oblako 0.1.0__tar.gz

oblako-0.1.0/.cfn-guard.rules

@@ -0,0 +1,52 @@
+#
+# oblako's CloudFormation conventions for the example stacks under examples/.
+# Not a compliance pack: each rule encodes how an oblako example is meant to run
+# against the local control plane (moto) and tear down cleanly, so a failure means
+# a template drifted from that, not a policy opinion.
+#
+
+# ECS runs on Fargate. oblako's local ECS backend runs the container directly;
+# there is no EC2 capacity to launch onto.
+let ecs_services = Resources.*[ Type == 'AWS::ECS::Service' ]
+rule ECS_IS_FARGATE when %ecs_services !empty {
+  %ecs_services.Properties.LaunchType == 'FARGATE'
+  << Violation: oblako runs ECS on Fargate; set LaunchType to FARGATE. >>
+}
+
+# Lambda / SAM functions pin a runtime oblako's local Lambda image supports (the
+# shogo82148 AL2023 images), so `sam local` and the local Lambda runner agree.
+let sam_functions = Resources.*[ Type == 'AWS::Serverless::Function' ]
+rule LAMBDA_SUPPORTED_RUNTIME when %sam_functions !empty {
+  %sam_functions.Properties.Runtime IN ['python3.11', 'python3.12', 'python3.13', 'nodejs20.x', 'nodejs22.x']
+  << Violation: pin a runtime oblako's local Lambda image supports (e.g. python3.12). >>
+}
+
+# Log groups keep a bounded retention, so repeated local runs do not pile up.
+let log_groups = Resources.*[ Type == 'AWS::Logs::LogGroup' ]
+rule LOG_GROUPS_HAVE_RETENTION when %log_groups !empty {
+  %log_groups.Properties.RetentionInDays exists
+  << Violation: set RetentionInDays on log groups so local runs stay tidy. >>
+}
+
+# Teardown leaves nothing behind. Retainable resources delete with the stack, so
+# oblako's local control plane does not keep orphans between runs.
+let buckets = Resources.*[ Type == 'AWS::S3::Bucket' ]
+rule S3_DELETES_WITH_THE_STACK when %buckets !empty {
+  %buckets.DeletionPolicy == 'Delete'
+  %buckets.UpdateReplacePolicy == 'Delete'
+  << Violation: set DeletionPolicy and UpdateReplacePolicy to Delete on buckets. >>
+}
+
+rule S3_PUBLIC_ACCESS_BLOCKED when %buckets !empty {
+  %buckets.Properties.PublicAccessBlockConfiguration.BlockPublicAcls == true
+  %buckets.Properties.PublicAccessBlockConfiguration.BlockPublicPolicy == true
+  %buckets.Properties.PublicAccessBlockConfiguration.IgnorePublicAcls == true
+  %buckets.Properties.PublicAccessBlockConfiguration.RestrictPublicBuckets == true
+  << Violation: buckets block all public access. >>
+}
+
+let ecr_repos = Resources.*[ Type == 'AWS::ECR::Repository' ]
+rule ECR_EMPTY_ON_DELETE when %ecr_repos !empty {
+  %ecr_repos.Properties.EmptyOnDelete == true
+  << Violation: set EmptyOnDelete so a repo with images does not block stack deletion. >>
+}

oblako-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,213 @@
+name: CI
+
+# Pull requests only: a merge to main brings the commits its pull request already
+# tested. "Run workflow" (workflow_dispatch) runs every job on demand.
+on:
+  pull_request:
+  workflow_dispatch:
+
+# A newer push to the same pull request cancels the run it supersedes.
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Which heavy jobs this change needs: each runs only when its code changed
+  # (or on a manual run), so a docs or example change costs only lint + unit.
+  # A change to this workflow runs no heavy job by itself; check it with
+  # "Run workflow".
+  changes:
+    name: changed areas
+    runs-on: ubuntu-latest
+    # paths-filter lists a pull request's files through the API
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      integration: ${{ steps.filter.outputs.integration }}
+      cluster: ${{ steps.filter.outputs.cluster }}
+      kubernetes: ${{ steps.filter.outputs.kubernetes }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            integration:
+              - "oblako/**"
+              - "tests/**"
+              - "pyproject.toml"
+              - "uv.lock"
+              - "docker-compose.yml"
+            cluster:
+              - "oblako/images/redshift/**"
+              - "oblako/images/redshift-cluster/**"
+              - "oblako/engines/redshift_control/**"
+              - "oblako/engines/redshift_data/**"
+              - "tests/redshift/test_redshift_multinode.py"
+            kubernetes:
+              - "oblako/services/backends.py"
+              - "tests/services/test_k8s_backend.py"
+
+  unit:
+    name: lint + unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Lint (ruff)
+        run: uv run --python 3.12 --extra dev ruff check oblako tests
+
+      # Docker-free subset: anything not auto-marked `integration` or `kubernetes`
+      # by tests/conftest.py is picked up — new tests Just Work without ci.yml edits.
+      - name: Unit tests
+        run: >
+          uv run --python 3.12 --extra dev python -m pytest -v
+          -m "not integration and not kubernetes and not cluster"
+
+  integration:
+    name: integration tests (Docker services)
+    needs: changes
+    if: needs.changes.outputs.integration == 'true' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # The sagemaker extra pulls in torch + CUDA wheels (via sagemaker-serve),
+      # several GB, and the tests then build training images; without room the
+      # image builds fail in pip. The runner image ships toolchains this job
+      # never uses, so drop them first.
+      - name: Free disk space
+        run: |
+          df -h /
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
+            /usr/local/.ghcup /opt/hostedtoolcache/CodeQL
+          docker image prune -af
+          df -h /
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      # Build the redshift image from source and tag it as the pull target, so
+      # integration tests run against the code under change (RedshiftService uses
+      # the local image when present, no pull). Closes the publish-lag gap where
+      # an image change lands before the registry republishes.
+      - name: Build redshift image
+        run: docker build -t public.ecr.aws/oblako/redshift-local:16 oblako/images/redshift
+
+      # Start the oblako services and wait for readiness (up to 180s each, for
+      # image pulls + DB/JVM init; OpenSearch is the slow one). Trino also starts
+      # the Glue engine, its awsdatacatalog metastore. Ollama/Bedrock
+      # is not run here: it needs large model downloads. The sagemaker extra
+      # (the v3 SDK) lets the SageMaker SDK tests drive its local modes.
+      - name: Start services
+        run: >
+          uv run --python 3.12 --extra dev --extra sagemaker python -c "from oblako.services import Oblako as O; import sys;
+          o = O(); svcs = [o.s3, o.dynamodb, o.kinesis, o.moto, o.stepfunctions, o.redshift, o.rds, o.opensearch, o.iceberg, o.trino];
+          [s.start() for s in svcs];
+          r = {s.name: s.wait_ready(timeout=180) for s in svcs};
+          print('ready:', r); sys.exit(0 if all(r.values()) else 1)"
+
+      # Trust oblako's Redshift TLS cert in the test environment, as a reader does,
+      # so redshift_connector connects with sslmode=verify-ca.
+      - name: Trust the Redshift certificate
+        run: uv run --python 3.12 --extra dev --extra sagemaker oblako trust
+
+      # MySQL (test_rds_data mysql cases) isn't started, so those skip; the Step
+      # Functions tests use Pass-only state machines (no Lambda).
+      - name: Integration tests
+        run: >
+          uv run --python 3.12 --extra dev --extra sagemaker python -m pytest -v
+          -m integration
+
+      - name: Disk usage after tests
+        if: always()
+        run: df -h /
+
+  redshift-cluster:
+    name: redshift MPP cluster (Citus)
+    needs: changes
+    if: needs.changes.outputs.cluster == 'true' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      # The cluster image builds FROM the single-node image (COPY --from), so
+      # build + tag that first; buildkit then resolves it from the local store.
+      - name: Build redshift image
+        run: docker build -t public.ecr.aws/oblako/redshift-local:16 oblako/images/redshift
+
+      # Coordinator + 2 workers, named explicitly so compose starts only the
+      # cluster (a bare `--profile cluster up` would also start the single-node
+      # `redshift` service, colliding on 5439).
+      - name: Build + start the Citus cluster
+        run: >
+          docker compose --profile cluster up -d --build
+          redshift-coordinator redshift-w1 redshift-w2
+
+      - name: Wait for the workers to register
+        run: |
+          for _ in $(seq 1 60); do
+            n=$(docker compose exec -T redshift-coordinator \
+                  psql -U oblako -d oblako -h 127.0.0.1 -p 5433 -tAc \
+                  "SELECT count(*) FROM pg_dist_node WHERE isactive" 2>/dev/null \
+                  | tr -d '[:space:]')
+            echo "active Citus nodes: ${n:-0}"
+            [ "${n:-0}" -ge 3 ] && exit 0
+            sleep 3
+          done
+          echo "cluster did not form"; docker compose logs redshift-coordinator | tail -40; exit 1
+
+      - name: Trust the Redshift certificate
+        run: uv run --python 3.12 --extra dev oblako trust
+
+      - name: Cluster tests
+        run: >
+          uv run --python 3.12 --extra dev python -m pytest -v
+          tests/redshift/test_redshift_cluster.py
+
+      # A multi-node cluster created through the Redshift API (moto behind the
+      # redshift-control proxy) runs from the image compose just built.
+      - name: Start moto
+        run: >
+          uv run --python 3.12 --extra dev python -c "from oblako.services import Oblako as O;
+          m = O().moto; m.start(); import sys; sys.exit(0 if m.wait_ready(timeout=120) else 1)"
+
+      - name: Multi-node cluster through the Redshift API
+        run: >
+          uv run --python 3.12 --extra dev python -m pytest -v -m cluster
+
+  kubernetes:
+    name: kubernetes backend (kind)
+    needs: changes
+    if: needs.changes.outputs.kubernetes == 'true' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      # Provision a real cluster so the Kubernetes backend's run/port-forward path
+      # (not just the manifest builder) is exercised end to end.
+      - name: Create kind cluster
+        uses: helm/kind-action@v1
+
+      - name: Kubernetes backend test
+        run: >
+          uv run --python 3.12 --extra dev python -m pytest -v
+          -m kubernetes

oblako-0.1.0/.github/workflows/docs.yml

@@ -0,0 +1,61 @@
+name: docs
+
+# Build the Sphinx site and publish it to S3 + CloudFront
+# (https://oblako-sdk.almostly.ai/). Authenticates via GitHub OIDC to the
+# least-privilege role `oblako-docs-deploy` (no static AWS keys).
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "oblako/services/**"        # api.md autodocs the service classes
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write   # required for GitHub OIDC -> AWS
+
+concurrency:
+  group: docs
+  cancel-in-progress: true
+
+env:
+  AWS_REGION: us-east-1
+  S3_TARGET: s3://oblako-public/docs/
+  DISTRIBUTION_ID: E9NGABBAAK9CF
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install docs dependencies
+        run: pip install -e ".[docs]"
+
+      - name: Build the Sphinx site
+        run: sphinx-build -b html -W --keep-going docs docs/_build/html
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          # Role ARN kept in a repo secret so the account ID isn't in the
+          # public source (and is masked in Actions logs). Value:
+          #   arn:aws:iam::<account-id>:role/oblako-docs-deploy
+          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Sync to S3
+        run: aws s3 sync docs/_build/html "$S3_TARGET" --delete
+
+      - name: Invalidate CloudFront
+        run: |
+          aws cloudfront create-invalidation \
+            --distribution-id "$DISTRIBUTION_ID" \
+            --paths "/*"

oblako-0.1.0/.github/workflows/redshift-image.yml

@@ -0,0 +1,67 @@
+name: redshift-image
+
+# Build + publish the oblako Redshift image whenever its source changes, so
+# `oblako up` / docker-compose can just pull it. Published to two registries:
+#   - Docker Hub:  deburky/redshift-local                  (discoverable, human-facing)
+#   - ECR Public:  public.ecr.aws/oblako/redshift-local      (no pull rate limits)
+#
+# Needs repo secrets:
+#   DOCKERHUB_USERNAME      = deburky
+#   DOCKERHUB_TOKEN         = a Docker Hub access token (PAT) with Read/Write
+#   AWS_ECR_PUBLIC_ROLE_ARN = arn of the oblako-ecr-public-publish OIDC role
+#                             (kept in a secret so the account id isn't in source)
+on:
+  push:
+    branches: [main]
+    paths: ["oblako/images/redshift/**", ".github/workflows/redshift-image.yml"]
+  schedule:
+    - cron: "0 6 1 * *" # monthly (1st, 06:00 UTC): pick up postgres:16 base-image CVE fixes
+  workflow_dispatch:
+
+permissions:
+  id-token: write # for GitHub OIDC -> the ECR Public publish role
+  contents: read
+
+env:
+  ECR_PUBLIC_REGISTRY: public.ecr.aws/oblako
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-qemu-action@v3 # emulation for the arm64 build leg
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ECR_PUBLIC_ROLE_ARN }}
+          aws-region: us-east-1 # ECR Public's control plane is us-east-1 only
+
+      - name: Log in to ECR Public
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registry-type: public
+
+      - name: Build and push (multi-arch, both registries)
+        uses: docker/build-push-action@v6
+        with:
+          context: oblako/images/redshift
+          platforms: linux/amd64,linux/arm64
+          push: true
+          # no SBOM/provenance attestation manifests (the "unknown · 0 MB" rows)
+          provenance: false
+          sbom: false
+          tags: |
+            deburky/redshift-local:16
+            deburky/redshift-local:latest
+            ${{ env.ECR_PUBLIC_REGISTRY }}/redshift-local:16
+            ${{ env.ECR_PUBLIC_REGISTRY }}/redshift-local:latest

oblako-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,58 @@
+# Publish oblako to PyPI when a version tag is pushed (git tag v0.1.0 && git push
+# origin v0.1.0). Trusted publishing: PyPI trusts this workflow through GitHub's
+# OIDC token, so no API token is stored anywhere. The publish job runs in the
+# `pypi` environment, which can require a reviewer's approval before it starts.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build and check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: The tag matches the package version
+        run: |
+          version=$(uv run --no-project python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          if [ "v${version}" != "${GITHUB_REF_NAME}" ]; then
+            echo "tag ${GITHUB_REF_NAME} does not match pyproject.toml version ${version}"
+            exit 1
+          fi
+
+      - name: Build the wheel and the source archive
+        run: uv build
+
+      - name: Check the distributions
+        run: uvx twine check --strict dist/*
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/oblako/
+    permissions:
+      id-token: write  # trusted publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

oblako-0.1.0/.gitignore

@@ -0,0 +1,53 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+/dist/
+.eggs/
+
+# Virtual envs
+.venv/
+venv/
+.python-version
+
+# Tooling caches
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+
+# Node (dashboard UI) — note: oblako/dashboard/frontend/dist is committed (served by the app)
+node_modules/
+
+# Editors / OS
+.vscode/
+.idea/
+.DS_Store
+# macOS custom-folder-icon metadata (stray Finder droppings)
+Icon-package/
+**/Icon-package/
+
+# SAM build artifacts
+.aws-sam/
+
+# Temp
+.tmp/
+
+# Local env files
+.env
+.env.*
+
+# `oblako notebook` launch artifacts (generated per launch in the working dir)
+.oblako-aws-config
+oblako-welcome.ipynb
+
+# Jupyter
+.ipynb_checkpoints/
+
+# SageMaker SDK local-mode working dirs (ModelTrainer local_container_root)
+.sm-local/
+
+# Sphinx output (CI builds it for the docs site)
+docs/_build/

oblako-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,30 @@
+# Run on demand: uvx pre-commit run --all-files
+# Install the git hooks: uvx pre-commit install --hook-type pre-commit --hook-type commit-msg
+repos:
+  - repo: https://github.com/commitizen-tools/commitizen
+    rev: v4.16.4
+    hooks:
+      - id: commitizen        # validate the message format: Service(+|~|-): description
+        stages: [commit-msg]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.14
+    hooks:
+      - id: ruff-check        # lint (autofix); covers oblako/, tests/, examples/, notebooks
+        args: [--fix]
+      - id: ruff-format       # formatter; keeps boxed section-divider comments intact
+
+  - repo: https://github.com/PyCQA/pydocstyle
+    rev: 6.3.0
+    hooks:
+      - id: pydocstyle
+        # scope to the package; tests/examples/dashboard aren't docstring-checked
+        files: ^oblako/.*\.py$
+        exclude: ^oblako/dashboard/
+
+  - repo: https://github.com/aws-cloudformation/cfn-lint
+    rev: v1.47.1
+    hooks:
+      - id: cfn-lint
+        # the tracked CloudFormation/SAM templates (build artifacts are gitignored)
+        files: ^examples/python/(sam/template|ecs/infra/ecs-fargate-alb)\.yaml$

oblako-0.1.0/CHANGELOG.md

@@ -0,0 +1,140 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Commits follow `Service(<+|~|->): description`, where `+` = **Added**, `~` =
+**Changed**, `-` = **Removed**. Running `cz bump` turns those commits into the
+versioned entries below.
+
+## Unreleased
+
+## v0.1.0 (2026-10-05)
+
+The first release.
+
+### Added
+
+- **Glue**: triggers and workflows: on-demand, scheduled and conditional triggers, workflow runs that follow the graph
+- **Glue**: crawlers and classifiers: S3 targets crawled into tables with partitions and inferred schemas
+- **Examples**: the Feast notebook runs on a provisioned cluster or a Redshift Serverless workgroup
+- **EventBridge**: Redshift scheduled queries as on AWS: cron schedules, Serverless targets, batches, WithEvent; the proxy is oblako's EventBridge endpoint
+- **Redshift**: GetClusterCredentials issues real temporary credentials; every awswrangler.redshift function is tested
+- **Glue**: connections: Create, Get, GetConnections, Update, Delete and BatchDelete, so awswrangler's connect(connection=...) works
+- **Redshift**: UNLOAD's PARTITION BY, MANIFEST, JSON and compression, with files named as Redshift names them
+- **Redshift**: awsdatacatalog.<db>.<table> names, Redshift's auto-mounted Data Catalog; MERGE from a distributed source on Citus
+- **Redshift**: ALTER TABLE on Iceberg tables: columns, type widening, compression, partition evolution
+- **Redshift**: MERGE into Iceberg tables; Iceberg DDL answers with a command, not a status row
+- **Redshift**: Apache Iceberg tables: CREATE EXTERNAL SCHEMA, CREATE TABLE ... USING ICEBERG, INSERT, UPDATE, DELETE
+- **Release**: publish oblako to PyPI from a version tag, through trusted publishing
+- **CLI**: the oblako banner, in block letters and oblako blue
+- **CLI**: oblako configure writes an AWS profile whose endpoints are oblako's
+- **MWAA**: environments run AWS's own Airflow image, with DAGs from S3 and InvokeRestApi
+- **Redshift**: Serverless namespaces and workgroups, in the API, the Data API and CloudFormation (#52)
+- **Redshift**: multi-node clusters from CreateCluster, on a native multi-arch Citus image (#48)
+- **RDS**: a real PostgreSQL per DB instance, with read replicas and logical replication (#45)
+- **Glue**: the Glue job API, so jobs are created and run with plain boto3 (#42)
+- **Athena**: query S3 Tables through s3tablescatalog/<bucket>, as on AWS (#41)
+- **S3Tables**: serve the S3 Tables Iceberg REST endpoint, so PyIceberg configured for AWS runs unchanged (#40)
+- **Glue**: Parquet and Iceberg tables in the Data Catalog, queried by Athena (#38)
+- **S3**: bucket policies and event notifications to Lambda, SQS, SNS and EventBridge (#37)
+- **S3**: object and bucket tagging, and S3 Inventory, in front of S3Proxy (#36)
+- **CLI**: oblako up starts the in-process API engines, like s3vectors (#35)
+- **redshift**: accept PASSWORD DISABLE on CREATE / ALTER USER (#30)
+- **redshift**: access management as code via redtape compat (#28)
+- **docs**: refresh SDK landing + architecture with diagrams (#24)
+- **redshift**: COPY from JSON (auto / noshred / jsonpaths) + compression (#23)
+- **services**: local S3 Vectors + S3 Tables (#22)
+- **services**: surface ECS + EKS control plane + ECS task metadata endpoint (#20)
+- **SageMaker**: multi-model endpoints (MME)
+- **EventBridge**: fire Redshift Data targets + scheduled rules
+- **Bedrock**: Guardrails (create/get/list/delete + ApplyGuardrail)
+- **Athena**: boto3 athena API executed via the Trino engine
+- **Firehose**: local Kinesis Data Firehose (DirectPut -> S3)
+- **services**: surface moto-backed services (Secrets Manager, SSM, STS, KMS, Logs, ECR, EventBridge)
+- **SageMaker**: Model Registry (package groups + versioned packages + approval)
+- **Bedrock**: streaming (InvokeModelWithResponseStream + ConverseStream)
+- **SageMaker**: async-inference SNS notifications (NotificationConfig)
+- **SageMaker**: Asynchronous Inference (InvokeEndpointAsync)
+- **DynamoDB**: native vector search (SearchVectors) over DynamoDB Local
+- **Bedrock**: real embeddings via invoke_model on embed models
+- **Bedrock**: expand foundation-model catalog to what oblako can serve
+- **SageMaker**: Model Monitor - Data Capture + monitoring schedules
+- **SageMaker**: local Feature Store (online KV + offline S3 Parquet)
+- **SageMaker**: serverless-MLflow training example + endpoint variant echo
+- **SageMaker**: resource CRUD, tags, Stop*, and Studio domains/profiles
+- **SageMaker**: Automatic Model Tuning (HPO) via Syne Tune -> AMT (increment)
+- **SageMaker**: local pipeline example + training Environment passthrough
+- **SageMaker**: local processing jobs (create_processing_job)
+- **SageMaker**: account-free client stubs + local_gpu passthrough
+- **SageMaker**: local batch transform (create_transform_job)
+- **SageMaker**: local real-time endpoints + invoke_endpoint
+- **SageMaker**: local control-plane engine: create_training_job runs in Docker
+- **Redshift**: COPY/UNLOAD<->S3 bridge, SUPER/PartiQL, LISTAGG, PIVOT/UNPIVOT (#18)
+- **Redshift**: auto-distribute DISTKEY/DISTSTYLE on the cluster (increment #2) (#16)
+- **Redshift**: MPP cluster variant on Citus (increment #1) (#15)
+- **Redshift**: sqlalchemy-redshift catalog reflection (unblocks Alembic) (#14)
+- **Commitizen**: Service(+/~/-) commit format and Keep a Changelog (#12)
+
+### Changed
+
+- **SageMaker**: local pipelines read S3Prefix inputs under when_required; model package versions are never reused
+- **Redshift**: each oblako certificate has its own subject, and oblako trust drops stale ones
+- **Redshift**: oblako trust survives a redshift-connector reinstall; oblako trust --remove undoes it
+- **Examples**: the Feast notebook uses oblako's DynamoDB endpoint, so apply re-runs; outputs refreshed
+- **Redshift**: enable_case_sensitive_identifier exists, off as on Redshift, so awswrangler's to_sql(add_new_columns=True) works
+- **Redshift**: selected SUPER items are named after the path's last key, cast or not, as Redshift Serverless names them
+- **Glue**: a job's S3 output is the data files only, as AWS Glue 5.0 writes it, with no directory markers
+- **Redshift**: a SUPER value selected through dot navigation comes back as JSON text, named after its last step, as Redshift sends it
+- **CLI**: oblako configure won't drop profile settings a newer oblako wrote, unless --force
+- **CloudFormation**: AWS::IAM::Role gets its inline Policies and ManagedPolicyArns, and deletes cleanly
+- **S3**: CreateBucket on a bucket you already own succeeds in us-east-1, as on S3; other Regions keep BucketAlreadyOwnedByYou
+- **Redshift**: UNLOAD into a non-empty prefix fails unless ALLOWOVERWRITE or CLEANPATH, and files are named after the prefix as written
+- **Redshift**: VARCHAR(MAX) is VARCHAR(65535), as Redshift stores and reflects it, so a longer value is refused
+- **Redshift**: oblako trust trusts this machine's certificate and any running compose container's, not one or the other
+- **Redshift**: Iceberg tables behave as Redshift Serverless does: NOT NULL, plain VARCHAR, Redshift's errors and SHOW TABLE
+- **Examples**: every demo notebook re-run against oblako; the fraud stream notebook generates its transactions, so it runs from a fresh clone
+- **Services**: KinesisService is exported from oblako.services, like the other services
+- **Examples**: the OpenSearch RAG example runs on current opensearch-py, Bedrock batch asks factual prompts; cfn-lint checks the SAM and ECS templates again
+- **Examples**: the credit-risk demo notebooks are now credit-scoring
+- **Docs**: the architecture diagrams carry the new oblako logo
+- **Redshift**: Redshift's storage clauses are stripped only from the CREATE TABLE statements of a multi-statement query
+- **Redshift**: docker compose's Redshift containers make their own TLS certificate, and oblako trust reads it while they run
+- **Repo**: untrack the docs build, drop local paths from notebook outputs, add SECURITY.md and CONTRIBUTING.md
+- **Redshift**: each machine makes its own TLS certificate; the image no longer ships a shared key
+- **Docs**: version the README logo URLs, so GitHub's image cache fetches the new logo
+- **Services**: containers publish their ports on this machine only
+- **CLI**: the dashboard listens on this machine only; OBLAKO_PORT_<NAME> moves a service off a taken port
+- **Redshift**: system objects live in pg_catalog, so SQLAlchemy and Alembic see only user tables
+- **Docs**: new oblako logo in the README and the docs sidebar
+- **ECS**: inject task secrets from SSM and Secrets Manager; refuse invalid Fargate sizes
+- **ECS**: plain boto3 RunTask runs the task as a real container
+- **CLI**: the oblako profile sends services it does not list to moto, never to AWS
+- **CloudFormation**: default port 8017, off OpenSearch Dashboards' 5601
+- **CloudFormation**: sam deploy and sam delete run end to end; stacks persist and roll back
+- **Redshift**: Serverless tags, and namespaces without an admin user
+- **S3**: virtual-hosted addressing, UTF-8 keys, and S3 Control's tag API for buckets
+- **MWAA**: report MWAA's defaults and drop null fields, as a real environment does
+- **Firehose**: a CreateDeliveryStream that fails on its Kinesis source leaves nothing behind (#51)
+- **CLI**: oblako up fails when a service is not ready, with --timeout (#49)
+- **Firehose**: name S3 objects, convert to Parquet and COPY into Redshift as AWS does (#47)
+- **DynamoDB**: vector search follows the released API, and tables take tags (#46)
+- **RDS**: pgvector in the engine, and Data API decimals as strings, as on AWS (#44)
+- **Redshift**: AVG of an integer column returns BIGINT, as on Redshift (#43)
+- **Kinesis**: start from the CLI and with oblako up, and fix the crash on start (#39)
+- **S3**: pin S3Proxy 4.1.1 so paginating partitioned keys terminates (#34)
+- **SageMaker**: align with SDK v3, plus in-engine Redshift ML and engine port checks (#32)
+- **docs**: redtape's plan is not reliably empty when converged (#31)
+- **redshift**: render group ACLs the way Redshift does, so redtape converges (#29)
+- **docs**: uniform diagram width so fonts render consistently (#27)
+- **docs**: enlarge diagram text for readability on the docs site (#26)
+- **redshift**: fix flaky Citus SORTKEY-index test (#25)
+- **docs**: reflect new services + license(+): Apache-2.0 open-core (#21)
+- **Firehose**: Kinesis-stream source + Redshift destination
+- **DynamoDB**: match AWS SearchVectors score semantics (COSINE distance)
+- **DynamoDB**: match real AWS SearchVectors wire shape (parity fix)
+- **SageMaker**: run training containers directly (v3-ready, no SDK dependency)
+- **Redshift**: SORTKEY -> index + transactional-DDL auto-distribute (polish) (#17)
+- **Redshift**: bake a fixed TLS cert so pins survive down -v / clones (#13)