feat: Phase 1 AWS depth & stabilization for v1.0

[skyoo2003]

Advances the four open Phase 1 (AWS Depth & Stabilization) roadmap items toward a stable v1.0. Scoped as a stabilization release, not a complete-every-operation one.

Unimplemented-op behavior (fix)

• Unknown operations now return an AWS InvalidAction error (HTTP 400) instead of a false 200 OK {} success, so SDKs no longer see a phantom success. Affects 11 services: glue, sagemaker, iot, backup, apigatewayv2, configservice, codebuild, codedeploy, codepipeline, cognito-idp, iotwireless. Tests that asserted the old behavior were updated.
• Removed the dead, unregistered STS provider stub (internal/services/sts) — STS is served by the IAM package.

Compatibility (fix + tests)

• Fixed X-Amz-Target routing for services with dotted target prefixes (CodeConnections, DMS) that previously misrouted to CloudTrail via an overbroad com prefix match; now routes by the last dotted prefix segment.
• Enabled and added boto3 compatibility tests for CodeConnections, DMS, and Verified Permissions (registered but never enabled — hence never tested).
• Added a regression test locking the unimplemented-op fix.
• Compatibility suite: 717 → 729 tests, all green.

Plugin API (docs + test)

• Documented the stable ServicePlugin contract in docs/plugin-api.md — method contracts, config keys, error convention, and the v1.x stability policy — enforced by a conformance test over every registered service. Added RegisteredServices() / Construct() registry accessors.

Docs

• Corrected service/operation counts and the unverifiable ~96% claim in README, services-matrix, and roadmap; ticked roadmap items 1–3; removed stale edge-case prose.
• Added unreleased Changie fragments.

Verification

go build ./..., go vet ./..., go test ./..., and make test-compat (729 passed) all green.

Not included

No release cut — tagging v1.0 remains a separate maintainer step per docs/release.md.

[sourcery-ai]

Reviewer's Guide

Stabilization-focused v1.0 prep that standardizes unimplemented-op behavior to return AWS-style InvalidAction errors, fixes X-Amz-Target routing (including DMS/CodeConnections), documents and enforces the stable ServicePlugin API, enables three additional services in the boto3 compatibility suite, and refreshes service/coverage documentation and changelog fragments.

File-Level Changes

Change	Details	Files
Add registry helpers and a conformance test to lock down the stable ServicePlugin API surface for all services.	Introduce Registry.RegisteredServices() to list all registered service IDs in sorted order. Introduce Registry.Construct() to build a plugin instance from its factory without Init, for introspection/testing. Add TestServicePluginConformance in cmd/devcloud to validate all registered plugins’ ServiceID/ServiceName/Protocol invariants against a closed set of protocols. Document the ServicePlugin contract, configuration, error conventions, and v1.x stability guarantees in docs/plugin-api.md and link it from architecture and contributing docs.	internal/plugin/registry.go cmd/devcloud/conformance_test.go docs/plugin-api.md docs/architecture.md docs/contributing.md
Standardize behavior of unimplemented operations to return AWS InvalidAction errors instead of false 200 successes, and lock this in with tests.	Change default cases in multiple service providers to return shared.JSONError("InvalidAction", ...) with HTTP 400 instead of 200 OK empty bodies. Update Glue, SageMaker, IoT, IoT Wireless, CodeBuild, CodeDeploy, CodePipeline, Cognito IDP, Backup, ConfigService, and APIGatewayv2 tests to assert 400/InvalidAction for stub/unknown operations. Add a compatibility regression test file ensuring representative unimplemented operations across services raise botocore ClientError. Clarify docs to state that less-common operations now return a clean AWS error rather than a silent success.	internal/services/apigatewayv2/provider.go internal/services/backup/provider.go internal/services/codebuild/provider.go internal/services/codedeploy/provider.go internal/services/codepipeline/provider.go internal/services/cognitoidentityprovider/provider.go internal/services/configservice/provider.go internal/services/glue/provider.go internal/services/iot/provider.go internal/services/iotwireless/provider.go internal/services/sagemaker/provider.go internal/services/glue/provider_test.go internal/services/sagemaker/provider_test.go internal/services/iot/provider_test.go internal/services/iotwireless/provider_test.go internal/services/codebuild/provider_test.go internal/services/codedeploy/provider_test.go tests/compatibility/test_unimplemented_ops.py docs/services-matrix.md README.md docs/roadmap.md changes/unreleased/Fixed-20260718-150000.yaml
Fix X-Amz-Target routing for dotted target prefixes and normalize DMS IDs so requests route to the correct service instead of CloudTrail.	Update serviceFromTarget to strip the operation name using the last '.', then take the last dotted segment of the prefix to derive the ServiceName_Date token, handling prefixes like com.amazonaws.codeconnections.CodeConnections_20231201. Adjust normalizeServiceID to map AmazonDMS variants to dms and remove the generic com→cloudtrail mapping to avoid misrouting. Add a changelog fragment documenting the X-Amz-Target routing fix.	internal/gateway/protocol.go changes/unreleased/Fixed-20260718-150100.yaml
Enable CodeConnections, DMS, and Verified Permissions services in the default config and cover them with boto3 compatibility tests.	Enable the codeconnections, dms, and verifiedpermissions services in the default YAML with data_dir entries. Add pytest fixtures that create boto3 clients for these services in the compatibility suite conftest. Add focused compatibility test modules for CodeConnections (CRUD on connections), DMS (replication instances/endpoints/account attributes), and Verified Permissions (list_policies and is_authorized). Record these additions in an unreleased Added changelog fragment.	internal/config/default.yaml tests/compatibility/conftest.py tests/compatibility/test_codeconnections.py tests/compatibility/test_dms.py tests/compatibility/test_verifiedpermissions.py changes/unreleased/Added-20260718-150200.yaml
Clean up docs, counts, and dead code to reflect the stabilized v1.0 state and expanded service surface.	Update services-matrix and README to state 104 services, describe the 729-test compatibility suite, and clarify that unimplemented operations yield clean AWS errors and that stats count handlers not distinct operations. Refresh the roadmap to mark Phase 1 items done (error semantics, coverage for newly tested services, stable ServicePlugin API) and clarify that v1.0 release is pending tagging. Add a link to Plugin API docs in README and adjust contributing guidance to reference the documented contract. Remove the unused STS provider implementation and its blank import, relying on IAM-backed STS only. Add unreleased changie fragments for Added/Removed items.	docs/services-matrix.md README.md docs/roadmap.md cmd/devcloud/imports.go internal/services/sts/provider.go changes/unreleased/Added-20260718-150300.yaml changes/unreleased/Removed-20260718-150400.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 5 issues, and left some high level feedback:

• In TestServicePluginConformance, the hardcoded len(ids) < 90 threshold is a bit brittle (e.g., if services are intentionally reduced or more added later); consider asserting > 0 or deriving the expected minimum from config/metadata instead of a magic number.
• Now that RegisteredServices() returns a sorted slice under an RLock, you might consider copying the map keys under the lock and doing sort.Strings after releasing it to keep lock hold times minimal if the registry grows further.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `TestServicePluginConformance`, the hardcoded `len(ids) < 90` threshold is a bit brittle (e.g., if services are intentionally reduced or more added later); consider asserting `> 0` or deriving the expected minimum from config/metadata instead of a magic number.
- Now that `RegisteredServices()` returns a sorted slice under an `RLock`, you might consider copying the map keys under the lock and doing `sort.Strings` after releasing it to keep lock hold times minimal if the registry grows further.

## Individual Comments

### Comment 1
<location path="internal/plugin/registry.go" line_range="81-88" />
<code_context>
+// without calling Init. Returns nil,false if the service is not registered.
+// Only the metadata methods (ServiceID/ServiceName/Protocol) are guaranteed
+// usable on the returned value; anything requiring state needs Init first.
+func (r *Registry) Construct(serviceID string) (ServicePlugin, bool) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	f, ok := r.factories[serviceID]
+	if !ok {
+		return nil, false
+	}
+	return f(), true
+}
+
</code_context>
<issue_to_address>
**issue (bug_risk):** Avoid calling the factory while holding the registry read lock

Because the `RLock` is held across `f()`, any factory that (directly or indirectly) interacts with the registry (e.g., registers services or calls another method that takes this lock) can deadlock. It also increases lock contention by running arbitrary plugin code under the lock. Please narrow the lock scope so the factory is looked up under `RLock`, then release the lock before invoking `f()`, e.g.:

```go
func (r *Registry) Construct(serviceID string) (ServicePlugin, bool) {
    r.mu.RLock()
    f, ok := r.factories[serviceID]
    r.mu.RUnlock()
    if !ok {
        return nil, false
    }
    return f(), true
}
```

If some read protection must remain, still try to exclude the factory call from the locked region.
</issue_to_address>

### Comment 2
<location path="internal/services/glue/provider_test.go" line_range="56-53" />
<code_context>
 	}
 }

+func assertErr(t *testing.T, resp *plugin.Response) {
+	t.Helper()
+	if resp.StatusCode != 400 {
+		t.Fatalf("expected 400, got %d: %s", resp.StatusCode, string(resp.Body))
+	}
+}
+
</code_context>
<issue_to_address>
**suggestion (testing):** Strengthen `assertErr` to also validate the AWS-style error body, not just the 400 status

Since this now returns an AWS `InvalidAction` error, please also assert the response body matches the expected AWS error shape (e.g. `__type`/`code == "InvalidAction"`) and that the message is non-empty. This will make the tests verify the full behavior, not just the status code.

Suggested implementation:

```golang
func assertErr(t *testing.T, resp *plugin.Response) {
	t.Helper()

	if resp.StatusCode != 400 {
		t.Fatalf("expected 400, got %d: %s", resp.StatusCode, string(resp.Body))
	}

	if len(resp.Body) == 0 {
		t.Fatal("expected non-empty error body")
	}

	var body map[string]any
	if err := json.Unmarshal(resp.Body, &body); err != nil {
		t.Fatalf("expected JSON error body, got %q: %v", string(resp.Body), err)
	}

	code, _ := body["code"].(string)
	if code == "" {
		code, _ = body["__type"].(string)
	}
	if code == "" || !strings.Contains(code, "InvalidAction") {
		t.Fatalf(`expected AWS-style "InvalidAction" error code, got %q (body: %s)`, code, string(resp.Body))
	}

	msg, _ := body["message"].(string)
	if msg == "" {
		msg, _ = body["Message"].(string)
	}
	if strings.TrimSpace(msg) == "" {
		t.Fatalf("expected non-empty error message in AWS error body, got: %s", string(resp.Body))
	}
}

```

You will also need to ensure the following imports are present at the top of `internal/services/glue/provider_test.go`:

- `encoding/json`
- `strings`

For example:

```go
import (
    "encoding/json"
    "strings"
    // existing imports...
)
```

Adjust the import block to match your current formatting and existing imports.
</issue_to_address>

### Comment 3
<location path="internal/services/sagemaker/provider_test.go" line_range="56-53" />
<code_context>
 	}
 }

+func assertErr(t *testing.T, resp *plugin.Response) {
+	t.Helper()
+	if resp.StatusCode != 400 {
+		t.Fatalf("expected 400, got %d: %s", resp.StatusCode, string(resp.Body))
+	}
+}
+
</code_context>
<issue_to_address>
**suggestion (testing):** Mirror Glue tests by asserting the error payload shape for unimplemented SageMaker ops

Since this suite is a regression test for the “unimplemented op returns AWS error” contract, it would be useful for `assertErr` to also inspect `resp.Body` and assert that the error type/code is `InvalidAction` (and ideally that the message references the unknown operation), not just that the status is 400. This will better protect against regressions where the status remains 400 but the payload stops being a valid AWS-style error.

Suggested implementation:

```golang
func assertErr(t *testing.T, resp *plugin.Response) {
	t.Helper()
	if resp.StatusCode != 400 {
		t.Fatalf("expected 400, got %d: %s", resp.StatusCode, string(resp.Body))
	}

	var errResp struct {
		Type    string `json:"__type"`
		Message string `json:"message"`
	}

	if err := json.Unmarshal(resp.Body, &errResp); err != nil {
		t.Fatalf("expected JSON error body, got %q (unmarshal error: %v)", string(resp.Body), err)
	}

	// Mirror Glue tests: error type/code should be InvalidAction for unknown operations
	if !strings.Contains(errResp.Type, "InvalidAction") {
		t.Fatalf("expected error type to contain %q, got %q (body: %q)", "InvalidAction", errResp.Type, string(resp.Body))
	}

	// And the message should mention the unknown operation
	if !strings.Contains(strings.ToLower(errResp.Message), "unknown operation") {
		t.Fatalf("expected error message to mention unknown operation, got %q (body: %q)", errResp.Message, string(resp.Body))
	}
}

```

To compile successfully and match existing Glue tests, ensure the following in `internal/services/sagemaker/provider_test.go`:

1. The imports include:
   - `encoding/json`
   - `strings`

   For example, in the import block:
   ```go
   import (
       "encoding/json"
       "strings"
       // existing imports...
   )
   ```

2. If the Glue tests use a shared helper or a different error shape (e.g. different field names or a namespaced `__type` like `com.amazon.coral.service#InvalidAction`), you may want to:
   - Reuse the same error struct type as in the Glue tests (instead of the inline `errResp` struct).
   - Mirror any additional assertions they make on the error type prefix/suffix to keep the SageMaker tests consistent with Glue.
</issue_to_address>

### Comment 4
<location path="cmd/devcloud/conformance_test.go" line_range="25-34" />
<code_context>
+// package init, so DefaultRegistry holds the full plugin surface. See
+// docs/plugin-api.md for the contract this enforces.
+func TestServicePluginConformance(t *testing.T) {
+	ids := plugin.DefaultRegistry.RegisteredServices()
+	if len(ids) < 90 {
+		t.Fatalf("expected the full service surface to be registered, got only %d", len(ids))
+	}
+
+	for _, id := range ids {
+		p, ok := plugin.DefaultRegistry.Construct(id)
+		if !ok {
+			t.Errorf("%s: registered but Construct returned not-found", id)
+			continue
+		}
+		if got := p.ServiceID(); got != id {
+			t.Errorf("%s: ServiceID() = %q, want the registry key %q", id, got, id)
+		}
+		if p.ServiceName() == "" {
+			t.Errorf("%s: ServiceName() is empty", id)
+		}
+		if proto := p.Protocol(); !validProtocols[proto] {
+			t.Errorf("%s: Protocol() = %q is not a valid ProtocolType", id, proto)
+		}
</code_context>
<issue_to_address>
**suggestion (testing):** Extend the conformance test to assert `RegisteredServices` ordering and non-emptiness semantics

Since `RegisteredServices` is specified to return a sorted list, this test should also assert that `ids` is non-decreasing (e.g., compare each element to the previous). That will make regressions in registry ordering (and any code relying on deterministic iteration) visible here.

Suggested implementation:

```golang
func TestServicePluginConformance(t *testing.T) {
	ids := plugin.DefaultRegistry.RegisteredServices()
	if len(ids) == 0 {
		t.Fatalf("RegisteredServices() returned no services; expected a non-empty, sorted list")
	}
	if len(ids) < 90 {
		t.Fatalf("expected the full service surface to be registered, got only %d", len(ids))
	}

	for i := 1; i < len(ids); i++ {
		if prev, curr := ids[i-1], ids[i]; prev > curr {
			t.Fatalf("RegisteredServices() is not sorted: %q > %q at index %d (full list: %v)", prev, curr, i, ids)
		}
	}

	for _, id := range ids {
		if id == "" {
			t.Errorf("RegisteredServices() contains an empty service ID")
			continue
		}

```

```golang
		p, ok := plugin.DefaultRegistry.Construct(id)

```

```golang
		if proto := p.Protocol(); !validProtocols[proto] {

```
</issue_to_address>

### Comment 5
<location path="tests/compatibility/test_unimplemented_ops.py" line_range="1-10" />
<code_context>
+"""Regression tests: unimplemented operations must return an AWS error, not a
+silent 200 empty-body success. Guards the fix in the services that previously
+returned a false 200 for unknown ops (glue, sagemaker, codebuild, iot, ...)."""
+
+import pytest
+from botocore.exceptions import ClientError
+
+
+def test_glue_unimplemented_op_errors(glue_client):
+    with pytest.raises(ClientError):
+        glue_client.list_workflows()
+
+
+def test_sagemaker_unimplemented_op_errors(sagemaker_client):
+    with pytest.raises(ClientError):
+        sagemaker_client.list_auto_ml_jobs()
+
+
+def test_codebuild_unimplemented_op_errors(codebuild_client):
+    with pytest.raises(ClientError):
+        codebuild_client.list_build_batches()
</code_context>
<issue_to_address>
**suggestion (testing):** Broaden the regression coverage to all services that previously returned false 200s for unknown ops

The tests only cover Glue, SageMaker, and CodeBuild, while the docstring/PR mention additional affected services (IoT, IoTWireless, Backup, ApiGatewayV2, ConfigService, CodeDeploy, CodePipeline, Cognito-IDP). Please add similar `pytest.raises(ClientError)` checks for those clients as well—parameterizing over `(client_fixture, operation_name)` pairs would keep the tests compact and ensure consistent behavior across all listed services.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[skyoo2003]

@sourcery-ai resolve

[skyoo2003]

@sourcery-ai review

[sourcery-ai]

Sorry @skyoo2003, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery