01
Inventory
- Does
- List managed and data resources represented by one accepted snapshot.
- Reads
- Tenant, stored state, pinned state version.
- Outcome
- A read-only inventory with digest and count, or a refused request.
infrastructure.inventory
Overpass / Infrastructure state
See what a change can reach.
Name what exists in an accepted snapshot, prove how it connects, and walk what a change could reach — including relationships that remain unresolved. Overpass is adopted on its own; it does not own Environment.
Request Overpass access See a sample
The sample is illustrative. Scrolling it is not access. Sign in stays in the header for invited operators.
01 / The problem
Cloud tools know resources. Teams still lose the state they govern.
Plans, consoles, and apply engines describe individual resources. They do not keep a custodial answer to what exists, how it is related, what a change could reach, or which version is actually being governed.
01State files move between backends, laptops, and pipelines. The snapshot a team thinks it is governing is often not the one they can query.
02Relationships are implied by modules, names, and tribal knowledge. Proven apply-time edges are rarely the object of record.
03Impact is guessed from outage stories or plan text. Reachability over stored edges is a different question.
04Overpass exists so infrastructure state has a domain home: custody, identity, relationships, persistence, and change — not another place to run Terraform.
Example
An inspectable snapshot, not live discovery.
This table is an illustrative composition of edge.prod serial 18. It is not live cloud discovery, not an outage prediction, and not an apply.
| Address | Kind | Relationship |
|---|---|---|
module.edge.aws_subnet.public | managed | source |
aws_route_table.public | managed | proven depends_on |
aws_security_group.edge | managed | unresolved — no stored edge |
Central model
One accepted snapshot is the unit of understanding.
Overpass reads Terraform/OpenTofu state — or an already-exported Pulumi stack document — that it has accepted into custody. Inventory, relationships, and impact are derived from that pinned version. Drift compares that version to a caller-supplied refresh that is never written. Commit is a gated state transaction that admits a new immutable version. It does not apply infrastructure or mutate cloud resources.
Pulumi enters as stack-export ingest, not as pulumi login against this host. Live cloud APIs are out of the model.
02 / Resource identity
A resource is an address in a stored document, not a live cloud object.
Inventory names managed and data resources as the accepted snapshot represents them. Identity is the Terraform-style address and instance, plus the digest and serial of the version that produced it. Overpass does not enrich that identity from cloud APIs, tags, or naming conventions.
Relationships reuse that same identity. An edge is a proven apply-time depends_on between two addresses in one snapshot. Unresolved or inferred connections stay visible as incompleteness, not as invented topology.
Ownership
Overpass owns infrastructure state. It does not own delivery, cost, or intent.
- OwnsAccepted Terraform/OpenTofu state (and ingested Pulumi export) as versioned custody: bytes, digest, serial, lineage.
- OwnsResource identity, proven relationships, structural reachability, refresh comparison, and gated admission of a new version.
- OwnsPersistence and tenant isolation for that custody when a store is configured. Export remains byte-exact as an escape hatch.
- Does notApply infrastructure, call cloud APIs, remediate drift, or run Terraform / OpenTofu / Pulumi.
- Does notOwn Environment or environment vending. Those stay with Repave. Overpass is independently adoptable.
- Does notGovern software repositories (Repave), engineering economics (Toll), or the intent-and-authorization experience (Dispatch).
- Does notTreat this public host as a capability API. Cluster callers use the Overpass runtime boundary, not this page.
Capabilities
Five readings of the same stored state.
Each capability names what it does, what it reads, and what it returns. None of these are Faster / Smarter / AI cards. Inventory, relate, and impact share one snapshot. Drift and commit operate on that custody.
02
Relationships
- Does
- Emit proven apply-time edges. No inference from names, modules, or live APIs.
- Reads
- The same snapshot inventory already understands.
- Outcome
- Depends-on edges plus unresolved count, or a refusal.
infrastructure.relate
03
Impact
- Does
- Walk reachability over relate edges from a selected address (blast radius in the UI).
- Reads
- Snapshot, source address, dependents or dependencies direction.
- Outcome
- A structural reachable set — not predicted outage or replace behavior.
infrastructure.impact
04
Drift
- Does
- Compare accepted expected state to a caller-posted refresh document.
- Reads
- Stored version plus observed refresh bytes that are never written.
- Outcome
- In-sync or drifted findings. Not version-vs-version history, not remediation.
infrastructure.drift
05
Commit
- Does
- Admit a proposed document as a new accepted version through required gates.
- Reads
- Proposed bytes, expected version/digest, recorded gates — never a caller “passed” flag.
- Outcome
- A new immutable version, or refusal. It does not apply infrastructure.
infrastructure.commit
Scenario
Change a subnet. Ask custody, not the console.
Labeled product truth
A partner holds an accepted OpenTofu snapshot in Overpass. They inventory module.edge.aws_subnet.public. Relate proves a depends_on to aws_route_table.public. Impact walks dependents of that address. A refresh file is posted; drift reports whether observed instances diverged. A new snapshot enters only if commit gates already recorded on the transaction succeed.
Not this scenario
Overpass does not open an AWS account, predict an outage, rewrite the module, or run apply. Dispatch may phrase the question; it does not persist state or evaluate Overpass gates. Toll may later attach cost to identity — that is a different domain.
Availability
Available here is identity. Custody is not general availability.
Statuses are conservative and Overpass-owned. Do not treat sibling products as delivered on this host. Do not treat this site as a public capability API.
available
Public identity and health
This host serves the product page, health, and readiness. Sign-in confirms Overpass identity only.
production-validation
Domain capabilities in this repository
Inventory, relate, impact, drift, and commit are implemented here. They are not a self-serve public API on this origin.
in-development
Hosted custody
The store stays off until a database URL is set. Hosted HTTP-backend custody is enabled per early-access partner, not as a Terraform-backend SKU.
planned
Public capability surface
A generally available, independently documented capability API is direction. It is not claimed by this page.
Policy
Overpass observes. Policy interprets. Another product remediates.
Accepted Terraform or OpenTofu snapshots and proven dependency edges are facts a policy engine can read. They are not themselves a decision, and they are not continuous live inventory.
Overpass does not run family-wide policy evaluation on this host. It does not apply cloud changes when a decision is denied. Repave or another authorized executor owns remediation. Observed outcomes can feed the next decision; that loop is direction, not a claim that every snapshot is already evaluated.
03 / Family
Four readings of one cut. Not a required bundle.
Overpass is independently adoptable. Sibling products are optional context, not prerequisites. Overpass does not own Environment. Convergence stays independent of the runtime path.
- Repave — governed software and repository delivery.
- Overpass — infrastructure state, identity, relationships, and impact.
- Toll — engineering economics and economic evidence.
- Dispatch — governed intent and action; it does not own this domain or evaluate Overpass gates.
Product truth
What is true today
Overpass is In development. Product identity and the five capabilities exist in this repository. Hosted custody is partner-gated. Sign-in does not unlock a capability console. Wire names in some hosted surfaces still say state_store / repave-tf; the domain owner is Overpass.
Product direction
What is not claimed
General hosted availability, a public capability API, and graph-scoped parallel apply remain direction (the last sits in a parking lot). This page does not invent a launch date or a deploy-now path.
Next step
Request Overpass access while hosted custody stays partner-gated.
This host does not offer a public start or deploy action. Access requests depend on the Repave-hosted waitlist at repave.opsdevco.de/waitlist?product=overpass. That form is Overpass interest, not a Repave-only signup. Exploring the sample is not access.