[angel-manuel]

Release dev → master. It contains 10 commits since v0.25.0 (#839), two decisions (D141, D142) and migration 139. git cherry origin/dev origin/master is empty.

What's in it

• "Allow & Remember" expires after an org-set default, 7 days out of the box (feat(approvals): org-configurable default Allow & Remember expiry (7 days) #846, D142).
  • New org setting default_remember_ttl_secs on GET/PATCH /v1/orgs/{id}/execution-settings. PATCH is admin-only. The range is 60 s to 365 d, and null means forever.
  • allow_remember with no ttl now gets the org default instead of a permanent rule. ttl: "forever" is accepted explicitly.
  • The MCP remember dialog, the dashboard (an Org Settings select, and a "· default" tag in the Allow menu) and the SDK card all follow the default.
• A single Allow split button on approval detail (feat(dashboard): single Allow split button with duration menu on approval detail #844). It replaces Allow once / Allow & Remember / the expiry clock: the main half runs the selected duration, and the caret picks Once, 1 h, 24 h, 7 d, 30 d or Always.
• Template info.summary, a one-line catalog tagline (feat(templates): info.summary as a one-line catalog tagline #847). It is optional on the template list, detail and admin responses. Compile warns when it is multi-line or over 80 chars. All 26 shipped templates now have one, and the Create Service cards show summary ?? description.
• Slack approvals name channels (fix(slack): name channels in approval summaries, log resolver misses #845). Channels render as '#general', get_thread_replies and get_user gain resolvers, and HTTP display-resolver misses are now logged with the upstream's error code. The argument itself is never logged.
• /health returns 503 when Postgres is down; Cloud Run probes are TCP (feat(infra): prod uptime check + [P0] API Down; /health fails on DB down, TCP probes #843, D141). This release also adds a prod uptime check and a [P0] API Down alert, and fixes the OAuth, upstream and webhook ratio alerts, whose per-second denominator was clamped to 1 so they could never fire.
• Infra posture (feat(infra): make Cloud Run services public via invoker_iam_disabled #840, feat(infra): remove default-SA Editor and set project org policies #841):
  • Cloud Run services are made public through invoker_iam_disabled instead of an allUsers binding, so the overspiral.com org's domain-restricted sharing can stay enforced.
  • roles/editor is removed from the default service accounts, and project-level org policies are set (new project-guardrails module).
• Dependencies (fix(deps): bump block-buffer 0.12.1, except 0.10.4 and deepmerge #842): block-buffer is bumped to 0.12.1. block-buffer 0.10.4 and npm deepmerge (dev-only) are excepted until 2027-01-25, since neither has a fixed release.

⚠️ Notes

• Migration 139 runs at boot and is additive. It adds orgs.default_remember_ttl_secs with a default of 604800, so every existing org is backfilled to 7 days.
• API behavior change: a caller that left out ttl on allow_remember to get a permanent rule now gets a 7-day rule. Pass ttl: "forever" for a permanent one. Existing rules keep their expiry.
• /health can now return 503. It does so when the DB probe fails. Anything that treated /health as always-200 (Better Stack, the GCP uptime check) now also reports DB outages, which is intended.
• Infra:
  • Apply module.cloud_run (TCP probes) with this deploy, both envs. The HTTP liveness probe on /health was what killed dev nightly, and it is still live until the apply.
  • The uptime check and alerts from feat(infra): prod uptime check + [P0] API Down; /health fails on DB down, TCP probes #843 are already applied in both envs. feat(infra): remove default-SA Editor and set project org policies #841 is applied too, and its apply included feat(infra): make Cloud Run services public via invoker_iam_disabled #840, since both envs planned clean afterwards. Once the forgotten allUsers invoker bindings are confirmed unused, they can be removed by hand (see feat(infra): make Cloud Run services public via invoker_iam_disabled #840).
• Overfolder contract: GET /v1/templates items gain an optional summary. Render summary ?? description.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
overslash	Ready	Preview	Oct 29, 2026 1:58pm UTC

[github-actions]

Code diff size

+847 / −120 across 43 files (net +727)

Area	Files	Added	Removed	Net
dashboard	10	+405	−37	+368
overslash-api	16	+252	−75	+177
overslash-core	13	+143	−3	+140
overslash-db	1	+34	−1	+33
sdk	3	+13	−4	+9

_{Source files under src/ only (.cjs, .go, .js, .jsx, .mjs, .py, .rs, .svelte, .ts, .tsx); test files and inline #[cfg(test)] modules excluded. 71 other changed files not counted.}

[codecov]

Codecov Report

❌ Patch coverage is 94.22111% with 23 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/overslash-api/src/routes/mcp/elicitation.rs	84.74%	9 Missing ⚠️
...rates/overslash-api/src/services/param_resolver.rs	82.35%	6 Missing ⚠️
crates/overslash-api/src/routes/templates/read.rs	50.00%	5 Missing ⚠️
crates/overslash-api/src/routes/mcp/modern.rs	95.65%	1 Missing ⚠️
crates/overslash-api/src/routes/mcp/tools_call.rs	0.00%	1 Missing ⚠️
crates/overslash-api/src/routes/templates/mod.rs	66.66%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!