AWS Weekend Agent Challenge: Daybreak

Vision and what the agent does

I build fast and I build a lot. As of this weekend that is 49 public repos. What I am bad at is remembering the state of any of them. Which ones are live, which shipped with no README, which went quiet months ago and quietly rotted. The answer used to be that I had no idea until I went digging.

Daybreak is the fix. I wanted the review done before I even sat down: not a dashboard I have to remember to check, but a brief already in my inbox, waiting at first light. That is the name. Every morning at 6 AM Pacific it wakes up on its own, with no button to press. It takes inventory of every repo on my GitHub account, reasons over that inventory with Amazon Nova, and leaves a short brief in my inbox: how many repos are live, how many have gone quiet, how many are missing a README or a license, and three specific "do something here" nudges. By the time I am awake, the review is done and waiting. The best tool is the one you never have to open.

It runs read-only. It reports, I decide. It never touches my repos.

How I built it

PRD first, always. One architecture doc with MUST, STUB, and NEVER labels before a line of code, then a block-by-block build with a pass or fail checkpoint after each block. Uptime checks, showcase scraping, and auto-generated README pull requests are all stubbed with implementation notes, not half-built. Shipping small and lean beat shipping big and broken.

I ran it as a multi-model workflow. Claude for the architecture and the PRD, Kiro for the spec-driven build. I wrote phase-aware guardrails so Kiro could do the file authoring and tests while I was at work, then flip to a go-live mode that let it deploy with my credentials once I got home. I direct and approve, the agents generate.

The challenge worth mentioning was getting Nova to answer at all. My first invoke failed with "on-demand throughput isn't supported." Nova will not run on-demand from the bare model id. You have to call the cross-region inference profile, us.amazon.nova-lite-v1:0, and your IAM policy has to allow both the profile and the underlying model in every region the profile routes to. List only the profile and you get AccessDenied even with model access on. Once I understood that, it answered first try.

A second lesson landed mid-build. The old Bedrock model access page was retired in late 2025 and Amazon-provided models are auto-enabled now, so a step I had planned no longer existed. Checking whether a tool is current before depending on it saved me from chasing a dead console page.

AWS services used and architecture overview

The whole thing is one Lambda and a schedule.

Amazon EventBridge Scheduler fires the function daily at 6 AM Pacific with a timezone-aware cron, so daylight saving handles itself. This is the trigger, not a button.
AWS Lambda runs the agent in Python with zero third-party dependencies, so the deploy package is a single zipped file.
Amazon Bedrock with Nova Lite via the Converse API does the reasoning.
Amazon SES emails the brief.
Amazon CloudWatch logs every run and alarms on any error.

Infrastructure is a single AWS SAM template, so the whole stack deploys and rolls back as one unit.

Flow: EventBridge Scheduler triggers Lambda, which reads the GitHub API, calls Bedrock Nova, and sends through SES to my inbox.

One design choice I am proud of: structure is deterministic, flavor is generated. The counts of how many repos are live, quiet, or unlicensed are computed in Python so they can never be hallucinated. Nova only writes the narrative and the nudges around those fixed numbers.

What I learned

Bedrock inference profiles, and why on-demand Nova needs the us. prefix and IAM that covers the fan-out regions. Least-privilege IAM for an agent: four actions, no wildcards, with Parameter Store wired for secrets (the token slot exists but v1 runs unauthenticated just fine). SES sandbox is fine when sender and recipient are the same verified address, which skips a production-access request. And the value of a hard line between deterministic logic and model reasoning, so the numbers are trustworthy and the writing is still warm.

The proof it ran without me: I set the EventBridge schedule to fire at 8:07 PM, stepped away, and it went off on its own. It pulled all 49 repos, Nova wrote the brief, and SES delivered it in about 4 seconds, with the CloudWatch timestamp and the email to match. That was a real scheduled trigger, not a button, which is the whole point of the challenge. With autonomy proven, I set the production schedule to 6 AM Pacific daily. The verbatim CloudWatch logs, timestamps, and request IDs are in PROOF.md.