Skip to content

parity: over-wide List summaries, 17 ledgers, 65 declared-unimplemented ops implemented, enumcheck precision - #2471

Open
agbishop wants to merge 206 commits into
mainfrom
chore/parity-sweep-2026-09-18
Open

parity: over-wide List summaries, 17 ledgers, 65 declared-unimplemented ops implemented, enumcheck precision#2471
agbishop wants to merge 206 commits into
mainfrom
chore/parity-sweep-2026-09-18

Conversation

@agbishop

@agbishop agbishop commented Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Parity sweep #4, stacked on #2470 — merge that first; this branch is then rebased onto main (its own commits apply cleanly, the rest are #2470's). ~55 commits, one per service slice.

What changed

Over-wide List responses narrowed to the SDK Summary types (the queue recorded on epic 9x62). ~330 flagged List ops verified member by member across sagemaker, cloudfront, cleanrooms, omics, bedrock, personalize, cloudformation, medialive, vpclattice, waf, glue, ssm, athena, appmesh, codeartifact, wafv2, appconfig, iam, kafka, macie2, transcribe. Real finds: cloudfront's DistributionSummary emitted empty Origins/DefaultCacheBehavior and lacked four required members; omics leaked 14–20 Describe-only members per run item and used source where the SDK reads partSource; bedrock, macie2, sagemaker, ssm (ListOpsMetadata leaked the Get-only map), athena (ListNotebookSessions used the wrong shape) leaked or dropped members; eight cloudfront lists gained the required timestamps.

PARITY ledger burn-downs on the remaining large ledgers: cloudformation, elasticbeanstalk, swf (timers now fire TimerFired), apigateway (GetModel.Flatten $ref resolution, FailOnWarnings), kinesis (ListStreams summaries, SubscribeToShard keep-alive root cause behind the i8q7/j60e flake), cloudtrail, firehose, ecs, s3 (x-amz-grant-* headers build real ACLs; lifecycle transitions honour TransitionDefaultMinimumObjectSize; control-plane checksums verified), cognitoidp, guardduty, xray, memorydb, fsx (data-repository tasks now complete), inspector2, s3control, resourcegroupstaggingapi. Dozens of stale entries removed; the rest tightened to one line each.

cmd/zeroguard now matches Go integer/float widths against the SDK pointer kinds; the 14 rows it uncovered (lambda MemorySize/Timeout and the event-source-mapping window members, kinesis WarmThroughputMiBps, eventbridge RetentionDays — whose >= 0 guard reset retention on every omitted update) are fixed.

Declared-unimplemented ops closed out. A census against every pinned SDK found the repo's sdkcheck.CheckCompleteness gate holding (the acm miss was a one-off) and 65 ops explicitly declared unimplemented across eight services — all now implemented: eventbridge schema discoverers + ExportSchema + registry resource policies, lambda Get/Put/DeleteResourcePolicy, personalize GetActionRecommendations, backup access points, quicksight Q Apps + BatchDescribeUserLimits, iam AcquireRole/GetRoleTemplateVersion/account properties, opensearch-serverless lifecycle policies/collection groups/account settings/policy stats/index CRUD/VPC endpoint CRUD/UpdateCollection, ec2 IPAM internet-registry associations + routing-policy registrations + ReplaceImageInstanceTypeSpecification + ValidateSecurityGroupQuotasForInterface. Every notImplemented list in those services is empty; acm's ListCertificateDomainValidations was added too.

Tools. cmd/enumcheck now resolves each emitted value to its own SDK member's enum (702 accusations → 24 actionable; five real fixes landed: ecr scanning failure code, fsx phantom Lifecycle, kms fabricated KeyState, cloudtrail EventCategory leak, bedrock status split); its SDK struct loader moved to cmd/internal/sdkshape on go/ast, which also fixed structfielddiff silently dropping ~500 sagemaker structs.

Persistence. Zero snapshot version bumps; every new field additive.

Not in this PR

staleclaims on untouched services, the over-wide long tail (services with ≤5 flagged List ops), glue schema-registry compatibility (j1b7 — needs a reachable AWS rule source), Aurora DSQL (7r6bz). The 45 unguarded-winner route pairs were all verified with the real SDK client (none collides; 12 routing tests lock the guards in).

Verification

Per-slice gates on every commit (build, vet, -race tests, persistence guard, golangci-lint, parityfmtcheck); make docs, make bd-audit clean; CI on the branch.

🤖 Generated with Claude Code

Witness Patrol and others added 30 commits September 17, 2026 22:55
Witness Patrol @claude
feat(reqfielddiff): follow computed query keys and chained url.Values…
b2ec744 
… helpers

The query-form recogniser only matched a plain string literal, so every
indexed-list or paginated read in the awsquery / ec2query services still
reported as undeclared: vals.Get(fmt.Sprintf("Filter.%d.Name", i)),
prefix := "ImageCriterion." + strconv.Itoa(i), inline concatenation, and
two-hop helper chains such as rds handleDescribe* → paginateDescribe →
parseDescribePagination.

resolveLiteralPrefix follows Sprintf format strings and concatenation
chains (through a locally tracked prefix) to the literal wire-name
prefix; scanURLValuesFuncBody chases url.Values-forwarding helpers to any
depth, cycle-guarded and gated on the caller's own confirmed url.Values
local, so the single-hop cap that guards against same-named receivers
stays in place elsewhere. A dynamic `for range vals` prefix loop is
reported as form-loop (unresolved) rather than guessed.

ec2 116 → 106, rds 141 → 125, elasticache 28 → 17, neptune 27 → 26,
docdb 22 → 20, autoscaling 11 → 10; repo-wide tier-1 835 → 793 with no
new findings. Every ec2/rds drop spot-checked as read and applied; the
remaining ones spot-checked as genuine gaps.

Refs: gopherstack-99nj

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuRbN6tdkW27u2PFP46N1m
Witness Patrol @claude
fix(eks,cognitoidp,mq,codebuild,s3control,guardduty): 17 dropped requ…
b95aa66 
…est parameters honoured

Non-query services ranked by cmd/reqfielddiff after its recogniser pass.

- eks: CreateCluster DeletionProtection is enforced on DeleteCluster,
  Logging is applied at create, UpgradePolicy is stored and echoed
  (EXTENDED default); DescribeClusterVersions DefaultOnly filters;
  UpdateNodegroupVersion ReleaseVersion is applied.
- cognitoidp: Create/UpdateUserPoolClient DefaultRedirectURI,
  ReadAttributes, WriteAttributes are stored and echoed; CreateUserPool
  Schema keeps custom:/dev:-prefixed attributes.
- mq: DescribeBrokerEngineTypes / DescribeBrokerInstanceOptions paginate
  on MaxResults; DescribeSharedResources validates NextToken.
- codebuild: DescribeTestCases paginates; ImportSourceCredentials
  ShouldOverwrite=false rejects a re-import.
- s3control: GetDataAccess DurationSeconds / Privilege are validated.
- guardduty: ListDetectors MaxResults / NextToken were never threaded
  through the dispatch chain.

Nine members recorded as gaps in PARITY.md; thirty-nine findings were
already read through shapes the tool cannot see (WrapOp bound to a
handler method, embedded struct promotion, inline URL.Query reads —
noted on gopherstack-99nj).

Inventory: additive eks and cognitoidp rows, no version bump.

Refs: gopherstack-xhu2t

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuRbN6tdkW27u2PFP46N1m
Witness Patrol @claude
fix(rds): 100 dropped request parameters honoured; VpcSecurityGroupId…
014b0aa 
…s read with the wrong key

cmd/reqfielddiff tier-1 for rds 125 → 25 after the query-form recogniser
made the count real.

- Twenty-three Describe ops accepted MaxRecords / Marker and returned
  everything; all now go through the package's paginateDescribe helper.
  DescribeDBClusterParameters Source filters on the modelled source.
- Seventy-six create / modify / restore members across DBCluster,
  DBInstance, GlobalCluster, DBProxy and DBProxyEndpoint,
  CustomDBEngineVersion, DescribeDBEngineVersions DefaultOnly,
  ModifyCertificates and StartActivityStream are declared, applied and
  described back with their documented defaults.
- Create/ModifyDBInstance read VpcSecurityGroupIds list items as
  VpcSecurityGroupID; the wire key is VpcSecurityGroupId
  (serializers.go:12323), so every real client's security groups were
  dropped. Fixed at all five call sites; two raw-form fixtures that
  pinned the wrong key were corrected.

Twenty-five members recorded as gaps in PARITY.md (Secrets-Manager-backed
master password, cross-account snapshot sharing, engine catalogs, RDS
Custom, tenant snapshots, blue/green switchover timeout).

Inventory: additive rds rows, no version bump.

Refs: gopherstack-xhu2t

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuRbN6tdkW27u2PFP46N1m
Witness Patrol @claude
fix(ec2): filters, pagination and attributes on fourteen ops; per-ENI…
034b9d0 
… security groups

cmd/reqfielddiff tier-1 for ec2 106 → 89.

- DescribeCapacityReservations, DescribeTransitGateways,
  DescribeTransitGatewayRouteTables, DescribeLaunchTemplateVersions and
  DescribeReservedInstancesOfferings now honour Filter.N through
  parseEC2Filters for the filter names their Input docs list.
- CreateCapacityReservation InstanceMatchCriteria / Tenancy;
  Create/UpdateInterruptibleCapacityReservationAllocation
  ZeroSizePreference (retain vs cancel at zero, observable status);
  CreateTransitGatewayConnectPeer TransitGatewayAddress (explicit or
  auto-assigned from the TGW CIDR); CreateLaunchTemplateVersion
  SourceVersion inherits through resolveLaunchTemplateVersion;
  DescribeReservedInstancesOfferings InstanceTenancy / Min/MaxDuration;
  CreateVpcPeeringConnection PeerOwnerId / PeerRegion; CreateVpnGateway
  AmazonSideAsn.
- ModifyInstanceAttribute Groups and ModifyNetworkInterfaceAttribute
  Groups now track security groups per ENI, closing a deferred gap.

Recorded: ModifyCapacityReservation Accept (documented Reserved),
ResolveAlias (no SSM AMI resolution), MaxInstanceCount, GetConsoleOutput
Latest. Families not yet reached are listed in PARITY.md. cloudformation's
VPN gateway resource follows the CreateVpnGateway signature.

Inventory: additive ec2 rows, no version bump.

Refs: gopherstack-xhu2t

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuRbN6tdkW27u2PFP46N1m
Witness Patrol @claude
fix(ec2): images, volumes, IPAM, Client VPN, VPN, Traffic Mirror, VPC…
90f1e42 
… endpoints, Spot — 40 dropped parameters and four real bugs

cmd/reqfielddiff tier-1 for ec2 89 → 49.

Real bugs surfaced while wiring the fields through the real client:
- DescribeImages rendered the owner under a fabricated ownerId key; the
  wire is imageOwnerId / imageOwnerAlias, so Owner.N filtering could never
  have matched.
- DeleteIpam deleted non-empty IPAMs unconditionally; without Cascade it
  now refuses with DependencyViolation.
- RequestSpotInstances ignored InstanceCount and always created one
  request; one SpotInstanceRequest per instance now.
- AttachNetworkInterface answered NetworkCardIndex 0 regardless of input.

Honoured: DescribeImageReferences ResourceType / IncludeAllResourceTypes;
DescribeImages Owner / IncludeDeprecated; RegisterImage ImdsSupport /
VirtualizationType; AttachVolume EbsCardIndex; ModifyVolume Throughput;
CreateVolume VolumeInitializationRate; Create/ModifyIpam EnablePrivateGua /
MeteredAccount; CreateIpamPool PublicIpSource; ModifyIpamPool
ClearAllocationDefaultNetmaskLength; IPAM prefix-list resolver version
filter; Client VPN DisconnectOnSessionTimeout / EndpointIpAddressType /
TrafficIpAddressType; VPN LocalIpv6NetworkCidr / RemoteIpv6NetworkCidr /
TunnelBandwidth; Traffic Mirror RemoveFields; CreateVpcEndpoint
PolicyDocument / PrivateDnsEnabled / SecurityGroupIds / ServiceRegion and
ModifyVpcEndpoint ResetPolicy; Instance Connect Endpoint IpAddressType /
SecurityGroupIds (never rendered before); Spot AvailabilityZoneGroup /
LaunchGroup / InstanceInterruptionBehavior / ValidUntil;
CreateNetworkInterface InterfaceType; ReplaceRoute LocalTarget.

Recorded as gaps with reasons in PARITY.md (NAT gateway drain, CreateImage
NoReboot / SnapshotLocation, import RoleName, IPAM history window,
ProvisionIpamPoolCidr VerificationMethod, BYOIP PubliclyAdvertisable,
snapshot Location, …); the short remaining tail is listed there too.

Inventory: additive ec2 rows (IpamPool.PublicIPSource is a field rename
with the JSON tag unchanged), no version bump.

Refs: gopherstack-xhu2t

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuRbN6tdkW27u2PFP46N1m
Witness Patrol @claude
fix(redshift,cloudformation): 85 dropped request parameters honoured;…
defe19a 
… DisableRollback and DeletionPolicy finally consulted

cmd/reqfielddiff tier-1: redshift 49 → 2, cloudformation 45 → 7.

redshift: nine Describe ops paginate on MaxRecords / Marker through a new
paginateByMarker helper; seven Cluster members are stored and described
back through create / modify / restore; snapshot retention is validated on
create, modify, delete and restore; DurationSeconds is validated on both
credentials ops; ModifyClusterIamRoles DefaultIamRoleArn; DescribeEvents
Duration; RestoreTableFromClusterSnapshot source / target schema names.
Recorded: GetClusterCredentials DbGroups, EnableCaseSensitiveIdentifier.

cloudformation: CallAs was silently dropped on twenty StackSet ops and is
now validated (enum, DELEGATED_ADMIN requires SERVICE_MANAGED); CreateStack
ResourceTypes / DisableValidation / EnableTerminationProtection /
RetainExceptOnCreate; CreateChangeSet ChangeSetType; ExecuteChangeSet
DisableRollback / RetainExceptOnCreate; ListResourceScans
ResourceScanType and ListResourceScanResources pagination; type-registry
Visibility / ProvisioningType / RegistrationStatusFilter / VersionId /
AcceptTermsAndConditions; GetTemplate TemplateStage validation. Two bugs
surfaced on the way: stack.DisableRollback was stored but never consulted
by provisionResources or the pre-flight failure path, and
rollbackCreateResources force-deleted resources whose DeletionPolicy was
Retain or Snapshot. Recorded: ActivateType AutoUpdate / MajorVersion,
change-set DisableValidation / IncludeNestedStacks / ResourceTypes,
ListResourceScanRelatedResources MaxResults, RollbackStack
RetainExceptOnCreate.

cli_test.go follows the redshift CreateCluster signature. Inventory:
additive redshift and cloudformation rows, no version bump.

Refs: gopherstack-xhu2t

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuRbN6tdkW27u2PFP46N1m
Witness Patrol @claude
test(e2e): follow the redshift CreateClusterOptions signature
2cae855 
The e2e package is behind a build tag, so the redshift options change
compiled everywhere except here.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(parityfmtcheck): match git's exact conflict-marker lines
9e0679b 
A prefix match flagged the 18-'=' rule of a race-detector dump quoted in
lambda's PARITY.md as an unresolved merge conflict. Git's markers are
exactly seven characters: '=======' alone, '<<<<<<<'/'>>>>>>>' plus a label.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(elasticache): 17 dropped request parameters honoured; serverless …
6279ba3 
…pagination used the wrong keys

CreateCacheCluster availability-zone fields, DeleteServerlessCache
FinalSnapshotName, engine-version and parameter filtering,
ModifyCacheCluster AuthToken and security groups, resharding AZ
propagation. DescribeServerlessCache* read Marker/MaxRecords where the
SDK sends NextToken/MaxResults, so pagination never engaged. One gap
recorded (PreferredCacheClusterAZs). Proven with the real client.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(docdb): 18 dropped request parameters honoured; five Describe ops…
cf62578 
… paginate

DBCluster.StorageType, DBInstance PerformanceInsights fields,
DescribeDBEngineVersions.DefaultOnly, ModifyDBInstance
ApplyImmediately/CertificateRotationRestart, RestoreToTime and
UseLatestRestorableTime, and Marker/MaxRecords on five Describe ops.
Four wire fields recorded as gaps: MasterUserSecretKmsKeyId (no
Secrets Manager credential model) and IncludePublic/IncludeShared
(single-account emulator). reqfielddiff tier-1 22 -> 4.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(autoscaling): 8 dropped request parameters honoured; SetDesiredCa…
603121b 
…pacity honours cooldown

HonorCooldown now rejects with ScalingActivityInProgress while the
group's DefaultCooldown window is open, reusing the LastScalingActivity
clock ExecutePolicy already keeps. Also CreateAutoScalingGroup
ServiceLinkedRoleARN, DescribeAutoScalingGroups IncludeInstances,
CancelInstanceRefresh WaitForTransitioningInstances, LaunchInstances
RetryStrategy validation, PutScalingPolicy EstimatedInstanceWarmup and
Enabled, PutWarmPool ReuseOnScaleIn. Proven with the real client.
reqfielddiff tier-1 10 -> 2 (both loop-table reads the tool cannot see).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
refactor(bedrock): delete the AgentsHandler that bedrockagent has sha…
07d7138 
…dowed all along

Every route it registered resolves to services/bedrockagent at a higher
priority, so its 77 ops never executed; 75 exist in bedrockagent by
name, the other two (GetAgentMemory, DeleteAgentMemory) belong to the
unvendored bedrock-agent-runtime API. Snapshot version left at 3: old
snapshots still decode, the dead fields are ignored. clientcoverage
bedrock 179 ops 60.3% -> 108 ops 97.2%. Typed-client smoke over
bedrockagent lists and tags added.

Closes: gopherstack-m2eiu
Closes: gopherstack-aqgw0

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(bd): close m2eiu and aqgw0
91589c1 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(s3): ACL, SSE-KMS encryption context, annotation directive and ob…
064cc83 
…ject ownership honoured on object creation

PutObject, CopyObject and CreateMultipartUpload dropped x-amz-acl and
x-amz-server-side-encryption-context; CreateBucket dropped
x-amz-object-ownership; CopyObject dropped
x-amz-annotation-directive. CreateMultipartUpload never wrote SSE
response headers. Seven wire fields recorded as gaps (Grant* headers,
TransitionDefaultMinimumObjectSize, control-plane ChecksumAlgorithm)
and a stale ListBuckets pagination claim removed. Proven with the real
client; reqfielddiff tier-1 30 -> 26 (four fixes sit in reads the tool
cannot see).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(neptune): 20 dropped request parameters honoured; eight Describe …
b9eff8f 
…ops paginate

CopyDBClusterSnapshot.CopyTags, instance-level DBSecurityGroups,
MonitoringInterval/MonitoringRoleArn, Iops and DBPortNumber,
cluster-inherited BackupRetentionPeriod and VpcSecurityGroupIds,
ModifyDBCluster.DBInstanceParameterGroupName propagated to members,
RestoreDBClusterToPointInTime time-field exclusivity, DefaultOnly and
MaxRecords on the engine-version, parameter, global-cluster, orderable
and maintenance Describe ops. Recorded: IncludePublic/IncludeShared,
DeleteDBInstance final snapshot (no instance snapshot type in the API).
reqfielddiff tier-1 26 -> 4.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(ec2): host placement, flow-log format and interval, spot history …
ab7ac08 
…filter, credit spec and private DNS options honoured

AllocateHosts AutoPlacement/HostRecovery were hardcoded off;
CreateFlowLogs LogFormat/MaxAggregationInterval never read;
DescribeSpotFleetRequestHistory.EventType ignored; RunInstances
CreditSpecification and PrivateDnsNameOptions dropped, the latter also
never rendered on DescribeInstances. Twelve wire fields recorded
(six promoted from notes-only reasoning, six new: MacCredentials,
regional NAT gateway addresses, fleet ValidFrom/Until, Ipv6Native
default subnets, instance BlockDeviceMappings). reqfielddiff tier-1
49 -> 42.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(cloudwatchlogs): FilterLogEvents honours StartFromHead
f3581c8 
The input struct never declared it, so results were always ascending;
a 2026-09-12 note had mislabelled the finding a false positive by
confusing it with GetLogEvents. Direction now rides in the pagination
token, and the documented 2024-01-01 startTime floor for descending
reads is enforced. Two ListAggregateLogGroupSummaries fields recorded.
reqfielddiff tier-1 13 -> 12.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(stepfunctions): GetExecutionHistory.IncludeExecutionData and Vali…
ab7ab29 
…dateStateMachineDefinition options honoured

IncludeExecutionData=false now strips Input/Output from the state and
task event details (copy-on-write). ValidateStateMachineDefinition
validates Severity and Type against their enums and caps diagnostics
at MaxResults with the Truncated output member that was missing from
the wire. TestState InspectionLevel/RevealSecrets recorded: no
inspection-data capture exists. reqfielddiff tier-1 6 -> 2.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(fsx): NetworkType and ImportedFileChunkSize honoured
68e2dcf 
CreateFileSystem.NetworkType defaults to IPV4 and echoes DUAL;
data-repository associations take ImportedFileChunkSize on create
(default 1024) and update. reqfielddiff tier-1 6 -> 3 (rest disclosed).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(cloudwatch): GetMetricStatistics.Unit, widget OutputFormat and fo…
a139bde 
…rm-path StatisticsConfigurations honoured

Unit filtering existed only as an unexported helper; both the form and
CBOR paths now use it. GetMetricWidgetImage OutputFormat=image/png
returns the raw PNG instead of XML-wrapped base64. PutMetricStream's
StatisticsConfigurations was parsed only on the CBOR path and never
echoed by GetMetricStream over XML. Three fields recorded (linked
accounts, Contributor Insights transformed logs, alarm EvaluationWindow).
reqfielddiff tier-1 6 -> 4.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(sagemakerruntime): InvokeEndpointAsync.Filename shapes OutputLoca…
6119e82 
…tion

The X-Amzn-SageMaker-Filename header was dropped and the output key
hardcoded to "output". InvocationTimeoutSeconds and RequestTTLSeconds
recorded: no async queue exists to time out.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(omics): re-confirm the six recorded request fields at HEAD
d79e061 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(backup): air-gapped vault key, scheduled-run preview, backup opti…
e34fb72 
…ons and start window honoured

CreateLogicallyAirGappedBackupVault.EncryptionKeyArn was dropped;
GetBackupPlan.MaxScheduledRunsPreview now computes real next
occurrences from each rule's cron via pkgs/awscron; StartBackupJob
stores BackupOptions and derives StartBy from StartWindowMinutes.
reqfielddiff tier-1 5 -> 1 (IncludeDeleted already disclosed).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(bedrockagent): OrchestrationType and SkipResourceInUseCheck honoured
61afea0 
Agents carry OrchestrationType (default DEFAULT); DeleteAgent and
DeleteFlow now refuse with ConflictException while an alias routes to
them unless SkipResourceInUseCheck is set, mirroring DeleteAgentVersion.
DeleteAgentActionGroup's flag recorded: action groups are DRAFT-scoped
with no in-use relationship to check. reqfielddiff tier-1 5 -> 1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(efs,cloudcontrol): record TypeVersionId and re-confirm efs find…
366fb49 
…ings at HEAD

cloudcontrol has no private type-version registry, so TypeVersionId on
the five resource ops is recorded rather than fabricated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(wafv2): logging configuration ops honour LogScope and LogType
af20fad 
ResourceArn alone was the lookup key, so a SECURITY_LAMBDA-scope request
resolved the CUSTOMER configuration. Scope is now stored and matched;
invalid enum values are WAFInvalidParameterException. tier-1 4 -> 0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(swf): ReverseOrder on the three List ops and StartAtPreviousStart…
08d1b08 
…edEvent on PollForDecisionTask

PreviousStartedEventId was also always 0; the backend now tracks the
last started decision-task event per execution. tier-1 4 -> 0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(sesv2): suppression list ops honour TenantName
5cad202 
Account-level and tenant suppression lists shared one store, so a
tenant-scoped Put was visible through the account-level Get. Keyed by
(tenant, email) now. tier-1 4 -> 0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(transcribe): StartCallAnalyticsJob.OutputLocation honoured
0bbcc1d 
Bucket-only, folder and fully-specified forms resolved per the SDK doc.
OutputEncryptionKMSKeyId on the three job-start ops recorded: no
response type echoes it. tier-1 4 -> 3.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(macie2): DeleteAllowList honours IgnoreJobChecks
de6fa60 
Deleting a list referenced by a non-terminal classification job is now
ConflictException unless the flag is set. The other three findings are
query and inline-struct reads already in place.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol and others added 30 commits September 19, 2026 10:33
Witness Patrol @claude
test(acm,fis): two acm tests stop racing the auto-validate timer; fis…
fa93861 
… integration skip points at a real issue

The acm tests self-skipped whenever the 100 ms auto-validation won the
race; they now pin the delay and assert PENDING_VALIDATION. The fis
SubscribeToShard-style /tags collision skip cited a non-existent issue;
gopherstack-0y8bi tracks it. 16 of the 36 grep hits were identifiers,
the rest environment-gated with precise messages.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(resiliencehub): CreateResiliencyPolicy no longer requires the Reg…
3c9c665 
…ion disruption type

The Terraform provider marks policy.region optional; a minimal request
was rejected with ValidationException.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(inspector2): account status carries all five resource types
71494ea 
codeRepository and lambdaCode were omitted; the Terraform provider
dereferences all five while polling aws_inspector2_enabler and crashed.

Closes: gopherstack-fndhb

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
test(terraform): fixtures for the thirteen services with no Terraform…
5330e30 
… coverage

accessanalyzer, appmesh, cleanrooms, dax, directconnect, dlm, grafana,
inspector2, networkmanager, resiliencehub, cloudfrontkeyvaluestore,
account and lightsail, applied and destroyed against the Docker image.
Five services have no provider resources (iotwireless, mgn, omics,
opsworks, outposts); qldb is unimplemented. go mod tidy promotes
klauspost/compress to a direct requirement.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(bedrockagent): the /tags matcher no longer claims every unsigned …
9a6116f 
…tag request

When the SigV4 scope named no service, RouteMatcher fell through to a
bare /tags/ prefix and swallowed other services' TagResource calls —
fis's integration test saw 204s from bedrockagent on every run, not
intermittently. The claim now requires a bedrock ARN. The router's
X-Amz-Target fast path is proven race-free by a new interleaved test;
the fis integration test is un-skipped.

Closes: gopherstack-0y8bi

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(bd): close 0y8bi
6c5c494 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(pinpoint): CreateCampaign requires SegmentId
1b9f9d3 
CampaignResponse.SegmentId/SegmentVersion are required members but were
omitted whenever the request left SegmentId out; AWS rejects such a
request, so the emulator now does too.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(route53,verifiedpermissions): confirm every SDK-required output…
f474dc4 
… member is always populated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(codecommit): approval-rule delete responses always carry their re…
2e00051 
…quired id member

DeleteApprovalRuleTemplate and DeletePullRequestApprovalRule dropped
the key entirely on the idempotent already-deleted path; a required
output member must be present even when empty. GetMergeOptions
BaseCommitId recorded (no merge-base algorithm).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(transfer,s3tables): confirm every SDK-required output member is…
4a7682d 
… always populated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(stepfunctions): StopDate set when a snapshot promotes a running e…
75254aa 
…xecution to TIMED_OUT; MapRun counters always present

The third RUNNING-exit transition lived in persistence.go and never
stamped StopDate; a stale "reviewed, not a bug" note is corrected.
DescribeMapRun's required zero-valued counters are no longer omitted.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(guardduty,iam,backup): confirm every SDK-required output member…
576e42c 
… is always populated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
test(integration): full suite green — stale resiliencehub Region case…
75c14a9 
… dropped, fis Kinesis stream name unique per run

The resiliencehub integration test still asserted the Region
disruption type was required after 3c9c665 relaxed it; the fis
throughput test collided with itself under -count. Four shards:
0 failures.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(securityhub,apprunner,databrew,lambda): confirm every SDK-requi…
44bff59 
…red output member is always populated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
docs: regenerate service READMEs and operations badge
9757641 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
perf(ec2): batch tag, security-group and IAM-profile lookups in Descr…
a83673c 
…ibeInstances/RunInstances

Each instance in a result took three separate backend RLocks (TagsForResource,
DescribeSecurityGroups, DescribeIamInstanceProfileAssociations), and the tag
lookup ran again inside filter evaluation. One snapshot per request now serves
all instances; wire output is byte-identical (golden test).

BenchmarkDescribeInstances_1000: 14.8ms -> 9.8ms, 15681 -> 9729 allocs/op.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(batch): ListJobs summaries carry jobDefinition, shareIdentifier a…
00f7085 
…nd arrayProperties

Sourced on the Job model but never emitted; the SDK JobSummary declares all three.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(servicediscovery): List summaries emit CreatedByAccount and Resou…
4c4f983 
…rceOwner

ListInstances/ListServices items now carry CreatedByAccount; ListInstances,
ListNamespaces and ListServices return the top-level ResourceOwner the SDK declares.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(emrserverless): ListJobRuns emits type and attempt timestamps; jo…
ba296ca 
…b-run attempts carry Type

JobRunSummary.type is derived from the JobDriver union; attemptCreatedAt/attemptUpdatedAt
and JobRunAttemptSummary.Type were declared by the SDK but never set.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(directoryservice,grafana,dynamodb): confirm List summaries matc…
9ccfc15 
…h the SDK shapes

No over-wide members; the few absent optional members are unsourced gaps recorded in PARITY.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(bd): record goroutine-launch audit results on gopherstack-1x2u0
cab1036 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(inspector2): UpdateOrganizationConfiguration rejects a missing au…
c0f51c0 
…toEnable

The SDK declares AutoEnable required on both input and output; persisting a
nil map echoed a null required member back. ValidationException now.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(vpclattice,appmesh,amplify): confirm every SDK-required output …
24813b4 
…member is always populated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
chore(ce,identitystore,pinpoint,verifiedpermissions): confirm every S…
0b11fe6 
…DK-required output member is always populated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(dax): cluster and node transitions promote on a persisted deadlin…
b42c0fe 
…e instead of sleeping goroutines

CreateCluster/DeleteCluster/Increase-/DecreaseReplicationFactor/RebootNode
each launched an untracked one-second goroutine, with CreateCluster and
DeleteCluster short-circuited by a DAX_TEST_SYNC env var in production code.
A TransitionDeadline (RebootDeadline on nodes) is stored instead and a lazy
sweep promotes past-deadline clusters on every op, so the ~1s creating/
modifying/rebooting/deleting window is unchanged, snapshot restore no longer
force-promotes mid-transition clusters, and goleak now guards the package.
Additive snapshot fields; version unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
docs: regenerate ec2 README; record dax progress on gopherstack-1x2u0
176ddc7 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
perf(dynamodb): drop the redundant attribute unwrap in Query/Scan sor…
b36537d 
…t keys; add golden and benchmark coverage

ParseNumeric/ToString already unwrap, so the outer UnwrapAttributeValue in
sortCandidates/populateScanSortEntry was pure overhead (~1.9s of 8.8s in
sortScanResults on the pgoload profile). Golden byte-equality tests for
Query/Scan/TransactWriteItems and standing handler-path benchmarks added.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
fix(networkmanager): DescribeGlobalNetworks omits unknown ids instead…
c52be5c 
… of returning ResourceNotFoundException

The Terraform provider's findGlobalNetworks relies on an empty result to
detect a deleted global network; the 404 broke every destroy wait and
refresh after deletion. Matches the sibling GetSites/GetDevices/GetLinks.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
test(terraform): fixture for accessanalyzer, appmesh, cleanrooms, clo…
62e6a15 
…udfrontkeyvaluestore, dlm, grafana, lightsail, networkmanager and inspector2

21 resources across nine services that had no provider coverage; apply,
empty re-plan and destroy all pass against the emulator.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Witness Patrol @claude
perf(s3): gzip at BestSpeed and pre-size body buffers from Content-Le…
ee9fec0 
…ngth

assembleMultipartData spent 89% of its time in gzip DefaultCompression, and
every part or object above the 64KiB pool retention cap re-grew its buffer
from empty on each request. Compression is an internal storage format
(GetObject always returns the original bytes), and the pre-size hint is
capped at 8MiB so a spoofed Content-Length cannot force a large allocation.

CompleteMultipartUpload 5MiB: 19.1ms -> 10.6ms; PutObject 64KiB: -25%.
Golden byte-equality tests cover GetObject (compressed and multipart),
HeadObject and ListObjectsV2.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@agbishop @github-advanced-security