4f1c27c4aa31ae20145e05c8dba75b04dc1a9e70e643a9

Release Notes

Added

• [cloudwatch] PutMetricAlarm carries more of the alarm: Tags are applied at creation as on AWS, and Unit selects which datapoints an alarm evaluates, so a metric published under several units evaluates separately per unit. PromQL alarms (EvaluationCriteria) join metric math and anomaly detection in returning 501 rather than being created un-evaluated

• [iam] permissions boundaries — PutUserPermissionsBoundary, DeleteUserPermissionsBoundary, PutRolePermissionsBoundary and DeleteRolePermissionsBoundary, plus the PermissionsBoundary parameter on CreateUser/CreateRole and the PermissionsBoundary member on the user and role responses

Changed

• BREAKING [cloudwatch] PutMetricAlarm requires Statistic, ComparisonOperator, Period, EvaluationPeriods and Threshold for an alarm on a metric
  migration: pass them explicitly. They are Required: No only because a PromQL alarm supplies them inside EvaluationCriteria; an alarm on a metric that omitted one used to be created with Average / GreaterThanThreshold / 60s / 1 period / 0.0 substituted, which arms an alarm nobody configured

• [web/debug] the Request Traces status and method filters are multi-select, so "all errors" is 4xx and 5xx ticked together rather than two separate looks, and 3xx joins the status list; the filters live in the URL, so they survive Back from a trace's detail page and can be shared as a link

Fixed

• [cloudformation/cloudwatch] an AWS::CloudWatch::Alarm the template does not name deploys — CloudFormation mints {Stack}-{Logical}-{RANDOM} for an omitted AlarmName, which is what CDK's Alarm construct and every metric.createAlarm() helper rely on, where the empty name used to reach PutMetricAlarm and come back as AWS's own Value null at 'alarmName'. Every property now reaches the alarm too: DatapointsToAlarm and TreatMissingData were dropped, so an "M out of N" alarm was evaluated as "N out of N" and notBreaching reverted to missing. A property the template omits is left out of the request rather than sent empty

• [cloudformation] AWS::Events::Rule, AWS::StepFunctions::StateMachine, AWS::ApiGateway::RestApi, AWS::Scheduler::ScheduleGroup, AWS::ECR::Repository and AWS::IAM::User are named by CloudFormation when the template omits their name. Each carries the logical ID, so two unnamed resources of one type in a stack are two resources — the rule and the schedule group used to share one empty name and quietly become a single resource, and the rest failed the stack

• [cloudformation] a stack that rolls an update back is handed its previous template and parameters again, so GetTemplate describes what is deployed rather than the attempt that failed and the next update resolves parameters from it; a nested stack whose own update fails restores its child template and parameters as part of rolling its resources back, instead of keeping the failed attempt's metadata because the parent never recorded the update as a success; and a rollback that cannot persist the metadata it restored reports UPDATE_ROLLBACK_FAILED rather than claiming the rollback completed

• [cloudformation] UpdateStack honours the DisableRollback member of the request it was given, rather than the value the stack was created with, and an update that fails with rollback disabled keeps the resource records the attempt reached — so DescribeStackResources no longer reports pre-update properties for a resource the update already changed, and no longer drops the resources it updated before the failure

• [debug/cloudformation] request traces record every internal hop, including the work that continues after the response is sent — a CloudFormation or CDK deploy runs for minutes past its HTTP reply, and every hop after the first second used to be dropped. DeleteStack and RollbackStack record the internal calls they make, as CreateStack and UpdateStack already did, where teardown hops were previously never recorded at all; and a stack created from a TemplateURL records the template fetch as a hop, with the S3 request it makes linking back to the CloudFormation request that triggered it

• [debug/s3] hops are named and linked whatever protocol answered them: a hop links reliably to the request it triggered, where S3 hops in particular used to link to nothing; hops for S3 calls name the service instead of showing a blank one, S3's REST paths being bare bucket paths that no prefix rule can attribute; and a Query-protocol request is named by its operation however the client ordered the form parameters, where one with a large parameter ahead of Action — a CreateStack carrying a real template, typically — used to show a blank operation

• [iam] permissions boundaries attached to a user or role are applied by SimulatePrincipalPolicy and by opt-in request-time enforcement, so a bounded principal no longer gets permissions AWS would deny through the boundary intersection

• [lambda] a failed CreateFunction or UpdateFunctionCode no longer leaves the stored deployment package ahead of the function's CodeSha256, RevisionId and source metadata, so a later read or cold start cannot run code the configuration does not describe

• [lambda] a PutObject landing the bytes a function is already running is no longer treated as a new deployment. Re-uploading an unchanged asset — or the very upload the function read at create time — leaves RevisionId, LastModified and the warm execution environment alone, instead of rotating the revision under callers using it for optimistic concurrency and forcing a needless cold start

• [scheduler] schedules fire SNS, Step Functions, Kinesis, Firehose, ECS and EventBridge event bus targets, not just Lambda and SQS — delivery goes through the same dispatcher EventBridge rules and Pipes use, so one target ARN behaves identically on a schedule and on a rule — and SqsParameters.MessageGroupId, KinesisParameters.PartitionKey, EventBridgeParameters and EcsParameters are honoured when a schedule fires. CreateSchedule and UpdateSchedule reject a target type Overcast cannot fire with a ValidationException, instead of accepting a schedule that would silently never fire

• [scheduler] RetryPolicy and DeadLetterConfig are honoured: a failed firing is retried up to MaximumRetryAttempts (capped at 6 attempts) while MaximumEventAgeInSeconds allows, then sent to the configured SQS dead-letter queue

• [state] Lambda deployment packages carry an explicit storage-tier classification, pinning them to the SQLite-backed tier so a future change cannot silently make every stored zip memory-resident at startup

• [web/debug] long request paths no longer stretch the traces table off-screen — the Path column is bounded against the page's own width and carries the full path as a tooltip — and the table's horizontal scrollbar is reachable without scrolling to the bottom of an infinitely growing list

Release: https://github.com/Neaox/overcast/releases/tag/v0.0.1-alpha.33

v0.0.1-alpha.32

Overcast v0.0.1-alpha.32

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.32
• Moving tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.32
• Moving tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.32
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.32

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	c045fda95e5f31ad79a8200278c0cb6acc77737b82c11f762bf14561bd745f10
overcast-darwin-arm64	e27f2adc055fa8b358e340cfb75c11bf36dc788878aad5b806f49223e8f9bb6f
overcast-linux-amd64	860bab296faa5e8583af105445c71eca8688607b76583fbcda78dcfa169628b7
overcast-linux-arm64	b748389c4df535cd6ca6eed3e77fc21917b63342510ac20f352e9676a2f7ebdb
overcast-windows-amd64.exe	7c37b28359bfb716f61d590bea22bc95ee345575a81b7f91a3ef0d14a6433d82
overcastd-darwin-amd64	6d85b58b3f177c4e63ea70d654c95c7cfcaa9217d573edf859d9714437998d41
overcastd-darwin-arm64	791a50dc2903594d7b5a7d2ffb2a9755951d4763bf3427c4e099bd63ad23ee5b
overcastd-linux-amd64	53e36549f11c914c50a3712386ba13549914f758e9d0836bdafd9f328ff479da
overcastd-linux-arm64	bc4a5c8919aae68d44f185588068b6c5b6bc290792c4e76db012e2b7c407b11c
overcastd-windows-amd64.exe	ac7c87429afe0804ed618d6508ad9f4e48cafe5d6a72f895387ed3383fc5dd76

Release Notes

Added

• [cloudwatch-logs] CreateLogGroup accepts AWS's tags field and applies it as part of creating the log group, over AWS JSON and RPC v2 CBOR alike; AWS::Logs::LogGroup now passes its Tags straight to the create instead of following up with TagLogGroup, so a rejected tag map leaves nothing behind

• [config] OVERCAST_HOST accepts a comma-separated list of addresses to bind, so one emulator can be on loopback and on a host-local bridge address without being on any network the machine is attached to. A wildcard combined with a specific address is refused rather than silently failing the second bind

• [lambda] TagResource, UntagResource and ListTags work on event source mappings. Their tags are stored separately from the mapping and are deleted with it, so they never appear in EventSourceMappingConfiguration, which has no Tags member. Code signing configurations, capacity providers and network connectors still return 501

• [lambda] Code.S3ObjectVersion on CreateFunction and UpdateFunctionCode fetches that version of the deployment package, which is what CDK emits once the asset bucket has versioning enabled

• [lambda] JSON logging — LogFormat: JSON is honoured on CreateFunction and UpdateFunctionConfiguration, which used to answer 501 for it. The plain-text START/END/REPORT lines are replaced by Telemetry-API-shaped platform.start, platform.runtimeDone and platform.report events, one {"time","type","record"} object per log line; SystemLogLevel filters those by AWS's system log level event mapping and ApplicationLogLevel filters function output by the "level" member of each record, with anything unparseable treated as INFO. Both default to INFO, and filtering covers CloudWatch Logs and the X-Amz-Log-Result tail — Telemetry and Logs API subscribers still receive every record. AWS_LAMBDA_LOG_FORMAT, and AWS_LAMBDA_LOG_LEVEL under JSON, reach the execution environment so managed and custom runtimes can structure their own output, and a change to the logging configuration retires warm environments. Text output is unchanged; the init-phase platform.initStart and platform.initReport records are not emitted yet, and both are DEBUG at the default system log level

• [lambda] execution images for every runtime AWS still accepts on CreateFunction: Python 3.14, Java 25 and the Amazon Linux 2023 Java runtimes, .NET 10, Ruby 3.4 and 4.0, plus the Node.js, Python, .NET, Ruby and provided.al2 runtimes that are past end of support but still deployable

• [lambda] TracingConfig, EphemeralStorage and KMSKeyArn are validated against AWS's own constraints, stored, and returned by CreateFunction, GetFunction, GetFunctionConfiguration and UpdateFunctionConfiguration. TracingConfig and EphemeralStorage are always present in a function's configuration, defaulting to PassThrough and 512 MB as on AWS. None of the three changes what a function does: X-Ray is not emulated, the ephemeral storage size is not enforced on the container, and environment variables are not encrypted at rest

• [release] Docker line tags :1 and :1.2, so a user can pin a release line rather than a single version or the moving :latest

• [release] a maintenance-release path for patching an older minor after 1.0: support/<major>.<minor> branches cut from their tag, backports cherry-picked out of main, and the full test and compat suites running on them

• [s3] PutBucketLifecycleConfiguration accepts x-amz-transition-default-minimum-object-size, and both it and GetBucketLifecycleConfiguration report the behaviour in force. The sweeper applies it: under the default all_storage_classes_128K an object below 128 KB does not transition, under varies_by_storage_class it still transitions to GLACIER or DEEP_ARCHIVE, and a rule with its own ObjectSizeGreaterThan/ObjectSizeLessThan filter sets its own floor. AWS::S3::Bucket.LifecycleConfiguration.TransitionDefaultMinimumObjectSize now dispatches through it instead of failing the resource

• [s3] PutBucketWebsite and GetBucketWebsite carry the whole WebsiteConfiguration: RedirectAllRequestsTo and RoutingRules are preserved alongside the index and error documents, with AWS's mutual exclusion, required fields and Protocol enum enforced rather than silently dropped. AWS::S3::Bucket.WebsiteConfiguration dispatches both new elements through S3, translating CloudFormation's RedirectRule/RoutingRuleCondition spellings. Overcast still serves no S3 website endpoint, so nothing is actually redirected

• [s3] buckets can send their object events to EventBridge. NotificationConfiguration now carries EventBridgeConfiguration, and while it is set every object mutation is published to the default event bus as AWS's aws.s3 / Object Created / Object Deleted event, through EventBridge's own delivery path so rule patterns, input transformers, retries and DLQs all apply. The detail omits request-id, requester, source-ip-address, sequencer and version-id rather than fabricating them. AWS::S3::Bucket.NotificationConfiguration.EventBridgeConfiguration dispatches through S3 instead of failing the resource

• BREAKING [s3] object version history. A versioning-enabled bucket mints a version id for every write, keeps the previous version as noncurrent, and answers a delete by adding a delete marker instead of removing anything; versionId addresses a specific version on GetObject, HeadObject, DeleteObject, DeleteObjects and CopyObject's source. Suspended keeps the versions it already has and writes the single null version, and objects stored before a bucket was versioned — including objects persisted by an earlier build — are that key's null version with nothing to migrate by hand. ListObjectVersions returns versions and delete markers in AWS's order, keys ascending then most recently stored first, with prefix, delimiter, max-keys and resumable key-marker/version-id-marker pagination. A bucket that never enables versioning behaves exactly as before, down to the absent x-amz-version-id
  migration: a bucket you had already set VersioningConfiguration Enabled or Suspended on now behaves as AWS does — DeleteObject writes a delete marker rather than removing the object, and DeleteBucket reports BucketNotEmpty until the markers and the versions under them are deleted by version id. Empty such a bucket with ListObjectVersions followed by version-targeted DeleteObjects, which is what the AWS SDKs' own cleanup loop does. Set the bucket back to unversioned if you did not mean to enable it — there is no such transition on AWS or here, so delete the bucket and recreate it

• [s3] the lifecycle sweeper executes NoncurrentVersionExpiration, NoncurrentVersionTransition and ExpiredObjectDeleteMarker, which were previously refused for want of any versions to act on. A version's noncurrent clock starts when the version that replaced it was written, NewerNoncurrentVersions retains that many newer versions first, and noncurrent transitions honour the bucket's x-amz-transition-default-minimum-object-size exactly as current-version transitions do. Expiring the current version of a versioned object adds a delete marker rather than deleting it, and ExpiredObjectDeleteMarker clears a marker once it is the key's only version. AWS::S3::Bucket.LifecycleConfiguration translates all three instead of failing the resource

• [s3] object event notifications carry versionId and sequencer, in both the Records[].s3.object payload delivered to SQS and Lambda and the EventBridge detail, and an EventBridge delete now reports "deletion-type": "Delete Marker Created" when a versioned bucket wrote a tombstone

• [web/cloudformation] the stack detail page and the stack list say why a deploy failed. The banner carries StackStatusReason, falls back to the ResourceStatusReason of the resource that actually failed once a terminal rollback has cleared the stack-level reason, and spells out what the status means: a ROLLBACK_COMPLETE stack has no stable state to ...

v0.0.1-alpha.31

Overcast v0.0.1-alpha.31

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.31
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.31
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.31
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.31

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	8570aed5f05046bad9c3b08878d23f04e4e3870964bd3ac854ac1bf9e34b9b32
overcast-darwin-arm64	1661c08d04031c362d1e9e77ab6958ba6818e39cb9d1c02a2729f621cff0f235
overcast-linux-amd64	e001832bee043b60b8b5a3e05763193dd6f516853256f057f7608cdbbf6a25fb
overcast-linux-arm64	1a12cfdd2f55e767dd4a52ae4331531a1a260f5e1e221795a261d5ff4457f8b8
overcast-windows-amd64.exe	db96c62c6393db58f68f00cea40b1569894cf1da9e01793793cff1f45f607114
overcastd-darwin-amd64	d6cf53cb58f0c52727ecc116314017cfe7c71ce40398222d74cb04007bffcf0e
overcastd-darwin-arm64	93fa0a7bf4285e66dd52b63cfadb2296895008c060b815c114beaac4d524d9fb
overcastd-linux-amd64	973100a0ef65830457c9b5658be733de39aeb3bfff2910e57156d22ea8296312
overcastd-linux-arm64	a27070849194336c37ac109130d09a1cad9ee0f4fcc61c3ef4e57135bcde11ed
overcastd-windows-amd64.exe	fae4c472138f4ba396d1179bae781b9d731a5f1ffecb7460941b4ac52503d869

Release Notes

Added

• Resource tagging operations added across 25 services: AppConfig, Athena, Cognito, DynamoDB, ECS, EKS, ElastiCache, ELBv2, EventBridge, Firehose, Glue, IAM, KMS, Lambda, MSK, Pipes, RDS, Scheduler, Secrets Manager, Shield, SNS, SQS, SSM, Step Functions, and WAF. Includes shared Taggable interface, generic ApplyTags/RemoveTags/ListTags helpers in serviceutil, and TagStore + NSStore for separate-namespace tag storage. CloudFormation tag propagation is wired through for Lambda and Secrets Manager.

• [router] new /_debug/trace/* endpoints for full request tracing — request/response bodies, per-handler structured log capture across 22 services, internal service-hop recording, stack traces captured during handler execution, and AWS errors. Active when OVERCAST_DEBUG=true; traces are looked up by the request ID already returned in every response (x-amzn-requestid / x-amz-request-id); /_debug/traces list and /_debug/trace/{id} detail endpoints support cursor-based bidirectional pagination; internal traces (health, inbox, SSE, debug polling) are capped at 20% of buffer capacity so they never crowd out user-facing requests; service/operation detection for Query-protocol services reads the request body via the generated awsapi.Registry; GET /_events/request/{requestId} queries the event history by request ID (History.FindByRequestID). Includes BFF proxy routes and a web UI at /debug/traces — infinite-scroll list with live polling, deduplication, service filter with counts, millisecond timestamps, and hop-count badges; per-trace tabs for overview (side-by-side request/response with copy buttons and referer), hops (upstream/downstream navigation via request IDs), logs, errors, and events (event-console matching layout); sequence diagram/waterfall/flow map views; Prism syntax highlighting for JSON, XML, form-encoded bodies, and Go stack traces; copy-as-curl; shared CheckboxFilterDropdown and formatBodyForDisplay used by the traces, events, and S3 preview pages; OVERCAST_DEBUG_TRACE_BUFFER env var for ring-buffer sizing.

• [router] GET /_health now includes a docker block with per-service Docker connection status. Responses from Docker-backed describe endpoints carry x-overcast-backing, x-overcast-backing-reason, and x-overcast-container-health headers.

• Web UI: S3 copy-URL buttons (S3 URI and path-style formats, actions-menu UX), header endpoint indicator with copy button, overhauled connection dialog with debounced endpoint validation and combobox suggestions, auto-detect API port (Docker socket, native, or 1:1 mapping), connection settings always visible, Docker connectivity banners on resource pages, and Docker health metrics on /metrics.

• [bff] normalizeEndpoint rewrites all loopback endpoints to internal API port, fixing BFF proxying in Docker with remapped ports and no socket. deriveAPIBaseURL returns endpoint known/unknown alongside URL; handles native custom API port via default-UI-port fallback.

• [combobox] add allowFreeText prop for editable-after-selection behaviour (seeds query from current value, commits on blur)

• [kms] UpdateKeyDescription

• [ci] a Release branch base check fails any pull request whose base is a release/* branch and puts the rebase-onto-main instructions in its job summary — the release bot is that branch's only writer, and a PR into it skips the test matrix, compat suite, changelog gate and breaking-change hold, which all run on pull requests into main

Changed

• [ci] the release changelog gate runs on pull requests into main only, so a mis-based PR gets the base-branch message instead of advice to fold a fragment that was correct all along

Fixed

• [cloudformation/dynamodb] Local secondary indexes are applied on table creation, while unsupported LSI updates now fail without mutating the table. DynamoDB table TTL configuration is validated, applied, and reconciled during stack create and update.

• [cloudformation/cloudwatch-logs] Log group retention, resource tags, and propagated stack tags are applied when a stack creates or updates the group.

• [cloudformation/kms] AWS::KMS::Key updates dispatch PutKeyPolicy only when KeyPolicy actually changed, so an unchanged caller-locking policy created with BypassPolicyLockoutSafetyCheck survives unrelated stack updates; a KeyPolicy given as a JSON string is forwarded verbatim instead of double-encoded; Description changes are applied through UpdateKeyDescription instead of being ignored

• [ecs/rds/elasticache/msk] resources no longer report RUNNING/available/ACTIVE when Docker is unavailable.

• BREAKING [kms/cloudformation] key-policy mutations apply AWS schema and caller lockout-safety validation.
  migration: ensure custom policies retain kms:PutKeyPolicy for the caller, or explicitly set BypassPolicyLockoutSafetyCheck

• [kms/cloudformation] KMS keys created by CloudFormation now honor Enabled: false on first deployment and restore the enabled default when the property is removed.

• BREAKING [secretsmanager/cloudformation] generated-secret templates validate before mutation, while KMS key metadata and CloudFormation tags round-trip through the service APIs.
  migration: use PasswordLength 1..4096 (or omit it for 32), and keep GenerateStringKey absent from the template object

• [waf/stepfunctions/shield/glue/elbv2/rds] fix tag validation gaps: WAF no longer publishes spurious creation events on tag writes; Step Functions typed path validates tags; Shield and ELBv2 validate tag limits; Glue uses shared helpers; RDS fixes unbounded loop; removed dead TaggedResource and shieldTagsToList.

• [waf] TagResource accepts and ListTagsForResource returns Tags/TagList as lists of {Key,Value} structs, matching the WAFv2 wire format that SDK clients send — previously tag operations were unusable via the SDK

• [web] path-style S3 copy URLs percent-encode object keys, so keys with #, ?, spaces, or unicode paste as working links

• [web] bundled builds follow the server-injected API endpoint on boot instead of a stale stored one; only endpoints entered in the connection dialog persist as overrides

• [web] reopening connection settings seeds the form from the active endpoint, so Connect keeps a custom endpoint instead of reverting it to the default

• BREAKING [logs] PutRetentionPolicy validates retentionInDays against AWS's fixed value set and returns InvalidParameterException otherwise, matching real CloudWatch Logs
  migration: use one of the AWS-documented retention values (1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288 or 3653 days)

• [router] debug tracing no longer pins an oversized request body's full backing array in memory when truncating it into the trace ring buffer, and internal CloudFormation dispatch hop bodies are capped at 1 MiB and flagged truncated

• [router] traces of responses written without an explicit status code record 200 instead of appearing in-flight forever in the debug UI

• [sns] TagResource and UntagResource responses include the empty result element botocore requires, so the AWS CLI no longer fails client-side after a successful tagging call

• [sns] tag operations answer a missing topic with error code ResourceNotFound as on real SNS; topic operations keep NotFound

• [athena] TagResource validates tags (limit and reserved-prefix checks) with InvalidRequestException, matching real Athena

• [eventbridge] tag operations no longer 500 (or panic) on a corrupt persisted tag blob, validate tags, surface store write failures, and answer ResourceNotFoundException for a rule or event bus that does not exist

• [firehose] TagDeliveryStream accepts Tags as a list of {Key,Value} structs matching the real API instead of rejecting SDK requests with a 400; ListTagsForDeliveryStream serializes an untagged stream's Tags as [] rather than null

• [pipes/router] the shared /tags/{resourceArn} route space now has a single dispatching owner that routes by the ARN's service prefix, so Pipes tag operations reach Pipes instead of silently landing in ...

v0.0.1-alpha.30

Overcast v0.0.1-alpha.30

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.30
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.30
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.30
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.30

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	154b132c03433abeb20320a1799e735dbbc8318353f1a3fda98e7f42f6d017f0
overcast-darwin-arm64	c1983e6457d329a71a9b39bb98644a6e7c85ba035f81afff24969310cf9d42e6
overcast-linux-amd64	bd206ec3935acd9240a65d447308bfcad5de301d06ca3c78c98674305de7e1a4
overcast-linux-arm64	43fb09dadd7b210910dd0804a8001559a62b47321b5451b573403e0f0f52ff90
overcast-windows-amd64.exe	b6f1491325d36dd9c65383aa395183ad70e744e0a34fea2194993b1c7d6d934c
overcastd-darwin-amd64	236adea7334df619dff3e5fd0aad0752ec4462d07c0814429759c3068171d6ac
overcastd-darwin-arm64	62afda0b2df35247429236246975887ede1b8dfe47301066fc6814234bc43451
overcastd-linux-amd64	b5bac75bd10f4de82e6e911c0f3c97706db5168000fb59be2dad37385a7140c4
overcastd-linux-arm64	5c5e510621878ecee921825aca3c27caaf1cc4036b109c40d07f92adfd12ba5b
overcastd-windows-amd64.exe	0ea5d784df00328103fd2a5e896f3daa085de65a786ffb2e264593eab726392a

Release Notes

Added

• [waf/web/docs] add Web ACL metadata CRUD views, global search, and system-map nodes while accurately surfacing missing rule enforcement and 501 boundaries

Changed

• [web/ecs] service and task screens prioritize recent container failures, stopped tasks, and logs over follow-on scheduler noise

Fixed

• [cloudformation/rds/ecs] CloudFormation waits for asynchronous resources to become usable before completing them and preserves their physical IDs through stabilisation failures so rollback can delete what it created. AWS::RDS::DBInstance and AWS::RDS::DBCluster now remain in progress until the database reports available, or fail with RDS's recorded reason and roll the stack back; cdk deploy no longer returns green while the engine is still initialising. Failed RDS databases and ECS services are now removed during rollback instead of being leaked under names that collide with the next deployment.

• [cloudformation/s3] AWS::S3::Bucket now applies lifecycle, versioning, notification, encryption, tag, CORS, and website properties through S3, including in-place updates, removals, and rollback restoration. S3 lifecycle configuration now validates and round-trips NoncurrentVersionExpiration while true version-history execution remains tracked separately.

• [cloudformation/lambda] Lambda resources now preserve supported function and event-source properties, reject unsupported fields before mutation, roll back partial updates, and store validated resource policies safely

• [sns/cloudformation] CloudFormation SNS topics and subscriptions now forward configured SNS attributes, including subscription filtering and raw SQS delivery (#522)

• [ecs/web] cluster summaries and topology reflect current resources, while stopped tasks remain inspectable with AWS-compatible status, reason, and one-hour retention metadata

• [ecs] stopped tasks retain a bounded container log tail for post-mortem diagnostics

• [rds] database containers stopped, crashed, or removed through Docker are now recovered with bounded backoff immediately, after Docker reconnects, or during Overcast startup; repeated crash loops settle to failed, only StopDBInstance establishes a durable stopped state, and MySQL 8 initialization now preserves AWS-valid special-character passwords while using caching_sha2_password

• [web/ecs] service diagnostics now keep the actual failed task and container logs visible instead of letting a later clean exit replace the cause; ECS screens add precise event times, two-way task navigation, and distinct working map destinations

Release: https://github.com/Neaox/overcast/releases/tag/v0.0.1-alpha.30

v0.0.1-alpha.29

Overcast v0.0.1-alpha.29

Docker Images

Full image with the web management console:

• Pull: ghcr.io/neaox/overcast:0.0.1-alpha.29
• Channel tag: ghcr.io/neaox/overcast:alpha
• Registry: overcast package

Headless slim image for CI pipelines:

• Pull: ghcr.io/neaox/overcast-slim:0.0.1-alpha.29
• Channel tag: ghcr.io/neaox/overcast-slim:alpha
• Registry: overcast-slim package

docker run --rm -p 4566:4566 -p 4567:4567 ghcr.io/neaox/overcast:0.0.1-alpha.29
docker run --rm -p 4566:4566 ghcr.io/neaox/overcast-slim:0.0.1-alpha.29

Native Binaries

Download a binary for your platform from the assets below and verify it with SHA256SUMS.

Asset	SHA256
overcast-darwin-amd64	e30067d382ad85882b047ad3f3f5ffdba9aa62fe153ccf5b511ffde58bb9f5bb
overcast-darwin-arm64	e63537f321caf3c40332153f67ea03045c0ef5c2f91811922818bf46a594117b
overcast-linux-amd64	dc1bc0fbc8c310afe96cec43306bc5653b5fdcc59da3e4bca8bed4c444f9ee9e
overcast-linux-arm64	092e0f96a26240e88f99fd721fe4173be9f229b0830f91701b727dda86eeb89b
overcast-windows-amd64.exe	0c7aeda9f89551bd080e79468025e5d11ada06b60b2a96aa1d195797f12292c0
overcastd-darwin-amd64	17e5941eb1b097117588c682e9315df49eb72dbd15a55b4b75fdcab7abf497ef
overcastd-darwin-arm64	1e606a262852328af745d561662138a1003837910b82a63e5a60db1e0efe3937
overcastd-linux-amd64	e2c4700f644e7ee4e27871445d7bec67e0eb5bd31c688230031d4f7ccd252dda
overcastd-linux-arm64	c9d3403c5fdbf1fe6b9d2057903f68156b1b05868188074782a6d42c4999d664
overcastd-windows-amd64.exe	5648600b256c6b265a3d50e16c735eb401add63d4ba5cae3de63c135a7a7d86d

Release Notes

Added

• BREAKING [stepfunctions] a real Amazon States Language interpreter — StartExecution now runs the state machine instead of reporting SUCCEEDED immediately. All eight state types, Retry/Catch, the full Choice operator set and the input/output pipeline are interpreted; Task states invoke Lambda, SQS, SNS, DynamoDB and nested state machines through Overcast's own router. DescribeExecution, GetExecutionHistory, ListExecutions, StopExecution, DescribeStateMachineForExecution and StartSyncExecution report what really ran, and the console gains an executions list and a state-history view. Anything Overcast cannot interpret — .waitForTaskToken, activity tasks, aws-sdk: integrations, distributed Map, JSONata — fails the execution loudly with States.Runtime rather than passing through silently. CreateStateMachine now rejects definitions that are not valid ASL with InvalidDefinition, as AWS does. StartExecution returns while the execution is RUNNING and StopExecution really interrupts it, both matching AWS; StartSyncExecution is the synchronous path
  migration: an execution that used to report SUCCEEDED unconditionally can now legitimately end FAILED or TIMED_OUT — assert on the real outcome. State machines created with a definition that is not valid ASL are rejected at create time. OVERCAST_STEPFUNCTIONS_EXECUTION_TIMEOUT (default 15m) is a runaway guard on each execution; it is not on the request path, so ordinary Wait states are unaffected

• BREAKING [cloudwatch] PutMetricAlarm refuses alarm shapes it cannot evaluate — metric math, anomaly detection, extended statistics — with a 501 instead of creating an alarm that never fires
  migration: replace a metric-math, anomaly-detection or percentile alarm with a single-metric alarm using Average, Sum, SampleCount, Minimum or Maximum

• [apigateway] usage-plan throttle and quota limits are measured on every request that presents an API key — GetUsage returns AWS's daily [used, remaining] log per key, and reaching a limit publishes an apigateway:Throttled event. OVERCAST_ENFORCE_APIGATEWAY_THROTTLE (default off) turns that measurement into rejection, answering an over-limit request with API Gateway's 429: TooManyRequestsException for the rate limit, LimitExceededException for the quota. The console's Usage Plans page shows each plan's rate, burst and quota, today's usage per API key, and a live feed of limits being reached

• [autoscaling] Auto Scaling groups converge for real — a single background reconciler launches and terminates EC2 instances until the owned instance set matches DesiredCapacity, runs the Pending/InService/Terminating lifecycle, replaces unhealthy instances, and records a DescribeScalingActivities entry for every launch and termination. PutScalingPolicy executes SimpleScaling and StepScaling policies, through ExecutePolicy or from a CloudWatch alarm naming the policy ARN in its actions, honouring cooldowns and MinAdjustmentMagnitude; PutLifecycleHook really pauses a launch or termination in Pending:Wait/Terminating:Wait, publishes the EventBridge lifecycle-action event, and waits for CompleteLifecycleAction or the heartbeat timeout. New: DescribeScalingActivities, ExecutePolicy, CompleteLifecycleAction, RecordLifecycleActionHeartbeat, SetInstanceHealth and SetInstanceProtection

• [cloudwatch] alarm state transitions publish the CloudWatch Alarm State Change event to EventBridge and notify SNS alarm actions; new DescribeAlarmHistory, EnableAlarmActions and DisableAlarmActions, plus StateReasonData, Dimensions, DatapointsToAlarm and the action lists on DescribeAlarms. The console's CloudWatch page gains a live alarms view showing state, reason, what is being evaluated, and recent transitions

• [ecs/secretsmanager/ssm] a container definition's secrets are resolved and injected as environment variables at task start, from Secrets Manager (including the :json-key: suffix that ecs.Secret.fromSecretsManager(secret, "password") produces) or SSM Parameter Store. They were parsed into nothing, so a task promised its credentials started without them and the application failed to reach its database with no explanation. A secret that cannot be resolved is named in a warning and left out rather than injected empty, which would be indistinguishable from a secret whose value is the empty string

• [ecs/logs] task containers using the awslogs log driver have their output shipped to CloudWatch Logs, into the group from awslogs-group and a stream named <prefix>/<container>/<task-id> as on ECS — under either launch type and however the task was started. A crash-looping task previously explained itself nowhere, its container being gone before docker logs could reach it

• [ecs] deployments report rolloutState, rolloutStateReason and failedTasks, and a service records the AWS-shaped events for a placement failure, for being unable to consistently start tasks, and for a tripped deployment circuit breaker. In the console a service row expands to show its rollout state, failed task count and event log, and task detail shows stopCode and per-container failure reasons; the Run Task and Create Service dialogs now take subnets, security groups and assignPublicIp, so a Fargate task can be started from the UI at all — it previously always failed with "Network Configuration must be provided when networkMode is 'awsvpc'"

• [ecs/elbv2] a service registers its tasks with the target groups in its loadBalancers, at the task's ENI address and container port, and deregisters them when they stop or the service scales in

• [efs] mount targets can serve a real NFSv4 export — OVERCAST_EFS_NFS=true in live mode starts one unprivileged NFS-Ganesha container per mount target, with access points as pseudo-paths

• [elbv2/ecs] a load balancer forwards to its targets, so ApplicationLoadBalancedFargateService hands out a URL that serves the application. A listener now stores the DefaultActions carrying its target group — previously parsed by the CloudFormation handler and dropped — and a request arriving on the load balancer's DNS name is proxied round robin to a registered target, preserving the Host so an app behind it builds its own links correctly. A load balancer with nothing healthy behind it answers 503, as ALB does

• [eventbridge] rule targets now fan out to Lambda, SNS, Step Functions, Kinesis and Firehose, not just SQS and scheduled ECS tasks; an EventBridge event bus is also a valid target, delivered through PutEvents with a hop budget so bus-to-bus forwarding cannot recurse. InputPath and InputTransformer are applied to a target's payload before delivery, and a failed delivery honours the target's RetryPolicy and dead-letter queue. The console's bus view lists each rule's targets with its resolved type and the last delivery outcome — delivered, retried, dead-lettered or dropped

• [iam] SimulateCustomPolicy, evaluating policy documents passed in the request without touching any stored entity. Opt-in request-time enforcement (OVERCAST_ENFORCE_IAM, unchanged and still off by default) now shares the simulator's evaluator, so a simulation describes what enforcement would decide, and it is documented in the IAM service reference. The console's IAM page gains a policy simulator — pick a principal or paste a policy, see the decision and the statements behind it — with the enforcement flag's state shown beside it, so an AccessDenied can be told apart from an application bug

• [pipes/web] a pipe detail view showing the resolved source, enrichment and target types, recent executions, and whether a pipe is actually wired or only stored

• [release] breaking changes wait while a minor or patch release PR is open. That PR's section of CHANGELOG.md is written and reviewed while it sits there, and every push to main is folded into it, so a break merged in the window ships under a version number that promised there was none. The release bot comments on the held pull request with the entries holding it and t...