feat: SSM/STS, Lambda provided runtimes, and Redshift COPY on PostgreSQL for local data loads

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this is
 
-`devcloud` is a local cloud service emulator: a single Rust binary that runs compatible development endpoints for Mail (SMTP), S3, GCS, DynamoDB, BigQuery, SQS, Pub/Sub, Redshift, Redis, Application Auto Scaling, Lambda, Cloud Run, and a React dashboard. It targets deterministic local tests and manual inspection — not production parity. New provider behavior should be added deliberately, backed by tests in the relevant Rust crate and usually an acceptance gate under `scripts/*-autoloop/`.
+`devcloud` is a local cloud service emulator: a single Rust binary that runs compatible development endpoints for Mail (SMTP), S3, GCS, DynamoDB, BigQuery, SQS, Pub/Sub, Redshift, Redis, Application Auto Scaling, SSM Parameter Store, STS, Lambda, Cloud Run, and a React dashboard. It targets deterministic local tests and manual inspection — not production parity. New provider behavior should be added deliberately, backed by tests in the relevant Rust crate and usually an acceptance gate under `scripts/*-autoloop/`.
 
 ## Commands
 
@@ -48,7 +48,7 @@ Each provider lives under `services/<svc>/` and exposes crate-local config/serve
 `services/dashboard` is the HTTP entry point users hit at `:18025`. It serves:
 - The React SPA from `assets/react` (embedded). `assets.rs` mounts `/dashboard/` and falls back to `index.html` for client-side routes.
 - A set of `/api/*` JSON endpoints that forward to each service's introspection/control or provider-protocol surface.
-- **Route convention:** every service page lives under `/dashboard/<svc>` (`mail`, `s3`, `gcs`, `dynamodb`, `bigquery`, `sqs`, `pubsub`, `redshift`, `redis`, `applicationautoscaling`, `lambda`, `cloudrun`). The compatibility short paths `/mail`, `/s3`, `/gcs`, `/dynamodb`, `/bigquery`, `/redis` return 301 redirects to their `/dashboard/<svc>` counterpart — never add new functionality to the compatibility redirects.
+- **Route convention:** every service page lives under `/dashboard/<svc>` (`mail`, `s3`, `gcs`, `dynamodb`, `bigquery`, `sqs`, `pubsub`, `redshift`, `redis`, `applicationautoscaling`, `ssm`, `sts`, `lambda`, `cloudrun`). The compatibility short paths `/mail`, `/s3`, `/gcs`, `/dynamodb`, `/bigquery`, `/redis` return 301 redirects to their `/dashboard/<svc>` counterpart — never add new functionality to the compatibility redirects.
 - **Safety rule:** dashboard mutations MUST go through the provider-protocol path (`/api/<svc>/*` forwarding into the in-process service) — never directly through storage. Never log credentials, Authorization headers, signatures, message bodies, or object payloads. See `AGENTS.md` and the per-service notes in `README.md`.
 
 ### Always-on auxiliary services
@@ -59,7 +59,7 @@ Each provider lives under `services/<svc>/` and exposes crate-local config/serve
 Every service supports a `relaxed` mode (default, used by all local tooling) and a stricter mode that validates configured credentials. Relaxed mode is what tests and autoloops assume; if you add credential checks, gate them on the mode string so the existing scripts still pass.
 
 ### Configuration & storage
-Config lives at `.devcloud/config.yaml` (custom YAML-ish parser in `orchestrator/src/config.rs`). Runtime data is rooted at `Storage.Path` (default `.devcloud/data`) with per-service subdirectories (`mail`, `s3`, `dynamodb`, `bigquery`, `sqs`, `pubsub`, `redshift`, `gcs/upload_sessions`, `applicationautoscaling`, `lambda`, `cloudrun`, `kv`). `kv` is reserved for a future key-value store — `init_workspace` creates it but no service currently reads or writes it. `.devcloud/` is gitignored and must not be committed.
+Config lives at `.devcloud/config.yaml` (custom YAML-ish parser in `orchestrator/src/config.rs`). Runtime data is rooted at `Storage.Path` (default `.devcloud/data`) with per-service subdirectories (`mail`, `s3`, `dynamodb`, `bigquery`, `sqs`, `pubsub`, `redshift`, `gcs/upload_sessions`, `applicationautoscaling`, `ssm`, `lambda`, `cloudrun`, `kv`). `kv` is reserved for a future key-value store — `init_workspace` creates it but no service currently reads or writes it. `.devcloud/` is gitignored and must not be committed.
 
 ## Conventions
 

Cargo.toml

@@ -22,4 +22,6 @@ members = [
   "services/redshift",
   "services/s3",
   "services/sqs",
+  "services/ssm",
+  "services/sts",
 ]